Trojan/Rustok-N Removal?
Wow. I have this damn thing in my computer and Malware and Sypbot and my AntiVirus programs will not work. Can someone please help me? I searched and have the following to post.. I did download the DDS and Gmer to my desktop and await any help..here is the DDS txt
DS (Ver_09-07-30.01) - NTFSx86
Run by harry at 9:21:05.20 on Mon 08/24/2009
Internet Explorer: 6.0.2900.2180
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.2038.1513 [GMT -6:00]
AV: AntiVir Desktop *On-access scanning enabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
============== Running Processes ===============
D:\WINDOWS\system32\svchost -k DcomLaunch
D:\WINDOWS\system32\svchost -k rpcss
D:\WINDOWS\System32\svchost.exe -k netsvcs
D:\Program Files\Intel\Wireless\Bin\EvtEng.exe
D:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
D:\WINDOWS\system32\svchost.exe -k NetworkService
D:\WINDOWS\system32\svchost.exe -k LocalService
D:\WINDOWS\Explorer.EXE
D:\WINDOWS\system32\spoolsv.exe
D:\Program Files\Avira\AntiVir Desktop\sched.exe
D:\Program Files\Avira\AntiVir Desktop\avguard.exe
D:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
D:\Program Files\Java\jre6\bin\jqs.exe
D:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
D:\Program Files\Spyware Doctor\pctsAuxs.exe
D:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
D:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
D:\Program Files\Intel\Wireless\Bin\EOUWiz.exe
D:\WINDOWS\system32\igfxpers.exe
D:\WINDOWS\system32\WDBtnMgr.exe
D:\Program Files\Java\jre6\bin\jusched.exe
D:\WINDOWS\RTHDCPL.EXE
D:\Program Files\Avira\AntiVir Desktop\avgnt.exe
D:\Program Files\Spyware Doctor\pctsTray.exe
D:\WINDOWS\system32\svchost.exe -k imgsvc
D:\DOCUME~1\harry\LOCALS~1\Temp\RtkBtMnt.exe
D:\WINDOWS\System32\alg.exe
D:\WINDOWS\system32\wscntfy.exe
D:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe
D:\Program Files\Spyware Doctor\pctsSvc.exe
D:\Program Files\SpyNoMore\SNM.exe
D:\WINDOWS\system32\msdesk.exe
D:\WINDOWS\msgdop.exe
D:\WINDOWS\system32\SNDVOL32.EXE
D:\Program Files\internet explorer\iexplore.exe
D:\Program Files\Internet Explorer\iexplore.exe
D:\Documents and Settings\harry\Desktop\dds.com
D:\WINDOWS\system32\wbem\wmiprvse.exe
============== Pseudo HJT Report ===============
uStart Page = hxxp://mail.google.com/mail/?ui=1
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - d:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - d:\progra~1\vstplu~1\spybot~1\SDHelper.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - d:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - d:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: {55FAF0F2-44D4-425F-B5F5-6B275B621EAB} - No File
uRun: [SpybotSD TeaTimer] d:\program files\spybot - search & destroy\TeaTimer.exe
uRun: [Uniblue RegistryBooster 2] d:\program files\uniblue\registrybooster 2\RegistryBooster.exe /S
mRun: [IntelZeroConfig] "d:\program files\intel\wireless\bin\ZCfgSvc.exe"
mRun: [IntelWireless] "d:\program files\intel\wireless\bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
mRun: [EOUApp] "d:\program files\intel\wireless\bin\EOUWiz.exe"
mRun: [igfxtray] d:\windows\system32\igfxtray.exe
mRun: [igfxhkcmd] d:\windows\system32\hkcmd.exe
mRun: [igfxpers] d:\windows\system32\igfxpers.exe
mRun: [QuickTime Task] "d:\program files\quicktime\qttask.exe" -atboottime
mRun: [WD Button Manager] WDBtnMgr.exe
mRun: [eDataSecurity Loader] c:\acer\empowering technology\edatasecurity\eDSloader.exe
mRun: [Adobe Photo Downloader] "d:\program files\adobe\photoshop elements 5.0\apdproxy.exe"
mRun: [ISUSPM] "d:\program files\common files\installshield\updateservice\ISUSPM.exe" -scheduler
mRun: [Adobe Reader Speed Launcher] "d:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [SunJavaUpdateSched] "d:\program files\java\jre6\bin\jusched.exe"
mRun: [RTHDCPL] RTHDCPL.EXE
mRun: [NeroFilterCheck] d:\windows\system32\NeroCheck.exe
mRun: [avgnt] "d:\program files\avira\antivir desktop\avgnt.exe" /min
mRun: [ISTray] "d:\program files\spyware doctor\pctsTray.exe"
mRun: [SNM] d:\program files\spynomore\SNM.exe /startup
mRun: [MS Desktop] d:\windows\system32\msdesk.exe
mExplorerRun: [Lsass Service] d:\documents and settings\harry\application data\microsoft\windows\lsass.exe
StartupFolder: d:\docume~1\harry\startm~1\programs\startup\datewi~1.lnk - d:\program files\bizware magic datewise\DATEwise3.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - d:\program files\messenger\msmsgs.exe
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - d:\progra~1\vstplu~1\spybot~1\SDHelper.dll
Trusted Zone: beatport.com\www
DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} - hxxp://www.apple.com/qtactivex/qtplugin.cab
DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} - hxxp://go.divx.com/plugin/DivXBrowserPlugin.cab
DPF: {73ECB3AA-4717-450C-A2AB-D00DAD9EE203} - hxxp://h20270.www2.hp.com/ediags/gmn2/install/HPProductDetection2.cab
DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} - hxxp://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab
DPF: {CAFEEFAC-0014-0002-0015-ABCDEFFEDCBA}
DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}
DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553525000} - hxxp://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
TCP: NameServer = 85.255.112.26,85.255.112.73
TCP: {66A5B27F-5CAD-4B1B-BECE-F550FD5CE025} = 85.255.112.26,85.255.112.73
Notify: igfxcui - igfxdev.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - d:\windows\system32\WPDShServiceObj.dll
SecurityProviders: msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll,
================= FIREFOX ===================
FF - ProfilePath - d:\docume~1\harry\applic~1\mozilla\firefox\profiles\a525am3d.default\
FF - prefs.js: browser.startup.homepage - hxxp://mail.google.com/mail/?ui=1
FF - HiddenExtension: Internal security: No Registry Reference - d:\program files\mozilla firefox\extensions\{4A0EE8BE-5C35-43C0-B5F9-897371B13595}
============= SERVICES / DRIVERS ===============
R0 PCTCore;PCTools KDS;d:\windows\system32\drivers\PCTCore.sys [2009-8-24 130936]
R1 avgio;avgio;d:\program files\avira\antivir desktop\avgio.sys [2009-8-17 11608]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;d:\program files\avira\antivir desktop\sched.exe [2009-8-17 108289]
R2 AntiVirService;Avira AntiVir Guard;d:\program files\avira\antivir desktop\avguard.exe [2009-8-17 185089]
R2 avgntflt;avgntflt;d:\windows\system32\drivers\avgntflt.sys [2009-8-17 55656]
R2 EpmPsd;Acer EPM Power Scheme Driver;d:\windows\system32\drivers\epm-psd.sys [2007-4-14 4096]
R2 EpmShd;Acer EPM System Hardware Driver;d:\windows\system32\drivers\epm-shd.sys [2007-4-14 78208]
R2 sdAuxService;PC Tools Auxiliary Service;d:\program files\spyware doctor\pctsAuxs.exe [2009-8-24 348752]
R2 sdCoreService;PC Tools Security Service;d:\program files\spyware doctor\pctsSvc.exe [2009-8-24 1097096]
S3 a8djavs;a8djavs;d:\windows\system32\drivers\a8djavs.sys [2009-4-17 25600]
S3 a8djusb;a8djusb;d:\windows\system32\drivers\a8djusb.sys [2009-4-17 85504]
S3 Ambfilt;Ambfilt;d:\windows\system32\drivers\Ambfilt.sys [2009-4-7 1684736]
S3 lv321av;Logitech USB PC Camera (VC0321);d:\windows\system32\drivers\lv321av.sys --> d:\windows\system32\drivers\lv321av.sys [?]
S3 MADFU;MADFU;d:\windows\system32\drivers\MADFU.sys [2007-4-14 16512]
S3 MAUSBML;Service for M-Audio Conectiv (WDM);d:\windows\system32\drivers\mausbcv.sys --> d:\windows\system32\drivers\mausbcv.sys [?]
============== File Associations ===============
regfile=regedit.exe "%1" %*
scrfile="%1" %*
=============== Created Last 30 ================
2009-08-24 03:50 30,208 a------- d:\windows\system32\msdesk.exe
2009-08-24 03:50 30,208 a------- d:\windows\msgdop.exe
2009-08-24 03:27 1,152 a------- d:\windows\system32\windrv.sys
2009-08-24 03:27 <DIR> --d----- d:\program files\SpyNoMore
2009-08-24 03:16 34,296 a------- d:\windows\system32\drivers\mbamcatchme.sys
2009-08-24 03:16 17,144 a------- d:\windows\system32\drivers\mbam.sys
2009-08-24 03:16 <DIR> --d----- d:\program files\Malwarebytes' Anti-Malware
2009-08-24 03:10 159,600 a------- d:\windows\system32\drivers\pctgntdi.sys
2009-08-24 03:10 130,936 a------- d:\windows\system32\drivers\PCTCore.sys
2009-08-24 03:10 73,840 a------- d:\windows\system32\drivers\PCTAppEvent.sys
2009-08-24 03:09 64,392 a------- d:\windows\system32\drivers\pctplsg.sys
2009-08-24 03:09 <DIR> --d----- d:\program files\Spyware Doctor
2009-08-24 03:09 <DIR> --d----- d:\docume~1\harry\applic~1\PC Tools
2009-08-24 03:09 <DIR> --d----- d:\docume~1\alluse~1\applic~1\PC Tools
2009-08-24 03:06 <DIR> --d----- d:\docume~1\harry\applic~1\GetRightToGo
2009-08-17 12:07 55,656 a------- d:\windows\system32\drivers\avgntflt.sys
2009-08-17 12:07 <DIR> --d----- d:\program files\Avira
2009-08-17 12:07 <DIR> --d----- d:\docume~1\alluse~1\applic~1\Avira
2009-08-11 00:25 <DIR> --d----- d:\program files\common files\Windows Live
==================== Find3M ====================
2007-10-13 13:58 167 ac------ d:\documents and settings\harry\udownload.dat
2004-02-04 20:53 24,070,405 a------- d:\documents and settings\harry\nero6303.exe
2004-01-31 20:54 331,776 ac------ d:\windows\inf\pdfinst2.exe
============= FINISH: 9:21:27.45 ===============
