virtumonde trojan

xanather · Sep 21, 2008

seems like i am not alone in having this trojan.

this pc has just had a new motherboard and hdd installed after roughly 2 months of being poor and gathering dust.
updated/ran avg antivirus to find a heap of issues then the system restarted partway through the scan (which worries me) though now all "seems" fine when i do scans.
updated/ran spybot to find trojans etc but i just cant kill the buggers.
used to run adaware se free but now i cant seem to find where it can be downloaded for free like it used to be.

this is what spybot keeps finding and cannot remove even after scans with no net connection and restarting..

Search result list ---
Hint of the Day: Click the bar at the right of this to see more information! ()

Virtumonde: [SBI $42352499] User settings (Registry key, nothing done)
HKEY_USERS\S-1-5-21-1935655697-1202660629-725345543-1001\Software\Microsoft\rdfa

Virtumonde: [SBI $47E741CD] Settings (Registry key, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\aoprndtws

--- Spybot - Search & Destroy version: 1.6.0 (build: 20080729) ---

2008-08-14 blindman.exe (1.0.0.8)
2008-01-28 SDDelFile.exe (1.0.2.4)
2008-08-14 SDFiles.exe (1.6.0.4)
2008-08-14 SDMain.exe (1.0.0.6)
2008-08-14 SDShred.exe (1.0.2.3)
2008-08-14 SDUpdate.exe (1.6.0.9)
2008-08-14 SDWinSec.exe (1.0.0.12)
2008-07-30 SpybotSD.exe (1.6.0.31)
2008-08-18 TeaTimer.exe (1.6.2.23)
2008-09-21 unins000.exe (51.49.0.0)
2008-08-14 Update.exe (1.6.0.7)
2008-08-14 advcheck.dll (1.6.1.12)
2007-04-02 aports.dll (2.1.0.0)
2008-06-14 DelZip179.dll (1.79.11.1)
2008-08-14 SDHelper.dll (1.6.0.12)
2008-06-19 sqlite3.dll
2008-08-14 Tools.dll (2.1.5.7)
2008-09-02 Includes\Adware.sbi (*)
2008-09-09 Includes\AdwareC.sbi (*)
2008-06-03 Includes\Cookies.sbi (*)
2008-09-02 Includes\Dialer.sbi (*)
2008-09-09 Includes\DialerC.sbi (*)
2008-07-23 Includes\HeavyDuty.sbi (*)
2008-09-02 Includes\Hijackers.sbi (*)
2008-09-02 Includes\HijackersC.sbi (*)
2008-09-09 Includes\Keyloggers.sbi (*)
2008-09-09 Includes\KeyloggersC.sbi (*)
2004-11-29 Includes\LSP.sbi (*)
2008-09-09 Includes\Malware.sbi (*)
2008-09-16 Includes\MalwareC.sbi (*)
2008-09-03 Includes\PUPS.sbi (*)
2008-09-11 Includes\PUPSC.sbi (*)
2007-11-07 Includes\Revision.sbi (*)
2008-06-18 Includes\Security.sbi (*)
2008-09-03 Includes\SecurityC.sbi (*)
2008-06-03 Includes\Spybots.sbi (*)
2008-06-03 Includes\SpybotsC.sbi (*)
2008-09-02 Includes\Spyware.sbi (*)
2008-09-16 Includes\SpywareC.sbi (*)
2008-06-03 Includes\Tracks.uti
2008-09-16 Includes\Trojans.sbi (*)
2008-09-16 Includes\TrojansC.sbi (*)
2008-03-04 Plugins\Chai.dll
2008-03-05 Plugins\Fennel.dll
2008-02-26 Plugins\Mate.dll
2007-12-24 Plugins\TCPIPAddress.dll

--- System information ---
Windows XP (Build: 2600) Service Pack 2 (5.1.2600)
/ Windows XP / SP3: High Definition Audio Driver Package - KB888111
/ Windows XP / SP3: Windows Installer 3.1 (KB893803)
/ Windows XP / SP3: Update for Windows XP (KB898461)
/ Windows XP / SP3: Update for Windows XP (KB911164)
/ Windows XP / SP4: Security Update for Windows XP (KB953839)

--- Startup entries list ---
Located: HK_LM:Run, 984c6abb
command: rundll32.exe "C:\WINDOWS\system32\vohfbhme.dll",b
file: C:\WINDOWS\system32\vohfbhme.dll
size: 90624
MD5: ABDE3CA2A591EC4462348C8FBC636F72

Located: HK_LM:Run, Ai Nap
command: "C:\Program Files\ASUS\AI Suite\AiNap\AiNap.exe"
file: C:\Program Files\ASUS\AI Suite\AiNap\AiNap.exe
size: 1422848
MD5: 48364668415A3D54DDC52891FEC3D727

Located: HK_LM:Run, AsusServiceProvider
command: C:\Program Files\ASUS\AASP\1.00.05\aaCenter.exe
file: C:\Program Files\ASUS\AASP\1.00.05\aaCenter.exe
size: 591360
MD5: AA81B4424C6FFF0309168BB25A917568

Located: HK_LM:Run, AVG7_CC
command: C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
file: C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
size: 579584
MD5: 25A49E5BFF4E6424FA5E27C81269041D

Located: HK_LM:Run, BM9b7f5927
command: Rundll32.exe "C:\WINDOWS\system32\veaxekgo.dll",s
file: C:\WINDOWS\system32\veaxekgo.dll
size: 0
MD5: D41D8CD98F00B204E9800998ECF8427E
Warning: if the file is actually larger than 0 bytes,
the checksum could not be properly calculated!

Located: HK_LM:Run, JMB36X Configure
command: C:\WINDOWS\system32\JMRaidTool.exe boot
file: C:\WINDOWS\system32\JMRaidTool.exe
size: 385024
MD5: EAAFD8BACFD10B6FDFE0A2E30C4DB1FC

Located: HK_LM:Run, NeroFilterCheck
command: C:\WINDOWS\system32\NeroCheck.exe
file: C:\WINDOWS\system32\NeroCheck.exe
size: 155648
MD5: 3E4C03CEFAD8DE135263236B61A49C90

Located: HK_LM:Run, NvCplDaemon
command: RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
file: C:\WINDOWS\system32\NvCpl.dll
size: 13529088
MD5: 4D8E9C2FB7E234A7FDFA6EC54794217F

Located: HK_LM:Run, NvMediaCenter
command: RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
file: C:\WINDOWS\system32\NvMcTray.dll
size: 86016
MD5: 3BC7B677094A2EF0BDDC3A9375E1F8A2

Located: HK_LM:Run, nwiz
command: nwiz.exe /install
file: C:\WINDOWS\system32\nwiz.exe
size: 1630208
MD5: 3860B249BF5AF7B28D11F2731FCF6088

Located: HK_LM:Run, SoundMAX
command: "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray
file: C:\Program Files\Analog Devices\SoundMAX\Smax4.exe
size: 729088
MD5: 5A25A52B38E8406AAFD2E04325321165

Located: HK_LM:Run, SoundMAXPnP
command: C:\Program Files\Analog Devices\Core\smax4pnp.exe
file: C:\Program Files\Analog Devices\Core\smax4pnp.exe
size: 843776
MD5: 1BE6FBEE744B1F35A8A57D7468DAA686

Located: HK_CU:Run, AVG7_Run
where: .DEFAULT...
command: C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE
file: C:\PROGRA~1\Grisoft\AVG7\avgw.exe
size: 219136
MD5: B331EF4C7437F5093D703340678469EB

Located: HK_CU:Run, CTFMON.EXE
where: .DEFAULT...
command: C:\WINDOWS\system32\CTFMON.EXE
file: C:\WINDOWS\system32\CTFMON.EXE
size: 15360
MD5: 24232996A38C0B0CF151C2140AE29FC8

Located: HK_CU:Run, ctfmon.exe
where: PE_C_NAOMI...
command: C:\WINDOWS\system32\ctfmon.exe
file: C:\WINDOWS\system32\ctfmon.exe
size: 15360
MD5: 24232996A38C0B0CF151C2140AE29FC8

Located: HK_CU:Run, LDM
where: PE_C_NAOMI...
command: C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
file: C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
size: 67128
MD5: F047983972FB1CFAC0B813B195A03033

Located: HK_CU:Run, CTFMON.EXE
where: PE_C_NAOMI.HOME-6A9BCF86F3...
command: C:\WINDOWS\system32\ctfmon.exe
file: C:\WINDOWS\system32\ctfmon.exe
size: 15360
MD5: 24232996A38C0B0CF151C2140AE29FC8

Located: HK_CU:Run, AVG7_Run
where: S-1-5-19...
command: C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE
file: C:\PROGRA~1\Grisoft\AVG7\avgw.exe
size: 219136
MD5: B331EF4C7437F5093D703340678469EB

Located: HK_CU:Run, CTFMON.EXE
where: S-1-5-19...
command: C:\WINDOWS\system32\CTFMON.EXE
file: C:\WINDOWS\system32\CTFMON.EXE
size: 15360
MD5: 24232996A38C0B0CF151C2140AE29FC8

Located: HK_CU:Run, AVG7_Run
where: S-1-5-20...
command: C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE
file: C:\PROGRA~1\Grisoft\AVG7\avgw.exe
size: 219136
MD5: B331EF4C7437F5093D703340678469EB

Located: HK_CU:Run, CTFMON.EXE
where: S-1-5-20...
command: C:\WINDOWS\system32\CTFMON.EXE
file: C:\WINDOWS\system32\CTFMON.EXE
size: 15360
MD5: 24232996A38C0B0CF151C2140AE29FC8

Located: HK_CU:Run, CTFMON.EXE
where: S-1-5-21-1935655697-1202660629-725345543-1001...
command: C:\WINDOWS\system32\ctfmon.exe
file: C:\WINDOWS\system32\ctfmon.exe
size: 15360
MD5: 24232996A38C0B0CF151C2140AE29FC8

Located: HK_CU:Run, SpybotSD TeaTimer
where: S-1-5-21-1935655697-1202660629-725345543-1001...
command: C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
file: C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
size: 1832272
MD5: FFB5BAC9C29303904365640A2E2A6D0C

Located: HK_CU:Run, AVG7_Run
where: S-1-5-18...
command: C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE
file: C:\PROGRA~1\Grisoft\AVG7\avgw.exe
size: 219136
MD5: B331EF4C7437F5093D703340678469EB

Located: HK_CU:Run, CTFMON.EXE
where: S-1-5-18...
command: C:\WINDOWS\system32\CTFMON.EXE
file: C:\WINDOWS\system32\CTFMON.EXE
size: 15360
MD5: 24232996A38C0B0CF151C2140AE29FC8

Located: Startup (user), OneNote 2007 Screen Clipper and Launcher.lnk
where: C:\Documents and Settings\naomi\Start Menu\Programs\Startup...
command: C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
file: C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
size: 98632
MD5: D91AFB6D2A0DA7539B74FB5838775D94

Located: WinLogon, cbXNHArQ
command: cbXNHArQ.dll
file: cbXNHArQ.dll
size: 0
MD5: D41D8CD98F00B204E9800998ECF8427E
Warning: if the file is actually larger than 0 bytes,
the checksum could not be properly calculated!

Located: WinLogon, crypt32chain
command: crypt32.dll
file: crypt32.dll
size: 0
MD5: D41D8CD98F00B204E9800998ECF8427E
Warning: if the file is actually larger than 0 bytes,
the checksum could not be properly calculated!

Located: WinLogon, cryptnet
command: cryptnet.dll
file: cryptnet.dll
size: 0
MD5: D41D8CD98F00B204E9800998ECF8427E
Warning: if the file is actually larger than 0 bytes,
the checksum could not be properly calculated!

Located: WinLogon, cscdll
command: cscdll.dll
file: cscdll.dll
size: 0
MD5: D41D8CD98F00B204E9800998ECF8427E
Warning: if the file is actually larger than 0 bytes,
the checksum could not be properly calculated!

Located: WinLogon, ScCertProp
command: wlnotify.dll
file: wlnotify.dll
size: 0
MD5: D41D8CD98F00B204E9800998ECF8427E
Warning: if the file is actually larger than 0 bytes,
the checksum could not be properly calculated!

Located: WinLogon, Schedule
command: wlnotify.dll
file: wlnotify.dll
size: 0
MD5: D41D8CD98F00B204E9800998ECF8427E
Warning: if the file is actually larger than 0 bytes,
the checksum could not be properly calculated!

Located: WinLogon, sclgntfy
command: sclgntfy.dll
file: sclgntfy.dll
size: 0
MD5: D41D8CD98F00B204E9800998ECF8427E
Warning: if the file is actually larger than 0 bytes,
the checksum could not be properly calculated!

Located: WinLogon, SensLogn
command: WlNotify.dll
file: WlNotify.dll
size: 0
MD5: D41D8CD98F00B204E9800998ECF8427E
Warning: if the file is actually larger than 0 bytes,
the checksum could not be properly calculated!

Located: WinLogon, termsrv
command: wlnotify.dll
file: wlnotify.dll
size: 0
MD5: D41D8CD98F00B204E9800998ECF8427E
Warning: if the file is actually larger than 0 bytes,
the checksum could not be properly calculated!

Located: WinLogon, wlballoon
command: wlnotify.dll
file: wlnotify.dll
size: 0
MD5: D41D8CD98F00B204E9800998ECF8427E
Warning: if the file is actually larger than 0 bytes,
the checksum could not be properly calculated!

--- Browser helper object list ---
{1F52280A-95E2-4D3D-8A6C-4AA7E9009194} ()
location: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
BHO name:
CLSID name:
Path: C:\WINDOWS\system32\
Long name: efcAQJdd.dll

{52bdba98-70e2-4e67-8220-f2a73a9768e4} ({4e8679a3-7a2f-0228-76e4-2e0789abdb25})
location: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
BHO name: {4e8679a3-7a2f-0228-76e4-2e0789abdb25}
CLSID name:
Path: C:\WINDOWS\system32\
Long name: niwvwt.dll
Short name:
Date (created): 21/09/2008 9:05:52 PM
Date (last access): 22/09/2008 5:15:44 AM
Date (last write): 21/09/2008 9:05:52 PM
Filesize: 113152
Attributes: archive
MD5: 4A3B993D03C97F80A624189770885955
CRC32: AB7C1D2F

{53707962-6F74-2D53-2644-206D7942484F} (Spybot-S&D IE Protection)
location: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
BHO name:
CLSID name: Spybot-S&D IE Protection
description: Spybot-S&D IE Browser plugin
classification: Legitimate
known filename: SDhelper.dll
info link: http://spybot.eon.net.au/
info source: Patrick M. Kolla
Path: C:\PROGRA~1\SPYBOT~1\
Long name: SDHelper.dll
Short name:
Date (created): 4/11/2007 2:31:56 AM
Date (last access): 22/09/2008 5:15:46 AM
Date (last write): 14/08/2008 1:39:52 PM
Filesize: 1562448
Attributes: archive
MD5: B0039242FC086A45F65891756BF56D74
CRC32: B61B184B
Version: 1.6.0.12

{98672103-AFBE-4434-92D2-692A124CD60F} ()
location: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
BHO name:
CLSID name:
Path: C:\WINDOWS\system32\
Long name: cbXNHArQ.dll

--- ActiveX list ---
{1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab)
DPF name: System Requirements Lab
CLSID name: System Requirements Lab Class
Installer:
Codebase: http://www.nvidia.com/content/DriverDownload/srl/3.0.0.0/srl_bin/sysreqlab3.cab
Path: C:\WINDOWS\Downloaded Program Files\
Long name: sysreqlab3.dll
Short name: SYSREQ~1.DLL
Date (created): 20/05/2008 8:32:40 PM
Date (last access): 22/09/2008 4:39:36 AM
Date (last write): 20/05/2008 8:32:40 PM
Filesize: 267568
Attributes: archive
MD5: B7AE21C49E0D2F48B6D63BC0BC408AD2
CRC32: E4218836
Version: 3.0.0.0

{74DBCB52-F298-4110-951D-AD2FF67BC8AB} (NVIDIA Smart Scan)
DPF name:
CLSID name: NVIDIA Smart Scan
Installer: C:\WINDOWS\Downloaded Program Files\NvidiaSmartScan.inf
Codebase: http://www.nvidia.com/content/DriverDownload/nforce/NvidiaSmartScan.cab
Path: C:\WINDOWS\DOWNLO~1\
Long name: NvidiaSmartScan.ocx
Short name: NVIDIA~1.OCX
Date (created): 4/10/2007 7:52:18 AM
Date (last access): 22/09/2008 4:39:36 AM
Date (last write): 4/10/2007 7:52:18 AM
Filesize: 323584
Attributes: archive
MD5: B272C8D74949A0BD1E651261691BDE04
CRC32: 882C60E8
Version: 1.0.0.2

--- Process list ---
PID: 0 ( 0) [System]
PID: 608 ( 4) \SystemRoot\System32\smss.exe
size: 50688
PID: 656 ( 608) \??\C:\WINDOWS\system32\csrss.exe
size: 6144
PID: 684 ( 608) \??\C:\WINDOWS\system32\winlogon.exe
size: 502272
PID: 728 ( 684) C:\WINDOWS\system32\services.exe
size: 108032
MD5: C6CE6EEC82F187615D1002BB3BB50ED4
PID: 740 ( 684) C:\WINDOWS\system32\lsass.exe
size: 13312
MD5: 84885F9B82F4D55C6146EBF6065D75D2
PID: 904 ( 728) C:\WINDOWS\system32\svchost.exe
size: 14336
MD5: 8F078AE4ED187AAABC0A305146DE6716
PID: 972 ( 728) C:\WINDOWS\system32\svchost.exe
size: 14336
MD5: 8F078AE4ED187AAABC0A305146DE6716
PID: 1012 ( 728) C:\WINDOWS\System32\svchost.exe
size: 14336
MD5: 8F078AE4ED187AAABC0A305146DE6716
PID: 1092 ( 728) C:\WINDOWS\system32\svchost.exe
size: 14336
MD5: 8F078AE4ED187AAABC0A305146DE6716
PID: 1128 ( 728) C:\WINDOWS\system32\svchost.exe
size: 14336
MD5: 8F078AE4ED187AAABC0A305146DE6716
PID: 1300 ( 728) C:\WINDOWS\system32\spoolsv.exe
size: 57856
MD5: 7435B108B935E42EA92CA94F59C8E717
PID: 1404 ( 728) C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
size: 418816
MD5: 3C7B93F947355E374A49564D0D017B7B
PID: 1436 ( 728) C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
size: 49664
MD5: 30A14F65DB477DC00A64A5A24E96919C
PID: 1472 ( 728) C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
size: 406528
MD5: FC0B2AE890BB0DC8C2306DABEDC8A4BA
PID: 1520 ( 728) C:\WINDOWS\system32\nvsvc32.exe
size: 159812
MD5: 0C41C4ACFE00D826DB479C40C1D9EDC8
PID: 1820 ( 728) C:\WINDOWS\System32\alg.exe
size: 44544
MD5: F1958FBF86D5C004CF19A5951A9514B7
PID: 292 ( 252) C:\WINDOWS\Explorer.EXE
size: 1032192
MD5: A0732187050030AE399B241436565E64
PID: 416 ( 292) C:\Program Files\Analog Devices\SoundMAX\Smax4.exe
size: 729088
MD5: 5A25A52B38E8406AAFD2E04325321165
PID: 512 ( 292) C:\WINDOWS\system32\RUNDLL32.EXE
size: 33280
MD5: DA285490BBD8A1D0CE6623577D5BA1FF
PID: 520 ( 292) C:\WINDOWS\system32\rundll32.exe
size: 33280
MD5: DA285490BBD8A1D0CE6623577D5BA1FF
PID: 536 ( 292) C:\Program Files\Analog Devices\Core\smax4pnp.exe
size: 843776
MD5: 1BE6FBEE744B1F35A8A57D7468DAA686
PID: 556 ( 292) C:\Program Files\ASUS\AASP\1.00.05\aaCenter.exe
size: 591360
MD5: AA81B4424C6FFF0309168BB25A917568
PID: 564 ( 292) C:\Program Files\ASUS\AI Suite\AiNap\AiNap.exe
size: 1422848
MD5: 48364668415A3D54DDC52891FEC3D727
PID: 532 ( 292) C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
size: 579584
MD5: 25A49E5BFF4E6424FA5E27C81269041D
PID: 600 ( 292) C:\WINDOWS\system32\ctfmon.exe
size: 15360
MD5: 24232996A38C0B0CF151C2140AE29FC8
PID: 624 ( 292) C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
size: 1832272
MD5: FFB5BAC9C29303904365640A2E2A6D0C
PID: 1236 ( 292) C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe
size: 4891984
MD5: 9C8F0F34F66BB845B42F70E92A972B5F
PID: 1748 (1236) C:\Program Files\Internet Explorer\iexplore.exe
size: 93184
MD5: E7484514C0464642BE7B4DC2689354C8
PID: 4016 ( 292) C:\Program Files\Internet Explorer\iexplore.exe
size: 93184
MD5: E7484514C0464642BE7B4DC2689354C8
PID: 4 ( 0) System

--- Browser start & search pages list ---
Spybot - Search & Destroy browser pages report, 22/09/2008 5:32:54 AM

HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Local Page
C:\WINDOWS\system32\blank.htm
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Search Page
http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Start Page
http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Local Page
%SystemRoot%\system32\blank.htm
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Search Page
http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Start Page
http://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Default_Page_URL
http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Default_Search_URL
http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Search\SearchAssistant
http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Search\CustomizeSearch
http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm

--- Winsock Layered Service Provider list ---
Protocol 0: MSAFD Tcpip [TCP/IP]
GUID: {E70F1AA0-AB8B-11CF-8CA3-00805F48A192}
Filename: %SystemRoot%\system32\mswsock.dll
Description: Microsoft Windows NT/2k/XP IP protocol
DB filename: %SystemRoot%\system32\mswsock.dll
DB protocol: MSAFD Tcpip [*]

Protocol 1: MSAFD Tcpip [UDP/IP]
GUID: {E70F1AA0-AB8B-11CF-8CA3-00805F48A192}
Filename: %SystemRoot%\system32\mswsock.dll
Description: Microsoft Windows NT/2k/XP IP protocol
DB filename: %SystemRoot%\system32\mswsock.dll
DB protocol: MSAFD Tcpip [*]

Protocol 2: MSAFD Tcpip [RAW/IP]
GUID: {E70F1AA0-AB8B-11CF-8CA3-00805F48A192}
Filename: %SystemRoot%\system32\mswsock.dll
Description: Microsoft Windows NT/2k/XP IP protocol
DB filename: %SystemRoot%\system32\mswsock.dll
DB protocol: MSAFD Tcpip [*]

Protocol 3: RSVP UDP Service Provider
GUID: {9D60A9E0-337A-11D0-BD88-0000C082E69A}
Filename: %SystemRoot%\system32\rsvpsp.dll
Description: Microsoft Windows NT/2k/XP RVSP
DB filename: %SystemRoot%\system32\rsvpsp.dll
DB protocol: RSVP * Service Provider

Protocol 4: RSVP TCP Service Provider
GUID: {9D60A9E0-337A-11D0-BD88-0000C082E69A}
Filename: %SystemRoot%\system32\rsvpsp.dll
Description: Microsoft Windows NT/2k/XP RVSP
DB filename: %SystemRoot%\system32\rsvpsp.dll
DB protocol: RSVP * Service Provider

Protocol 5: MSAFD NetBIOS [\Device\NetBT_Tcpip_{EFBA2002-6656-47B2-9527-338B08EC7B24}] SEQPACKET 0
GUID: {8D5F1830-C273-11CF-95C8-00805F48A192}
Filename: %SystemRoot%\system32\mswsock.dll
Description: Microsoft Windows NT/2k/XP NetBios protocol
DB filename: %SystemRoot%\system32\mswsock.dll
DB protocol: MSAFD NetBIOS *

Protocol 6: MSAFD NetBIOS [\Device\NetBT_Tcpip_{EFBA2002-6656-47B2-9527-338B08EC7B24}] DATAGRAM 0
GUID: {8D5F1830-C273-11CF-95C8-00805F48A192}
Filename: %SystemRoot%\system32\mswsock.dll
Description: Microsoft Windows NT/2k/XP NetBios protocol
DB filename: %SystemRoot%\system32\mswsock.dll
DB protocol: MSAFD NetBIOS *

Protocol 7: MSAFD NetBIOS [\Device\NetBT_Tcpip_{C6AAF02B-09C3-4729-A91C-6F933260A9D5}] SEQPACKET 1
GUID: {8D5F1830-C273-11CF-95C8-00805F48A192}
Filename: %SystemRoot%\system32\mswsock.dll
Description: Microsoft Windows NT/2k/XP NetBios protocol
DB filename: %SystemRoot%\system32\mswsock.dll
DB protocol: MSAFD NetBIOS *

Protocol 8: MSAFD NetBIOS [\Device\NetBT_Tcpip_{C6AAF02B-09C3-4729-A91C-6F933260A9D5}] DATAGRAM 1
GUID: {8D5F1830-C273-11CF-95C8-00805F48A192}
Filename: %SystemRoot%\system32\mswsock.dll
Description: Microsoft Windows NT/2k/XP NetBios protocol
DB filename: %SystemRoot%\system32\mswsock.dll
DB protocol: MSAFD NetBIOS *

Protocol 9: MSAFD NetBIOS [\Device\NetBT_Tcpip_{3A160D02-EA13-4884-B022-2356ADB63605}] SEQPACKET 2
GUID: {8D5F1830-C273-11CF-95C8-00805F48A192}
Filename: %SystemRoot%\system32\mswsock.dll
Description: Microsoft Windows NT/2k/XP NetBios protocol
DB filename: %SystemRoot%\system32\mswsock.dll
DB protocol: MSAFD NetBIOS *

Protocol 10: MSAFD NetBIOS [\Device\NetBT_Tcpip_{3A160D02-EA13-4884-B022-2356ADB63605}] DATAGRAM 2
GUID: {8D5F1830-C273-11CF-95C8-00805F48A192}
Filename: %SystemRoot%\system32\mswsock.dll
Description: Microsoft Windows NT/2k/XP NetBios protocol
DB filename: %SystemRoot%\system32\mswsock.dll
DB protocol: MSAFD NetBIOS *

Namespace Provider 0: Tcpip
GUID: {22059D40-7E9E-11CF-AE5A-00AA00A7112B}
Filename: %SystemRoot%\System32\mswsock.dll
Description: Microsoft Windows NT/2k/XP TCP/IP name space provider
DB filename: %SystemRoot%\system32\mswsock.dll
DB protocol: TCP/IP

Namespace Provider 1: NTDS
GUID: {3B2637EE-E580-11CF-A555-00C04FD8D4AC}
Filename: %SystemRoot%\System32\winrnr.dll
Description: Microsoft Windows NT/2k/XP name space provider
DB filename: %SystemRoot%\system32\winrnr.dll
DB protocol: NTDS

Namespace Provider 2: Network Location Awareness (NLA) Namespace
GUID: {6642243A-3BA8-4AA6-BAA5-2E0BD71FDD83}
Filename: %SystemRoot%\System32\mswsock.dll
Description: Microsoft Windows NT/2k/XP name space provider
DB filename: %SystemRoot%\system32\mswsock.dll
DB protocol: NLA-Namespace

any and all help is much appreciated.

also, can anyone suggest some more/better programs to use to keep both this pc and my girls laptop clean/safe from spyware/virus's etc?

i'm at my wits end after everything that has happened of late (still dont know how this pc got infected with everything after i updated/scanned about 3hours before the hdd died and i dont use any download programs, i dont open suspect emails/attachements, i dont visit dodgey web sites...)

this is a gaming desktop and someone mentioned steelsecurity, but they said i would need to remove the other programs and only run steel. ideas?

any and all help is much appreciated before i launch the laptop and desktop out the window

Shaba · Sep 23, 2008

Hi xanather

We will start with this:

Click here to download HJTInstall.exe

Save HJTInstall.exe to your desktop.
Doubleclick on the HJTInstall.exe icon on your desktop.
By default it will install to C:\Program Files\Trend Micro\HijackThis .
Click on Install.
It will create a HijackThis icon on the desktop.
Once installed, it will launch Hijackthis.
Click on the Do a system scan and save a logfile button. It will scan and the log should open in notepad.
Click on "Edit > Select All" then click on "Edit > Copy" to copy the entire contents of the log.
Come back here to this thread and Paste the log in your next reply.
DO NOT use the AnalyseThis button, its findings are dangerous if misinterpreted.
DO NOT have Hijackthis fix anything yet. Most of what it finds will be harmless or even required.

xanather · Sep 23, 2008

thanks for taking time to help me out shaba.
here's the htj log you requested:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2:16:35 AM, on 24/09/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Analog Devices\SoundMAX\Smax4.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\ASUS\AASP\1.00.05\aaCenter.exe
C:\Program Files\ASUS\AI Suite\AiNap\AiNap.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe
C:\Documents and Settings\pete.HOME-6A9BCF86F3\Desktop\HiJackThis.exe

O2 - BHO: (no name) - {1F52280A-95E2-4D3D-8A6C-4AA7E9009194} - C:\WINDOWS\system32\efcAQJdd.dll (file missing)
O2 - BHO: {4e8679a3-7a2f-0228-76e4-2e0789abdb25} - {52bdba98-70e2-4e67-8220-f2a73a9768e4} - C:\WINDOWS\system32\niwvwt.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {98672103-AFBE-4434-92D2-692A124CD60F} - C:\WINDOWS\system32\cbXNHArQ.dll (file missing)
O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray
O4 - HKLM\..\Run: [JMB36X Configure] C:\WINDOWS\system32\JMRaidTool.exe boot
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [984c6abb] rundll32.exe "C:\WINDOWS\system32\vohfbhme.dll",b
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [AsusServiceProvider] C:\Program Files\ASUS\AASP\1.00.05\aaCenter.exe
O4 - HKLM\..\Run: [Ai Nap] "C:\Program Files\ASUS\AI Suite\AiNap\AiNap.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [BM9b7f5927] Rundll32.exe "C:\WINDOWS\system32\veaxekgo.dll",s
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownload/srl/3.0.0.0/srl_bin/sysreqlab3.cab
O16 - DPF: {74DBCB52-F298-4110-951D-AD2FF67BC8AB} (NVIDIA Smart Scan) - http://www.nvidia.com/content/DriverDownload/nforce/NvidiaSmartScan.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O20 - AppInit_DLLs: niwvwt.dll
O20 - Winlogon Notify: cbXNHArQ - cbXNHArQ.dll (file missing)
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

--
End of file - 4721 bytes

Shaba · Sep 23, 2008

We will begin with ComboFix. Please visit this webpage for download links, and instructions for running the tool:

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

Please ensure you read this guide carefully and install the Recovery Console first.

The Windows Recovery Console will allow you to boot up into a special recovery (repair) mode. This allows us to more easily help you should your computer have a problem after an attempted removal of malware. It is a simple procedure that will only take a few moments of your time.

Once installed, you should see a blue screen prompt that says:

The Recovery Console was successfully installed.

Please continue as follows:

Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix, link
Remember to re-enable them afterwards.
Click Yes to allow ComboFix to continue scanning for malware.

When the tool is finished, it will produce a report for you.

Please include the following reports for further review, and so we may continue cleansing the system:

C:\ComboFix.txt
New HijackThis log.

A word of warning: Please do not run ComboFix on your own. This tool is not a toy and not for everyday use.

xanather · Sep 24, 2008

as requested. hope i got it right and didnt kill anything, kinda half asleep.

ComboFix 08-09-22.06 - pete 2008-09-25 2:24:34.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1482 [GMT 10:00]
Running from: C:\Documents and Settings\pete.HOME-6A9BCF86F3\Desktop\ComboFix.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\DOCUME~1\PETE~1.HOM\LOCALS~1\Temp\tmp1.tmp
C:\DOCUME~1\PETE~1.HOM\LOCALS~1\Temp\tmp2.tmp
C:\WINDOWS\BM9b7f5927.txt
C:\WINDOWS\BM9b7f5927.xml
C:\WINDOWS\cookies.ini
C:\WINDOWS\system32\emhbfhov.ini
C:\WINDOWS\system32\mcrh.tmp

.
((((((((((((((((((((((((( Files Created from 2008-08-24 to 2008-09-24 )))))))))))))))))))))))))))))))
.

2008-09-25 01:21 . 2008-09-25 01:30 <DIR> d-------- C:\WINDOWS\system32\CatRoot_bak
2008-09-25 01:18 . <DIR> C:\WINDOWS\LastGood.Tmp
2008-09-22 04:36 . 2008-06-13 23:10 272,128 --------- C:\WINDOWS\system32\drivers\bthport.sys
2008-09-22 04:36 . 2008-06-13 23:10 272,128 -----c--- C:\WINDOWS\system32\dllcache\bthport.sys
2008-09-22 02:48 . 2008-09-22 02:48 13,646 --a------ C:\WINDOWS\system32\wpa.bak
2008-09-22 02:32 . 2008-09-22 02:35 192 --a------ C:\WINDOWS\wininit.ini
2008-09-22 02:28 . 2004-08-03 23:01 25,856 --a------ C:\WINDOWS\system32\drivers\usbprint.sys
2008-09-22 02:28 . 2004-08-03 23:01 25,856 --a--c--- C:\WINDOWS\system32\dllcache\usbprint.sys
2008-09-22 01:47 . 2008-09-24 02:06 <DIR> dr-h----- C:\$VAULT$.AVG
2008-09-22 01:05 . 2008-09-25 01:17 <DIR> d-------- C:\Documents and Settings\pete.HOME-6A9BCF86F3\Application Data\AVG7
2008-09-22 01:05 . 2008-09-22 01:05 <DIR> d-------- C:\Documents and Settings\LocalService.NT AUTHORITY\Application Data\AVG7
2008-09-22 01:05 . 2008-09-22 01:05 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\Grisoft
2008-09-22 01:05 . 2008-09-22 01:08 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\avg7
2008-09-22 01:05 . 2008-09-22 01:05 499,712 --a------ C:\WINDOWS\system32\msvcp71.dll
2008-09-22 01:05 . 2008-09-22 01:05 348,160 --a------ C:\WINDOWS\system32\msvcr71.dll
2008-09-22 00:48 . 2003-07-18 22:17 5,174 --a------ C:\WINDOWS\system32\nppt9x.vxd
2008-09-22 00:48 . 2005-01-02 13:43 4,682 --a------ C:\WINDOWS\system32\npptNT2.sys
2008-09-22 00:43 . 2008-09-22 00:43 <DIR> d-------- C:\Program Files\SystemRequirementsLab
2008-09-22 00:29 . 2008-09-22 00:29 <DIR> d---s---- C:\Documents and Settings\pete.HOME-6A9BCF86F3\UserData
2008-09-21 22:22 . 2008-09-21 22:22 15,648 --a------ C:\WINDOWS\system32\drivers\NSDriver.sys
2008-09-21 22:22 . 2008-09-21 22:22 15,648 --a------ C:\WINDOWS\system32\drivers\AWRTRD.sys
2008-09-21 22:22 . 2008-09-21 22:22 12,960 --a------ C:\WINDOWS\system32\drivers\AWRTPD.sys
2008-09-21 22:22 . 2008-09-21 22:22 12,632 --a------ C:\WINDOWS\system32\lsdelete.exe
2008-09-21 22:21 . 2008-09-21 22:22 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\Lavasoft
2008-09-21 21:55 . 2008-09-21 21:55 <DIR> d-------- C:\Documents and Settings\pete.HOME-6A9BCF86F3\Application Data\mIRC
2008-09-21 21:51 . 2008-09-21 21:51 <DIR> d-------- C:\Program Files\TeaTimer (Spybot - Search & Destroy)
2008-09-21 21:49 . 2008-09-21 21:57 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\Spybot - Search & Destroy
2008-09-21 21:27 . 2006-01-10 18:50 24,576 -ra------ C:\WINDOWS\system32\AsIO.dll
2008-09-21 21:27 . 2005-12-22 12:22 5,685 -ra------ C:\WINDOWS\system32\drivers\AsIO.sys
2008-09-21 21:27 . 2005-07-05 10:43 5,120 --a------ C:\WINDOWS\system32\drivers\AsInsHelp64.sys
2008-09-21 21:27 . 2005-07-05 10:43 3,328 --a------ C:\WINDOWS\system32\drivers\AsInsHelp32.sys
2008-09-21 21:05 . 2008-09-21 21:05 113,152 --a------ C:\WINDOWS\system32\niwvwt.dll
2008-09-21 21:05 . 2008-09-21 21:05 113,152 --a------ C:\WINDOWS\system32\htqpsicw.dll
2008-09-21 21:03 . 2008-09-22 01:45 2,051 --ahs---- C:\WINDOWS\system32\ddJQAcfe.ini2
2008-09-21 21:03 . 2008-09-22 01:47 2,051 --ahs---- C:\WINDOWS\system32\ddJQAcfe.ini
2008-09-21 20:59 . 2008-09-21 21:20 19,368 --a------ C:\WINDOWS\Ascd_tmp.ini
2008-09-20 18:02 . 2008-09-20 18:02 1,885,464 --a------ C:\WINDOWS\system32\AutoPartNt.exe
2008-09-20 18:02 . 2008-09-20 18:03 1,024 --a------ C:\WINDOWS\system32\AutoPartNt.let
2008-09-20 18:01 . 2008-09-20 18:01 <DIR> d-------- C:\Documents and Settings\LocalService.NT AUTHORITY\Application Data\Acronis
2008-09-20 17:59 . 2008-09-20 17:59 <DIR> d-------- C:\Program Files\Acronis
2008-09-20 17:59 . 2008-09-20 17:59 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\Acronis
2008-09-20 17:59 . 2008-09-20 17:59 441,760 --a------ C:\WINDOWS\system32\drivers\timntr.sys
2008-09-20 17:59 . 2008-09-20 17:59 368,480 --a------ C:\WINDOWS\system32\drivers\tdrpman.sys
2008-09-20 17:59 . 2008-09-20 17:59 132,224 --a------ C:\WINDOWS\system32\drivers\snapman.sys
2008-09-20 17:59 . 2008-09-20 17:59 44,384 --a------ C:\WINDOWS\system32\drivers\tifsfilt.sys
2008-09-20 17:09 . 2008-09-20 17:09 <DIR> d-------- C:\NVIDIA
2008-09-20 17:09 . 2008-05-16 11:48 446,464 --a------ C:\WINDOWS\system32\NVUNINST.EXE
2008-09-20 17:09 . 2008-05-16 14:01 446,464 --a------ C:\WINDOWS\system32\nvudisp.exe
2008-09-20 17:09 . 2008-05-19 18:16 186,407 --a------ C:\WINDOWS\system32\nvapps.nvb
2008-09-20 17:09 . 2008-09-25 02:28 181,423 --a------ C:\WINDOWS\system32\nvapps.xml
2008-09-20 17:09 . 2008-05-16 14:01 18,070 --a------ C:\WINDOWS\system32\nvdisp.nvu
2008-09-20 17:08 . 2004-08-03 23:08 26,496 --a--c--- C:\WINDOWS\system32\dllcache\usbstor.sys
2008-09-20 17:04 . 2008-09-20 17:04 <DIR> d-------- C:\Program Files\Common Files\Ahead
2008-09-20 17:04 . 2008-09-20 17:05 <DIR> d-------- C:\Program Files\Ahead
2008-09-20 17:04 . 2001-07-06 23:41 569,344 -ra------ C:\WINDOWS\system32\imagr5.dll
2008-09-20 17:04 . 2001-07-06 21:44 544,768 -ra------ C:\WINDOWS\system32\imagx5.dll
2008-09-20 17:04 . 2001-07-07 03:24 283,920 -ra------ C:\WINDOWS\system32\ImagXpr5.dll
2008-09-20 17:04 . 2001-07-09 20:50 155,648 -ra------ C:\WINDOWS\system32\NeroCheck.exe
2008-09-20 17:04 . 2001-06-26 17:15 38,912 -ra------ C:\WINDOWS\system32\picn20.dll
2008-09-20 17:01 . 2006-06-02 18:45 385,024 -ra------ C:\WINDOWS\system32\JMRaidTool.exe
2008-09-20 17:01 . 2006-08-04 18:29 43,904 -ra------ C:\WINDOWS\system32\drivers\jraid.sys
2008-09-20 17:01 . 2006-02-07 21:52 6,912 -ra------ C:\WINDOWS\system32\drivers\JGOGO.sys
2008-09-20 17:00 . 2006-07-13 22:11 83,712 -ra------ C:\WINDOWS\system32\drivers\Rtenicxp.sys
2008-09-20 16:55 . 2005-02-25 13:35 22,752 --a------ C:\WINDOWS\system32\spupdsvc.exe
2008-09-19 17:08 . 2008-09-21 21:23 19,697 --a------ C:\WINDOWS\Ascd_log.ini
2008-09-19 17:03 . 2004-04-27 17:26 5,824 --a------ C:\WINDOWS\system32\drivers\ASUSHWIO.SYS
2008-09-19 17:03 . 2004-08-13 12:56 5,810 -ra------ C:\WINDOWS\system32\drivers\ASACPI.sys
2008-09-13 11:30 . 2008-09-20 18:13 <DIR> d-------- C:\Documents and Settings\naomi.HOME-6A9BCF86F3
2008-09-13 10:55 . 2008-09-13 01:06 <DIR> dr------- C:\Documents and Settings\All Users.WINDOWS\Documents
2008-09-13 10:55 . 2006-02-28 22:00 1,086,058 -ra------ C:\WINDOWS\SET20.tmp
2008-09-13 10:55 . 2006-02-28 22:00 1,042,903 -ra------ C:\WINDOWS\SET1D.tmp
2008-09-13 10:55 . 2006-02-28 22:00 14,573 -ra------ C:\WINDOWS\SET68.tmp
2008-09-13 10:55 . 2006-02-28 22:00 13,753 -ra------ C:\WINDOWS\SET2D.tmp
2008-09-13 10:53 . 2008-09-25 02:24 <DIR> d--h----- C:\Documents and Settings\Default User.WINDOWS
2008-09-13 10:53 . 2008-09-13 01:07 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS
2008-09-13 01:16 . 2008-09-22 00:29 <DIR> d-------- C:\Documents and Settings\pete.HOME-6A9BCF86F3
2008-09-13 01:15 . 2008-09-22 01:04 <DIR> d--hs---- C:\Documents and Settings\LocalService.NT AUTHORITY
2008-09-13 01:14 . 2008-09-22 01:04 <DIR> d--hs---- C:\Documents and Settings\NetworkService.NT AUTHORITY
2008-09-13 01:14 . 2008-09-13 01:14 8,192 --a------ C:\WINDOWS\REGLOCS.OLD
2008-09-13 01:13 . 2006-02-28 22:00 28,288 --a--c--- C:\WINDOWS\system32\dllcache\xjis.nls
2008-09-13 01:11 . 2006-02-28 22:00 1,875,968 --a--c--- C:\WINDOWS\system32\dllcache\msir3jp.lex
2008-09-13 01:10 . 2006-02-28 22:00 13,463,552 --a--c--- C:\WINDOWS\system32\dllcache\hwxjpn.dll
2008-09-13 01:09 . 2006-02-28 22:00 2,134,528 --a--c--- C:\WINDOWS\system32\dllcache\smtpsnap.dll
2008-09-13 01:07 . 2008-09-13 01:07 <DIR> d--hs---- C:\Documents and Settings\All Users.WINDOWS\DRM

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-09-23 19:17 --------- d-----w C:\Program Files\Lineage II
2008-09-21 11:58 --------- d-----w C:\Program Files\Spybot - Search & Destroy
2008-09-21 11:58 --------- d-----w C:\Program Files\mIRC
2006-06-23 06:48 32,768 ----a-r C:\WINDOWS\inf\UpdateUSB.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{52bdba98-70e2-4e67-8220-f2a73a9768e4}]
2008-09-21 21:05 113152 --a------ C:\WINDOWS\system32\niwvwt.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2006-02-28 15360]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-08-18 1832272]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"JMB36X Configure"="C:\WINDOWS\system32\JMRaidTool.exe" [2006-06-02 385024]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 155648]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2008-05-16 13529088]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2008-05-16 86016]
"SoundMAXPnP"="C:\Program Files\Analog Devices\Core\smax4pnp.exe" [2006-05-01 843776]
"AsusServiceProvider"="C:\Program Files\ASUS\AASP\1.00.05\aaCenter.exe" [2006-08-03 591360]
"Ai Nap"="C:\Program Files\ASUS\AI Suite\AiNap\AiNap.exe" [2006-08-22 1422848]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2008-09-22 579584]
"nwiz"="nwiz.exe" [2008-05-16 C:\WINDOWS\system32\nwiz.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2006-02-28 15360]
"AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2008-09-22 219136]

C:\Documents and Settings\naomi\Start Menu\Programs\Startup\
OneNote 2007 Screen Clipper and Launcher.lnk - C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE [2006-10-26 98632]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=niwvwt.dll

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\WINDOWS\\system32\\mpxa.exe"=
"C:\\Program Files\\Grisoft\\AVG7\\avginet.exe"=
"C:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe"=
"C:\\Program Files\\Grisoft\\AVG7\\avgcc.exe"=
"C:\\Program Files\\Grisoft\\AVG7\\avgemc.exe"=

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c364d179-5c3e-11dd-b9aa-806d6172696f}]
\Shell\AutoRun\command - E:\ASUSACPI.exe
.
- - - - ORPHANS REMOVED - - - -

BHO-{1F52280A-95E2-4D3D-8A6C-4AA7E9009194} - C:\WINDOWS\system32\efcAQJdd.dll
BHO-{98672103-AFBE-4434-92D2-692A124CD60F} - C:\WINDOWS\system32\cbXNHArQ.dll
HKLM-Run-984c6abb - C:\WINDOWS\system32\vohfbhme.dll
HKLM-Run-BM9b7f5927 - C:\WINDOWS\system32\veaxekgo.dll
ShellExecuteHooks-{98672103-AFBE-4434-92D2-692A124CD60F} - C:\WINDOWS\system32\cbXNHArQ.dll
Notify-cbXNHArQ - cbXNHArQ.dll

.
------- Supplementary Scan -------
.

O16 -: {1E54D648-B804-468d-BC78-4AFFED8E262E} - hxxp://www.nvidia.com/content/DriverDownload/srl/3.0.0.0/srl_bin/sysreqlab3.cab
C:\WINDOWS\Downloaded Program Files\SysReqLab3.osd
C:\WINDOWS\Downloaded Program Files\sysreqlab3.dll
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-09-25 02:28:48
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\WINDOWS\system32\rundll32.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\ComboFix\pv.cfexe
.
**************************************************************************
.
Completion time: 2008-09-25 2:29:39 - machine was rebooted [pete]
ComboFix-quarantined-files.txt 2008-09-24 16:29:37

Pre-Run: 277,132,021,760 bytes free
Post-Run: 278,257,795,072 bytes free

185 --- E O F --- 2008-09-21 20:12:48

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2:31:30 AM, on 25/09/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\ASUS\AASP\1.00.05\aaCenter.exe
C:\Program Files\ASUS\AI Suite\AiNap\AiNap.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\pete.HOME-6A9BCF86F3\Desktop\HiJackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O2 - BHO: {4e8679a3-7a2f-0228-76e4-2e0789abdb25} - {52bdba98-70e2-4e67-8220-f2a73a9768e4} - C:\WINDOWS\system32\niwvwt.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O4 - HKLM\..\Run: [JMB36X Configure] C:\WINDOWS\system32\JMRaidTool.exe boot
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [AsusServiceProvider] C:\Program Files\ASUS\AASP\1.00.05\aaCenter.exe
O4 - HKLM\..\Run: [Ai Nap] "C:\Program Files\ASUS\AI Suite\AiNap\AiNap.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownload/srl/3.0.0.0/srl_bin/sysreqlab3.cab
O16 - DPF: {74DBCB52-F298-4110-951D-AD2FF67BC8AB} (NVIDIA Smart Scan) - http://www.nvidia.com/content/DriverDownload/nforce/NvidiaSmartScan.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O20 - AppInit_DLLs: niwvwt.dll
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

--
End of file - 4329 bytes

Shaba · Sep 24, 2008

Open notepad and copy/paste the text in the codebox below into it:

Code:

File::
C:\WINDOWS\system32\niwvwt.dll
C:\WINDOWS\system32\htqpsicw.dll
C:\WINDOWS\system32\ddJQAcfe.ini2
C:\WINDOWS\system32\ddJQAcfe.ini

Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{52bdba98-70e2-4e67-8220-f2a73a9768e4}]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=-

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"C:\\WINDOWS\\system32\\mpxa.exe"=-

Save this as "CFScript"

Then drag the CFScript into ComboFix.exe as you see in the screenshot below.

This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply together with a new HijackThis log.

Combofix should never take more that 20 minutes including the reboot if malware is detected.
If it does, open Task Manager then Processes tab (press ctrl, alt and del at the same time) and end any processes of findstr, find, sed or swreg, then combofix should continue.
If that happened we want to know, and also what process you had to end.

xanather · Sep 27, 2008

sorry for the delay, been in and out of hospital

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2:23:49 AM, on 28/09/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\ASUS\AASP\1.00.05\aaCenter.exe
C:\Program Files\ASUS\AI Suite\AiNap\AiNap.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\pete.HOME-6A9BCF86F3\Desktop\HiJackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O4 - HKLM\..\Run: [JMB36X Configure] C:\WINDOWS\system32\JMRaidTool.exe boot
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [AsusServiceProvider] C:\Program Files\ASUS\AASP\1.00.05\aaCenter.exe
O4 - HKLM\..\Run: [Ai Nap] "C:\Program Files\ASUS\AI Suite\AiNap\AiNap.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownload/srl/3.0.0.0/srl_bin/sysreqlab3.cab
O16 - DPF: {74DBCB52-F298-4110-951D-AD2FF67BC8AB} (NVIDIA Smart Scan) - http://www.nvidia.com/content/DriverDownload/nforce/NvidiaSmartScan.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O20 - Winlogon Notify: cbXNHArQ - C:\WINDOWS\
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

--
End of file - 4253 bytes

ComboFix 08-09-26.06 - pete 2008-09-28 2:20:04.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1544 [GMT 10:00]
Running from: C:\Documents and Settings\pete.HOME-6A9BCF86F3\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\pete.HOME-6A9BCF86F3\Desktop\CFScript.txt
* Created a new restore point

FILE ::
C:\WINDOWS\system32\ddJQAcfe.ini
C:\WINDOWS\system32\ddJQAcfe.ini2
C:\WINDOWS\system32\htqpsicw.dll
C:\WINDOWS\system32\niwvwt.dll
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\DOCUME~1\PETE~1.HOM\LOCALS~1\Temp\tmp1.tmp
C:\DOCUME~1\PETE~1.HOM\LOCALS~1\Temp\tmp2.tmp
C:\WINDOWS\system32\ddJQAcfe.ini
C:\WINDOWS\system32\ddJQAcfe.ini2
C:\WINDOWS\system32\htqpsicw.dll
C:\WINDOWS\system32\niwvwt.dll

.
((((((((((((((((((((((((( Files Created from 2008-08-27 to 2008-09-27 )))))))))))))))))))))))))))))))
.

2008-09-25 01:21 . 2008-09-25 01:30 <DIR> d-------- C:\WINDOWS\system32\CatRoot_bak
2008-09-22 04:36 . 2008-06-13 23:10 272,128 --------- C:\WINDOWS\system32\drivers\bthport.sys
2008-09-22 04:36 . 2008-06-13 23:10 272,128 -----c--- C:\WINDOWS\system32\dllcache\bthport.sys
2008-09-22 02:48 . 2008-09-22 02:48 13,646 --a------ C:\WINDOWS\system32\wpa.bak
2008-09-22 02:32 . 2008-09-22 02:35 192 --a------ C:\WINDOWS\wininit.ini
2008-09-22 02:28 . 2004-08-03 23:01 25,856 --a------ C:\WINDOWS\system32\drivers\usbprint.sys
2008-09-22 02:28 . 2004-08-03 23:01 25,856 --a--c--- C:\WINDOWS\system32\dllcache\usbprint.sys
2008-09-22 01:47 . 2008-09-24 02:06 <DIR> dr-h----- C:\$VAULT$.AVG
2008-09-22 01:05 . 2008-09-28 01:20 <DIR> d-------- C:\Documents and Settings\pete.HOME-6A9BCF86F3\Application Data\AVG7
2008-09-22 01:05 . 2008-09-22 01:05 <DIR> d-------- C:\Documents and Settings\LocalService.NT AUTHORITY\Application Data\AVG7
2008-09-22 01:05 . 2008-09-22 01:05 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\Grisoft
2008-09-22 01:05 . 2008-09-22 01:08 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\avg7
2008-09-22 01:05 . 2008-09-22 01:05 499,712 --a------ C:\WINDOWS\system32\msvcp71.dll
2008-09-22 01:05 . 2008-09-22 01:05 348,160 --a------ C:\WINDOWS\system32\msvcr71.dll
2008-09-22 00:48 . 2003-07-18 22:17 5,174 --a------ C:\WINDOWS\system32\nppt9x.vxd
2008-09-22 00:48 . 2005-01-02 13:43 4,682 --a------ C:\WINDOWS\system32\npptNT2.sys
2008-09-22 00:43 . 2008-09-22 00:43 <DIR> d-------- C:\Program Files\SystemRequirementsLab
2008-09-22 00:29 . 2008-09-22 00:29 <DIR> d---s---- C:\Documents and Settings\pete.HOME-6A9BCF86F3\UserData
2008-09-21 22:22 . 2008-09-21 22:22 15,648 --a------ C:\WINDOWS\system32\drivers\NSDriver.sys
2008-09-21 22:22 . 2008-09-21 22:22 15,648 --a------ C:\WINDOWS\system32\drivers\AWRTRD.sys
2008-09-21 22:22 . 2008-09-21 22:22 12,960 --a------ C:\WINDOWS\system32\drivers\AWRTPD.sys
2008-09-21 22:22 . 2008-09-21 22:22 12,632 --a------ C:\WINDOWS\system32\lsdelete.exe
2008-09-21 22:21 . 2008-09-21 22:22 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\Lavasoft
2008-09-21 21:55 . 2008-09-21 21:55 <DIR> d-------- C:\Documents and Settings\pete.HOME-6A9BCF86F3\Application Data\mIRC
2008-09-21 21:51 . 2008-09-21 21:51 <DIR> d-------- C:\Program Files\TeaTimer (Spybot - Search & Destroy)
2008-09-21 21:49 . 2008-09-21 21:57 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\Spybot - Search & Destroy
2008-09-21 21:27 . 2006-01-10 18:50 24,576 -ra------ C:\WINDOWS\system32\AsIO.dll
2008-09-21 21:27 . 2005-12-22 12:22 5,685 -ra------ C:\WINDOWS\system32\drivers\AsIO.sys
2008-09-21 21:27 . 2005-07-05 10:43 5,120 --a------ C:\WINDOWS\system32\drivers\AsInsHelp64.sys
2008-09-21 21:27 . 2005-07-05 10:43 3,328 --a------ C:\WINDOWS\system32\drivers\AsInsHelp32.sys
2008-09-21 20:59 . 2008-09-21 21:20 19,368 --a------ C:\WINDOWS\Ascd_tmp.ini
2008-09-20 18:02 . 2008-09-20 18:02 1,885,464 --a------ C:\WINDOWS\system32\AutoPartNt.exe
2008-09-20 18:02 . 2008-09-20 18:03 1,024 --a------ C:\WINDOWS\system32\AutoPartNt.let
2008-09-20 18:01 . 2008-09-20 18:01 <DIR> d-------- C:\Documents and Settings\LocalService.NT AUTHORITY\Application Data\Acronis
2008-09-20 17:59 . 2008-09-20 17:59 <DIR> d-------- C:\Program Files\Acronis
2008-09-20 17:59 . 2008-09-20 17:59 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\Acronis
2008-09-20 17:59 . 2008-09-20 17:59 441,760 --a------ C:\WINDOWS\system32\drivers\timntr.sys
2008-09-20 17:59 . 2008-09-20 17:59 368,480 --a------ C:\WINDOWS\system32\drivers\tdrpman.sys
2008-09-20 17:59 . 2008-09-20 17:59 132,224 --a------ C:\WINDOWS\system32\drivers\snapman.sys
2008-09-20 17:59 . 2008-09-20 17:59 44,384 --a------ C:\WINDOWS\system32\drivers\tifsfilt.sys
2008-09-20 17:09 . 2008-09-20 17:09 <DIR> d-------- C:\NVIDIA
2008-09-20 17:09 . 2008-05-16 11:48 446,464 --a------ C:\WINDOWS\system32\NVUNINST.EXE
2008-09-20 17:09 . 2008-05-16 14:01 446,464 --a------ C:\WINDOWS\system32\nvudisp.exe
2008-09-20 17:09 . 2008-05-19 18:16 186,407 --a------ C:\WINDOWS\system32\nvapps.nvb
2008-09-20 17:09 . 2008-09-28 02:21 181,423 --a------ C:\WINDOWS\system32\nvapps.xml
2008-09-20 17:09 . 2008-05-16 14:01 18,070 --a------ C:\WINDOWS\system32\nvdisp.nvu
2008-09-20 17:08 . 2004-08-03 23:08 26,496 --a--c--- C:\WINDOWS\system32\dllcache\usbstor.sys
2008-09-20 17:04 . 2008-09-20 17:04 <DIR> d-------- C:\Program Files\Common Files\Ahead
2008-09-20 17:04 . 2008-09-20 17:05 <DIR> d-------- C:\Program Files\Ahead
2008-09-20 17:04 . 2001-07-06 23:41 569,344 -ra------ C:\WINDOWS\system32\imagr5.dll
2008-09-20 17:04 . 2001-07-06 21:44 544,768 -ra------ C:\WINDOWS\system32\imagx5.dll
2008-09-20 17:04 . 2001-07-07 03:24 283,920 -ra------ C:\WINDOWS\system32\ImagXpr5.dll
2008-09-20 17:04 . 2001-07-09 20:50 155,648 -ra------ C:\WINDOWS\system32\NeroCheck.exe
2008-09-20 17:04 . 2001-06-26 17:15 38,912 -ra------ C:\WINDOWS\system32\picn20.dll
2008-09-20 17:01 . 2006-06-02 18:45 385,024 -ra------ C:\WINDOWS\system32\JMRaidTool.exe
2008-09-20 17:01 . 2006-08-04 18:29 43,904 -ra------ C:\WINDOWS\system32\drivers\jraid.sys
2008-09-20 17:01 . 2006-02-07 21:52 6,912 -ra------ C:\WINDOWS\system32\drivers\JGOGO.sys
2008-09-20 17:00 . 2006-07-13 22:11 83,712 -ra------ C:\WINDOWS\system32\drivers\Rtenicxp.sys
2008-09-20 16:55 . 2005-02-25 13:35 22,752 --a------ C:\WINDOWS\system32\spupdsvc.exe
2008-09-19 17:08 . 2008-09-21 21:23 19,697 --a------ C:\WINDOWS\Ascd_log.ini
2008-09-19 17:03 . 2004-04-27 17:26 5,824 --a------ C:\WINDOWS\system32\drivers\ASUSHWIO.SYS
2008-09-19 17:03 . 2004-08-13 12:56 5,810 -ra------ C:\WINDOWS\system32\drivers\ASACPI.sys
2008-09-13 11:30 . 2008-09-20 18:13 <DIR> d-------- C:\Documents and Settings\naomi.HOME-6A9BCF86F3
2008-09-13 10:55 . 2008-09-13 01:06 <DIR> dr------- C:\Documents and Settings\All Users.WINDOWS\Documents
2008-09-13 10:55 . 2006-02-28 22:00 1,086,058 -ra------ C:\WINDOWS\SET20.tmp
2008-09-13 10:55 . 2006-02-28 22:00 1,042,903 -ra------ C:\WINDOWS\SET1D.tmp
2008-09-13 10:55 . 2006-02-28 22:00 14,573 -ra------ C:\WINDOWS\SET68.tmp
2008-09-13 10:55 . 2006-02-28 22:00 13,753 -ra------ C:\WINDOWS\SET2D.tmp
2008-09-13 10:53 . 2008-09-25 02:24 <DIR> d--h----- C:\Documents and Settings\Default User.WINDOWS
2008-09-13 10:53 . 2008-09-13 01:07 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS
2008-09-13 01:16 . 2008-09-22 00:29 <DIR> d-------- C:\Documents and Settings\pete.HOME-6A9BCF86F3
2008-09-13 01:15 . 2008-09-22 01:04 <DIR> d--hs---- C:\Documents and Settings\LocalService.NT AUTHORITY
2008-09-13 01:14 . 2008-09-22 01:04 <DIR> d--hs---- C:\Documents and Settings\NetworkService.NT AUTHORITY
2008-09-13 01:14 . 2008-09-13 01:14 8,192 --a------ C:\WINDOWS\REGLOCS.OLD
2008-09-13 01:13 . 2006-02-28 22:00 28,288 --a--c--- C:\WINDOWS\system32\dllcache\xjis.nls
2008-09-13 01:11 . 2006-02-28 22:00 1,875,968 --a--c--- C:\WINDOWS\system32\dllcache\msir3jp.lex
2008-09-13 01:10 . 2006-02-28 22:00 13,463,552 --a--c--- C:\WINDOWS\system32\dllcache\hwxjpn.dll
2008-09-13 01:09 . 2006-02-28 22:00 2,134,528 --a--c--- C:\WINDOWS\system32\dllcache\smtpsnap.dll
2008-09-13 01:07 . 2008-09-13 01:07 <DIR> d--hs---- C:\Documents and Settings\All Users.WINDOWS\DRM

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-09-24 17:53 --------- d-----w C:\Program Files\Lineage II
2008-09-21 11:58 --------- d-----w C:\Program Files\Spybot - Search & Destroy
2008-09-21 11:58 --------- d-----w C:\Program Files\mIRC
2008-08-01 04:28 41,984 ----a-w C:\WINDOWS\system32\mpxa.exe
2008-07-18 12:10 94,920 ----a-w C:\WINDOWS\system32\cdm.dll
2008-07-18 12:10 53,448 ----a-w C:\WINDOWS\system32\wuauclt.exe
2008-07-18 12:10 45,768 ----a-w C:\WINDOWS\system32\wups2.dll
2008-07-18 12:10 36,552 ----a-w C:\WINDOWS\system32\wups.dll
2008-07-18 12:09 563,912 ----a-w C:\WINDOWS\system32\wuapi.dll
2008-07-18 12:09 325,832 ----a-w C:\WINDOWS\system32\wucltui.dll
2008-07-18 12:09 205,000 ----a-w C:\WINDOWS\system32\wuweb.dll
2008-07-18 12:09 1,811,656 ----a-w C:\WINDOWS\system32\wuaueng.dll
2008-07-07 20:32 253,952 ----a-w C:\WINDOWS\system32\es.dll
2006-06-23 06:48 32,768 ----a-r C:\WINDOWS\inf\UpdateUSB.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2006-02-28 15360]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-08-18 1832272]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"JMB36X Configure"="C:\WINDOWS\system32\JMRaidTool.exe" [2006-06-02 385024]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 155648]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2008-05-16 13529088]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2008-05-16 86016]
"SoundMAXPnP"="C:\Program Files\Analog Devices\Core\smax4pnp.exe" [2006-05-01 843776]
"AsusServiceProvider"="C:\Program Files\ASUS\AASP\1.00.05\aaCenter.exe" [2006-08-03 591360]
"Ai Nap"="C:\Program Files\ASUS\AI Suite\AiNap\AiNap.exe" [2006-08-22 1422848]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2008-09-22 579584]
"nwiz"="nwiz.exe" [2008-05-16 C:\WINDOWS\system32\nwiz.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2006-02-28 15360]
"AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2008-09-22 219136]

C:\Documents and Settings\naomi\Start Menu\Programs\Startup\
OneNote 2007 Screen Clipper and Launcher.lnk - C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE [2006-10-26 98632]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\cbXNHArQ]
[BU]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Grisoft\\AVG7\\avginet.exe"=
"C:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe"=
"C:\\Program Files\\Grisoft\\AVG7\\avgcc.exe"=
"C:\\Program Files\\Grisoft\\AVG7\\avgemc.exe"=

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c364d179-5c3e-11dd-b9aa-806d6172696f}]
\Shell\AutoRun\command - E:\ASUSACPI.exe
.
- - - - ORPHANS REMOVED - - - -

BHO-{1F52280A-95E2-4D3D-8A6C-4AA7E9009194} - (no file)
BHO-{52bdba98-70e2-4e67-8220-f2a73a9768e4} - (no file)
BHO-{98672103-AFBE-4434-92D2-692A124CD60F} - (no file)

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-09-28 02:21:53
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\WINDOWS\system32\rundll32.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\ComboFix\pv.cfexe
C:\ComboFix\pv.cfexe
.
**************************************************************************
.
Completion time: 2008-09-28 2:22:39 - machine was rebooted
ComboFix-quarantined-files.txt 2008-09-27 16:22:37
ComboFix2.txt 2008-09-24 16:29:39

Pre-Run: 278,134,865,920 bytes free
Post-Run: 278,215,995,392 bytes free

185 --- E O F --- 2008-09-21 20:12:48

Shaba · Sep 27, 2008

No worries

We need first to disable TeaTimer that it doesn't interfere with fixes. You can re-enable it when you're clean again:

1. Run Spybot-S&D in Advanced Mode.
2. If it is not already set to do this Go to the Mode menu select "Advanced Mode"
3. On the left hand side, Click on Tools
4. Then click on the Resident Icon in the List
5. Uncheck "Resident TeaTimer" and OK any prompts.
6. Restart your computer.

Open HijackThis, click do a system scan only and checkmark this:

O20 - Winlogon Notify: cbXNHArQ - C:\WINDOWS\

Close all windows including browser and press fix checked.

Reboot.

Post back a fresh HijackThis log, please.

xanather · Sep 27, 2008

unable to locate tea timer to disable it =/

Shaba · Sep 27, 2008

Then continue with rest of my instructions, please.

xanather · Sep 28, 2008

found the teatimer checkbox but it didnt bring up any prompts when i disabled it.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:31:48 PM, on 28/09/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\userinit.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\ASUS\AASP\1.00.05\aaCenter.exe
C:\Program Files\ASUS\AI Suite\AiNap\AiNap.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Documents and Settings\pete.HOME-6A9BCF86F3\Desktop\HiJackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O2 - BHO: (no name) - {1F52280A-95E2-4D3D-8A6C-4AA7E9009194} - (no file)
O2 - BHO: (no name) - {52bdba98-70e2-4e67-8220-f2a73a9768e4} - (no file)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {98672103-AFBE-4434-92D2-692A124CD60F} - (no file)
O4 - HKLM\..\Run: [JMB36X Configure] C:\WINDOWS\system32\JMRaidTool.exe boot
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [AsusServiceProvider] C:\Program Files\ASUS\AASP\1.00.05\aaCenter.exe
O4 - HKLM\..\Run: [Ai Nap] "C:\Program Files\ASUS\AI Suite\AiNap\AiNap.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownload/srl/3.0.0.0/srl_bin/sysreqlab3.cab
O16 - DPF: {74DBCB52-F298-4110-951D-AD2FF67BC8AB} (NVIDIA Smart Scan) - http://www.nvidia.com/content/DriverDownload/nforce/NvidiaSmartScan.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

--
End of file - 4304 bytes

Shaba · Sep 28, 2008

Please make sure that all programs are closed when installing Java.

Click here to visit Java's website.
Scroll down to Java Runtime Environment (JRE) 6 Update 7. Click on Download.
Select Windows from the drop-down list for Platform.
Select Multi-language from the drop-down list for Language.
Check (tick) I agree to the Java SE Runtime Environment 6 License Agreement box and click on Continue.
Click on jre-6u7-windows-i586-p.exe link to download it and save this to a convenient location.
Double click on jre-6u7-windows-i586-p.exe to install Java.
After the Java installation has finished, please go to Kaspersky website and perform an online antivirus scan.
Read through the requirements and privacy statement and click on Accept button.
It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
When the downloads have finished, click on Settings.
Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
- Spyware, Adware, Dialers, and other potentially dangerous programs
  Archives
Click on My Computer under Scan.
Once the scan is complete, it will display the results. Click on View Scan Report.
You will see a list of infected items there. Click on Save Report As....
Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button.
Please post this log in your next reply along with a fresh HijackThis log.

If you need a tutorial, see here

xanather · Sep 29, 2008

kaspersky log and hjt log as you asked.

--------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER 7 REPORT
Tuesday, September 30, 2008
Operating System: Microsoft Windows XP Professional Service Pack 2 (build 2600)
Kaspersky Online Scanner 7 version: 7.0.25.0
Program database last update: Monday, September 29, 2008 12:23:18
Records in database: 1273573
--------------------------------------------------------------------------------

Scan settings:
Scan using the following database: extended
Scan archives: yes
Scan mail databases: yes

Scan area - My Computer:
C:\
D:\
E:\
F:\

Scan statistics:
Files scanned: 42011
Threat name: 3
Infected objects: 5
Suspicious objects: 0
Duration of the scan: 00:24:57

File name / Threat name / Threats count
C:\Documents and Settings\Pete\Desktop\mirc631.exe Infected: not-a-virus:Client-IRC.Win32.mIRC.631 1
C:\Program Files\mIRC\mirc.exe Infected: not-a-virus:Client-IRC.Win32.mIRC.631 1
C:\QooBox\Quarantine\C\WINDOWS\system32\htqpsicw.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.efo 1
C:\QooBox\Quarantine\C\WINDOWS\system32\niwvwt.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.efo 1
C:\WINDOWS\system32\mpxa.exe Infected: not-a-virus:Server-Proxy.Win32.3proxy.af 1

The selected area was scanned.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:56:20 AM, on 30/09/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\ASUS\AASP\1.00.05\aaCenter.exe
C:\Program Files\ASUS\AI Suite\AiNap\AiNap.exe
C:\Program Files\Logitech\G-series Software\LGDCore.exe
C:\Program Files\Logitech\G-series Software\LCDMon.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Logitech\G-series Software\Applets\LCDPop3\LCDPOP3.exe
C:\Program Files\Logitech\G-series Software\Applets\LCDCountdown\LCDCountdown.exe
C:\Program Files\Logitech\G-series Software\Applets\LCDMedia.exe
C:\Program Files\Logitech\G-series Software\Applets\LCDClock.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\pete.HOME-6A9BCF86F3\Desktop\HiJackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O2 - BHO: (no name) - {1F52280A-95E2-4D3D-8A6C-4AA7E9009194} - (no file)
O2 - BHO: (no name) - {52bdba98-70e2-4e67-8220-f2a73a9768e4} - (no file)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {98672103-AFBE-4434-92D2-692A124CD60F} - (no file)
O4 - HKLM\..\Run: [JMB36X Configure] C:\WINDOWS\system32\JMRaidTool.exe boot
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [AsusServiceProvider] C:\Program Files\ASUS\AASP\1.00.05\aaCenter.exe
O4 - HKLM\..\Run: [Ai Nap] "C:\Program Files\ASUS\AI Suite\AiNap\AiNap.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [Launch LGDCore] "C:\Program Files\Logitech\G-series Software\LGDCore.exe" /SHOWHIDE
O4 - HKLM\..\Run: [Launch LCDMon] "C:\Program Files\Logitech\G-series Software\LCDMon.exe"
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownload/srl/3.0.0.0/srl_bin/sysreqlab3.cab
O16 - DPF: {74DBCB52-F298-4110-951D-AD2FF67BC8AB} (NVIDIA Smart Scan) - http://www.nvidia.com/content/DriverDownload/nforce/NvidiaSmartScan.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O20 - Winlogon Notify: cbXNHArQ - C:\WINDOWS\
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

--
End of file - 5496 bytes

Shaba · Sep 29, 2008

Empty this folder:
C:\QooBox\Quarantine\

Delete this:
C:\WINDOWS\system32\mpxa.exe

Empty Recycle Bin.

Still problems?

xanather · Sep 29, 2008

call me dumb (or slightly out of it thanks to the medication) but could you shove me in the right direction in finding them? do i go through dos prompt or my computer?

Shaba · Sep 29, 2008

Yes, via My Computer

xanather · Sep 29, 2008

deleted mpxa.exe and deleted what was inside the Quarantine folder then emptied the recycle bin.

i should run avg and spybot now?

Shaba · Sep 29, 2008

Yes, you can do it

xanather · Sep 29, 2008

spybot scan was clean
avg scan found a change c:\WINDOWS\system32\drivers\etc\hosts

this mean i am clean

Shaba · Sep 29, 2008

Yes we can assume so unless you have some symptoms left?

virtumonde trojan

New member

Security Expert: Emeritus

New member

Security Expert: Emeritus

New member

Security Expert: Emeritus

New member

Security Expert: Emeritus

New member

Security Expert: Emeritus

New member

Security Expert: Emeritus

New member

Security Expert: Emeritus

New member

Security Expert: Emeritus

New member

Security Expert: Emeritus

New member

Security Expert: Emeritus