Virtumonde will not go away

madamat · Feb 9, 2008

Hello, Can you please help. When I run Spybot it detects the virus virtumonde. Spybot says it deleted it but the virus keeps coming back after connecting to the internet. I ran the Kaspersky scan and the HJT . The Kaspersky scan log is too long to post but found several problems if you need to see.
Here is the log file from HJT.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 4:15:00 PM, on 2/9/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Dell\Media Experience\DMXLauncher.exe
C:\Program Files\Lexmark 5400 Series\lxctmon.exe
C:\Program Files\Lexmark 5400 Series\ezprint.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\SpiralFrog\Spiralfrog.exe
C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\Program Files\PeoplePC\ISP6530\Browser\Bartshel.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\system32\lxctcoms.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\PeoplePC\ISP6530\Browser\PPShared.exe
C:\Program Files\Google\Google Updater\GoogleUpdater.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://broadband.zoomtown.com
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.7\NppBho.dll
O2 - BHO: (no name) - {2860C741-8F63-45DA-B029-2B4B148AC499} - C:\WINDOWS\system32\khfcyxy.dll
O2 - BHO: (no name) - {365F7DEB-9A81-43AB-85D1-4CA0052DBE56} - C:\WINDOWS\system32\awvtu.dll (file missing)
O2 - BHO: (no name) - {36FB5D1A-5993-45C4-BE3B-0A975784E503} - (no file)
O2 - BHO: (no name) - {47CB4603-2750-4DF5-AAD0-795568EB3E9E} - C:\WINDOWS\system32\ddabc.dll (file missing)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7C7906DB-EACB-47BA-A742-2FED04693AED} - (no file)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll
O2 - BHO: (no name) - {B1845E1B-2951-42C3-9AAB-BF82DC6813FB} - (no file)
O2 - BHO: (no name) - {BCE2568E-B93A-483C-8409-705771F4D7FC} - C:\WINDOWS\system32\pmkhi.dll (file missing)
O2 - BHO: (no name) - {D649BDD8-6959-4A6B-8286-11E27737D8E5} - C:\WINDOWS\system32\ddaya.dll (file missing)
O2 - BHO: (no name) - {E18A3970-8698-41F4-BDE5-69D75F66A370} - C:\WINDOWS\system32\vtuts.dll (file missing)
O2 - BHO: (no name) - {F36A4757-ADA2-4C06-9C6D-ACB173311EAD} - C:\WINDOWS\system32\ddabx.dll (file missing)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Show Norton Toolbar - {90222687-F593-4738-B738-FBEE9C7B26DF} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.7\UIBHO.dll
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [MMTray] "C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe"
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [DMXLauncher] C:\Program Files\Dell\Media Experience\DMXLauncher.exe
O4 - HKLM\..\Run: [Bart Station] C:\Program Files\PeoplePC\ISP6530\BIN\PPCOLink.exe -STATION
O4 - HKLM\..\Run: [lxctmon.exe] "C:\Program Files\Lexmark 5400 Series\lxctmon.exe"
O4 - HKLM\..\Run: [Lexmark 5400 Series Fax Server] "C:\Program Files\Lexmark 5400 Series\fm3032.exe" /s
O4 - HKLM\..\Run: [EzPrint] "C:\Program Files\Lexmark 5400 Series\ezprint.exe"
O4 - HKLM\..\Run: [LXCTCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCTtime.dll,_RunDLLEntry@16
O4 - HKLM\..\Run: [SpiralFrog] C:\Program Files\SpiralFrog\Spiralfrog.exe
O4 - HKLM\..\Run: [mmtask] "C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [281e158d] rundll32.exe "C:\WINDOWS\system32\vufmppxm.dll",b
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: Google Updater.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O4 - Global Startup: QuickBooks Update Agent.lnk = C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {B49C4597-8721-4789-9250-315DFBD9F525} (IWinAmpActiveX Class) - http://cdn.digitalcity.com/radio/ampx/ampx2.6.1.11_en_dl.cab
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: lxct_device - - C:\WINDOWS\system32\lxctcoms.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O24 - Desktop Component 0: (no name) - http://www.webkinz.com/assets/images/splash/splash.jpg
O24 - Desktop Component 1: (no name) - http://www.webkinz.com/assets/images/blank.gif

--
End of file - 9830 bytes

Any help would be great, thanks

__RiP_ChAiN_ · Feb 11, 2008

Hello madamat

While TeaTimer is an excellent tool for the prevention of spyware, it can sometimes prevent HijackThis from fixing certain things.
Please disable TeaTimer for now until you are clean. TeaTimer can be re-activated once your HijackThis log is clean.

Open Spybot Search & Destroy.
In the Mode menu click "Advanced mode" if not already selected.
Choose "Yes" at the Warning prompt.
Expand the "Tools" menu.
Click "Resident".
Uncheck the "Resident "TeaTimer" (Protection of overall system settings) active." box.
In the File menu click "Exit" to exit Spybot Search & Destroy.

----------------------------------------------- Step 2

Open HijackThis, click Config, click Misc Tools
Click "Open Uninstall Manager"
Click "Save List" (generates uninstall_list.txt)
Click Save, copy and paste the results in your next post.

----------------------------------------------- Step 3

Please download ComboFix by sUBs from HERE.

You must download it to and run it from your Desktop
Now STOP all your monitoring programs (Antivirus/Antispyware, Guards and Shields) as they could easily interfere with ComboFix.
Double click combofix.exe & follow the prompts.
When finished, it will produce a log. Please save that log to post in your next reply along with a fresh HJT log
Re-enable all the programs that were disabled during the running of ComboFix..

Note:
Do not mouse-click combofix's window while it is running. That may cause it to stall.

CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

madamat · Feb 11, 2008

Reply

Hello RiP ChAiN,
Thank you. I disabled Teatimer then generated an uninstall list.

ABBYY FineReader 6.0 Sprint
Adobe Flash Player ActiveX
Adobe Reader 8.1.1
Adobe Shockwave Player
AOLIcon
AppCore
Apple Mobile Device Support
Apple Software Update
AV
Broadcom Management Programs
ccCommon
Conexant D850 56K V.9x DFVc Modem
Dell Digital Jukebox Driver
Dell Driver Reset Tool
Dell Media Experience
Dell Picture Studio v3.0
Dell Support 3.1
Digital Line Detect
DivX Codec
DivX Content Uploader
DivX Converter
DivX Player
DivX Web Player
ebgcInfra
ebgcRes
ebgcSDK
eMusic Remote 1.0
GearDrvs
Get High Speed Internet!
Google Toolbar for Internet Explorer
Google Toolbar for Internet Explorer
Google Updater
HijackThis 2.0.2
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows Media Player 11 (KB939683)
Hotfix for Windows XP (KB926239)
Intel(R) Extreme Graphics Driver
Internet Explorer Default Page
iPod for Windows 2005-11-17
iTunes
Jasc Paint Shop Photo Album 5
Jasc Paint Shop Pro Studio, Dell Editon
Java 2 Runtime Environment, SE v1.4.2_03
Java(TM) 6 Update 2
Java(TM) 6 Update 3
Kaspersky Online Scanner
Learn2 Player (Uninstall Only)
Lexmark 5400 Series
LimeWire 4.14.10
LiveUpdate 3.2 (Symantec Corporation)
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Hotfix (KB928366)
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Plus! Digital Media Edition Installer
Microsoft Plus! Photo Story 2 LE
Microsoft Silverlight
Microsoft User-Mode Driver Framework Feature Pack 1.0
Modem Helper
MSN
MSXML 4.0 SP2 (KB936181)
Musicmatch® Jukebox
myfantasyleague.com Game Day 2007
NetWaiting
NetZeroInstallers
Norton 360
Norton 360
Norton 360
Norton 360 (Symantec Corporation)
Norton 360 Help
Norton Confidential Browser Component
Norton Confidential Web Authentification Component
Norton Confidential Web Protection Component
PeoplePC Online
Photo Click
PowerDVD 5.5
QuickBooks Simple Start Special Edition
QuickTime
RealArcade
RealPlayer
Security Update for Step By Step Interactive Training (KB923723)
Security Update for Windows Media Player (KB911564)
Security Update for Windows Media Player 10 (KB936782)
Security Update for Windows Media Player 11 (KB936782)
Security Update for Windows Media Player 6.4 (KB925398)
Security Update for Windows XP (KB890046)
Security Update for Windows XP (KB893756)
Security Update for Windows XP (KB896358)
Security Update for Windows XP (KB896423)
Security Update for Windows XP (KB896428)
Security Update for Windows XP (KB899587)
Security Update for Windows XP (KB899591)
Security Update for Windows XP (KB900725)
Security Update for Windows XP (KB901017)
Security Update for Windows XP (KB901214)
Security Update for Windows XP (KB902400)
Security Update for Windows XP (KB904706)
Security Update for Windows XP (KB905414)
Security Update for Windows XP (KB905749)
Security Update for Windows XP (KB908519)
Security Update for Windows XP (KB911562)
Security Update for Windows XP (KB911927)
Security Update for Windows XP (KB913580)
Security Update for Windows XP (KB914388)
Security Update for Windows XP (KB914389)
Security Update for Windows XP (KB917344)
Security Update for Windows XP (KB917953)
Security Update for Windows XP (KB918118)
Security Update for Windows XP (KB918439)
Security Update for Windows XP (KB919007)
Security Update for Windows XP (KB920213)
Security Update for Windows XP (KB920670)
Security Update for Windows XP (KB920683)
Security Update for Windows XP (KB920685)
Security Update for Windows XP (KB921503)
Security Update for Windows XP (KB922819)
Security Update for Windows XP (KB923191)
Security Update for Windows XP (KB923414)
Security Update for Windows XP (KB923689)
Security Update for Windows XP (KB923980)
Security Update for Windows XP (KB924270)
Security Update for Windows XP (KB924496)
Security Update for Windows XP (KB924667)
Security Update for Windows XP (KB925902)
Security Update for Windows XP (KB926255)
Security Update for Windows XP (KB926436)
Security Update for Windows XP (KB927779)
Security Update for Windows XP (KB927802)
Security Update for Windows XP (KB928255)
Security Update for Windows XP (KB928843)
Security Update for Windows XP (KB929123)
Security Update for Windows XP (KB930178)
Security Update for Windows XP (KB931261)
Security Update for Windows XP (KB931784)
Security Update for Windows XP (KB932168)
Security Update for Windows XP (KB933729)
Security Update for Windows XP (KB935839)
Security Update for Windows XP (KB935840)
Security Update for Windows XP (KB936021)
Security Update for Windows XP (KB937143)
Security Update for Windows XP (KB938127)
Security Update for Windows XP (KB938829)
Security Update for Windows XP (KB939653)
Security Update for Windows XP (KB941202)
Security Update for Windows XP (KB941568)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB941644)
Security Update for Windows XP (KB942615)
Security Update for Windows XP (KB943460)
Security Update for Windows XP (KB943485)
Security Update for Windows XP (KB944653)
Slice Uninstall
Sonic DLA
Sonic RecordNow Audio
Sonic RecordNow Copy
Sonic RecordNow Data
Sonic Update Manager
SPBBC 32bit
SpiralFrog Download Manager 0.8.23
Spybot - Search & Destroy
SpywareBot
SuppSoft
Symantec Technical Support Controls
SymNet
Update for Windows XP (KB894391)
Update for Windows XP (KB898461)
Update for Windows XP (KB900485)
Update for Windows XP (KB908531)
Update for Windows XP (KB910437)
Update for Windows XP (KB911280)
Update for Windows XP (KB916595)
Update for Windows XP (KB920342)
Update for Windows XP (KB920872)
Update for Windows XP (KB922582)
Update for Windows XP (KB927891)
Update for Windows XP (KB930916)
Update for Windows XP (KB933360)
Update for Windows XP (KB936357)
Update for Windows XP (KB938828)
Update for Windows XP (KB942763)
Update for Windows XP (KB942840)
Update for Windows XP (KB946627)
Viewpoint Media Player
WavePad Uninstall
WebCyberCoach 3.2 Dell
Windows Installer 3.1 (KB893803)
Windows Media Format 11 runtime
Windows Media Format 11 runtime
Windows Media Format SDK Hotfix - KB891122
Windows Media Player 10
Windows Media Player 11
Windows Media Player 11
Windows XP Hotfix - KB885836
Windows XP Hotfix - KB886185
Windows XP Hotfix - KB888302
Windows XP Hotfix - KB890859
WordPerfect Office 12
ZoomTown Software

I then ran a fresh HJT:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2:21:03 AM, on 2/11/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\WINDOWS\system32\lxctcoms.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Dell\Media Experience\DMXLauncher.exe
C:\Program Files\Lexmark 5400 Series\lxctmon.exe
C:\Program Files\Lexmark 5400 Series\ezprint.exe
C:\Program Files\SpiralFrog\Spiralfrog.exe
C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\PeoplePC\ISP6530\Browser\Bartshel.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\Google\Google Updater\GoogleUpdater.exe
C:\PROGRA~1\PeoplePC\ISP6530\Browser\PPShared.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://broadband.zoomtown.com
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.7\NppBho.dll
O2 - BHO: (no name) - {365F7DEB-9A81-43AB-85D1-4CA0052DBE56} - C:\WINDOWS\system32\awvtu.dll (file missing)
O2 - BHO: (no name) - {3F54CE76-38C7-48B0-9D31-EE111FC43CB7} - C:\WINDOWS\system32\ssqrq.dll (file missing)
O2 - BHO: (no name) - {47CB4603-2750-4DF5-AAD0-795568EB3E9E} - C:\WINDOWS\system32\ddabc.dll (file missing)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: (no name) - {5EA32F79-1D87-4152-8350-E058E1B0AB7D} - C:\WINDOWS\system32\ssqrp.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {8D81E87A-7642-481E-BEF8-FA15A0D7E4CD} - C:\WINDOWS\system32\pmnnm.dll (file missing)
O2 - BHO: (no name) - {9CB75DC8-9BEB-4CA4-8CCD-F7DB2D6DA300} - C:\WINDOWS\system32\geeby.dll (file missing)
O2 - BHO: (no name) - {A95B2816-1D7E-4561-A202-68C0DE02353A} - C:\WINDOWS\system32\opqvpocq.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll
O2 - BHO: (no name) - {BCE2568E-B93A-483C-8409-705771F4D7FC} - C:\WINDOWS\system32\pmkhi.dll (file missing)
O2 - BHO: (no name) - {D406AFC9-55EB-41B0-A734-7C1BF46A44EF} - C:\WINDOWS\system32\jkhhi.dll (file missing)
O2 - BHO: (no name) - {D649BDD8-6959-4A6B-8286-11E27737D8E5} - C:\WINDOWS\system32\ddaya.dll (file missing)
O2 - BHO: (no name) - {E18A3970-8698-41F4-BDE5-69D75F66A370} - C:\WINDOWS\system32\vtuts.dll (file missing)
O2 - BHO: (no name) - {F36A4757-ADA2-4C06-9C6D-ACB173311EAD} - C:\WINDOWS\system32\ddabx.dll (file missing)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [MMTray] "C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe"
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [DMXLauncher] C:\Program Files\Dell\Media Experience\DMXLauncher.exe
O4 - HKLM\..\Run: [Bart Station] C:\Program Files\PeoplePC\ISP6530\BIN\PPCOLink.exe -STATION
O4 - HKLM\..\Run: [lxctmon.exe] "C:\Program Files\Lexmark 5400 Series\lxctmon.exe"
O4 - HKLM\..\Run: [Lexmark 5400 Series Fax Server] "C:\Program Files\Lexmark 5400 Series\fm3032.exe" /s
O4 - HKLM\..\Run: [EzPrint] "C:\Program Files\Lexmark 5400 Series\ezprint.exe"
O4 - HKLM\..\Run: [LXCTCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCTtime.dll,_RunDLLEntry@16
O4 - HKLM\..\Run: [SpiralFrog] C:\Program Files\SpiralFrog\Spiralfrog.exe
O4 - HKLM\..\Run: [mmtask] "C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [281e158d] rundll32.exe "C:\WINDOWS\system32\vufmppxm.dll",b
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: Google Updater.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O4 - Global Startup: QuickBooks Update Agent.lnk = C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {B49C4597-8721-4789-9250-315DFBD9F525} (IWinAmpActiveX Class) - http://cdn.digitalcity.com/radio/ampx/ampx2.6.1.11_en_dl.cab
O20 - Winlogon Notify: opqvpocq - C:\WINDOWS\SYSTEM32\opqvpocq.dll
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: lxct_device - - C:\WINDOWS\system32\lxctcoms.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O24 - Desktop Component 0: (no name) - http://www.webkinz.com/assets/images/splash/splash.jpg
O24 - Desktop Component 1: (no name) - http://www.webkinz.com/assets/images/blank.gif

--
End of file - 9860 bytes

I will submit another post for the ComboFix log which is to large.

madamat · Feb 11, 2008

Reply: ComboFix Log

I then ran ComboFix and generated this log:

ComboFix 08-02.11.1 - walshromans 2008-02-11 1:58:01.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.210 [GMT -5:00]
Running from: C:\Documents and Settings\walshromans\Desktop\ComboFix.exe
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\ssqpn.dll
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat
C:\WINDOWS\cookies.ini
C:\WINDOWS\system32\ajvedapt.dll
C:\WINDOWS\system32\avuhhtsd.ini
C:\WINDOWS\system32\ayadd.ini
C:\WINDOWS\system32\ayadd.ini2
C:\WINDOWS\system32\bszip.dll
C:\WINDOWS\system32\cbadd.ini
C:\WINDOWS\system32\cbadd.ini2
C:\WINDOWS\system32\cqfkxrke.dll
C:\WINDOWS\system32\cujwcyqe.dll
C:\WINDOWS\system32\drivers\fad.sys
C:\WINDOWS\system32\dsthhuva.dll
C:\WINDOWS\system32\ihhkj.ini
C:\WINDOWS\system32\ihhkj.ini2
C:\WINDOWS\system32\ihkmp.ini
C:\WINDOWS\system32\ihkmp.ini2
C:\WINDOWS\system32\khfcyxy.dll
C:\WINDOWS\system32\lvfsyvqt.ini
C:\WINDOWS\system32\mcrh.tmp
C:\WINDOWS\system32\mkpjwwva.ini
C:\WINDOWS\system32\mnnmp.ini
C:\WINDOWS\system32\mnnmp.ini2
C:\WINDOWS\system32\mplkdpnv.dll
C:\WINDOWS\system32\nkeukeak.ini
C:\WINDOWS\system32\npqss.ini
C:\WINDOWS\system32\npqss.ini2
C:\WINDOWS\system32\opqvpocq.dll
C:\WINDOWS\system32\opqvpocq.dll . . . . failed to delete
C:\WINDOWS\system32\opqvpocq.dllbox
C:\WINDOWS\system32\prqss.ini
C:\WINDOWS\system32\prqss.ini2
C:\WINDOWS\system32\qrqss.ini
C:\WINDOWS\system32\qrqss.ini2
C:\WINDOWS\system32\rlrpynnf.dll
C:\WINDOWS\system32\sogopmpj.dll
C:\WINDOWS\system32\ssqpn.dll
C:\WINDOWS\system32\stutv.ini
C:\WINDOWS\system32\stutv.ini2
C:\WINDOWS\system32\tqvysfvl.dll
C:\WINDOWS\system32\utvwa.ini
C:\WINDOWS\system32\utvwa.ini2
C:\WINDOWS\system32\uyqddfpq.dll
C:\WINDOWS\system32\ybeeg.ini
C:\WINDOWS\system32\ybeeg.ini2
C:\WINDOWS\system32\yohxfxlk.dll

----- BITS: Possible infected sites -----

hxxp://www.spiralfrog.com
.
((((((((((((((((((((((((( Files Created from 2008-01-11 to 2008-02-11 )))))))))))))))))))))))))))))))
.

2008-02-11 02:11 . 2008-02-11 02:12 134 ---hs---- C:\WINDOWS\system32\opqvpocq.dllbox
2008-02-11 01:48 . 2008-02-11 02:06 163,904 --a------ C:\WINDOWS\system32\opqvpocq.dll
2008-02-10 02:47 . 2008-02-10 02:47 294 --ahs---- C:\WINDOWS\system32\pgouakme.ini
2008-02-09 16:20 . 2008-02-09 16:20 294 --ahs---- C:\WINDOWS\system32\yafncdam.ini
2008-02-09 16:05 . 2008-02-09 16:05 <DIR> d-------- C:\Program Files\Trend Micro
2008-02-09 11:19 . 2008-02-09 11:20 414 --ahs---- C:\WINDOWS\system32\mxppmfuv.ini
2008-02-09 02:37 . 2008-02-09 11:09 354 --ahs---- C:\WINDOWS\system32\cduhouwt.ini
2008-02-09 02:16 . 2008-02-09 02:16 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab
2008-02-09 02:16 . 2008-02-09 02:16 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-02-07 10:59 . 2008-02-07 10:59 414 --ahs---- C:\WINDOWS\system32\kymnjxdo.ini
2008-02-07 07:26 . 2008-02-07 10:59 354 --ahs---- C:\WINDOWS\system32\qnjrmuqo.ini
2008-02-07 07:13 . 2008-02-07 07:13 24,576 --a------ C:\WINDOWS\system32\VundoFixSVC.exe
2008-02-07 03:39 . 2008-02-07 07:14 <DIR> d-------- C:\VundoFix Backups
2008-02-06 03:51 . 2008-02-06 08:44 2,156,227 --ahs---- C:\WINDOWS\system32\gbpjxyxs.ini
2008-02-05 10:05 . 2008-02-06 03:51 2,156,167 --ahs---- C:\WINDOWS\system32\pdfgycqe.ini
2008-02-05 03:56 . 2008-02-07 01:24 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy
2008-02-05 03:56 . 2008-02-05 04:24 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-02-04 02:46 . 2008-01-12 18:32 23,904 --a------ C:\WINDOWS\system32\drivers\COH_Mon.sys
2008-02-04 02:46 . 2008-01-15 09:54 10,537 --a------ C:\WINDOWS\system32\drivers\COH_Mon.cat
2008-02-04 02:46 . 2008-01-15 05:28 706 --a------ C:\WINDOWS\system32\drivers\COH_Mon.inf
2008-02-03 22:24 . 2008-02-04 01:18 <DIR> d-------- C:\Program Files\Norton 360
2008-02-03 22:21 . 2008-02-04 01:10 123,952 --a------ C:\WINDOWS\system32\drivers\SYMEVENT.SYS
2008-02-03 22:21 . 2008-02-04 01:10 60,800 --a------ C:\WINDOWS\system32\S32EVNT1.DLL
2008-02-03 22:21 . 2008-02-04 01:10 10,740 --a------ C:\WINDOWS\system32\drivers\SYMEVENT.CAT
2008-02-03 22:21 . 2008-02-04 01:10 805 --a------ C:\WINDOWS\system32\drivers\SYMEVENT.INF
2008-02-03 22:20 . 2008-02-04 01:10 <DIR> d-------- C:\Program Files\Symantec
2008-02-03 21:57 . 2005-09-21 22:33 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Symantec
2008-02-03 21:57 . 2005-09-21 22:22 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Jasc Software Inc
2008-02-03 21:57 . 2005-09-21 22:38 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Gtek
2008-01-27 14:49 . 2008-01-27 14:49 <DIR> d-------- C:\Documents and Settings\walshromans\Application Data\DivX
2008-01-23 13:23 . 2008-01-23 13:23 <DIR> d-------- C:\Documents and Settings\walshromans\Application Data\NCH Swift Sound
2008-01-23 12:37 . 2008-01-23 13:23 <DIR> d-------- C:\Program Files\NCH Swift Sound
2008-01-20 22:22 . 2008-02-11 02:11 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-01-20 22:22 . 2008-01-20 22:22 1,409 --a------ C:\WINDOWS\QTFont.for
2008-01-15 13:13 . 2008-01-15 13:13 <DIR> d-------- C:\WINDOWS\Pure Digital Prefs

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-11 07:12 --------- d-----w C:\Program Files\SpiralFrog
2008-02-11 07:11 --------- d-----w C:\Program Files\Lx_cats
2008-02-11 07:09 --------- d-----w C:\Program Files\Common Files\Symantec Shared
2008-02-11 06:26 --------- d-----w C:\Documents and Settings\All Users\Application Data\Symantec
2008-02-10 17:00 --------- d-----w C:\Documents and Settings\All Users\Application Data\Google Updater
2008-02-04 04:33 --------- d-----w C:\Documents and Settings\walshromans\Application Data\Symantec
2008-02-04 02:40 --------- d-----w C:\Program Files\Common Files\McAfee
2008-02-04 02:40 --------- d-----w C:\Documents and Settings\All Users\Application Data\McAfee
2008-02-03 04:16 --------- d-----w C:\Documents and Settings\walshromans\Application Data\LimeWire
2008-01-21 03:21 --------- d-----w C:\Program Files\iTunes
2008-01-21 03:20 --------- d-----w C:\Program Files\iPod
2008-01-21 03:15 --------- d-----w C:\Program Files\QuickTime
2008-01-04 17:11 --------- d-----w C:\Documents and Settings\Kathy Romans\Application Data\CyberLink
2008-01-04 08:22 --------- d-----w C:\Documents and Settings\Kathy Romans\Application Data\Apple Computer
2008-01-04 07:08 --------- d-----w C:\Documents and Settings\Kathy Romans\Application Data\5400 Series
2007-12-28 17:18 --------- d-----w C:\Program Files\Google
2007-12-21 06:46 --------- d-----w C:\Documents and Settings\walshromans\Application Data\CyberLink
2007-12-19 14:55 --------- d-----w C:\Program Files\DivX
2007-12-11 00:23 --------- d-----w C:\Documents and Settings\All Users\Application Data\Viewpoint
2007-09-19 22:19 774,144 ----a-w C:\Program Files\RngInterstitial.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{365F7DEB-9A81-43AB-85D1-4CA0052DBE56}]
C:\WINDOWS\system32\awvtu.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{3F54CE76-38C7-48B0-9D31-EE111FC43CB7}]
C:\WINDOWS\system32\ssqrq.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{47CB4603-2750-4DF5-AAD0-795568EB3E9E}]
C:\WINDOWS\system32\ddabc.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{5EA32F79-1D87-4152-8350-E058E1B0AB7D}]
C:\WINDOWS\system32\ssqrp.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{8D81E87A-7642-481E-BEF8-FA15A0D7E4CD}]
C:\WINDOWS\system32\pmnnm.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{9CB75DC8-9BEB-4CA4-8CCD-F7DB2D6DA300}]
C:\WINDOWS\system32\geeby.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A95B2816-1D7E-4561-A202-68C0DE02353A}]
2008-02-11 02:06 163904 --a------ C:\WINDOWS\system32\opqvpocq.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{BCE2568E-B93A-483C-8409-705771F4D7FC}]
C:\WINDOWS\system32\pmkhi.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D406AFC9-55EB-41B0-A734-7C1BF46A44EF}]
C:\WINDOWS\system32\jkhhi.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D649BDD8-6959-4A6B-8286-11E27737D8E5}]
C:\WINDOWS\system32\ddaya.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{E18A3970-8698-41F4-BDE5-69D75F66A370}]
C:\WINDOWS\system32\vtuts.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F36A4757-ADA2-4C06-9C6D-ACB173311EAD}]
C:\WINDOWS\system32\ddabx.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 11:24 1694208]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMAXPnP"="C:\Program Files\Analog Devices\Core\smax4pnp.exe" [2004-10-14 19:42 1404928]
"IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2005-01-23 16:36 155648]
"HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2005-01-23 16:31 126976]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496]
"DVDLauncher"="C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" [2005-02-23 16:19 53248]
"MMTray"="C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe" [2006-01-17 12:03 135168]
"ISUSPM Startup"="C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-27 16:50 221184]
"ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2004-07-27 16:50 81920]
"DMXLauncher"="C:\Program Files\Dell\Media Experience\DMXLauncher.exe" [2005-01-27 01:02 86016]
"Bart Station"="C:\Program Files\PeoplePC\ISP6530\BIN\PPCOLink.exe" [2007-03-12 18:04 26208]
"lxctmon.exe"="C:\Program Files\Lexmark 5400 Series\lxctmon.exe" [2006-11-22 04:11 291760]
"Lexmark 5400 Series Fax Server"="C:\Program Files\Lexmark 5400 Series\fm3032.exe" [2006-11-22 04:12 304048]
"EzPrint"="C:\Program Files\Lexmark 5400 Series\ezprint.exe" [2006-11-22 04:11 82864]
"LXCTCATS"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCTtime.dll" [2006-11-21 07:27 106496]
"SpiralFrog"="C:\Program Files\SpiralFrog\Spiralfrog.exe" [2007-09-14 07:58 163128]
"mmtask"="C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe" [2006-01-17 12:03 53248]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 18:51 39792]
"dla"="C:\WINDOWS\system32\dla\tfswctrl.exe" [2005-05-31 04:33 122941]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2008-01-10 15:27 385024]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-01-15 03:22 267048]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2007-07-17 20:54 116072]
"281e158d"="C:\WINDOWS\system32\vufmppxm.dll" [ ]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Digital Line Detect.lnk - C:\Program Files\Digital Line Detect\DLG.exe [2005-09-21 22:20:05 24576]
Google Updater.lnk - C:\Program Files\Google\Google Updater\GoogleUpdater.exe [2007-12-28 12:17:17 124400]
QuickBooks Update Agent.lnk - C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe [2004-11-11 11:59:36 806912]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\opqvpocq]
opqvpocq.dll 2008-02-11 02:06 163904 C:\WINDOWS\system32\opqvpocq.dll

*Newly Created Service* - COMHOST
.
Contents of the 'Scheduled Tasks' folder
"2008-02-08 13:10:03 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-11 02:12:15
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

PROCESS: C:\WINDOWS\system32\winlogon.exe
-> C:\WINDOWS\system32\opqvpocq.dll

PROCESS: C:\WINDOWS\explorer.exe [6.00.2900.3156]
-> C:\WINDOWS\system32\opqvpocq.dll
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\WINDOWS\system32\lxctcoms.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\PeoplePC\ISP6530\Browser\Bartshel.exe
C:\PROGRA~1\PeoplePC\ISP6530\Browser\PPShared.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
.
**************************************************************************
.
Completion time: 2008-02-11 2:17:27 - machine was rebooted
ComboFix-quarantined-files.txt 2008-02-11 07:17:19
.
2008-02-01 06:13:25 --- E O F ---

If you need anymore info please let me know, and thanks again!!!

__RiP_ChAiN_ · Feb 11, 2008

Hello madamat

A. Please RUN HijackThis

Click the SCAN button to produce a log.
Place a check mark beside each one of the following items:

O2 - BHO: (no name) - {365F7DEB-9A81-43AB-85D1-4CA0052DBE56} - C:\WINDOWS\system32\awvtu.dll (file missing)
O2 - BHO: (no name) - {3F54CE76-38C7-48B0-9D31-EE111FC43CB7} - C:\WINDOWS\system32\ssqrq.dll (file missing)
O2 - BHO: (no name) - {47CB4603-2750-4DF5-AAD0-795568EB3E9E} - C:\WINDOWS\system32\ddabc.dll (file missing)
O2 - BHO: (no name) - {5EA32F79-1D87-4152-8350-E058E1B0AB7D} - C:\WINDOWS\system32\ssqrp.dll (file missing)
O2 - BHO: (no name) - {8D81E87A-7642-481E-BEF8-FA15A0D7E4CD} - C:\WINDOWS\system32\pmnnm.dll (file missing)
O2 - BHO: (no name) - {9CB75DC8-9BEB-4CA4-8CCD-F7DB2D6DA300} - C:\WINDOWS\system32\geeby.dll (file missing)
O2 - BHO: (no name) - {A95B2816-1D7E-4561-A202-68C0DE02353A} - C:\WINDOWS\system32\opqvpocq.dll
O2 - BHO: (no name) - {BCE2568E-B93A-483C-8409-705771F4D7FC} - C:\WINDOWS\system32\pmkhi.dll (file missing)
O2 - BHO: (no name) - {D406AFC9-55EB-41B0-A734-7C1BF46A44EF} - C:\WINDOWS\system32\jkhhi.dll (file missing)
O2 - BHO: (no name) - {D649BDD8-6959-4A6B-8286-11E27737D8E5} - C:\WINDOWS\system32\ddaya.dll (file missing)
O2 - BHO: (no name) - {E18A3970-8698-41F4-BDE5-69D75F66A370} - C:\WINDOWS\system32\vtuts.dll (file missing)
O2 - BHO: (no name) - {F36A4757-ADA2-4C06-9C6D-ACB173311EAD} - C:\WINDOWS\system32\ddabx.dll (file missing)
O4 - HKLM\..\Run: [281e158d] rundll32.exe "C:\WINDOWS\system32\vufmppxm.dll",b
O20 - Winlogon Notify: opqvpocq - C:\WINDOWS\SYSTEM32\opqvpocq.dll
Now with all the items selected, and all windows closed except for HJT, delete them by clicking the FIX checked button. Close the HijackThis window.

B. 1. Please open Notepad

Click Start , then Run
Type notepad .exe in the Run Box.

2. Now copy/paste the entire content of the codebox below into the Notepad window:

KillAll::
File::
C:\WINDOWS\system32\opqvpocq.dllbox
C:\WINDOWS\system32\opqvpocq.dll
C:\WINDOWS\system32\pgouakme.ini
C:\WINDOWS\system32\yafncdam.ini
C:\WINDOWS\system32\mxppmfuv.ini
C:\WINDOWS\system32\cduhouwt.ini
C:\WINDOWS\system32\kymnjxdo.ini
C:\WINDOWS\system32\qnjrmuqo.ini
C:\WINDOWS\system32\gbpjxyxs.ini
C:\WINDOWS\system32\pdfgycqe.ini
Folder::
C:\VundoFix Backups

Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.

3. Save the above as CFScript.txt

4. Now STOP all your monitoring programs (Antivirus/Antispyware, Guards and Shields) as they could easily interfere with ComboFix.

5. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.

6. After reboot, (in case it asks to reboot), please re-enable all the programs that were disabled during the running of ComboFix then post the following reports/logs into your next reply:

Combofix.txt
A new HijackThis log.

CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

madamat · Feb 12, 2008

Reply: ComboFix Log and fresh HJT Log

Hello RiP ChAiN

I deleted the files from the HJT scan and then copied and pasted the CFScript on desktop and drug it into ComboFix which produced this log:

ComboFix 08-02.11.1 - walshromans 2008-02-12 1:30:28.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.239 [GMT -5:00]
Running from: C:\Documents and Settings\walshromans\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\walshromans\Desktop\CFScript.txt
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE
C:\WINDOWS\system32\cduhouwt.ini
C:\WINDOWS\system32\gbpjxyxs.ini
C:\WINDOWS\system32\kymnjxdo.ini
C:\WINDOWS\system32\mxppmfuv.ini
C:\WINDOWS\system32\opqvpocq.dll
C:\WINDOWS\system32\opqvpocq.dllbox
C:\WINDOWS\system32\pdfgycqe.ini
C:\WINDOWS\system32\pgouakme.ini
C:\WINDOWS\system32\qnjrmuqo.ini
C:\WINDOWS\system32\yafncdam.ini
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat
C:\VundoFix Backups
C:\VundoFix Backups\addmorefiles.txt
C:\VundoFix Backups\ddabx.dll.bad
C:\VundoFix Backups\ddcaxvv.dll.bad
C:\VundoFix Backups\khfcyxy.dll.bad
C:\VundoFix Backups\kuvniatd.dll.bad
C:\VundoFix Backups\obycqqjr.dll.bad
C:\VundoFix Backups\opnolmj.dll.bad
C:\VundoFix Backups\qhyvglks.dll.bad
C:\VundoFix Backups\qljhrhja.dll.bad
C:\VundoFix Backups\qommkig.dll.bad
C:\VundoFix Backups\sklgvyhq.ini.bad
C:\VundoFix Backups\xbadd.ini.bad
C:\VundoFix Backups\xbadd.ini2.bad
C:\WINDOWS\system32\cduhouwt.ini
C:\WINDOWS\system32\gbpjxyxs.ini
C:\WINDOWS\system32\kymnjxdo.ini
C:\WINDOWS\system32\mxppmfuv.ini
C:\WINDOWS\system32\pdfgycqe.ini
C:\WINDOWS\system32\pgouakme.ini
C:\WINDOWS\system32\qnjrmuqo.ini
C:\WINDOWS\system32\yafncdam.ini

----- BITS: Possible infected sites -----

hxxp://www.spiralfrog.com
.
((((((((((((((((((((((((( Files Created from 2008-01-12 to 2008-02-12 )))))))))))))))))))))))))))))))
.

2008-02-09 16:05 . 2008-02-09 16:05 <DIR> d-------- C:\Program Files\Trend Micro
2008-02-09 02:16 . 2008-02-09 02:16 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab
2008-02-09 02:16 . 2008-02-09 02:16 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-02-07 07:13 . 2008-02-07 07:13 24,576 --a------ C:\WINDOWS\system32\VundoFixSVC.exe
2008-02-05 03:56 . 2008-02-07 01:24 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy
2008-02-05 03:56 . 2008-02-05 04:24 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-02-04 02:46 . 2008-01-12 18:32 23,904 --a------ C:\WINDOWS\system32\drivers\COH_Mon.sys
2008-02-04 02:46 . 2008-01-15 09:54 10,537 --a------ C:\WINDOWS\system32\drivers\COH_Mon.cat
2008-02-04 02:46 . 2008-01-15 05:28 706 --a------ C:\WINDOWS\system32\drivers\COH_Mon.inf
2008-02-03 22:24 . 2008-02-04 01:18 <DIR> d-------- C:\Program Files\Norton 360
2008-02-03 22:21 . 2008-02-04 01:10 123,952 --a------ C:\WINDOWS\system32\drivers\SYMEVENT.SYS
2008-02-03 22:21 . 2008-02-04 01:10 60,800 --a------ C:\WINDOWS\system32\S32EVNT1.DLL
2008-02-03 22:21 . 2008-02-04 01:10 10,740 --a------ C:\WINDOWS\system32\drivers\SYMEVENT.CAT
2008-02-03 22:21 . 2008-02-04 01:10 805 --a------ C:\WINDOWS\system32\drivers\SYMEVENT.INF
2008-02-03 22:20 . 2008-02-04 01:10 <DIR> d-------- C:\Program Files\Symantec
2008-02-03 21:57 . 2005-09-21 22:33 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Symantec
2008-02-03 21:57 . 2005-09-21 22:22 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Jasc Software Inc
2008-02-03 21:57 . 2005-09-21 22:38 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Gtek
2008-01-27 14:49 . 2008-01-27 14:49 <DIR> d-------- C:\Documents and Settings\walshromans\Application Data\DivX
2008-01-23 13:23 . 2008-01-23 13:23 <DIR> d-------- C:\Documents and Settings\walshromans\Application Data\NCH Swift Sound
2008-01-23 12:37 . 2008-01-23 13:23 <DIR> d-------- C:\Program Files\NCH Swift Sound
2008-01-20 22:22 . 2008-02-12 01:38 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-01-20 22:22 . 2008-01-20 22:22 1,409 --a------ C:\WINDOWS\QTFont.for
2008-01-15 13:13 . 2008-01-15 13:13 <DIR> d-------- C:\WINDOWS\Pure Digital Prefs

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-12 06:37 --------- d-----w C:\Program Files\Lx_cats
2008-02-12 06:36 --------- d-----w C:\Program Files\Common Files\Symantec Shared
2008-02-12 06:20 --------- d-----w C:\Documents and Settings\All Users\Application Data\Symantec
2008-02-12 06:06 --------- d-----w C:\Program Files\SpiralFrog
2008-02-11 18:02 --------- d-----w C:\Documents and Settings\All Users\Application Data\Google Updater
2008-02-04 04:33 --------- d-----w C:\Documents and Settings\walshromans\Application Data\Symantec
2008-02-04 02:40 --------- d-----w C:\Program Files\Common Files\McAfee
2008-02-04 02:40 --------- d-----w C:\Documents and Settings\All Users\Application Data\McAfee
2008-02-03 04:16 --------- d-----w C:\Documents and Settings\walshromans\Application Data\LimeWire
2008-01-21 03:21 --------- d-----w C:\Program Files\iTunes
2008-01-21 03:20 --------- d-----w C:\Program Files\iPod
2008-01-21 03:15 --------- d-----w C:\Program Files\QuickTime
2008-01-04 17:11 --------- d-----w C:\Documents and Settings\Kathy Romans\Application Data\CyberLink
2008-01-04 08:22 --------- d-----w C:\Documents and Settings\Kathy Romans\Application Data\Apple Computer
2008-01-04 07:08 --------- d-----w C:\Documents and Settings\Kathy Romans\Application Data\5400 Series
2007-12-28 17:18 --------- d-----w C:\Program Files\Google
2007-12-21 06:46 --------- d-----w C:\Documents and Settings\walshromans\Application Data\CyberLink
2007-12-19 14:55 --------- d-----w C:\Program Files\DivX
2007-09-19 22:19 774,144 ----a-w C:\Program Files\RngInterstitial.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 11:24 1694208]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMAXPnP"="C:\Program Files\Analog Devices\Core\smax4pnp.exe" [2004-10-14 19:42 1404928]
"IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2005-01-23 16:36 155648]
"HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2005-01-23 16:31 126976]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496]
"DVDLauncher"="C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" [2005-02-23 16:19 53248]
"MMTray"="C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe" [2006-01-17 12:03 135168]
"ISUSPM Startup"="C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-27 16:50 221184]
"ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2004-07-27 16:50 81920]
"DMXLauncher"="C:\Program Files\Dell\Media Experience\DMXLauncher.exe" [2005-01-27 01:02 86016]
"Bart Station"="C:\Program Files\PeoplePC\ISP6530\BIN\PPCOLink.exe" [2007-03-12 18:04 26208]
"lxctmon.exe"="C:\Program Files\Lexmark 5400 Series\lxctmon.exe" [2006-11-22 04:11 291760]
"Lexmark 5400 Series Fax Server"="C:\Program Files\Lexmark 5400 Series\fm3032.exe" [2006-11-22 04:12 304048]
"EzPrint"="C:\Program Files\Lexmark 5400 Series\ezprint.exe" [2006-11-22 04:11 82864]
"LXCTCATS"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCTtime.dll" [2006-11-21 07:27 106496]
"SpiralFrog"="C:\Program Files\SpiralFrog\Spiralfrog.exe" [2007-09-14 07:58 163128]
"mmtask"="C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe" [2006-01-17 12:03 53248]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 18:51 39792]
"dla"="C:\WINDOWS\system32\dla\tfswctrl.exe" [2005-05-31 04:33 122941]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2008-01-10 15:27 385024]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-01-15 03:22 267048]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2007-07-17 20:54 116072]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Digital Line Detect.lnk - C:\Program Files\Digital Line Detect\DLG.exe [2005-09-21 22:20:05 24576]
Google Updater.lnk - C:\Program Files\Google\Google Updater\GoogleUpdater.exe [2007-12-28 12:17:17 124400]
QuickBooks Update Agent.lnk - C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe [2004-11-11 11:59:36 806912]

*Newly Created Service* - COMHOST
.
Contents of the 'Scheduled Tasks' folder
"2008-02-08 13:10:03 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-12 01:38:02
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\WINDOWS\system32\lxctcoms.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\PeoplePC\ISP6530\Browser\Bartshel.exe
C:\PROGRA~1\PeoplePC\ISP6530\Browser\PPShared.exe
C:\Program Files\iPod\bin\iPodService.exe
.
**************************************************************************
.
Completion time: 2008-02-12 1:44:20 - machine was rebooted
ComboFix-quarantined-files.txt 2008-02-12 06:44:14
ComboFix2.txt 2008-02-11 07:17:27
.
2008-02-01 06:13:25 --- E O F ---

I then ran a new HJT scan and produced this log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:52:40 AM, on 2/12/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\WINDOWS\system32\lxctcoms.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Dell\Media Experience\DMXLauncher.exe
C:\Program Files\Lexmark 5400 Series\lxctmon.exe
C:\Program Files\Lexmark 5400 Series\ezprint.exe
C:\Program Files\SpiralFrog\Spiralfrog.exe
C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\Google\Google Updater\GoogleUpdater.exe
C:\Program Files\PeoplePC\ISP6530\Browser\Bartshel.exe
C:\PROGRA~1\PeoplePC\ISP6530\Browser\PPShared.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://broadband.zoomtown.com
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.7\NppBho.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [MMTray] "C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe"
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [DMXLauncher] C:\Program Files\Dell\Media Experience\DMXLauncher.exe
O4 - HKLM\..\Run: [Bart Station] C:\Program Files\PeoplePC\ISP6530\BIN\PPCOLink.exe -STATION
O4 - HKLM\..\Run: [lxctmon.exe] "C:\Program Files\Lexmark 5400 Series\lxctmon.exe"
O4 - HKLM\..\Run: [Lexmark 5400 Series Fax Server] "C:\Program Files\Lexmark 5400 Series\fm3032.exe" /s
O4 - HKLM\..\Run: [EzPrint] "C:\Program Files\Lexmark 5400 Series\ezprint.exe"
O4 - HKLM\..\Run: [LXCTCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCTtime.dll,_RunDLLEntry@16
O4 - HKLM\..\Run: [SpiralFrog] C:\Program Files\SpiralFrog\Spiralfrog.exe
O4 - HKLM\..\Run: [mmtask] "C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: Google Updater.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O4 - Global Startup: QuickBooks Update Agent.lnk = C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {B49C4597-8721-4789-9250-315DFBD9F525} (IWinAmpActiveX Class) - http://cdn.digitalcity.com/radio/ampx/ampx2.6.1.11_en_dl.cab
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: lxct_device - - C:\WINDOWS\system32\lxctcoms.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O24 - Desktop Component 0: (no name) - http://www.webkinz.com/assets/images/splash/splash.jpg
O24 - Desktop Component 1: (no name) - http://www.webkinz.com/assets/images/blank.gif

--
End of file - 8364 bytes

Let me know what else you need and again- thanks for your time!!!

__RiP_ChAiN_ · Feb 12, 2008

Hello madamat

Please go to Microsoft's website => http://support.microsoft.com/kb/310994
Select the download that's appropriate for your Operating System

Microsoft Windows XP Home Edition
- Without Service Packs
  http://www.microsoft.com/downloads/details...55-BD5AFEE126D8
- Service Pack 1
  http://www.microsoft.com/downloads/details...05-719F45C382A4
- Service Pack 2
  http://www.microsoft.com/downloads/details...3D-81C2137FF464
Microsoft Windows XP Professional
- Without Service Packs
  http://www.microsoft.com/downloads/details...B7-4FED408EA73F
- Service Pack 1
  http://www.microsoft.com/downloads/details...C2-631504EF5E26
- Service Pack 2
  http://www.microsoft.com/downloads/details...0C-0A0205368124

## Important ##
As we do not know the name of the file that's downloaded, you have to save the file as RC.exe to the root of SystemDrive e.g. C:\RC.exe

STEP #2

Download the latest copy of ComboFix.exe => http://download.bleepingcomputer.com/sUBs/ComboFix.exe

Open notepad and copy/paste the text in the quotebox below into it:

Code:

RecoveryConsole::
C:\RC.EXE

Save this as "CFScript"

Please drag CFScript.txt into ComboFix.exe

When finished, it shall produce a log for you, C:\CF-RC.txt. Post that log in your next reply.

## Important ##
This is a precautionary measure. Please do not reboot the machine until we have reviewed the log & responded to you.

----------------------------------------------- Step 2

Before we start fixing anything you should print out these instructions or copy them to a NotePad file so they will be accessible. Some steps will require you to disconnect from the Internet or use Safe Mode and you will not have access to this page.

Please download DrWeb-CureIt & save it to your desktop. DO NOT perform a scan yet.

Reboot your computer in "SAFE MODE" using the F8 method. To do this, restart your computer and after hearing your computer beep once during startup (but before the Windows icon appears) press the F8 key repeatedly. A menu will appear with several options. Use the arrow keys to navigate and select the option to run Windows in "Safe Mode".

Scan with DrWeb-CureIt as follows:

Double-click on drweb-cureit.exe to start the program. An "Express Scan of your PC" notice will appear.
Under "Start the Express Scan Now", Click "OK" to start. This is a short scan that will scan the files currently running in memory and when something is found, click the Yes button when it asks you if you want to cure it.
Once the short scan has finished, Click Options > Change settings
Choose the "Scan tab" and UNcheck "Heuristic analysis"
Back at the main window, click "Custom Scan", then Select drives (a red dot will show which drives have been chosen).
Then click the "Start/Stop Scanning" button (green arrow on the right) and the scan will start.
When done, a message will be displayed at the bottom advising if any viruses were found.
Click "Yes to all" if it asks if you want to cure/move the file.
When the scan has finished, look if you can see the icon next to the files found. If so, click it, then click the next icon right below and select "Move incurable".
(This will move it to the C:\Documents and Settings\userprofile\DoctorWeb\Quarantine folder if it can't be cured)
Next, in the Dr.Web CureIt menu on top, click file and choose save report list.
Save the DrWeb.csv report to your desktop.
Exit Dr.Web Cureit when done.
Important! Reboot your computer because it could be possible that files in use will be moved/deleted during reboot.
After reboot, post the contents of the log from Dr.Web in your next reply. (You can use Notepad to open the DrWeb.cvs report)

madamat · Feb 13, 2008

Reply

Hello RiP ChAiN,

I ran into a problem. I downloaded Windows XP Home Edition Service Pack2 . Saved it in Local Disk [c:] and renamed it RC.exe. I then downloaded newest ComboFix copy. I then copied and pasted text in notebook naming it CFScript. I turned off my security programs and drug CFScript file into ComboFix. Combofix would start up and start to scan but then it prompted me with this error - "C:\RC.exe is not a valid win 32 application " then it said "installation is aborted." I think I saved the windows service pack to the wrong spot. I didn't fully understand
"save file to the root of system drive." I'm sorry

__RiP_ChAiN_ · Feb 14, 2008

Hello madamat

I ran into a problem. I downloaded Windows XP Home Edition Service Pack2 . Saved it in Local Disk [c:] and renamed it RC.exe. I then downloaded newest ComboFix copy. I then copied and pasted text in notebook naming it CFScript. I turned off my security programs and drug CFScript file into ComboFix. Combofix would start up and start to scan but then it prompted me with this error - "C:\RC.exe is not a valid win 32 application " then it said "installation is aborted." I think I saved the windows service pack to the wrong spot. I didn't fully understand
"save file to the root of system drive." I'm sorry

It sounds like you did everything correct here, I wonder if the download managed to get corrupted during the download to your computer. The root of your system drive in this case is C:\ which is where you correctly saved and then renamed the file at. Can you try downloading a new copy of the Service pack to your computer's C:\ drive, renamed it once again to C:\RC.EXE and try running ComboFix again?

madamat · Feb 14, 2008

Reply

Hello RiP ChAiN

I downloaded Windows Service Pack 2 again and ComboFix also and it worked this time. ( I tried this several times yesterday but it didnt work but amazingly it worked this time!!!) Here is the report:

RC.EXE
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect
C:\CMDCONS\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

I will not reboot until I hear from you, Thanks

__RiP_ChAiN_ · Feb 14, 2008

It looks like everything worked correctly this time, indeed

Please move on to Step #2, when ready.

madamat · Feb 15, 2008

Reply: Dr Web-Cureit

Hello RiP ChAiN,

Here is the Dr Web log you requested:

RegUBP2b-walshromans.reg;C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Snapshots2;Trojan.StartPage.1505;Deleted.;
3 Months Free NetZero.exe;C:\Documents and Settings\All Users\Start Menu;Trojan.Click.1487;Deleted.;
PPCInstall.dll;C:\Program Files\PeoplePC\ISP6530\Bin;Probably STPAGE.Trojan;Incurable.Moved.;
ddabx.dll.bad.vir;C:\QooBox\Quarantine\C\VundoFix Backups;Trojan.Virtumod.268;Deleted.;
ddcaxvv.dll.bad.vir;C:\QooBox\Quarantine\C\VundoFix Backups;Trojan.Virtumod.240;Deleted.;
khfcyxy.dll.bad.vir;C:\QooBox\Quarantine\C\VundoFix Backups;Trojan.Virtumod.240;Deleted.;
kuvniatd.dll.bad.vir;C:\QooBox\Quarantine\C\VundoFix Backups;Trojan.Virtumod.269;Deleted.;
obycqqjr.dll.bad.vir;C:\QooBox\Quarantine\C\VundoFix Backups;Trojan.Virtumod.269;Deleted.;
opnolmj.dll.bad.vir;C:\QooBox\Quarantine\C\VundoFix Backups;Trojan.Virtumod.240;Deleted.;
qhyvglks.dll.bad.vir;C:\QooBox\Quarantine\C\VundoFix Backups;Trojan.Virtumod.272;Deleted.;
qljhrhja.dll.bad.vir;C:\QooBox\Quarantine\C\VundoFix Backups;Trojan.Virtumod.269;Deleted.;
qommkig.dll.bad.vir;C:\QooBox\Quarantine\C\VundoFix Backups;Trojan.Virtumod.240;Deleted.;
ajvedapt.dll.vir;C:\QooBox\Quarantine\C\WINDOWS\system32;Trojan.Virtumod.269;Deleted.;
cqfkxrke.dll.vir;C:\QooBox\Quarantine\C\WINDOWS\system32;Trojan.Virtumod.269;Deleted.;
cujwcyqe.dll.vir;C:\QooBox\Quarantine\C\WINDOWS\system32;Trojan.Virtumod.269;Deleted.;
dsthhuva.dll.vir;C:\QooBox\Quarantine\C\WINDOWS\system32;Trojan.Virtumod.272;Deleted.;
khfcyxy.dll.vir;C:\QooBox\Quarantine\C\WINDOWS\system32;Trojan.Virtumod.240;Deleted.;
mplkdpnv.dll.vir;C:\QooBox\Quarantine\C\WINDOWS\system32;Trojan.Virtumod.269;Deleted.;
rlrpynnf.dll.vir;C:\QooBox\Quarantine\C\WINDOWS\system32;Trojan.Virtumod.269;Deleted.;
sogopmpj.dll.vir;C:\QooBox\Quarantine\C\WINDOWS\system32;Trojan.Virtumod.269;Deleted.;
tqvysfvl.dll.vir;C:\QooBox\Quarantine\C\WINDOWS\system32;Trojan.Virtumod.272;Deleted.;
uyqddfpq.dll.vir;C:\QooBox\Quarantine\C\WINDOWS\system32;Trojan.Virtumod.269;Deleted.;
yohxfxlk.dll.vir;C:\QooBox\Quarantine\C\WINDOWS\system32;Trojan.Virtumod.260;Deleted.;
A0000006.dll;C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1;Trojan.Virtumod.272;Deleted.;
A0000050.dll;C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1;Trojan.Virtumod.274;Deleted.;
A0000067.dll;C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1;Trojan.Virtumod.272;Deleted.;
A0005886.bat;C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP10;Probably BATCH.Virus;Incurable.Moved.;
A0006030.bat;C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP12;Probably BATCH.Virus;Incurable.Moved.;
A0008140.reg;C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP12;Trojan.StartPage.1505;Deleted.;
A0008141.exe;C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP12;Trojan.Click.1487;Deleted.;
A0000120.dll;C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP2;Trojan.Virtumod.272;Deleted.;
A0000121.dll;C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP2;Trojan.Virtumod.269;Deleted.;
A0000168.dll;C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP2;Trojan.Virtumod.272;Deleted.;
A0000175.dll;C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP2;Trojan.Virtumod.272;Deleted.;
A0000176.dll;C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP2;Trojan.Virtumod.274;Deleted.;
A0000280.dll;C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP3;Trojan.Virtumod.269;Deleted.;
A0000282.dll;C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP3;Trojan.Virtumod.272;Deleted.;
A0000283.dll;C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP3;Trojan.Virtumod.274;Deleted.;
A0000319.dll;C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP3;Trojan.Virtumod.272;Deleted.;
A0000320.dll;C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP3;Trojan.Virtumod.274;Deleted.;
A0000369.dll;C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP3;Trojan.Virtumod.274;Deleted.;
A0000395.dll;C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP3;Trojan.Virtumod.274;Deleted.;
A0001422.dll;C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP4;Trojan.Virtumod.274;Deleted.;
A0002466.dll;C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP5;Trojan.Virtumod.269;Deleted.;
A0002467.dll;C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP5;Trojan.Virtumod.269;Deleted.;
A0002468.dll;C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP5;Trojan.Virtumod.269;Deleted.;
A0002469.dll;C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP5;Trojan.Virtumod.272;Deleted.;
A0002470.dll;C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP5;Trojan.Virtumod.240;Deleted.;
A0002471.dll;C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP5;Trojan.Virtumod.269;Deleted.;
A0002472.dll;C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP5;Trojan.Virtumod.269;Deleted.;
A0002473.dll;C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP5;Trojan.Virtumod.269;Deleted.;
A0002474.dll;C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP5;Trojan.Virtumod.272;Deleted.;
A0002475.dll;C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP5;Trojan.Virtumod.269;Deleted.;
A0002476.dll;C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP5;Trojan.Virtumod.260;Deleted.;
A0002493.bat;C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP5;Probably BATCH.Virus;Incurable.Moved.;
A0002504.dll;C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP5;Trojan.Virtumod.260;Deleted.;
A0002505.dll;C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP5;Trojan.Virtumod.274;Deleted.;
A0002554.dll;C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP5;Trojan.Virtumod.260;Deleted.;
A0002557.dll;C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP5;Trojan.Virtumod.260;Deleted.;
A0002661.bat;C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP6;Probably BATCH.Virus;Incurable.Moved.;
A0005721.bat;C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP7;Probably BATCH.Virus;Incurable.Moved.;
A0005774.bat;C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP8;Probably BATCH.Virus;Incurable.Moved.;
A0005832.bat;C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP9;Probably BATCH.Virus;Incurable.Moved.;

Thanks a lot

__RiP_ChAiN_ · Feb 15, 2008

Hello madamat

That scanner didn't find anything out of the ordinary, and your logs are looking pretty good now. Please post back with a new HijackThis log, and an update on how your computer is running.

madamat · Feb 16, 2008

Reply: HJT Log and Update

Hello RiP ChAiN,

I ran a new HJT scan:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:38:08 PM, on 2/16/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\WINDOWS\system32\lxctcoms.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Dell\Media Experience\DMXLauncher.exe
C:\Program Files\Lexmark 5400 Series\lxctmon.exe
C:\Program Files\PeoplePC\ISP6530\Browser\Bartshel.exe
C:\Program Files\Lexmark 5400 Series\ezprint.exe
C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\Google\Google Updater\GoogleUpdater.exe
C:\PROGRA~1\PeoplePC\ISP6530\Browser\PPShared.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://home.peoplepc.com/search/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://broadband.zoomtown.com
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.7\NppBho.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [MMTray] "C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe"
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [DMXLauncher] C:\Program Files\Dell\Media Experience\DMXLauncher.exe
O4 - HKLM\..\Run: [Bart Station] C:\Program Files\PeoplePC\ISP6530\BIN\PPCOLink.exe -STATION
O4 - HKLM\..\Run: [lxctmon.exe] "C:\Program Files\Lexmark 5400 Series\lxctmon.exe"
O4 - HKLM\..\Run: [Lexmark 5400 Series Fax Server] "C:\Program Files\Lexmark 5400 Series\fm3032.exe" /s
O4 - HKLM\..\Run: [EzPrint] "C:\Program Files\Lexmark 5400 Series\ezprint.exe"
O4 - HKLM\..\Run: [LXCTCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCTtime.dll,_RunDLLEntry@16
O4 - HKLM\..\Run: [SpiralFrog] C:\Program Files\SpiralFrog\Spiralfrog.exe
O4 - HKLM\..\Run: [mmtask] "C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: Google Updater.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O4 - Global Startup: QuickBooks Update Agent.lnk = C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {B49C4597-8721-4789-9250-315DFBD9F525} (IWinAmpActiveX Class) - http://cdn.digitalcity.com/radio/ampx/ampx2.6.1.11_en_dl.cab
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: lxct_device - - C:\WINDOWS\system32\lxctcoms.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O24 - Desktop Component 0: (no name) - http://www.webkinz.com/assets/images/splash/splash.jpg
O24 - Desktop Component 1: (no name) - http://www.webkinz.com/assets/images/blank.gif

--
End of file - 8371 bytes

My computer runs well when I am offline but when I used Internet Explorer last nite it went blank. It was like I X'd
out of the screen. When I tried to shutdown and restart I got two messages: " ending ccpp" and the next message "ending explorer.exe. " I've been on it all morning to try to repeat it but its been running fine so maybe that was just an internet error.

Thanks again

__RiP_ChAiN_ · Feb 16, 2008

Hello madamat

Those errors I've had before myself, they probably aren't a sign of anything to worry about.

Please delete the following folder:

C:\Qoobox

Congratulations, your computer is now clean of malware!

Set a New Restore Point to prevent possible reinfection from an old one. Some of the malware you picked up could have been saved in System Restore. Since System Restore is a protected directory, your tools can not access it to delete these bad files which sometimes can reinfect your system. Setting a new restore point AFTER cleaning your system will help prevent this and enable your computer to "roll-back" to a clean working state.

The easiest and safest way to do this is:

Go to Start > Programs > Accessories > System Tools and click "System Restore".
Choose the radio button marked "Create a Restore Point" on the first screen then click "Next". Give the R.P. a name then click "Create". The new point will be stamped with the current date and time. Keep a log of this so you can find it easily should you need to use System Restore.
Then go to Start > Run and type: Cleanmgr
Click "OK".
Click the "More Options" Tab.
Click "Clean Up" in the System Restore section to remove all previous restore points except the newly created one.

Now that you are clean, please follow these simple steps in order to keep your computer clean and secure:

Make your Internet Explorer more secure - This can be done by following these simple instructions:
1. From within Internet Explorer click on the Tools menu and then click on Options.
2. Click once on the Security tab
3. Click once on the Internet icon so it becomes highlighted.
4. Click once on the Custom Level button.
  - Change the Download signed ActiveX controls to Prompt
  - Change the Download unsigned ActiveX controls to Disable
  - Change the Initialize and script ActiveX controls not marked as safe to Disable
  - Change the Installation of desktop items to Prompt
  - Change the Launching programs and files in an IFRAME to Prompt
  - Change the Navigate sub-frames across different domains to Prompt
  - When all these settings have been made, click on the OK button.
  - If it prompts you as to whether or not you want to save the settings, press the Yes button.
5. Next press the Apply button and then the OK to exit the Internet Properties page.
Use an AntiVirus Software - It is very important that your computer has an anti-virus software running on your machine. This alone can save you a lot of trouble with malware in the future.

See this link for a listing of some online & their stand-alone antivirus programs:

Virus, Spyware, and Malware Protection and Removal Resources
Update your AntiVirus Software - It is imperitive that you update your Antivirus software at least once a week (Even more if you wish). If you do not update your antivirus software then it will not be able to catch any of the new variants that may come out.
Use a Firewall - I can not stress how important it is that you use a Firewall on your computer. Without a firewall your computer is succeptible to being hacked and taken over. I am very serious about this and see it happen almost every day with my clients. Simply using a Firewall in its default configuration can lower your risk greatly.

For a tutorial on Firewalls and a listing of some available ones see the link below:

Understanding and Using Firewalls
Visit Microsoft's Windows Update Site Frequently - It is important that you visit http://www.windowsupdate.com regularly. This will ensure your computer has always the latest security updates available installed on your computer. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.
Install SpywareBlaster - SpywareBlaster will added a large list of programs and sites into your Internet Explorer settings that will protect you from running and downloading known malicious programs.

A tutorial on installing & using this product can be found here:

Using SpywareBlaster to protect your computer from Spyware and Malware
Update all these programs regularly - Make sure you update all the programs I have listed regularly. Without regular updates you WILL NOT be protected when new malicious programs are released.

Follow this list and your potential for being infected again will reduce dramatically.

here are some additional utilities that will enhance your safety

IE/Spyad <= IE/Spyad places over 4000 websites and domains in the IE Restricted list which will severely impair attempts to infect your system. It basically prevents any downloads (Cookies etc) from the sites listed, although you will still be able to connect to the sites.
MVPS Hosts file <= The MVPS Hosts file replaces your current HOSTS file with one containing well know ad sites etc. Basically, this prevents your coputer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer
Google Toolbar <= Get the free google toolbar to help stop pop up windows.
Winpatrol <= Download and install the free version of Winpatrol. a tutorial for this product is located here:
Using Winpatrol to protect your computer from malicious software

madamat · Feb 17, 2008

Thank You

Hello RiP ChAiN,

Thank you very much for your time and knowledge. I will definitely refer people to SpyBot just as I was referred. My computer is running great and I took your advice to make it more secure. Thanks again

MaDaMaT
(can you tell)

Virtumonde will not go away

madamat

New member

__RiP_ChAiN_

Emeritus- Malware Team

madamat

New member

madamat

New member

__RiP_ChAiN_

Emeritus- Malware Team

madamat

New member

__RiP_ChAiN_

Emeritus- Malware Team

madamat

New member

__RiP_ChAiN_

Emeritus- Malware Team

madamat

New member

__RiP_ChAiN_

Emeritus- Malware Team

madamat

New member

__RiP_ChAiN_

Emeritus- Malware Team

madamat

New member

__RiP_ChAiN_

Emeritus- Malware Team

madamat

New member