[Resolved] Possible trojan and browser hijacker.

• Close ALL OTHER PROGRAMS.
• Open the OTScanit folder and double-click on OTScanit.exe to start the program.
• Check the box that says Scan All Users
• Check the Radio button for Rootkit check YES
• Under Additional Scans check the following:
  • File - Lop Check
  • File - Purity Scan
  • Evnt - EventViewer Errors/Warnings (last 10)
• Now click the Run Scan button on the toolbar.
• Let it run unhindered until it finishes.
• When the scan is complete Notepad will open with the report file loaded in it.
• Click the Format menu and make sure that Wordwrap is not checked. If it is then click on it to uncheck it.

• Click Add Reply
• Under the reply panel is the Attachments Panel
• Browse for the attachment file you want to upload, then click the green Upload button
• Once it has uploaded, click the Manage Current Attachments drop down box
• Click on [external image: Posted Image] to insert the attachment into your post

One or more of the identified infections is a backdoor Trojan and a key logger.

If this computer is ever used for on-line banking, I suggest you do the following immediately:

1. Call all of your banks, credit card companies, financial institutions and inform them that you may be a victim of identity theft and to put a watch on your accounts or change all your account numbers.

2. From a clean computer, change ALL your on-line passwords for email, for banks, financial accounts, PayPal, eBay, on-line companies, any on-line forums or groups you belong to.

Do NOT change passwords or do any transactions while using the infected computer because the attacker will get the new passwords and transaction information.

[Kill Explorer]
[Unregister Dlls]
[Processes - Safe List]
YY -> e1a5.tmp -> %SystemRoot%\temp\E1A5.tmp
YY -> svñshost.exe -> %SystemRoot%\system32\svñshost.exe
YY -> svschost.exe -> %SystemRoot%\system32\svschost.exe
[Driver Services - Safe List]
YY -> (raawhvmttmotd) raawhvmttmotd [Kernel | Auto | Stopped] -> %SystemRoot%\system32\drivers\ckfqha.sys
[Registry - Safe List]
< HOSTS File > (784 bytes and 21 lines) -> C:\WINDOWS\System32\drivers\etc\Hosts
YN -> 195.245.119.131 browser-security.microsoft.com -> 
< BHO's [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
YY -> {C5BF49A2-94F3-42BD-F434-3604812C8955} [HKLM] -> %SystemRoot%\system32\hsfd83jfdg.dll [C:\WINDOWS\system32\hsfd83jfdg.dll]
< Internet Explorer ToolBars [HKEY_CURRENT_USER\] > -> HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\
YN -> ShellBrowser\\"{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6}" [HKLM] -> Reg Error: Key does not exist or could not be opened. [Reg Error: Key does not exist or could not be opened.]
YN -> WebBrowser\\"{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6}" [HKLM] -> Reg Error: Key does not exist or could not be opened. [Reg Error: Key does not exist or could not be opened.]
< Internet Explorer ToolBars [HKEY_USERS\S-1-5-21-3869047767-4027495630-107577635-1003\] > -> HKEY_USERS\S-1-5-21-3869047767-4027495630-107577635-1003\Software\Microsoft\Internet Explorer\Toolbar\
YN -> ShellBrowser\\"{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6}" [HKLM] -> Reg Error: Key does not exist or could not be opened. [Reg Error: Key does not exist or could not be opened.]
YN -> WebBrowser\\"{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6}" [HKLM] -> Reg Error: Key does not exist or could not be opened. [Reg Error: Key does not exist or could not be opened.]
< Run [HKEY_LOCAL_MACHINE\] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
YY -> "lrijh8s73jhbfgfd" -> %UserProfile%\Local Settings\Temp\winlognn.exe [C:\DOCUME~1\Owner\LOCALS~1\Temp\winlognn.exe]
YY -> "lsass driver" -> %SystemRoot%\msauc.exe [C:\WINDOWS\msauc.exe]
YN -> "RegistryMechanic" -> []
YY -> "Vzeyogoyineba" -> %SystemRoot%\Mwinubasebiw.dll [rundll32.exe "C:\WINDOWS\Mwinubasebiw.dll",e]
< Run [HKEY_CURRENT_USER\] > -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
YN -> "44138497242337706662347701380875" -> %ProgramFiles%\Antivirus 2009\av2009.exe [C:\Program Files\Antivirus 2009\av2009.exe]
YY -> "lrijh8s73jhbfgfd" -> %UserProfile%\Local Settings\Temp\winlognn.exe [C:\DOCUME~1\Owner\LOCALS~1\Temp\winlognn.exe]
YY -> "MS AntiSpyware 2009" -> %AllUsersProfile%\Application Data\CrucialSoft Ltd\MS AntiSpyware 2009\msas2009.exe ["C:\Documents and Settings\All Users\Application Data\CrucialSoft Ltd\MS AntiSpyware 2009\msas2009.exe" /autorun]
YY -> "svschost.exe" -> %SystemRoot%\system32\svschost.exe [C:\WINDOWS\system32\svschost.exe -check]
YY -> "sysguard" -> %SystemRoot%\sysguard.exe [C:\WINDOWS\sysguard.exe]
YY -> "tezrtsjhfr84iusjfo84f" -> %UserProfile%\Local Settings\Temp\csrssc.exe [C:\DOCUME~1\Owner\LOCALS~1\Temp\csrssc.exe]
< Run [HKEY_USERS\S-1-5-21-3869047767-4027495630-107577635-1003\] > -> HKEY_USERS\S-1-5-21-3869047767-4027495630-107577635-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
YN -> "44138497242337706662347701380875" -> %ProgramFiles%\Antivirus 2009\av2009.exe [C:\Program Files\Antivirus 2009\av2009.exe]
YY -> "lrijh8s73jhbfgfd" -> %UserProfile%\Local Settings\Temp\winlognn.exe [C:\DOCUME~1\Owner\LOCALS~1\Temp\winlognn.exe]
YY -> "MS AntiSpyware 2009" -> %AllUsersProfile%\Application Data\CrucialSoft Ltd\MS AntiSpyware 2009\msas2009.exe ["C:\Documents and Settings\All Users\Application Data\CrucialSoft Ltd\MS AntiSpyware 2009\msas2009.exe" /autorun]
YY -> "svschost.exe" -> %SystemRoot%\system32\svschost.exe [C:\WINDOWS\system32\svschost.exe -check]
YY -> "sysguard" -> %SystemRoot%\sysguard.exe [C:\WINDOWS\sysguard.exe]
YY -> "tezrtsjhfr84iusjfo84f" -> %UserProfile%\Local Settings\Temp\csrssc.exe [C:\DOCUME~1\Owner\LOCALS~1\Temp\csrssc.exe]
< Internet Explorer Extensions [HKEY_CURRENT_USER\] > -> HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Extensions\
YN -> {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52}\\"CLSID" [HKLM] -> [{0000031A-0000-0000-C000-000000000046}]
YN -> {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52}\\"ClsidExtension" [HKLM] -> [Reg Error: Key does not exist or could not be opened.]
YN -> {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52}\\"Default Visible" [HKLM] -> [Reg Error: Key does not exist or could not be opened.]
< Internet Explorer Extensions [HKEY_USERS\S-1-5-21-3869047767-4027495630-107577635-1003\] > -> HKEY_USERS\S-1-5-21-3869047767-4027495630-107577635-1003\Software\Microsoft\Internet Explorer\Extensions\
YN -> {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52}\\"ButtonText" [HKLM] -> [Reg Error: Key does not exist or could not be opened.]
YN -> {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52}\\"CLSID" [HKLM] -> [{0000031A-0000-0000-C000-000000000046}]
YN -> {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52}\\"ClsidExtension" [HKLM] -> [Reg Error: Key does not exist or could not be opened.]
YN -> {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52}\\"Default Visible" [HKLM] -> [Reg Error: Key does not exist or could not be opened.]
< Winlogon\Notify settings [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\
YY -> crypt -> %SystemRoot%\system32\crypts.dll
< SharedTaskScheduler [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler
YN -> "{259BA022-2005-45E9-A965-10EDB9C00618}" [HKLM] -> Reg Error: Key does not exist or could not be opened. [Windowz Updater]
YN -> "{A4F94C0C-54A7-4DB1-9AF3-B22E63D00322}" [HKLM] -> Reg Error: Key does not exist or could not be opened. [g322]
YY -> "{C5BF49A2-94F3-42BD-F434-3604812C8955}" [HKLM] -> %SystemRoot%\system32\hsfd83jfdg.dll [jgzfkj9w38rksndfi7r4]
YY -> "{D5BF4552-94F1-42BD-F434-3604812C807D}" [HKLM] -> %SystemRoot%\system32\rah3b8ffdnd.dll [erajhsf8743kjrngjnf]
< IFEO [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\
YY -> explorer.exe -> %ProgramFiles%\Microsoft Common\svchost.exe [Debugger]
< SecurityProviders [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\\SecurityProviders
*SecurityProviders* -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\\SecurityProviders
YY ->  digeste.dll -> %SystemRoot%\system32\digeste.dll
< SecurityProviders [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\\SecurityProviders
[Files/Folders - Created Within 30 Days]
NY -> digeste.dll -> %SystemRoot%\System32\digeste.dll
NY -> iehelper.dll -> %SystemRoot%\System32\iehelper.dll
NY -> TDSSxxiu.sys -> %SystemRoot%\System32\drivers\TDSSxxiu.sys
NY -> TDSSkalo.dll -> %SystemRoot%\System32\TDSSkalo.dll
NY -> ieupdates.exe -> %SystemRoot%\System32\ieupdates.exe
NY -> scui.cpl -> %SystemRoot%\System32\scui.cpl
NY -> $$$$$$$$.bat -> %SystemRoot%\System32\$$$$$$$$.bat
NY -> hsfd83jfdg.dll -> %SystemRoot%\System32\hsfd83jfdg.dll
NY -> system32.exe -> %SystemRoot%\system32.exe
NY -> kernel32.exe -> %SystemRoot%\kernel32.exe
NY -> CrucialSoft Ltd -> %AllUsersProfile%\Application Data\CrucialSoft Ltd
NY -> rah3b8ffdnd.dll -> %SystemRoot%\System32\rah3b8ffdnd.dll
NY -> svschost.exe -> %SystemRoot%\System32\svschost.exe
NY -> svñshost.exe -> %SystemRoot%\System32\svñshost.exe
NY -> Mwinubasebiw.dll -> %SystemRoot%\Mwinubasebiw.dll
NY -> str.sys -> %SystemRoot%\System32\drivers\str.sys
NY -> msauc.exe -> %SystemRoot%\msauc.exe
NY -> crypts.dll -> %SystemRoot%\System32\crypts.dll
NY -> ckfqha.sys -> %SystemRoot%\System32\drivers\ckfqha.sys
NY -> shell31.dll -> %SystemRoot%\System32\shell31.dll
NY -> wpv881234083759.cpx -> %SystemRoot%\System32\wpv881234083759.cpx
NY -> wpv671234083698.cpx -> %SystemRoot%\System32\wpv671234083698.cpx
NY -> sysguard.exe -> %SystemRoot%\sysguard.exe
NY -> Microsoft Common -> %ProgramFiles%\Microsoft Common
NY -> Mandy Morbid - Tentacle Rape -> %UserProfile%\Desktop\Mandy Morbid - Tentacle Rape
NY -> 58b8791b527f165a21 -> %SystemDrive%\58b8791b527f165a21
NY -> mm.BOT -> %ProgramFiles%\mm.BOT
[Files/Folders - Modified Within 30 Days]
NY -> csrssc.exe -> %UserProfile%\Local Settings\Temp\csrssc.exe
NY -> l26[1].exe -> %UserProfile%\Local Settings\Temp\Temporary Internet Files\Content.IE5\N6YE4GVQ\l26[1].exe
NY -> 162[1].exe -> %UserProfile%\Local Settings\Temp\Temporary Internet Files\Content.IE5\N6YE4GVQ\162[1].exe
NY -> soft[1].exe -> %UserProfile%\Local Settings\Temp\Temporary Internet Files\Content.IE5\N6YE4GVQ\soft[1].exe
NY -> svschost.exe -> %SystemRoot%\System32\svschost.exe
NY -> svñshost.exe -> %SystemRoot%\System32\svñshost.exe
NY -> Mwinubasebiw.dll -> %SystemRoot%\Mwinubasebiw.dll
NY -> digeste.dll -> %SystemRoot%\System32\digeste.dll
NY -> iehelper.dll -> %SystemRoot%\System32\iehelper.dll
NY -> $$$$$$$$.bat -> %SystemRoot%\System32\$$$$$$$$.bat
NY -> TDSSxxiu.sys -> %SystemRoot%\System32\drivers\TDSSxxiu.sys
NY -> TDSSkalo.dll -> %SystemRoot%\System32\TDSSkalo.dll
NY -> system32.exe -> %SystemRoot%\system32.exe
NY -> kernel32.exe -> %SystemRoot%\kernel32.exe
NY -> ieupdates.exe -> %SystemRoot%\System32\ieupdates.exe
NY -> scui.cpl -> %SystemRoot%\System32\scui.cpl
NY -> hsfd83jfdg.dll -> %SystemRoot%\System32\hsfd83jfdg.dll
NY -> winlognn.exe -> %UserProfile%\Local Settings\Temp\winlognn.exe
NY -> rah3b8ffdnd.dll -> %SystemRoot%\System32\rah3b8ffdnd.dll
NY -> str.sys -> %SystemRoot%\System32\drivers\str.sys
NY -> crypts.dll -> %SystemRoot%\System32\crypts.dll
NY -> ckfqha.sys -> %SystemRoot%\System32\drivers\ckfqha.sys
NY -> shell31.dll -> %SystemRoot%\System32\shell31.dll
NY -> msauc.exe -> %SystemRoot%\msauc.exe
NY -> wJQs.exe -> %UserProfile%\Local Settings\Temp\wJQs.exe
NY -> sysguard.exe -> %SystemRoot%\sysguard.exe
NY -> xpdes.dll -> %UserProfile%\Local Settings\Temp\xpdes.dll
[Alternate Data Streams]
NY -> @Alternate Data Stream - 0 bytes -> %SystemRoot%\unvise32qt.exe:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}
NY -> @Alternate Data Stream - 114 bytes -> %AllUsersProfile%\Application Data\TEMP:B835CF2D
NY -> @Alternate Data Stream - 150 bytes -> %AllUsersProfile%\Application Data\TEMP:30FD0CBD
NY -> @Alternate Data Stream - 88 bytes -> %SystemRoot%\unvise32qt.exe:SummaryInformation
[File - Lop Check]
NY -> CrucialSoft Ltd -> C:\Documents and Settings\All Users\Application Data\CrucialSoft Ltd
[Empty Temp Folders]
[Start Explorer]
[Reboot]

• Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools
  
  
• Double click on ComboFix.exe & follow the prompts.
  
  
• As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
  
  
• Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

[external image: Posted Image]

• Doubleclick the drweb-cureit.exe file and Allow to run the express scan
• This will scan the files currently running in memory and when something is found, click the yes button when it asks you if you want to cure it. This is only a short scan.
• Once the short scan has finished, mark the drives that you want to scan.
• Select all drives. A red dot shows which drives have been chosen.
• Click the green arrow at the right, and the scan will start.
• Click 'Yes to all' if it asks if you want to cure/move the file.
• When the scan has finished, in the menu, click file and choose save report list
• Save the report to your desktop. The report will be called DrWeb.csv
• Close Dr.Web Cureit.

• Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools
  
  
• Double click on ComboFix.exe & follow the prompts.
  
  
• As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
  
  
• Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

[external image: Posted Image]

Combofix does nothing when i try to open it.

• Unzip it to your desktop to a folder named avz4
• Double click on AVZ.exe to run it.
• Run an update by clicking the Auto Update button on the Right of the Log window: [external image: Posted Image]
• Click Start to begin the update

• Start AVZ.
  
• Choose from the menu "File" => "Standard scripts " and mark the "Healing/Quarantine and Advanced System Investigation" check box.
• Click on the “Execute selected scripts”.
• Automatic scanning, healing and system check will be executed.
• A logfile (avz_sysinfo.htm) will be created and saved in the LOG folder in the AVZ directory as virusinfo_syscure.zip.
• It is necessary to reboot your machine, because AVZ might disturb some program operations (like antiviruses and firewall) during the system scan.
• All applications will work properly after the system restart.

• Start AVZ.
  
• Choose from the menu "File" => "Standard scripts " and mark the “Advanced System Investigation" check box.
• Click on the "Execute selected scripts".
• A system check will be automatically performed, and the created logfile (avz_sysinfo.htm) will be saved in the LOG folder in the AVZ directory as virusinfo_syscheck.zip.

• Click Add Reply
• Under the reply panel is the Attachments Panel
• Browse for the attachment file you want to upload, then click the green Upload button
• Once it has uploaded, click the Manage Current Attachments drop down box
• Click on [external image: Posted Image] to insert the attachment into your post