What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] HALP! Persistent Virus(es)

11 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1 last edited
I've tried so much already and nothing is working. I have a strange plethora of viruses. I've run Malwarebytes and my current anti-virus (BitDefender) plus the online TrendMicro, but they still don't seem to be catching it. Or they'll say it's removed but there's still a hint of virus on my computer. *sob, sniffle, panic, death*

The virus was the Generic 8 virus, with something called "Vundo" attached. Now I'm seeing "BlueskyAgency" or something close to that. It's all bullocksed up, I have no idea what I have now.

Anywho, here's my Malwarebytes log in safe mode and HJT log. (Malwarebytes log claims there's nothing in regular mode, but the BlueSkyAgency one is definitely still there, another one just popped up. In Safe Mode Malwarebytes catches several of the infected files and "removes them", but I'm still having problems.) Someone please tell this not-as-tech-savy-as-her-parents-think-she-is chick what to do. *bats eyelashes*




~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Malwarebytes' Anti-Malware 1.34
Database version: 1749
Windows 5.1.2600 Service Pack 2

2/22/2009 11:11:20 PM
newestmwbamLOG

Scan type: Full Scan (C:\|)
Objects scanned: 203140
Time elapsed: 1 hour(s), 37 minute(s), 49 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 1
Registry Keys Infected: 5
Registry Values Infected: 2
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 6

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
C:\WINDOWS\system32\vtUnolMC.dll (Trojan.Vundo) -> No action taken.

Registry Keys Infected:
HKEY_CLASSES_ROOT\CLSID\{6d794cb4-c7cd-4c6f-bfdc-9b77afbdc02c} (Trojan.Vundo) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6d794cb4-c7cd-4c6f-bfdc-9b77afbdc02c} (Trojan.Vundo) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\vtunolmc (Trojan.Vundo) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\xpreapp (Malware.Trace) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\instkey (Trojan.Vundo) -> No action taken.

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{6d794cb4-c7cd-4c6f-bfdc-9b77afbdc02c} (Trojan.Vundo) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer (Trojan.Agent) -> No action taken.

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\WINDOWS\system32\vtUnolMC.dll (Trojan.Vundo) -> No action taken.
C:\Documents and Settings\Pixie.SILVERGODDESS\Local Settings\Temp\aownxecmrs.tmp (Rogue.Installer) -> No action taken.
C:\Documents and Settings\Pixie.SILVERGODDESS\Local Settings\Temp\winvsnet.tmp (Rogue.Installer) -> No action taken.
C:\WINDOWS\system32\afisicx.exe (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\comsa32.sys (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\soxpeca.exe (Trojan.Agent) -> No action taken.



~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 4:00:53 AM, on 2/23/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\BitDefender\BitDefender 2009\bdagent.exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\PROGRA~1\MI3AA1~1\rapimgr.exe
C:\Program Files\BitDefender\BitDefender 2009\seccenter.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\rundll32.exe
C:\Documents and Settings\Pixie.SILVERGODDESS\Desktop\HiJackThis.exe
C:\Program Files\BitDefender\BitDefender 2009\vsserv.exe
C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe

O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: BitDefender Toolbar - {381FFDE8-2394-4f90-B10D-FC6124A40F8C} - C:\Program Files\BitDefender\BitDefender 2009\IEToolbar.dll
O4 - HKLM\..\Run: [UpdatePDRShortCut] "C:\Program Files\CyberLink\PowerDirector\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\PowerDirector" UpdateWithCreateOnce "Software\CyberLink\PowerDirector\7.0"
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [BDAgent] "C:\Program Files\BitDefender\BitDefender 2009\bdagent.exe"
O4 - HKLM\..\Run: [BitDefender Antiphishing Helper] "C:\Program Files\BitDefender\BitDefender 2009\IEShow.exe"
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite… - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/flas…ent/swflash.cab
O20 - AppInit_DLLs: avbxps.dll
O20 - Winlogon Notify: mlJCSlJA - mlJCSlJA.dll (file missing)
O23 - Service: BitDefender Arrakis Server (Arrakis3) - BitDefender S.R.L. http://www.bitdefender.com - C:\Program Files\Common Files\BitDefender\BitDefender Arrakis Server\bin\Arrakis3.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Intel® PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: BitDefender Desktop Update Service (LIVESRV) - BitDefender SRL - C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe
O23 - Service: Intel® PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: Intel® PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - BitDefender S. R. L. - C:\Program Files\BitDefender\BitDefender 2009\vsserv.exe
O23 - Service: Intel® PROSet/Wireless SSO Service (WLANKEEPER) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe

–
End of file - 5736 bytes
Post #2
Hi, and Welcome to WhatTheTech :)

My name is jpshortstuff. I would be glad to take a look at your log and help you with solving any malware problems. HijackThis logs can take a while to research, so please be patient and I'd be grateful if you would note the following:
  • I will be working on your Malware issues, this may or may not solve other issues you have with your machine.
  • The fixes are specific to your problem and should only be used for the issues on this machine.
  • Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
  • It's often worth reading through the instructions before starting to follow them to amek sure you understand everything you have to do.
  • If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
  • Please reply to this thread. Do not start a new topic.
Download ComboFix by sUBs from here or here

Note: If you already have a copy of ComboFix on your system it is essential that you delete it before downloading this copy.

**Save it to your desktop**

We need to disable one or more of your security programs so that they do not interfere with ComboFix.

You need to disable TeaTimer, so that it doesn't interfere with our fix.

This is a two step process.
First step:
  • Right-click the Spybot Icon in the System Tray (looks like a blue/white calendar with a padlock symbol)
  • If you have the new version 1.5, click once on Resident Protection, then right-click the Spybot icon again and make sure Resident Protection is now Unchecked. The Spybot icon in the System tray should now be now colorless.
  • If you have Version 1.4, Click on Exit Spybot S&D Resident
Second step, For both versions :
  • Open Spybot S&D
  • Click Mode, choose Advanced Mode
  • Go to the bottom of the vertical panel on the left, click Tools
  • Then, also in left panel, click Resident shows a red/white shield.
  • If your firewall raises a question, say OK
  • In the Resident protection status frame, Uncheck the box labeled Resident "Tea-Timer"(Protection of over-all system settings) active
  • OK any prompts.
  • Use File, Exit to terminate Spybot
  • Reboot your machine for the changes to take effect.
Please disable BitDefender via the System Tray (by your clock) as well if you can. Re-enable after reboot if it doesn't automcatically.

Double click on ComboFix.exe & follow the prompts. If you are prompted to install the Recovery Console I recommend you go ahead and hit yes.
When finished, it shall produce a log for you. Please save that log to post in your next reply along with a fresh HJT log

Notes:
  • Do not mouseclick combofix's window whilst it's running. That may cause it to stall.
  • ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
  • Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you - please let me know.
  • ComboFix disconnects your machine from the internet when it runs. This connection should be automatically restored when ComboFix completes its run. If ComboFix runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

I need to see another log from HijackThis.
  • Run Hijackthis.
  • Click on Open the Misc Tools section.
  • Next click on Open uninstall manager.
  • Press the Save list button.
  • Save the file to your desktop, with the default name of uninstall_list
  • Copy & Paste the entire contents of that file in your in your next post.
Thanks.
Post #3
Hey, thanks for replying. I couldn't do the SpyBot bit… I don't think it's on my computer and I didn't see any kind of SystemTray icon… but I ran ComboFix and got that log, plus the other specified log from HJT you requested. Also, I tried disabling BitDefender. I ended the two processes I know are from BitDefender and tried shutting off every security option - unfortunately ComboFix still said BitDefender was running. Lastly, I'd like to note that when I restarted my computer after the ComboFix, I got the blue screen of death for some reason. o_0;


——ComboFix Log———-

ComboFix 09-02-25.02 - Pixie 2009-02-25 23:25:53.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.2046.1465 [GMT -5:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
AV: BitDefender Antivirus *On-access scanning enabled* (Updated)
FW: BitDefender Firewall *enabled*
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\Mozilla Firefox\components\476ecdd3-b24a-0922-9f6e-bab8de765504.dll
c:\windows\akui3568.exe
c:\windows\system32\404Fix.exe
c:\windows\system32\d.exe
c:\windows\system32\dumphive.exe
c:\windows\system32\IEDFix.C.exe
c:\windows\system32\IEDFix.exe
c:\windows\system32\IStCbccf.ini
c:\windows\system32\IStCbccf.ini2
c:\windows\system32\o4Patch.exe
c:\windows\system32\Process.exe
c:\windows\system32\SrchSTS.exe
c:\windows\system32\tmp.reg
c:\windows\system32\tpszxyd.sys
c:\windows\system32\twain32
c:\windows\system32\twain32\local.ds
c:\windows\system32\twain32\user.ds
c:\windows\system32\udxfytw.sys
c:\windows\system32\VACFix.exe
c:\windows\system32\VCCLSID.exe
c:\windows\system32\WS2Fix.exe
c:\windows\Tasks\imlrsqnr.job
c:\windows\wiaserviv.log

c:\windows\system32\userinit.exe . . . is infected!!

c:\windows\system32\svchost.exe . . . is infected!!

c:\windows\system32\spoolsv.exe . . . is infected!!

c:\windows\explorer.exe . . . is infected!!

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Service_UACd.sys


((((((((((((((((((((((((( Files Created from 2009-01-26 to 2009-02-26 )))))))))))))))))))))))))))))))
.

2009-02-23 15:05 . 2009-02-25 23:06 491 –a—— c:\windows\system32\BDUpdateV1.xml
2009-02-22 16:27 . 2002-02-15 14:02 676,352 –a—— c:\windows\system32\rtl60.bpl
2009-02-22 16:27 . 2009-02-22 10:05 32,768 –a—— c:\windows\system32\umtcdtw.sys
2009-02-19 19:39 . 2009-02-25 23:11 81,984 –a—— c:\windows\system32\bdod.bin
2009-02-19 19:34 . 2009-02-19 19:34 850 –a—— c:\windows\system32\ProductTweaks.xml
2009-02-19 19:34 . 2009-02-19 19:34 385 –a—— c:\windows\system32\user_gensett.xml
2009-02-19 19:30 . 2009-02-19 19:30 d——– c:\windows\system32\logs
2009-02-19 19:30 . 2009-02-19 19:30 d——– c:\documents and settings\Pixie.SILVERGODDESS\Application Data\BitDefender
2009-02-19 19:30 . 2009-02-19 19:30 d——– C:\Binaries
2009-02-19 19:29 . 2009-02-19 19:30 d——– c:\program files\BitDefender
2009-02-19 19:29 . 2009-02-19 19:33 d——– c:\documents and settings\All Users.WINDOWS\Application Data\BitDefender
2009-02-19 19:24 . 2009-02-19 19:30 d——– c:\program files\Common Files\BitDefender
2009-02-18 18:35 . 2009-02-18 18:36 4,643,960 –a—— c:\windows\paupw7742.exe
2009-02-18 18:35 . 2009-02-18 18:35 876,544 –a—— c:\windows\system32\hlihrlnk.exe
2009-02-18 18:35 . 2009-02-18 18:35 400,896 –a—— c:\windows\rgmonsvc.exe
2009-02-16 00:34 . 2009-02-16 00:34 d——– c:\documents and settings\All Users.WINDOWS\CyberLink
2009-02-15 23:56 . 2009-02-15 23:56 d——– c:\documents and settings\Pixie.SILVERGODDESS\Application Data\CyberLink
2009-02-15 23:56 . 2009-02-15 23:56 d——– c:\documents and settings\All Users.WINDOWS\Application Data\CyberLink
2009-02-15 23:52 . 2009-02-15 23:52 d——– c:\program files\SmartSound Software
2009-02-15 23:52 . 2009-02-15 23:52 d——– c:\documents and settings\All Users.WINDOWS\Application Data\SmartSound Software Inc
2009-02-15 23:30 . 2009-02-15 23:30 d——– c:\documents and settings\Pixie.SILVERGODDESS\Application Data\Video DVD Maker FREE
2009-02-15 17:33 . 2009-02-15 17:40 d——– c:\program files\RADVideo
2009-02-13 02:20 . 2009-02-13 02:21 d——– c:\program files\Malwarebytes' Anti-Malware
2009-02-13 02:20 . 2009-02-11 10:19 38,496 –a—— c:\windows\system32\drivers\mbamswissarmy.sys
2009-02-13 02:20 . 2009-02-11 10:19 15,504 –a—— c:\windows\system32\drivers\mbam.sys
2009-02-13 01:59 . 2009-02-13 01:59 d–h—– c:\windows\system32\GroupPolicy
2009-02-06 18:52 . 2009-02-06 18:52 49,504 –a—— c:\windows\system32\sirenacm.dll
2009-02-05 01:24 . 2009-02-20 21:35 d-a—— c:\documents and settings\All Users.WINDOWS\Application Data\TEMP
2009-02-03 17:03 . 2009-02-03 17:03 104,328 –a—— c:\windows\system32\drivers\bdfndisf.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-02-24 07:39 ——— d—–w c:\documents and settings\Pixie.SILVERGODDESS\Application Data\FrostWire
2009-02-18 23:30 ——— d—–w c:\documents and settings\Pixie.SILVERGODDESS\Application Data\U3
2009-02-16 04:53 ——— d–h–w c:\program files\InstallShield Installation Information
2009-02-16 04:50 ——— d—–w c:\program files\CyberLink
2009-02-16 01:57 ——— d—–w c:\program files\Sony
2009-01-27 20:11 ——— d—–w c:\program files\FrostWire
2009-01-24 02:34 ——— d—–w c:\program files\Windows Live
2009-01-24 02:34 ——— d—–w c:\program files\Microsoft
2009-01-24 02:33 ——— d—–w c:\program files\Windows Live SkyDrive
2009-01-24 02:30 ——— d—–w c:\program files\Common Files\Windows Live
2009-01-23 20:15 ——— d—–w c:\documents and settings\Administrator.SILVERGODDESS\Application Data\U3
2009-01-23 06:35 ——— d—–w c:\documents and settings\Pixie.SILVERGODDESS\Application Data\uTorrent
2009-01-22 18:39 244,976 —-a-w c:\windows\WRITE.EXE
2009-01-22 17:40 ——— d—–w c:\documents and settings\All Users.WINDOWS\Application Data\WinZip
2009-01-16 20:24 ——— d—–w c:\documents and settings\Administrator.SILVERGODDESS\Application Data\DivX
2009-01-12 17:58 ——— d—–w c:\documents and settings\Administrator.SILVERGODDESS\Application Data\acccore
2009-01-12 17:46 ——— d—–w c:\documents and settings\Administrator.SILVERGODDESS\Application Data\SUPERAntiSpyware.com
2009-01-12 16:55 ——— d—–w c:\documents and settings\Administrator.SILVERGODDESS\Application Data\Apple Computer
2007-10-01 00:47 564 —-a-w c:\documents and settings\Tim\Application Data\wklnhst.dat
2003-12-17 03:57 160,016 —-a-w c:\documents and settings\Pixie.SILVERGODDESS\wnaspi32.dll
2008-12-16 22:52 61,440 —-a-w c:\program files\mozilla firefox\components\FFComm.dll
.

——- Sigcheck ——-

2004-08-04 05:00 31232 65cdcc324f0081e10febb75972f11c4f c:\windows\SoftwareDistribution\Download\385cb67dda0ffd4dea8c0d990dc65796\backup\svchost.exe
2008-04-13 19:12 31232 c6bfc17668998ca4bfa2b945744c9e20 c:\windows\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\svchost.exe
2004-08-04 05:00 31232 8552f6df609adacf801cd770dd904284 c:\windows\system32\svchost.exe
2004-08-04 05:00 31232 9d3a3f77a747ab4215e33402815aa50d c:\windows\system32\dllcache\svchost.exe

2007-06-13 05:23 1050112 e13590a6fdbf85930621d55f6a5a87bf c:\windows\explorer.exe
2007-06-13 06:26 1050112 ed73bfcb669a51ca150fb3cf7757073a c:\windows\$hf_mig$\KB938828\SP2QFE\explorer.exe
2004-08-04 05:00 1049088 08e156cfc7ba96faef396df06bd383bc c:\windows\$NtUninstallKB938828$\explorer.exe
2004-08-04 05:00 1049088 88c2646a693453a345fd0724183ade33 c:\windows\SoftwareDistribution\Download\385cb67dda0ffd4dea8c0d990dc65796\backup\explorer.exe
2008-04-13 19:12 1051136 4916e55488669d2b280495d79d21466d c:\windows\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\explorer.exe
2007-06-13 05:23 1050624 795c253837f0832cc531caaec9b38aa9 c:\windows\system32\dllcache\explorer.exe

2004-08-04 05:00 32768 c2c287f5a8418e3b7940cd6499ec4c49 c:\windows\SoftwareDistribution\Download\385cb67dda0ffd4dea8c0d990dc65796\backup\ctfmon.exe
2008-04-13 19:12 32256 64e974acfabb6eda36f6bcc7396e5249 c:\windows\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\ctfmon.exe
2004-08-04 05:00 32256 509a08602d3bf7996e09340fa5f67ad0 c:\windows\system32\ctfmon.exe
2004-08-04 05:00 32768 d44f01ca3e8f8fd640528d8dfb995c3f c:\windows\system32\dllcache\ctfmon.exe

2005-06-10 19:17 74752 34d9515ff69a5990ef70680f94bcf5b3 c:\windows\$hf_mig$\KB896423\SP2QFE\spoolsv.exe
2004-08-04 05:00 75264 74a3fae96b7e108a0de90125a6a93ede c:\windows\$NtUninstallKB896423$\spoolsv.exe
2005-06-10 18:53 74752 0089c0a3d67f5b924fe13221965c3707 c:\windows\SoftwareDistribution\Download\385cb67dda0ffd4dea8c0d990dc65796\backup\spoolsv.exe
2008-04-13 19:12 75264 b1959d9e17b2112a11db955c64b75071 c:\windows\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\spoolsv.exe
2005-06-10 18:53 75264 610ffa33d5f216604fb71f15b8b35b64 c:\windows\system32\spoolsv.exe
2005-06-10 18:53 74752 2237c496deff264351a83df7164c860e c:\windows\system32\dllcache\spoolsv.exe

2004-08-04 05:00 41472 1a46248cd486dfbbce8d9bbab7beab91 c:\windows\SoftwareDistribution\Download\385cb67dda0ffd4dea8c0d990dc65796\backup\userinit.exe
2008-04-13 19:12 43008 cc6b939190b727f042444c988423b15f c:\windows\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\userinit.exe
2004-08-04 05:00 41984 04be1cb5c36bdf63a9559f0302df5821 c:\windows\system32\userinit.exe
2004-08-04 05:00 41472 99b4c7b953713e81b7a7f8762b84060b c:\windows\system32\dllcache\userinit.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"H/PC Connection Agent"="c:\program files\Microsoft ActiveSync\wcescomm.exe" [2006-11-13 1289000]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"UpdatePDRShortCut"="c:\program files\CyberLink\PowerDirector\MUITransfer\MUIStartMenu.exe" [2008-01-04 222504]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-03-08 782427]
"BDAgent"="c:\program files\BitDefender\BitDefender 2009\bdagent.exe" [2009-02-24 741376]
"BitDefender Antiphishing Helper"="c:\program files\BitDefender\BitDefender 2009\IEShow.exe" [2009-02-25 90112]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-04 32256]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"Userinit"="c:\windows\explorer.exe,"

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=avbxps.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^Adobe Gamma Loader.lnk]
path=c:\documents and settings\All Users.WINDOWS\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk
backup=c:\windows\pss\Adobe Gamma Loader.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=c:\documents and settings\All Users.WINDOWS\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^Digital Line Detect.lnk]
path=c:\documents and settings\All Users.WINDOWS\Start Menu\Programs\Startup\Digital Line Detect.lnk
backup=c:\windows\pss\Digital Line Detect.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^Icatch(VI) SnapDetect.lnk]
path=c:\documents and settings\All Users.WINDOWS\Start Menu\Programs\Startup\Icatch(VI) SnapDetect.lnk
backup=c:\windows\pss\Icatch(VI) SnapDetect.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=c:\documents and settings\All Users.WINDOWS\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=c:\windows\pss\Microsoft Office.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^WinZip Quick Pick.lnk]
path=c:\documents and settings\All Users.WINDOWS\Start Menu\Programs\Startup\WinZip Quick Pick.lnk
backup=c:\windows\pss\WinZip Quick Pick.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATICCC]
–a—— 2006-01-02 18:41 65536 c:\program files\ATI Technologies\ATI.ACE\CLI.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
–a—— 2004-08-04 05:00 32256 c:\windows\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
–a—— 2008-08-08 07:11 511432 c:\program files\DAEMON Tools Lite\daemon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\H/PC Connection Agent]
–a—— 2006-11-13 13:39 1289000 c:\program files\Microsoft ActiveSync\wcescomm.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IMJPMIG8.1]
–a—— 2004-08-04 05:00 229432 c:\windows\ime\imjp8_1\imjpmig.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IntelWireless]
–a—— 2007-10-08 13:13 1122304 c:\program files\Intel\Wireless\Bin\iFrmewrk.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IntelZeroConfig]
–a—— 2007-10-08 13:18 1015808 c:\program files\Intel\Wireless\Bin\ZCfgSvc.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Media Codec Update Service]
–a—— 2007-04-08 11:44 323584 c:\program files\Essentials Codec Pack\update.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002A]
–a—— 2004-08-04 05:00 472064 c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002ASync]
–a—— 2004-08-04 05:00 472064 c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
–a—— 2008-05-27 09:50 434176 c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SigmatelSysTrayApp]
–a—— 2007-05-10 10:22 425984 c:\program files\Sigmatel\C-Major Audio\WDM\stsystra.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
–a—— 2008-12-11 20:26 136600 c:\program files\Java\jre6\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"c:\\Documents and Settings\\All Users\\Documents\\Program Setups\\utorrent.exe"=
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"c:\\Program Files\\AIM6\\aim6.exe"=
"c:\\Program Files\\Sony\\Media Manager for WALKMAN\\MediaManager.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\program files\Microsoft ActiveSync\rapimgr.exe"= c:\program files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
"c:\program files\Microsoft ActiveSync\wcescomm.exe"= c:\program files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
"c:\program files\Microsoft ActiveSync\WCESMgr.exe"= c:\program files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
"c:\\Program Files\\Java\\jre6\\bin\\java.exe"=
"c:\\Program Files\\FrostWire\\FrostWire.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\CyberLink\\PowerDirector\\PDR.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service

R2 BDVEDISK;BDVEDISK;c:\program files\BitDefender\BitDefender 2009\BDVEDISK.sys [2008-10-06 82696]
R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [2007-12-23 45132]
R3 bdfm;BDFM;c:\windows\system32\drivers\bdfm.sys [2008-09-18 111112]
R3 Bdfndisf;BitDefender Firewall NDIS Filter Service;c:\windows\system32\drivers\bdfndisf.sys [2009-02-03 104328]
S1 SASKUTIL;SASKUTIL;\??\c:\program files\SUPERAntiSpyware\SASKUTIL.sys –> c:\program files\SUPERAntiSpyware\SASKUTIL.sys [?]
S3 Arrakis3;BitDefender Arrakis Server;c:\program files\Common Files\BitDefender\BitDefender Arrakis Server\bin\Arrakis3.exe [2008-07-17 139264]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bdx REG_MULTI_SZ scan

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\F]
\Shell\AutoRun\command - F:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{4c9e4d73-bdeb-11db-9da1-00038a000015}]
\Shell\AutoRun\command - D:\LaunchU3.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{66aca8d6-d49b-11dd-813d-0015c5195774}]
\Shell\AutoRun\command - F:\LaunchU3.exe -a
.
- - - - ORPHANS REMOVED - - - -

Notify-mlJCSlJA - mlJCSlJA.dll
MSConfigStartUp-SUPERAntiSpyware - c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe
MSConfigStartUp-UfSeAgnt - c:\program files\Trend Micro\Internet Security\UfSeAgnt.exe


.
——- Supplementary Scan ——-
.
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office10\EXCEL.EXE/3000
.
.
——- File Associations ——-
.
txtfile="c:\windows\system32\nxtepad.exe" "%1"
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-02-25 23:32:18
Windows 5.1.2600 Service Pack 2 NTFS

detected NTDLL code modification:
ZwOpenFile

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{61b5250a-8021-4487-8be7-7505c330576b}\InprocServer32]
@DACL=(02 0000)
@="c:\\WINDOWS\\SYSTEM32\\AVBXPS.DLL"
"ThreadingModel"="free"
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(1376)
c:\windows\system32\Ati2evxx.dll
.
———————— Other Running Processes ————————
.
c:\windows\system32\ati2evxx.exe
c:\program files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe
c:\program files\Intel\Wireless\Bin\S24EvMon.exe
c:\program files\Intel\Wireless\Bin\EvtEng.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Intel\Wireless\Bin\RegSrvc.exe
c:\program files\CyberLink\Shared Files\RichVideo.exe
c:\program files\Intel\Wireless\Bin\WLKEEPER.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\ati2evxx.exe
c:\program files\Viewpoint\Viewpoint Manager\ViewMgr.exe
c:\program files\Microsoft ActiveSync\rapimgr.exe
.
**************************************************************************
.
Completion time: 2009-02-25 23:35:34 - machine was rebooted
ComboFix-quarantined-files.txt 2009-02-26 04:35:31

Pre-Run: 12,582,322,176 bytes free
Post-Run: 12,768,153,600 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

290 — E O F — 2008-11-30 04:48:26






——HJT Log ——-


Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Photoshop 7.0
Adobe Reader 7.0.9
AIM 6
ATI - Software Uninstall Utility
ATI Catalyst Control Center
ATI Display Driver
BitDefender Total Security 2009
Broadcom 440x 10/100 Integrated Controller
Broadcom Management Programs
CEP (Color Enable Package) v.9.0 (beta)
Choice Guard
Comcast High-Speed Internet Install Wizard
Conexant HDA D110 MDC V.92 Modem
CyberLink PowerDirector
CyberLink PowerDirector
Digital Line Detect
Disney Pirates of the Caribbean Online
DivX Codec
DivX Converter
DivX Player
DivX Web Player
FrostWire 4.17.2
High Definition Audio Driver Package - KB888111
HijackThis 2.0.2
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows Media Player 11 (KB939683)
Hotfix for Windows XP (KB909394)
Hotfix for Windows XP (KB915865)
Hotfix for Windows XP (KB926239)
Hotfix for Windows XP (KB952287)
ICatch (VI) PC Camera
Intel® PROSet/Wireless Software
Java™ 6 Update 11
Java™ 6 Update 3
Java™ 6 Update 5
Java™ 6 Update 7
Magic ISO Maker v5.4 (build 0251)
Malwarebytes' Anti-Malware
mCore
mDriver
mDrWiFi
Media Manager for WALKMAN 1.1
mHlpDell
Microsoft .NET Framework 1.1
Microsoft .NET Framework 2.0
Microsoft ActiveSync
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft National Language Support Downlevel APIs
Microsoft Office XP Professional with FrontPage
Microsoft Silverlight
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
mIWA
mLogView
mMHouse
Mozilla Firefox (3.0.6)
mPfMgr
mPfWiz
mProSafe
mSCfg
mSSO
MSVCRT
MSXML 6 Service Pack 2 (KB954459)
mWlsSafe
mWMI
mZConfig
QuickTime
RAD Video Tools
Rhapsody Player Engine
Security Update for Windows Media Player (KB911564)
Security Update for Windows Media Player 11 (KB936782)
Security Update for Windows Media Player 11 (KB954154)
Security Update for Windows Media Player 6.4 (KB925398)
Security Update for Windows Media Player 9 (KB936782)
Security Update for Windows XP (KB893756)
Security Update for Windows XP (KB896358)
Security Update for Windows XP (KB896423)
Security Update for Windows XP (KB896428)
Security Update for Windows XP (KB899587)
Security Update for Windows XP (KB899591)
Security Update for Windows XP (KB900725)
Security Update for Windows XP (KB901017)
Security Update for Windows XP (KB901190)
Security Update for Windows XP (KB901214)
Security Update for Windows XP (KB902400)
Security Update for Windows XP (KB905414)
Security Update for Windows XP (KB905749)
Security Update for Windows XP (KB908519)
Security Update for Windows XP (KB911562)
Security Update for Windows XP (KB911927)
Security Update for Windows XP (KB913580)
Security Update for Windows XP (KB914388)
Security Update for Windows XP (KB914389)
Security Update for Windows XP (KB917953)
Security Update for Windows XP (KB918118)
Security Update for Windows XP (KB918439)
Security Update for Windows XP (KB919007)
Security Update for Windows XP (KB920213)
Security Update for Windows XP (KB920670)
Security Update for Windows XP (KB920683)
Security Update for Windows XP (KB920685)
Security Update for Windows XP (KB921503)
Security Update for Windows XP (KB922819)
Security Update for Windows XP (KB923191)
Security Update for Windows XP (KB923414)
Security Update for Windows XP (KB923980)
Security Update for Windows XP (KB924270)
Security Update for Windows XP (KB924496)
Security Update for Windows XP (KB924667)
Security Update for Windows XP (KB925902)
Security Update for Windows XP (KB926255)
Security Update for Windows XP (KB926436)
Security Update for Windows XP (KB927779)
Security Update for Windows XP (KB927802)
Security Update for Windows XP (KB928255)
Security Update for Windows XP (KB928843)
Security Update for Windows XP (KB929123)
Security Update for Windows XP (KB930178)
Security Update for Windows XP (KB931261)
Security Update for Windows XP (KB931784)
Security Update for Windows XP (KB932168)
Security Update for Windows XP (KB933729)
Security Update for Windows XP (KB935839)
Security Update for Windows XP (KB935840)
Security Update for Windows XP (KB936021)
Security Update for Windows XP (KB937894)
Security Update for Windows XP (KB938127)
Security Update for Windows XP (KB938464)
Security Update for Windows XP (KB938829)
Security Update for Windows XP (KB941202)
Security Update for Windows XP (KB941568)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB941644)
Security Update for Windows XP (KB941693)
Security Update for Windows XP (KB942615)
Security Update for Windows XP (KB943055)
Security Update for Windows XP (KB943460)
Security Update for Windows XP (KB943485)
Security Update for Windows XP (KB944338)
Security Update for Windows XP (KB944653)
Security Update for Windows XP (KB945553)
Security Update for Windows XP (KB946026)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB948590)
Security Update for Windows XP (KB948881)
Security Update for Windows XP (KB950749)
Security Update for Windows XP (KB950759)
Security Update for Windows XP (KB950760)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951698)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB953838)
Security Update for Windows XP (KB953839)
Security Update for Windows XP (KB954211)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956391)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956841)
Security Update for Windows XP (KB957095)
Security Update for Windows XP (KB957097)
Security Update for Windows XP (KB958644)
Segoe UI
SigmaTel Audio
SmartSound Quicktracks Plugin
Synaptics Pointing Device Driver
The Sims 2
Touch by HTC™ User Guide
Update for Windows XP (KB898461)
Update for Windows XP (KB900485)
Update for Windows XP (KB908531)
Update for Windows XP (KB910437)
Update for Windows XP (KB911280)
Update for Windows XP (KB914882)
Update for Windows XP (KB916595)
Update for Windows XP (KB920872)
Update for Windows XP (KB922582)
Update for Windows XP (KB923845)
Update for Windows XP (KB927891)
Update for Windows XP (KB930916)
Update for Windows XP (KB932823-v3)
Update for Windows XP (KB936357)
Update for Windows XP (KB938828)
Update for Windows XP (KB942763)
Update for Windows XP (KB942840)
Update for Windows XP (KB946627)
Update for Windows XP (KB951072-v2)
Viewpoint Media Player
Windows Driver Package - Intel (w29n51) net (04/05/2006 9.0.4.13)
Windows Driver Package - Intel (w39n51) net (04/27/2006 10.1.1.7)
Windows Essentials Media Codec Pack 1.0
Windows Installer 3.1 (KB893803)
Windows Live Call
Windows Live Communications Platform
Windows Live Essentials
Windows Live Essentials
Windows Live Messenger
Windows Live Sign-in Assistant
Windows Live Upload Tool
Windows Media Format 11 runtime
Windows Media Format 11 runtime
Windows Media Player 11
Windows Media Player 11
Windows Media Player Firefox Plugin
Windows XP Hotfix - KB873339
Windows XP Hotfix - KB885836
Windows XP Hotfix - KB885884
Windows XP Hotfix - KB886185
Windows XP Hotfix - KB887472
Windows XP Hotfix - KB888302
Windows XP Hotfix - KB890859
Windows XP Hotfix - KB891781
WinRAR archiver
WinZip 12.0
Yahoo! Messenger
Post #5
Hi,

Do you have a Windows Installation Disk at all?

The following scan may take a long time, so make sure you do it when you know you have a good amount of time free.

Please go to Kaspersky website and perform an online antivirus scan.
  • Read through the requirements and privacy statement and click on Accept button.
  • It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
  • When the downloads have finished, click on Settings.
  • Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
    • Spyware, Adware, Dialers, and other potentially dangerous programs
      Archives
      Mail databases
  • Click on My Computer under Scan.
  • Once the scan is complete, it will display the results. Click on View Scan Report.
  • You will see a list of infected items there. Click on Save Report As….
  • Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button.
  • Please post this log in your next reply.
Thanks.
Post #7
Ahhhhhh, sheesh, now I'm having a problem with Kapersky. I'm getting the following error message: Update has failed. Program has failed to start. Close the Kaspersky Online Scanner 7.0 window and open it again to install the program. You must be online to update the Kaspersky Online Scanner 7 database. With the latest database updates, you can find new viruses and other threats. Please go online to use Kaspersky Online Scanner 7. [ERROR: Invalid file signature] ————————————————————————— I've re-tried it several times, and keep getting that. I'm definitely ONLINE, so I have no idea what's wrong.
Post #8
Hi,

Could well be the Malware. We just need to check whether it is a particular virus before we continue.

We need to upload a file to Jotti

1. Click HERE to get to Jotti's site.

2. At the top of the Jotti window, use the Browse button to locate the following file on your system:

c:\windows\explorer.exe

3. Once you have located the file, click SUBMIT and the content of the file will be uploaded by the site and analysed.

4. Please provide me with the results of the analysis.

5. Please repeat steps 2-4 for the following files:
c:\windows\system32\svchost.exe

Thanks.
Post #9
God, this is one horrendous virus. 1 Log below: File: explorer.exe Status: INFECTED/MALWARE (Note: this file has been scanned before. Therefore, this file's scan results will not be stored in the database) MD5: 1760cb3304bcafd3617f51a4c44d0874 Packers detected: - Scanner results Scan taken on 27 Feb 2009 03:32:31 (GMT) A-Squared Found Trojan.Win32.Patched!IK AntiVir Found HEUR/Malware ArcaVir Found nothing Avast Found Win32:Vitro AVG Antivirus Found nothing BitDefender Found nothing ClamAV Found nothing CPsecure Found nothing Dr.Web Found Win32.Virut.56 F-Prot Antivirus Found W32/Patched.E.gen!Eldorado F-Secure Anti-Virus Found Virus.Win32.Virut.ce Ikarus Found Trojan.Win32.Patched.bl Kaspersky Anti-Virus Found Virus.Win32.Virut.ce NOD32 Found Win32/Virut.NBK Norman Virus Control Found W32/Virut.BV Panda Antivirus Found nothing Sophos Antivirus Found nothing VirusBuster Found nothing VBA32 Found nothing When I tried to run the svchost.exe file, I got: The file you uploaded is 0 bytes. It is very likely a firewall or a piece of malware is prohibiting you from uploading this file This is one well thought out virus. *clamps mouth shut in attempts to not curse up a storm*
Post #10 last edited
Hi,

I'm afraid I have to be the bringer of bad news. The Jotti scan confirmed what I was hoping wasn't the case - you have contracted a virus called Virut. This is a file infecter that attempts to infect all executable files on your system, and it looks like it has got most of them already.

The problem is that when it infects them it corrupts them. This causes issues for your computer (which you have no doubt already experienced some of) but also means that it is impossible to dis-infect them.

I'm afraid there is only one way to clean your computer of this particular piece of Malware, and that is to backup your important data, format the computer and re-install Windows.

If you don't have a Windows Installation Disk (if this came with Windows pre-installed), you may have a Manufacturer restore disk to restore the computer to its original state - this depends on the Manufacture though. Otherwise, give the Manufacturer a call and ask them to send you a restore disk or Windows installation CD.

When backing up your data make sure you do not back up any executable files (.exe, .com, .scr, .pif, .sys) as these are likely to be infected and will simply re-infect your system again. Here is a guide on backing up your data;
http://www.bleepingcomputer.com/tutorials/tutorial127.html
Although you can use whatever method you prefer.

We also have an excellent guide and information topic for formatting and re-installing here at WhatTheTech:
http://forums.whatthetech.com/How_Reformat…tem_t91962.html

Should you have any questions, please feel free to ask.

I am sorry there is nothing more that we can do.

Thanks.
Post #12
Always sad when we get one we can't fix. However, as far as I'm aware, Virut usually caught from cracks/keygens. Any chance you've used cracked software at all?
Post #13
The only two things I can think of are my Photoshop and my Sims 2, but I've had Photoshop for over a year now and Sims 2 for about half a year and have never seen any problems before… so I don't think it's them. And now backing up my files is getting harder and harder as the virus eats away at my hard drive, and I don't have my USB yet, so backing up what I can with what I have is taking forever - is there anything I can do to delay any further damage so I can get all my files off the computer in time?
Post #14
Hi, Got any Linux Live CDs lying around by any chance? If so, you could boot from that and back up your files from there, but its a bit of a long shot. I'm afraid there's not really anything else we can do. This virus is as nasty as they come - its not going to make things easy for you. Sorry :(
Post #15 last edited
No Linux disc… but for some reason, restarting the computer made it more cooperative. I've been able to back up a decent amount of stuff, now I just need a flash drive to back up the rest. Hopefully everything will go alright in time for me to get the flash drive. *knock on wood* (It helps of course, that I'm running it in safe mode.) I've found 3 Windows reinstallation discs… one from my old laptop, one from this one, and a bootleg. Hopefully ONE of them will work… heh. (Just have to figure out which of the two originals is the right one for this computer.) Thank you for your help. I'll let you know when I've reformatted. I should be able to get that flash drive tomorrow.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI