What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] *Possibly* Vundo- no other scans are catching it...

13 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
The problem started a few days ago and was almost definitely Vundo. I had Avast on trial period, but it had expired that day. Scanned with Spybot and it came up. It would say it was fixed but it obviously wasn't and kept coming up in subsequent scans. At this point, I could only reboot in Safe Mode (or it would go straight to blue screen). Downloaded AVG and scanned in Safe Mode- didn't seem to do much. Downloaded MalwareBytes and it caught it! Everything seemed fixed and was fine for a day or so. Yesterday searching google on firefox and noticed some (but not all) the search pages where showing legitimate sites, but clicking on the link would redirect to CouponMountain. At first I thought it was the AVG toolbar, and tried to disable it (which I couldn't without uninstalling AVG, apparently). The problem got worse, now all clicked links redirect to malicious sites (which are blocked by my WOT addon). In addition, I'm back in Safe Mode because again it kicks me out of a normal boot up. None of the previously mentioned programs detect it. I uninstalled and reinstalled Spybot and Malwarebytes, but they still can't see it. Uninstalled AVG and downloaded Avira, but can't install it (it looks like teatimer is blocking it, could that be right?). In any case, I only barely know what I'm doing here, and I can't search for the solution because I can't trust any of the sites I come across. Help! :pullhair:

(BTW a lot of these I recognize as factory settings because we restored it about a month ago. It's a hand me down Dell…)

HijackThis Log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2:03:38 PM, on 6/7/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Safe mode with network support

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/mywaybiz
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell4me.com/mywaybiz
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/mywaybiz
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell4me.com/mywaybiz
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll (file missing)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Application Accelerator\iaanotif.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [DwlClient] c:\Program Files\Common Files\Dell\EUSW\Support.exe
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Startup: OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
O4 - Global Startup: Digital Line Detect.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: MUSICMATCH MX Web Player - {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmatch.com/mmz/openWebRadio.html (file missing)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: IAA Event Monitor (IAANTMon) - Intel Corporation - C:\Program Files\Intel\Intel Application Accelerator\iaantmon.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
Post #2
Hi Hillery, welcome to the forum.

To make cleaning this machine easier
  • Please do not uninstall/install any programs unless asked to
    It is more difficult when files/programs are appearing in/disappearing from the logs.
  • Please do not run any scans other than those requested
  • Please follow all instructions in the order posted
  • All logs/reports, etc.. must be posted in Notepad. Please ensure that word wrap is unchecked. In notepad click format, uncheck word wrap if it is checked.
  • Do not attach any logs/reports, etc.. unless specifically requested to do so.
  • If you have problems with or do not understand the instructions, Please ask before continuing.
  • Please stay with this thread until given the All Clear. A absence of symptoms does not mean a clean machine.

Please download DDS and save it to your desktop.
  • Disable any script blocking protection
  • Double click dds.scr to run the tool.
  • When done, DDS.txt will open.
  • Click Yes at the next prompt for Optional Scan.
  • Save both reports to your desktop.
—————————————————

Please include the contents of the following in your next reply:

DDS.txt

Please attach the second file; Attach.txt. To attach a file, do the following:
  • Under the reply panel is the Attachments Panel
  • Browse for the attachment file you want to upload, then click the green Upload button
  • Once it has uploaded, click the Manage Current Attachments drop down box
  • Click on [external image: Posted Image] to insert the attachment into your post

Download the GMER Rootkit Scanner. Unzip it to your Desktop.

Before scanning, make sure all other running programs are closed and no other actions like a scheduled antivirus scan will occur while the scan is being performed. Do not use your computer for anything else during the scan.

Double-click gmer.exe. The program will begin to run.

**Caution**
These types of scans can produce false positives. Do NOT take any action on any "<— ROOKIT" entries unless advised!

If possible rootkit activity is found, you will be asked if you would like to perform a full scan.
  • Click NO
  • In the right panel, you will see a bunch of boxes that have been checked … leave everything checked and ensure the Show all box is un-checked.
  • Now click the Scan button.
    Once the scan is complete, you may receive another notice about rootkit activity.
  • Click OK.
  • GMER will produce a log. Click on the [Save..] button, and in the File name area, type in "GMER.txt"
  • Save it where you can easily find it, such as your desktop.
If you do not receive notice about possible rootkit activity remain on the Rootkit/Malware tab & make sure the 'Show All' button is unticked.
  • Click the Scan button and let the program do its work. GMER will produce a log. Click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
Save it where you can easily find it, such as your desktop.

Please post back with the GMER log and both DDS logs.

Thanks
Post #3
Thank you for your response! I did as you requested and here's the info:

DDS.txt:

DDS (Ver_09-05-14.01) - NTFSx86
Run by [removed] at 14:34:32.93 on Wed 06/10/2009
Internet Explorer: 6.0.2900.2180 BrowserJavaVersion: 1.6.0_13
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.510.118 [GMT -6:00]


============== Running Processes ===============

C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
svchost.exe
C:\Program Files\Intel\Intel Application Accelerator\iaantmon.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\svchost.exe -k imgsvc
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Intel\Intel Application Accelerator\iaanotif.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\Program Files\Dell\Media Experience\PCMService.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Common Files\Dell\EUSW\Support.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Digital Line Detect\DLG.exe
c:\Program Files\Dell\Support\Alert\bin\NotifyAlert.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Java\jre6\bin\jucheck.exe
C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Documents and Settings\Hilllery\Desktop\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.dell4me.com/mywaybiz
uDefault_Page_URL = hxxp://www.dell4me.com/mywaybiz
mDefault_Page_URL = hxxp://www.dell4me.com/mywaybiz
mStart Page = hxxp://www.dell4me.com/mywaybiz
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg8\avgssie.dll
BHO: DriveLetterAccess: {5ca3d70e-1895-11cf-8e15-001234567890} - c:\windows\system32\dla\tfswshx.dll
BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: {BA52B914-B692-46c4-B683-905236F6F655} - No File
EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
mRun: [IAAnotif] c:\program files\intel\intel application accelerator\iaanotif.exe
mRun: [ATIPTA] c:\program files\ati technologies\ati control panel\atiptaxx.exe
mRun: [DVDLauncher] "c:\program files\cyberlink\powerdvd\DVDLauncher.exe"
mRun: [PCMService] "c:\program files\dell\media experience\PCMService.exe"
mRun: [dla] c:\windows\system32\dla\tfswctrl.exe
mRun: [UpdateManager] "c:\program files\common files\sonic\update manager\sgtray.exe" /r
mRun: [DwlClient] c:\program files\common files\dell\eusw\Support.exe
mRun: [GrooveMonitor] "c:\program files\microsoft office\office12\GrooveMonitor.exe"
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRunOnce: [CleanSetup] cmd /C rmdir /S /Q "c:\documents and settings\hilllery\local settings\temp\nro.tmp\"
StartupFolder: c:\docume~1\hilllery\startm~1\programs\startup\onenot~1.lnk - c:\program files\microsoft office\office12\ONENOTEM.EXE
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\digita~1.lnk - c:\program files\digital line detect\DLG.exe
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000
IE: {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmatch.com/mmz/openWebRadio.html
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~2\office12\ONBttnIE.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
DPF: {CAFEEFAC-0014-0002-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/products/plugin/autodl/jinstall-142-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\program files\microsoft office\office12\GrooveSystemServices.dll
SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\hilllery\applic~1\mozilla\firefox\profiles\nb2wnszo.default\

============= SERVICES / DRIVERS ===============

R2 Nero BackItUp Scheduler 4.0;Nero BackItUp Scheduler 4.0;c:\program files\common files\nero\nero backitup 4\NBService.exe [2009-5-15 935208]

=============== Created Last 30 ================

2009-06-10 13:14 4,767 a——- c:\windows\Irremote.ini
2009-06-10 13:02 –d—– c:\program files\Nero
2009-06-10 13:02 –d—– c:\docume~1\alluse~1\applic~1\Nero
2009-06-07 13:33 664 a——- c:\windows\system32\d3d9caps.dat
2009-06-07 13:32 –d—– c:\windows\system32\appmgmt
2009-06-07 02:15 40,160 a——- c:\windows\system32\drivers\mbamswissarmy.sys
2009-06-07 02:15 19,096 a——- c:\windows\system32\drivers\mbam.sys
2009-06-07 02:15 –d—– c:\program files\Malwarebytes' Anti-Malware
2009-06-06 18:51 –d—– c:\program files\Trend Micro
2009-06-06 18:13 552 a——- c:\windows\system32\d3d8caps.dat
2009-06-04 21:24 –d—– c:\docume~1\hilllery\applic~1\Malwarebytes
2009-06-04 21:23 –d—– c:\docume~1\alluse~1\applic~1\Malwarebytes
2009-06-04 21:19 -cd—– c:\docume~1\alluse~1\applic~1\{7972B2E5-3E09-4E5E-81B7-FE5819D6772F}
2009-06-04 20:08 –d-h— C:\$AVG8.VAULT$
2009-06-04 20:04 –d—– c:\docume~1\alluse~1\applic~1\avg8
2009-06-04 17:08 108,336 a——- c:\windows\system32\mswinsck.ocx
2009-06-04 17:07 4,224 a——- c:\windows\system32\drivers\beep.sys
2009-06-04 17:07 4,224 a——- c:\windows\system32\dllcache\beep.sys
2009-06-04 17:07 2 a——- C:\409309565
2009-06-02 19:10 5,632 a——- c:\windows\system32\ptpusb.dll
2009-06-02 19:10 159,232 a——- c:\windows\system32\ptpusd.dll
2009-06-02 19:10 15,104 a——- c:\windows\system32\drivers\usbscan.sys
2009-06-02 19:10 15,104 a——- c:\windows\system32\dllcache\usbscan.sys
2009-05-20 16:10 24 a——- c:\windows\popcinfot.dat
2009-05-20 16:09 –d—– c:\docume~1\alluse~1\applic~1\PopCap Games
2009-05-20 16:09 –d—– c:\program files\PopCap Games

==================== Find3M ====================

2009-04-01 04:48 410,984 a——- c:\windows\system32\deploytk.dll
2009-03-30 17:47 88,563 a——- c:\windows\pchealth\helpctr\offlinecache\index.dat
2009-03-21 08:18 986,112 ——– c:\windows\system32\dllcache\kernel32.dll
2005-08-09 08:38 244,224 a–shr– c:\windows\plugin.dat

============= FINISH: 14:36:26.96 ===============

Attachments:

Post #4
Hi Hillery,

You will need to temporarily disable both your antivirus program and firewall before you run this next tool.

Please read through the instructions to familiarize yourself with what to expect when the tool runs.

If you all ready have combofix on your computer please delete combofix.exe from your desktop.

It is vitally important that combofix is renamed before it is even started to download


Please download ComboFix from Here or Here to your Desktop.

**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**

  • If you are using Firefox, make sure that your download settings are as follows:
    -Tools->Options->Main tab
    -Set to "Always ask me where to Save the files".
  • During the download, rename Combofix to Combo-Fix as follows:

[external image: Posted Image]

[external image: Posted Image]

  • It is important you rename Combofix during the download, but not after.
  • Please do not rename Combofix to other names, but only to the one indicated.

———————————————————–

  • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
  • Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.

    ———————————————————–

  • Double click on ComboFix.exe & follow the prompts. Close all browsers/windows first.
  • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]


Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]


Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

1.Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not run combofix more than once. If you have problems, please post back for additional instructions.
3. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

Please post back with
  • combofix log

Let us know how the computer is at the moment and any problems you are having.
Post #5
Hi! Thanks again for your help… ran ComboFix- it restarted halfway through the scan after detecting the five files listed in this first part of this report. I searched the SKYNET prefix (recognizing the terminator reference). The virus described doesn't sound like what was happening to my comp, though. Also, wallpaper's reset (leading me to wonder what else may be reset). For now it seems the browser hijack is disabled (at least the test run I made seemed fine). System seems a bit faster as well. Here's the report:

ComboFix 09-06-09.06 - Hilllery 06/10/2009 18:23.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.510.329 [GMT -6:00]
Running from: c:\documents and settings\[removed]\Desktop\Combo-Fix.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\drivers\SKYNETrkispkqh.sys
c:\windows\system32\SKYNETbudruimo.dll
c:\windows\system32\SKYNETefedrqjl.dat
c:\windows\system32\SKYNETvncgdqkp.dll
c:\windows\system32\SKYNETxghffdfn.dat

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Service_SKYNETpqdmmycq


((((((((((((((((((((((((( Files Created from 2009-05-11 to 2009-06-11 )))))))))))))))))))))))))))))))
.

2009-06-10 19:54 . 2009-06-10 19:54 ——– d—–w- c:\documents and settings\Hilllery\Application Data\Nero
2009-06-10 19:14 . 2009-06-10 19:14 ——– d—–w- c:\program files\Windows Sidebar
2009-06-10 19:02 . 2009-06-10 19:13 ——– d—–w- c:\program files\Nero
2009-06-10 19:02 . 2009-06-10 19:05 ——– d—–w- c:\documents and settings\All Users\Application Data\Nero
2009-06-10 19:02 . 2009-06-10 19:15 ——– d—–w- c:\program files\Common Files\Nero
2009-06-07 19:33 . 2009-06-09 17:31 664 —-a-w- c:\windows\system32\d3d9caps.dat
2009-06-07 08:15 . 2009-05-26 19:20 40160 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-06-07 08:15 . 2009-06-07 08:15 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2009-06-07 08:15 . 2009-05-26 19:19 19096 —-a-w- c:\windows\system32\drivers\mbam.sys
2009-06-07 00:51 . 2009-06-07 00:51 ——– d—–w- c:\program files\Trend Micro
2009-06-07 00:13 . 2009-06-07 00:13 552 —-a-w- c:\windows\system32\d3d8caps.dat
2009-06-05 03:24 . 2009-06-05 03:24 ——– d—–w- c:\documents and settings\Hilllery\Application Data\Malwarebytes
2009-06-05 03:23 . 2009-06-05 03:23 ——– d—–w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-06-05 03:19 . 2009-06-05 03:19 ——– dc—-w- c:\documents and settings\All Users\Application Data\{7972B2E5-3E09-4E5E-81B7-FE5819D6772F}
2009-06-05 02:08 . 2009-06-05 18:13 ——– d–h–w- C:\$AVG8.VAULT$
2009-06-05 02:04 . 2009-06-07 08:10 ——– d—–w- c:\documents and settings\All Users\Application Data\avg8
2009-06-04 23:07 . 2004-03-19 22:34 4224 —-a-w- c:\windows\system32\drivers\beep.sys
2009-06-04 23:07 . 2004-03-19 22:34 4224 —-a-w- c:\windows\system32\dllcache\beep.sys
2009-06-03 01:10 . 2001-08-18 04:36 5632 —-a-w- c:\windows\system32\ptpusb.dll
2009-06-03 01:10 . 2004-08-04 06:56 159232 —-a-w- c:\windows\system32\ptpusd.dll
2009-06-03 01:10 . 2004-08-04 04:58 15104 —-a-w- c:\windows\system32\drivers\usbscan.sys
2009-06-03 01:10 . 2004-08-04 04:58 15104 —-a-w- c:\windows\system32\dllcache\usbscan.sys
2009-05-20 22:18 . 2009-05-20 22:18 ——– d—–w- c:\documents and settings\Ryan\Local Settings\Application Data\Mozilla
2009-05-20 22:10 . 2009-05-27 04:09 24 —-a-w- c:\windows\popcinfot.dat
2009-05-20 22:09 . 2009-05-20 22:09 ——– d—–w- c:\documents and settings\All Users\Application Data\PopCap Games
2009-05-20 22:09 . 2009-06-04 00:03 ——– d—–w- c:\program files\PopCap Games
2009-05-15 14:02 . 2009-05-15 14:02 2373416 —-a-w- c:\documents and settings\All Users\Application Data\Nero\Nero\DrWeb\DrWeb32.dll
2009-05-15 13:50 . 2009-05-15 13:50 2373416 —-a-w- c:\documents and settings\All Users\Application Data\Nero\Nero 9\DrWeb\DrWeb32.dll
2009-05-14 06:57 . 2009-05-14 06:57 ——– d—–w- c:\program files\Common Files\Adobe AIR
2009-05-14 06:56 . 2009-05-14 06:57 ——– d—–w- c:\program files\Common Files\Adobe
2009-05-14 06:46 . 2009-05-14 07:00 ——– d—–w- c:\documents and settings\Hilllery\Local Settings\Application Data\Adobe
2009-05-14 06:44 . 2009-05-20 22:16 ——– d—–w- c:\documents and settings\All Users\Application Data\NOS
2009-05-14 06:44 . 2009-05-20 22:16 ——– d—–w- c:\program files\NOS

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-06-07 18:56 . 2009-03-30 18:07 ——– d—–w- c:\program files\Spybot - Search & Destroy
2009-06-07 18:56 . 2009-03-30 18:07 ——– d—–w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-06-04 22:58 . 2009-03-30 09:15 ——– d—–w- c:\documents and settings\Hilllery\Application Data\uTorrent
2009-05-13 09:04 . 2009-03-31 01:23 ——– d—–w- c:\documents and settings\All Users\Application Data\Microsoft Help
2009-04-17 19:23 . 2009-03-30 04:07 ——– d—–w- c:\documents and settings\Hilllery\Application Data\Sonic
2009-04-17 19:22 . 2009-04-17 19:22 ——– d—–w- c:\documents and settings\Hilllery\Application Data\Leadertech
2009-04-03 19:45 . 2009-04-03 19:45 488960 —-a-w- c:\documents and settings\Hilllery\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\octoshape\pmv302-0811070-0-main.dll
2009-04-03 19:45 . 2009-04-03 19:45 319488 —-a-w- c:\documents and settings\Hilllery\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\octoshape\octoshape.exe
2009-04-01 10:48 . 2009-04-01 10:48 410984 —-a-w- c:\windows\system32\deploytk.dll
2009-04-01 10:48 . 2009-04-01 10:48 152576 —-a-w- c:\documents and settings\Hilllery\Application Data\Sun\Java\jre1.6.0_13\lzma.dll
2009-03-31 01:44 . 2004-08-24 02:26 75424 —-a-w- c:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-03-30 23:47 . 2004-03-20 17:57 88563 —-a-w- c:\windows\PCHealth\HelpCtr\OfflineCache\index.dat
2009-03-30 04:13 . 2009-03-30 04:13 0 —-a-w- c:\windows\nsreg.dat
2005-08-09 14:38 . 2005-08-09 14:38 244224 –sha-r- c:\windows\plugin.dat
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-04-01 148888]
"IAAnotif"="c:\program files\Intel\Intel Application Accelerator\iaanotif.exe" [2004-03-23 135168]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-05-26 335872]
"DVDLauncher"="c:\program files\CyberLink\PowerDVD\DVDLauncher.exe" [2004-04-11 53248]
"PCMService"="c:\program files\Dell\Media Experience\PCMService.exe" [2004-04-12 290816]
"dla"="c:\windows\system32\dla\tfswctrl.exe" [2004-03-15 122933]
"UpdateManager"="c:\program files\Common Files\Sonic\Update Manager\sgtray.exe" [2003-08-19 110592]
"DwlClient"="c:\program files\Common Files\Dell\EUSW\Support.exe" [2004-05-28 323584]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2007-08-24 33648]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-01-05 413696]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]

c:\documents and settings\Hilllery\Start Menu\Programs\Startup\
OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2007-12-7 101440]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2004-8-23 24576]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Documents and Settings\\Hilllery\\Application Data\\Macromedia\\Flash Player\\www.macromedia.com\\bin\\octoshape\\octoshape.exe"=

.
Contents of the 'Scheduled Tasks' folder

2009-06-02 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 18:34]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.dell4me.com/mywaybiz
mStart Page = hxxp://www.dell4me.com/mywaybiz
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\Hilllery\Application Data\Mozilla\Firefox\Profiles\nb2wnszo.default\
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-06-10 18:28
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
DwlClient = c:\program files\Common Files\Dell\EUSW\Support.exe?l?e?s?\?D?e?l?l?\?E?U?S?W?\?S?u?p?p?o?r?t?.?e?x?e???x???x???????????????????x???????????x???x???????????x???????????x???x???????????@????????????????????????????D?w????????????7??w????x???x??????????????

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2009-06-11 18:30
ComboFix-quarantined-files.txt 2009-06-11 00:30

Pre-Run: 50,217,103,360 bytes free
Post-Run: 52,250,038,272 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Professional" /fastdetect /NoExecute=OptIn

135 — E O F — 2009-05-13 09:04
Post #6
Hi Hillery,

My pleasure.

Also, wallpaper's reset (leading me to wonder what else may be reset).

Please elaborate. What was your wallpaper before and what is it now?

Are you able to access normal Windows now?


Please disable this program until we are finished as it may interfere with our fixes.
SPYBOT TEATIMER
  • Launch Spybot S&D, go to the Mode menu and make sure "Advanced Mode" is selected.
  • On the left hand side, click on Tools, then click on the Resident Icon in the list.
  • Uncheck the "Resident "TeaTimer" (Protection of overall system settings) active." box.
  • Click on the "System Startup" icon in the List
  • Uncheck the "TeaTimer" box and "OK" any prompts.
  • If Teatimer gives you a warning that changes were made, click the "Allow Change" box when prompted.
  • Exit Spybot S&D when done.
  • (When we are done, you can re-enable Teatimer using the same steps but this time place a check next to "Resident TeaTimer" and check the "TeaTimer" box in System Startup.]


µTorrent
You have µTorrent, a P2P/file sharing program installed on your computer. P2P applications like it are the largest source of malware we see. You'll be doing yourself a favor by removing it.

References for the risk of these programs can be found in these links:
http://www.microsoft.com/windows/ie/commun…protection.mspx

http://www.internetworldstats.com/articles…cles/art053.htm

I would recommend that you uninstall µTorrent, however that choice is up to you. If you choose to remove this programs, you can do so via Control Panel >> Add or Remove Programs.

If you wish to keep it, please do not use it until your computer is cleaned.



You have a very old vulnerable version of java installed. Please go to add/remove programs and uninstall

Java 2 Runtime Environment, SE v1.4.2_03


Next, click your start button, open Control panel.
  • Locate the Java icon (it looks like a coffee cup)
  • double click it to open it
  • click the Update tab
  • Click update now
After the java is updated, reboot your computer if not prompted to.


Next, clear the java cache

To clear the Java Plug-in cache:
  • Click Start > Control Panel.
  • Double-click the Java icon in the control panel.
  • On the General tab, Click Settings under Temporary Internet Files.
  • On the Temporary Files Settings screen, Click Delete Files.
  • check all 3 boxes
  • Click OK


You have this program installed, Malwarebytes' Anti-Malware (MBAM). Please update it and run a scan.

Open MBAM

  • Click the Update tab
  • Click Check for Updates
  • If an update is found, it will download and install the latest version.
  • The program will close to update and reopen.
  • Once the program has loaded, select "Perform Quick Scan", then click Scan.
  • The scan may take some time to finish,so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected.
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  • Copy&Paste the entire report in your next reply.
Extra Note:
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.


Please post back with
  • MBAM log
  • new DDS log (just the DDS.txt)

Please describe any symptoms you are having.

Thanks
Post #7
We seem to be running fine now- system boots normally and I'm accessing regular windows. For now the Browser Hijacking seems to have been eliminated. Our wallpaper before yesterday was simply a picture pulled off the internet (from a travel photography website- of a dock with sea and sky in case you where curious) that I had set a few months ago. It is now back to Stonehenge, which is its factory setting. It is also worth noting the virus we thought we had eliminated before I came here changed the wallpaper to black with red letters warning to get a (no doubt malware infested) antivirus program. When Malwarebytes removed that virus (Virtumonde), it went back to the one I had set, but now it is Stonehenge.

Regarding TeaTimer: It seems to have been shut off without me. Though it was running when I first came to this forum with my problem, when I went to disable it prior to running ComboFix, it had already been disabled. Would the virus have done that? Or, if it says somewhere in the reports that it is still running, what am I to do if it says it is disabled on my end?

Before I include the logs: Once again Malwarebytes says it has found nothing. It may be there is nothing to find now, but it said the same thing when there clearly was something, which makes me question my version of the program. Either way, it is updated now and I include its report:

Malwarebytes' Anti-Malware 1.37
Database version: 2263
Windows 5.1.2600 Service Pack 2

6/11/2009 3:35:53 PM
mbam-log-2009-06-11 (15-35-53).txt

Scan type: Quick Scan
Objects scanned: 96107
Time elapsed: 3 minute(s), 27 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

…and the DDS report:

DDS (Ver_09-05-14.01) - NTFSx86
Run by [removed] at 15:37:03.92 on Thu 06/11/2009
Internet Explorer: 6.0.2900.2180 BrowserJavaVersion: 1.6.0_14
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.510.229 [GMT -6:00]


============== Running Processes ===============

C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Intel\Intel Application Accelerator\iaanotif.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\Program Files\Dell\Media Experience\PCMService.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Common Files\Dell\EUSW\Support.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
c:\Program Files\Dell\Support\Alert\bin\NotifyAlert.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Digital Line Detect\DLG.exe
svchost.exe
C:\Program Files\Intel\Intel Application Accelerator\iaantmon.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\svchost.exe -k imgsvc
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Documents and Settings\Hilllery\Desktop\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.dell4me.com/mywaybiz
mStart Page = hxxp://www.dell4me.com/mywaybiz
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg8\avgssie.dll
BHO: DriveLetterAccess: {5ca3d70e-1895-11cf-8e15-001234567890} - c:\windows\system32\dla\tfswshx.dll
BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: {BA52B914-B692-46c4-B683-905236F6F655} - No File
EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
mRun: [IAAnotif] c:\program files\intel\intel application accelerator\iaanotif.exe
mRun: [ATIPTA] c:\program files\ati technologies\ati control panel\atiptaxx.exe
mRun: [DVDLauncher] "c:\program files\cyberlink\powerdvd\DVDLauncher.exe"
mRun: [PCMService] "c:\program files\dell\media experience\PCMService.exe"
mRun: [dla] c:\windows\system32\dla\tfswctrl.exe
mRun: [UpdateManager] "c:\program files\common files\sonic\update manager\sgtray.exe" /r
mRun: [DwlClient] c:\program files\common files\dell\eusw\Support.exe
mRun: [GrooveMonitor] "c:\program files\microsoft office\office12\GrooveMonitor.exe"
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
StartupFolder: c:\docume~1\hilllery\startm~1\programs\startup\onenot~1.lnk - c:\program files\microsoft office\office12\ONENOTEM.EXE
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\digita~1.lnk - c:\program files\digital line detect\DLG.exe
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000
IE: {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmatch.com/mmz/openWebRadio.html
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~2\office12\ONBttnIE.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\program files\microsoft office\office12\GrooveSystemServices.dll
SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\hilllery\applic~1\mozilla\firefox\profiles\nb2wnszo.default\

============= SERVICES / DRIVERS ===============

S2 Nero BackItUp Scheduler 4.0;Nero BackItUp Scheduler 4.0;c:\program files\common files\nero\nero backitup 4\nbservice.exe –> c:\program files\common files\nero\nero backitup 4\NBService.exe [?]

=============== Created Last 30 ================

2009-06-11 15:11 73,728 a——- c:\windows\system32\javacpl.cpl
2009-06-11 15:03 –ds—- c:\documents and settings\hilllery\UserData
2009-06-10 18:16 a-dshr– C:\cmdcons
2009-06-10 18:14 161,792 a——- c:\windows\SWREG.exe
2009-06-10 18:14 155,136 a——- c:\windows\PEV.exe
2009-06-10 18:14 98,816 a——- c:\windows\sed.exe
2009-06-10 18:13 –ds—- C:\Combo-Fix
2009-06-10 13:14 39 a——- c:\windows\Irremote.ini
2009-06-10 13:02 –d—– c:\program files\Nero
2009-06-10 13:02 –d—– c:\docume~1\alluse~1\applic~1\Nero
2009-06-07 13:33 664 a——- c:\windows\system32\d3d9caps.dat
2009-06-07 13:32 –d—– c:\windows\system32\appmgmt
2009-06-07 02:15 40,160 a——- c:\windows\system32\drivers\mbamswissarmy.sys
2009-06-07 02:15 19,096 a——- c:\windows\system32\drivers\mbam.sys
2009-06-07 02:15 –d—– c:\program files\Malwarebytes' Anti-Malware
2009-06-06 18:51 –d—– c:\program files\Trend Micro
2009-06-06 18:13 552 a——- c:\windows\system32\d3d8caps.dat
2009-06-04 21:24 –d—– c:\docume~1\hilllery\applic~1\Malwarebytes
2009-06-04 21:23 –d—– c:\docume~1\alluse~1\applic~1\Malwarebytes
2009-06-04 21:19 -cd—– c:\docume~1\alluse~1\applic~1\{7972B2E5-3E09-4E5E-81B7-FE5819D6772F}
2009-06-04 20:08 –d-h— C:\$AVG8.VAULT$
2009-06-04 20:04 –d—– c:\docume~1\alluse~1\applic~1\avg8
2009-06-04 17:08 108,336 a——- c:\windows\system32\mswinsck.ocx
2009-06-04 17:07 4,224 a——- c:\windows\system32\drivers\beep.sys
2009-06-04 17:07 4,224 a——- c:\windows\system32\dllcache\beep.sys
2009-06-04 17:07 2 a——- C:\409309565
2009-06-02 19:10 5,632 a——- c:\windows\system32\ptpusb.dll
2009-06-02 19:10 159,232 a——- c:\windows\system32\ptpusd.dll
2009-06-02 19:10 15,104 a——- c:\windows\system32\drivers\usbscan.sys
2009-06-02 19:10 15,104 a——- c:\windows\system32\dllcache\usbscan.sys
2009-05-20 16:10 24 a——- c:\windows\popcinfot.dat
2009-05-20 16:09 –d—– c:\docume~1\alluse~1\applic~1\PopCap Games
2009-05-20 16:09 –d—– c:\program files\PopCap Games

==================== Find3M ====================

2009-05-21 11:33 410,984 a——- c:\windows\system32\deploytk.dll
2009-05-07 09:44 344,064 a——- c:\windows\system32\localspl.dll
2009-05-07 09:44 344,064 ——– c:\windows\system32\dllcache\localspl.dll
2009-04-27 03:17 18,432 ——– c:\windows\system32\dllcache\iedw.exe
2009-04-17 03:58 1,846,656 a——- c:\windows\system32\win32k.sys
2009-04-17 03:58 1,846,656 ——– c:\windows\system32\dllcache\win32k.sys
2009-04-15 09:11 584,192 a——- c:\windows\system32\rpcrt4.dll
2009-04-15 09:11 584,192 ——– c:\windows\system32\dllcache\rpcrt4.dll
2009-03-30 17:47 88,563 a——- c:\windows\pchealth\helpctr\offlinecache\index.dat
2009-03-21 08:18 986,112 ——– c:\windows\system32\dllcache\kernel32.dll
2005-08-09 08:38 244,224 a–shr– c:\windows\plugin.dat

============= FINISH: 15:37:39.96 ===============


P.S. What is or was wrong with my computer specifically?
Post #8 last edited
Hi Hillery,

Thanks for the info. I'll try to answer some questions then we'll carry on.

The wallpaper MBAM removed was no doubt infected (desktop hijacker). You should be able to restore the wallpaper you had as I don't see where we removed any image and it seems to have been set to default by one of our tools.

Teatimer: Malware may have disabled it. It showed as running in your origonal HJT log but is not running now according to DDS. You should be able to restart it when we are done without any problem. On the rare occasion when it gets corrutped and you are unable to stop it, uninstall is the only way. I don't believe there is a problem though.

Don't be too hard on MBAM. It is a very good program, after all it did take care of the desktop hijacker. The infection you had was a rootkitted search hijacker. MBAM can deal with some but not all of these types of infection. We had to use GMER to find it.

Where is your antivirus program? All I see is an AVG BHO.


One more scan to check our handiwork.

*Note
It is recommended to disable onboard antivirus program and antispyware programs while performing scans so there are no conflicts and it will speed up scan time.
Please don't go surfing while your resident protection is disabled!
Once the scan is finished remember to re-enable your antivirus along with your antispyware programs.


Please go to Kaspersky website and perform an online antivirus scan.
  • Read through the requirements and privacy statement and click on Accept button.
  • It will start downloading and installing the scanner and virus definitions.
  • You will be prompted to install an application from Kaspersky. Click Run.
  • When the downloads have finished, click on Settings.
  • Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button
    • Spyware, Adware, Dialers, and other potentially dangerous programs
    • Archives
    • Mail databases
  • Click on My Computerr under Scan.
  • Once the scan is complete, it will display the results. Click on View Scan Report.
  • You will see a list of infected items there. Click on Save Report As….
  • Change the Files of type to Text file (.txt)
  • Set the Save In to Desktop
  • click the Save button.
  • Please post this log in your next reply along with a new HijackThis log.

Everything still ok?

Thanks
Post #9
Phew! Kaspersky was the longest scan yet! I take that as a good thing (thorough, at least). Everything still seems to be going fine, same as yesterday. Regarding our missing antivirus- we had Avast but it was a trial version, and we caught Virtumonde the day it expired. In fact, it said it detected a virus but could do nothing to remove it (it just kept popping up a window saying we were infected- got in the way more than anything). Shortly afterwords it popped up saying it had expired (which we had been expecting). After we (supposedly) removed Virtumonde with Malwarebytes, I removed Avast and downloaded AVG but found we were infected with something anyways and AVG didn't seem to see it. I removed AVG because I was going to install Avira instead, but was unable to install Avira- if I recall there was a window that popped up saying it was blocked. That is when I came here. I figured I would install it when you give the all clear, unless there is a better program you can recommend?

As for the no surfing policy- I have been avoiding the internet, however my Husband thought we were fixed already and was on this morning, so I am sincerely sorry if anything else has latched on because of that. We're all on the same page now. Here are the reports, Kaspersky seems to have some bad news…

——————————————————————————–
KASPERSKY ONLINE SCANNER 7.0 REPORT
Friday, June 12, 2009
Operating System: Microsoft Windows XP Professional Service Pack 2 (build 2600)
Kaspersky Online Scanner version: 7.0.26.13
Program database last update: Friday, June 12, 2009 23:44:41
Records in database: 2338558
——————————————————————————–

Scan settings:
Scan using the following database: extended
Scan archives: yes
Scan mail databases: yes

Scan area - My Computer:
A:\
C:\
D:\
E:\

Scan statistics:
Files scanned: 61503
Threat name: 1
Infected objects: 2
Suspicious objects: 0
Duration of the scan: 01:35:15


File name / Threat name / Threats count
C:\Qoobox\Quarantine\C\WINDOWS\system32\SKYNETvncgdqkp.dll.vir Infected: Trojan.Win32.Monder.gen 1
C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP63\A0008635.dll Infected: Trojan.Win32.Monder.gen 1

The selected area was scanned.


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 6:04:13 PM, on 6/12/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Intel\Intel Application Accelerator\iaanotif.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\Program Files\Dell\Media Experience\PCMService.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Common Files\Dell\EUSW\Support.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
c:\Program Files\Dell\Support\Alert\bin\NotifyAlert.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\Intel\Intel Application Accelerator\iaantmon.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Java\jre6\bin\java.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell4me.com/mywaybiz
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell4me.com/mywaybiz
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll (file missing)
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Application Accelerator\iaanotif.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [DwlClient] c:\Program Files\Common Files\Dell\EUSW\Support.exe
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
O4 - Global Startup: Digital Line Detect.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: MUSICMATCH MX Web Player - {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmatch.com/mmz/openWebRadio.html (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: IAA Event Monitor (IAANTMon) - Intel Corporation - C:\Program Files\Intel\Intel Application Accelerator\iaantmon.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Nero BackItUp Scheduler 4.0 - Unknown owner - C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe (file missing)

–
End of file - 5646 bytes
Post #10
Hi Hillery,

No, nothing really bad in Kaspersky, one is in quarantine and the other is in an old System Restore point. Both will be removed during the tools cleanup.

A small note about Avast Home (free version). It does not really expire. You simply have to register it to get a product key that is good for one year. At that time, just submit for a new key.
http://avast.com/eng/home-registration.php

Not any one antivirus program will catch it all. Some detect what other miss and vise versa. We see logs here with all products represented. :(

Any one of these 3 free ones should serve you well. Only install one.

Avast
Help and support can be found here Avast Forum
AVG
Help and support can be found here AVG Forum
Antivir PersonalEditionClassic
Help and support can be found hereAvira Personal Support Forum



One little fix to do then we'll cleanup.

Open hijackthis, do a system scan only and checkmark these lines, if present

O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll (file missing)

Close ALL other windows/browsers and click Fix Checked. Answer Yes if prompted. Close HJT.



Clean up time

Now lets uninstall GMER:
  • Copy the entire contents of the Code Box below to Notepad.
  • Name the file as gmer_uninstall.bat
  • Change the Save as Type to All Files
  • and Save it in the folder where GMER.exe was saved
  • Once saved, double click on the gmer_uninstall.bat file. a MSDOS window will be displayed. That is normal.
Do Not copy the word CODE

@echo off
sc stop gmer
sc delete gmer
if exist %SystemRoot%\System32\drivers\gmer.sys del /f /q %SystemRoot%\System32\drivers\gmer.sys
if exist %SystemRoot%\gmer.dll del /f /q %SystemRoot%\gmer.dll
if exist %SystemRoot%\gmer.exe del /f /q %SystemRoot%\gmer.exe
if exist %SystemRoot%\gmer.ini del /f /q %SystemRoot%\gmer.ini
if exist %SystemRoot%\gmer_uninstall.cmd del /f /q %SystemRoot%\gmer_uninstall.cmd
if exist %SystemRoot%\gmer.bat del /f /q %SystemRoot%\gmer.bat
if exist %SystemRoot%\gmer.reg del /f /q %SystemRoot%\gmer.reg
if exist %SystemRoot%\gmer.log del /f /q %SystemRoot%\gmer.log
rd /s /q gmer
del /f /q gmer_uninstall.bat
exit


From your desktop, please delete if present
  • any notepads/logs that we created
  • GMER.zip
  • GMER.exe
  • DDS.scr

Next

Click the Start button, click Run. Copy and paste the following line into the run box and click OK
Combofix /u


I suggest you keep MBAM as an on demand scanner. Don't forget to re-enable Teatimer when you are done.

Updates and upgrades

* If you are running Microsoft Office, or any portion thereof, go to the Microsoft's Office Update site and make sure you have at least all the cirtical updates installed (Free) Microsoft Office Update

Some Recommendations and prevention tips

Basic security consists of 1 antivirus program, 1 resident antispyware program, 1 on demand antispyware program and a firewall. Once you install your antivirus just add a firewall.

* If you are behind a router Windows firewall should be fine. Otherwise a 3rd party firewall with outbound monitoring is recommended.

Click FIREWALL for tips, reviews and links to good, free and paid for firewalls. (Note: Zone Alarm is becoming bloatware, IMO)


You should also use Spyware Blaster to help immunize your computer.

- SpywareBlaster will add a large list of programs and sites into your Internet Explorer
settings that will protect you from running and downloading known malicious programs.

OR

A guide to understanding and using the hosts file.

Learn how your Hosts file can protect you and how you can protect it.
Besides the Hosts file information, there are links to a very good updated hosts file, a host file manager. and some programs that can protect your hosts file.
HOSTS

Please read the info on disabling the DNS Client before installing a custom hosts file.


-Secure your Internet Explorer

From within Internet Explorer click on the Tools menu and then click on Options.
  • Click once on the Security tab
  • Click once on the Internet icon so it becomes highlighted.
  • Click once on the Custom Level button.
  • Change the Download signed ActiveX controls to Prompt
  • Change the Download unsigned ActiveX controls to Disable
  • Change the Initialize and script ActiveX controls not marked as safe to Disable
  • Change the Installation of desktop items to Prompt
  • Change the Launching programs and files in an IFRAME to Prompt
  • Change the Navigate sub-frames across different domains to Prompt
  • When all these settings have been made, click on the OK button.
  • If it prompts you as to whether or not you want to save the settings, press the Yes button.
Next press the Apply button and then the OK to exit the Internet Properties page.


- Ensure that Automatic Update is turned on so you get all the latest patches.
Click start, control panel, click Security Center.


- Keep your antivirus program updated, as well as any other security programs you have.


- You may also want to read this article By Tony Klein
http://www.freedomlist.com/forum/viewtopic.php?t=22879


-Check this site out to check for out of date programs
Secunia Personal Software Inspector (PSI) 1.0


We will keep this thread open for a couple of days. Please post back if you have any problems or questions. Please post back when you have finished so this thread can be marked "Resolved".

Take care :adios:
Post #13
Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance. If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread. Everyone else please begin a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI