What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] Help! Vundo trojan

14 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Hallo,

Need some help, Vundo is on my machine and I can't erase it.

Hijackthis log file:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:50:38, on 07-07-2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16850)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\Programas\Fingerprint Sensor\AtService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Programas\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\WLTRYSVC.EXE
C:\WINDOWS\System32\bcmwltry.exe
C:\WINDOWS\system32\spoolsv.exe
c:\programas\idt\dellxpm09b_6017v022\wdm\stacsv.exe
C:\Programas\Avira\AntiVir Desktop\sched.exe
C:\WINDOWS\TEMP\tyhretchbs.exe
C:\WINDOWS\TEMP\tyhretchbs.exe
C:\Programas\Avira\AntiVir Desktop\avguard.exe
C:\Programas\COMODO\BackUp\CmdBkSvc.exe
C:\WINDOWS\system32\DWRCS.EXE
C:\Programas\Malwarebytes' Anti-Malware\mbamservice.exe
C:\Programas\Ficheiros comuns\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Programas\Spyware Doctor\pctsAuxs.exe
C:\Programas\Spyware Doctor\pctsSvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\SearchIndexer.exe
C:\Programas\Spyware Doctor\pctsTray.exe
C:\WINDOWS\system32\DWRCST.exe
C:\Programas\Dell\Dell ControlPoint\DCPButtonSvc.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Programas\IDT\WDM\sttray.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\WINDOWS\system32\AESTFltr.exe
C:\Programas\Windows Defender\MSASCui.exe
C:\WINDOWS\system32\WLTRAY.exe
C:\Programas\CyberLink\PowerDVD DX\PDVDDXSrv.exe
C:\Programas\Dell\Dell ControlPoint\Dell.ControlPoint.exe
C:\Programas\DellTPad\Apoint.exe
C:\WINDOWS\PixArt\PAC7302\Monitor.exe
C:\Programas\Avira\AntiVir Desktop\avgnt.exe
C:\Programas\Dell\Dell ControlPoint\System Manager\DCPSysMgrSvc.exe
C:\Programas\Malwarebytes' Anti-Malware\mbamgui.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programas\DellTPad\ApMsgFwd.exe
C:\Programas\Windows Live\Messenger\msnmsgr.exe
C:\Programas\DellTPad\HidFind.exe
C:\Programas\Skype\Phone\Skype.exe
C:\Programas\DellTPad\Apntex.exe
C:\Programas\Ficheiros comuns\InstallShield\UpdateService\ISUSPM.exe
C:\Programas\IObit\Advanced SystemCare 3\AWC.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Programas\Dell\Dell ControlPoint\System Manager\DCPSysMgr.exe
C:\Programas\Windows Live\Contacts\wlcomm.exe
C:\Programas\Skype\Plugin Manager\skypePM.exe
C:\WINDOWS\System32\alg.exe
C:\Programas\Mozilla Firefox\firefox.exe
C:\Documents and Settings\carlos.simoes\Ambiente de trabalho\HiJackThis.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: Facilitador de Leitor de Link Adobe PDF - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programas\Ficheiros comuns\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programas\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programas\Ficheiros comuns\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {A9B03309-CF90-4397-934B-9FA53AC09D94} - c:\windows\system32\ujrkcaq.dll
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [SysTrayApp] %ProgramFiles%\IDT\WDM\sttray.exe
O4 - HKLM\..\Run: [AESTFltr] "C:\WINDOWS\system32\AESTFltr.exe" /NoDlg
O4 - HKLM\..\Run: [Windows Defender] "C:\Programas\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\WINDOWS\system32\WLTRAY.exe
O4 - HKLM\..\Run: [PDVDDXSrv] "C:\Programas\CyberLink\PowerDVD DX\PDVDDXSrv.exe"
O4 - HKLM\..\Run: [DellControlPoint] "C:\Programas\Dell\Dell ControlPoint\Dell.ControlPoint.exe"
O4 - HKLM\..\Run: [Apoint] C:\Programas\DellTPad\Apoint.exe
O4 - HKLM\..\Run: [PAC7302_Monitor] C:\WINDOWS\PixArt\PAC7302\Monitor.exe
O4 - HKLM\..\Run: [JobHisInit] C:\Programas\RDS\RMClient\JobHisInit.exe
O4 - HKLM\..\Run: [MplSetUp] C:\Programas\RDS\RMClient\MplSetUp.exe
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [avgnt] "C:\Programas\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [Malwarebytes' Anti-Malware] "C:\Programas\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
O4 - HKLM\..\Run: [ISTray] "C:\Programas\Spyware Doctor\pctsTray.exe"
O4 - HKLM\..\Run: [DameWare MRC Agent] C:\WINDOWS\system32\DWRCST.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Programas\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Skype] "C:\Programas\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [ISUSPM] "C:\Programas\Ficheiros comuns\InstallShield\UpdateService\ISUSPM.exe" -scheduler
O4 - HKCU\..\Run: [Advanced SystemCare 3] "C:\Programas\IObit\Advanced SystemCare 3\AWC.exe" /startup
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIÇO LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Serviço de rede')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Programas\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Programas\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
O4 - Global Startup: Dell ControlPoint System Manager.lnk = C:\Programas\Dell\Dell ControlPoint\System Manager\DCPSysMgr.exe
O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programas\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programas\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Pesquisar - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programas\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programas\Messenger\msmsgs.exe
O15 - Trusted Zone: http://intranetz.zagope.pt
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1239895530828
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1239895500359
O16 - DPF: {C4847596-972C-11D0-9567-00A0C9273C2A} (Crystal Report Viewer Control) - http://intranetz.zagope.pt/viewer/activeXV…tivexviewer.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHEI~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: yrzvwyhm - C:\WINDOWS\SYSTEM32\ujrkcaq.dll
O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Programas\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Programas\Avira\AntiVir Desktop\avguard.exe
O23 - Service: AuthenTec Fingerprint Service (ATService) - AuthenTec, Inc. - C:\Programas\Fingerprint Sensor\AtService.exe
O23 - Service: Dell ControlPoint Button Service (buttonsvc32) - Dell Inc. - C:\Programas\Dell\Dell ControlPoint\DCPButtonSvc.exe
O23 - Service: ComodoBackupService - COMODO - C:\Programas\COMODO\BackUp\CmdBkSvc.exe
O23 - Service: Dell ControlPoint System Manager (dcpsysmgrsvc) - Dell Inc. - C:\Programas\Dell\Dell ControlPoint\System Manager\DCPSysMgrSvc.exe
O23 - Service: DameWare Mini Remote Control (DWMRCS) - DameWare Development LLC - C:\WINDOWS\system32\DWRCS.EXE
O23 - Service: MBAMService - Malwarebytes Corporation - C:\Programas\Malwarebytes' Anti-Malware\mbamservice.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Programas\WinPcap\rpcapd.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Programas\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Programas\Spyware Doctor\pctsSvc.exe
O23 - Service: Audio Service (STacSV) - IDT, Inc. - c:\programas\idt\dellxpm09b_6017v022\wdm\stacsv.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Programas\Ficheiros comuns\SureThing Shared\stllssvr.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE


Thanks!!!
Post #2
Hi


NOTE:
  • Malware removal is NOT instantaneous, most infections require more than one round to properly eradicate.
  • Absence of symptoms does not always mean the job is complete, you can be certain that I will advise you when the computer is clean.
  • Kindly follow my instructions in the order posted.
  • Please DO NOT run any scans or fix items without my direction.



Please do the following:

STEP #1

Please download DDS and save it to your desktop.
  • Disable any script blocking protection
  • Double click dds.pif to run the tool.
  • When done, two DDS.txt's will open.
  • Save both reports to your desktop.
—————————————————
Please include the contents of the following in your next reply:

DDS.txt
Attach.txt.



STEP #2


[external image: Posted Image]
Download GMER Rootkit Scanner from here or here.
  • Extract the contents of the zipped file to desktop.
  • Double click GMER.exe. If asked to allow gmer.sys driver to load, please consent .
  • If it gives you a warning about rootkit activity and asks if you want to run scan…click on NO.

    [external image: Posted Image]
    Click the image to enlarge it
  • In the right panel, you will see several boxes that have been checked. Uncheck the following …
    • Sections
    • IAT/EAT
    • Drives/Partition other than Systemdrive (typically C:\)
    • Show All (don't miss this one)
  • Then click the Scan button & wait for it to finish.
  • Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
  • Save it where you can easily find it, such as your desktop, and attach it in reply.

**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOKIT" entries
Post #3
Hi, thanks for the help. DDS.txt DDS (Ver_09-06-26.01) - NTFSx86 Run by [removed] at 15:11:05,01 on 07-07-2009 Internet Explorer: 7.0.5730.13 Microsoft Windows XP Professional 5.1.2600.3.1252.351.2070.18.3539.2928 [GMT 1:00] AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7} ============== Running Processes =============== C:\Programas\Fingerprint Sensor\AtService.exe C:\WINDOWS\system32\svchost -k DcomLaunch C:\WINDOWS\system32\svchost -k rpcss C:\Programas\Windows Defender\MsMpEng.exe C:\WINDOWS\System32\svchost.exe -k netsvcs C:\WINDOWS\system32\svchost.exe -k NetworkService C:\WINDOWS\system32\svchost.exe -k LocalService C:\WINDOWS\System32\WLTRYSVC.EXE C:\WINDOWS\System32\bcmwltry.exe C:\WINDOWS\system32\spoolsv.exe c:\programas\idt\dellxpm09b_6017v022\wdm\stacsv.exe C:\Programas\Avira\AntiVir Desktop\sched.exe C:\WINDOWS\TEMP\tyhretchbs.exe C:\Programas\Avira\AntiVir Desktop\avguard.exe C:\Programas\COMODO\BackUp\CmdBkSvc.exe C:\WINDOWS\system32\DWRCS.EXE C:\Programas\Malwarebytes' Anti-Malware\mbamservice.exe C:\Programas\Ficheiros comuns\Microsoft Shared\VS7DEBUG\MDM.EXE C:\Programas\Dell\Dell ControlPoint\DCPButtonSvc.exe C:\WINDOWS\system32\wbem\wmiprvse.exe C:\Programas\Dell\Dell ControlPoint\System Manager\DCPSysMgrSvc.exe C:\WINDOWS\system32\SearchIndexer.exe C:\WINDOWS\System32\alg.exe C:\WINDOWS\system32\DWRCST.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\igfxpers.exe C:\WINDOWS\system32\igfxsrvc.exe C:\Programas\IDT\WDM\sttray.exe C:\WINDOWS\system32\AESTFltr.exe C:\Programas\Windows Defender\MSASCui.exe C:\WINDOWS\system32\WLTRAY.exe C:\Programas\CyberLink\PowerDVD DX\PDVDDXSrv.exe C:\Programas\Dell\Dell ControlPoint\Dell.ControlPoint.exe C:\Programas\DellTPad\Apoint.exe C:\WINDOWS\PixArt\PAC7302\Monitor.exe C:\Programas\Avira\AntiVir Desktop\avgnt.exe C:\Programas\DellTPad\ApMsgFwd.exe C:\Programas\DellTPad\HidFind.exe C:\Programas\DellTPad\Apntex.exe C:\WINDOWS\system32\ctfmon.exe C:\Programas\Ficheiros comuns\InstallShield\UpdateService\ISUSPM.exe C:\Programas\Dell\Dell ControlPoint\System Manager\DCPSysMgr.exe C:\WINDOWS\system32\svchost.exe -k imgsvc C:\WINDOWS\TEMP\tyhretchbs.exe C:\WINDOWS\system32\taskmgr.exe C:\WINDOWS\system32\wbem\wmiprvse.exe C:\WINDOWS\system32\wscntfy.exe C:\Documents and Settings\carlos.simoes\Ambiente de trabalho\dds.pif ============== Pseudo HJT Report =============== BHO: Facilitador de Leitor de Link Adobe PDF: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\programas\ficheiros comuns\adobe\acrobat\activex\AcroIEHelper.dll BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File BHO: SSVHelper Class: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\programas\java\jre1.6.0_07\bin\ssv.dll BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\programas\ficheiros comuns\microsoft shared\windows live\WindowsLiveLogin.dll BHO: {a9b03309-cf90-4397-934b-9fa53ac09d94} - c:\windows\system32\ujrkcaq.dll uRun: [CTFMON.EXE] c:\windows\system32\ctfmon.exe uRun: [msnmsgr] "c:\programas\windows live\messenger\msnmsgr.exe" /background uRun: [Skype] "c:\programas\skype\phone\Skype.exe" /nosplash /minimized uRun: [ISUSPM] "c:\programas\ficheiros comuns\installshield\updateservice\ISUSPM.exe" -scheduler uRun: [Advanced SystemCare 3] "c:\programas\iobit\advanced systemcare 3\AWC.exe" /startup mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe mRun: [Persistence] c:\windows\system32\igfxpers.exe mRun: [SysTrayApp] %ProgramFiles%\IDT\WDM\sttray.exe mRun: [AESTFltr] "c:\windows\system32\AESTFltr.exe" /NoDlg mRun: [Windows Defender] "c:\programas\windows defender\MSASCui.exe" -hide mRun: [Broadcom Wireless Manager UI] c:\windows\system32\WLTRAY.exe mRun: [PDVDDXSrv] "c:\programas\cyberlink\powerdvd dx\PDVDDXSrv.exe" mRun: [DellControlPoint] "c:\programas\dell\dell controlpoint\Dell.ControlPoint.exe" mRun: [Apoint] c:\programas\delltpad\Apoint.exe mRun: [PAC7302_Monitor] c:\windows\pixart\pac7302\Monitor.exe mRun: [JobHisInit] c:\programas\rds\rmclient\JobHisInit.exe mRun: [MplSetUp] c:\programas\rds\rmclient\MplSetUp.exe mRun: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u mRun: [avgnt] "c:\programas\avira\antivir desktop\avgnt.exe" /min mRun: [Malwarebytes' Anti-Malware] "c:\programas\malwarebytes' anti-malware\mbamgui.exe" /starttray mRun: [DameWare MRC Agent] c:\windows\system32\DWRCST.exe dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE StartupFolder: c:\docume~1\alluse~1\menuin~1\progra~1\arranque\adober~1.lnk - c:\programas\adobe\reader 8.0\reader\reader_sl.exe StartupFolder: c:\docume~1\alluse~1\menuin~1\progra~1\arranque\adober~2.lnk - c:\programas\adobe\reader 8.0\reader\AdobeCollabSync.exe StartupFolder: c:\docume~1\alluse~1\menuin~1\progra~1\arranque\dellco~1.lnk - c:\programas\dell\dell controlpoint\system manager\DCPSysMgr.exe IE: E&xportar para o Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000 IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\programas\messenger\msmsgs.exe IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBC} - c:\programas\java\jre1.6.0_07\bin\ssv.dll IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL Trusted Zone: zagope.pt\intranetz DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1239895530828 DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1239895500359 DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab DPF: {C4847596-972C-11D0-9567-00A0C9273C2A} - hxxp://intranetz.zagope.pt/viewer/activeXViewer/activexviewer.cab DPF: {CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_06-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\fichei~1\skype\SKYPE4~1.DLL Notify: igfxcui - igfxdev.dll Notify: yrzvwyhm - ujrkcaq.dll SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll SEH: Microsoft AntiMalware ShellExecuteHook: {091eb208-39dd-417d-a5dd-7e2c2d8fb9cb} - c:\progra~1\window~4\MpShHook.dll SEH: Windows Desktop Search Namespace Manager: {56f9679e-7826-4c84-81f3-532071a8bcc5} - c:\programas\windows desktop search\MSNLNamespaceMgr.dll ================= FIREFOX =================== FF - ProfilePath - ============= SERVICES / DRIVERS =============== R?2 AlerterALG;Alerta AlerterALG;c:\windows\temp\tyhretchbs.exe service –> c:\windows\temp\tyhretchbs.exe service [?] R0 ngecpbcb;ngecpbcb;c:\windows\system32\drivers\ngecpbcb.sys [2003-4-25 23424] R0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [2009-6-23 130936] R1 avgio;avgio;c:\programas\avira\antivir desktop\avgio.sys [2002-6-9 11608] R1 dwvkbd;DameWare Virtual Keyboard 32 bit Driver;c:\windows\system32\drivers\dwvkbd.sys [2007-2-15 26624] R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\programas\avira\antivir desktop\sched.exe [2002-6-9 108289] R2 AntiVirService;Avira AntiVir Guard;c:\programas\avira\antivir desktop\avguard.exe [2002-6-9 185089] R2 ATService;AuthenTec Fingerprint Service;c:\programas\fingerprint sensor\AtService.exe [2008-6-11 1664248] R2 avgntflt;avgntflt;c:\windows\system32\drivers\avgntflt.sys [2002-6-9 55640] R2 buttonsvc32;Dell ControlPoint Button Service;c:\programas\dell\dell controlpoint\DCPButtonSvc.exe [2008-6-3 386328] R2 ComodoBackupService;ComodoBackupService;c:\programas\comodo\backup\CmdBkSvc.exe [2009-4-30 1023488] R2 dcpsysmgrsvc;Dell ControlPoint System Manager;c:\programas\dell\dell controlpoint\system manager\DCPSysMgrSvc.exe [2008-8-18 455960] R2 MBAMService;MBAMService;c:\programas\malwarebytes' anti-malware\mbamservice.exe [2009-6-12 179856] R2 mjcrwofr;NetGroup Packet Filter Support;c:\windows\system32\svchost.exe -k netsvcs [2008-4-14 14336] R2 WinDefend;Windows Defender;c:\programas\windows defender\MsMpEng.exe [2006-11-3 13592] R3 AESTAud;AE Audio Service;c:\windows\system32\drivers\AESTAud.sys [2008-11-14 108160] R3 DwMirror;DwMirror;c:\windows\system32\drivers\DamewareMini.sys [2007-2-7 3712] R3 IntcHdmiAddService;Intel® High Definition Audio HDMI Service;c:\windows\system32\drivers\IntcHdmi.sys [2008-11-14 110080] R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2009-6-12 15504] S3 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [2007-11-6 34064] S3 PAC7302;PAC7302 VGA USB Camera;c:\windows\system32\drivers\PAC7302.SYS [2009-5-23 457856] S3 sdAuxService;PC Tools Auxiliary Service;c:\programas\spyware doctor\pctsAuxs.exe [2009-6-23 348752] S3 sdCoreService;PC Tools Security Service;c:\programas\spyware doctor\pctsSvc.exe [2009-6-23 1096584] S4 BCSWAP;BCSWAP;c:\windows\system32\drivers\BCSwap.sys [2007-1-25 91496] =============== Created Last 30 ================ 2009-07-07 10:23 –d—– c:\docume~1\carlos~1.sim\applic~1\dnvkeiwd 2009-06-23 18:06 –d—– c:\programas\ficheiros comuns\PC Tools 2009-06-23 18:06 –d—– c:\programas\Spyware Doctor 2009-06-23 18:06 –d—– c:\docume~1\carlos~1.sim\applic~1\PC Tools 2009-06-23 18:06 –d—– c:\docume~1\alluse~1\applic~1\PC Tools 2009-06-15 09:43 –d—– c:\programas\TeaTimer (Spybot - Search & Destroy) 2009-06-15 09:43 –d—– c:\programas\SDHelper (Spybot - Search & Destroy) 2009-06-15 09:43 –d—– c:\programas\Misc. Support Library (Spybot - Search & Destroy) 2009-06-15 09:43 –d—– c:\programas\File Scanner Library (Spybot - Search & Destroy) 2009-06-15 09:27 –d—– c:\docume~1\alluse~1\applic~1\Spybot - Search & Destroy 2009-06-15 09:27 –d—– c:\programas\SpybotSDPortable 2009-06-12 07:55 –d—– c:\programas\Malwarebytes' Anti-Malware 2009-06-08 22:41 –d—– c:\programas\RegCleaner ==================== Find3M ==================== ============= FINISH: 15:12:32,28 =============== Attach.txt UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG. IF REQUESTED, ZIP IT UP & ATTACH IT DDS (Ver_09-06-26.01) Microsoft Windows XP Professional Boot Device: \Device\HarddiskVolume3 Install Date: 13-11-2008 16:42:50 System Uptime: 07-07-2009 12:02:15 (3 hours ago) Motherboard: Dell Inc. | | 0DW635 Processor: Intel® Core™2 Duo CPU T7250 @ 2.00GHz | Microprocessor | 1994/200mhz ==== Disk Partitions ========================= C: is FIXED (NTFS) - 110 GiB total, 23,622 GiB free. D: is FIXED (NTFS) - 2 GiB total, 0,67 GiB free. E: is CDROM () F: is Removable ==== Disabled Device Manager Items ============= ==== System Restore Points =================== No restore point in system. ==== Installed Programs ====================== ==== End Of File =========================== Thanks

Attachments:

Post #4
Hi,

Please do the following:


Download ComboFix from one of these locations:
Link 1
Link 2
Link 3

VERY IMPORTANT !!! Save ComboFix.exe to your Desktop

* IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here
  • Double click on ComboFix.exe & follow the prompts.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]

  • Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]

  • Click on Yes, to continue scanning for malware.
When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.
Notes:
1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.


Please make sure you include the combo fix log in your next reply as well as describe how your computer is running now
Post #5
Hi, thanks again for the help.

I'm sorry for combofix beeing in portuguese, it was automatic. Hope it doesn't bother you.

The machine seems to be running well right now. Outlook doesn't crash xp and I don't have to reboot. Malwarebytes hasn't found anything.


Combofix.log

ComboFix 09-07-07.A0 - carlos.simoes 07-07-2009 21:40.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.351.2070.18.3539.2954 [GMT 1:00]
Executando de: c:\documents and settings\carlos.simoes\Ambiente de trabalho\ComboFix.exe
AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
.

((((((((((((((((((((((((((((((((((((( Outras Exclusões )))))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users\Application Data\96094366.ini
c:\documents and settings\carlos.simoes\Application Data\dnvkeiwd
c:\documents and settings\carlos.simoes\Application Data\dnvkeiwd\profiles.ini
c:\documents and settings\carlos.simoes\Application Data\dnvkeiwd\Profiles\6y8feil1.default\cert8.db
c:\documents and settings\carlos.simoes\Application Data\dnvkeiwd\Profiles\6y8feil1.default\compatibility.ini
c:\documents and settings\carlos.simoes\Application Data\dnvkeiwd\Profiles\6y8feil1.default\compreg.dat
c:\documents and settings\carlos.simoes\Application Data\dnvkeiwd\Profiles\6y8feil1.default\cookies.sqlite
c:\documents and settings\carlos.simoes\Application Data\dnvkeiwd\Profiles\6y8feil1.default\formhistory.sqlite
c:\documents and settings\carlos.simoes\Application Data\dnvkeiwd\Profiles\6y8feil1.default\key3.db
c:\documents and settings\carlos.simoes\Application Data\dnvkeiwd\Profiles\6y8feil1.default\localstore.rdf
c:\documents and settings\carlos.simoes\Application Data\dnvkeiwd\Profiles\6y8feil1.default\permissions.sqlite
c:\documents and settings\carlos.simoes\Application Data\dnvkeiwd\Profiles\6y8feil1.default\places.sqlite
c:\documents and settings\carlos.simoes\Application Data\dnvkeiwd\Profiles\6y8feil1.default\pluginreg.dat
c:\documents and settings\carlos.simoes\Application Data\dnvkeiwd\Profiles\6y8feil1.default\prefs.js
c:\documents and settings\carlos.simoes\Application Data\dnvkeiwd\Profiles\6y8feil1.default\secmod.db
c:\documents and settings\carlos.simoes\Application Data\dnvkeiwd\Profiles\6y8feil1.default\webappsstore.sqlite
c:\documents and settings\carlos.simoes\Application Data\dnvkeiwd\Profiles\6y8feil1.default\xpti.dat
c:\documents and settings\NetworkService\Application Data\dnvkeiwd
c:\documents and settings\NetworkService\Application Data\dnvkeiwd\profiles.ini
c:\documents and settings\NetworkService\Application Data\dnvkeiwd\Profiles\qg2w2bgy.default\cert8.db
c:\documents and settings\NetworkService\Application Data\dnvkeiwd\Profiles\qg2w2bgy.default\compatibility.ini
c:\documents and settings\NetworkService\Application Data\dnvkeiwd\Profiles\qg2w2bgy.default\compreg.dat
c:\documents and settings\NetworkService\Application Data\dnvkeiwd\Profiles\qg2w2bgy.default\cookies.sqlite
c:\documents and settings\NetworkService\Application Data\dnvkeiwd\Profiles\qg2w2bgy.default\formhistory.sqlite
c:\documents and settings\NetworkService\Application Data\dnvkeiwd\Profiles\qg2w2bgy.default\key3.db
c:\documents and settings\NetworkService\Application Data\dnvkeiwd\Profiles\qg2w2bgy.default\localstore.rdf
c:\documents and settings\NetworkService\Application Data\dnvkeiwd\Profiles\qg2w2bgy.default\permissions.sqlite
c:\documents and settings\NetworkService\Application Data\dnvkeiwd\Profiles\qg2w2bgy.default\places.sqlite
c:\documents and settings\NetworkService\Application Data\dnvkeiwd\Profiles\qg2w2bgy.default\pluginreg.dat
c:\documents and settings\NetworkService\Application Data\dnvkeiwd\Profiles\qg2w2bgy.default\prefs.js
c:\documents and settings\NetworkService\Application Data\dnvkeiwd\Profiles\qg2w2bgy.default\secmod.db
c:\documents and settings\NetworkService\Application Data\dnvkeiwd\Profiles\qg2w2bgy.default\webappsstore.sqlite
c:\documents and settings\NetworkService\Application Data\dnvkeiwd\Profiles\qg2w2bgy.default\xpti.dat
c:\windows\system32\drivers\ngecpbcb.sys
c:\windows\system32\drivers\SKYNETwcfvaqkx.sys
c:\windows\system32\drivers\yvvwnafs.sys
c:\windows\system32\SKYNETdrwlsxit.dll
c:\windows\system32\SKYNETlog.dat
c:\windows\system32\SKYNETmfpbllml.dat
c:\windows\system32\SKYNETrhslmujk.dat
c:\windows\system32\SKYNETxyrmndgh.dll
c:\windows\system32\trkzvbm.dll
c:\windows\system32\ujrkcaq.dll
c:\windows\system32\uqchywve.dll
D:\Autorun.inf

.
((((((((((((((((((((((((((((((((((((((( Drivers/Serviços )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Service_SKYNETkqsqlota
——-\Legacy_MJCRWOFR
——-\Legacy_NGECPBCB
——-\Service_mjcrwofr
——-\Service_ngecpbcb


(((((((((((((((( Arquivos/Ficheiros criados de 2009-06-07 to 2009-07-07 ))))))))))))))))))))))))))))
.

2009-07-07 20:45 . 2009-07-07 20:45 104448 —-a-w- c:\windows\system32\_ujrkcaq.dll_.vir
2009-06-23 17:06 . 2008-12-11 07:38 159600 —-a-w- c:\windows\system32\drivers\pctgntdi.sys
2009-06-23 17:06 . 2009-04-03 10:18 130936 —-a-w- c:\windows\system32\drivers\PCTCore.sys
2009-06-23 17:06 . 2008-12-18 11:16 73840 —-a-w- c:\windows\system32\drivers\PCTAppEvent.sys
2009-06-23 17:06 . 2009-07-07 20:54 ——– d—a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-06-23 17:06 . 2009-06-23 17:24 ——– d—–w- c:\programas\Ficheiros comuns\PC Tools
2009-06-23 17:06 . 2008-12-10 10:36 64392 —-a-w- c:\windows\system32\drivers\pctplsg.sys
2009-06-23 17:06 . 2009-06-24 12:46 ——– d—–w- c:\programas\Spyware Doctor
2009-06-23 17:06 . 2009-06-23 17:06 ——– d—–w- c:\documents and settings\carlos.simoes\Application Data\PC Tools
2009-06-23 17:06 . 2009-06-23 17:06 ——– d—–w- c:\documents and settings\All Users\Application Data\PC Tools
2009-06-20 14:12 . 2009-06-20 14:12 2372 —-a-w- C:\vundofix.reg
2009-06-20 13:42 . 2009-06-23 13:01 ——– d—–w- C:\VundoFix Backups
2009-06-15 14:10 . 2009-06-15 14:10 ——– d-sh–w- c:\windows\system32\config\systemprofile\PrivacIE
2009-06-15 08:43 . 2009-06-15 08:43 ——– d—–w- c:\programas\TeaTimer (Spybot - Search & Destroy)
2009-06-15 08:43 . 2009-06-15 08:43 ——– d—–w- c:\programas\SDHelper (Spybot - Search & Destroy)
2009-06-15 08:43 . 2009-06-15 08:43 ——– d—–w- c:\programas\Misc. Support Library (Spybot - Search & Destroy)
2009-06-15 08:43 . 2009-06-15 08:43 ——– d—–w- c:\programas\File Scanner Library (Spybot - Search & Destroy)
2009-06-15 08:27 . 2009-06-15 15:26 ——– d—–w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-06-15 08:27 . 2009-06-15 08:27 ——– d—–w- c:\programas\SpybotSDPortable
2009-06-12 20:17 . 2009-04-30 21:14 12800 -c—-w- c:\windows\system32\dllcache\xpshims.dll
2009-06-12 20:17 . 2009-04-30 21:14 246272 -c—-w- c:\windows\system32\dllcache\ieproxy.dll
2009-06-12 06:55 . 2009-04-06 14:32 15504 —-a-w- c:\windows\system32\drivers\mbam.sys
2009-06-12 06:55 . 2009-04-06 14:32 38496 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-06-12 06:55 . 2009-06-12 06:55 ——– d—–w- c:\programas\Malwarebytes' Anti-Malware
2009-06-09 16:40 . 2009-06-09 16:40 ——– d-sh–w- c:\documents and settings\LocalService\PrivacIE
2009-06-09 12:51 . 2009-06-09 12:51 ——– d-sh–w- c:\windows\system32\config\systemprofile\IETldCache
2009-06-08 21:41 . 2009-06-08 21:53 ——– d—–w- c:\programas\RegCleaner

.
((((((((((((((((((((((((((((((((((((( Relatório Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-07-07 20:56 . 2003-04-25 12:00 76352 —-a-w- c:\windows\system32\perfc016.dat
2009-07-07 20:56 . 2003-04-25 12:00 457744 —-a-w- c:\windows\system32\perfh016.dat
2009-07-07 20:28 . 2009-06-01 11:25 ——– d—–w- c:\documents and settings\carlos.simoes\Application Data\Skype
2009-07-07 17:47 . 2009-06-01 11:41 ——– d—–w- c:\documents and settings\carlos.simoes\Application Data\skypePM
2009-07-07 10:21 . 2008-11-14 10:46 ——– d—–w- c:\programas\Symantec
2009-07-07 10:20 . 2009-04-15 10:37 ——– d—–w- c:\programas\Ficheiros comuns\Symantec Shared
2009-07-07 07:17 . 2008-11-14 10:46 ——– d—–w- c:\documents and settings\All Users\Application Data\Symantec
2009-07-06 19:44 . 2009-04-17 10:46 ——– d—–w- c:\documents and settings\carlos.simoes\Application Data\Dropbox
2009-07-05 01:16 . 2009-04-18 11:08 ——– d—–w- c:\documents and settings\carlos.simoes\Application Data\foobar2000
2009-07-04 17:41 . 2009-04-17 20:58 ——– d—–w- c:\documents and settings\carlos.simoes\Application Data\dvdcss
2009-07-02 09:28 . 2008-11-14 10:21 ——– d—–w- c:\programas\Ficheiros comuns\Adobe
2009-06-29 09:41 . 2009-06-05 11:44 ——– d—–w- c:\documents and settings\carlos.simoes\Application Data\Thinstall
2009-06-25 17:52 . 2002-06-08 09:20 664 —-a-w- c:\windows\system32\d3d9caps.dat
2009-06-12 03:45 . 2008-11-14 12:14 ——– d—–w- c:\programas\Windows Desktop Search
2009-06-11 10:24 . 2002-06-09 12:40 ——– d—–w- c:\documents and settings\carlos.simoes\Application Data\IObit
2009-06-11 10:21 . 2009-05-01 23:18 ——– d—–w- c:\programas\Xobni
2009-06-11 10:21 . 2009-04-17 10:46 ——– d—–w- c:\programas\Dropbox
2009-06-11 10:20 . 2009-04-18 18:33 ——– d—–w- c:\documents and settings\carlos.simoes\Application Data\uTorrent
2009-06-05 11:47 . 2009-06-05 11:47 8704 —-a-w- c:\documents and settings\carlos.simoes\Application Data\Thinstall\Foxit PDF Editor\400000500002i\AcroRd32Info.exe
2009-06-05 11:47 . 2009-06-05 11:47 8704 —-a-w- c:\documents and settings\carlos.simoes\Application Data\Thinstall\Foxit PDF Editor\1000000b00002i\verclsid.exe
2009-06-02 16:33 . 2008-11-14 10:13 ——– d–h–w- c:\programas\InstallShield Installation Information
2009-06-02 16:33 . 2009-06-02 16:33 ——– d—–w- c:\programas\Ficheiros comuns\RDPrint
2009-06-02 16:33 . 2009-06-02 16:33 2255 —-a-w- c:\windows\PmData.Dat
2009-06-02 16:33 . 2009-06-02 16:33 ——– d—–w- c:\programas\RDS
2009-06-01 11:41 . 2009-06-01 11:41 56 —ha-w- c:\windows\system32\ezsidmv.dat
2009-06-01 11:24 . 2009-06-01 11:24 ——– d—–w- c:\programas\Ficheiros comuns\Skype
2009-06-01 11:24 . 2009-06-01 11:23 ——– d—–r- c:\programas\Skype
2009-06-01 11:24 . 2009-06-01 11:23 ——– d—–w- c:\documents and settings\All Users\Application Data\Skype
2009-05-25 13:12 . 2009-05-25 13:12 19200 —-a-w- c:\windows\system32\drivers\WSTCODEC.SYS
2009-05-25 12:31 . 2009-05-25 12:31 85248 —-a-w- c:\windows\system32\drivers\NABTSFEC.sys
2009-05-25 12:28 . 2009-05-25 12:28 17024 —-a-w- c:\windows\system32\drivers\CCDECODE.sys
2009-05-25 11:04 . 2009-05-25 11:04 54784 —-a-w- c:\windows\system32\vfwwdm32.dll
2009-05-24 23:24 . 2008-05-26 22:18 350208 ——w- c:\windows\system32\mssph.dll
2009-05-23 14:04 . 2009-05-23 14:04 ——– d—–w- c:\programas\VGA USB Camera
2009-05-23 14:04 . 2009-04-15 12:05 ——– d—–w- c:\documents and settings\carlos.simoes\Application Data\InstallShield
2009-05-23 13:19 . 2009-05-23 13:19 ——– d—–w- c:\documents and settings\carlos.simoes\Application Data\ArcSoft
2009-05-23 06:40 . 2009-05-23 06:37 ——– d—–w- c:\programas\ArcSoft
2009-05-23 06:38 . 2009-05-23 06:38 ——– d—–w- c:\programas\Ficheiros comuns\ArcSoft
2009-05-23 06:32 . 2008-11-14 10:13 ——– d—–w- c:\programas\Ficheiros comuns\InstallShield
2009-05-12 14:12 . 2008-11-14 10:57 26144 —-a-w- c:\windows\system32\spupdsvc.exe
2009-05-07 15:32 . 2008-04-14 20:39 348160 —-a-w- c:\windows\system32\localspl.dll
2009-04-30 21:03 . 2009-04-30 21:03 4 —-a-w- c:\windows\csdf_sdum.dat
2009-04-29 04:44 . 2008-04-14 20:39 827392 —-a-w- c:\windows\system32\wininet.dll
2009-04-29 04:44 . 2009-05-07 01:14 78336 —-a-w- c:\windows\system32\ieencode.dll
2009-04-20 07:32 . 2009-04-20 07:32 0 —-a-w- c:\windows\nsreg.dat
2009-04-19 19:50 . 2008-04-14 20:07 1847296 —-a-w- c:\windows\system32\win32k.sys
2009-04-15 14:52 . 2008-04-14 20:39 585216 —-a-w- c:\windows\system32\rpcrt4.dll
2009-04-14 16:18 . 2009-04-14 16:18 89088 —-a-w- c:\windows\system32\atl71.dll
.

(((((((((((((((((((((((((( Pontos de Carregamento do Registro )))))))))))))))))))))))))))))))))))))))
.
.
*Nota* entradas vazias e legítimas por defeito não são mostradas.
REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2009-04-01 08:14 1163264 —-a-w- c:\programas\Dropbox\DropboxExt.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2009-04-01 08:14 1163264 —-a-w- c:\programas\Dropbox\DropboxExt.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2009-04-01 08:14 1163264 —-a-w- c:\programas\Dropbox\DropboxExt.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"msnmsgr"="c:\programas\Windows Live\Messenger\msnmsgr.exe" [2009-02-06 3885408]
"Skype"="c:\programas\Skype\Phone\Skype.exe" [2009-04-21 24264488]
"ISUSPM"="c:\programas\Ficheiros comuns\InstallShield\UpdateService\ISUSPM.exe" [2006-09-11 218032]
"Advanced SystemCare 3"="c:\programas\IObit\Advanced SystemCare 3\AWC.exe" [2009-04-30 2329936]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"UserFaultCheck"="c:\windows\system32\dumprep 0 -u" [X]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-09-15 178712]
"Persistence"="c:\windows\system32\igfxpers.exe" [2008-09-15 150040]
"SysTrayApp"="c:\programas\IDT\WDM\sttray.exe" [2008-05-22 442467]
"AESTFltr"="c:\windows\system32\AESTFltr.exe" [2008-05-20 466944]
"Windows Defender"="c:\programas\Windows Defender\MSASCui.exe" [2006-11-03 866584]
"Broadcom Wireless Manager UI"="c:\windows\system32\WLTRAY.exe" [2008-10-23 2220032]
"PDVDDXSrv"="c:\programas\CyberLink\PowerDVD DX\PDVDDXSrv.exe" [2008-05-23 128296]
"DellControlPoint"="c:\programas\Dell\Dell ControlPoint\Dell.ControlPoint.exe" [2008-05-30 593920]
"Apoint"="c:\programas\DellTPad\Apoint.exe" [2008-12-21 200704]
"PAC7302_Monitor"="c:\windows\PixArt\PAC7302\Monitor.exe" [2006-11-03 319488]
"JobHisInit"="c:\programas\RDS\RMClient\JobHisInit.exe" [2007-08-30 229481]
"MplSetUp"="c:\programas\RDS\RMClient\MplSetUp.exe" [2007-08-30 49254]
"avgnt"="c:\programas\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
"Malwarebytes' Anti-Malware"="c:\programas\Malwarebytes' Anti-Malware\mbamgui.exe" [2009-04-06 401040]
"ISTray"="c:\programas\Spyware Doctor\pctsTray.exe" [2009-06-23 1181576]
"DameWare MRC Agent"="c:\windows\system32\DWRCST.exe" [2008-12-29 78848]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\All Users\Menu Iniciar\Programas\Arranque\
Adobe Reader Speed Launch.lnk - c:\programas\Adobe\Reader 8.0\Reader\reader_sl.exe [2006-10-23 40048]
Adobe Reader Synchronizer.lnk - c:\programas\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe [2006-10-23 734872]
Dell ControlPoint System Manager.lnk - c:\programas\Dell\Dell ControlPoint\System Manager\DCPSysMgr.exe [2008-8-18 1205528]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\programas\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-24 304128]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSN Webcam Recorder

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Programas\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Programas\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\WINDOWS\\pchealth\\helpctr\\binaries\\HelpCtr.exe"=
"c:\\Programas\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"6129:TCP"= 6129:TCP:DameWare
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009

R0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [23-06-2009 18:06 130936]
R1 dwvkbd;DameWare Virtual Keyboard 32 bit Driver;c:\windows\system32\drivers\dwvkbd.sys [15-02-2007 18:00 26624]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\programas\Avira\AntiVir Desktop\sched.exe [09-06-2002 19:50 108289]
R2 ATService;AuthenTec Fingerprint Service;c:\programas\Fingerprint Sensor\AtService.exe [11-06-2008 12:39 1664248]
R2 buttonsvc32;Dell ControlPoint Button Service;c:\programas\Dell\Dell ControlPoint\DCPButtonSvc.exe [03-06-2008 16:28 386328]
R2 ComodoBackupService;ComodoBackupService;c:\programas\COMODO\BackUp\CmdBkSvc.exe [30-04-2009 22:28 1023488]
R2 dcpsysmgrsvc;Dell ControlPoint System Manager;c:\programas\Dell\Dell ControlPoint\System Manager\DCPSysMgrSvc.exe [18-08-2008 11:39 455960]
R2 MBAMService;MBAMService;c:\programas\Malwarebytes' Anti-Malware\mbamservice.exe [12-06-2009 7:55 179856]
R2 sdAuxService;PC Tools Auxiliary Service;c:\programas\Spyware Doctor\pctsAuxs.exe [23-06-2009 18:06 348752]
R2 WinDefend;Windows Defender;c:\programas\Windows Defender\MsMpEng.exe [03-11-2006 19:19 13592]
R3 AESTAud;AE Audio Service;c:\windows\system32\drivers\AESTAud.sys [14-11-2008 11:13 108160]
R3 DwMirror;DwMirror;c:\windows\system32\drivers\DamewareMini.sys [07-02-2007 18:00 3712]
R3 IntcHdmiAddService;Intel® High Definition Audio HDMI Service;c:\windows\system32\drivers\IntcHdmi.sys [14-11-2008 10:57 110080]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [12-06-2009 7:55 15504]
S2 AlerterALG;Alerta AlerterALG;c:\windows\TEMP\tyhretchbs.exe service –> c:\windows\TEMP\tyhretchbs.exe service [?]
S3 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [06-11-2007 21:22 34064]
S3 PAC7302;PAC7302 VGA USB Camera;c:\windows\system32\drivers\PAC7302.SYS [23-05-2009 7:31 457856]
S4 BCSWAP;BCSWAP;c:\windows\system32\drivers\BCSwap.sys [25-01-2007 15:54 91496]

— =Outros Serviços/Drivers Na Memória —

*Deregistered* - mchInjDrv
.
Conteúdo da pasta 'Tarefas Agendadas'

2009-07-07 c:\windows\Tasks\MP Scheduled Scan.job
- c:\programas\Windows Defender\MpCmdRun.exe [2006-11-03 18:20]
.
.
——- Scan Suplementar ——-
.
IE: E&xportar para o Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
Trusted Zone: zagope.pt\intranetz
FF - ProfilePath - c:\documents and settings\carlos.simoes\Application Data\Mozilla\Firefox\Profiles\ev41tm8u.default\
FF - plugin: c:\programas\Microsoft\Office Live\npOLW.dll
FF - plugin: c:\windows\system32\C2MP\npdivx32.dll

—- FIREFOX POLICIES —-
FF - user.js: browser.cache.memory.capacity - 65536
FF - user.js: browser.chrome.favicons - fales
FF - user.js: browser.display.show_image_placeholders - true
FF - user.js: browser.turbo.enabled - true
FF - user.js: browser.urlbar.autocomplete.enabled - true
FF - user.js: browser.urlbar.autofill - true
FF - user.js: browser.xul.error_pages.enabled - true
FF - user.js: content.interrupt.parsing - true
FF - user.js: content.max.tokenizing.time - 3000000
FF - user.js: content.maxtextrun - 8191
FF - user.js: content.notify.backoffcount - 5
FF - user.js: content.notify.interval - 750000
FF - user.js: content.notify.ontimer - true
FF - user.js: content.switch.threshold - 750000
FF - user.js: network.http.max-connections - 32
FF - user.js: network.http.max-connections-per-server - 8
FF - user.js: network.http.max-persistent-connections-per-proxy - 8
FF - user.js: network.http.max-persistent-connections-per-server - 4
FF - user.js: network.http.pipelining - true
FF - user.js: network.http.pipelining.firstrequest - true
FF - user.js: network.http.pipelining.maxrequests - 8
FF - user.js: network.http.proxy.pipelining - true
FF - user.js: network.http.request.max-start-delay - 0
FF - user.js: nglayout.initialpaint.delay - 0
FF - user.js: plugin.expose_full_path - true
FF - user.js: ui.submenuDelay - 0
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-07-07 21:53
Windows 5.1.2600 Service Pack 3 NTFS

detected NTDLL code modification:
ZwClose

Procurando processos ocultos …

Procurando entradas auto inicializáveis ocultas …

Procurando ficheiros/arquivos ocultos …

Varredura completada com sucesso
arquivos/ficheiros ocultos: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet008\Services\SAVRT]
"ImagePath"="-"

[HKEY_LOCAL_MACHINE\System\ControlSet008\Services\SNDSrvc]
"ImagePath"="-"
.
——————— DLLs Carregadas Sob os Processos em Execução ———————

- - - - - - - > 'explorer.exe'(836)
c:\programas\Spyware Doctor\pctgmhk.dll
c:\programas\Dropbox\DropboxExt.dll
c:\windows\system32\WPDShServiceObj.dll
c:\progra~1\ArcSoft\PHOTOI~1\share\pihook.dll
c:\programas\Roxio\Drag-to-Disc\Shellex.dll
c:\programas\Ficheiros comuns\Roxio Shared\9.0\DLLShared\DLAAPI_W.DLL
c:\programas\Roxio\Drag-to-Disc\ShellRes.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
———————— Outros Processos em Execução ————————
.
c:\windows\system32\WLTRYSVC.EXE
c:\windows\system32\BCMWLTRY.EXE
c:\programas\IDT\DellXPM09B_6017v022\WDM\stacsv.exe
c:\programas\Avira\AntiVir Desktop\avguard.exe
c:\windows\system32\DWRCS.EXE
c:\programas\Ficheiros comuns\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\programas\Spyware Doctor\pctsSvc.exe
c:\windows\system32\searchindexer.exe
c:\windows\system32\igfxsrvc.exe
c:\programas\DellTPad\ApMsgFwd.exe
c:\programas\DellTPad\ApntEx.exe
c:\programas\DellTPad\hidfind.exe
c:\programas\Windows Live\Contacts\wlcomm.exe
c:\programas\Skype\Plugin Manager\skypePM.exe
.
**************************************************************************
.
Tempo para conclusão: 2009-07-07 21:59 - Máquina reiniciou
ComboFix-quarantined-files.txt 2009-07-07 20:59

Pré-execução: 25.163.612.160 bytes livres
Pós execução: 25.045.606.400 bytes livres

WindowsXP-KB310994-SP2-Pro-BootDisk-PTB.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(3)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(3)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

Current=8 Default=8 Failed=7 LastKnownGood=9 Sets=1,2,3,4,5,6,7,8,9
331 — E O F — 2009-06-23 04:24


Thanks
Post #6 last edited
Hi

Please do the following:

  • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below.
  • They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
Copy/paste the text inside the Codebox below into notepad:

Here's how to do that:
Click Start > Run type Notepad click OK.
This will open an empty notepad file:

Copy all the text inside of the code box - Press Ctrl+C (or right click on the highlighted section and choose 'copy')

File::
c:\windows\system32\_ujrkcaq.dll_.vir

Now paste the copied text into the open notepad - press CTRL+V (or right click and choose 'paste')

Save this file to your desktop, Save this as "CFScript"

Here's how to do that:

1.Click File;
2.Click Save As… Change the directory to your desktop;
3.Change the Save as type to "All Files";
4.Type in the file name: CFScript
5.Click Save …

[external image: Posted Image]
  • Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
  • ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
  • When finished, it shall produce a log for you.
  • Copy and paste the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.


NEXT

  • Please open your MalwareBytes AntiMalware Program
  • Click the Update Tab and search for updates
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select "Perform Quick Scan", then click Scan.
  • The scan may take some time to finish, so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected. <– very important
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Extra Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  • Copy&Paste the entire report in your next reply.

Extra Note:If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer, please do so immediately.



NEXT

Using Internet Explorer or Firefox, visit Kaspersky On-line Scanner

1. Click Accept, when prompted to download and install the program files and database of malware definitions.
2. To optimize scanning time and produce a more sensible report for review:
  • Close any open programs
  • Turn off the real time scanner of any existing antivirus program while performing the online scan
3. Click Run at the Security prompt.
The program will then begin downloading and installing and will also update the database.
Please be patient as this can take quite a long time to download.
  • Once the update is complete, click on My Computer under the green Scan bar to the left to start the scan.
  • Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
  • Do NOT be alarmed by what you see in the report. Many of the finds have likely been quarantined.
  • Click View scan report at the bottom.

    [external image: Posted Image]
  • Click the Save as Text button to save the file to your desktop so that you may post it in your next reply
Post #7
Hi,

After Combofix XP froze after login and I had to restart from the last good configuration. Right now it appears to be normal.

Combofix.txt

ComboFix 09-07-07.A0 - carlos.simoes 08-07-2009 7:05.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.351.2070.18.3539.3003 [GMT 1:00]
Executando de: c:\documents and settings\carlos.simoes\Ambiente de trabalho\ComboFix.exe
Comandos utilizados :: c:\documents and settings\carlos.simoes\Ambiente de trabalho\CFScript.txt
AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}

FILE ::
"c:\windows\system32\_ujrkcaq.dll_.vir"
.

(((((((((((((((( Arquivos/Ficheiros criados de 2009-06-08 to 2009-07-08 ))))))))))))))))))))))))))))
.

2009-06-23 17:06 . 2008-12-11 07:38 159600 —-a-w- c:\windows\system32\drivers\pctgntdi.sys
2009-06-23 17:06 . 2009-04-03 10:18 130936 —-a-w- c:\windows\system32\drivers\PCTCore.sys
2009-06-23 17:06 . 2008-12-18 11:16 73840 —-a-w- c:\windows\system32\drivers\PCTAppEvent.sys
2009-06-23 17:06 . 2009-07-08 05:53 ——– d—a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-06-23 17:06 . 2009-06-23 17:24 ——– d—–w- c:\programas\Ficheiros comuns\PC Tools
2009-06-23 17:06 . 2008-12-10 10:36 64392 —-a-w- c:\windows\system32\drivers\pctplsg.sys
2009-06-23 17:06 . 2009-06-24 12:46 ——– d—–w- c:\programas\Spyware Doctor
2009-06-23 17:06 . 2009-06-23 17:06 ——– d—–w- c:\documents and settings\carlos.simoes\Application Data\PC Tools
2009-06-23 17:06 . 2009-06-23 17:06 ——– d—–w- c:\documents and settings\All Users\Application Data\PC Tools
2009-06-20 14:12 . 2009-06-20 14:12 2372 —-a-w- C:\vundofix.reg
2009-06-20 13:42 . 2009-06-23 13:01 ——– d—–w- C:\VundoFix Backups
2009-06-15 14:10 . 2009-06-15 14:10 ——– d-sh–w- c:\windows\system32\config\systemprofile\PrivacIE
2009-06-15 08:43 . 2009-06-15 08:43 ——– d—–w- c:\programas\TeaTimer (Spybot - Search & Destroy)
2009-06-15 08:43 . 2009-06-15 08:43 ——– d—–w- c:\programas\SDHelper (Spybot - Search & Destroy)
2009-06-15 08:43 . 2009-06-15 08:43 ——– d—–w- c:\programas\Misc. Support Library (Spybot - Search & Destroy)
2009-06-15 08:43 . 2009-06-15 08:43 ——– d—–w- c:\programas\File Scanner Library (Spybot - Search & Destroy)
2009-06-15 08:27 . 2009-06-15 15:26 ——– d—–w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-06-15 08:27 . 2009-06-15 08:27 ——– d—–w- c:\programas\SpybotSDPortable
2009-06-12 20:17 . 2009-04-30 21:14 12800 -c—-w- c:\windows\system32\dllcache\xpshims.dll
2009-06-12 20:17 . 2009-04-30 21:14 246272 -c—-w- c:\windows\system32\dllcache\ieproxy.dll
2009-06-12 06:55 . 2009-04-06 14:32 15504 —-a-w- c:\windows\system32\drivers\mbam.sys
2009-06-12 06:55 . 2009-04-06 14:32 38496 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-06-12 06:55 . 2009-06-12 06:55 ——– d—–w- c:\programas\Malwarebytes' Anti-Malware
2009-06-09 16:40 . 2009-06-09 16:40 ——– d-sh–w- c:\documents and settings\LocalService\PrivacIE
2009-06-09 12:51 . 2009-06-09 12:51 ——– d-sh–w- c:\windows\system32\config\systemprofile\IETldCache
2009-06-08 21:41 . 2009-06-08 21:53 ——– d—–w- c:\programas\RegCleaner

.
((((((((((((((((((((((((((((((((((((( Relatório Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-07-08 06:03 . 2009-06-01 11:25 ——– d—–w- c:\documents and settings\carlos.simoes\Application Data\Skype
2009-07-08 06:03 . 2003-04-25 12:00 76352 —-a-w- c:\windows\system32\perfc016.dat
2009-07-08 06:03 . 2003-04-25 12:00 457744 —-a-w- c:\windows\system32\perfh016.dat
2009-07-08 05:45 . 2009-06-01 11:41 ——– d—–w- c:\documents and settings\carlos.simoes\Application Data\skypePM
2009-07-07 10:21 . 2008-11-14 10:46 ——– d—–w- c:\programas\Symantec
2009-07-07 10:20 . 2009-04-15 10:37 ——– d—–w- c:\programas\Ficheiros comuns\Symantec Shared
2009-07-07 07:17 . 2008-11-14 10:46 ——– d—–w- c:\documents and settings\All Users\Application Data\Symantec
2009-07-06 19:44 . 2009-04-17 10:46 ——– d—–w- c:\documents and settings\carlos.simoes\Application Data\Dropbox
2009-07-05 01:16 . 2009-04-18 11:08 ——– d—–w- c:\documents and settings\carlos.simoes\Application Data\foobar2000
2009-07-04 17:41 . 2009-04-17 20:58 ——– d—–w- c:\documents and settings\carlos.simoes\Application Data\dvdcss
2009-07-02 09:28 . 2008-11-14 10:21 ——– d—–w- c:\programas\Ficheiros comuns\Adobe
2009-06-29 09:41 . 2009-06-05 11:44 ——– d—–w- c:\documents and settings\carlos.simoes\Application Data\Thinstall
2009-06-25 17:52 . 2002-06-08 09:20 664 —-a-w- c:\windows\system32\d3d9caps.dat
2009-06-12 03:45 . 2008-11-14 12:14 ——– d—–w- c:\programas\Windows Desktop Search
2009-06-11 10:24 . 2002-06-09 12:40 ——– d—–w- c:\documents and settings\carlos.simoes\Application Data\IObit
2009-06-11 10:21 . 2009-05-01 23:18 ——– d—–w- c:\programas\Xobni
2009-06-11 10:21 . 2009-04-17 10:46 ——– d—–w- c:\programas\Dropbox
2009-06-11 10:20 . 2009-04-18 18:33 ——– d—–w- c:\documents and settings\carlos.simoes\Application Data\uTorrent
2009-06-05 11:47 . 2009-06-05 11:47 8704 —-a-w- c:\documents and settings\carlos.simoes\Application Data\Thinstall\Foxit PDF Editor\400000500002i\AcroRd32Info.exe
2009-06-05 11:47 . 2009-06-05 11:47 8704 —-a-w- c:\documents and settings\carlos.simoes\Application Data\Thinstall\Foxit PDF Editor\1000000b00002i\verclsid.exe
2009-06-02 16:33 . 2008-11-14 10:13 ——– d–h–w- c:\programas\InstallShield Installation Information
2009-06-02 16:33 . 2009-06-02 16:33 ——– d—–w- c:\programas\Ficheiros comuns\RDPrint
2009-06-02 16:33 . 2009-06-02 16:33 2255 —-a-w- c:\windows\PmData.Dat
2009-06-02 16:33 . 2009-06-02 16:33 ——– d—–w- c:\programas\RDS
2009-06-01 11:41 . 2009-06-01 11:41 56 —ha-w- c:\windows\system32\ezsidmv.dat
2009-06-01 11:24 . 2009-06-01 11:24 ——– d—–w- c:\programas\Ficheiros comuns\Skype
2009-06-01 11:24 . 2009-06-01 11:23 ——– d—–r- c:\programas\Skype
2009-06-01 11:24 . 2009-06-01 11:23 ——– d—–w- c:\documents and settings\All Users\Application Data\Skype
2009-05-25 13:12 . 2009-05-25 13:12 19200 —-a-w- c:\windows\system32\drivers\WSTCODEC.SYS
2009-05-25 12:31 . 2009-05-25 12:31 85248 —-a-w- c:\windows\system32\drivers\NABTSFEC.sys
2009-05-25 12:28 . 2009-05-25 12:28 17024 —-a-w- c:\windows\system32\drivers\CCDECODE.sys
2009-05-25 11:04 . 2009-05-25 11:04 54784 —-a-w- c:\windows\system32\vfwwdm32.dll
2009-05-24 23:24 . 2008-05-26 22:18 350208 ——w- c:\windows\system32\mssph.dll
2009-05-23 14:04 . 2009-05-23 14:04 ——– d—–w- c:\programas\VGA USB Camera
2009-05-23 14:04 . 2009-04-15 12:05 ——– d—–w- c:\documents and settings\carlos.simoes\Application Data\InstallShield
2009-05-23 13:19 . 2009-05-23 13:19 ——– d—–w- c:\documents and settings\carlos.simoes\Application Data\ArcSoft
2009-05-23 06:40 . 2009-05-23 06:37 ——– d—–w- c:\programas\ArcSoft
2009-05-23 06:38 . 2009-05-23 06:38 ——– d—–w- c:\programas\Ficheiros comuns\ArcSoft
2009-05-23 06:32 . 2008-11-14 10:13 ——– d—–w- c:\programas\Ficheiros comuns\InstallShield
2009-05-12 14:12 . 2008-11-14 10:57 26144 —-a-w- c:\windows\system32\spupdsvc.exe
2009-05-07 15:32 . 2008-04-14 20:39 348160 —-a-w- c:\windows\system32\localspl.dll
2009-04-30 21:03 . 2009-04-30 21:03 4 —-a-w- c:\windows\csdf_sdum.dat
2009-04-29 04:44 . 2008-04-14 20:39 827392 —-a-w- c:\windows\system32\wininet.dll
2009-04-29 04:44 . 2009-05-07 01:14 78336 —-a-w- c:\windows\system32\ieencode.dll
2009-04-20 07:32 . 2009-04-20 07:32 0 —-a-w- c:\windows\nsreg.dat
2009-04-19 19:50 . 2008-04-14 20:07 1847296 —-a-w- c:\windows\system32\win32k.sys
2009-04-15 14:52 . 2008-04-14 20:39 585216 —-a-w- c:\windows\system32\rpcrt4.dll
2009-04-14 16:18 . 2009-04-14 16:18 89088 —-a-w- c:\windows\system32\atl71.dll
.

((((((((((((((((((((((((((((( SnapShot@2009-07-07_20.54.20 )))))))))))))))))))))))))))))))))))))))))
.
- 2003-04-25 12:00 . 2009-07-07 20:41 64706 c:\windows\system32\perfc009.dat
+ 2003-04-25 12:00 . 2009-07-08 06:03 64706 c:\windows\system32\perfc009.dat
+ 2003-04-25 12:00 . 2009-07-08 06:03 409566 c:\windows\system32\perfh009.dat
- 2003-04-25 12:00 . 2009-07-07 20:41 409566 c:\windows\system32\perfh009.dat
.
(((((((((((((((((((((((((( Pontos de Carregamento do Registro )))))))))))))))))))))))))))))))))))))))
.
.
*Nota* entradas vazias e legítimas por defeito não são mostradas.
REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2009-04-01 08:14 1163264 —-a-w- c:\programas\Dropbox\DropboxExt.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2009-04-01 08:14 1163264 —-a-w- c:\programas\Dropbox\DropboxExt.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2009-04-01 08:14 1163264 —-a-w- c:\programas\Dropbox\DropboxExt.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"msnmsgr"="c:\programas\Windows Live\Messenger\msnmsgr.exe" [2009-02-06 3885408]
"Skype"="c:\programas\Skype\Phone\Skype.exe" [2009-04-21 24264488]
"ISUSPM"="c:\programas\Ficheiros comuns\InstallShield\UpdateService\ISUSPM.exe" [2006-09-11 218032]
"Advanced SystemCare 3"="c:\programas\IObit\Advanced SystemCare 3\AWC.exe" [2009-04-30 2329936]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"UserFaultCheck"="c:\windows\system32\dumprep 0 -u" [X]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-09-15 178712]
"Persistence"="c:\windows\system32\igfxpers.exe" [2008-09-15 150040]
"SysTrayApp"="c:\programas\IDT\WDM\sttray.exe" [2008-05-22 442467]
"AESTFltr"="c:\windows\system32\AESTFltr.exe" [2008-05-20 466944]
"Windows Defender"="c:\programas\Windows Defender\MSASCui.exe" [2006-11-03 866584]
"Broadcom Wireless Manager UI"="c:\windows\system32\WLTRAY.exe" [2008-10-23 2220032]
"PDVDDXSrv"="c:\programas\CyberLink\PowerDVD DX\PDVDDXSrv.exe" [2008-05-23 128296]
"DellControlPoint"="c:\programas\Dell\Dell ControlPoint\Dell.ControlPoint.exe" [2008-05-30 593920]
"Apoint"="c:\programas\DellTPad\Apoint.exe" [2008-12-21 200704]
"PAC7302_Monitor"="c:\windows\PixArt\PAC7302\Monitor.exe" [2006-11-03 319488]
"JobHisInit"="c:\programas\RDS\RMClient\JobHisInit.exe" [2007-08-30 229481]
"MplSetUp"="c:\programas\RDS\RMClient\MplSetUp.exe" [2007-08-30 49254]
"avgnt"="c:\programas\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
"Malwarebytes' Anti-Malware"="c:\programas\Malwarebytes' Anti-Malware\mbamgui.exe" [2009-04-06 401040]
"DameWare MRC Agent"="c:\windows\system32\DWRCST.exe" [2008-12-29 78848]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\All Users\Menu Iniciar\Programas\Arranque\
Adobe Reader Speed Launch.lnk - c:\programas\Adobe\Reader 8.0\Reader\reader_sl.exe [2006-10-23 40048]
Adobe Reader Synchronizer.lnk - c:\programas\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe [2006-10-23 734872]
Dell ControlPoint System Manager.lnk - c:\programas\Dell\Dell ControlPoint\System Manager\DCPSysMgr.exe [2008-8-18 1205528]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\programas\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-24 304128]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Programas\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Programas\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\WINDOWS\\pchealth\\helpctr\\binaries\\HelpCtr.exe"=
"c:\\Programas\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"6129:TCP"= 6129:TCP:DameWare
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009

R0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [23-06-2009 18:06 130936]
R1 dwvkbd;DameWare Virtual Keyboard 32 bit Driver;c:\windows\system32\drivers\dwvkbd.sys [15-02-2007 18:00 26624]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\programas\Avira\AntiVir Desktop\sched.exe [09-06-2002 19:50 108289]
R2 ATService;AuthenTec Fingerprint Service;c:\programas\Fingerprint Sensor\AtService.exe [11-06-2008 12:39 1664248]
R2 buttonsvc32;Dell ControlPoint Button Service;c:\programas\Dell\Dell ControlPoint\DCPButtonSvc.exe [03-06-2008 16:28 386328]
R2 ComodoBackupService;ComodoBackupService;c:\programas\COMODO\BackUp\CmdBkSvc.exe [30-04-2009 22:28 1023488]
R2 dcpsysmgrsvc;Dell ControlPoint System Manager;c:\programas\Dell\Dell ControlPoint\System Manager\DCPSysMgrSvc.exe [18-08-2008 11:39 455960]
R2 MBAMService;MBAMService;c:\programas\Malwarebytes' Anti-Malware\mbamservice.exe [12-06-2009 7:55 179856]
R2 WinDefend;Windows Defender;c:\programas\Windows Defender\MsMpEng.exe [03-11-2006 19:19 13592]
R3 AESTAud;AE Audio Service;c:\windows\system32\drivers\AESTAud.sys [14-11-2008 11:13 108160]
R3 DwMirror;DwMirror;c:\windows\system32\drivers\DamewareMini.sys [07-02-2007 18:00 3712]
R3 IntcHdmiAddService;Intel® High Definition Audio HDMI Service;c:\windows\system32\drivers\IntcHdmi.sys [14-11-2008 10:57 110080]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [12-06-2009 7:55 15504]
S2 AlerterALG;Alerta AlerterALG;c:\windows\TEMP\tyhretchbs.exe service –> c:\windows\TEMP\tyhretchbs.exe service [?]
S3 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [06-11-2007 21:22 34064]
S3 PAC7302;PAC7302 VGA USB Camera;c:\windows\system32\drivers\PAC7302.SYS [23-05-2009 7:31 457856]
S3 sdAuxService;PC Tools Auxiliary Service;c:\programas\Spyware Doctor\pctsAuxs.exe [23-06-2009 18:06 348752]
S4 BCSWAP;BCSWAP;c:\windows\system32\drivers\BCSwap.sys [25-01-2007 15:54 91496]
.
Conteúdo da pasta 'Tarefas Agendadas'

2009-07-08 c:\windows\Tasks\MP Scheduled Scan.job
- c:\programas\Windows Defender\MpCmdRun.exe [2006-11-03 18:20]
.
.
——- Scan Suplementar ——-
.
IE: E&xportar para o Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
Trusted Zone: zagope.pt\intranetz
FF - ProfilePath - c:\documents and settings\carlos.simoes\Application Data\Mozilla\Firefox\Profiles\ev41tm8u.default\
FF - plugin: c:\programas\Microsoft\Office Live\npOLW.dll
FF - plugin: c:\windows\system32\C2MP\npdivx32.dll

—- FIREFOX POLICIES —-
FF - user.js: browser.cache.memory.capacity - 65536
FF - user.js: browser.chrome.favicons - fales
FF - user.js: browser.display.show_image_placeholders - true
FF - user.js: browser.turbo.enabled - true
FF - user.js: browser.urlbar.autocomplete.enabled - true
FF - user.js: browser.urlbar.autofill - true
FF - user.js: browser.xul.error_pages.enabled - true
FF - user.js: content.interrupt.parsing - true
FF - user.js: content.max.tokenizing.time - 3000000
FF - user.js: content.maxtextrun - 8191
FF - user.js: content.notify.backoffcount - 5
FF - user.js: content.notify.interval - 750000
FF - user.js: content.notify.ontimer - true
FF - user.js: content.switch.threshold - 750000
FF - user.js: network.http.max-connections - 32
FF - user.js: network.http.max-connections-per-server - 8
FF - user.js: network.http.max-persistent-connections-per-proxy - 8
FF - user.js: network.http.max-persistent-connections-per-server - 4
FF - user.js: network.http.pipelining - true
FF - user.js: network.http.pipelining.firstrequest - true
FF - user.js: network.http.pipelining.maxrequests - 8
FF - user.js: network.http.proxy.pipelining - true
FF - user.js: network.http.request.max-start-delay - 0
FF - user.js: nglayout.initialpaint.delay - 0
FF - user.js: plugin.expose_full_path - true
FF - user.js: ui.submenuDelay - 0
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-07-08 07:09
Windows 5.1.2600 Service Pack 3 NTFS

Procurando processos ocultos …

Procurando entradas auto inicializáveis ocultas …

Procurando ficheiros/arquivos ocultos …

Varredura completada com sucesso
arquivos/ficheiros ocultos: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet008\Services\SAVRT]
"ImagePath"="-"

[HKEY_LOCAL_MACHINE\System\ControlSet008\Services\SNDSrvc]
"ImagePath"="-"
.
——————— DLLs Carregadas Sob os Processos em Execução ———————

- - - - - - - > 'explorer.exe'(3792)
c:\programas\Dropbox\DropboxExt.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Tempo para conclusão: 2009-07-08 7:11
ComboFix-quarantined-files.txt 2009-07-08 06:11
ComboFix2.txt 2009-07-07 20:59

Pré-execução: 25.126.395.904 bytes livres
Pós execução: 25.088.319.488 bytes livres

Current=8 Default=8 Failed=7 LastKnownGood=9 Sets=1,2,3,4,5,6,7,8,9
248 — E O F — 2009-06-23 04:24


Malwarebytes MBAM.txt

Malwarebytes' Anti-Malware 1.38
Database version: 2297
Windows 5.1.2600 Service Pack 3

08-07-2009 8:13:38
mbam-log-2009-07-08 (08-13-38).txt

Scan type: Quick Scan
Objects scanned: 98930
Time elapsed: 1 minute(s), 41 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)


Kasperski online scan

——————————————————————————–
KASPERSKY ONLINE SCANNER 7.0 REPORT
Wednesday, July 8, 2009
Operating System: Microsoft Windows XP Professional Service Pack 3 (build 2600)
Kaspersky Online Scanner version: 7.0.26.13
Program database last update: Wednesday, July 08, 2009 10:33:00
Records in database: 2442137
——————————————————————————–

Scan settings:
Scan using the following database: extended
Scan archives: yes
Scan mail databases: yes

Scan area - My Computer:
C:\
D:\
E:\
G:\

Scan statistics:
Files scanned: 61679
Threat name: 4
Infected objects: 7
Suspicious objects: 0
Duration of the scan: 01:20:25


File name / Threat name / Threats count
C:\Qoobox\Quarantine\C\WINDOWS\system32\drivers\_ngecpbcb_.sys.zip Infected: Trojan.Win32.BHO.ext 1
C:\Qoobox\Quarantine\C\WINDOWS\system32\SKYNETdrwlsxit.dll.vir Infected: Trojan.Win32.Small.bzc 1
C:\Qoobox\Quarantine\C\WINDOWS\system32\_uqchywve_.dll.zip Infected: Trojan-Clicker.Win32.Delf.cbe 1
G:\utilitarios\vnc-4_1_2-x86_win32.exe Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.4 4

The selected area was scanned.

Thanks for the patience!!!
Post #9
Hi,

The system appears to be normal right now. It functions correctly to my knowledge.

HijackThis log

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:43:44, on 08-07-2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16850)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\Programas\Fingerprint Sensor\AtService.exe
C:\WINDOWS\system32\svchost.exe
C:\Programas\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\WLTRYSVC.EXE
C:\WINDOWS\System32\bcmwltry.exe
C:\WINDOWS\system32\spoolsv.exe
c:\programas\idt\dellxpm09b_6017v022\wdm\stacsv.exe
C:\Programas\Avira\AntiVir Desktop\sched.exe
C:\Programas\Avira\AntiVir Desktop\avguard.exe
C:\Programas\COMODO\BackUp\CmdBkSvc.exe
C:\WINDOWS\system32\DWRCS.EXE
C:\Programas\Ficheiros comuns\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\SearchIndexer.exe
C:\Programas\Dell\Dell ControlPoint\DCPButtonSvc.exe
C:\Programas\Dell\Dell ControlPoint\System Manager\DCPSysMgrSvc.exe
C:\WINDOWS\system32\DWRCST.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Programas\IDT\WDM\sttray.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\WINDOWS\system32\AESTFltr.exe
C:\Programas\Windows Defender\MSASCui.exe
C:\WINDOWS\system32\WLTRAY.exe
C:\Programas\CyberLink\PowerDVD DX\PDVDDXSrv.exe
C:\Programas\Dell\Dell ControlPoint\Dell.ControlPoint.exe
C:\Programas\DellTPad\Apoint.exe
C:\WINDOWS\PixArt\PAC7302\Monitor.exe
C:\Programas\DellTPad\ApMsgFwd.exe
C:\Programas\Avira\AntiVir Desktop\avgnt.exe
C:\Programas\DellTPad\Apntex.exe
C:\Programas\DellTPad\HidFind.exe
C:\Programas\Spyware Doctor\pctsTray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programas\Windows Live\Messenger\msnmsgr.exe
C:\Programas\Skype\Phone\Skype.exe
C:\Programas\Ficheiros comuns\InstallShield\UpdateService\ISUSPM.exe
C:\Programas\IObit\Advanced SystemCare 3\AWC.exe
C:\Programas\Dell\Dell ControlPoint\System Manager\DCPSysMgr.exe
C:\Programas\Windows Live\Contacts\wlcomm.exe
C:\Programas\Skype\Plugin Manager\skypePM.exe
C:\Programas\Mozilla Firefox\firefox.exe
C:\Programas\Microsoft Office\OFFICE11\OUTLOOK.EXE
C:\Programas\Microsoft Office\OFFICE11\WINWORD.EXE
C:\Programas\Microsoft\Office Live\OfficeLiveSignIn.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\SearchProtocolHost.exe
C:\Documents and Settings\carlos.simoes\Ambiente de trabalho\HiJackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: Facilitador de Leitor de Link Adobe PDF - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programas\Ficheiros comuns\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programas\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programas\Ficheiros comuns\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [SysTrayApp] %ProgramFiles%\IDT\WDM\sttray.exe
O4 - HKLM\..\Run: [AESTFltr] "C:\WINDOWS\system32\AESTFltr.exe" /NoDlg
O4 - HKLM\..\Run: [Windows Defender] "C:\Programas\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\WINDOWS\system32\WLTRAY.exe
O4 - HKLM\..\Run: [PDVDDXSrv] "C:\Programas\CyberLink\PowerDVD DX\PDVDDXSrv.exe"
O4 - HKLM\..\Run: [DellControlPoint] "C:\Programas\Dell\Dell ControlPoint\Dell.ControlPoint.exe"
O4 - HKLM\..\Run: [Apoint] C:\Programas\DellTPad\Apoint.exe
O4 - HKLM\..\Run: [PAC7302_Monitor] C:\WINDOWS\PixArt\PAC7302\Monitor.exe
O4 - HKLM\..\Run: [JobHisInit] C:\Programas\RDS\RMClient\JobHisInit.exe
O4 - HKLM\..\Run: [MplSetUp] C:\Programas\RDS\RMClient\MplSetUp.exe
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [avgnt] "C:\Programas\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [ISTray] "C:\Programas\Spyware Doctor\pctsTray.exe"
O4 - HKLM\..\Run: [Malwarebytes' Anti-Malware] "C:\Programas\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
O4 - HKLM\..\Run: [DameWare MRC Agent] C:\WINDOWS\system32\DWRCST.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Programas\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Skype] "C:\Programas\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [ISUSPM] "C:\Programas\Ficheiros comuns\InstallShield\UpdateService\ISUSPM.exe" -scheduler
O4 - HKCU\..\Run: [Advanced SystemCare 3] "C:\Programas\IObit\Advanced SystemCare 3\AWC.exe" /startup
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Programas\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Programas\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
O4 - Global Startup: Dell ControlPoint System Manager.lnk = C:\Programas\Dell\Dell ControlPoint\System Manager\DCPSysMgr.exe
O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programas\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programas\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Pesquisar - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programas\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programas\Messenger\msmsgs.exe
O15 - Trusted Zone: http://intranetz.zagope.pt
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1239895530828
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1239895500359
O16 - DPF: {C4847596-972C-11D0-9567-00A0C9273C2A} (Crystal Report Viewer Control) - http://intranetz.zagope.pt/viewer/activeXV…tivexviewer.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHEI~1\Skype\SKYPE4~1.DLL
O23 - Service: Alerta AlerterALG (AlerterALG) - Unknown owner - C:\WINDOWS\TEMP\tyhretchbs.exe (file missing)
O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Programas\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Programas\Avira\AntiVir Desktop\avguard.exe
O23 - Service: AuthenTec Fingerprint Service (ATService) - AuthenTec, Inc. - C:\Programas\Fingerprint Sensor\AtService.exe
O23 - Service: Dell ControlPoint Button Service (buttonsvc32) - Dell Inc. - C:\Programas\Dell\Dell ControlPoint\DCPButtonSvc.exe
O23 - Service: ComodoBackupService - COMODO - C:\Programas\COMODO\BackUp\CmdBkSvc.exe
O23 - Service: Dell ControlPoint System Manager (dcpsysmgrsvc) - Dell Inc. - C:\Programas\Dell\Dell ControlPoint\System Manager\DCPSysMgrSvc.exe
O23 - Service: DameWare Mini Remote Control (DWMRCS) - DameWare Development LLC - C:\WINDOWS\system32\DWRCS.EXE
O23 - Service: MBAMService - Malwarebytes Corporation - C:\Programas\Malwarebytes' Anti-Malware\mbamservice.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Programas\WinPcap\rpcapd.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Programas\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Programas\Spyware Doctor\pctsSvc.exe
O23 - Service: Audio Service (STacSV) - IDT, Inc. - c:\programas\idt\dellxpm09b_6017v022\wdm\stacsv.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Programas\Ficheiros comuns\SureThing Shared\stllssvr.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE

–
End of file - 9413 bytes


Thanks
Post #10
Hi,

Please do the following:

  • Open HiJackThis
  • Click on Do a system scan only
  • Check the boxes next to ONLY the entries listed below (if still present):


O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O23 - Service: Alerta AlerterALG (AlerterALG) - Unknown owner - C:\WINDOWS\TEMP\tyhretchbs.exe (file missing)

  • Close all windows except Hijackthis and click Fix Checked
  • Click Yes when prompted
  • Close HijackThis.


NEXT

Please download JavaRa to your desktop and unzip it to its own folder.
  • Run JavaRa.exe, pick the language of your choice and click Select. Then click Remove Older Versions.
  • Accept any prompts.
  • Open JavaRa.exe again and select Search For Updates.
  • Select Update Using Sun Java's Website then click Search and click on the Open Webpage button.
  • Scroll down to the Java SE Runtime Environment (JRE) option.
  • Download and install the latest Java Runtime Environment (JRE) version for your computer.(version 6, update 14)

NEXT

Visit ADOBEand download the latest version of Acrobat Reader (version 9.1)
Having the latest updates ensures there are no security vulnerabilities in your system.


NEXT

Follow these steps to uninstall Combofix

  • Click START then RUN
  • Now type Combofix /u in the runbox and click OK. Note the space between the ..X and the /U, it needs to be there.

[external image: Posted Image]


NEXT

Now to remove the rest of the tools that we have used in fixing your machine:
  • Make sure you have an Internet Connection.
  • Download OTC to your desktop and run it
  • A list of tool components used in the Cleanup of malware will be downloaded.
  • If your Firewall or Real Time protection attempts to block OTC to reach the Internet, please allow the application to do so.
  • Click Yes to begin the Cleanup process and remove these components, including this application.
  • You will be asked to reboot the machine to finish the Cleanup process. If you are asked to reboot the machine choose Yes.


NEXT

Below I have included a number of recommendations for how to protect your computer against malware infections.

  • Keep Windows updated by regularly checking their website at :
    http://windowsupdate.microsoft.com/
    This will ensure your computer has always the latest security updates available installed on your computer.

  • SpywareBlaster protects against bad ActiveX, it immunizes your PC against them.

  • SpywareGuard offers realtime protection from spyware installation attempts. Make sure you are only running one real-time anti-spyware protection program ( eg : TeaTimer, Windows Defender ) or there will be a conflict.

  • Make Internet Explorer more secure
    • Click Start > Run
    • Type Inetcpl.cpl & click OK
    • Click on the Security tab
    • Click Reset all zones to default level
    • Make sure the Internet Zone is selected & Click Custom level
    • In the ActiveX section, set the first two options ("Download signed and unsigned ActiveX controls) to "Prompt", and ("Initialize and Script ActiveX controls not marked as safe") to "Disable".
    • Next Click OK, then Apply button and then OK to exit the Internet Properties page.
  • ATF Cleaner - Cleans temporary files from IE and Windows, empties the recycle bin and more. Great tool to help speed up your computer and knock out those nasties that like to reside in the temp folders.

  • MVPS Hosts file replaces your current HOSTS file with one containing well known ad sites and other bad sites. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer, meaning it will be difficult to infect yourself in the future.

    WOT, Web of Trust, warns you about risky websites that try to scam visitors, deliver malware or send spam. Protect your computer against online threats by using WOT as your front-line layer of protection when browsing or searching in unfamiliar territory. WOT's color-coded icons show you ratings for 21 million websites, helping you avoid the dangerous sites:
    • Green to go
    • Yellow for caution
    • Red to stop
    WOT has an addon available for both Firefox and IE

  • For Firefox, I highly recommend this add-on to keep your PC even more secure.
    • NoScript - for blocking ads and other potential website attacks
  • Keep a backup of your important files - Now, more than ever, it's especially important to protect your digital files and memories. This article is full of good information on alternatives for home backup solutions.
  • ERUNT (Emergency Recovery Utility NT) allows you to keep a complete backup of your registry and restore it when needed. The standard registry backup options that come with Windows back up most of the registry but not all of it. ERUNT however creates a complete backup set, including the Security hive and user related sections. ERUNT is easy to use and since it creates a full backup, there are no options or choices other than to select the location of the backup files. The backup set includes a small executable that will launch the registry restore if needed.
  • In light of your recent issue, I'm sure you'd like to avoid any future infections. Please take a look at these well written articles:
    Think Prevention.
    PC Safety and Security–What Do I Need?.


**Be very wary with any security software that is advertised in popups or in other ways. They are not only usually of no use, but often have malware in them.


Thank you for your patience, and performing all of the procedures requested.

Please respond one last time so we can consider the thread resolved and close it, thank-you.
Post #11
Hi, thanks for your time and patience.

I've done all the steps you've asked.

HJT doesn't delete the O23 line, it keeps comming back:
O23 - Service: Alerta AlerterALG (AlerterALG) - Unknown owner - C:\WINDOWS\TEMP\tyhretchbs.exe (file missing)

HJT log

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:09:58, on 09-07-2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16850)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\Programas\Fingerprint Sensor\AtService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\WLTRYSVC.EXE
C:\WINDOWS\System32\bcmwltry.exe
C:\WINDOWS\system32\spoolsv.exe
c:\programas\idt\dellxpm09b_6017v022\wdm\stacsv.exe
C:\Programas\Avira\AntiVir Desktop\sched.exe
C:\Programas\Avira\AntiVir Desktop\avguard.exe
C:\Programas\COMODO\BackUp\CmdBkSvc.exe
C:\WINDOWS\system32\DWRCS.EXE
C:\Programas\Java\jre6\bin\jqs.exe
C:\Programas\Ficheiros comuns\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\SearchIndexer.exe
C:\WINDOWS\system32\DWRCST.exe
C:\WINDOWS\Explorer.EXE
C:\Programas\Dell\Dell ControlPoint\DCPButtonSvc.exe
C:\Programas\Dell\Dell ControlPoint\System Manager\DCPSysMgrSvc.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Programas\IDT\WDM\sttray.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\WINDOWS\system32\AESTFltr.exe
C:\WINDOWS\system32\WLTRAY.exe
C:\Programas\CyberLink\PowerDVD DX\PDVDDXSrv.exe
C:\Programas\Dell\Dell ControlPoint\Dell.ControlPoint.exe
C:\Programas\DellTPad\Apoint.exe
C:\WINDOWS\PixArt\PAC7302\Monitor.exe
C:\Programas\DellTPad\ApMsgFwd.exe
C:\Programas\Avira\AntiVir Desktop\avgnt.exe
C:\Programas\DellTPad\Apntex.exe
C:\Programas\Java\jre6\bin\jusched.exe
C:\Programas\DellTPad\HidFind.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programas\Windows Live\Messenger\msnmsgr.exe
C:\Programas\Skype\Phone\Skype.exe
C:\Programas\Ficheiros comuns\InstallShield\UpdateService\ISUSPM.exe
C:\Programas\IObit\Advanced SystemCare 3\AWC.exe
C:\Programas\Dell\Dell ControlPoint\System Manager\DCPSysMgr.exe
C:\Programas\Windows Live\Contacts\wlcomm.exe
C:\Programas\Microsoft Office\OFFICE11\OUTLOOK.EXE
C:\Programas\Skype\Plugin Manager\skypePM.exe
C:\Programas\Microsoft Office\OFFICE11\WINWORD.EXE
C:\Programas\Microsoft\Office Live\OfficeLiveSignIn.exe
C:\WINDOWS\system32\svchost.exe
C:\Programas\SpywareGuard\sgmain.exe
C:\Programas\SpywareGuard\sgbhp.exe
C:\Programas\Mozilla Firefox\firefox.exe
C:\Documents and Settings\carlos.simoes\Ambiente de trabalho\HiJackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programas\Ficheiros comuns\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Programas\SpywareGuard\dlprotect.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programas\Ficheiros comuns\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programas\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Programas\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [SysTrayApp] %ProgramFiles%\IDT\WDM\sttray.exe
O4 - HKLM\..\Run: [AESTFltr] "C:\WINDOWS\system32\AESTFltr.exe" /NoDlg
O4 - HKLM\..\Run: [Windows Defender] "C:\Programas\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\WINDOWS\system32\WLTRAY.exe
O4 - HKLM\..\Run: [PDVDDXSrv] "C:\Programas\CyberLink\PowerDVD DX\PDVDDXSrv.exe"
O4 - HKLM\..\Run: [DellControlPoint] "C:\Programas\Dell\Dell ControlPoint\Dell.ControlPoint.exe"
O4 - HKLM\..\Run: [Apoint] C:\Programas\DellTPad\Apoint.exe
O4 - HKLM\..\Run: [PAC7302_Monitor] C:\WINDOWS\PixArt\PAC7302\Monitor.exe
O4 - HKLM\..\Run: [JobHisInit] C:\Programas\RDS\RMClient\JobHisInit.exe
O4 - HKLM\..\Run: [MplSetUp] C:\Programas\RDS\RMClient\MplSetUp.exe
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [avgnt] "C:\Programas\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [Malwarebytes' Anti-Malware] "C:\Programas\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programas\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Programas\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [DameWare MRC Agent] C:\WINDOWS\system32\DWRCST.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Programas\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Skype] "C:\Programas\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [ISUSPM] "C:\Programas\Ficheiros comuns\InstallShield\UpdateService\ISUSPM.exe" -scheduler
O4 - HKCU\..\Run: [Advanced SystemCare 3] "C:\Programas\IObit\Advanced SystemCare 3\AWC.exe" /startup
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: ERUNT AutoBackup.lnk = C:\Programas\ERUNT\AUTOBACK.EXE
O4 - Startup: SpywareGuard.lnk = C:\Programas\SpywareGuard\sgmain.exe
O4 - Global Startup: Dell ControlPoint System Manager.lnk = C:\Programas\Dell\Dell ControlPoint\System Manager\DCPSysMgr.exe
O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Pesquisar - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programas\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programas\Messenger\msmsgs.exe
O15 - Trusted Zone: http://intranetz.zagope.pt
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1239895530828
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1239895500359
O16 - DPF: {C4847596-972C-11D0-9567-00A0C9273C2A} (Crystal Report Viewer Control) - http://intranetz.zagope.pt/viewer/activeXV…tivexviewer.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHEI~1\Skype\SKYPE4~1.DLL
O23 - Service: Alerta AlerterALG (AlerterALG) - Unknown owner - C:\WINDOWS\TEMP\tyhretchbs.exe (file missing)
O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Programas\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Programas\Avira\AntiVir Desktop\avguard.exe
O23 - Service: AuthenTec Fingerprint Service (ATService) - AuthenTec, Inc. - C:\Programas\Fingerprint Sensor\AtService.exe
O23 - Service: Dell ControlPoint Button Service (buttonsvc32) - Dell Inc. - C:\Programas\Dell\Dell ControlPoint\DCPButtonSvc.exe
O23 - Service: ComodoBackupService - COMODO - C:\Programas\COMODO\BackUp\CmdBkSvc.exe
O23 - Service: Dell ControlPoint System Manager (dcpsysmgrsvc) - Dell Inc. - C:\Programas\Dell\Dell ControlPoint\System Manager\DCPSysMgrSvc.exe
O23 - Service: DameWare Mini Remote Control (DWMRCS) - DameWare Development LLC - C:\WINDOWS\system32\DWRCS.EXE
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Programas\Java\jre6\bin\jqs.exe
O23 - Service: MBAMService - Malwarebytes Corporation - C:\Programas\Malwarebytes' Anti-Malware\mbamservice.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Programas\WinPcap\rpcapd.exe
O23 - Service: Audio Service (STacSV) - IDT, Inc. - c:\programas\idt\dellxpm09b_6017v022\wdm\stacsv.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Programas\Ficheiros comuns\SureThing Shared\stllssvr.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE

–
End of file - 9298 bytes

Thanks a lot
Post #12
Hi,

Please do the following

Click Start >Run type notepad into the run box click OK
Click Format and make certain that Word Wrap is NOT checked.

Copy all the text inside of the code box, Press Ctrl+C (or right click on the highlighted section and choose 'copy')

@echo off
SC stop AlerterALG
SC delete AlerterALG
attrib -s -h -r C:\WINDOWS\TEMP\tyhretchbs.exe
del /f /q C:\WINDOWS\TEMP\tyhretchbs.exe
del %0

Now paste the copied text into the open notepad, press CTRL+V (or right click and choose 'paste')

Now go to File > and click Save As,
From the drop down menu at the top of the box choose Desktop as the location to save this file.
Go down to the File Name box and type in runme.bat as the file name, then choose All Files as the save as file type.
Then click the save button.
Once you have clicked the save button, close Notepad.

You will now have a file on your desktop that looks like this

[external image: Posted Image]

Locate runme.bat on your Desktop and double-click it
A black window will flash up and disappear again, and runme.bat will be deleted.
This is normal.


NEXT

Follow these steps to uninstall Combofix

  • Click START then RUN
  • Now type Combofix /u in the runbox and click OK. Note the space between the ..X and the /U, it needs to be there.

[external image: Posted Image]


NEXT

Now to remove the rest of the tools that we have used in fixing your machine:
  • Make sure you have an Internet Connection.
  • Download OTC to your desktop and run it
  • A list of tool components used in the Cleanup of malware will be downloaded.
  • If your Firewall or Real Time protection attempts to block OTC to reach the Internet, please allow the application to do so.
  • Click Yes to begin the Cleanup process and remove these components, including this application.
  • You will be asked to reboot the machine to finish the Cleanup process. If you are asked to reboot the machine choose Yes.


NEXT

Below I have included a number of recommendations for how to protect your computer against malware infections.

  • Keep Windows updated by regularly checking their website at :
    http://windowsupdate.microsoft.com/
    This will ensure your computer has always the latest security updates available installed on your computer.

  • SpywareBlaster protects against bad ActiveX, it immunizes your PC against them.

  • SpywareGuard offers realtime protection from spyware installation attempts. Make sure you are only running one real-time anti-spyware protection program ( eg : TeaTimer, Windows Defender ) or there will be a conflict.

  • Make Internet Explorer more secure
    • Click Start > Run
    • Type Inetcpl.cpl & click OK
    • Click on the Security tab
    • Click Reset all zones to default level
    • Make sure the Internet Zone is selected & Click Custom level
    • In the ActiveX section, set the first two options ("Download signed and unsigned ActiveX controls) to "Prompt", and ("Initialize and Script ActiveX controls not marked as safe") to "Disable".
    • Next Click OK, then Apply button and then OK to exit the Internet Properties page.
  • ATF Cleaner - Cleans temporary files from IE and Windows, empties the recycle bin and more. Great tool to help speed up your computer and knock out those nasties that like to reside in the temp folders.

  • MVPS Hosts file replaces your current HOSTS file with one containing well known ad sites and other bad sites. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer, meaning it will be difficult to infect yourself in the future.

    WOT, Web of Trust, warns you about risky websites that try to scam visitors, deliver malware or send spam. Protect your computer against online threats by using WOT as your front-line layer of protection when browsing or searching in unfamiliar territory. WOT's color-coded icons show you ratings for 21 million websites, helping you avoid the dangerous sites:
    • Green to go
    • Yellow for caution
    • Red to stop
    WOT has an addon available for both Firefox and IE

  • For Firefox, I highly recommend this add-on to keep your PC even more secure.
    • NoScript - for blocking ads and other potential website attacks
  • Keep a backup of your important files - Now, more than ever, it's especially important to protect your digital files and memories. This article is full of good information on alternatives for home backup solutions.
  • ERUNT (Emergency Recovery Utility NT) allows you to keep a complete backup of your registry and restore it when needed. The standard registry backup options that come with Windows back up most of the registry but not all of it. ERUNT however creates a complete backup set, including the Security hive and user related sections. ERUNT is easy to use and since it creates a full backup, there are no options or choices other than to select the location of the backup files. The backup set includes a small executable that will launch the registry restore if needed.
  • In light of your recent issue, I'm sure you'd like to avoid any future infections. Please take a look at these well written articles:
    Think Prevention.
    PC Safety and Security–What Do I Need?.


**Be very wary with any security software that is advertised in popups or in other ways. They are not only usually of no use, but often have malware in them.


Thank you for your patience, and performing all of the procedures requested.

Please respond one last time so we can consider the thread resolved and close it, thank-you.
Post #15
Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance. If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread. Everyone else please begin a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI