What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] unremovable trojan(s) problem

13 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #16
biba82,

The proxy address is 219.93.178.162 and is owned by TMNET in Malaysia.

Let me know what you find out. If they don't recognize it, we will remove it and see how it goes.
Post #17
Hi Tomk. Nothing new so far re. the proxy, but my Firefox only works (w/o crashing) when my Sunbelt Personal Firewall is turned off. That's odd, and how can I possibly change this??? Get back to you as soon as I know more about the proxy. The guy who set up the network, just recently left this place (got his Skype contact though). biba82
Post #19 last edited
biba82,

Please download the OTM by OldTimer.
  • Save it to your desktop.
  • Please double-click OTM.exe to run it.
    (Note: If you are running on Vista, right-click on the file and choose Run As Administrator).
  • Copy the lines inside the codebox below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):

    :Processes
explorer.exe

:Reg
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"=-
"ProxyServer"=-

:Commands
[purity]
[emptytemp]
[start explorer]
[Reboot]
  • Return to OTM, right click in the "Paste Instructions for Items to be Moved" window (under the yellow bar) and choose Paste.
  • Click the red Moveit! button.
  • Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
  • Close OTM
Note: If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes. In this case, after the reboot, open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTM\MovedFiles folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post.

Then also post a new DDS log.
Post #20
Hi Tomk,

stuff!

I cannot access the dl link you posted! Following message pops up:

High security alert!!!

You are not permitted to download the file "OTM.exe" because it is infected with the virus "PossibleThreat".

URL = http://oldtimer.geekstogo.com/OTM.exe

File quarantined as: .
http://www.fortinet.com/ve?vid=62183

This has happened before, but I cannot log onto my university account any longer!!!
Therefore, I cannot dl otm by oldtimer!

Any other way getting my hands on the software???
Post #21
biba82,

Let's do it this way.

Backup Your Registry with ERUNT
  • Download ERUNT from here and save it to your desktop.
  • Right-click erunt.zip, choose Extract All… and follow the prompts to unzip the program
  • Open the erunt folder on your Desktop and double-click ERUNT.exe to start the program
  • OK all the prompts to back up your registry to the default location.
Note:
The backups can be restored from here:
C:\windows\ERDNT\\ERDNT.exe

Please open Notepad

  • Click Start , then Run
  • Type notepad.exe in the Run Box.
    Copy and Paste everything from the Quote box into Notepad:

    REGEDIT4

    [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
    "ProxyOverride"=-
    "ProxyServer"=-


    Make sure there are NO blank lines before REGEDIT4
    Make sure there IS one blank line at the end of the file.

    Go to File > Save As
    Save File name as Fix.reg
    Change Save as Type to All Files and save the file to your desktop.

    Close Notepad, and double-click Fix.reg on your Desktop. When it asks if you want to merge the info to the registry, hit YES/OK. Reboot the computer.

Then please give me a new DDS log.
Post #22
Hi once more, … this step taught me: The devil's in the detail. Overlooked one word and could not access the internet after reboot. Now it's done! Here's the log: DDS (Ver_09-06-26.01) - NTFSx86 Run by [removed] at 21:50:33,03 on 08.09.2009 Internet Explorer: 7.0.5730.13 BrowserJavaVersion: 1.6.0_16 Microsoft Windows XP Home Edition 5.1.2600.3.1252.49.1031.18.2046.1440 [GMT 2:00] AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF} FW: COMODO Firewall *enabled* {043803A3-4F86-4ef6-AFC5-F6E02A79969B} ============== Running Processes =============== C:\WINDOWS\system32\svchost -k DcomLaunch svchost.exe C:\Programme\COMODO\COMODO Internet Security\cmdagent.exe C:\WINDOWS\system32\svchost.exe -k netsvcs svchost.exe svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe svchost.exe C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe C:\Programme\Bonjour\mDNSResponder.exe svchost.exe C:\Programme\Java\jre6\bin\jqs.exe C:\WINDOWS\system32\nvsvc32.exe C:\Programme\Spyware Terminator\sp_rsser.exe C:\PROGRA~1\AVG\AVG8\avgrsx.exe C:\PROGRA~1\AVG\AVG8\avgnsx.exe C:\WINDOWS\system32\svchost.exe -k imgsvc C:\PROGRA~1\AVG\AVG8\avgemc.exe C:\Programme\AVG\AVG8\avgcsrvx.exe C:\Programme\Java\jre6\bin\jusched.exe C:\Programme\COMODO\COMODO Internet Security\cfp.exe C:\WINDOWS\system32\ctfmon.exe C:\Programme\Mozilla Firefox\firefox.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\system32\wbem\wmiapsrv.exe C:\WINDOWS\system32\msiexec.exe C:\WINDOWS\system32\MsiExec.exe C:\Dokumente und Einstellungen\Benjamin Baar\Desktop\virus\Install Software\dds.scr ============== Pseudo HJT Report =============== uStart Page = hxxp://altavista.co.uk/ uInternet Connection Wizard,ShellNext = iexplore BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\programme\java\jre6\bin\jp2ssv.dll BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\programme\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll TB: {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - No File uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup mRun: [SunJavaUpdateSched] "c:\programme\java\jre6\bin\jusched.exe" mRun: [COMODO Internet Security] "c:\programme\comodo\comodo internet security\cfp.exe" -h dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\programme\messenger\msmsgs.exe DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1186694380734 DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\programme\avg\avg8\avgpp.dll Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\gemein~1\skype\SKYPE4~1.DLL Handler: widimg - {EE7C2AFF-5742-44FF-BD0E-E521B0D3C3BA} - c:\windows\system32\BTXPPanel.dll Notify: avgrsstarter - avgrsstx.dll AppInit_DLLs: c:\windows\system32\guard32.dll SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\programme\superantispyware\SASSEH.DLL ================= FIREFOX =================== FF - ProfilePath - c:\dokume~1\benjam~1\anwend~1\mozilla\firefox\profiles\9uva9vku.default\ FF - prefs.js: browser.startup.homepage - FF - prefs.js: keyword.URL - FF - prefs.js: keyword.enabled - false FF - plugin: c:\program files\real\realplayer\netscape6\nppl3260.dll FF - plugin: c:\program files\real\realplayer\netscape6\nprjplug.dll FF - plugin: c:\program files\real\realplayer\netscape6\nprpjplug.dll FF - plugin: c:\programme\google\google earth plugin\npgeplugin.dll FF - plugin: c:\programme\google\update\1.2.183.7\npGoogleOneClick8.dll FF - plugin: c:\programme\mozilla firefox\plugins\NPinfotl.dll FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\ FF - HiddenExtension: Java Console: No Registry Reference - c:\programme\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} ============= SERVICES / DRIVERS =============== R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2008-11-1 335240] R1 AvgMfx86;AVG Free On-access Scanner Minifilter Driver x86;c:\windows\system32\drivers\avgmfx86.sys [2008-11-1 27784] R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2008-11-1 108552] R1 cmdGuard;COMODO Internet Security Sandbox Driver;c:\windows\system32\drivers\cmdguard.sys [2009-9-8 132168] R1 cmdHlp;COMODO Internet Security Helper Driver;c:\windows\system32\drivers\cmdhlp.sys [2009-9-8 25160] R1 hwinterface;hwinterface;c:\windows\system32\drivers\hwinterface.sys [2005-2-25 3026] R1 SASDIFSV;SASDIFSV;c:\programme\superantispyware\sasdifsv.sys [2009-8-5 9968] R1 SASKUTIL;SASKUTIL;c:\programme\superantispyware\SASKUTIL.SYS [2009-8-5 74480] R1 sp_rsdrv2;Spyware Terminator Driver 2;c:\windows\system32\drivers\sp_rsdrv2.sys [2008-6-16 141312] R2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\avg\avg8\avgemc.exe [2008-11-1 908056] R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\avg\avg8\avgwdsvc.exe [2008-11-1 297752] R2 cmdAgent;COMODO Internet Security Helper Service;c:\programme\comodo\comodo internet security\cmdagent.exe [2009-9-8 715392] R3 LVHybrid;LVHybrid service;c:\windows\system32\drivers\LVHybrid.sys [2005-3-1 1013248] R3 Slazldrv;SmartLink AMR_PCI Driver;c:\windows\system32\drivers\sldrv\slazldrv.sys [2005-2-8 226768] S2 gupdate1c9e5c393d15dc8;Google Update Service (gupdate1c9e5c393d15dc8);c:\programme\google\update\GoogleUpdate.exe [2009-6-5 133104] S3 avmeject;AVM Eject;c:\windows\system32\drivers\avmeject.sys [2009-2-6 4352] S3 FWLANUSB;AVM FRITZ!WLAN;c:\windows\system32\drivers\fwlanusb.sys [2009-2-6 265088] S3 mbr;mbr;\??\c:\dokume~1\benjam~1\lokale~1\temp\mbr.sys –> c:\dokume~1\benjam~1\lokale~1\temp\mbr.sys [?] S3 nvhid;NVIDIA HID Filter Driver;c:\programme\nvidia corporation\forceware\nvremote\nvhid.sys [2009-9-3 5632] S3 PSI;PSI;c:\windows\system32\drivers\psi_mf.sys [2009-6-17 12648] S3 SASENUM;SASENUM;c:\programme\superantispyware\SASENUM.SYS [2009-8-5 7408] =============== Created Last 30 ================ 2009-09-08 14:47 –d—– c:\dokume~1\alluse~1\anwend~1\Comodo 2009-09-08 14:47 179,792 a——- c:\windows\system32\guard32.dll 2009-09-08 14:47 132,168 a——- c:\windows\system32\drivers\cmdguard.sys 2009-09-08 14:47 25,160 a——- c:\windows\system32\drivers\cmdhlp.sys 2009-09-08 14:46 –d—– c:\programme\COMODO 2009-09-08 14:29 120 a——- c:\windows\CIS_Setup_3.11.108364.552_XP_Vista_x32.INI 2009-09-08 09:47 20 a——- c:\windows\popcinfot.dat 2009-09-08 09:47 –d—– c:\dokume~1\alluse~1\anwend~1\PopCap Games 2009-09-08 09:46 –d—– c:\programme\PopCap Games 2009-09-06 22:56 411,368 a——- c:\windows\system32\deploytk.dll 2009-09-06 22:56 73,728 a——- c:\windows\system32\javacpl.cpl 2009-09-06 20:38 95 a——- c:\windows\system32\productregistry 2009-09-06 20:35 –d—– C:\Sun 2009-09-06 15:49 –d—– c:\programme\Sunbelt Software 2009-09-06 14:15 a-dshr– C:\cmdcons 2009-09-06 14:13 230,912 a——- c:\windows\PEV.exe 2009-09-06 14:13 161,792 a——- c:\windows\SWREG.exe 2009-09-06 14:13 98,816 a——- c:\windows\sed.exe 2009-09-03 23:29 35,328 a——- c:\windows\system32\NvRemote.cpl 2009-09-03 23:29 –d—– c:\programme\NVIDIA Corporation 2009-09-01 09:15 –d—– c:\programme\Sophos 2009-08-31 20:51 –d—– c:\dokume~1\alluse~1\anwend~1\SUPERAntiSpyware.com 2009-08-31 20:51 7,168 a–sh— c:\windows\Thumbs.db 2009-08-31 12:27 –d—– c:\dokume~1\benjam~1\anwend~1\Malwarebytes 2009-08-31 12:10 38,160 a——- c:\windows\system32\drivers\mbamswissarmy.sys 2009-08-31 12:10 –d—– c:\dokume~1\alluse~1\anwend~1\Malwarebytes 2009-08-31 12:10 19,096 a——- c:\windows\system32\drivers\mbam.sys 2009-08-31 12:10 –d—– c:\programme\Malwarebytes' Anti-Malware 2009-08-31 11:29 –d—– c:\dokumente und einstellungen\benjamin baar\DoctorWeb 2009-08-31 10:56 –d—– c:\programme\SUPERAntiSpyware 2009-08-31 10:56 –d—– c:\dokume~1\benjam~1\anwend~1\SUPERAntiSpyware.com 2009-08-29 21:54 –d—– c:\dokumente und einstellungen\benjamin baar\dwhelper 2009-08-29 17:16 –d—– c:\dokume~1\benjam~1\anwend~1\Logs 2009-08-28 20:39 –d—– c:\dokume~1\alluse~1\anwend~1\TVU Networks 2009-08-28 20:39 –d—– c:\dokumente und einstellungen\benjamin baar\LocalLow 2009-08-21 19:40 315,392 a——- c:\windows\system32\nvwrshu.dll 2009-08-21 19:39 2,441,216 a——- c:\windows\system32\nvwssr.dll 2009-08-21 19:28 –d—– c:\programme\NVIDIA 2009-08-20 15:45 –d—– c:\windows\system32\CatRoot_bak 2009-08-19 15:25 –d—– c:\programme\Marvell 2009-08-19 15:21 266,088 a——- c:\windows\system32\xactengine2_8.dll 2009-08-19 15:16 –d—– c:\windows\Logs 2009-08-19 15:00 485,920 a——- c:\windows\system32\NVUNINST.EXE 2009-08-18 21:52 –d—– c:\dokume~1\benjam~1\anwend~1\Blitware 2009-08-18 20:45 –d—– c:\dokume~1\alluse~1\anwend~1\Innovative Solutions 2009-08-18 13:02 –d—– c:\programme\gemeinsame dateien\DivX Shared 2009-08-18 12:26 –d—– c:\programme\Secunia 2009-08-18 12:25 –d—– c:\dokume~1\benjam~1\anwend~1\ScummVM 2009-08-18 11:58 –d—– c:\programme\iPod 2009-08-16 21:12 56 a—h— c:\windows\system32\ezsidmv.dat 2009-08-16 12:03 372,736 a—-r– c:\windows\system32\LVUI2RC.dll 2009-08-16 12:03 106,496 a—-r– c:\windows\system32\lvcoinst.dll 2009-08-16 12:03 22,016 a—-r– c:\windows\system32\drivers\LVUSBSta.sys 2009-08-16 12:03 204,800 a—-r– c:\windows\system32\LVUI2.dll 2009-08-16 12:03 204,800 a—-r– c:\windows\system32\lvcodec2.dll 2009-08-16 12:03 2,180,096 a—-r– c:\windows\system32\drivers\LVSVF2.sys 2009-08-16 11:56 913,280 a—-r– c:\windows\system32\drivers\LV302AV.SYS 2009-08-15 21:44 –d—– c:\windows\system32\XPSViewer 2009-08-15 21:42 –d—– c:\windows\SxsCaPendDel 2009-08-15 14:18 128,512 -c—— c:\windows\system32\dllcache\dhtmled.ocx 2009-08-15 14:18 1,315,328 -c—— c:\windows\system32\dllcache\msoe.dll ==================== Find3M ==================== 2009-09-07 19:10 449,044 a——- c:\windows\system32\perfh007.dat 2009-09-07 19:10 80,306 a——- c:\windows\system32\perfc007.dat 2009-09-07 14:53 70,062 a——- c:\dokume~1\benjam~1\anwend~1\wklnhst.dat 2009-08-21 18:55 413,696 a——- c:\windows\system32\wrap_oal.dll 2009-08-21 18:55 110,592 a——- c:\windows\system32\OpenAL32.dll 2009-08-19 12:28 335,240 a——- c:\windows\system32\drivers\avgldx86.sys 2009-08-19 12:28 11,952 a——- c:\windows\system32\avgrsstx.dll 2009-08-06 10:10 282,624 a——- c:\windows\system32\yk51x86.dll 2009-08-05 10:59 206,336 a——- c:\windows\system32\mswebdvd.dll 2009-07-29 06:34 119,808 a——- c:\windows\system32\t2embed.dll 2009-07-29 06:34 81,920 a——- c:\windows\system32\fontsub.dll 2009-07-17 21:01 58,880 a——- c:\windows\system32\atl.dll 2009-07-13 23:43 286,208 a——- c:\windows\system32\wmpdxm.dll 2009-06-29 17:55 827,392 ——– c:\windows\system32\wininet.dll 2009-06-29 17:55 78,336 a——- c:\windows\system32\ieencode.dll 2009-06-29 17:55 17,408 a——- c:\windows\system32\corpol.dll 2009-06-25 10:25 737,792 a——- c:\windows\system32\lsasrv.dll 2009-06-25 10:25 301,568 a——- c:\windows\system32\kerberos.dll 2009-06-25 10:25 147,456 a——- c:\windows\system32\schannel.dll 2009-06-25 10:25 136,192 a——- c:\windows\system32\msv1_0.dll 2009-06-25 10:25 56,832 a——- c:\windows\system32\secur32.dll 2009-06-25 10:25 54,272 a——- c:\windows\system32\wdigest.dll 2009-06-15 12:43 78,848 a——- c:\windows\system32\telnet.exe 2009-03-06 12:33 47,360 a——- c:\dokume~1\benjam~1\anwend~1\pcouffin.sys 2009-03-06 12:31 94,208 a——- c:\dokume~1\benjam~1\anwend~1\ezplay.sys 2009-02-01 21:15 74,304 a——- c:\dokume~1\benjam~1\anwend~1\GDIPFONTCACHEV1.DAT 2008-02-08 14:29 32 a——- c:\dokume~1\alluse~1\anwend~1\ezsid.dat 2007-08-08 20:26 8 —shr– c:\windows\system32\B641F5EEF4.sys 2007-08-08 20:29 4,184 a–sh— c:\windows\system32\KGyGaAvL.sys ============= FINISH: 21:51:35,12 =============== Your help is very much appreciated!!!

Attachments:

Post #25
biba82,

Let's try this:

Download HostsXpert v4.3 and unzip it to your computer, somewhere where you can find it.
  • Double click on HostsXpert.exe to launch the program.
  • Click on Restore MS Hosts File to restore your Hosts file to its default condition.
  • Click on Make ReadOnly to secure it against further infection.
  • Exit the program.
Visit the Website for more information.
Post #26 last edited
okay, done is that it for now? is there anything I can or should do in the future. The system seems fine now, and I did not get any virus alert over the past couple of days … I'll have to go offline now Many thanks for you help!!
Post #27
biba82,

I'm not seeing anymore malware. Is your system working correctly?

As far as malware goes;

Log looks good :D


Time for some housekeeping
  • Click START then RUN
  • Now type Combofix /u in the runbox and click OK
  • Note the space between the X and the U, it needs to be there.
  • [external image: Posted Image]
The above procedure will:
  • Implement some cleanup procedures.
  • Reset System Restore.

Please re-enable any security that was disabled.


The following is my standard advice for the future. Use what you can and pat yourself on the back for what you're already doing.

Please take time to read Preventing Malware - Tools and Practices for Safe Computing. Very important information for your consideration is contained therein.

I would also suggest you read this:
So how did I get infected in the first place?
by Tony Klein


Also: "How to prevent malware"
by miekiemoes

Please respond back that you understand the above and let me know if you have any questions. Otherwise, this thread will be closed Resolved. :thumbup:
Post #28
Hi Tomk, Many thanks to your excellent support!!! I have read the info you recommended, was good to be reminded! I am as such using Firefox, which is, according to some sources safer than IE (Is that true?). After the reading I've done, I do not really have any questions, apart from maybe asking how safe the free Comodo Firewall is (is it e.g. better than the free Outpost one)? I am using this once since the Sunbelt Personal Firewall causes Firefox to crash. Otherwise, things seem to be fine and in working order. After the last cleaning up was finished, there were some pop ups asking me to reinstall my Bluetooth software. I downloaded the software from the support site of the company I bought my laptop from. With my extended security system (again, thanks for the recommendations), I guess I will be okay for now. Many many thanks biba82
Post #29
biba82,

how safe the free Comodo Firewall is (is it e.g. better than the free Outpost one)?

You can find people who say it is the best, while others will say that it is little better than spyware. I think either one will work for you. It is more a matter of which one you are comfortable using. Both have their good points and bad points.

As far as Firefox goes… I happen to really like Firefox. Safety wise it's kind of like Apple vs. PC. Firefox has so much smaller share of the market that the malware writers are not writing near as many malicious programs that target it. As it becomes more popular, it is being targeted more. I think you are still safer with it and I prefer it anyway. :)

Any other questions?

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI