What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] Cont'd Thread - Malicious Infection Removal

43 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #16
I am not sure if you meant the .dat files that were included in the Qoobox folder, or if there were supposed to be txt files; I only saw .dat files with the date and time. I have tried to post the content of the .dat files and they are too huge- they would require several posts each I think. I am going to attach them to this post, I hope that is acceptable. Let me know if you need me to cut them up and post them, though, and I will attempt it.

Attachments:

Post #17

molydeus85,

Please verify that you still have Inherit on your desktop, if not please re-download it. Instructions here

Go to Start > Run > Copy & Paste each line below, one at a time into the run box, then press Enter, do this for each line

"%userprofile%\desktop\Inherit.exe" "C:\WINDOWS\PCHealth\HelpCtr\Binaries\HelpSvc.exe"
"%userprofile%\desktop\Inherit.exe" "C:\WINDOWS\SYSTEM32\MRT.exe"
"%userprofile%\desktop\Inherit.exe" "C:\WINDOWS\SYSTEM32\svchost.exe"
"%userprofile%\desktop\Inherit.exe" "c:\Program Files\Spybot - Search & Destroy\SpybotSD.exe"
"%userprofile%\desktop\Inherit.exe" "c:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe"
"%userprofile%\desktop\Inherit.exe" "C:\windows\explorer.exe"

- - - - - Next - - - - -

Next we will be running new scans with DDS, Sysprot and Win32kDiag

DDS .

Be sure to disable your script blocking software BEFORE running the DDS scan. Use the link below if you need assistance.

  • Disable any script blocking protection (How to Disable your Security Programs) < - - Important
  • Double click DDS icon to run the tool (may take up to 3 minutes to run)
  • When done, DDS.txt will open.
  • After a few moments, attach.txt will open in a second window.
  • Save both reports to your desktop.
- - - - - Next - - - - -

Sysprot Antirootkit.
  • Double click Sysprot.exe to start the program.
  • Click on the Log tab.
  • In the Write to log box select all items.
  • Click on the Create Log button on the bottom right.
  • After a few seconds a new window should appear.
  • Select Scan Root Drive. Click on the Start button.
  • When it is complete a new window will appear to indicate that the scan is finished.
  • The log will be saved automatically in the same folder Sysprot.exe was extracted to.
  • Open the text file and copy/paste the log in your next post.
- - - - - Next - - - - -

Win32kDiag.
  • Double-click Win32kDiag.exe to run Win32kDiag and let it finish.
  • When it states "Finished! Press any key to exit…", press any key on your keyboard to close the program.
  • Right-click on the Win32kDiag.txt file that is located on your Desktop and select Rename, rename the file to Win32kDiag.txt post the entire contents of that log as a reply to this topic.
- - - - - Next - - - - -

On your next post please provide the following:
  • Post the contents of the DDS.txt report in your next reply
  • Attach the Attach.txt report to your post by scroling down to the Attachments area and then clicking Browse. Browse to where you saved the file, and click Open and the click UPLOAD.
  • Sysprot log
  • Win32kDiag log

Post #18
OCD, The DDS scan successfully ran this time! Also, I am now able to drag icons on the desktop and copy off of it. The explorer and start menu button are still missing though. I have attached Attach.txt and SysProtLog.txt, since it was so large. The DDS log is as follows: —— DDS.txt ———— DDS (Ver_09-06-26.01) - NTFSx86 Run by [removed] at 21:19:57.14 on Wed 09/23/2009 Internet Explorer: 6.0.2900.2180 BrowserJavaVersion: 1.6.0_15 ============== Running Processes =============== ============== Pseudo HJT Report =============== uStart Page = hxxp://www.yahoo.com/ mStart Page = hxxp://www.yahoo.com/ uURLSearchHooks: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn\yt.dll BHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\program files\yahoo!\companion\installs\cpn\yt.dll BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll BHO: SingleInstance Class: {fdad4da1-61a2-4fd8-9c17-86f7ac245081} - c:\program files\yahoo!\companion\installs\cpn\YTSingleInstance.dll TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn\yt.dll uRun: [ABIT uGuruIII] c:\program files\abit\uguru\uGuru.exe uRun: [Steam] "c:\program files\steam\Steam.exe" -silent uRun: [DAEMON Tools Lite] "c:\program files\daemon tools lite\daemon.exe" -autorun uRun: [MSMSGS] "c:\program files\messenger\msmsgs.exe" /background uRun: [Aim6] "c:\program files\aim6\aim6.exe" /d locale=en-US ee://aol/imApp uRun: [SUPERAntiSpyware] c:\program files\superantispyware\SUPERAntiSpyware.exe uRun: [SpybotSD TeaTimer] c:\program files\spybot - search & destroy\TeaTimer.exe mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup mRun: [nwiz] nwiz.exe /install mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 8.0\reader\Reader_sl.exe" mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe" StartupFolder: c:\docume~1\kevino~1.kev\startm~1\programs\startup\openof~1.lnk - c:\program files\openoffice.org 2.3\program\quickstart.exe IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe LSP: %SYSTEMROOT%\system32\nvappfilter.dll DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} - hxxp://www.apple.com/qtactivex/qtplugin.cab DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1137041060718 DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} - hxxp://www.nvidia.com/content/DriverDownload/srl/2.0.0.1/sysreqlab2.cab DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab Notify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.dll SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLL ================= FIREFOX =================== FF - ProfilePath - c:\docume~1\kevino~1.kev\applic~1\mozilla\firefox\profiles\keo34oll.default\ FF - prefs.js: browser.search.defaulturl - hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2706&invocationType=&query= FF - prefs.js: browser.search.selectedEngine - AIM Search FF - prefs.js: keyword.URL - hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2706&invocationType=&query= FF - component: c:\program files\avg\avg8\firefox\components\avgssff.dll FF - plugin: c:\documents and settings\kevin o'connor.kevins-minion\application data\mozilla\firefox\profiles\keo34oll.default\extensions\[removed]\plugins\npiaplayer.dll FF - plugin: c:\documents and settings\kevin o'connor.kevins-minion\application data\mozilla\firefox\profiles\keo34oll.default\extensions\[removed]\platform\winnt_x86-msvc\plugins\npmnqmp071101000055.dll FF - plugin: c:\program files\mozilla firefox\plugins\npdnu.dll FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\ FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} ============= SERVICES / DRIVERS =============== =============== Created Last 30 ================ 2009-09-17 18:24 38,224 a——- c:\windows\system32\drivers\mbamswissarmy.sys 2009-09-17 18:24 19,160 a——- c:\windows\system32\drivers\mbam.sys 2009-09-17 18:24 –d—– c:\program files\Malwarebytes' Anti-Malware_v2 2009-09-13 22:26 –d—– C:\fixer 2009-09-11 18:05 –d-h— c:\windows\system32\GroupPolicy 2009-09-11 17:02 50,968 a——- c:\windows\system32\avgfwdx.dll 2009-09-11 17:02 29,208 a——- c:\windows\system32\drivers\avgfwdx.sys 2009-09-11 17:02 –d—– c:\program files\AVG 2009-09-11 17:02 –d—– c:\docume~1\alluse~1.win\applic~1\avg8 2009-09-11 16:58 –d—– c:\docume~1\kevino~1.kev\applic~1\AVG8 2009-09-10 15:59 217 a——- c:\windows\system32\winset.ini 2009-09-10 15:58 –d—– c:\windows\tempie 2009-09-09 17:19 7,680 a–sh— c:\windows\Thumbs.db 2009-09-09 17:19 7,680 a–sh— C:\Thumbs.db ==================== Find3M ==================== 2009-09-14 02:12 229,888 a——- c:\windows\PEV.exe 2009-09-10 00:48 25,280 a——- c:\windows\system32\drivers\hamachi.sys 2009-08-16 16:09 7,680 a–sh— c:\program files\common files\Thumbs.db 2009-08-05 05:11 204,800 a——- c:\windows\system32\mswebdvd.dll 2009-07-25 05:23 411,368 a——- c:\windows\system32\deploytk.dll 2009-07-17 14:55 58,880 a——- c:\windows\system32\atl.dll 2009-07-13 02:18 233,472 a——- c:\windows\system32\wmpdxm.dll 2009-06-26 12:18 659,456 a——- c:\windows\system32\wininet.dll 2009-06-26 12:18 81,920 a——- c:\windows\system32\ieencode.dll 2009-06-24 17:02 1,890 a–sh— c:\docume~1\alluse~1.win\applic~1\KGyGaAvL.sys 2009-06-24 03:12 88 —shr– c:\docume~1\alluse~1.win\applic~1\CFB92F2D02.sys 2008-02-27 00:17 22,328 a——- c:\docume~1\kevino~1.kev\applic~1\PnkBstrK.sys ============= FINISH: 21:20:07.93 =============== —– Win32KDiag.txt —– Running from: C:\Documents and Settings\[removed]\Desktop\Win32kDiag.exe Log file at : C:\Documents and Settings\Kevin O'Connor.KEVINS-MINION\Desktop\Win32kDiag.txt WARNING: Could not get backup privileges! Searching 'C:\WINDOWS'… Finished!

Attachments:

Post #19

molydeus85,

I have a few questions:

Are you running these scans in Safe Mode?
Have you recently tried upgarding to SP3?
Have you regained Internet access?

If so please try the ESET scan.

Run the following scan: Eset Online Scanner
(you will need Internet Explorer to run this scan)

  • Place a check mark in the box YES, I accept the Terms Of Use
  • Click the Start button.
  • Now click the Install button.
  • Click Start. The scanner engine will initialize and update.
  • Do Not place a check mark in the box beside Remove found threats.
  • Click the Scan button. The scan will now run, please be patient.
  • When the scan finishes click the Details tab.
  • Copy and paste the contents of the C:\ProgramFiles\EsetOnlineScanner\log.txt into your next reply.
- - - - - Next - - - - -

If not please continue,

Open a blank Notepad document

Start > Run > in the run box type cmd, hit Enter
A window will open type ipconfig /all at the prompt. (notice the space between the g / this is needed) hit Enter
Right click in the window choose Select All, left click in the open Notepad windows and select Paste
Save the notepad document as ipconfig.txt

- - - - - Next - - - - -

Check the DHCP Client
Start > Run > in the run box type services.msc, hit Enter
Check the service named DHCP Client. It should be set to Automatic and should be running

- - - - - Next - - - - -

Please download SystemLook from one of the links below and save it to your Desktop.
Download Mirror #1
Download Mirror #2
  • Double-click SystemLook.exe to run it.
  • Copy the content of the following codebox into the main textfield:
    :dir
c:\windows\tempie /s
c:\windows\system32\GroupPolicy /s
  • Click the Look button to start the scan.
  • When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.
Note: The log can also be found on your Desktop entitled SystemLook.txt

- - - - - Next - - - - -

Try these to solve the Explorer and Start Menu issues.

In Task Manager > File> New Task (Run…) type: explorer > OK.

Press CTRL + ESC or your Windows key to make Start menu appear.

- - - - - Next - - - - -

I would also like for you to check your Device Manager for any issues.

Start > Run > type devmgmt.msc > OK
Your Device Manager will open, look for any of the following notations:
These are identified by a yellow exclamation mark, a blue "i", a red X, or an "Other" device.

- - - - - Next - - - - -

On your next post please provide the following:
  • Answer to the questions posted.
  • ESET log - if able to run
  • ipconfig.txt
  • DHCP Client status
  • SystemLook.txt log
  • Device Manager condition
  • Any visible progress is system performance/response?

Post #21
Hi OCD, sorry about the gap in responses again, there is actually a lot of progress. I restarted the computer after running the previous scans (just prior to running these most recent tasks) and the explorer is now functioning, as well as the internet connection. I didn't run any of the previous scans, or these current ones in Safe Mode, just let me know when/If I should. I was able to run the Eset scan: C:\Program Files\DAEMON Tools Lite\SRSAI.exe Win32/Adware.Toolbar.Shopper application C:\Qoobox\Quarantine\C\Program Files\AWS\WEATHE~1\MINIBU~1.DLL.vir Win32/Adware.WBug.A application C:\Qoobox\Quarantine\C\WINDOWS\SYSTEM32\ajusonub.ini.vir Win32/Adware.Virtumonde.NEO application C:\Qoobox\Quarantine\C\WINDOWS\SYSTEM32\dosoyahe.exe.vir a variant of Win32/Kryptik.OS trojan C:\Qoobox\Quarantine\C\WINDOWS\SYSTEM32\eventlog.dll.vir Win32/Agent.QBG trojan C:\Qoobox\Quarantine\C\WINDOWS\SYSTEM32\openebir.ini.vir Win32/Adware.Virtumonde.NEO application C:\Qoobox\Quarantine\C\WINDOWS\SYSTEM32\popatetu.dll.tmp.vir a variant of Win32/Kryptik.OH trojan C:\Qoobox\Quarantine\C\WINDOWS\SYSTEM32\rotscxeambujbo.dll.vir Win32/Olmarik.MF trojan C:\Qoobox\Quarantine\C\WINDOWS\SYSTEM32\rotscxeeudeens.dll.vir Win32/Olmarik.MF trojan C:\Qoobox\Quarantine\C\WINDOWS\SYSTEM32\utefines.ini.vir Win32/Adware.Virtumonde.NEO application C:\Qoobox\Quarantine\C\WINDOWS\SYSTEM32\yinirare.dll.tmp.vir a variant of Win32/Kryptik.OH trojan C:\Qoobox\Quarantine\D\AUTORUN.INF.vir INF/Autorun virus C:\System Volume Information\_restore{C4EB2478-360B-4CE9-ADA5-D24B62221B1A}\RP82\A0010942.sys:1 Win32/Agent.QBG trojan C:\System Volume Information\_restore{C4EB2478-360B-4CE9-ADA5-D24B62221B1A}\RP82\A0010949.sys:1 Win32/Agent.QBG trojan C:\System Volume Information\_restore{C4EB2478-360B-4CE9-ADA5-D24B62221B1A}\RP82\A0011276.sys:1 Win32/Agent.QBG trojan C:\System Volume Information\_restore{C4EB2478-360B-4CE9-ADA5-D24B62221B1A}\RP88\A0012276.sys:1 Win32/Agent.QBG trojan C:\System Volume Information\_restore{C4EB2478-360B-4CE9-ADA5-D24B62221B1A}\RP88\A0012281.sys:1 Win32/Agent.QBG trojan C:\System Volume Information\_restore{C4EB2478-360B-4CE9-ADA5-D24B62221B1A}\RP88\A0016828.sys:1 Win32/Agent.QBG trojan C:\System Volume Information\_restore{C4EB2478-360B-4CE9-ADA5-D24B62221B1A}\RP88\A0016896.sys:1 Win32/Agent.QBG trojan C:\WINDOWS\SYSTEM32\wgyr.exe probably a variant of Win32/Injector.ZT trojan C:\WINDOWS\tempie\svshost.exe probably unknown NewHeur_PE virus (I don't think any of that is good…. ;-P) Since the connection is now functioning, I am not going to post ipconfig info, and the DHCP Client status was Automatic and Started. Here is SystemLook.txt: SystemLook v1.0 by jpshortstuff (29.08.09) Log created at 23:28 on 29/09/2009 by Kevin O'Connor (Administrator - Elevation successful) ========== dir ========== c:\windows\tempie - Parameters: "/s" —Files— aim5.exe –a— 192512 bytes [10:00 11/09/2009] [10:00 11/09/2009] DartCertificate.dll –a— 139264 bytes [14:23 31/05/2001] [14:23 31/05/2001] DartSecure2.dll –a— 147456 bytes [14:25 31/05/2001] [14:25 31/05/2001] DartSock.dll –a— 212992 bytes [14:23 31/05/2001] [14:23 31/05/2001] decaptcher.dll –a— 73728 bytes [18:18 17/02/2009] [18:18 17/02/2009] iepv.exe –a— 42496 bytes [10:00 11/09/2009] [10:00 11/09/2009] iepw.txt –a— 0 bytes [10:00 11/09/2009] [10:00 11/09/2009] me.ini –a— 95 bytes [20:00 10/09/2009] [21:00 11/09/2009] msado25.tlb –a— 81920 bytes [05:00 10/08/2004] [05:00 10/08/2004] mspass2.exe –a— 64000 bytes [10:00 11/09/2009] [10:00 11/09/2009] MSVBVM60.DLL –a— 1386496 bytes [01:42 24/02/2004] [01:42 24/02/2004] MSWINSCK.OCX –a— 109248 bytes [01:14 17/04/2007] [01:14 17/04/2007] newpw.txt –a— 182 bytes [10:00 11/09/2009] [10:00 11/09/2009] RICHTX32.OCX –a— 212240 bytes [01:37 17/04/2007] [01:37 17/04/2007] scanner9.exe –a— 94208 bytes [21:00 11/09/2009] [21:00 11/09/2009] SubclassingSink.tlb –a— 10348 bytes [21:50 29/01/2003] [21:50 29/01/2003] svshost.exe –a— 69632 bytes [20:00 10/09/2009] [01:07 26/06/2009] urlmon.dll –a— 1152000 bytes [14:34 27/06/2007] [14:34 27/06/2007] wbemdisp.tlb –a— 59904 bytes [05:00 10/08/2004] [05:00 10/08/2004] winhttp.dll –a— 349696 bytes [09:43 06/03/2009] [09:43 06/03/2009] wininet.dll –a— 818688 bytes [02:03 08/11/2006] [02:03 08/11/2006] No folders found. c:\windows\system32\GroupPolicy - Parameters: "/s" —Files— gpt.ini –a— 154 bytes [22:05 11/09/2009] [19:57 13/09/2009] c:\windows\system32\GroupPolicy\Adm d—– [22:05 11/09/2009] admfiles.ini —h– 81 bytes [22:05 11/09/2009] [22:05 11/09/2009] conf.adm –a— 40282 bytes [22:05 11/09/2009] [12:00 04/08/2004] inetres.adm –a— 1431144 bytes [22:05 11/09/2009] [12:00 04/08/2004] system.adm –a— 1744202 bytes [22:05 11/09/2009] [12:00 04/08/2004] wmplayer.adm –a— 67374 bytes [22:05 11/09/2009] [12:00 04/08/2004] wuau.adm –a— 54440 bytes [22:05 11/09/2009] [19:04 16/10/2008] c:\windows\system32\GroupPolicy\Machine d—– [22:05 11/09/2009] Registry.pol –a— 158 bytes [22:06 11/09/2009] [22:06 11/09/2009] c:\windows\system32\GroupPolicy\User d—– [22:05 11/09/2009] -=End Of File=- Device Manager looks all clear, nothing out of the ordinary is marked, and I am able to interact with the Desktop normally, as well as explorer and the internet, which is muchly improved.
Post #22

molydeus85,

I'm glad your system is running better.

The majority of those items ESET found are in quarantine folders and will be removed during our clean up process, but there are a few we need some additional information on.

  • Make sure to use Internet Explorer for this
  • Please go to VirSCAN.org FREE on-line scan service
  • Copy and paste the following file path into the "Suspicious files to scan" box on the top of the page:

  • c:\windows\tempie\iepv.exe
  • c:\windows\tempie\mspass2.exe
  • c:\windows\tempie\MSVBVM60.DLL

  • Click on the Upload button
  • If a pop-up appears saying the file has been scanned already, please select the ReScan button.
  • Once the Scan is completed, click on the "Copy to Clipboard" button. This will copy the link of the report into the Clipboard.
  • Paste the contents of the Clipboard in your next reply.
- - - - - Next - - - - -

On your next post please provide the following:
  • VirScan results

Post #23
Here are the results from the VirScan site:
VirSCAN.org Scanned Report :
Scanned time : 2009/10/01 06:55:54 (CST)
Scanner results: 57% Scanner(21/37) found malware!
File Name : iepv.exe
File Size : 42496 byte
File Type : PE32 executable for MS Windows (GUI) Intel 80386 32-bit
MD5 : 49333f7d3b73e3a1da1d78705cdcabaf
SHA1 : 0732866cfc27067d6b9cb396d56ee45f2415c5b6
Online report : http://virscan.org/report/4609ed804129a7a5…8c71392a12.html

Scanner Engine Ver Sig Ver Sig Date Time Scan result
a-squared 4.5.0.8 20090930233123 2009-09-30 4.06 Riskware.PSWTool.Win32.NetPass!IK
AhnLab V3 2009.10.01.00 2009.10.01 2009-10-01 0.79 Win-Trojan/Xema.variant
AntiVir 8.2.1.27 7.1.6.59 2009-09-30 0.28 SPR/PSW.NetPass.ET
Antiy 2.0.18 20090930.2943538 2009-09-30 0.12 PSWTool/Win32.NetPass.et[:not_virus]
Arcavir 2009 200909301639 2009-09-30 0.12 Riskware.Pswtool.Netpass.Et
Authentium 5.1.1 200909301926 2009-09-30 1.18 W32/PassView.A.gen!Eldorado (Possible)
AVAST! 4.7.4 090929-0 2009-09-29 0.01 -
AVG 8.5.288 270.14.0/2406 2009-10-01 0.55 HackTool.GFQ
BitDefender 7.81008.4297154 7.27992 2009-10-01 3.67 Gen:Application.Heur.cmKfba33n@c
CA (VET) 9.0.0.143 31.6.6769 2009-10-01 8.60 -
ClamAV 0.95.2 9855 2009-09-30 0.04 -
Comodo 3.11 2476 2009-09-30 0.71 Win32.PSWTool.NetPass.~BAAD
CP Secure 1.3.0.5 2009.09.30 2009-09-30 0.12 PSWTool.W32.NetPass.et
Dr.Web 4.44.0.9170 2009.09.30 2009-09-30 5.47 Program.PwdFind.5
F-Prot 4.4.4.56 20090930 2009-09-30 1.17 W32/PassView.A.gen!Eldorado (generic, not disinfectable)
F-Secure 7.02.73807 2009.09.30.11 2009-09-30 0.12 -
Fortinet 2.81-3.120 10.893 2009-09-30 0.21 -
GData 19.8151/19.495 20090930 2009-09-30 5.47 -
ViRobot 20090930 2009.09.30 2009-09-30 0.41 -
Ikarus T3.1.01.72 2009.09.30.73842 2009-09-30 4.07 not-a-virus:PSWTool.Win32.NetPass
JiangMin 11.0.800 2009.09.26 2009-09-26 3.69 Packed.PePatch.ahc
Kaspersky 5.5.10 2009.09.30 2009-09-30 0.06 not-a-virus:PSWTool.Win32.NetPass.et
KingSoft 2009.2.5.15 2009.9.30.21 2009-09-30 0.51 -
McAfee 5.3.00 5757 2009-09-30 3.40 -
Microsoft 1.5101 2009.09.30 2009-09-30 5.48 Tool:Win32/IEPassRecover.A
Norman 6.01.09 6.01.00 2009-09-16 1.82 -
Panda 9.05.01 2009.09.30 2009-09-30 1.77 Hacktool/NetPass.D
Trend Micro 8.700-1004 6.492.02 2009-09-30 0.10 -
Quick Heal 10.00 2009.09.30 2009-09-30 1.16 -
Rising 20.0 21.49.22.00 2009-09-30 1.18 -
Sophos 2.90.1 4.45 2009-10-01 3.52 -
Sunbelt 5424 5424 2009-09-30 1.47 Trojan.Malware
Symantec 1.3.0.24 20090930.002 2009-09-30 0.07 Hacktool
nProtect 20090930.01 5690625 2009-09-30 6.81 Trojan/W32.HackTool.42496.E
The Hacker 6.5.0.2 v00023 2009-09-30 0.67 Trojan/NetPass.et
VBA32 3.12.10.11 20090930.1230 2009-09-30 1.94 -
VirusBuster 4.5.11.10 10.112.54/1925539 2009-09-30 2.60 -


VirSCAN.org Scanned Report :
Scanned time : 2009/10/01 12:08:07 (CST)
Scanner results: 54% Scanner(20/37) found malware!
File Name : mspass2.exe
File Size : 64000 byte
File Type : PE32 executable for MS Windows (GUI) Intel 80386 32-bit
MD5 : cd5a98ad3d2890a9fc45c15b4f2cec01
SHA1 : bc384b29bc644e6b1a63bb0c98b9920275143b09
Online report : http://virscan.org/report/f8aa7c5d7a0093db…e62015cf93.html

Scanner Engine Ver Sig Ver Sig Date Time Scan result
a-squared 4.5.0.8 20090930233123 2009-09-30 4.54 Riskware.PSWTool.Win32.Messen.bh!IK
AhnLab V3 2009.10.01.00 2009.10.01 2009-10-01 1.03 Win-AppCare/Messenpass.64000
AntiVir 8.2.1.27 7.1.6.59 2009-09-30 0.29 SPR/PSW.Messen.BG
Antiy 2.0.18 20090930.2943538 2009-09-30 0.12 PSWTool/Win32.Messen.bh[:not_virus]
Arcavir 2009 200909301639 2009-09-30 0.20 -
Authentium 5.1.1 200909301926 2009-09-30 1.16 W32/Trojan2.GXAC (Exact)
AVAST! 4.7.4 090930-0 2009-09-30 0.02 -
AVG 8.5.288 270.14.0/2406 2009-10-01 0.62 HackTool.GUO
BitDefender 7.81008.4297154 7.27994 2009-10-01 3.72 Gen:Application.Heur.dmKfbeeDYKb
CA (VET) 9.0.0.143 31.6.6769 2009-10-01 5.26 may be infected with Win32/ASuspect.GJFIN unknown type.
ClamAV 0.95.2 9856 2009-09-30 0.05 Trojan.Agent-121207
Comodo 3.11 2478 2009-10-01 0.80 Win32.PSWTool.Messen.~BAAC
CP Secure 1.3.0.5 2009.09.30 2009-09-30 0.13 PSWTool.W32.Messen.bg
Dr.Web 4.44.0.9170 2009.10.01 2009-10-01 5.45 Tool.PassView.117
F-Prot 4.4.4.56 20090930 2009-09-30 1.22 W32/Trojan2.GXAC (exact)
F-Secure 7.02.73807 2009.10.01.03 2009-10-01 8.51 -
Fortinet 2.81-3.120 10.893 2009-09-30 0.35 -
GData 19.8155/19.495 20091001 2009-10-01 5.05 -
ViRobot 20090930 2009.09.30 2009-09-30 0.42 -
Ikarus T3.1.01.72 2009.10.01.73843 2009-10-01 4.14 not-a-virus:PSWTool.Win32.Messen.bh
JiangMin 11.0.800 2009.09.26 2009-09-26 4.03 -
Kaspersky 5.5.10 2009.10.01 2009-10-01 0.17 not-a-virus:PSWTool.Win32.Messen.bh
KingSoft 2009.2.5.15 2009.10.1.7 2009-10-01 0.56 -
McAfee 5.3.00 5757 2009-09-30 3.47 -
Microsoft 1.5101 2009.09.30 2009-09-30 5.55 Tool:Win32/MessenPass.A
Norman 6.01.09 6.01.00 2009-09-16 1.82 -
Panda 9.05.01 2009.09.30 2009-09-30 2.97 HackTool/MSNpass.G
Trend Micro 8.700-1004 6.492.04 2009-09-30 0.07 -
Quick Heal 10.00 2009.09.30 2009-09-30 1.39 -
Rising 20.0 21.49.22.00 2009-09-30 1.21 -
Sophos 2.90.1 4.45 2009-10-01 3.53 -
Sunbelt 5424 5424 2009-09-30 1.86 Trojan.Win32.Generic!BT
Symantec 1.3.0.24 20090930.002 2009-09-30 0.13 -
nProtect 20090930.01 5696930 2009-09-30 8.90 Gen:Application.Heur.dmKfbeeDYKb
The Hacker 6.5.0.2 v00024 2009-09-30 0.85 Trojan/Messen.bh
VBA32 3.12.10.11 20090930.1230 2009-09-30 1.94 -
VirusBuster 4.5.11.10 10.112.54/1925539 2009-09-30 2.59 -


VirSCAN.org Scanned Report :
Scanned time : 2009/10/01 12:13:09 (CST)
Scanner results: All Scanners reported not find malware!
File Name : MSVBVM60.DLL
File Size : 1386496 byte
File Type : PE32 executable for MS Windows (DLL) (GUI) Intel 80386 32-bi
MD5 : f28eb5cbc3ca6d8c787f09f047d1f9c8
SHA1 : 70db1fac822974bc9b636a984bcc1da2e67f8de5
Online report : http://virscan.org/report/95a7cd9bce341555…9846a31735.html

Scanner Engine Ver Sig Ver Sig Date Time Scan result
a-squared 4.5.0.8 20090930233123 2009-09-30 4.11 -
AhnLab V3 2009.10.01.00 2009.10.01 2009-10-01 0.94 -
AntiVir 8.2.1.27 7.1.6.59 2009-09-30 0.46 -
Antiy 2.0.18 20090930.2943538 2009-09-30 0.12 -
Arcavir 2009 200909301639 2009-09-30 0.10 -
Authentium 5.1.1 200909301926 2009-09-30 2.80 -
AVAST! 4.7.4 090930-0 2009-09-30 0.08 -
AVG 8.5.288 270.14.0/2406 2009-10-01 0.35 -
BitDefender 7.81008.4297154 7.27994 2009-10-01 3.68 -
CA (VET) 9.0.0.143 31.6.6769 2009-10-01 9.37 -
ClamAV 0.95.2 9856 2009-09-30 0.24 -
Comodo 3.11 2478 2009-10-01 0.98 -
CP Secure 1.3.0.5 2009.09.30 2009-09-30 0.42 -
Dr.Web 4.44.0.9170 2009.10.01 2009-10-01 5.48 -
F-Prot 4.4.4.56 20090930 2009-09-30 2.64 -
F-Secure 7.02.73807 2009.10.01.03 2009-10-01 0.12 -
Fortinet 2.81-3.120 10.893 2009-09-30 0.28 -
GData 19.8155/19.495 20091001 2009-10-01 5.10 -
ViRobot 20090930 2009.09.30 2009-09-30 0.41 -
Ikarus T3.1.01.72 2009.10.01.73843 2009-10-01 4.09 -
JiangMin 11.0.800 2009.09.26 2009-09-26 6.41 -
Kaspersky 5.5.10 2009.10.01 2009-10-01 0.06 -
KingSoft 2009.2.5.15 2009.10.1.7 2009-10-01 0.51 -
McAfee 5.3.00 5757 2009-09-30 3.38 -
Microsoft 1.5101 2009.09.30 2009-09-30 6.15 -
Norman 6.01.09 6.01.00 2009-09-16 1.89 -
Panda 9.05.01 2009.09.30 2009-09-30 2.06 -
Trend Micro 8.700-1004 6.492.04 2009-09-30 0.04 -
Quick Heal 10.00 2009.09.30 2009-09-30 1.60 -
Rising 20.0 21.49.22.00 2009-09-30 0.88 -
Sophos 2.90.1 4.45 2009-10-01 3.56 -
Sunbelt 5424 5424 2009-09-30 4.88 -
Symantec 1.3.0.24 20090930.002 2009-09-30 0.36 -
nProtect 20090930.01 5696930 2009-09-30 10.14 -
The Hacker 6.5.0.2 v00024 2009-09-30 0.77 -
VBA32 3.12.10.11 20090930.1230 2009-09-30 2.33 -
VirusBuster 4.5.11.10 10.112.54/1925539 2009-09-30 2.79 -
Post #24
molydeus85,

I'm glad your system is running better.

The majority of those items ESET found are in quarantine folders and will be removed during our clean up process, but there are a few we need to address.

Please download OTM by OldTimer.
  • Save it to your desktop.
  • Please click OTM and then click >> run.
  • Copy the lines inside the codebox below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):

:Processes
explorer.exe

:Files
C:\Program Files\DAEMON Tools Lite\SRSAI.exe
C:\WINDOWS\SYSTEM32\wgyr.exe 
C:\WINDOWS\tempie\svshost.exe

:Commands
[purity]
[emptytemp]
[start explorer]
[Reboot]
  • Return to OTM, right click in the "Paste Instructions for items to be Moved" window (under the yellow bar) and choose Paste.
  • Click the red Moveit! button.
  • Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
  • Close OTM
Note: If an item cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes. In this case, after the reboot, open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTM\MovedFiles folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post.


- - - - - Next - - - - -

You should still have Malwarebytes' installed on your computer, if not re-download it from Malwarebytes' Anti-Malware from here or here
  • Make sure a get the latest Updates before beginning the scan.
  • After the updates have been installed and once the program has loaded, select "Perform Quick Scan", then click Scan.
  • The scan may take some time to finish,so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected.< < Don't forget this!
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.
    (The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.)
  • Copy and Paste the entire report in your next reply.
- - - - - Next - - - - -

Please re-run DDS and post the new logs generated.

Be sure to disable your script blocking software BEFORE running the DDS scan. Use the link below if you need assistance.
  • Disable any script blocking protection (How to Disable your Security Programs) < - - Important
  • Double click DDS icon to run the tool (may take up to 3 minutes to run)
  • When done, DDS.txt will open.
  • After a few moments, attach.txt will open in a second window.
  • Save both reports to your desktop.
- - - - - Next - - - - -

On your next post please provide the following:
  • OTM log
  • MBAM log
  • Post the contents of the DDS.txt report in your next reply
  • Attach the Attach.txt report to your post by scrolling down to the Attachments area and then clicking Browse. Browse to where you saved the file, and click Open and the click UPLOAD.
  • Tell me how your computer is running at the moment.
Post #26 last edited
Due to inactivity this topic will be closed. If you need help please start a new thread. EDIT: Topic reopened at users request - topics merged
Post #27
Hello, sorry about inactivity, the thread I was posting in was closed, but I would like to follow up continuing the most recently recommended scans, the last post from OCD was asking for: " - - - - - Next - - - - - On your next post please provide the following: * OTM log * MBAM log * Post the contents of the DDS.txt report in your next reply * Attach the Attach.txt report to your post by scrolling down to the Attachments area and then clicking Browse. Browse to where you saved the file, and click Open and the click UPLOAD. * Tell me how your computer is running at the moment. ——————– OCD" My OTM log: All processes killed ========== PROCESSES ========== No active process named explorer.exe was found! ========== FILES ========== File/Folder C:\Program Files\DAEMON Tools Lite\SRSAI.exe not found. File/Folder C:\WINDOWS\SYSTEM32\wgyr.exe not found. File/Folder C:\WINDOWS\tempie\svshost.exe not found. ========== COMMANDS ========== [EMPTYTEMP] User: Administrator ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: Administrator.KEVINS-MINION ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes ->FireFox cache emptied: 0 bytes User: All Users User: All Users.WINDOWS User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: Default User.WINDOWS ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: Guest ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: Kevin O'Connor User: Kevin O'Connor.KEVINS-MINION File delete failed. C:\Documents and Settings\Kevin O'Connor.KEVINS-MINION\Local Settings\Temp\~DFA8B.tmp scheduled to be deleted on reboot. File delete failed. C:\Documents and Settings\Kevin O'Connor.KEVINS-MINION\Local Settings\Temp\~DFA97.tmp scheduled to be deleted on reboot. ->Temp folder emptied: 331922 bytes File delete failed. C:\Documents and Settings\Kevin O'Connor.KEVINS-MINION\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot. ->Temporary Internet Files folder emptied: 91089 bytes ->Java cache emptied: 25493442 bytes ->FireFox cache emptied: 44787964 bytes User: KEVINO~1~KEV User: LocalService ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: LocalService.NT AUTHORITY ->Temp folder emptied: 0 bytes File delete failed. C:\Documents and Settings\LocalService.NT AUTHORITY\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot. ->Temporary Internet Files folder emptied: 33170 bytes User: NetworkService ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: NetworkService.NT AUTHORITY ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 0 bytes %systemroot%\System32 .tmp files removed: 0 bytes Windows Temp folder emptied: 0 bytes RecycleBin emptied: 0 bytes Total Files Cleaned = 67.46 mb OTM by OldTimer - Version 3.0.0.6 log created on 10082009_220928 Files moved on Reboot… C:\Documents and Settings\Kevin O'Connor.KEVINS-MINION\Local Settings\Temp\~DFA8B.tmp moved successfully. File C:\Documents and Settings\Kevin O'Connor.KEVINS-MINION\Local Settings\Temp\~DFA97.tmp not found! Registry entries deleted on Reboot… MBAM log: Malwarebytes' Anti-Malware 1.41 Database version: 2775 Windows 5.1.2600 Service Pack 2 10/5/2009 8:12:47 PM mbam-log-2009-10-05 (20-12-47).txt Scan type: Full Scan (C:\|) Objects scanned: 293940 Time elapsed: 1 hour(s), 16 minute(s), 7 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 1 Files Infected: 21 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: C:\WINDOWS\tempie (Spyware.Passwords) -> Quarantined and deleted successfully. Files Infected: C:\Qoobox\Quarantine\C\WINDOWS\SYSTEM32\eventlog.dll.vir (Trojan.Sirefef) -> Quarantined and deleted successfully. C:\WINDOWS\tempie\iepv.exe (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\tempie\mspass2.exe (Password.Stealer) -> Quarantined and deleted successfully. C:\WINDOWS\tempie\aim5.exe (Spyware.Passwords) -> Quarantined and deleted successfully. C:\WINDOWS\tempie\DartCertificate.dll (Spyware.Passwords) -> Quarantined and deleted successfully. C:\WINDOWS\tempie\DartSecure2.dll (Spyware.Passwords) -> Quarantined and deleted successfully. C:\WINDOWS\tempie\DartSock.dll (Spyware.Passwords) -> Quarantined and deleted successfully. C:\WINDOWS\tempie\decaptcher.dll (Spyware.Passwords) -> Quarantined and deleted successfully. C:\WINDOWS\tempie\iepw.txt (Spyware.Passwords) -> Quarantined and deleted successfully. C:\WINDOWS\tempie\me.ini (Spyware.Passwords) -> Quarantined and deleted successfully. C:\WINDOWS\tempie\msado25.tlb (Spyware.Passwords) -> Quarantined and deleted successfully. C:\WINDOWS\tempie\MSVBVM60.DLL (Spyware.Passwords) -> Quarantined and deleted successfully. C:\WINDOWS\tempie\MSWINSCK.OCX (Spyware.Passwords) -> Quarantined and deleted successfully. C:\WINDOWS\tempie\newpw.txt (Spyware.Passwords) -> Quarantined and deleted successfully. C:\WINDOWS\tempie\RICHTX32.OCX (Spyware.Passwords) -> Quarantined and deleted successfully. C:\WINDOWS\tempie\scanner9.exe (Spyware.Passwords) -> Quarantined and deleted successfully. C:\WINDOWS\tempie\SubclassingSink.tlb (Spyware.Passwords) -> Quarantined and deleted successfully. C:\WINDOWS\tempie\urlmon.dll (Spyware.Passwords) -> Quarantined and deleted successfully. C:\WINDOWS\tempie\wbemdisp.tlb (Spyware.Passwords) -> Quarantined and deleted successfully. C:\WINDOWS\tempie\winhttp.dll (Spyware.Passwords) -> Quarantined and deleted successfully. C:\WINDOWS\tempie\wininet.dll (Spyware.Passwords) -> Quarantined and deleted successfully. DDS.txt: DDS (Ver_09-07-30.01) - NTFSx86 Run by [removed] at 22:17:21.84 on Thu 10/08/2009 Internet Explorer: 6.0.2900.2180 BrowserJavaVersion: 1.6.0_15 Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.2047.1372 [GMT -4:00] ============== Running Processes =============== C:\WINDOWS\system32\svchost -k DcomLaunch svchost.exe C:\WINDOWS\System32\svchost.exe -k netsvcs svchost.exe svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE svchost.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\PnkBstrA.exe C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\notepad.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\Java\jre6\bin\jusched.exe C:\Program Files\Steam\Steam.exe C:\Program Files\DAEMON Tools Lite\daemon.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\AIM6\aim6.exe C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe C:\Program Files\OpenOffice.org 2.3\program\soffice.exe C:\Program Files\OpenOffice.org 2.3\program\soffice.BIN C:\WINDOWS\system32\wuauclt.exe C:\Program Files\AIM6\aolsoftware.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\WINDOWS\system32\NOTEPAD.EXE C:\Documents and Settings\Kevin O'Connor.KEVINS-MINION\Desktop\dds.pif ============== Pseudo HJT Report =============== uStart Page = hxxp://www.yahoo.com/ mStart Page = hxxp://www.yahoo.com/ uURLSearchHooks: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn\yt.dll BHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\program files\yahoo!\companion\installs\cpn\yt.dll BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll BHO: SingleInstance Class: {fdad4da1-61a2-4fd8-9c17-86f7ac245081} - c:\program files\yahoo!\companion\installs\cpn\YTSingleInstance.dll TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn\yt.dll uRun: [ABIT uGuruIII] c:\program files\abit\uguru\uGuru.exe uRun: [Steam] "c:\program files\steam\Steam.exe" -silent uRun: [DAEMON Tools Lite] "c:\program files\daemon tools lite\daemon.exe" -autorun uRun: [MSMSGS] "c:\program files\messenger\msmsgs.exe" /background uRun: [Aim6] "c:\program files\aim6\aim6.exe" /d locale=en-US ee://aol/imApp uRun: [SUPERAntiSpyware] c:\program files\superantispyware\SUPERAntiSpyware.exe uRun: [SpybotSD TeaTimer] c:\program files\spybot - search & destroy\TeaTimer.exe mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup mRun: [nwiz] nwiz.exe /install mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 8.0\reader\Reader_sl.exe" mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe" mRun: [Malwarebytes Anti-Malware (reboot)] "c:\program files\malwarebytes' anti-malware_v2\mbam.exe" /runcleanupscript StartupFolder: c:\docume~1\kevino~1.kev\startm~1\programs\startup\openof~1.lnk - c:\program files\openoffice.org 2.3\program\quickstart.exe IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe LSP: %SYSTEMROOT%\system32\nvappfilter.dll DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} - hxxp://www.apple.com/qtactivex/qtplugin.cab DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1137041060718 DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} - hxxp://www.nvidia.com/content/DriverDownload/srl/2.0.0.1/sysreqlab2.cab DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos/OnlineScanner.cab DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab Notify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.dll SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLL ================= FIREFOX =================== FF - ProfilePath - c:\docume~1\kevino~1.kev\applic~1\mozilla\firefox\profiles\keo34oll.default\ FF - prefs.js: browser.search.defaulturl - hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2706&invocationType=&query= FF - prefs.js: browser.search.selectedEngine - AIM Search FF - prefs.js: keyword.URL - hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2706&invocationType=&query= FF - component: c:\program files\avg\avg8\firefox\components\avgssff.dll FF - plugin: c:\documents and settings\kevin o'connor.kevins-minion\application data\mozilla\firefox\profiles\keo34oll.default\extensions\[removed]\plugins\npiaplayer.dll FF - plugin: c:\documents and settings\kevin o'connor.kevins-minion\application data\mozilla\firefox\profiles\keo34oll.default\extensions\[removed]\platform\winnt_x86-msvc\plugins\npmnqmp071101000055.dll FF - plugin: c:\program files\mozilla firefox\plugins\npdnu.dll FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\ FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} ============= SERVICES / DRIVERS =============== R0 UGURU;UGURU;c:\windows\system32\drivers\uGuru.sys [2006-1-12 14592] R1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\sasdifsv.sys [2009-9-4 9968] R1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2009-9-4 74480] R3 SASENUM;SASENUM;c:\program files\superantispyware\SASENUM.SYS [2009-9-4 7408] S2 spupdsvc;Windows Service Pack Installer update service;c:\windows\system32\spupdsvc.exe [2006-1-12 26488] S3 Avgfwdx;Avgfwdx;c:\windows\system32\drivers\avgfwdx.sys [2009-9-11 29208] S3 Avgfwfd;AVG network filter service;c:\windows\system32\drivers\avgfwdx.sys [2009-9-11 29208] S3 SysProtDrv.sys;SysProtDrv.sys;c:\documents and settings\kevin o'connor.kevins-minion\desktop\sysprot\SysProtDrv.sys [2009-9-23 44288] =============== Created Last 30 ================ 2009-10-04 20:49 –d—– C:\_OTM 2009-09-29 18:54 –d—– c:\program files\ESET 2009-09-17 18:24 38,224 a——- c:\windows\system32\drivers\mbamswissarmy.sys 2009-09-17 18:24 19,160 a——- c:\windows\system32\drivers\mbam.sys 2009-09-17 18:24 –d—– c:\program files\Malwarebytes' Anti-Malware_v2 2009-09-13 22:26 –d—– C:\fixer 2009-09-11 18:05 –d-h— c:\windows\system32\GroupPolicy 2009-09-11 17:02 50,968 a——- c:\windows\system32\avgfwdx.dll 2009-09-11 17:02 29,208 a——- c:\windows\system32\drivers\avgfwdx.sys 2009-09-11 17:02 –d—– c:\program files\AVG 2009-09-11 17:02 –d—– c:\docume~1\alluse~1.win\applic~1\avg8 2009-09-11 16:58 –d—– c:\docume~1\kevino~1.kev\applic~1\AVG8 2009-09-10 15:59 217 a——- c:\windows\system32\winset.ini 2009-09-09 17:19 7,680 a–sh— c:\windows\Thumbs.db 2009-09-09 17:19 7,680 a–sh— C:\Thumbs.db ==================== Find3M ==================== 2009-09-14 02:12 229,888 a——- c:\windows\PEV.exe 2009-09-10 00:48 25,280 a——- c:\windows\system32\drivers\hamachi.sys 2009-08-16 16:09 7,680 a–sh— c:\program files\common files\Thumbs.db 2009-08-06 19:23 274,288 a——- c:\windows\system32\mucltui.dll 2009-08-06 19:23 215,920 a——- c:\windows\system32\muweb.dll 2009-08-05 05:11 204,800 a——- c:\windows\system32\mswebdvd.dll 2009-07-25 05:23 411,368 a——- c:\windows\system32\deploytk.dll 2009-07-17 14:55 58,880 a——- c:\windows\system32\atl.dll 2009-07-13 02:18 233,472 a——- c:\windows\system32\wmpdxm.dll 2009-06-24 17:02 1,890 a–sh— c:\docume~1\alluse~1.win\applic~1\KGyGaAvL.sys 2009-06-24 03:12 88 —shr– c:\docume~1\alluse~1.win\applic~1\CFB92F2D02.sys 2008-02-27 00:17 22,328 a——- c:\docume~1\kevino~1.kev\applic~1\PnkBstrK.sys ============= FINISH: 22:18:28.15 =============== And the computer is running relatively fine at the moment, though we aren't using it extensively, since we don't know what's still on it.
Post #28
Hello molydeus85,

Congratulations, you computer appears clean. We have a little housekeeping to do before we can wrap this up.

  • Click START then RUN
  • Now type Combofix /u in the runbox and click OK
  • Note the space between the X and the U, it needs to be there.

[external image: Posted Image]

The above procedure will:
  • Implement some cleanup procedures.
  • Reset System Restore.
- - - - - Next - - - - -

Clean up with OTM
  • Double Click OTM.exe … to run it.
  • Click the CleanUp! button.
  • Select Yes when the "Begin cleanup Process?" prompt appears.
  • If you are prompted to Reboot during the cleanup, select Yes.
  • The tool will delete itself once it finishes, if not delete it by yourself.
- - - - - Next - - - - -

You can now delete any other tools I had you download and use, unless you wish to keep them.

- - - - - Next - - - - -

Your Adobe Reader is out of date.
Please go to http://get.adobe.com/reader/ and download Adobe Reader 9
follow the instructions to install Adobe Reader.

- - - - - Next - - - - -

Please remove this older version of:Java™ 6 Update 3

Please go to Start Menu > Control Panel > Add/ Remove Programs
Scroll Down and locate the following programs:
  • Java™ 6 Update 3
Select each one of the programs, then select remove.
(if the program is not listed don't be alarmed, just continue with the list)

Exit the Control Panel when finished.

- - - - - Next - - - - -

Here comes the "All Clean Speech":

Here are some tips to reduce the potential for spyware infection in the future:

Automatic Updates:

The easiest way to ensure you don't miss any of the critical Windows Updates is to set your computer up to receive Automatic Updates.
To set your computer up for Automatic Updates please do the following:
  • Click Start, and then click Control Panel.
  • Depending on which Control Panel view you use, Classic or Category, do one of the following:
  • Click System, and then click the Automatic Updates tab.
  • Click Performance and Maintenance, click System, and then click the Automatic Updates tab.
  • Select Automatic and choose a frequency and time that's convenient for you to get the updates.
  • Click Apply, then OK
  • Close the Control Panel.
- - - - - Next - - - - -

Make your Internet Explorer more secure - This can be done by following these simple instructions:

  • From within Internet Explorer click on the Tools menu and then click on Options.
  • Click once on the Security tab.
  • Click once on the Internet icon so it becomes highlighted.
  • Click once on the Custom Level button.
  • Change the Download signed ActiveX controls to Prompt
  • Change the Download unsigned ActiveX controls to Disable
  • Change the Initialize and script ActiveX controls not marked as safe to Disable
  • Change the Installation of desktop items to Prompt
  • Change the Launching programs and files in an IFRAME to Prompt
  • Change the Navigate sub-frames across different domains to Prompt
  • When all these settings have been made, click on the OK button.
  • If it prompts you as to whether or not you want to save the settings, press the Yes button.
Next press the Apply button and then the OK to exit the Internet Properties page.

Anti-Virus - It is imperative that you update your Antivirus software at least once a week (Even more if you wish). If you do not update your antivirus software then it will not be able to catch any of the new variants that may come out.

Firewall - I cannot stress how important it is that you keep the Firewall on your computer active at all times. Without a firewall your computer is susceptible to being hacked and taken over. I am very serious about this and see it happen almost every day with my clients. Simply using a Firewall in its default configuration can lower your risk greatly. For a tutorial on Firewalls and a listing of some available ones see the link below:
Understanding and Using Firewalls

Install SpywareBlaster - SpywareBlaster will add a large list of programs and sites into your Internet Explorer
settings that will protect you from running and downloading known malicious programs. A tutorial on installing & using this product can be found here:
Using SpywareBlaster to protect your computer from Spyware and Malware

MVPS Hosts file replaces your current HOSTS file with one containing well known ad sites and other bad sites. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer, meaning it will be difficult to infect yourself in the future.

Keep a backup of your important files - Now, more than ever, it's especially important to protect your digital files and memories. This article is full of good information on alternatives for home backup solutions.

ERUNT (Emergency Recovery Utility NT) allows you to keep a complete backup of your registry and restore it when needed. The standard registry backup options that come with Windows back up most of the registry but not all of it. ERUNT however creates a complete backup set, including the Security hive and user related sections. ERUNT is easy to use and since it creates a full backup, there are no options or choices other than to select the location of the backup files. The backup set includes a small executable that will launch the registry restore if needed.

Update all security programs regularly - Make sure you update all the programs regularly.
Without regular updates you WILL NOT be protected when new malicious programs are released.

Remember to have only one (1) Firewall and one (1) Anti-Virus program running at any one time.

I would also suggest you read "So how did I get infected in the first place"?: by Tony Klein

Please reply to this thread once more if you are satisfied so that we can mark the problem as resolved.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI