What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Got Me Good

18 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #16
It looks like we are taking 2 steps forward and one step back :rant2:


Open HJT > Misc Tools> Open Process Manager. Look for both these processes and click on Kill Process.

C:\WINNT\elRecvr.exe
C:\WINNT\system32\msasvc.exe



Rerun Combofix as some of the bad files returned, I need to see the log.

Rerun Vundoibegone, I need to see this log also.


Make sure you have AVG setup the way I posted it, check for updates, and close out the program.

Open HJT and remove these entries.

O2 - BHO: (no name) - {2856021F-4568-454E-8F4D-501BA83D80AA} - C:\WINNT\system32\nnnligd.dll
O2 - BHO: (no name) - {B56BDA75-300B-4DBA-99EE-7CB3A96A9C2D} - C:\WINNT\system32\awvvu.dll
O2 - BHO: (no name) - {F18F04B0-9CF1-4b93-B004-77A288BEE28B} - C:\WINNT\system32\hdfdhxle.dll

O4 - HKLM\..\Run: [keyboard] C:\\kybrdff_e49.exe
O4 - HKLM\..\Run: [_mzu_stonedrv8] C:\WINNT\system32\_mzu_stonedrv8.exe
O4 - HKLM\..\Run: [newname] C:\\nwnmff_e49.exe
O4 - HKLM\..\RunServices: [_mzu_stonedrv8] C:\WINNT\system32\_mzu_stonedrv8.exe

O20 - Winlogon Notify: awvvu - C:\WINNT\system32\awvvu.dll
O20 - Winlogon Notify: nnnligd - C:\WINNT\SYSTEM32\nnnligd.dll

O23 - Service: Extended Windows Security (Microsoft Extended Windows Security) - Unknown owner - C:\WINNT\elRecvr.exe
O23 - Service: Microsoft authenticate service (MsaSvc) - Unknown owner - C:\WINNT\system32\msasvc.exe



Boot to safemode and run AVG.


Still in Safemode, look for these files and delete them. Make sure you still have windows enabled to show all flles and folders

C:\WINNT\elRecvr.exe
C:\WINNT\TEMP\eraseme_1065.exe
C:\WINNT\TEMP\eraseme_7526.exe
C:\WINNT\TEMP\JTB089.EXE
C:\WINNT\system32\awvvu.dll
C:\WINNT\system32\msasvc.exe
C:\WINNT\system32\_mzu_stonedrv8.exe
C:\WINNT\SYSTEM32\nnnligd.dll


Still in Safemode , do this

* Go to My Computer/ C: Drive/ Documents and Settings/ Every User on this Computer Local Settings and delete all the contents of the Temp Folder and the Temporary Internet Files Folder <–Just the contents, not the folder itself.

* Go to My Computer/ C:/ Windows/ Temp and delete all the contents of the Temp Folder <– But not the temp folder itself.

* Go to My Computer/ C:/ Windows/ Prefetch and remove all the contents of the Prefetch Folder. <–But not the Prefetch folder itself.



Reboot your system normally


Close any instance of Internet Explorer and Windows Explorer.
  • Go to Start> Control Panel> Internet Options . You shoud be on the General Tab
  • Delete Cookies
  • Delete Files > and offline content as well

Now Empty your Recycle Bin

Post the New Combofix, AVG and Vundobegone log along with a new HJT log.
Post #18
THINGS ARE COMING TOGETHER…..

I ran AVG Spyware in safe mode before you asked me to. Here is the report.

Then I followed all your instructions and attached the reports.

Okay - going to run NEW VUNDO as per your instructions.


C:\!KillBox\VSAdd-in\VSAdd-in.dll -> Adware.Agent : No action taken.
C:\WINNT\system32\xqbhxsrg.exe -> Adware.Searchcolor : No action taken.
C:\bctpra.exe -> Backdoor.Pakes : No action taken.
C:\fkhxd.exe -> Backdoor.Pakes : No action taken.
C:\ogrm.exe -> Backdoor.Pakes : No action taken.
C:\mc44a47.exe -> Downloader.Adload.fu : No action taken.
C:\mc44a48.exe -> Downloader.Adload.fu : No action taken.
C:\mc44a49.exe -> Downloader.Adload.fu : No action taken.
C:\kybrdff_e48.exe -> Downloader.Adload.hw : No action taken.
C:\hlmdg.exe -> Downloader.Small.ctf : No action taken.
C:\qyrih.exe -> Downloader.Small.ctf : No action taken.
C:\rrtejlig.exe -> Downloader.Small.ctf : No action taken.
C:\!KillBox\ldcore.dll -> Downloader.Small.dxm : No action taken.
C:\dollarrev.exe -> Downloader.Small.dxm : No action taken.
C:\!KillBox\wacky32.exe( 1)/rmsyrup.exe -> Dropper.Agent.ayl : No action taken.
C:\!KillBox\wacky32.exe/rmsyrup.exe -> Dropper.Agent.ayl : No action taken.
C:\WINNT\system32\protector.exe -> Proxy.Wopla.ac : No action taken.
:mozilla.156:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\tdwul817.default\cookies.txt -> TrackingCookie.2o7 : No action taken.
:mozilla.103:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\tdwul817.default\cookies.txt -> TrackingCookie.Adbrite : No action taken.
:mozilla.104:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\tdwul817.default\cookies.txt -> TrackingCookie.Adbrite : No action taken.
:mozilla.122:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\tdwul817.default\cookies.txt -> TrackingCookie.Adbrite : No action taken.
:mozilla.98:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\tdwul817.default\cookies.txt -> TrackingCookie.Adbrite : No action taken.
:mozilla.125:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\tdwul817.default\cookies.txt -> TrackingCookie.Addynamix : No action taken.
:mozilla.14:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\tdwul817.default\cookies.txt -> TrackingCookie.Advertising : No action taken.
:mozilla.15:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\tdwul817.default\cookies.txt -> TrackingCookie.Advertising : No action taken.
:mozilla.16:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\tdwul817.default\cookies.txt -> TrackingCookie.Atdmt : No action taken.
:mozilla.37:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\tdwul817.default\cookies.txt -> TrackingCookie.Bfast : No action taken.
:mozilla.111:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\tdwul817.default\cookies.txt -> TrackingCookie.Burstnet : No action taken.
:mozilla.68:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\tdwul817.default\cookies.txt -> TrackingCookie.Casalemedia : No action taken.
:mozilla.69:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\tdwul817.default\cookies.txt -> TrackingCookie.Casalemedia : No action taken.
:mozilla.70:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\tdwul817.default\cookies.txt -> TrackingCookie.Casalemedia : No action taken.
:mozilla.50:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\tdwul817.default\cookies.txt -> TrackingCookie.Doubleclick : No action taken.
:mozilla.105:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\tdwul817.default\cookies.txt -> TrackingCookie.Falkag : No action taken.
:mozilla.106:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\tdwul817.default\cookies.txt -> TrackingCookie.Fastclick : No action taken.
:mozilla.107:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\tdwul817.default\cookies.txt -> TrackingCookie.Fastclick : No action taken.
:mozilla.108:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\tdwul817.default\cookies.txt -> TrackingCookie.Fastclick : No action taken.
:mozilla.109:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\tdwul817.default\cookies.txt -> TrackingCookie.Fastclick : No action taken.
:mozilla.139:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\tdwul817.default\cookies.txt -> TrackingCookie.Hitbox : No action taken.
:mozilla.140:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\tdwul817.default\cookies.txt -> TrackingCookie.Hitbox : No action taken.
:mozilla.142:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\tdwul817.default\cookies.txt -> TrackingCookie.Hitbox : No action taken.
:mozilla.143:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\tdwul817.default\cookies.txt -> TrackingCookie.Hitbox : No action taken.
:mozilla.38:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\tdwul817.default\cookies.txt -> TrackingCookie.Hitbox : No action taken.
:mozilla.39:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\tdwul817.default\cookies.txt -> TrackingCookie.Hitbox : No action taken.
:mozilla.40:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\tdwul817.default\cookies.txt -> TrackingCookie.Hitbox : No action taken.
:mozilla.41:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\tdwul817.default\cookies.txt -> TrackingCookie.Hitbox : No action taken.
:mozilla.42:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\tdwul817.default\cookies.txt -> TrackingCookie.Hitbox : No action taken.
:mozilla.43:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\tdwul817.default\cookies.txt -> TrackingCookie.Hitbox : No action taken.
:mozilla.51:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\tdwul817.default\cookies.txt -> TrackingCookie.Hitbox : No action taken.
:mozilla.61:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\tdwul817.default\cookies.txt -> TrackingCookie.Hitbox : No action taken.
:mozilla.112:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\tdwul817.default\cookies.txt -> TrackingCookie.Mediaplex : No action taken.
:mozilla.45:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\tdwul817.default\cookies.txt -> TrackingCookie.Overture : No action taken.
:mozilla.95:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\tdwul817.default\cookies.txt -> TrackingCookie.Pointroll : No action taken.
:mozilla.96:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\tdwul817.default\cookies.txt -> TrackingCookie.Pointroll : No action taken.
:mozilla.97:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\tdwul817.default\cookies.txt -> TrackingCookie.Pointroll : No action taken.
:mozilla.46:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\tdwul817.default\cookies.txt -> TrackingCookie.Questionmarket : No action taken.
:mozilla.47:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\tdwul817.default\cookies.txt -> TrackingCookie.Questionmarket : No action taken.
:mozilla.121:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\tdwul817.default\cookies.txt -> TrackingCookie.Statcounter : No action taken.
:mozilla.135:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\tdwul817.default\cookies.txt -> TrackingCookie.Tacoda : No action taken.
:mozilla.136:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\tdwul817.default\cookies.txt -> TrackingCookie.Tacoda : No action taken.
:mozilla.137:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\tdwul817.default\cookies.txt -> TrackingCookie.Tacoda : No action taken.
:mozilla.138:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\tdwul817.default\cookies.txt -> TrackingCookie.Tacoda : No action taken.
:mozilla.17:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\tdwul817.default\cookies.txt -> TrackingCookie.Tribalfusion : No action taken.
:mozilla.18:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\tdwul817.default\cookies.txt -> TrackingCookie.Tribalfusion : No action taken.
:mozilla.19:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\tdwul817.default\cookies.txt -> TrackingCookie.Tribalfusion : No action taken.
:mozilla.20:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\tdwul817.default\cookies.txt -> TrackingCookie.Tribalfusion : No action taken.
:mozilla.193:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\tdwul817.default\cookies.txt -> TrackingCookie.Webtrendslive : No action taken.
C:\WINNT\system32\durvil1.exe -> Trojan.Kolweb.b : No action taken.
C:\!KillBox\msasvc.exe -> Trojan.Sinowal.bh : No action taken.
C:\Program Files\Common Files\Microsoft Shared\Web Folders\ibm00001.dll -> Trojan.Sinowal.bh : No action taken.
C:\WINNT\system32\msasvc.exe -> Trojan.Sinowal.bh : No action taken.


::Report end

==================================

Administrator - Mon 11/06/2006 21:04:31.25 Service Pack 4
ComboFix 06.10.19 - Running from: "C:\Documents and Settings\Administrator\Desktop"

(((((((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))


C:\dfndrff_e48.exe
C:\dfndrff_e49.exe
C:\drsmartload.exe
C:\deskbar_e48.exe
C:\deskbar_e49.exe
C:\kybrdff_e49.exe
C:\nwnmff_e49.exe
C:\Program Files\Common Files\{38656286-03EA-1033-1226-010106000001}


((((((((((((((((((((((((((((((( Files Created from 2006-10-06 to 2006-11-06 ))))))))))))))))))))))))))))))))))


2006-11-06 19:28 40,973 —hs—- C:\WINNT\system32\khffgfe.dll
2006-11-06 19:19 40,973 —hs—- C:\WINNT\system32\awtspnk.dll
2006-11-06 19:13 3,968 –a—— C:\WINNT\system32\drivers\AvgAsCln.sys
2006-11-06 18:33 40,973 —hs—- C:\WINNT\system32\fccyywu.dll
2006-11-06 18:28 40,973 —hs—- C:\WINNT\system32\efcaxur.dll
2006-11-06 18:19 40,973 —hs—- C:\WINNT\system32\opnopno.dll
2006-11-06 18:09 40,973 —hs—- C:\WINNT\system32\urqonnk.dll
2006-11-06 17:38 40,973 —hs—- C:\WINNT\system32\jkkliif.dll
2006-11-06 17:34 40,973 —hs—- C:\WINNT\system32\byxxwxw.dll
2006-11-06 17:27 574,657 —hs—- C:\WINNT\system32\uvvwa.bak2
2006-11-06 17:26 40,973 —hs—- C:\WINNT\system32\efcabca.dll
2006-11-06 07:19 40,973 —hs—- C:\WINNT\system32\pmnkihg.dll
2006-11-06 07:18 80,384 -r-hs—- C:\WINNT\elRecvr.exe
2006-11-05 23:39 40,973 —hs—- C:\WINNT\system32\khfcccc.dll
2006-11-05 17:59 14,336 –a—— C:\jrdm.exe
2006-11-05 17:56 40,973 —hs—- C:\WINNT\system32\yayvwvs.dll
2006-11-05 16:46 40,973 —hs—- C:\WINNT\system32\tuvwvts.dll
2006-11-05 16:36 684,032 –a—— C:\WINNT\system32\libeay32.dll
2006-11-05 16:36 155,648 –a—— C:\WINNT\system32\ssleay32.dll
2006-11-05 16:25 40,973 —hs—- C:\WINNT\system32\xxywuuu.dll
2006-11-05 16:22 40,973 —hs—- C:\WINNT\system32\fccdbyw.dll
2006-11-05 16:20 40,973 —hs—- C:\WINNT\system32\fccdaab.dll
2006-11-05 15:47 250,769 –a—— C:\windows.exe
2006-11-05 15:42 40,973 —hs—- C:\WINNT\system32\fccaaxx.dll
2006-11-05 15:21 40,973 —hs—- C:\WINNT\system32\hggeday.dll
2006-11-05 10:55 40,973 —hs—- C:\WINNT\system32\nnnligd.dll
2006-11-05 09:52 692,276 —hs—- C:\WINNT\system32\awvvu.dll
2006-11-05 09:52 602,245 —hs—- C:\WINNT\system32\uvvwa.bak1
2006-11-05 09:52 60,436 –a—— C:\WINNT\system32\hdfdhxle.dll
2006-11-05 09:01 40,973 —hs—- C:\WINNT\system32\ssqpopp.dll
2006-11-05 08:23 40,973 –ahs—- C:\WINNT\system32\mljhhef.dll.vir
2006-11-04 22:39 602,245 —hs—- C:\WINNT\system32\yyadd.bak1
2006-11-04 22:38 692,276 –ahs—- C:\WINNT\system32\ddayy.dll.vir
2006-11-04 22:37 40,973 —hs—- C:\WINNT\system32\rqrrrop.dll
2006-11-04 22:37 0 –a—— C:\yvfamwqq.exe
2006-11-04 22:34 40,973 —hs—- C:\WINNT\system32\opnligh.dll
2006-11-04 22:30 40,973 —hs—- C:\WINNT\system32\wvurrss.dll
2006-11-04 22:30 1,492 –a—— C:\WINNTvundofix.reg
2006-11-04 21:30 40,973 —hs—- C:\WINNT\system32\nnnkllm.dll
2006-11-04 20:45 40,973 —hs—- C:\WINNT\system32\pmnoono.dll
2006-11-04 19:16 40,973 —hs—- C:\WINNT\system32\awtrrrs.dll
2006-11-04 18:41 40,973 —hs—- C:\WINNT\system32\gebcccc.dll
2006-11-04 15:49 40,973 —hs—- C:\WINNT\system32\rqronon.dll
2006-11-04 12:40 40,973 —hs—- C:\WINNT\system32\ddcbxwt.dll
2006-11-04 11:14 40,973 —hs—- C:\WINNT\system32\xxyxwwv.dll
2006-11-04 10:11 40,973 —hs—- C:\WINNT\system32\xxyxutu.dll
2006-11-04 09:55 40,973 —hs—- C:\WINNT\system32\ssqqopm.dll
2006-11-04 08:48 40,973 —hs—- C:\WINNT\system32\mljhgec.dll
2006-11-03 23:37 40,973 —hs—- C:\WINNT\system32\ssqpmlm.dll
2006-11-03 23:30 40,973 —hs—- C:\WINNT\system32\opnonml.dll
2006-11-03 23:04 323,072 –a—— C:\165.exe
2006-11-03 23:03 48,128 –a—— C:\mainboard.exe
2006-11-03 23:03 40,973 —hs—- C:\WINNT\system32\tuvuvww.dll
2006-11-03 23:02 80,384 -r-hs—- C:\WINNT\atapid.exe
2006-10-30 07:26 110,612 –a—— C:\WINNT\system32\ydcjfcfh.exe
2006-10-26 22:50 40,973 —hs—- C:\WINNT\system32\tuvuvwt.dll
2006-10-24 11:57 80,384 -r-hs—- C:\WINNT\tcpsvcs.exe


(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))


2006-11-06 21:05 ——– d-a—— C:\Program Files\Common Files
2006-11-06 21:01 ——– d——– C:\Program Files\Hijackthis
2006-11-06 19:07 ——– d——– C:\Program Files\Eudora
2006-11-05 15:29 ——– d——– C:\Documents and Settings\Administrator\Application Data\Lavasoft
2006-11-04 10:59 ——– d——– C:\Program Files\FirstClass
2006-11-04 10:59 ——– d——– C:\Program Files\Common Files\InstallShield
2006-11-04 09:20 ——– d——– C:\Documents and Settings\Administrator\Application Data\OpenOffice.org2
2006-10-30 22:26 ——– d——– C:\Program Files\Google
2006-10-30 21:54 ——– d——– C:\Documents and Settings\Administrator\Application Data\SearchToolbarCorp
2006-10-26 11:33 ——– d——– C:\Documents and Settings\Administrator\Application Data\Real
2006-10-26 06:05 ——– d——– C:\Program Files\Mozilla Firefox
2006-10-25 21:18 ——– d——– C:\Documents and Settings\Administrator\Application Data\Google
2006-10-25 20:01 ——– d—s—- C:\Documents and Settings\Administrator\Application Data\Microsoft
2006-09-12 05:48 1713536 –a—— C:\WINNT\system32\NTKRNLPA.EXE
2006-09-12 05:48 1690880 –a—— C:\WINNT\system32\NTOSKRNL.EXE
2006-09-05 22:58 1110528 –a—— C:\WINNT\system32\msxml3.dll
2006-08-28 02:44 530192 –a—— C:\WINNT\system32\comctl32.dll


(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries are not shown

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"NvMediaCenter"="\"RUNDLL32.EXE\" C:\\WINNT\\system32\\NVMCTRAY.DLL,NvTaskbarInit"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"Synchronization Manager"="\"mobsync.exe\" /logon"
"OfficeScanNT Monitor"="\"C:\\Program Files\\Trend Micro\\OfficeScan Client\\pccntmon.exe\" -HideWindow"
"SunJavaUpdateSched"="\"C:\\Program Files\\Java\\jre1.5.0_06\\bin\\jusched.exe\""
"iTunesHelper"="\"C:\\Program Files\\iTunes\\iTunesHelper.exe\""
"QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
"Acronis Scheduler2 Service"="\"C:\\Program Files\\Common Files\\Acronis\\Schedule2\\schedhlp.exe\""
"Tweak UI"="\"RUNDLL32.EXE\" TWEAKUI.CPL,TweakMeUp"
"C-Media Mixer"="Mixer.exe /startup"
"NvCplDaemon"="\"RUNDLL32.EXE\" C:\\WINNT\\system32\\NvCpl.dll,NvStartup"
"nwiz"="\"nwiz.exe\" /install"
"WinampAgent"="\"F:\\Program Files\\Winamp\\winampa.exe\""

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components]
"DeskHtmlVersion"=dword:00000110
"DeskHtmlMinorVersion"=dword:00000003
"Settings"=dword:00000001
"GeneralFlags"=dword:00000001

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="My Current Home Page"
"Flags"=dword:00000002
"Position"=hex:2c,00,00,00,cc,00,00,00,00,00,00,00,34,03,00,00,e4,02,00,00,00,\
00,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00
"CurrentState"=hex:04,00,00,40
"OriginalStateInfo"=hex:18,00,00,00,ff,ff,00,00,ff,ff,00,00,ff,ff,ff,ff,ff,ff,\
ff,ff,04,00,00,00
"RestoredStateInfo"=hex:18,00,00,00,f0,01,00,00,1f,00,00,00,80,00,00,00,76,00,\
00,00,01,00,00,00

[HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce]
"^SetupICWDesktop"="C:\\Program Files\\Internet Explorer\\Connection Wizard\\icwconn1.exe /desktop"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon"
"{9F143C3A-1457-6CCA-03A7-7AA23B61E40F}"="Network Neighborhood"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{AEB6717E-7E19-11d0-97EE-00C04FD91972}"=""
"{EDB0E980-90BD-11D4-8599-0008C7D3B6F8}"="Eudora's Shell Extension"
"{2856021F-4568-454E-8F4D-501BA83D80AA}"=""
"{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="AVG Anti-Spyware 7.5"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000095
"CDRAutoRun"=dword:00000000

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\Run]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"dontdisplaylastusername"=dword:00000000
"legalnoticecaption"=""
"legalnoticetext"=""
"shutdownwithoutlogon"=dword:00000001
"disablecad"=dword:00000000

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000095

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer\Run]
"{38656286-03EA-1033-1226-010106000001}"="\"C:\\Program Files\\Common Files\\{38656286-03EA-1033-1226-010106000001}\\Update.exe\" mc-110-12-0000297"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload]
"Network.ConnectionTray"="{7007ACCF-3202-11D1-AAD2-00805FC1270E}"
"WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"
"SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}"

HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\awvvu
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\nnnligd

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll"

HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\KxNT
Completion time: Mon 2006-11-06 21:05:35.46
C:\ComboFix.txt … 06-11-06 21:05
C:\ComboFix2.txt … 06-11-04 21:37






[11/06/2006, 21:08:42] - VirtumundoBeGone v1.5 ( "C:\Documents and Settings\Administrator\Desktop\VirtumundoBeGone.exe" )
[11/06/2006, 21:08:49] - Detected System Information:
[11/06/2006, 21:08:49] - Windows Version: 5.0.2195, Service Pack 4
[11/06/2006, 21:08:49] - Current Username: Administrator (Admin)
[11/06/2006, 21:08:49] - Windows is in NORMAL mode.
[11/06/2006, 21:08:49] - Searching for Browser Helper Objects:
[11/06/2006, 21:08:49] - BHO 1: {2856021F-4568-454E-8F4D-501BA83D80AA} ()
[11/06/2006, 21:08:49] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/06/2006, 21:08:49] - Checking for HKLM\…\Winlogon\Notify\nnnligd
[11/06/2006, 21:08:49] - Found: HKLM\…\Winlogon\Notify\nnnligd - This is probably Virtumundo.
[11/06/2006, 21:08:49] - Assigning {2856021F-4568-454E-8F4D-501BA83D80AA} MSEvents Object
[11/06/2006, 21:08:49] - BHO list has been changed! Starting over…
[11/06/2006, 21:08:49] - BHO 1: {2856021F-4568-454E-8F4D-501BA83D80AA} (MSEvents Object)
[11/06/2006, 21:08:49] - ALERT: Found MSEvents Object!
[11/06/2006, 21:08:49] - BHO 2: {4FE218C0-3401-49D4-994A-C1F7E5DE3211} ()
[11/06/2006, 21:08:49] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/06/2006, 21:08:49] - Checking for HKLM\…\Winlogon\Notify\awvvu
[11/06/2006, 21:08:49] - Found: HKLM\…\Winlogon\Notify\awvvu - This is probably Virtumundo.
[11/06/2006, 21:08:49] - Assigning {4FE218C0-3401-49D4-994A-C1F7E5DE3211} MSEvents Object
[11/06/2006, 21:08:49] - BHO list has been changed! Starting over…
[11/06/2006, 21:08:49] - BHO 1: {2856021F-4568-454E-8F4D-501BA83D80AA} (MSEvents Object)
[11/06/2006, 21:08:49] - ALERT: Found MSEvents Object!
[11/06/2006, 21:08:49] - BHO 2: {4FE218C0-3401-49D4-994A-C1F7E5DE3211} (MSEvents Object)
[11/06/2006, 21:08:49] - ALERT: Found MSEvents Object!
[11/06/2006, 21:08:49] - BHO 3: {53707962-6F74-2D53-2644-206D7942484F} ()
[11/06/2006, 21:08:49] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/06/2006, 21:08:49] - Checking for HKLM\…\Winlogon\Notify\SDHelper
[11/06/2006, 21:08:49] - Key not found: HKLM\…\Winlogon\Notify\SDHelper, continuing.
[11/06/2006, 21:08:49] - BHO 4: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[11/06/2006, 21:08:49] - BHO 5: {AA58ED58-01DD-4d91-8333-CF10577473F7} (Google Toolbar Helper)
[11/06/2006, 21:08:49] - BHO 6: {F18F04B0-9CF1-4b93-B004-77A288BEE28B} ()
[11/06/2006, 21:08:49] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/06/2006, 21:08:49] - Checking for HKLM\…\Winlogon\Notify\hdfdhxle
[11/06/2006, 21:08:49] - Key not found: HKLM\…\Winlogon\Notify\hdfdhxle, continuing.
[11/06/2006, 21:08:49] - Finished Searching Browser Helper Objects
[11/06/2006, 21:08:49] - *** Detected MSEvents Object
[11/06/2006, 21:08:49] - Trying to remove MSEvents Object…
[11/06/2006, 21:08:50] - Terminating Process: IEXPLORE.EXE
[11/06/2006, 21:08:50] - Terminating Process: RUNDLL32.EXE
[11/06/2006, 21:08:51] - Disabling Automatic Shell Restart
[11/06/2006, 21:08:51] - Terminating Process: EXPLORER.EXE
[11/06/2006, 21:08:51] - Suspending the NT Session Manager System Service
[11/06/2006, 21:08:51] - Terminating Windows NT Logon/Logoff Manager
[11/06/2006, 21:08:51] - Re-enabling Automatic Shell Restart
[11/06/2006, 21:08:51] - File to disable: C:\WINNT\system32\nnnligd.dll
[11/06/2006, 21:08:51] - Renaming C:\WINNT\system32\nnnligd.dll -> C:\WINNT\system32\nnnligd.dll.vir
[11/06/2006, 21:08:51] - ! File rename was unsucessful.
[11/06/2006, 21:08:51] - Attempting to Deny Access to C:\WINNT\system32\nnnligd.dll
[11/06/2006, 21:08:51] - *** IMPORTANT: Delete/Rename/Move on reboot (like Killbox) MAY NOT work.
[11/06/2006, 21:08:51] - processed file: C:\WINNT\system32\nnnligd.dll

[11/06/2006, 21:08:51] - *** IMPORTANT: The file is disabled and will need to be deleted by the user.
[11/06/2006, 21:08:51] - Removing HKLM\…\Browser Helper Objects\{2856021F-4568-454E-8F4D-501BA83D80AA}
[11/06/2006, 21:08:51] - Removing HKCR\CLSID\{2856021F-4568-454E-8F4D-501BA83D80AA}
[11/06/2006, 21:08:51] - Adding Kill Bit for ActiveX for GUID: {2856021F-4568-454E-8F4D-501BA83D80AA}
[11/06/2006, 21:08:51] - Deleting ATLEvents/MSEvents Registry entries
[11/06/2006, 21:08:51] - Removing HKLM\…\Winlogon\Notify\nnnligd
[11/06/2006, 21:08:51] - Searching for Browser Helper Objects:
[11/06/2006, 21:08:51] - BHO 1: {4FE218C0-3401-49D4-994A-C1F7E5DE3211} (MSEvents Object)
[11/06/2006, 21:08:51] - ALERT: Found MSEvents Object!
[11/06/2006, 21:08:51] - BHO 2: {53707962-6F74-2D53-2644-206D7942484F} ()
[11/06/2006, 21:08:51] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/06/2006, 21:08:51] - Checking for HKLM\…\Winlogon\Notify\SDHelper
[11/06/2006, 21:08:51] - Key not found: HKLM\…\Winlogon\Notify\SDHelper, continuing.
[11/06/2006, 21:08:51] - BHO 3: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[11/06/2006, 21:08:51] - BHO 4: {AA58ED58-01DD-4d91-8333-CF10577473F7} (Google Toolbar Helper)
[11/06/2006, 21:08:51] - BHO 5: {F18F04B0-9CF1-4b93-B004-77A288BEE28B} ()
[11/06/2006, 21:08:51] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/06/2006, 21:08:51] - Checking for HKLM\…\Winlogon\Notify\hdfdhxle
[11/06/2006, 21:08:51] - Key not found: HKLM\…\Winlogon\Notify\hdfdhxle, continuing.
[11/06/2006, 21:08:51] - Finished Searching Browser Helper Objects
[11/06/2006, 21:08:51] - *** Detected MSEvents Object
[11/06/2006, 21:08:51] - Trying to remove MSEvents Object…
[11/06/2006, 21:08:52] - Terminating Process: IEXPLORE.EXE
[11/06/2006, 21:08:53] - Terminating Process: RUNDLL32.EXE
[11/06/2006, 21:08:53] - Disabling Automatic Shell Restart
[11/06/2006, 21:08:53] - Terminating Process: EXPLORER.EXE
[11/06/2006, 21:08:53] - Suspending the NT Session Manager System Service
[11/06/2006, 21:08:53] - Terminating Windows NT Logon/Logoff Manager
[11/06/2006, 21:08:53] - Re-enabling Automatic Shell Restart
[11/06/2006, 21:08:53] - File to disable: C:\WINNT\system32\awvvu.dll
[11/06/2006, 21:08:53] - Renaming C:\WINNT\system32\awvvu.dll -> C:\WINNT\system32\awvvu.dll.vir
[11/06/2006, 21:08:53] - ! File rename was unsucessful.
[11/06/2006, 21:08:53] - Attempting to Deny Access to C:\WINNT\system32\awvvu.dll
[11/06/2006, 21:08:53] - *** IMPORTANT: Delete/Rename/Move on reboot (like Killbox) MAY NOT work.
[11/06/2006, 21:08:53] - ERROR: The system cannot find the file specified.

[11/06/2006, 21:08:53] - *** IMPORTANT: The file is disabled and will need to be deleted by the user.
[11/06/2006, 21:08:53] - Removing HKLM\…\Browser Helper Objects\{4FE218C0-3401-49D4-994A-C1F7E5DE3211}
[11/06/2006, 21:08:53] - Removing HKCR\CLSID\{4FE218C0-3401-49D4-994A-C1F7E5DE3211}
[11/06/2006, 21:08:53] - Adding Kill Bit for ActiveX for GUID: {4FE218C0-3401-49D4-994A-C1F7E5DE3211}
[11/06/2006, 21:08:53] - Deleting ATLEvents/MSEvents Registry entries
[11/06/2006, 21:08:53] - Removing HKLM\…\Winlogon\Notify\awvvu
[11/06/2006, 21:08:53] - Searching for Browser Helper Objects:
[11/06/2006, 21:08:53] - BHO 1: {53707962-6F74-2D53-2644-206D7942484F} ()
[11/06/2006, 21:08:53] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/06/2006, 21:08:53] - Checking for HKLM\…\Winlogon\Notify\SDHelper
[11/06/2006, 21:08:53] - Key not found: HKLM\…\Winlogon\Notify\SDHelper, continuing.
[11/06/2006, 21:08:53] - BHO 2: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[11/06/2006, 21:08:53] - BHO 3: {AA58ED58-01DD-4d91-8333-CF10577473F7} (Google Toolbar Helper)
[11/06/2006, 21:08:53] - BHO 4: {F18F04B0-9CF1-4b93-B004-77A288BEE28B} ()
[11/06/2006, 21:08:53] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/06/2006, 21:08:53] - Checking for HKLM\…\Winlogon\Notify\hdfdhxle
[11/06/2006, 21:08:53] - Key not found: HKLM\…\Winlogon\Notify\hdfdhxle, continuing.
[11/06/2006, 21:08:53] - Finished Searching Browser Helper Objects
[11/06/2006, 21:08:53] - Finishing up…
[11/06/2006, 21:08:53] - A restart is needed.
[11/06/2006, 21:09:01] - Attempting to Restart via STOP error (Blue Screen!)

=====================================

———————————————————
AVG Anti-Spyware - Scan Report
———————————————————

+ Created at: 10:11:03 PM 11/6/2006

+ Scan result:



Nothing found.


::Report end

======================================

FINAL HIJACK LOG.

Logfile of HijackThis v1.99.1
Scan saved at 10:27:29 PM, on 11/6/2006
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Common Files\Acronis\Agent\agent.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\Trend Micro\OfficeScan Client\ntrtscan.exe
C:\WINNT\system32\nvsvc32.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\stisvc.exe
C:\Program Files\Trend Micro\OfficeScan Client\tmlisten.exe
C:\WINNT\Explorer.EXE
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\Trend Micro\OfficeScan Client\OfcPfwSvc.exe
C:\Program Files\Trend Micro\OfficeScan Client\pccntmon.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe
C:\WINNT\Mixer.exe
F:\Program Files\Winamp\winampa.exe
C:\WINNT\system32\RUNDLL32.EXE
F:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Trend Micro\OfficeScan Client\Pop3Trap.exe
C:\Program Files\Hijackthis\Analyse.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - F:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll (file missing)
O2 - BHO: (no name) - {F18F04B0-9CF1-4b93-B004-77A288BEE28B} - C:\WINNT\system32\hdfdhxle.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
O4 - HKLM\..\Run: [Synchronization Manager] "mobsync.exe" /logon
O4 - HKLM\..\Run: [OfficeScanNT Monitor] "C:\Program Files\Trend Micro\OfficeScan Client\pccntmon.exe" -HideWindow
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Acronis Scheduler2 Service] "C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe"
O4 - HKLM\..\Run: [Tweak UI] "RUNDLL32.EXE" TWEAKUI.CPL,TweakMeUp
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [NvCplDaemon] "RUNDLL32.EXE" C:\WINNT\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] "nwiz.exe" /install
O4 - HKLM\..\Run: [WinampAgent] "F:\Program Files\Winamp\winampa.exe"
O4 - HKCU\..\Run: [NvMediaCenter] "RUNDLL32.EXE" C:\WINNT\system32\NVMCTRAY.DLL,NvTaskbarInit
O4 - Global Startup: WinZip Quick Pick.lnk = F:\Program Files\WinZip\WZQKPICK.EXE
O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.dell.com/systemprofiler/SysPro.CAB
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1153499979273
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1153834256367
O23 - Service: Acronis Remote Agent (AcronisAgent) - Acronis - C:\Program Files\Common Files\Acronis\Agent\agent.exe
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - F:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: OfficeScanNT RealTime Scan (ntrtscan) - Trend Micro Inc. - C:\Program Files\Trend Micro\OfficeScan Client\ntrtscan.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINNT\system32\nvsvc32.exe
O23 - Service: OfficeScanNT Personal Firewall (OfcPfwSvc) - Trend Micro Inc. - C:\Program Files\Trend Micro\OfficeScan Client\OfcPfwSvc.exe
O23 - Service: OfficeScanNT Listener (tmlisten) - Trend Micro Inc. - C:\Program Files\Trend Micro\OfficeScan Client\tmlisten.exe
Post #19
Ken:

Here's the Vundo log…


VundoFix V6.2.7

Checking Java version…

Java version is 1.5.0.6

Scan started at 10:34:59 PM 11/6/2006

Listing files found while scanning….

C:\WINNT\system32\tuvuvwt.dll

Beginning removal…

Attempting to delete C:\WINNT\system32\tuvuvwt.dll
C:\WINNT\system32\tuvuvwt.dll Has been deleted!

Performing Repairs to the registry.
Done!


And the latest Hijack This!

Logfile of HijackThis v1.99.1
Scan saved at 11:11:31 PM, on 11/6/2006
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Common Files\Acronis\Agent\agent.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
F:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\Trend Micro\OfficeScan Client\ntrtscan.exe
C:\WINNT\system32\nvsvc32.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\stisvc.exe
C:\Program Files\Trend Micro\OfficeScan Client\tmlisten.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\Explorer.EXE
C:\WINNT\system32\svchost.exe
C:\Program Files\Trend Micro\OfficeScan Client\OfcPfwSvc.exe
C:\Program Files\Trend Micro\OfficeScan Client\pccntmon.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe
C:\WINNT\Mixer.exe
F:\Program Files\Winamp\winampa.exe
C:\WINNT\system32\RUNDLL32.EXE
F:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Trend Micro\OfficeScan Client\Pop3Trap.exe
F:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Hijackthis\Analyse.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - F:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll (file missing)
O2 - BHO: (no name) - {F18F04B0-9CF1-4b93-B004-77A288BEE28B} - C:\WINNT\system32\hdfdhxle.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
O4 - HKLM\..\Run: [Synchronization Manager] "mobsync.exe" /logon
O4 - HKLM\..\Run: [OfficeScanNT Monitor] "C:\Program Files\Trend Micro\OfficeScan Client\pccntmon.exe" -HideWindow
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Acronis Scheduler2 Service] "C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe"
O4 - HKLM\..\Run: [Tweak UI] "RUNDLL32.EXE" TWEAKUI.CPL,TweakMeUp
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [NvCplDaemon] "RUNDLL32.EXE" C:\WINNT\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] "nwiz.exe" /install
O4 - HKLM\..\Run: [WinampAgent] "F:\Program Files\Winamp\winampa.exe"
O4 - HKCU\..\Run: [NvMediaCenter] "RUNDLL32.EXE" C:\WINNT\system32\NVMCTRAY.DLL,NvTaskbarInit
O4 - Global Startup: WinZip Quick Pick.lnk = F:\Program Files\WinZip\WZQKPICK.EXE
O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.dell.com/systemprofiler/SysPro.CAB
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1153499979273
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1153834256367
O23 - Service: Acronis Remote Agent (AcronisAgent) - Acronis - C:\Program Files\Common Files\Acronis\Agent\agent.exe
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - F:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: OfficeScanNT RealTime Scan (ntrtscan) - Trend Micro Inc. - C:\Program Files\Trend Micro\OfficeScan Client\ntrtscan.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINNT\system32\nvsvc32.exe
O23 - Service: OfficeScanNT Personal Firewall (OfcPfwSvc) - Trend Micro Inc. - C:\Program Files\Trend Micro\OfficeScan Client\OfcPfwSvc.exe
O23 - Service: OfficeScanNT Listener (tmlisten) - Trend Micro Inc. - C:\Program Files\Trend Micro\OfficeScan Client\tmlisten.exe
Post #20
Mark,

Did you post 2 AVG logs? I am a little confused on this, the first one you ran you set it wrong, reread my instructions, I needed you to set it to Quauantine and not Take No Action. But the last AVG found nothing. :thumbup:


Open HJT Scan Only and remove this entry.
O2 - BHO: (no name) - {F18F04B0-9CF1-4b93-B004-77A288BEE28B} - C:\WINNT\system32\hdfdhxle.dll

Do the safemode thing and make sure you still have windows enabled to show all files and folders and delete this one.
C:\WINNT\system32\hdfdhxle.dll

You did well, the rest of your log looks good :thumbup: It looks like we may have gotten rid of Vundo.

After you fix the above entry, reboot and run this free online virus scanner from Panda, I need to see this report.
Panda ActiveScan <<

I also need to look over the files that were created in the last 30 days in the Combofix log but am tied up at work and won't be able to get to it till a little later today.

So let me see the Panda report and a new HJT log.

How is your system behaving now??
Post #21
OK, got some homework for ya, these are related to the Vundo Infection, they may be gone, but print this out, boot to safemode, make sure windows is still enabled to show all files and folders, look for these and delete them if still present. Write down any that are still present and also the ones that won't let you delete them.

C:\165.exe
C:\jrdm.exe
C:\mainboard.exe
C:\windows.exe <– Be Careful, do not delete C:\windows
C:\yvfamwqq.exe

C:\WINNT\atapid.exe
C:\WINNT\elRecvr.exe

C:\WINNT\system32\awtspnk.dll
C:\WINNT\system32\awtrrrs.dll
C:\WINNT\system32\byxxwxw.dll
C:\WINNT\system32\ddayy.dll.vir
C:\WINNT\system32\ddcbxwt.dll
C:\WINNT\system32\efcaxur.dll
C:\WINNT\system32\efcabca.dll
C:\WINNT\system32\fccyywu.dll
C:\WINNT\system32\fccdbyw.dll
C:\WINNT\system32\fccdaab.dll
C:\WINNT\system32\fccaaxx.dll
C:\WINNT\system32\gebcccc.dll
C:\WINNT\system32\hggeday.dll
C:\WINNT\system32\jkkliif.dll
C:\WINNT\system32\khffgfe.dll
C:\WINNT\system32\khfcccc.dll
C:\WINNT\system32\mljhhef.dll.vir
C:\WINNT\system32\mljhgec.dll
C:\WINNT\system32\nnnkllm.dll
C:\WINNT\system32\opnopno.dll
C:\WINNT\system32\opnonml.dll
C:\WINNT\system32\opnligh.dll
C:\WINNT\system32\pmnoono.dll
C:\WINNT\system32\pmnkihg.dll
C:\WINNT\system32\rqrrrop.dll
C:\WINNT\system32\rqronon.dll
C:\WINNT\system32\ssqpopp.dll
C:\WINNT\system32\ssqqopm.dll
C:\WINNT\system32\ssqpmlm.dll
C:\WINNT\system32\tuvwvts.dll
C:\WINNT\system32\tuvuvww.dll
C:\WINNT\system32\tuvuvwt.dll
C:\WINNT\system32\urqonnk.dll
C:\WINNT\system32\uvvwa.bak2
C:\WINNT\system32\wvurrss.dll
C:\WINNT\system32\xxywuuu.dll
C:\WINNT\system32\xxyxwwv.dll
C:\WINNT\system32\xxyxutu.dll
C:\WINNT\system32\yayvwvs.dll
C:\WINNT\system32\yyadd.bak1
C:\WINNT\system32\ydcjfcfh.exe
Post #22 last edited
Here's my homework. I still have to run the panda active scan… I have attached my homework and the latest Hijack scan… Panda Active Scan to follow later….

And it's behaving sooooooo much better now.

C:\165.exe - had to delete it
C:\jrdm.exe - had to delete it
C:\mainboard.exe - had to delete it
C:\windows.exe <– had to delete it
C:\yvfamwqq.exe - had to delete it

C:\WINNT\atapid.exe - not there
C:\WINNT\elRecvr.exe - had to delete it

C:\WINNT\system32\awtspnk.dll- had to delete it
C:\WINNT\system32\awtrrrs.dll- not there
C:\WINNT\system32\byxxwxw.dll- had to delete it
C:\WINNT\system32\ddayy.dll.vir - had to delete it
C:\WINNT\system32\ddcbxwt.dll - not there
C:\WINNT\system32\efcaxur.dll - had to delete it
C:\WINNT\system32\efcabca.dll - had to delete it
C:\WINNT\system32\fccyywu.dll - had to delete it
C:\WINNT\system32\fccdbyw.dll - not there
C:\WINNT\system32\fccdaab.dll - not there
C:\WINNT\system32\fccaaxx.dll - not there
C:\WINNT\system32\gebcccc.dll - not there
C:\WINNT\system32\hggeday.dll - not there
C:\WINNT\system32\jkkliif.dll - had to delete it
C:\WINNT\system32\khffgfe.dll - had to delete it
C:\WINNT\system32\khfcccc.dll - not there
C:\WINNT\system32\mljhhef.dll.vir - not there
C:\WINNT\system32\mljhgec.dll - not there
C:\WINNT\system32\nnnkllm.dll - not there
C:\WINNT\system32\opnopno.dll - had to delete it
C:\WINNT\system32\opnonml.dll - not there
C:\WINNT\system32\opnligh.dll - not there
C:\WINNT\system32\pmnoono.dll - not there
C:\WINNT\system32\pmnkihg.dll - not there
C:\WINNT\system32\rqrrrop.dll - not there
C:\WINNT\system32\rqronon.dll - not there
C:\WINNT\system32\ssqpopp.dll - not there
C:\WINNT\system32\ssqqopm.dll - not there
C:\WINNT\system32\ssqpmlm.dll - not there
C:\WINNT\system32\tuvwvts.dll - not there
C:\WINNT\system32\tuvuvww.dll - not there
C:\WINNT\system32\tuvuvwt.dll - not there
C:\WINNT\system32\urqonnk.dll - had to delete
C:\WINNT\system32\uvvwa.bak2 - had to delete (note. uvvwa.bak1 also present - not deleted)
C:\WINNT\system32\wvurrss.dll - not there
C:\WINNT\system32\xxywuuu.dll - not there
C:\WINNT\system32\xxyxwwv.dll - not there
C:\WINNT\system32\xxyxutu.dll - not there
C:\WINNT\system32\yayvwvs.dll - not there
C:\WINNT\system32\yyadd.bak1 - not there
C:\WINNT\system32\ydcjfcfh.exe - had to delete



And the Hijack log….

Logfile of HijackThis v1.99.1
Scan saved at 5:51:50 PM, on 11/7/2006
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Common Files\Acronis\Agent\agent.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
F:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\Trend Micro\OfficeScan Client\ntrtscan.exe
C:\WINNT\system32\nvsvc32.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\stisvc.exe
C:\Program Files\Trend Micro\OfficeScan Client\tmlisten.exe
C:\WINNT\Explorer.EXE
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\Trend Micro\OfficeScan Client\OfcPfwSvc.exe
C:\WINNT\TEMP\OTDA3A.EXE
C:\Program Files\Trend Micro\OfficeScan Client\pccntmon.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe
C:\WINNT\Mixer.exe
F:\Program Files\Winamp\winampa.exe
C:\WINNT\system32\RUNDLL32.EXE
F:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Trend Micro\OfficeScan Client\Pop3Trap.exe
C:\WINNT\system32\NOTEPAD.EXE
F:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Hijackthis\Analyse.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - F:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll (file missing)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
O4 - HKLM\..\Run: [Synchronization Manager] "mobsync.exe" /logon
O4 - HKLM\..\Run: [OfficeScanNT Monitor] "C:\Program Files\Trend Micro\OfficeScan Client\pccntmon.exe" -HideWindow
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Acronis Scheduler2 Service] "C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe"
O4 - HKLM\..\Run: [Tweak UI] "RUNDLL32.EXE" TWEAKUI.CPL,TweakMeUp
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [NvCplDaemon] "RUNDLL32.EXE" C:\WINNT\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] "nwiz.exe" /install
O4 - HKLM\..\Run: [WinampAgent] "F:\Program Files\Winamp\winampa.exe"
O4 - HKCU\..\Run: [NvMediaCenter] "RUNDLL32.EXE" C:\WINNT\system32\NVMCTRAY.DLL,NvTaskbarInit
O4 - Global Startup: WinZip Quick Pick.lnk = F:\Program Files\WinZip\WZQKPICK.EXE
O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.dell.com/systemprofiler/SysPro.CAB
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1153499979273
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1153834256367
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O23 - Service: Acronis Remote Agent (AcronisAgent) - Acronis - C:\Program Files\Common Files\Acronis\Agent\agent.exe
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - F:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: OfficeScanNT RealTime Scan (ntrtscan) - Trend Micro Inc. - C:\Program Files\Trend Micro\OfficeScan Client\ntrtscan.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINNT\system32\nvsvc32.exe
O23 - Service: OfficeScanNT Personal Firewall (OfcPfwSvc) - Trend Micro Inc. - C:\Program Files\Trend Micro\OfficeScan Client\OfcPfwSvc.exe
O23 - Service: OfficeScanNT Listener (tmlisten) - Trend Micro Inc. - C:\Program Files\Trend Micro\OfficeScan Client\tmlisten.exe
Post #23
Opeongo :D

Good job :thumbup:

note. uvvwa.bak1 also present - not deleted) <– Delete it

C:\WINNT\TEMP\OTDA3A.EXE Delete this one too.



Lets see what Panda finds.
Post #24 last edited
I deleted uvvwa.bak1; there is also a uvvwa.ini file beside it… get rid of that too?

C:\WINNT\TEMP\OTDA3A.EXE…. will boot into safe mode to get rid of it…. it wouldn't go on normal start up.

In safe mode- found three files camped out in c:\winnt\temp\ASHeuristic\
backup-20061106-194148-349_dll.vir
jkhfg.dll_bad.vir
tuvuvwt.dll_bad.vir

They were deleted. I did not see the file C:\WINNT\TEMP\OTDA3A.EXE … it gets created on startup. And keeps coming back?

This time it was C:\WINNT\TEMP\NG3048.EXE - I stopped the process with Killbox and deleted the file. But I doubt that's the end of it.

Ideas?


Panda says…


Incident; Status; Location

Spyware:Cookie/Go ;Not disinfected; C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\tdwul817.default\cookies.txt[.go.com/]

Spyware:Cookie/Hitbox;Not disinfected;C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\tdwul817.default\cookies.txt[.hitbox.com/]

Spyware:Cookie/Doubleclick;Not disinfected; C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\tdwul817.default\cookies.txt[.doubleclick.net/]

Spyware:Cookie/Hitbox;Not disinfected;C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\tdwul817.default\cookies.txt[.ehg-dig.hitbox.com/]

Spyware:Cookie/Hitbox; Not disinfected; C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\tdwul817.default\cookies.txt[.hitbox.com/]

Spyware:Cookie/Hitbox; Not disinfected; C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\tdwul817.default\cookies.txt[.ehg-dig.hitbox.com/]

Spyware:Cookie/Atlas DMT; Not disinfected; C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\tdwul817.default\cookies.txt[.atdmt.com/]

Spyware:Cookie/2o7; Not disinfected; C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\tdwul817.default\cookies.txt[.2o7.net/]

Spyware:Cookie/Casalemedia; Not disinfected; C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\tdwul817.default\cookies.txt[.casalemedia.com/]

Spyware:Cookie/Advertising;Not disinfected; C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\tdwul817.default\cookies.txt[.advertising.com/]

Spyware:Cookie/Mediaplex; Not disinfected; C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\tdwul817.default\cookies.txt[.mediaplex.com/]

Spyware:Cookie/Statcounter; Not disinfected; C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\tdwul817.default\cookies.txt[.statcounter.com/]

Spyware:Cookie/2o7; Not disinfected; C:\Documents and Settings \Administrator\Cookies\administrator@2o7[2].txt

Spyware:Cookie/Atlas DMT; Not disinfected; C:\Documents and Settings\Administrator\Cookies\administrator@atdmt[2].txt

Potentially unwanted tool:Application/Processor; Not disinfected; C:\Documents and Settings\Administrator\Desktop\VirtumundoBeGone.exe[²ƒÇ]

Potentially unwanted tool:Application/VSToolbar; Not disinfected; C:\Program Files\Hijackthis\backups\backup-20061105-093821-950.dll

Possible Virus. Not disinfected; C:\Program Files\Hijackthis\backups\backup-20061106-194148-349.dll

Potentially unwanted tool:Application/VSToolbar; Not disinfected; C:\Program Files\Hijackthis\backups\backup-20061107-073044-263.dll

Spyware:Spyware/Virtumonde; Not disinfected; C:\VundoFix Backups\etpuunji.dll.bad

Possible Virus. Not disinfected;C:\VundoFix Backups\jkhfg.dll.bad

Possible Virus. Not disinfected; C:\VundoFix Backups\tuvuvwt.dll.bad


And the latest Hijackthis Log…

Logfile of HijackThis v1.99.1
Scan saved at 10:34:26 PM, on 11/7/2006
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Common Files\Acronis\Agent\agent.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
F:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\Trend Micro\OfficeScan Client\ntrtscan.exe
C:\WINNT\system32\nvsvc32.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\stisvc.exe
C:\Program Files\Trend Micro\OfficeScan Client\tmlisten.exe
C:\WINNT\Explorer.EXE
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\Trend Micro\OfficeScan Client\OfcPfwSvc.exe
C:\WINNT\TEMP\NG3048.EXE
C:\Program Files\Trend Micro\OfficeScan Client\pccntmon.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe
C:\WINNT\Mixer.exe
F:\Program Files\Winamp\winampa.exe
C:\WINNT\system32\RUNDLL32.EXE
F:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Trend Micro\OfficeScan Client\Pop3Trap.exe
F:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Hijackthis\Analyse.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - F:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll (file missing)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
O4 - HKLM\..\Run: [Synchronization Manager] "mobsync.exe" /logon
O4 - HKLM\..\Run: [OfficeScanNT Monitor] "C:\Program Files\Trend Micro\OfficeScan Client\pccntmon.exe" -HideWindow
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Acronis Scheduler2 Service] "C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe"
O4 - HKLM\..\Run: [Tweak UI] "RUNDLL32.EXE" TWEAKUI.CPL,TweakMeUp
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [NvCplDaemon] "RUNDLL32.EXE" C:\WINNT\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] "nwiz.exe" /install
O4 - HKLM\..\Run: [WinampAgent] "F:\Program Files\Winamp\winampa.exe"
O4 - HKCU\..\Run: [NvMediaCenter] "RUNDLL32.EXE" C:\WINNT\system32\NVMCTRAY.DLL,NvTaskbarInit
O4 - Global Startup: WinZip Quick Pick.lnk = F:\Program Files\WinZip\WZQKPICK.EXE
O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.dell.com/systemprofiler/SysPro.CAB
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1153499979273
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1153834256367
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O23 - Service: Acronis Remote Agent (AcronisAgent) - Acronis - C:\Program Files\Common Files\Acronis\Agent\agent.exe
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - F:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: OfficeScanNT RealTime Scan (ntrtscan) - Trend Micro Inc. - C:\Program Files\Trend Micro\OfficeScan Client\ntrtscan.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINNT\system32\nvsvc32.exe
O23 - Service: OfficeScanNT Personal Firewall (OfcPfwSvc) - Trend Micro Inc. - C:\Program Files\Trend Micro\OfficeScan Client\OfcPfwSvc.exe
O23 - Service: OfficeScanNT Listener (tmlisten) - Trend Micro Inc. - C:\Program Files\Trend Micro\OfficeScan Client\tmlisten.exe
Post #25
Good Morning :D

Your log looks good except for that temp file that keeps recreating itself. I see nothing on your log that is causing that. Lets do a few things. Everything that Panda found where backup files.


Open HJT > Misc Tools> View the list of Backups and delete everything in there.


You can do a search and delete any instances of uvvwa.bak1


Run this quick scan that will search for Rootkits, post the log back for me to see.

Download and Save Blacklight to your desktop:
  • Double-click blbeta.exe
  • Then accept the agreement
  • leave [X]scan through Windows Explorer checked.
  • Click > scan then > next
  • You'll see a list of all items found. There will also be a log on your desktop with the name fsbl.xxxxxxx.log (the xxxxxxx stand for numbers).
  • Copy and paste this log in your next reply.
  • Don't choose the rename option yet! I want to see the log first, because legitimate items can also be present there, such as "wbemtest.exe"
Post #27
Backlight report

11/08/06 07:03:57 [Info]: BlackLight Engine 1.0.47 initialized
11/08/06 07:03:57 [Info]: OS: 5.0 build 2195 (Service Pack 4)
11/08/06 07:03:57 [Note]: 7019 4
11/08/06 07:03:57 [Note]: 7005 0
11/08/06 07:04:13 [Note]: 7006 0
11/08/06 07:04:13 [Note]: 7011 900
11/08/06 07:04:13 [Note]: 7026 0
11/08/06 07:04:14 [Note]: 7026 0
11/08/06 07:04:19 [Note]: FSRAW library version 1.7.1020
11/08/06 07:09:26 [Note]: 7007 0

Here is the startup list:

StartupList report, 11/8/2006, 7:15:22 AM
StartupList version: 1.52.2
Started from : C:\Program Files\Hijackthis\Analyse.EXE
Detected: Windows 2000 SP4 (WinNT 5.00.2195)
Detected: Internet Explorer v6.00 SP1 (6.00.2800.1106)
* Using default options
==================================================

Running processes:

C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Common Files\Acronis\Agent\agent.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
F:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\Trend Micro\OfficeScan Client\ntrtscan.exe
C:\WINNT\system32\nvsvc32.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\stisvc.exe
C:\Program Files\Trend Micro\OfficeScan Client\tmlisten.exe
C:\WINNT\Explorer.EXE
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\Trend Micro\OfficeScan Client\OfcPfwSvc.exe
C:\Program Files\Trend Micro\OfficeScan Client\pccntmon.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe
C:\WINNT\Mixer.exe
F:\Program Files\Winamp\winampa.exe
C:\WINNT\system32\RUNDLL32.EXE
F:\Program Files\WinZip\WZQKPICK.EXE
C:\WINNT\TEMP\TIACF9.EXE
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Trend Micro\OfficeScan Client\Pop3Trap.exe
F:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Administrator\Desktop\KillBox.exe
C:\WINNT\system32\NOTEPAD.EXE
C:\Program Files\Hijackthis\Analyse.exe

————————————————–

Listing of startup folders:

Shell folders Common Startup:
[C:\Documents and Settings\All Users\Start Menu\Programs\Startup]
WinZip Quick Pick.lnk = F:\Program Files\WinZip\WZQKPICK.EXE

————————————————–

Checking Windows NT UserInit:

[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
UserInit = C:\WINNT\system32\userinit.exe,

————————————————–

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run

Synchronization Manager = "mobsync.exe" /logon
OfficeScanNT Monitor = "C:\Program Files\Trend Micro\OfficeScan Client\pccntmon.exe" -HideWindow
SunJavaUpdateSched = "C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe"
iTunesHelper = "C:\Program Files\iTunes\iTunesHelper.exe"
QuickTime Task = "C:\Program Files\QuickTime\qttask.exe" -atboottime
Acronis Scheduler2 Service = "C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe"
Tweak UI = "RUNDLL32.EXE" TWEAKUI.CPL,TweakMeUp
C-Media Mixer = Mixer.exe /startup
NvCplDaemon = "RUNDLL32.EXE" C:\WINNT\system32\NvCpl.dll,NvStartup
nwiz = "nwiz.exe" /install
WinampAgent = "F:\Program Files\Winamp\winampa.exe"

————————————————–

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run

NvMediaCenter = "RUNDLL32.EXE" C:\WINNT\system32\NVMCTRAY.DLL,NvTaskbarInit

————————————————–

Shell & screensaver key from C:\WINNT\SYSTEM.INI:

Shell=*INI section not found*
SCRNSAVE.EXE=*INI section not found*
drivers=*INI section not found*

Shell & screensaver key from Registry:

Shell=Explorer.exe
SCRNSAVE.EXE=*Registry value not found*
drivers=*Registry value not found*

Policies Shell key:

HKCU\..\Policies: Shell=*Registry value not found*
HKLM\..\Policies: Shell=*Registry value not found*

————————————————–


Enumerating Browser Helper Objects:

(no name) - F:\PROGRA~1\SPYBOT~1\SDHelper.dll - {53707962-6F74-2D53-2644-206D7942484F}
(no name) - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}
(no name) - c:\program files\google\googletoolbar2.dll (file missing) - {AA58ED58-01DD-4d91-8333-CF10577473F7}

————————————————–

Enumerating Download Program Files:

[SysProWmi Class]
InProcServer32 = C:\WINNT\system32\Dell\SystemProfiler\SysPro.ocx
CODEBASE = http://support.dell.com/systemprofiler/SysPro.CAB

[Shockwave ActiveX Control]
InProcServer32 = C:\WINNT\system32\macromed\Director\SwDir.dll
CODEBASE = http://fpdownload.macromedia.com/pub/shock…director/sw.cab

[Windows Genuine Advantage Validation Tool]
InProcServer32 = C:\WINNT\system32\LegitCheckControl.DLL
CODEBASE = http://go.microsoft.com/fwlink/?linkid=39204

[WUWebControl Class]
InProcServer32 = C:\WINNT\system32\wuweb.dll
CODEBASE = http://update.microsoft.com/windowsupdate/…b?1153499979273

[MUWebControl Class]
InProcServer32 = C:\WINNT\system32\muweb.dll
CODEBASE = http://update.microsoft.com/microsoftupdat…b?1153834256367

[ActiveScan Installer Class]
InProcServer32 = C:\WINNT\Downloaded Program Files\asinst.dll
CODEBASE = http://acs.pandasoftware.com/activescan/as5free/asinst.cab

[Shockwave Flash Object]
InProcServer32 = C:\WINNT\system32\Macromed\Flash\Flash9.ocx
CODEBASE = http://fpdownload.macromedia.com/pub/shock…ash/swflash.cab

————————————————–

Enumerating ShellServiceObjectDelayLoad items:

Network.ConnectionTray: C:\WINNT\system32\NETSHELL.dll
WebCheck: C:\WINNT\system32\webcheck.dll
SysTray: stobject.dll

————————————————–
End of report, 6,318 bytes
Report generated in 0.063 seconds

Command line options:
/verbose - to add additional info on each section
/complete - to include empty sections and unsuspicious data
/full - to include several rarely-important sections
/force9x - to include Win9x-only startups even if running on WinNT
/forcent - to include WinNT-only startups even if running on Win9x
/forceall - to include all Win9x and WinNT startups, regardless of platform
/history - to list version history only
Post #28
Opeongo :D

Blacklight showed nothing and I see nothing out of the ordinary on start up. Lets do this, your Java is out of date and could be letting some bad things access your computer. Lets update Java .

Your Java is out of date and leaving your system vunerable. Update your Java:
  • Go to Start > Control Panel > Add-Remove Programs.
  • Search in the list for all previous installed versions of Java. (J2SE Runtime Environment)

    It should have an icon next to it:

    [external image: Posted Image]
    Select it and click Remove.
  • The current version can be downloaded from Sun here:
    http://java.sun.com/javase/downloads/index.jsp
    Scroll down the page to 'Java Runtime Environment (JRE) 5.0 Update 9 and press the Download' button. On the new web page, click the Accept License Agreement' button.
    Then select 'Windows Offline Installation, Multi-language' in the Windows Platform
    area just below the Accept button.



Then delete this file
C:\WINNT\TEMP\NG3048.EXE



Sometimes , printers or scanners or could be a program your using is putting files in the temp directory, BUT NOT ALWAYS, Let me look into this further for you, I will be back as soon as I find out anything, don't go away.
Post #29 last edited
From one of my peers. If you see a log with OfficeScanNT (from Trend Micro) running, there will be a "random named" EXE running in windows\temp. This is part of OfficeScanNT, and is not malware. A quick way to verify the random EXE is to ask the user to find the file. If the file icon is a "doggie", it's legit. I've only seen this in a few logs… but eventually you'll run into it. Let me know what you find
Post #30
Yes… it's a doggie. Cute little thing too… I was going to shoot it. But he lives… Think I'll be unloading Trend micro in the coming days and moving over to Norton Anti-Virus.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI