Smitfraudfix discovered Rootkit

Download RustBFix and save it to your Desktop.

• Double click on rustbfix.exe to run the tool.
• If a Rustock.b-infection is found, you will be asked to reboot the computer. The reboot will probably take quite a while, and perhaps 2 reboots will be needed. But this will happen automatically.
• After the reboot 2 logfiles will open (%root%\avenger.txt and %root%\rustbfix\pelog.txt). (Where %root% is the root drive for your computer, usually the C:\ drive).
• Save these logs.

Download ADS Spy and unzip it to your Desktop.

• Double Click ADSSpy.exe to lauch it.
• Select Full Scan (all NTFS Drives).
• Click Scan the system for alternate data streams.
• Once the scan is complete, select all instances of C:\WINDOWS\system32:lzx32.sys and click Remove selected streams if listed.
• Exit AdsSpy.

Please go HERE and do a online scan
Let me know what was found when you post back the results below.



Now can you send me the following logs please:

• C:\avenger.txt
• C:\rustbfix\pelog.txt
• What was found with the online scan.
• A new HJT log.

How are you doing with the fix?

I've done the RustB Fix and the ADSFix and I've downloaded the file for the online scan but haven't run it yet…. Unfortunately my schedule and my neighbours schedule havent coincided very well lately. I should be able to run the online scan on Wednesday (Sydney time). So I'll post all of the results then. I have told them not to use the PC in the mean time.

LD, I'm trying to download the component of the online scanner. Component: F-Secure Anti-Virus Update 2007-02-08_01 And it's showing the size of 21Mb (approximately) but so far has downloaded 27Mb. Is this a normal thing? I've checked the folder that it's located in c:\documents and settings\username\local settings\temp\online scanner and so far it's over 62Mb. But so far it hasn't run a scan at all.

Are you downloading the program? It should be doing a online scan.

When I clicked on the link and then clicked Start Scanning it showed a popup box with a side panel on the righthand side which says: 1 - License Terms 2 - Scanning Options 3 - Downloading 4 - Scanning 5 - Cleaning 6 - Finish as it said that it needed to download the Active X program before it would run it. Which is what It's trying to do. I've also tried it on my laptop as well and it's doing the same thing (Though a lot faster as I have ADSL and they have dialup).

You can stop it then: Post the: C:\avenger.txt C:\rustbfix\pelog.txt A new HJT log.

The Online scanner found 761 viruses 1 hidden file and 14 pieces of malware. Stealth_file (C:\WINDOWS\SYSTEM32\WINCOM32.INI) NoneDisinfectRenameDelete Email-Worm.Win32.Zhelatin.d (C:\WINDOWS\SYSTEM32\WINCOM32.SYS) NoneDisinfectRenameDelete Email-Worm.Win32.Luder.a (C:\WINDOWS\ALCRMV.EXE) NoneDisinfectRenameDelete Email-Worm.Win32.Luder.a (C:\WINDOWS\ALCUPD.EXE) NoneDisinfectRenameDelete Email-Worm.Win32.Luder.a (C:\WINDOWS\BJPSUNST.EXE) NoneDisinfectRenameDelete Backdoor.Win32.Agent.tk (C:\WINDOWS\TYPE32W.EXE) NoneDisinfectRenameDelete Email-Worm.Win32.Luder.a (C:\WINDOWS\TWAIN_32\QUICKCAM\HVIDEOS…) NoneDisinfectRenameDelete Email-Worm.Win32.Luder.a (C:\WINDOWS\TEMP\ALCUPD.EXE) Email-Worm.Win32.Mixor.a (C:\WINDOWS\TEMP\CHCFG.EXE) NoneDisinfectRenameDelete Trojan-Downloader.Win32.Small.dam (C:\WINDOWS\TEMP\TEMPORARY INTERNET F…) NoneDisinfectRenameDelete Trojan-Proxy.Win32.Dlena.ap (C:\WINDOWS\SYSTEM32\2151312LD.EXE) NoneDisinfectRenameDelete Trojan-Downloader.Win32.Small.cyn (C:\WINDOWS\SYSTEM32\24438902LD.EXE) NoneDisinfectRenameDelete Trojan-Proxy.Win32.Dlena.ap (C:\WINDOWS\SYSTEM32\28179062LD.EXE) NoneDisinfectRenameDelete Trojan-Proxy.Win32.Dlena.ap (C:\WINDOWS\SYSTEM32\32311252LD.EXE) NoneDisinfectRenameDelete Trojan-Proxy.Win32.Dlena.ap (C:\WINDOWS\SYSTEM32\42261712LD.EXE) NoneDisinfectRenameDelete Email-Worm.Win32.Luder.a (C:\WINDOWS\SYSTEM32\A0DJG7X.EXE) NoneDisinfectRenameDelete Email-Worm.Win32.Luder.a (C:\WINDOWS\SYSTEM32\A0JDBQI.EXE) NoneDisinfectRenameDelete Email-Worm.Win32.Luder.a (C:\WINDOWS\SYSTEM32\A8DLCH1.EXE) NoneDisinfectRenameDelete Trojan-Downloader.Win32.Tibs.kj (C:\WINDOWS\SYSTEM32\AB.EXE) NoneDisinfectRenameDelete Trojan-Downloader.Win32.Tibs.kj (C:\WINDOWS\SYSTEM32\AC.EXE) NoneDisinfectRenameDelete Trojan-Downloader.Win32.Tibs.kj (C:\WINDOWS\SYSTEM32\AD.EXE) NoneDisinfectRenameDelete Email-Worm.Win32.Banwarum.f (C:\WINDOWS\SYSTEM32\ADIR.DLL) NoneDisinfectRenameDelete Trojan-Proxy.Win32.Lager.fa (C:\WINDOWS\SYSTEM32\ADIRSS.EXE) NoneDisinfectRenameDelete Trojan-Downloader.Win32.Tibs.kj (C:\WINDOWS\SYSTEM32\AE.EXE) Email-Worm.Win32.Luder.a (C:\WINDOWS\SYSTEM32\AE6D728.EXE) NoneDisinfectRenameDelete Email-Worm.Win32.Luder.a (C:\WINDOWS\SYSTEM32\AGTSXWW.EXE) NoneDisinfectRenameDelete Email-Worm.Win32.Luder.a (C:\WINDOWS\SYSTEM32\ALSYS.EXE) NoneDisinfectRenameDelete Trojan-PSW.Win32.LdPinch.sh (C:\WINDOWS\SYSTEM32\ASPI2024711.EXE) NoneDisinfectRenameDelete Email-Worm.Win32.Luder.a (C:\WINDOWS\SYSTEM32\AUNKTKB.EXE) NoneDisinfectRenameDelete Email-Worm.Win32.Luder.a (C:\WINDOWS\SYSTEM32\B1AQ7X1.EXE) NoneDisinfectRenameDelete Email-Worm.Win32.Luder.a (C:\WINDOWS\SYSTEM32\B5U67NQ.EXE) NoneDisinfectRenameDelete Email-Worm.Win32.Luder.a (C:\WINDOWS\SYSTEM32\BC542XF.EXE) Email-Worm.Win32.Luder.a (C:\WINDOWS\SYSTEM32\BC7M.EXE) NoneDisinfectRenameDelete Email-Worm.Win32.Luder.a (C:\WINDOWS\SYSTEM32\BFRP1O8.EXE) NoneDisinfectRenameDelete Email-Worm.Win32.Luder.a (C:\WINDOWS\SYSTEM32\BKO8QM5.EXE) NoneDisinfectRenameDelete Email-Worm.Win32.Mixor.a (C:\WINDOWS\SYSTEM32\CHCFG.EXE) NoneDisinfectRenameDelete Email-Worm.Win32.Luder.a (C:\WINDOWS\SYSTEM32\CIO7GCP.EXE) NoneDisinfectRenameDelete Email-Worm.Win32.Luder.a (C:\WINDOWS\SYSTEM32\CLICONFG.EXE) NoneDisinfectRenameDelete Email-Worm.Win32.Luder.a (C:\WINDOWS\SYSTEM32\CO71F7E.EXE) NoneDisinfectRenameDelete Email-Worm.Win32.Luder.a (C:\WINDOWS\SYSTEM32\CQ8NK7G.EXE) Email-Worm.Win32.Luder.a (C:\WINDOWS\SYSTEM32\CUFBQF5.EXE) NoneDisinfectRenameDelete Email-Worm.Win32.Luder.a (C:\WINDOWS\SYSTEM32\CV6VW84.EXE) NoneDisinfectRenameDelete Email-Worm.Win32.Luder.a (C:\WINDOWS\SYSTEM32\D0NKK6U.EXE) NoneDisinfectRenameDelete Email-Worm.Win32.Luder.a (C:\WINDOWS\SYSTEM32\D105VJC.EXE) NoneDisinfectRenameDelete Email-Worm.Win32.Luder.a (C:\WINDOWS\SYSTEM32\D3P27HF.EXE) NoneDisinfectRenameDelete Email-Worm.Win32.Luder.a (C:\WINDOWS\SYSTEM32\DA25QPR.EXE) NoneDisinfectRenameDelete Email-Worm.Win32.Luder.a (C:\WINDOWS\SYSTEM32\DBTDWAW.EXE) NoneDisinfectRenameDelete Email-Worm.Win32.Luder.a (C:\WINDOWS\SYSTEM32\DHW8I51.EXE) Email-Worm.Win32.Luder.a (C:\WINDOWS\SYSTEM32\DO134Q1.EXE) NoneDisinfectRenameDelete Email-Worm.Win32.Luder.a (C:\WINDOWS\SYSTEM32\DÿH3X77.EXE) NoneDisinfectRenameDelete Email-Worm.Win32.Luder.a (C:\WINDOWS\SYSTEM32\E51O0A4.EXE) NoneDisinfectRenameDelete Email-Worm.Win32.Luder.a (C:\WINDOWS\SYSTEM32\E5607V7.EXE) NoneDisinfectRenameDelete Email-Worm.Win32.Luder.a (C:\WINDOWS\SYSTEM32\EVM21O0.EXE) NoneDisinfectRenameDelete Email-Worm.Win32.Luder.a (C:\WINDOWS\SYSTEM32\F8EP2EU.EXE) NoneDisinfectRenameDelete Email-Worm.Win32.Luder.a (C:\WINDOWS\SYSTEM32\FD51WA8.EXE) NoneDisinfectRenameDelete Email-Worm.Win32.Luder.a (C:\WINDOWS\SYSTEM32\FH8J8A8.EXE) W32/Agent.ATMO (C:\WINDOWS\SYSTEM32\FMYINDZ.DLL) NoneDisinfectRenameDelete Email-Worm.Win32.Luder.a (C:\WINDOWS\SYSTEM32\FPKGD8J.EXE) NoneDisinfectRenameDelete Email-Worm.Win32.Luder.a (C:\WINDOWS\SYSTEM32\FUM44V1.EXE) NoneDisinfectRenameDelete Trojan-Downloader.Win32.Tibs.kj (C:\WINDOWS\SYSTEM32\GA03J82.EXE) NoneDisinfectRenameDelete Trojan-Downloader.Win32.Small.ciw (C:\WINDOWS\SYSTEM32\GAME.EXE) NoneDisinfectRenameDelete Trojan-Proxy.Win32.Lager.dp (C:\WINDOWS\SYSTEM32\GAME0.EXE) NoneDisinfectRenameDelete Trojan-Downloader.Win32.Small.dam (C:\WINDOWS\SYSTEM32\GAME0.EXE.EXE) NoneDisinfectRenameDelete Trojan-Proxy.Win32.Lager.fa (C:\WINDOWS\SYSTEM32\GAME1.EXE) W32/Tibs.gen27 (C:\WINDOWS\SYSTEM32\GAME2.EXE) NoneDisinfectRenameDelete W32/Tibs.gen27 (C:\WINDOWS\SYSTEM32\GAME3.EXE) NoneDisinfectRenameDelete Email-Worm.Win32.Banwarum.f (C:\WINDOWS\SYSTEM32\GAME4.EXE) NoneDisinfectRenameDelete Trojan-Proxy.Win32.Lager.dp (C:\WINDOWS\SYSTEM32\GAME5.EXE) NoneDisinfectRenameDelete Email-Worm.Win32.Luder.a (C:\WINDOWS\SYSTEM32\GB0LA2F.EXE) NoneDisinfectRenameDelete Email-Worm.Win32.Luder.a (C:\WINDOWS\SYSTEM32\GFW84EL.EXE) NoneDisinfectRenameDelete Email-Worm.Win32.Banwarum.f (C:\WINDOWS\SYSTEM32\GOOGLE.PNG.EXE) NoneDisinfectRenameDelete Email-Worm.Win32.Luder.a (C:\WINDOWS\SYSTEM32\GRU5TPJ.EXE) Email-Worm.Win32.Luder.a (C:\WINDOWS\SYSTEM32\GVKVCSK.EXE) NoneDisinfectRenameDelete Email-Worm.Win32.Luder.a (C:\WINDOWS\SYSTEM32\H26134U.EXE) NoneDisinfectRenameDelete Email-Worm.Win32.Luder.a (C:\WINDOWS\SYSTEM32\H3OPXKD.EXE) NoneDisinfectRenameDelete Email-Worm.Win32.Luder.a (C:\WINDOWS\SYSTEM32\H6E05MR.EXE) NoneDisinfectRenameDelete Email-Worm.Win32.Luder.a (C:\WINDOWS\SYSTEM32\H77WPQ1.EXE) NoneDisinfectRenameDelete Email-Worm.Win32.Luder.a (C:\WINDOWS\SYSTEM32\H8J5J13.EXE) NoneDisinfectRenameDelete Email-Worm.Win32.Luder.a (C:\WINDOWS\SYSTEM32\HFASEJW.EXE) NoneDisinfectRenameDelete Email-Worm.Win32.Luder.a (C:\WINDOWS\SYSTEM32\HIVXJC5.EXE) Email-Worm.Win32.Luder.a (C:\WINDOWS\SYSTEM32\HKQ7D7M.EXE) NoneDisinfectRenameDelete Trojan-Downloader.Win32.Small.ciw (C:\WINDOWS\SYSTEM32\HRM41WR.EXE) NoneDisinfectRenameDelete Email-Worm.Win32.Luder.a (C:\WINDOWS\SYSTEM32\HT6B582.EXE) NoneDisinfectRenameDelete Email-Worm.Win32.Luder.a (C:\WINDOWS\SYSTEM32\I03EGK8.EXE) NoneDisinfectRenameDelete Email-Worm.Win32.Luder.a (C:\WINDOWS\SYSTEM32\I580SFN.EXE) NoneDisinfectRenameDelete Email-Worm.Win32.Luder.a (C:\WINDOWS\SYSTEM32\I8A0PLX.EXE) NoneDisinfectRenameDelete Email-Worm.Win32.Luder.a (C:\WINDOWS\SYSTEM32\IITS0DX.EXE) NoneDisinfectRenameDelete Email-Worm.Win32.Luder.a (C:\WINDOWS\SYSTEM32\IO6ELOH.EXE) mail-Worm.Win32.Luder.a (C:\WINDOWS\SYSTEM32\JAVA.EXE) NoneDisinfectRenameDelete Email-Worm.Win32.Luder.a (C:\WINDOWS\SYSTEM32\JAVAW.EXE) NoneDisinfectRenameDelete Email-Worm.Win32.Luder.a (C:\WINDOWS\SYSTEM32\JVROFFC.EXE) NoneDisinfectRenameDelete Email-Worm.Win32.Luder.a (C:\WINDOWS\SYSTEM32\JWV7X06.EXE) NoneDisinfectRenameDelete Email-Worm.Win32.Luder.a (C:\WINDOWS\SYSTEM32\K3063IU.EXE) NoneDisinfectRenameDelete Email-Worm.Win32.Luder.a (C:\WINDOWS\SYSTEM32\K5ALV18.EXE) NoneDisinfectRenameDelete Email-Worm.Win32.Luder.a (C:\WINDOWS\SYSTEM32\K7004NR.EXE) NoneDisinfectRenameDelete Trojan-Downloader.Win32.Tibs.ir (C:\WINDOWS\SYSTEM32\KERNELS8.EXE) Email-Worm.Win32.Luder.a (C:\WINDOWS\SYSTEM32\L7OK438.EXE) NoneDisinfectRenameDelete Email-Worm.Win32.Luder.a (C:\WINDOWS\SYSTEM32\L8OMPB4.EXE) NoneDisinfectRenameDelete Email-Worm.Win32.Luder.a (C:\WINDOWS\SYSTEM32\LFQ5IQ2.EXE) NoneDisinfectRenameDelete Email-Worm.Win32.Luder.a (C:\WINDOWS\SYSTEM32\LJLH7VA.EXE) NoneDisinfectRenameDelete Email-Worm.Win32.Luder.a (C:\WINDOWS\SYSTEM32\LMHFP5D.EXE) NoneDisinfectRenameDelete Trojan-Proxy.Win32.Lager.dp (C:\WINDOWS\SYSTEM32\LNWIN.EXE) NoneDisinfectRenameDelete Email-Worm.Win32.Luder.a (C:\WINDOWS\SYSTEM32\M45L4T4.EXE) NoneDisinfectRenameDelete Email-Worm.Win32.Luder.a (C:\WINDOWS\SYSTEM32\M7WT3JV.EXE) Email-Worm.Win32.Luder.a (C:\WINDOWS\SYSTEM32\MB2RLWX.EXE) NoneDisinfectRenameDelete Email-Worm.Win32.Luder.a (C:\WINDOWS\SYSTEM32\MDPSRQ3.EXE) NoneDisinfectRenameDelete Email-Worm.Win32.Luder.a (C:\WINDOWS\SYSTEM32\MEX74QI.EXE) NoneDisinfectRenameDelete Email-Worm.Win32.Luder.a (C:\WINDOWS\SYSTEM32\MIO6I1P.EXE) NoneDisinfectRenameDelete Email-Worm.Win32.Luder.a (C:\WINDOWS\SYSTEM32\MJBLEIE.EXE) NoneDisinfectRenameDelete Email-Worm.Win32.Luder.a (C:\WINDOWS\SYSTEM32\MU4M65Q.EXE) NoneDisinfectRenameDelete Email-Worm.Win32.Luder.a (C:\WINDOWS\SYSTEM32\N0DDE63.EXE) NoneDisinfectRenameDelete Email-Worm.Win32.Luder.a (C:\WINDOWS\SYSTEM32\N27QF30.EXE) Email-Worm.Win32.Luder.a (C:\WINDOWS\SYSTEM32\N2IRJQO.EXE) NoneDisinfectRenameDelete Email-Worm.Win32.Luder.a (C:\WINDOWS\SYSTEM32\N36KF87.EXE) NoneDisinfectRenameDelete Email-Worm.Win32.Luder.a (C:\WINDOWS\SYSTEM32\N600CXM.EXE) NoneDisinfectRenameDelete Email-Worm.Win32.Luder.a (C:\WINDOWS\SYSTEM32\NPVS6P2.EXE) NoneDisinfectRenameDelete Email-Worm.Win32.Luder.a (C:\WINDOWS\SYSTEM32\NTW8XL4.EXE) NoneDisinfectRenameDelete Email-Worm.Win32.Luder.a (C:\WINDOWS\SYSTEM32\O54UIK0.EXE) NoneDisinfectRenameDelete Email-Worm.Win32.Luder.a (C:\WINDOWS\SYSTEM32\O7EF7PI.EXE) NoneDisinfectRenameDelete Email-Worm.Win32.Luder.a (C:\WINDOWS\SYSTEM32\OF23PBR.EXE) Email-Worm.Win32.Luder.a (C:\WINDOWS\SYSTEM32\OHAX1KD.EXE) NoneDisinfectRenameDelete Email-Worm.Win32.Luder.a (C:\WINDOWS\SYSTEM32\PH54CMS.EXE) NoneDisinfectRenameDelete Email-Worm.Win32.Luder.a (C:\WINDOWS\SYSTEM32\PH582S0.EXE) NoneDisinfectRenameDelete Email-Worm.Win32.Luder.a (C:\WINDOWS\SYSTEM32\PÿLADEO.EXE) NoneDisinfectRenameDelete Email-Worm.Win32.Luder.a (C:\WINDOWS\SYSTEM32\Q58CO3F.EXE) NoneDisinfectRenameDelete Email-Worm.Win32.Zhelatin.d (C:\WINDOWS\SYSTEM32\Q85A3RR.EXE) NoneDisinfectRenameDelete Email-Worm.Win32.Luder.a (C:\WINDOWS\SYSTEM32\QC2D06L.EXE) NoneDisinfectRenameDelete Email-Worm.Win32.Luder.a (C:\WINDOWS\SYSTEM32\R20JRHF.EXE) Email-Worm.Win32.Luder.a (C:\WINDOWS\SYSTEM32\RCV8SHS.EXE) NoneDisinfectRenameDelete Email-Worm.Win32.Luder.a (C:\WINDOWS\SYSTEM32\RFPCCVP.EXE) NoneDisinfectRenameDelete Email-Worm.Win32.Luder.a (C:\WINDOWS\SYSTEM32\RMGUKUB.EXE) NoneDisinfectRenameDelete Trojan.Win32.Spabot.ai (C:\WINDOWS\SYSTEM32\RPCC.DLL) NoneDisinfectRenameDelete Email-Worm.Win32.Luder.a (C:\WINDOWS\SYSTEM32\RUEJAGT.EXE) NoneDisinfectRenameDelete Email-Worm.Win32.Luder.a (C:\WINDOWS\SYSTEM32\RWQ44FV.EXE) NoneDisinfectRenameDelete Email-Worm.Win32.Luder.a (C:\WINDOWS\SYSTEM32\S17TD31.EXE) NoneDisinfectRenameDelete Email-Worm.Win32.Luder.a (C:\WINDOWS\SYSTEM32\S2US66J.EXE) Email-Worm.Win32.Luder.a (C:\WINDOWS\SYSTEM32\SB4TLXP.EXE) NoneDisinfectRenameDelete Email-Worm.Win32.Luder.a (C:\WINDOWS\SYSTEM32\SC05MCU.EXE) NoneDisinfectRenameDelete Trojan-Downloader.Win32.Small.dam (C:\WINDOWS\SYSTEM32\SE.EXE) NoneDisinfectRenameDelete Email-Worm.Win32.Luder.a (C:\WINDOWS\SYSTEM32\SELIWF0.EXE) NoneDisinfectRenameDelete Email-Worm.Win32.Luder.a (C:\WINDOWS\SYSTEM32\SL0FSUG.EXE) NoneDisinfectRenameDelete Email-Worm.Win32.Luder.a (C:\WINDOWS\SYSTEM32\SMLW0K2.EXE) NoneDisinfectRenameDelete Email-Worm.Win32.Luder.a (C:\WINDOWS\SYSTEM32\SP7846A.EXE) NoneDisinfectRenameDelete Email-Worm.Win32.Luder.a (C:\WINDOWS\SYSTEM32\SQ8WBDH.EXE) Trojan-Downloader.Win32.Small.dam (C:\WINDOWS\SYSTEM32\SS.EXE) NoneDisinfectRenameDelete Email-Worm.Win32.Luder.a (C:\WINDOWS\SYSTEM32\SU0.EXE) NoneDisinfectRenameDelete W32/DLoader.BYWD (C:\WINDOWS\SYSTEM32\SVCHC7P.EXE) NoneDisinfectRenameDelete Trojan-Downloader.Win32.Small.dam (C:\WINDOWS\SYSTEM32\SYSPOOLS.EXE) NoneDisinfectRenameDelete Trojan-Downloader.Win32.Small.cyn (C:\WINDOWS\SYSTEM32\SYST337.DLL) NoneDisinfectRenameDelete Email-Worm.Win32.Luder.a (C:\WINDOWS\SYSTEM32\T3W5VDU.EXE) NoneDisinfectRenameDelete Email-Worm.Win32.Luder.a (C:\WINDOWS\SYSTEM32\T8OESI1.EXE) NoneDisinfectRenameDelete Trojan-Downloader.Win32.Tibs.kj (C:\WINDOWS\SYSTEM32\TASKDIR.EXE) Trojan-Downloader.Win32.Small.crd (C:\WINDOWS\SYSTEM32\TMP_0.EXE) NoneDisinfectRenameDelete Trojan-Downloader.Win32.Small.cyn (C:\WINDOWS\SYSTEM32\TMP_608.DLL) NoneDisinfectRenameDelete Trojan-Downloader.Win32.Small.crd (C:\WINDOWS\SYSTEM32\TMP_8.DLL) NoneDisinfectRenameDelete Trojan-Downloader.Win32.Small.cyn (C:\WINDOWS\SYSTEM32\TMP_C4Q.EXE) NoneDisinfectRenameDelete Email-Worm.Win32.Luder.a (C:\WINDOWS\SYSTEM32\TW2L3QR.EXE) NoneDisinfectRenameDelete Email-Worm.Win32.Luder.a (C:\WINDOWS\SYSTEM32\U25TMPQ.EXE) NoneDisinfectRenameDelete Email-Worm.Win32.Luder.a (C:\WINDOWS\SYSTEM32\UEKKT60.EXE) NoneDisinfectRenameDelete Email-Worm.Win32.Luder.a (C:\WINDOWS\SYSTEM32\UG4EU08.EXE) Email-Worm.Win32.Luder.a (C:\WINDOWS\SYSTEM32\UK0G367.EXE) NoneDisinfectRenameDelete Email-Worm.Win32.Luder.a (C:\WINDOWS\SYSTEM32\ULDB7CM.EXE) NoneDisinfectRenameDelete Email-Worm.Win32.Luder.a (C:\WINDOWS\SYSTEM32\ULGC4X4.EXE) NoneDisinfectRenameDelete Email-Worm.Win32.Luder.a (C:\WINDOWS\SYSTEM32\USE0PR4.EXE) NoneDisinfectRenameDelete Email-Worm.Win32.Luder.a (C:\WINDOWS\SYSTEM32\USWL1WF.EXE) NoneDisinfectRenameDelete Email-Worm.Win32.Luder.a (C:\WINDOWS\SYSTEM32\UTH72EA.EXE) NoneDisinfectRenameDelete Email-Worm.Win32.Luder.a (C:\WINDOWS\SYSTEM32\VCP.EXE) NoneDisinfectRenameDelete Email-Worm.Win32.Luder.a (C:\WINDOWS\SYSTEM32\VHV7NIR.EXE) Email-Worm.Win32.Luder.a (C:\WINDOWS\SYSTEM32\VIQ3BHT.EXE) NoneDisinfectRenameDelete Email-Worm.Win32.Luder.a (C:\WINDOWS\SYSTEM32\VNI4DGC.EXE) NoneDisinfectRenameDelete Email-Worm.Win32.Luder.a (C:\WINDOWS\SYSTEM32\VP8QGEJ.EXE) NoneDisinfectRenameDelete Email-Worm.Win32.Luder.a (C:\WINDOWS\SYSTEM32\VRFCI82.EXE) NoneDisinfectRenameDelete Email-Worm.Win32.Luder.a (C:\WINDOWS\SYSTEM32\VXDRMWN.EXE) NoneDisinfectRenameDelete Trojan-Downloader.Win32.Small.cpt (C:\WINDOWS\SYSTEM32\VXG3AM1ET3.EXE) NoneDisinfectRenameDelete Email-Worm.Win32.Banwarum.f (C:\WINDOWS\SYSTEM32\VXG4AM1ET2.EXE) NoneDisinfectRenameDelete Trojan-Downloader.Win32.Small.dzd (C:\WINDOWS\SYSTEM32\VXG6AME4.EXE) Trojan-Proxy.Win32.Agent.ji (C:\WINDOWS\SYSTEM32\VXGA4M1ET4.EXE) NoneDisinfectRenameDelete Trojan.Win32.Agent.oh (C:\WINDOWS\SYSTEM32\VXGA4ME1.EXE) NoneDisinfectRenameDelete Trojan-Downloader.Win32.Small.coy (C:\WINDOWS\SYSTEM32\VXGA5ME3.EXE) NoneDisinfectRenameDelete Trojan-Downloader.Win32.Small.dam (C:\WINDOWS\SYSTEM32\W.EXE) NoneDisinfectRenameDelete Email-Worm.Win32.Luder.a (C:\WINDOWS\SYSTEM32\W3MRV5K.EXE) NoneDisinfectRenameDelete Email-Worm.Win32.Luder.a (C:\WINDOWS\SYSTEM32\W8OMU0V.EXE) NoneDisinfectRenameDelete Email-Worm.Win32.Luder.a (C:\WINDOWS\SYSTEM32\WBTECQX.EXE) NoneDisinfectRenameDelete Email-Worm.Win32.Luder.a (C:\WINDOWS\SYSTEM32\WE1D04E.EXE) Email-Worm.Win32.Luder.a (C:\WINDOWS\SYSTEM32\X42F14E.EXE) NoneDisinfectRenameDelete Email-Worm.Win32.Zhelatin.d (C:\WINDOWS\SYSTEM32\X637B5U.EXE) NoneDisinfectRenameDelete Email-Worm.Win32.Luder.a (C:\WINDOWS\SYSTEM32\X83DGHS.EXE) NoneDisinfectRenameDelete Email-Worm.Win32.Luder.a (C:\WINDOWS\SYSTEM32\XJ8EHC4.EXE) NoneDisinfectRenameDelete Email-Worm.Win32.Mixor.a (C:\WINDOWS\SYSTEM32\SPOOL\DRIVERS\W3…) NoneDisinfectRenameDelete W32/Luder.A (C:\WINDOWS\SYSTEM32\SPOOL\DRIVERS\W3…) NoneDisinfectRenameDelete Email-Worm.Win32.Mixor.a (C:\WINDOWS\SYSTEM32\SPOOL\DRIVERS\W3…) NoneDisinfectRenameDelete W32/Luder.A (C:\WINDOWS\SYSTEM32\SPOOL\DRIVERS\W3…) Email-Worm.Win32.Luder.a (C:\WINDOWS\SYSTEM32\MACROMED\FLASH\G…) NoneDisinfectRenameDelete Email-Worm.Win32.Luder.a (C:\WINDOWS\SYSTEM32\DLLCACHE\ADMIN.E…) NoneDisinfectRenameDelete Email-Worm.Win32.Mixor.a (C:\WINDOWS\SYSTEM32\DLLCACHE\AGENTSV…) NoneDisinfectRenameDelete Email-Worm.Win32.Mixor.a (C:\WINDOWS\SYSTEM32\DLLCACHE\ALG.EXE) NoneDisinfectRenameDelete Email-Worm.Win32.Mixor.a (C:\WINDOWS\SYSTEM32\DLLCACHE\ATTRIB….) NoneDisinfectRenameDelete Email-Worm.Win32.Luder.a (C:\WINDOWS\SYSTEM32\DLLCACHE\AUTHOR….) NoneDisinfectRenameDelete Email-Worm.Win32.Mixor.a (C:\WINDOWS\SYSTEM32\DLLCACHE\AUTOCON…) NoneDisinfectRenameDelete Email-Worm.Win32.Mixor.a (C:\WINDOWS\SYSTEM32 W32/Luder.A (C:\WINDOWS\SYSTEM32\DLLCACHE\BOOTOK….) NoneDisinfectRenameDelete Email-Worm.Win32.Mixor.a (C:\WINDOWS\SYSTEM32\DLLCACHE\CACLS.E…) NoneDisinfectRenameDelete Email-Worm.Win32.Mixor.a (C:\WINDOWS\SYSTEM32\DLLCACHE\CALC.EX…) NoneDisinfectRenameDelete Email-Worm.Win32.Luder.a (C:\WINDOWS\SYSTEM32\DLLCACHE\CB32.EX…) NoneDisinfectRenameDelete Email-Worm.Win32.Luder.a (C:\WINDOWS\SYSTEM32\DLLCACHE\CFGWIZ….) NoneDisinfectRenameDelete Email-Worm.Win32.Mixor.a (C:\WINDOWS\SYSTEM32\DLLCACHE\CHANGE….) NoneDisinfectRenameDelete Email-Worm.Win32.Mixor.a (C:\WINDOWS\SYSTEM32\DLLCACHE\CHKDSK….) NoneDisinfectRenameDelete Email-Worm.Win32.Mixor.a (C:\WINDOWS\SYSTEM32 W32/Luder.A (C:\WINDOWS\SYSTEM32\DLLCACHE\CISVC.E…) NoneDisinfectRenameDelete Email-Worm.Win32.Mixor.a (C:\WINDOWS\SYSTEM32\DLLCACHE\CLEANMG…) NoneDisinfectRenameDelete Email-Worm.Win32.Mixor.a (C:\WINDOWS\SYSTEM32\DLLCACHE\CMDL32….) NoneDisinfectRenameDelete Email-Worm.Win32.Mixor.a (C:\WINDOWS\SYSTEM32\DLLCACHE\COMP.EX…) NoneDisinfectRenameDelete Email-Worm.Win32.Luder.a (C:\WINDOWS\SYSTEM32\DLLCACHE\CONF.EX…) NoneDisinfectRenameDelete Email-Worm.Win32.Mixor.a (C:\WINDOWS\SYSTEM32\DLLCACHE\CONIME….) NoneDisinfectRenameDelete Email-Worm.Win32.Mixor.a (C:\WINDOWS\SYSTEM32\DLLCACHE\CONTROL…) NoneDisinfectRenameDelete Email-Worm.Win32.Mixor.a (C:\WINDOWS\SYSTEM32 Email-Worm.Win32.Mixor.a (C:\WINDOWS\SYSTEM32\DLLCACHE\CPROFIL…) NoneDisinfectRenameDelete Email-Worm.Win32.Luder.a (C:\WINDOWS\SYSTEM32\DLLCACHE\CSCRIPT…) NoneDisinfectRenameDelete W32/Luder.A (C:\WINDOWS\SYSTEM32\DLLCACHE\CSRSS.E…) NoneDisinfectRenameDelete Email-Worm.Win32.Mixor.a (C:\WINDOWS\SYSTEM32\DLLCACHE\CTFMON….) NoneDisinfectRenameDelete Email-Worm.Win32.Mixor.a (C:\WINDOWS\SYSTEM32\DLLCACHE\DEFRAG….) NoneDisinfectRenameDelete Email-Worm.Win32.Mixor.a (C:\WINDOWS\SYSTEM32\DLLCACHE\DFRGFAT…) NoneDisinfectRenameDelete Email-Worm.Win32.Mixor.a (C:\WINDOWS\SYSTEM32\DLLCACHE\DISKPER…) NoneDisinfectRenameDelete Email-Worm.Win32.Mixor.a (C:\WINDOWS\SYSTEM32 Email-Worm.Win32.Mixor.a (C:\WINDOWS\SYSTEM32\DLLCACHE\DRWTSN3…) NoneDisinfectRenameDelete Email-Worm.Win32.Luder.a (C:\WINDOWS\SYSTEM32\DLLCACHE\DWWIN.E…) NoneDisinfectRenameDelete Email-Worm.Win32.Mixor.a (C:\WINDOWS\SYSTEM32\DLLCACHE\EUDCEDI…) NoneDisinfectRenameDelete Email-Worm.Win32.Mixor.a (C:\WINDOWS\SYSTEM32\DLLCACHE\EXPAND….) NoneDisinfectRenameDelete Email-Worm.Win32.Mixor.a (C:\WINDOWS\SYSTEM32\DLLCACHE\EXPLORE…) NoneDisinfectRenameDelete W32/Luder.A (C:\WINDOWS\SYSTEM32\DLLCACHE\FINGER….) NoneDisinfectRenameDelete W32/Luder.A (C:\WINDOWS\SYSTEM32\DLLCACHE\FIXMAPI…) NoneDisinfectRenameDelete Email-Worm.Win32.Mixor.a (C:\WINDOWS\SYSTEM32 Email-Worm.Win32.Mixor.a (C:\WINDOWS\SYSTEM32\DLLCACHE\FONTVIE…) NoneDisinfectRenameDelete W32/Luder.A (C:\WINDOWS\SYSTEM32\DLLCACHE\FORCEDO…) NoneDisinfectRenameDelete Email-Worm.Win32.Luder.a (C:\WINDOWS\SYSTEM32\DLLCACHE\FPADMCG…) NoneDisinfectRenameDelete Email-Worm.Win32.Luder.a (C:\WINDOWS\SYSTEM32\DLLCACHE\FPCOUNT…) NoneDisinfectRenameDelete Email-Worm.Win32.Luder.a (C:\WINDOWS\SYSTEM32\DLLCACHE\FPREMAD…) NoneDisinfectRenameDelete Email-Worm.Win32.Mixor.a (C:\WINDOWS\SYSTEM32\DLLCACHE\FSUTIL….) NoneDisinfectRenameDelete Email-Worm.Win32.Mixor.a (C:\WINDOWS\SYSTEM32\DLLCACHE\FXSCOVE…) NoneDisinfectRenameDelete Email-Worm.Win32.Mixor.a (C:\WINDOWS\SYSTEM32 Email-Worm.Win32.Mixor.a (C:\WINDOWS\SYSTEM32\DLLCACHE\HELPCTR…) NoneDisinfectRenameDelete W32/Luder.A (C:\WINDOWS\SYSTEM32\DLLCACHE\HH.EXE) NoneDisinfectRenameDelete Email-Worm.Win32.Mixor.a (C:\WINDOWS\SYSTEM32\DLLCACHE\HRTZZM….) NoneDisinfectRenameDelete Email-Worm.Win32.Luder.a (C:\WINDOWS\SYSTEM32\DLLCACHE\ICWCONN…) NoneDisinfectRenameDelete Email-Worm.Win32.Luder.a (C:\WINDOWS\SYSTEM32\DLLCACHE\ICWRMIN…) NoneDisinfectRenameDelete Email-Worm.Win32.Mixor.a (C:\WINDOWS\SYSTEM32\DLLCACHE\IE4UINI…) NoneDisinfectRenameDelete Email-Worm.Win32.Mixor.a (C:\WINDOWS\SYSTEM32\DLLCACHE\IMEKRMI…) NoneDisinfectRenameDelete Email-Worm.Win32.Luder.a (C:\WINDOWS\SYSTEM32 Email-Worm.Win32.Luder.a (C:\WINDOWS\SYSTEM32\DLLCACHE\IMJPDAD…) NoneDisinfectRenameDelete Email-Worm.Win32.Luder.a (C:\WINDOWS\SYSTEM32\DLLCACHE\IMJPDCT…) NoneDisinfectRenameDelete Email-Worm.Win32.Luder.a (C:\WINDOWS\SYSTEM32\DLLCACHE\IMJPDSV…) NoneDisinfectRenameDelete Email-Worm.Win32.Luder.a (C:\WINDOWS\SYSTEM32\DLLCACHE\IMJPINS…) NoneDisinfectRenameDelete Email-Worm.Win32.Luder.a (C:\WINDOWS\SYSTEM32\DLLCACHE\IMJPMIG…) NoneDisinfectRenameDelete Email-Worm.Win32.Luder.a (C:\WINDOWS\SYSTEM32\DLLCACHE\IMJPRW….) NoneDisinfectRenameDelete Email-Worm.Win32.Luder.a (C:\WINDOWS\SYSTEM32\DLLCACHE\IMJPUEX…) NoneDisinfectRenameDelete Email-Worm.Win32.Luder.a (C:\WINDOWS\SYSTEM32 Email-Worm.Win32.Mixor.a (C:\WINDOWS\SYSTEM32\DLLCACHE\IMSCINS…) NoneDisinfectRenameDelete Email-Worm.Win32.Luder.a (C:\WINDOWS\SYSTEM32\DLLCACHE\INETWIZ…) NoneDisinfectRenameDelete Email-Worm.Win32.Mixor.a (C:\WINDOWS\SYSTEM32\DLLCACHE\IPSEC6….) NoneDisinfectRenameDelete Email-Worm.Win32.Mixor.a (C:\WINDOWS\SYSTEM32\DLLCACHE\IPV6.EX…) NoneDisinfectRenameDelete Email-Worm.Win32.Luder.a (C:\WINDOWS\SYSTEM32\DLLCACHE\ISIGNUP…) NoneDisinfectRenameDelete Email-Worm.Win32.Mixor.a (C:\WINDOWS\SYSTEM32\DLLCACHE\LABEL.E…) NoneDisinfectRenameDelete Email-Worm.Win32.Mixor.a (C:\WINDOWS\SYSTEM32\DLLCACHE\LNKSTUB…) NoneDisinfectRenameDelete W32/Luder.A (C:\WINDOWS\SYSTEM32\DLLCACHE\LODCTR….) Email-Worm.Win32.Mixor.a (C:\WINDOWS\SYSTEM32\DLLCACHE\LOGMAN….) NoneDisinfectRenameDelete Email-Worm.Win32.Mixor.a (C:\WINDOWS\SYSTEM32\DLLCACHE\LOGON.S…) NoneDisinfectRenameDelete Email-Worm.Win32.Mixor.a (C:\WINDOWS\SYSTEM32\DLLCACHE\MAGNIFY…) NoneDisinfectRenameDelete Email-Worm.Win32.Mixor.a (C:\WINDOWS\SYSTEM32\DLLCACHE\MIGLOAD…) NoneDisinfectRenameDelete Email-Worm.Win32.Luder.a (C:\WINDOWS\SYSTEM32\DLLCACHE\MIGRATE…) NoneDisinfectRenameDelete Email-Worm.Win32.Mixor.a (C:\WINDOWS\SYSTEM32\DLLCACHE\MIGWIZ….) NoneDisinfectRenameDelete Email-Worm.Win32.Mixor.a (C:\WINDOWS\SYSTEM32\DLLCACHE\MIGWIZ_…) NoneDisinfectRenameDelete Email-Worm.Win32.Mixor.a (C:\WINDOWS\SYSTEM32 W32/Tibs.gen27 (C:\DOCUMENTS AND SETTINGS\LOCALSERVI…) NoneDisinfectRenameDelete Trojan-Proxy.Win32.Lager.fa (C:\DOCUMENTS AND SETTINGS\LOCALSERVI…) NoneDisinfectRenameDelete Trojan-Proxy.Win32.Lager.dp (C:\DOCUMENTS AND SETTINGS\LOCALSERVI…) NoneDisinfectRenameDelete Trojan-Downloader.Win32.Small.ciw (C:\DOCUMENTS AND SETTINGS\LOCALSERVI…) NoneDisinfectRenameDelete Trojan-Proxy.Win32.Lager.dp (C:\DOCUMENTS AND W32/Tibs.gen27 (C:\DOCUMENTS AND SETTINGS\LOCALSERVI…) NoneDisinfectRenameDelete Email-Worm.Win32.Banwarum.f (C:\DOCUMENTS AND Trojan-Downloader.Win32.Small.dam (C:\DOCUMENTS AND SETTINGS\FIONA Trojan-Downloader.Win32.Small.dam (C:\DOCUMENTS AND SETTINGS\FIONA Trojan-Downloader.Win32.Tibs.kj (C:\DOCUMENTS AND SETTINGS\FIONA Trojan.Win32.Agent.aer (C:\DOCUMENTS AND SETTINGS\FIONA Trojan-Proxy.Win32.Lager.dp (C:\DOCUMENTS AND SETTINGS\FIONA HARR…) NoneDisinfectRenameDelete W32/Tibs.gen27 (C:\DOCUMENTS AND SETTINGS\FIONA HARR…) NoneDisinfectRenameDelete Trojan-Downloader.Win32.Tibs.kj (C:\DOCUMENTS AND SETTINGS\FIONA Email-Worm.Win32.Banwarum.f (C:\DOCUMENTS AND SETTINGS\FIONA Tracking Cookie NoneDisinfect Windows NoneDisinfect Win32.TrojanDownloader.Small NoneDisinfect Win32.Trojan.MatrixHasYou NoneDisinfect Win32.Trojan.Spy There was 97 pages of viruses so I've left most of them out. Avenger.txt and the others to follow.

Avenger Txt Logfile of The Avenger version 1, by Swandog46 Running from registry key: \Registry\Machine\System\CurrentControlSet\Services\xmnhykjt ******************* Script file located at: \??\C:\ededuysd.txt Script file opened successfully. Script file read successfully Backups directory opened successfully at C:\Avenger ******************* Beginning to process script file: Driver PE386 unloaded successfully. Program C:\Rustbfix\2run.bat successfully set up to run once on reboot. Completed script processing. ******************* Finished! Terminate. Rapport.txt SmitFraudFix v2.135 Scan done at 8:55:15.84, Tue 30/01/2007 Run from C:\WIP\SmitfraudFix OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT The filesystem type is NTFS Fix run in normal mode »»»»»»»»»»»»»»»»»»»»»»»» C:\ »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32 C:\WINDOWS\system32\kernels8.exe FOUND ! C:\WINDOWS\system32\zlbw.dll FOUND ! »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Fiona Harris »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Fiona Harris\Application Data C:\Documents and Settings\Fiona Harris\Application Data\Install.dat FOUND ! »»»»»»»»»»»»»»»»»»»»»»»» Start Menu »»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\FIONAH~1\FAVORI~1 »»»»»»»»»»»»»»»»»»»»»»»» Desktop »»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files »»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys »»»»»»»»»»»»»»»»»»»»»»»» Desktop Components [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0] "Source"="About:Home" "SubscribedURL"="About:Home" "FriendlyName"="My Current Home Page" »»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler !!!Attention, following keys are not inevitably infected!!! SrchSTS.exe by S!Ri Search SharedTaskScheduler's .dll »»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs !!!Attention, following keys are not inevitably infected!!! [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] "AppInit_DLLs"="" »»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System !!!Attention, following keys are not inevitably infected!!! [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] "System"="" »»»»»»»»»»»»»»»»»»»»»»»» pe386-msguard-lzx32 pe386 detected, use a Rootkit scanner »»»»»»»»»»»»»»»»»»»»»»»» Scanning wininet.dll infection »»»»»»»»»»»»»»»»»»»»»»»» End Pelog.txt ************************* Rustock.b-fix – By ejvindh ************************* Tue 30/01/2007 9:43:57.81 ******************* Pre-run Status of system ******************* Rootkit driver PE386 is found. Starting the unload-procedure…. Rustock.b-ADS attached to the System32-folder: :lzx32.sys 65568 Total size: 65568 bytes. Attempting to remove ADS… system32: deleted 65568 bytes in 1 streams. Looking for Rustock.b-files in the System32-folder: No Rustock.b-files found in system32 ******************* Post-run Status of system ******************* Rustock.b-driver on the system: NONE! Rustock.b-ADS attached to the System32-folder: No System32-ADS found. Looking for Rustock.b-files in the System32-folder: No Rustock.b-files found in system32 ******************************* End of Logfile ********************************

WOW…

When it's finished we need to do SDfix:

Download SDFix and save it to your Desktop.

Double click SDFix.exe and it will extract the files to %systemdrive%
(Drive that contains the Windows Directory, typically C:\SDFix)

Please then reboot your computer in Safe Mode by doing the following :

• Restart your computer
• After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
• Instead of Windows loading as normal, the Advanced Options Menu should appear;
• Select the first option, to run Windows in Safe Mode, then press Enter.
• Choose your usual account.

• Open the extracted SDFix folder and double click RunThis.bat to start the script.
• Type Y to begin the cleanup process.
• It will remove any Trojan Services and Registry Entries that it finds then prompt you to press any key to Reboot.
• Press any Key and it will restart the PC.
• When the PC restarts the Fixtool will run again and complete the removal process then display Finished, press any key to end the script and load your desktop icons.
• Once the desktop icons load the SDFix report will open on screen and also save into the SDFix folder as Report.txt
  (Report.txt will also be copied to Clipboard ready for posting back on the forum).
• Finally paste the contents of the Report.txt back on the forum with a new HijackThis log

How are you doing with the fix?

Nothing much has happened as there was a family emergency but they did say it had finished but the icons didn't come back. I asked her to reboot but haven't seen the results of it yet. I'm thinking that if there is a lot more time/work involved I'm tempted to remove the HDD and pull the data off onto my machine and then reformat the hard Drive.