What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

My Computor Is On Death Row.

166 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Hello,

My Internet browser redirects the website i type in to the address bar to patchyoursystem.com and systemerror.com.
Also my computor automatically shuts down saying that there is an error in C:\\WINDOWS\system32\lsass.exe.
PLEASE HELP.

Here is my log:

Logfile of HijackThis v1.99.1
Scan saved at 4:26:40 PM, on 6/11/2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\DRIVERS\CDANTSRV.EXE
C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
C:\WINDOWS\System32\DVDRAMSV.exe
C:\WINDOWS\system32\LxrJD31s.exe
C:\WINDOWS\system32\1.tmp
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\lsass.exe
C:\WINDOWS\system\services.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\system\winlogon.exe
C:\WINDOWS\Explorer.exe
C:\WINDOWS\System32\nvctrl.exe
C:\Program Files\EzButton\CplBTQ00.EXE
C:\Program Files\TOSHIBA\E-KEY\CeEKey.exe
C:\Program Files\ltmoh\Ltmoh.exe
C:\Program Files\Toshiba Controls\CpRmtKey.EXE
C:\Program Files\TOSHIBA\Power Management\CePMTray.exe
C:\WINDOWS\System32\ezSP_Px.exe
C:\Program Files\TOSHIBA\TouchPad\TPTray.exe
C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\WINDOWS\TPPALDR.EXE
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S0BIC1.EXE
C:\toshiba\ivp\ism\ivpsvmgr.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
C:\WINDOWS\System32\dllsys64.exe
C:\WINDOWS\System32\mstskmgr.exe
C:\WINDOWS\System32\svcchost.exe
C:\WINDOWS\System32\mysvcc.exe
C:\WINDOWS\system32\mfcee.exe
C:\WINDOWS\System32\svcchosst.exe
C:\WINDOWS\system32\ssc.exe
C:\WINDOWS\system32\sscc.exe
C:\WINDOWS\system32\mfceee.exe
C:\WINDOWS\system32\mdmdd.exe
C:\WINDOWS\system32\RAMASST.exe
C:\WINDOWS\TEMP\C15D.tmp
C:\WINDOWS\System32\svchost.exe
C:\Documents and Settings\holiday\Local Settings\Temp\Temporary Directory 1 for hijackthis.zip\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/customize/…rch/search.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/customize/…rch/search.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://server224.smartbotpro.net/7search/?003
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/…//www.yahoo.com
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\system32\1.tmp
F2 - REG:system.ini: UserInit=C:\WINDOWS\System32\userinit.exe,C:\WINDOWS\system32\1.tmp
O2 - BHO: HomepageBHO - {3bf1f86f-b1a8-489b-8d8b-43781d51411f} - C:\WINDOWS\System32\hpB555.tmp
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [CplBTQ00] C:\Program Files\EzButton\CplBTQ00.EXE
O4 - HKLM\..\Run: [CeEKEY] C:\Program Files\TOSHIBA\E-KEY\CeEKey.exe
O4 - HKLM\..\Run: [LtMoh] C:\Program Files\ltmoh\Ltmoh.exe
O4 - HKLM\..\Run: [CpRmtKey] "C:\Program Files\Toshiba Controls\CpRmtKey.EXE"
O4 - HKLM\..\Run: [CeEPOWER] C:\Program Files\TOSHIBA\Power Management\CePMTray.exe
O4 - HKLM\..\Run: [ezShieldProtector for Px] C:\WINDOWS\System32\ezSP_Px.exe
O4 - HKLM\..\Run: [TPNF] C:\Program Files\TOSHIBA\TouchPad\TPTray.exe
O4 - HKLM\..\Run: [NDSTray.exe] NDSTray.exe
O4 - HKLM\..\Run: [Pinger] c:\toshiba\ivp\ism\pinger.exe /run
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [TPP Auto Loader] C:\WINDOWS\TPPALDR.EXE
O4 - HKLM\..\Run: [EPSON Stylus C62 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S0BIC1.EXE /P23 "EPSON Stylus C62 Series" /O5 "LPT1:" /M "Stylus C62"
O4 - HKLM\..\Run: [IVPServiceMgr] C:\toshiba\ivp\ism\ivpsvmgr.exe
O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\Internet Security 2005\pccguide.exe"
O4 - HKLM\..\Run: [MS DLL Library Manager] C:\WINDOWS\System32\dllsys64.exe
O4 - HKLM\..\Run: [Microsoft ® Windows Network Latency Controller] C:\WINDOWS\system32\1.tmp
O4 - HKLM\..\Run: [MS Task Manager 32] C:\WINDOWS\System32\mstskmgr.exe
O4 - HKLM\..\Run: [msvcc25] svcchost.exe
O4 - HKLM\..\Run: [mysvcig38] mysvcc.exe
O4 - HKLM\..\Run: [staeck12] C:\WINDOWS\system32\mfcee.exe
O4 - HKLM\..\Run: [msvccc66] svcchosst.exe
O4 - HKLM\..\Run: [sixer5] C:\WINDOWS\system32\ssc.exe
O4 - HKLM\..\Run: [intell32.exe] C:\WINDOWS\System32\intell32.exe
O4 - HKLM\..\Run: [sixer566] C:\WINDOWS\system32\sscc.exe
O4 - HKLM\..\Run: [staeck122] C:\WINDOWS\system32\mfceee.exe
O4 - HKLM\..\Run: [melg3445] C:\WINDOWS\system32\mdmdd.exe
O4 - HKLM\..\RunServices: [Ms Java for Windows NT] msi32info.exe
O4 - HKLM\..\RunServices: [z] C:\z.exe
O4 - HKLM\..\RunServices: [msvcc25] svcchost.exe
O4 - HKLM\..\RunServices: [mysvcig38] mysvcc.exe
O4 - HKLM\..\RunServices: [msvccc66] svcchosst.exe
O4 - HKCU\..\Run: [Ms Java for Windows NT] MS32.exe
O4 - HKCU\..\Run: [staeck12] C:\WINDOWS\system32\mfcee.exe
O4 - HKCU\..\Run: [melg34] C:\WINDOWS\system32\mdmd.exe
O4 - HKCU\..\Run: [sixer5] C:\WINDOWS\system32\ssc.exe
O4 - HKCU\..\Run: [sixer566] C:\WINDOWS\system32\sscc.exe
O4 - HKCU\..\Run: [staeck122] C:\WINDOWS\system32\mfceee.exe
O4 - HKCU\..\Run: [melg3445] C:\WINDOWS\system32\mdmdd.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: RAMASST.lnk = C:\WINDOWS\system32\RAMASST.exe
O4 - Global Startup: VPN Client.lnk = ?
O8 - Extra context menu item: &Add animation to IncrediMail Style Box - C:\PROGRA~1\INCRED~1\bin\resources\WebMenuImg.htm
O8 - Extra context menu item: Yahoo! Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {33331111-1111-1111-1111-611111193423} -
O16 - DPF: {33331111-1111-1111-1111-611111193429} -
O16 - DPF: {33331111-1111-1111-1111-615111193427} -
O16 - DPF: {64311111-1111-1121-1111-111191113457} - file://c:\eied_s7.cab
O20 - Winlogon Notify: rpcc - C:\WINDOWS\System32\rpcc.dll
O20 - Winlogon Notify: WLogon - C:\WINDOWS\SYSTEM32\srvc.dll
O21 - SSODL: SystemCheck2 - {54645654-2225-4455-44A1-9F4543D34546} - C:\WINDOWS\System32\vbsys2.dll
O23 - Service: Print Spooler Service (aeiiuuee8yo) - Unknown owner - C:\z.exe
O23 - Service: C-DillaSrv - C-Dilla Ltd - C:\WINDOWS\System32\DRIVERS\CDANTSRV.EXE
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
O23 - Service: DVD-RAM_Service - Matsushita Electric Industrial Co., Ltd. - C:\WINDOWS\System32\DVDRAMSV.exe
O23 - Service: Lexar JD31 (LxrJD31s) - Unknown owner - C:\WINDOWS\SYSTEM32\LxrJD31s.exe
O23 - Service: Windows Network Latency Controller (nlc) - Unknown owner - C:\WINDOWS\system32\1.tmp
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Reflection Servers - WRQ, Inc. - C:\Program Files\Reflection\rninetd.exe
O23 - Service: Microsoft sdk core (sdk) - Unknown owner - C:\WINDOWS\lsass.exe
O23 - Service: Windows Event Services (SERVICE32) - Unknown owner - C:\WINDOWS\system\services.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
O23 - Service: Windows NT Logon Application (WINLOGON) - Unknown owner - C:\WINDOWS\system\winlogon.exe
Post #2
  • Hello, and welcome to the forum.

    My name is Simon V., and I'll be glad to help you with your computer problems.

    HijackThis logs can take some time to research, so please be patient with me. I know that you need your computer working as quickly as possible, and I will work hard to help see that happens.
    I am currently looking over your log. As I am a trainee, everything that I post to you must be checked by an Admin or Moderator. Thus, there may be a tiny bit of a delay between posts, but it shouldn't be too long. I will post back shortly with a potential fix.

    Please be patient and I'd be grateful if you would note the following:
  • I will be working on your Malware issues, this may or may not, solve other issues you have with your machine.
  • The fixes are specific to your problem and should only be used for this issue on this machine.
  • Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
  • It's often worth reading through these instructions and printing them for ease of reference.
  • If you don't know or understand something, please don't hesitate to say or ask! It's better to be sure and safe than sorry.
  • Please reply to this thread. Do not start a new topic.
Post #3
  • Hi lost and confused,

    Identity Theft
  • I'm afraid I have unpleasant news for you. You have a Very Dangerous infection on this machine.
    The infection is delivered by several IRC backdoor trojans.
    It allows outsiders COMPLETE access to every keystroke, account, and password you use while on this machine, and complete access to any other data present…

    IF this computer has been used for any kind of important data, my best recommendation is to disconnect from the internet, reformat the entire drive and re-install your operating system and applications.

    We can likely clean the infected files off the computer, and if you wish we will attempt to do so, but we cannot be sure that the infection didn't do something to your system to reduce the system security. In that instance, even after removal of the infection, you could be subject to another attack or takeover as soon as you re-connect to the internet.

    The decision whether to reformat or not should be based on:
  • The use of the computer - this is the primary factor in the decision whether to reformat and re-install, or just disinfect.
  • The variety of malware - this influences the decision on whether to re-format and re-install, or just disinfect. IN THIS CASE we have a backdoor worm, the worst kind.
If the computer has been used for any important data, you are strongly advised to do the following, immediately:
  • Disconnect the infected computer from the internet and from any networked computers until the computer can be cleaned.
  • Back up all important data on the machine. Do not back up any Applications (programs). Those should be re-installed from the original source CDs or websites.
  • If you have ever used this computer for shopping, banking, or any transactions relating to your financial well being:
    Call all of your banks, credit card companies, and financial institutions, informing them that you may be a victim of identity theft, and to put a watch on your accounts or change all your account numbers.
  • From a clean computer, change ALL your online passwords – for ISP login, email, banks, financial accounts, PayPal, eBay, online companies, and any online forums or groups you belong to.
  • DO NOT change passwords or do any transactions while using the infected computer because the attacker will get the new password and transaction information.
  • Take any other steps you think appropriate for an attempted identity theft.
While you are deciding whether to reformat and re-install, this can be a useful link.

Please let me know what you decide.
Post #4 last edited
If it is at all possible that we could not have to reformat and re-install it would be great because i dont have the software for this computor. I dont use this computer for anything of importantance. Thanks
Post #5
  • Hi lost and confused,

    Rename HijackThis
  • Please right-click on HijackThis.exe and choose Rename. Rename it to Scanner.exe.

    Make an Uninstall List
  • To access the Uninstall Manager you would do the following:

    1. Start HijackThis
    2. Click on the Config button
    3. Click on the Misc Tools button
    4. Click on the Open Uninstall Manager button.

    You will now be presented with a screen similar to the one below:

    [external image: Posted Image]

    5. Click on the Save list… button and save the file to a convenient location. When you press Save, Notepad will open with the contents of that file.

    SmitfraudFix
  • Please download SmitfraudFix (By S!ri).
    • Extract the content of SmitfraudFix.zip to you desktop. To do this, right-click on SmitfraudFix.zip and select Extract Here.
    • Next, open the SmitfraudFix folder, and double-click on SmitfraudFix.cmd. A screen will pop up. Select Option 1 (Search) by typing 1 and hit enter. A text file will appear, which will list the infected files. Save it to a convenient location.
    • The log will also be saved here: C:\rapport.txt
    • Note: process.exe is detected by some antivirus programs (AntiVir, Dr.Web, Kaspersky) as a "RiskTool"; it is not a virus, but a program used to stop system processes. Antivirus programs cannot distinguish between "good" and "malicious" use of such programs, therefore they may alert the user.
    SDFix
  • Please download SDFix and save it to your Desktop.

    Double click SDFix.exe and it will extract the files to %systemdrive%
    (Drive that contains the Windows Directory, typically C:\\SDFix)
    • Print these instructions or copy them to Notepad and save it to your Desktop, as you won't be able to access internet in Safe Mode.
    • Please reboot into Safe Mode. To do this, go to Start>Turn off Computer, and select Restart. Rapidly tap F8 just before Windows starts to load. In the menu that appears, select Safe Mode (Without Networking)

      Once in Safe Mode, do the following:
    • Open the extracted SDFix folder and double click RunThis.bat to start the script.
    • Type Y to begin the cleanup process.
    • It will remove any Trojan Services and Registry Entries that it finds then prompt you to press any key to reboot.
    • Press any key and it will restart the PC.
    • When the PC restarts the fixtool will run again and complete the removal process then display Finished, press any key to end the script and load your desktop icons.
    • Once the desktop icons load, the SDFix report will open on screen and also save into the SDFix folder as Report.txt
      (Report.txt will also be copied to clipboard ready for posting back on the forum).
    Report Back
  • Please post the reports from SmitfraudFix, SDFix and the Uninstall List from HijackThis, along with a new HijackThis log in your next reply.
Post #6
Hey Simon V.
Below are the reports you requested. After running RunThis.bat in Safe Mode my computer wouldnt restart itself so i restarted it and ran it again and it restarted itself.


SmitFraudFix v2.195

Scan done at 10:30:34.62, Tue 06/12/2007
Run from C:\Documents and Settings\holiday\Desktop\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
The filesystem type is NTFS
Fix run in normal mode

»»»»»»»»»»»»»»»»»»»»»»»» Process

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\DRIVERS\CDANTSRV.EXE
C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\DVDRAMSV.exe
C:\WINDOWS\system32\LxrJD31s.exe
C:\WINDOWS\System32\urdvxc.exe
C:\WINDOWS\system32\1.tmp
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\lsass.exe
C:\WINDOWS\Explorer.exe
C:\WINDOWS\system\services.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\system\winlogon.exe
C:\WINDOWS\System32\nvctrl.exe
C:\Program Files\EzButton\CplBTQ00.EXE
C:\Program Files\TOSHIBA\E-KEY\CeEKey.exe
C:\Program Files\ltmoh\Ltmoh.exe
C:\Program Files\Toshiba Controls\CpRmtKey.EXE
C:\Program Files\TOSHIBA\Power Management\CePMTray.exe
C:\WINDOWS\System32\ezSP_Px.exe
C:\Program Files\TOSHIBA\TouchPad\TPTray.exe
C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\WINDOWS\TPPALDR.EXE
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S0BIC1.EXE
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
C:\toshiba\ivp\ism\ivpsvmgr.exe
C:\WINDOWS\System32\dllsys64.exe
C:\WINDOWS\System32\mstskmgr.exe
C:\WINDOWS\System32\svcchost.exe
C:\WINDOWS\System32\mysvcc.exe
C:\WINDOWS\System32\svcchosst.exe
C:\WINDOWS\system32\sscc.exe
C:\WINDOWS\system32\mfceee.exe
C:\WINDOWS\system32\mdmdd.exe
C:\WINDOWS\system32\RAMASST.exe
C:\WINDOWS\TEMP\6FD8.tmp
C:\WINDOWS\System32\cmd.exe

»»»»»»»»»»»»»»»»»»»»»»»» hosts


»»»»»»»»»»»»»»»»»»»»»»»» C:\


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32

C:\WINDOWS\system32\hp????.tmp FOUND !
C:\WINDOWS\system32\intell32.exe FOUND !
C:\WINDOWS\system32\msvol.tlb FOUND !
C:\WINDOWS\system32\ncompat.tlb FOUND !
C:\WINDOWS\system32\nvctrl.exe FOUND !
C:\WINDOWS\system32\oleext.dll FOUND !
C:\WINDOWS\system32\ot.ico FOUND !
C:\WINDOWS\system32\ts.ico FOUND !
C:\WINDOWS\system32\x.exe FOUND !
C:\WINDOWS\system32\1024\ FOUND !

»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\holiday


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\holiday\Application Data


»»»»»»»»»»»»»»»»»»»»»»»» Start Menu

C:\DOCUME~1\ALLUSE~1\STARTM~1\Security Troubleshooting.url FOUND !

»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\holiday\FAVORI~1

C:\DOCUME~1\holiday\FAVORI~1\Antivirus Test Online.url FOUND !

»»»»»»»»»»»»»»»»»»»»»»»» Desktop


»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files

C:\Program Files\PSGuard\ FOUND !

»»»»»»»»»»»»»»»»»»»»»»»» Scanning files created on 05/24/2007
!!! Attention, follow files are not inevitably infected !!!

C:\WINDOWS\system32\6144
C:\WINDOWS\system32\1158

»»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys

HKLM\SOFTWARE\SHUDDERLTD FOUND !

»»»»»»»»»»»»»»»»»»»»»»»» Desktop Components

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="My Current Home Page"


»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=""


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""


»»»»»»»»»»»»»»»»»»»»»»»» Rustock



»»»»»»»»»»»»»»»»»»»»»»»» DNS



»»»»»»»»»»»»»»»»»»»»»»»» Scanning for wininet.dll infection


»»»»»»»»»»»»»»»»»»»»»»»» End



SDFix: Version 1.87

Run by [removed]
Microsoft Windows XP [Version 5.1.2600]

Running From: C:\DOCUME~1\holiday\Desktop\SDFix

Safe Mode:
Checking Services:

Name:
MSWindows
nlc
sdk
WINLOGON
aeiiuuee8yo

ImagePath:
"C:\WINDOWS\System32\urdvxc.exe" /service
C:\WINDOWS\system32\1.tmp
"C:\WINDOWS\lsass.exe"
"C:\WINDOWS\system\winlogon.exe"
C:\z.exe /service

MSWindows - Deleted
nlc - Deleted
sdk - Deleted
WINLOGON - Deleted
aeiiuuee8yo - Deleted



Restoring Windows Registry Values
Restoring Windows Default Hosts File

Rebooting…


Normal Mode:
Checking Files:

No Trojan Files Found




Removing Temp Files…

ADS Check:

Checking if ADS is attached to system32 Folder
C:\WINDOWS\system32
No streams found.

Checking if ADS is attached to svchost.exe
C:\WINDOWS\system32\svchost.exe
No streams found.

Checking if ADS is attached to ntoskrnl.exe
C:\WINDOWS\system32\ntoskrnl.exe
No streams found.



Final Check:

Remaining Services:
——————



Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

Remaining Files:
—————


Listing Files with Hidden Attributes:

C:\Program Files\Common Files\aolshare\shell\us\shellext.dll
C:\Program Files\America Online 8.0\aolphx.exe
C:\Program Files\America Online 8.0\aoltray.exe
C:\Program Files\America Online 8.0\RBM.exe
C:\Program Files\America Online 8.0\waol.exe
C:\Program Files\America Online 8.0\COMIT\cswitch.exe
C:\Program Files\Autodesk\Autodesk Express Viewer\Setup.exe
C:\WINDOWS\system32\helpermdmdd.exe
C:\WINDOWS\system32\helpermfceee.exe
C:\WINDOWS\system32\helpersscc.exe
C:\WINDOWS\system32\mdmdd.exe
C:\WINDOWS\system32\mfceee.exe
C:\WINDOWS\system32\msi32info.exe
C:\WINDOWS\system32\sscc.exe
C:\redir.sys
C:\WINDOWS\page files\maxmeg.sys
C:\WINDOWS\system32\l34501.sys

Listing User Accounts:

User accounts for \\PETREY

Administrator ASPNET Guest
HelpAssistant holiday Petrey
SUPPORT_388945a0


Finished

Uninstall List:

Adobe Acrobat 5.0
Adobe Flash Player 9 ActiveX
America Online (Choose which version to remove)
AOL Coach Version 1.0(Build:20020929.1)
ArcSoft PhotoImpression 3.0
AT&T; Connection Services Manager
AutoCAD LT 2004
Autodesk Express Viewer
Canon PowerShot G3 WIA Driver
C-Dilla Licence Management System
Cisco Systems VPN Client 4.0.2 (B)
Click'N Design 3D Trial Version
Drag'n Drop CD+DVD
DVD-RAM Driver
Easy Button
Easy CD Creator 5 Basic
ENI / ENIW Utility
EPSON Printer Software
Hemera Products
HijackThis 1.99.1
HP Photo and Imaging 1.0 - Scanjet 3500c Series
InterActual Player
InterVideo WinDVD 4
InterVideo WinDVD Creator 2
JD Secure 3.1
Liquid Player
MasterClips Browser v2.03
Merriam-Webster
MicroMain XM
Microsoft .NET Framework (English)
Microsoft .NET Framework (English) v1.0.3705
Microsoft .NET Framework 1.1
Microsoft Access 2000 SR-1
Microsoft Excel 2000 SR-1
Microsoft Office 2000 SR-1 Professional
Microsoft Office Access 2003 Runtime
Microsoft Picture It! 2000
Microsoft PowerPoint 2000 SR-1
Microsoft Web Publishing Wizard 1.52
Microsoft Word 2000 SR-1
Microsoft Works 7.0
Notebook Maximizer
NVIDIA Windows 2000/XP Display Drivers
Quicken 2003 New User Edition
QuickTime
RealPlayer Basic
Realtek AC'97 Audio
Realtek Fast Ethernet Adapter Driver
Shockwave
SMSC IrCC Driver V5.1.2462.0 (WinXP)
Software Suite
Special Internet Offers
Spy Wiper v2.0
SurfHere by Toshiba
TOSHIBA Access
TOSHIBA ConfigFree
TOSHIBA Console
Toshiba Controls
TOSHIBA Hotkey Utility
TOSHIBA Power Management Utility
Toshiba Registration
TOSHIBA Software Modem
TOSHIBA Software Upgrades
TOSHIBA Speech System Applications
TOSHIBA Speech System SR Engine(U.S.) Version1.0
TOSHIBA Speech System TTS Engine(U.S.) Version1.0
Toshiba Tbiosdrv Driver
TouchPad On/Off Utility
TPP Storage Driver Installation
Ultra WinCleaner One Click! Version 8.0
USB Storage Adapter FX (TPP)
USB Storage Adapter SL11R (TPP)
USB Storage Adapter V2 (TPP)
USB Storage Adapter V3 (TPP)
Viewpoint Media Player
Windows XP Hotfix - KB822603
Windows XP Hotfix (SP2) [See Q329048 for more information]
Windows XP Hotfix (SP2) [See q329112 for more information]
Windows XP Hotfix (SP2) [See Q329115 for more information]
Windows XP Hotfix (SP2) [See Q329390 for more information]
Windows XP Hotfix (SP2) Q327979
Windows XP Hotfix (SP2) Q329170
Windows XP Hotfix (SP2) q329623
Windows XP Hotfix (SP2) Q329834
Windows XP Hotfix (SP2) Q810565
Windows XP Hotfix (SP2) Q810577
Windows XP Hotfix (SP2) Q810583
Windows XP Hotfix (SP2) Q810833
Windows XP Hotfix (SP2) Q811048
Windows XP Hotfix (SP2) Q814033
Windows XP Hotfix (SP2) q817434

Logfile of HijackThis v1.99.1
Scan saved at 11:37:30 AM, on 6/12/2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\DRIVERS\CDANTSRV.EXE
C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
C:\WINDOWS\System32\DVDRAMSV.exe
C:\WINDOWS\system32\LxrJD31s.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\EzButton\CplBTQ00.EXE
C:\Program Files\TOSHIBA\E-KEY\CeEKey.exe
C:\Program Files\ltmoh\Ltmoh.exe
C:\Program Files\Toshiba Controls\CpRmtKey.EXE
C:\Program Files\TOSHIBA\Power Management\CePMTray.exe
C:\WINDOWS\System32\ezSP_Px.exe
C:\Program Files\TOSHIBA\TouchPad\TPTray.exe
C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe
C:\toshiba\ivp\ism\pinger.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\WINDOWS\TPPALDR.EXE
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S0BIC1.EXE
C:\toshiba\ivp\ism\ivpsvmgr.exe
C:\Program Files\Trend Micro\Internet Security 2005\pccguide.exe
C:\WINDOWS\System32\intell32.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
C:\WINDOWS\system32\sscc.exe
C:\WINDOWS\system32\mdmdd.exe
C:\WINDOWS\system32\mfceee.exe
C:\WINDOWS\system32\RAMASST.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Documents and Settings\holiday\Start Menu\Programs\Scanner.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/customize/…rch/search.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/customize/…rch/search.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://server224.smartbotpro.net/7search/?003
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/…//www.yahoo.com
O2 - BHO: HomepageBHO - {3bf1f86f-b1a8-489b-8d8b-43781d51411f} - C:\WINDOWS\System32\hpAE31.tmp
O3 - Toolbar: &Radio; - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [CplBTQ00] C:\Program Files\EzButton\CplBTQ00.EXE
O4 - HKLM\..\Run: [CeEKEY] C:\Program Files\TOSHIBA\E-KEY\CeEKey.exe
O4 - HKLM\..\Run: [LtMoh] C:\Program Files\ltmoh\Ltmoh.exe
O4 - HKLM\..\Run: [CpRmtKey] "C:\Program Files\Toshiba Controls\CpRmtKey.EXE"
O4 - HKLM\..\Run: [CeEPOWER] C:\Program Files\TOSHIBA\Power Management\CePMTray.exe
O4 - HKLM\..\Run: [ezShieldProtector for Px] C:\WINDOWS\System32\ezSP_Px.exe
O4 - HKLM\..\Run: [TPNF] C:\Program Files\TOSHIBA\TouchPad\TPTray.exe
O4 - HKLM\..\Run: [NDSTray.exe] NDSTray.exe
O4 - HKLM\..\Run: [Pinger] c:\toshiba\ivp\ism\pinger.exe /run
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [TPP Auto Loader] C:\WINDOWS\TPPALDR.EXE
O4 - HKLM\..\Run: [EPSON Stylus C62 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S0BIC1.EXE /P23 "EPSON Stylus C62 Series" /O5 "LPT1:" /M "Stylus C62"
O4 - HKLM\..\Run: [IVPServiceMgr] C:\toshiba\ivp\ism\ivpsvmgr.exe
O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\Internet Security 2005\pccguide.exe"
O4 - HKLM\..\Run: [intell32.exe] C:\WINDOWS\System32\intell32.exe
O4 - HKLM\..\Run: [sixer566] C:\WINDOWS\system32\sscc.exe
O4 - HKLM\..\Run: [staeck122] C:\WINDOWS\system32\mfceee.exe
O4 - HKLM\..\Run: [melg3445] C:\WINDOWS\system32\mdmdd.exe
O4 - HKLM\..\RunServices: [z] C:\z.exe
O4 - HKCU\..\Run: [sixer566] C:\WINDOWS\system32\sscc.exe
O4 - HKCU\..\Run: [staeck122] C:\WINDOWS\system32\mfceee.exe
O4 - HKCU\..\Run: [melg3445] C:\WINDOWS\system32\mdmdd.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: RAMASST.lnk = C:\WINDOWS\system32\RAMASST.exe
O4 - Global Startup: VPN Client.lnk = ?
O8 - Extra context menu item: &Add; animation to IncrediMail Style Box - C:\PROGRA~1\INCRED~1\bin\resources\WebMenuImg.htm
O8 - Extra context menu item: Yahoo! Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related; Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {33331111-1111-1111-1111-611111193423} -
O16 - DPF: {33331111-1111-1111-1111-611111193429} -
O16 - DPF: {33331111-1111-1111-1111-615111193427} -
O16 - DPF: {64311111-1111-1121-1111-111191113457} - file://c:\eied_s7.cab
O20 - Winlogon Notify: WLogon - srvc.dll (file missing)
O21 - SSODL: SystemCheck2 - {54645654-2225-4455-44A1-9F4543D34546} - C:\WINDOWS\System32\vbsys2.dll
O23 - Service: C-DillaSrv - C-Dilla Ltd - C:\WINDOWS\System32\DRIVERS\CDANTSRV.EXE
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
O23 - Service: DVD-RAM_Service - Matsushita Electric Industrial Co., Ltd. - C:\WINDOWS\System32\DVDRAMSV.exe
O23 - Service: Lexar JD31 (LxrJD31s) - Unknown owner - C:\WINDOWS\SYSTEM32\LxrJD31s.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Reflection Servers - WRQ, Inc. - C:\Program Files\Reflection\rninetd.exe
O23 - Service: Windows Event Services (SERVICE32) - Unknown owner - C:\WINDOWS\system\services.exe (file missing)
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

THANK YOU
Post #7
  • Hi lost and confused,

    Show Hidden Files and Folders
  • Be sure that you are set to see hidden files and folders:
    • Close all programs so that you are at your desktop.
    • Double-click on the My Computer icon.
    • Select the Tools menu and click Folder Options.
    • After the new window appears select the View tab.
    • Put a checkmark in the checkbox labelled Display the contents of system folders.
    • Under the Hidden files and folders section select the radio button labeled Show hidden files and folders.
    • Remove the checkmark from the checkbox labelled Hide file extensions for known file types.
    • Remove the checkmark from the checkbox labelled Hide protected operating system files.
    • Press the Apply button and then the OK button and shutdown My Computer.
    Upload Files
  • Please download Suspicious File Packer.
  • Unzip it to desktop, open it and copy and paste the list of files below, press next and it will create an archive (.cab file) on your desktop.

    C:\WINDOWS\system32\helpermdmdd.exe
    C:\WINDOWS\system32\helpermfceee.exe
    C:\WINDOWS\system32\helpersscc.exe
    C:\WINDOWS\system32\mdmdd.exe
    C:\WINDOWS\system32\mfceee.exe
    C:\WINDOWS\system32\msi32info.exe
    C:\WINDOWS\system32\sscc.exe
    C:\z.exe

  • Go to The Spy Killer.
  • Press New Topic, make threads title Files for Simon V. MRU
  • Include in your message a link to here (http://forums.tomcoyote.org/Computor_Death_Row_t80244.html), then attach the .cab file to your message and post the topic.
  • If you can't locate it through the browse button just copy and paste the filename and path.

    Upload Files to Virustotal
  • Please visit Virustotal
    • Click the Browse… button.
    • Navigate to the file C:\redir.sys
    • Click the Open button.
    • Click the Send button.
    • Also do this for:

      C:\WINDOWS\page files\maxmeg.sys
      C:\WINDOWS\system32\l34501.sys
    • Please post the results from the Virustotal scans here.
Post #8
Hey Simon V. STATUS: FINISHEDComplete scanning result of "redir.sys", received in VirusTotal at 06.13.2007, 00:29:08 (CET). Antivirus Version Update Result AhnLab-V3 2007.6.12.2 06.12.2007 no virus found AntiVir 7.4.0.32 06.12.2007 no virus found Authentium 4.93.8 06.12.2007 no virus found Avast 4.7.997.0 06.12.2007 no virus found AVG 7.5.0.467 06.12.2007 no virus found BitDefender 7.2 06.12.2007 no virus found CAT-QuickHeal 9.00 06.12.2007 no virus found ClamAV devel-20070416 06.12.2007 no virus found DrWeb 4.33 06.12.2007 no virus found eSafe 7.0.15.0 06.12.2007 no virus found eTrust-Vet 30.7.3714 06.12.2007 no virus found Ewido 4.0 06.12.2007 no virus found FileAdvisor 1 06.13.2007 no virus found Fortinet 2.85.0.0 06.12.2007 no virus found F-Prot 4.3.2.48 06.12.2007 no virus found F-Secure 6.70.13030.0 06.13.2007 no virus found Ikarus T3.1.1.8 06.12.2007 no virus found Kaspersky 4.0.2.24 06.13.2007 no virus found McAfee 5051 06.12.2007 no virus found Microsoft 1.2503 06.12.2007 no virus found NOD32v2 2325 06.12.2007 no virus found Norman 5.80.02 06.12.2007 no virus found Panda 9.0.0.4 06.12.2007 no virus found Prevx1 V2 06.13.2007 no virus found Sophos 4.18.0 06.12.2007 no virus found Sunbelt 2.2.907.0 06.09.2007 no virus found Symantec 10 06.12.2007 no virus found TheHacker [removed] 06.11.2007 no virus found VBA32 [removed] 06.12.2007 no virus found VirusBuster 4.3.23:9 06.12.2007 no virus found Webwasher-Gateway 6.0.1 06.12.2007 no virus found Aditional Information File size: 56 bytes MD5: ab728893b0688e165d76a797343b7263 SHA1: 135e8828d5c94230723c029d0da09fb43be89df5 STATUS: FINISHEDComplete scanning result of "maxmeg.sys", received in VirusTotal at 06.13.2007, 00:36:27 (CET). Antivirus Version Update Result AhnLab-V3 2007.5.9.0 05.09.2007 no virus found AntiVir 7.4.0.32 06.12.2007 no virus found Authentium 4.93.8 06.12.2007 no virus found Avast 4.7.997.0 06.12.2007 no virus found AVG 7.5.0.467 05.08.2007 no virus found BitDefender 7.2 06.12.2007 no virus found CAT-QuickHeal 9.00 06.12.2007 no virus found ClamAV devel-20070416 05.09.2007 no virus found DrWeb 4.33 06.12.2007 no virus found eSafe 7.0.15.0 05.08.2007 no virus found eTrust-Vet 30.7.3714 06.12.2007 no virus found FileAdvisor 1 06.13.2007 no virus found Fortinet 2.85.0.0 06.12.2007 no virus found F-Prot 4.3.2.48 05.08.2007 no virus found F-Secure 6.70.13030.0 05.09.2007 no virus found Ikarus T3.1.1.7 05.09.2007 no virus found Kaspersky 4.0.2.24 06.13.2007 no virus found McAfee 5051 06.12.2007 no virus found Microsoft 1.2503 06.12.2007 no virus found NOD32v2 2325 06.12.2007 no virus found Norman 5.80.02 06.12.2007 no virus found Panda 9.0.0.4 06.12.2007 no virus found Prevx1 V2 06.13.2007 no virus found Sophos 4.18.0 06.12.2007 no virus found Sunbelt 2.2.907.0 05.05.2007 no virus found Symantec 10 05.09.2007 no virus found TheHacker [removed] 06.11.2007 no virus found VBA32 [removed] 06.12.2007 no virus found VirusBuster 4.3.23:9 06.12.2007 no virus found Webwasher-Gateway 6.0.1 05.09.2007 no virus found Aditional Information File size: 1025 bytes MD5: fc8555fba712c852d6cdfb6c27a90977 SHA1: 74e96b24bdbe9c862513cc884967fc18f982e4b9 STATUS: FINISHEDComplete scanning result of "l34501.sys", received in VirusTotal at 06.13.2007, 00:45:07 (CET). Antivirus Version Update Result AhnLab-V3 2007.5.9.0 05.09.2007 no virus found AntiVir 7.4.0.32 06.12.2007 no virus found Authentium 4.93.8 06.12.2007 no virus found Avast 4.7.997.0 06.12.2007 no virus found AVG 7.5.0.467 05.08.2007 no virus found BitDefender 7.2 06.13.2007 no virus found CAT-QuickHeal 9.00 06.12.2007 no virus found ClamAV devel-20070416 05.09.2007 no virus found DrWeb 4.33 06.12.2007 no virus found eSafe 7.0.15.0 05.08.2007 no virus found eTrust-Vet 30.7.3714 06.12.2007 no virus found FileAdvisor 1 06.13.2007 no virus found Fortinet 2.85.0.0 06.12.2007 no virus found F-Prot 4.3.2.48 05.08.2007 no virus found F-Secure 6.70.13030.0 05.09.2007 no virus found Ikarus T3.1.1.7 05.09.2007 no virus found Kaspersky 4.0.2.24 06.13.2007 no virus found McAfee 5051 06.12.2007 no virus found Microsoft 1.2503 06.12.2007 no virus found NOD32v2 2325 06.12.2007 no virus found Norman 5.80.02 06.12.2007 no virus found Panda 9.0.0.4 06.12.2007 no virus found Prevx1 V2 06.13.2007 no virus found Sophos 4.18.0 06.12.2007 no virus found Sunbelt 2.2.907.0 05.05.2007 no virus found Symantec 10 05.09.2007 no virus found TheHacker [removed] 06.11.2007 no virus found VBA32 [removed] 06.12.2007 no virus found VirusBuster 4.3.23:9 06.12.2007 no virus found Webwasher-Gateway 6.0.1 05.09.2007 no virus found Aditional Information File size: 1025 bytes MD5: cfa737d56394c61fd4be5ff6746931a0 SHA1: 008c098639ac5ed5819add4d19c4ea1ec9822d08
Post #9
  • Hi lost and confused,

    Download and Run Blacklight
  • Download F-Secure Blacklight (fsbl.exe) to your desktop from here.
    • Open it and click Accept Agreement.
    • Click Scan.
    • After the scan is complete, click Next, then Exit.
    • It will create a log on the desktop named fsbl-xxxxxxx.log (the xxxxxxx will be the date and time of the scan).
    ATF Cleaner
  • Please download ATF Cleaner.

    Double-click on ATF-Cleaner.exe to start the program.
    Under the Main tab, put a check next to 'Select All'.
    Click the 'Empty Selected' button. (Note: if you select cookies, automated login at forums and sites will be disabled. If you do not want this, uncheck 'Cookies'.

    If you use the Firefox browser:
    Click on Firefox at the top and put a check next to 'Select All'.
    If you would like to keep your saved passwords, click No at the prompt.
    Click the 'Empty Selected' button. (Note: if you select cookies, automated login at forums and sites will be disabled. If you do not want this, uncheck 'Cookies'.

    If you use the Opera browser:
    Click on Opera at the top and put a check next to 'Select All'.
    If you would like to keep your saved passwords, click No at the prompt.
    Click the 'Empty Selected' button. (Note: if you select cookies, automated login at forums and sites will be disabled. If you do not want this, uncheck 'Cookies'.

    AVG Anti-Spyware
  • Please download and install AVG Anti-Spyware.

    After the installation, open AVG Anti-Spyware and do the following:
    • Under 'Status', click on Change state, next to 'Resident shield' (this will change from Active to Inactive)
    • Under the 'Update' tab, click on 'Start update'.
    • Under 'Scanner', click on the 'Settings' tab:
      • Under 'How to act?', click on 'Recommended actions', and select Quarantine.
      • Under 'Reports', select 'Automatically generate report after every scan', and remove the check next to 'Only if threats were found'
    Close AVG Anti-Spyware. Do not let it scan yet.

    Safe Mode
  • Print these instructions or copy them to Notepad and save it to your Desktop, as you won't be able to access internet in Safe Mode.
  • Please reboot into Safe Mode. To do this, go to Start>Turn off Computer, and select Restart. Rapidly tap F8 just before Windows starts to load. In the menu that appears, select Safe Mode (Without Networking)

    SmitfraudFix
  • Open the SmitfraudFix folder and double-click on Smifraudfix.cmd.
    • A screen will pop up. Select Option 2 (Clean) by typing 2 and hit Enter.
    • You will be prompted: 'Registry Cleaning - Do you want to clean the registry?' Answer Yes by typing Y and press Enter in order to clean registry keys associated with the infection.
    • The tool will now check if wininet.dll is infected. You may be prompted to replace the infected file; answer 'Yes' by typing Y and hit Enter.
    • The tool may need to restart your computer to finish the cleaning process; if it doesn't, please restart Windows into Normal Mode.
    • A text file will appear onscreen, with results from the cleaning process; please copy the content of that report and paste it in your next reply along with all the other logs requested. The report can also be found at C:\rapport.txt.
  • Warning: running option #2 on a non infected computer will remove your desktop background.

    Uninstall Programs
  • Click on Start, then Control Panel. Double click on Add or Remove Programs.

    Please remove the following program:
    • Special Internet Offers
    • Spy Wiper v2.0
    Stop Running Processes
  • Press and hold the Control and Alt keys and press Delete. Then locate intell32.exe and click Stop process. Also do this for sscc.exe, mdmdd.exe and mfceee.exe.

    Fix Entries with HijackThis
  • Open HijackThis, perform a scan and put a check next to the following items (if present):

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/customize/…rch/search.html
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/customize/…rch/search.html
    R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://server224.smartbotpro.net/7search/?003
    R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/…//www.yahoo.com
    O2 - BHO: HomepageBHO - {3bf1f86f-b1a8-489b-8d8b-43781d51411f} - C:\WINDOWS\System32\hpAE31.tmp
    O4 - HKLM\..\Run: [intell32.exe] C:\WINDOWS\System32\intell32.exe
    O4 - HKLM\..\Run: [sixer566] C:\WINDOWS\system32\sscc.exe
    O4 - HKLM\..\Run: [staeck122] C:\WINDOWS\system32\mfceee.exe
    O4 - HKLM\..\Run: [melg3445] C:\WINDOWS\system32\mdmdd.exe
    O4 - HKLM\..\RunServices: [z] C:\z.exe
    O4 - HKCU\..\Run: [sixer566] C:\WINDOWS\system32\sscc.exe
    O4 - HKCU\..\Run: [staeck122] C:\WINDOWS\system32\mfceee.exe
    O4 - HKCU\..\Run: [melg3445] C:\WINDOWS\system32\mdmdd.exe
    O4 - Global Startup: VPN Client.lnk = ?
    O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
    O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
    016 - DPF: {33331111-1111-1111-1111-611111193423} -
    O16 - DPF: {33331111-1111-1111-1111-611111193429} -
    O16 - DPF: {33331111-1111-1111-1111-615111193427} -
    O16 - DPF: {64311111-1111-1121-1111-111191113457} - file://c:\eied_s7.cab
    O20 - Winlogon Notify: WLogon - srvc.dll (file missing)
    O21 - SSODL: SystemCheck2 - {54645654-2225-4455-44A1-9F4543D34546} - C:\WINDOWS\System32\vbsys2.dll
    O23 - Service: Windows Event Services (SERVICE32) - Unknown owner - C:\WINDOWS\system\services.exe (file missing)

    Close all programs except HijackThis and click on Fix checked.

    Delete Files and Folders
  • Navigate to the following files/folders using Windows Explorer and delete them when found (please note the ones that can’t be deleted):

    C:\z.exe
    C:\WINDOWS\System32\intell32.exe
    C:\WINDOWS\system32\sscc.exe
    C:\WINDOWS\system32\mdmdd.exe
    C:\WINDOWS\system32\mfceee.exe
    C:\WINDOWS\System32\hpAE31.tmp
    C:\WINDOWS\system32\srvc.dll
    C:\WINDOWS\System32\vbsys2.dll
    C:\WINDOWS\system\services.exe

    AVG Anti-Spyware
  • Please open AVG Anti-Spyware.
    • Click on the 'Scan' tab.
    • Click on 'Complete System Scan' to start the scan process.
    • After the scan, do the following:Important: Don't click on the "Save Scan Report" button before you did hit the "Apply all Actions" button.
    • Make sure that Set all elements to: shows Quarantine (1), if not, click on the link and select 'Quarantine' from the popup menu. (2)
    • At the bottom of the window click on the Apply all Actions button. (3)
    • When done, click the 'Save Report' (4) button, and save the file to your Desktop.
    [external image: Posted Image].
  • Reboot into Normal Mode.

    Report Back
  • Please post the reports from Blacklight, SmitfraudFix and AVG Anti-Spyware, along with a new HijackThis log in your next reply.
Post #10 last edited
Hi Simon V., I did everything you said. After running Blacklight, it didn't create a log on my desktop…so i searched for it and there was no match. I ran ATF Cleaner with no problems After running SmitfraudFix in Safe Mode and restarting Windows into Normal Mode my desktop background was removed. When I performed the Stop Running Processes part intell32.exe wasn't listed. I was able to stop the others though. Deleting Files and Folders the only ones listed wasf C:\z.exe and C:\WINDOWS\System32\vbsys2.dll. I was able to delete C:\z.exe but I couldn't delete C:\WINDOWS\System32\vbsys2.dll it said that acess was denied. I ran the AVG Anti-Spyware and it wouldnt let me Save Report, it wouldnt let me click the button… so i looked in the reports section and there wasn't a saved report What do i need to do. The reports from SmitfraudFix and HijackThis log are below: SmitFraudFix v2.195 Scan done at 12:03:24.70, Wed 06/13/2007 Run from C:\Documents and Settings\holiday\Desktop\Unused Desktop Shortcuts\SmitfraudFix OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT The filesystem type is NTFS Fix run in safe mode »»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Before SmitFraudFix !!!Attention, following keys are not inevitably infected!!! SrchSTS.exe by S!Ri Search SharedTaskScheduler's .dll »»»»»»»»»»»»»»»»»»»»»»»» Killing process »»»»»»»»»»»»»»»»»»»»»»»» hosts 127.0.0.1 localhost »»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix GenericRenosFix by S!Ri »»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files C:\WINDOWS\system32\hp????.tmp Deleted C:\WINDOWS\system32\intell32.exe Deleted C:\WINDOWS\system32\msvol.tlb Deleted C:\WINDOWS\system32\ncompat.tlb Deleted C:\WINDOWS\system32\nvctrl.exe Deleted C:\WINDOWS\system32\oleext.dll Deleted C:\WINDOWS\system32\ot.ico Deleted C:\WINDOWS\system32\ts.ico Deleted C:\WINDOWS\system32\x.exe Deleted C:\WINDOWS\system32\1024\ Deleted C:\DOCUME~1\ALLUSE~1\STARTM~1\Security Troubleshooting.url Deleted C:\DOCUME~1\holiday\FAVORI~1\Antivirus Test Online.url Deleted C:\Program Files\PSGuard\ Deleted »»»»»»»»»»»»»»»»»»»»»»»» DNS »»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files »»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System !!!Attention, following keys are not inevitably infected!!! [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] "System"="" »»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning HKLM\SOFTWARE\SHUDDERLTD Deleted Registry Cleaning done. »»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler After SmitFraudFix !!!Attention, following keys are not inevitably infected!!! SrchSTS.exe by S!Ri Search SharedTaskScheduler's .dll »»»»»»»»»»»»»»»»»»»»»»»» End Logfile of HijackThis v1.99.1 Scan saved at 12:13:16 PM, on 6/13/2007 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\WINDOWS\System32\DRIVERS\CDANTSRV.EXE C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe C:\WINDOWS\dllmgr64.exe C:\WINDOWS\System32\DVDRAMSV.exe C:\WINDOWS\system32\LxrJD31s.exe C:\WINDOWS\System32\nvsvc32.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\wanmpsvc.exe C:\WINDOWS\Explorer.EXE C:\Program Files\EzButton\CplBTQ00.EXE C:\Program Files\TOSHIBA\E-KEY\CeEKey.exe C:\Program Files\ltmoh\Ltmoh.exe C:\Program Files\Toshiba Controls\CpRmtKey.EXE C:\Program Files\TOSHIBA\Power Management\CePMTray.exe C:\WINDOWS\System32\ezSP_Px.exe C:\Program Files\TOSHIBA\TouchPad\TPTray.exe C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe C:\toshiba\ivp\ism\pinger.exe C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe C:\WINDOWS\TPPALDR.EXE C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S0BIC1.EXE C:\toshiba\ivp\ism\ivpsvmgr.exe C:\WINDOWS\System32\mstskmgr.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe C:\WINDOWS\system32\RAMASST.exe C:\Documents and Settings\holiday\Start Menu\Programs\Scanner.exe O2 - BHO: HomepageBHO - {3bf1f86f-b1a8-489b-8d8b-43781d51411f} - C:\WINDOWS\System32\hpAE31.tmp (file missing) O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [CplBTQ00] C:\Program Files\EzButton\CplBTQ00.EXE O4 - HKLM\..\Run: [CeEKEY] C:\Program Files\TOSHIBA\E-KEY\CeEKey.exe O4 - HKLM\..\Run: [LtMoh] C:\Program Files\ltmoh\Ltmoh.exe O4 - HKLM\..\Run: [CpRmtKey] "C:\Program Files\Toshiba Controls\CpRmtKey.EXE" O4 - HKLM\..\Run: [CeEPOWER] C:\Program Files\TOSHIBA\Power Management\CePMTray.exe O4 - HKLM\..\Run: [ezShieldProtector for Px] C:\WINDOWS\System32\ezSP_Px.exe O4 - HKLM\..\Run: [TPNF] C:\Program Files\TOSHIBA\TouchPad\TPTray.exe O4 - HKLM\..\Run: [NDSTray.exe] NDSTray.exe O4 - HKLM\..\Run: [Pinger] c:\toshiba\ivp\ism\pinger.exe /run O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe" O4 - HKLM\..\Run: [TPP Auto Loader] C:\WINDOWS\TPPALDR.EXE O4 - HKLM\..\Run: [EPSON Stylus C62 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S0BIC1.EXE /P23 "EPSON Stylus C62 Series" /O5 "LPT1:" /M "Stylus C62" O4 - HKLM\..\Run: [IVPServiceMgr] C:\toshiba\ivp\ism\ivpsvmgr.exe O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\Internet Security 2005\pccguide.exe" O4 - HKLM\..\Run: [sixer566] C:\WINDOWS\system32\sscc.exe O4 - HKLM\..\Run: [staeck122] C:\WINDOWS\system32\mfceee.exe O4 - HKLM\..\Run: [melg3445] C:\WINDOWS\system32\mdmdd.exe O4 - HKLM\..\Run: [MS Task Manager 32] C:\WINDOWS\System32\mstskmgr.exe O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized O4 - HKLM\..\RunServices: [z] C:\z.exe O4 - HKCU\..\Run: [sixer566] C:\WINDOWS\system32\sscc.exe O4 - HKCU\..\Run: [staeck122] C:\WINDOWS\system32\mfceee.exe O4 - HKCU\..\Run: [melg3445] C:\WINDOWS\system32\mdmdd.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O4 - Global Startup: RAMASST.lnk = C:\WINDOWS\system32\RAMASST.exe O4 - Global Startup: VPN Client.lnk = ? O8 - Extra context menu item: &Add animation to IncrediMail Style Box - C:\PROGRA~1\INCRED~1\bin\resources\WebMenuImg.htm O8 - Extra context menu item: Yahoo! Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm O8 - Extra context menu item: Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\WINDOWS\System32\shdocvw.dll O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\WINDOWS\System32\shdocvw.dll O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O16 - DPF: {33331111-1111-1111-1111-611111193423} - O16 - DPF: {33331111-1111-1111-1111-611111193429} - O16 - DPF: {33331111-1111-1111-1111-615111193427} - O16 - DPF: {64311111-1111-1121-1111-111191113457} - file://c:\eied_s7.cab O20 - Winlogon Notify: WLogon - srvc.dll (file missing) O21 - SSODL: SystemCheck2 - {54645654-2225-4455-44A1-9F4543D34546} - C:\WINDOWS\System32\vbsys2.dll O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: C-DillaSrv - C-Dilla Ltd - C:\WINDOWS\System32\DRIVERS\CDANTSRV.EXE O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe O23 - Service: dllmgr64 - Unknown owner - C:\WINDOWS\dllmgr64.exe O23 - Service: DVD-RAM_Service - Matsushita Electric Industrial Co., Ltd. - C:\WINDOWS\System32\DVDRAMSV.exe O23 - Service: Lexar JD31 (LxrJD31s) - Unknown owner - C:\WINDOWS\SYSTEM32\LxrJD31s.exe O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: Reflection Servers - WRQ, Inc. - C:\Program Files\Reflection\rninetd.exe O23 - Service: Windows Event Services (SERVICE32) - Unknown owner - C:\WINDOWS\system\services.exe (file missing) O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe Window popped up saying: Unexpected error occurred! Error #52 (Bad file name or number) in Sub GetLongPath(?.exe). Please send a report to [removed], mentioning what you were doing, and what version of Windows you have. This message has been copied to your clipboard. THANKS
Post #11
  • Hi lost and confused,

    No Anti-Virus
  • You aren't running Anti-Virus Software. Please download and install one of them first.

    Use an Anti-Virus Software - It is very important that your computer has an anti-virus software running on your machine. This alone can save you a lot of trouble with malware in the future. See this link for a listing of some on line & their stand-alone anti virus programs: Computer Safety On line - Anti-Virus

    Update your Anti-Virus Software - It is very important that you update your Anti-Virus software at least once a week (even more if you wish). If you do not update your Anti-Virus software then it will not be able to catch any of the new variants that may come out.

    No Firewall
  • Use a Firewall - Without a firewall your computer is susceptible to being hacked and taken over. If you use the Windows Firewall you might think that's sufficient but it only controls one way of the traffic (inbound/outbound not sure). Simply using a Firewall in its default configuration can lower your risk greatly. For an article on Firewalls and a listing of some available ones see the link below:
    Computer Safety On line - Software Firewalls

    SDFix
  • Print these instructions or copy them to Notepad and save it to your Desktop, as you won't be able to access internet in Safe Mode.
  • Please reboot into Safe Mode. To do this, go to Start>Turn off Computer, and select Restart. Rapidly tap F8 just before Windows starts to load. In the menu that appears, select Safe Mode (Without Networking)

    Once in Safe Mode, do the following:
    • Open the extracted SDFix folder and double click RunThis.bat to start the script.
    • Type Y to begin the cleanup process.
    • It will remove any Trojan Services and Registry Entries that it finds then prompt you to press any key to reboot.
    • Press any key and it will restart the PC.
    • When the PC restarts the fixtool will run again and complete the removal process then display Finished, press any key to end the script and load your desktop icons.
    • Once the desktop icons load, the SDFix report will open on screen and also save into the SDFix folder as Report.txt
      (Report.txt will also be copied to clipboard ready for posting back on the forum).
    ComboFix
  • Please download Combofix from one of the links below:

    http://download.bleepingcomputer.com/sUBs/ComboFix.exe
    http://www.techsupportforum.com/sectools/sUBs/ComboFix.exe

  • Double-click combofix.exe and follow the prompts.
    • When finished, it shall produce a log for you. Save it to a convenient location.
    Note: Do not mouseclick combofix's window whilst it's running. That may cause it to stall.

    Report Back
  • Please post the reports from SDFix and ComboFix, along with a new HijackThis log in your next reply.
Post #12
Hey Simon V. I have the software "VCOM Fix-it Utilities 7: Professional Verson" it has Anti-Virus Protection and Spyware Removal and some other functions. Can I use this software as my Anti-Virus or do i need to download AVG Anti-Virus and use it instead?
Post #13
Hi lost and confused, Yes, that should be ok :) Please do make sure you install a Firewall, as this is an essential piece of security for your computer.
Post #14
Hi Simon V.

Below are the reports.


SDFix: Version 1.87

Run by [removed]
Microsoft Windows XP [Version 5.1.2600]

Running From: C:\DOCUME~1\holiday\Desktop\COYOTE~1\SDFix

Safe Mode:
Checking Services:

Name:
dllmgr64
MSWindows

ImagePath:
"C:\WINDOWS\dllmgr64.exe"
"C:\WINDOWS\System32\urdvxc.exe" /service

dllmgr64 - Deleted
MSWindows - Deleted



Restoring Windows Registry Values
Restoring Windows Default Hosts File

Rebooting…


Normal Mode:
Checking Files:

Below files will be copied to Backups folder then removed:

C:\WINDOWS\SYSTEM32\ERASEM~1.EXE - Deleted
C:\WINDOWS\system32\eraseme_45506.exe - Deleted
C:\WINDOWS\system32\i - Deleted



Removing Temp Files…

ADS Check:

Checking if ADS is attached to system32 Folder
C:\WINDOWS\system32
No streams found.

Checking if ADS is attached to svchost.exe
C:\WINDOWS\system32\svchost.exe
No streams found.

Checking if ADS is attached to ntoskrnl.exe
C:\WINDOWS\system32\ntoskrnl.exe
No streams found.



Final Check:

Remaining Services:
——————



Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

Remaining Files:
—————

Backups Folder: - C:\DOCUME~1\holiday\Desktop\COYOTE~1\SDFix\backups\backups.zip

Listing Files with Hidden Attributes:

C:\Program Files\Common Files\aolshare\shell\us\shellext.dll
C:\Documents and Settings\holiday\Application Data\VCOM\Fix-It\Quarantine\mfceee.exe.QUAR00
C:\Program Files\America Online 8.0\aolphx.exe
C:\Program Files\America Online 8.0\aoltray.exe
C:\Program Files\America Online 8.0\RBM.exe
C:\Program Files\America Online 8.0\waol.exe
C:\Program Files\America Online 8.0\COMIT\cswitch.exe
C:\Program Files\Autodesk\Autodesk Express Viewer\Setup.exe
C:\WINDOWS\system32\sscc.exe
C:\redir.sys
C:\WINDOWS\page files\maxmeg.sys
C:\WINDOWS\system32\l34501.sys
C:\Program Files\InterActual\InterActual Player\iti3.tmp

Listing User Accounts:

User accounts for \\PETREY

Administrator ASPNET Guest
HelpAssistant holiday Petrey
SUPPORT_388945a0


Finished

ComboFix 07-06-13.3 - C:\Documents and Settings\holiday\Desktop\ComboFix.exe
"holiday" - 2007-06-16 6:51:35 - Service Pack 1 NTFS


((((((((((((((((((((((((( Files Created from 2007-05-16 to 2007-06-16 )))))))))))))))))))))))))))))))


2007-06-16 06:50 49,152 –a—— C:\WINDOWS\nircmd.exe
2007-06-14 13:26 d——– C:\Program Files\Common Files\Wise Installation Wizard
2007-06-13 19:22 1,156 –a—— C:\WINDOWS\mozver.dat
2007-06-13 15:48 13,952 –a—— C:\WINDOWS\system32\drivers\kbdhid.sys
2007-06-13 11:41 10,872 –a—— C:\WINDOWS\system32\drivers\AvgAsCln.sys
2007-06-12 10:30 4,104 –a—— C:\WINDOWS\system32\tmp.reg
2007-06-06 20:51 70,834 —hs—- C:\WINDOWS\system32\sscc.exe


(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2018-01-24 05:47:38 1,025 –sha-w C:\WINDOWS\system32\l34501.sys
2007-06-16 02:50:57 ——– d—–w C:\Program Files\Kazaa
2007-06-16 02:30:36 ——– d—–w C:\Program Files\Hemera Products
2007-06-16 01:42:18 ——– d—–w C:\Program Files\America Online 8.0
2007-06-13 17:10:30 ——– d—–w C:\Program Files\SpyWiper


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"nwiz"="nwiz.exe" [2003-06-24 20:32 C:\WINDOWS\system32\nwiz.exe]
"CplBTQ00"="C:\Program Files\EzButton\CplBTQ00.EXE" [2003-06-27 20:33]
"CeEKEY"="C:\Program Files\TOSHIBA\E-KEY\CeEKey.exe" [2003-06-09 21:07]
"LtMoh"="C:\Program Files\ltmoh\Ltmoh.exe" [2003-01-22 16:54]
"CpRmtKey"="C:\Program Files\Toshiba Controls\CpRmtKey.EXE" [2003-05-29 15:54]
"CeEPOWER"="C:\Program Files\TOSHIBA\Power Management\CePMTray.exe" [2003-08-05 21:07]
"TPNF"="C:\Program Files\TOSHIBA\TouchPad\TPTray.exe" [2003-06-11 19:46]
"NDSTray.exe"="NDSTray.exe" []
"Pinger"="c:\toshiba\ivp\ism\pinger.exe" [2002-10-17 15:21]
"Share-to-Web Namespace Daemon"="C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe" [2002-04-11 07:19]
"AdaptecDirectCD"="C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe" [2002-01-23 15:09]
"IVPServiceMgr"="C:\toshiba\ivp\ism\ivpsvmgr.exe" [2002-10-17 15:15]
"pccguide.exe"="C:\Program Files\Trend Micro\Internet Security 2005\pccguide.exe" [2004-09-15 05:48]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-05-30 07:30]
"VirusScannerPro"="C:\PROGRA~1\VCOM\Fix-It\MemCheck.exe" [2006-09-07 19:28]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"staeck122"="C:\WINDOWS\system32\mfceee.exe" []
"sixer566"="C:\WINDOWS\system32\sscc.exe" [2007-06-06 20:50]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\shellexecutehook.dll" [2007-05-30 07:29]


Contents of the 'Scheduled Tasks' folder
2006-02-20 18:00:00 C:\WINDOWS\tasks\Liquid Audio Auto Update Agent.job

**************************************************************************

catchme 0.3.721 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2007-06-16 06:52:19
Windows 5.1.2600 Service Pack 1 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-06-16 6:52:46

— E O F —

Logfile of HijackThis v1.99.1
Scan saved at 6:53:43 AM, on 6/16/2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\System32\DRIVERS\CDANTSRV.EXE
C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
C:\WINDOWS\System32\DVDRAMSV.exe
C:\PROGRA~1\VCOM\Fix-It\mxtask.exe
C:\WINDOWS\system32\LxrJD31s.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\wanmpsvc.exe
C:\PROGRA~1\VCOM\Fix-It\mxtask.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\EzButton\CplBTQ00.EXE
C:\Program Files\TOSHIBA\E-KEY\CeEKey.exe
C:\Program Files\ltmoh\Ltmoh.exe
C:\Program Files\Toshiba Controls\CpRmtKey.EXE
C:\Program Files\TOSHIBA\Power Management\CePMTray.exe
C:\WINDOWS\System32\ezSP_Px.exe
C:\Program Files\TOSHIBA\TouchPad\TPTray.exe
C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe
C:\toshiba\ivp\ism\pinger.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\WINDOWS\TPPALDR.EXE
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S0BIC1.EXE
C:\toshiba\ivp\ism\ivpsvmgr.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\WINDOWS\system32\sscc.exe
C:\WINDOWS\system32\RAMASST.exe
C:\WINDOWS\explorer.exe
C:\Documents and Settings\holiday\Desktop\Coyote Help\Scanner.exe

O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [CplBTQ00] C:\Program Files\EzButton\CplBTQ00.EXE
O4 - HKLM\..\Run: [CeEKEY] C:\Program Files\TOSHIBA\E-KEY\CeEKey.exe
O4 - HKLM\..\Run: [LtMoh] C:\Program Files\ltmoh\Ltmoh.exe
O4 - HKLM\..\Run: [CpRmtKey] "C:\Program Files\Toshiba Controls\CpRmtKey.EXE"
O4 - HKLM\..\Run: [CeEPOWER] C:\Program Files\TOSHIBA\Power Management\CePMTray.exe
O4 - HKLM\..\Run: [TPNF] C:\Program Files\TOSHIBA\TouchPad\TPTray.exe
O4 - HKLM\..\Run: [NDSTray.exe] NDSTray.exe
O4 - HKLM\..\Run: [Pinger] c:\toshiba\ivp\ism\pinger.exe /run
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [IVPServiceMgr] C:\toshiba\ivp\ism\ivpsvmgr.exe
O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\Internet Security 2005\pccguide.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [VirusScannerPro] C:\PROGRA~1\VCOM\Fix-It\MemCheck.exe
O4 - HKCU\..\Run: [staeck122] C:\WINDOWS\system32\mfceee.exe
O4 - HKCU\..\Run: [sixer566] C:\WINDOWS\system32\sscc.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: RAMASST.lnk = C:\WINDOWS\system32\RAMASST.exe
O8 - Extra context menu item: &Add animation to IncrediMail Style Box - C:\PROGRA~1\INCRED~1\bin\resources\WebMenuImg.htm
O8 - Extra context menu item: Yahoo! Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: C-DillaSrv - C-Dilla Ltd - C:\WINDOWS\System32\DRIVERS\CDANTSRV.EXE
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
O23 - Service: DVD-RAM_Service - Matsushita Electric Industrial Co., Ltd. - C:\WINDOWS\System32\DVDRAMSV.exe
O23 - Service: Fix-It Task Manager - Avanquest Publishing USA, Inc. - C:\PROGRA~1\VCOM\Fix-It\mxtask.exe
O23 - Service: Lexar JD31 (LxrJD31s) - Unknown owner - C:\WINDOWS\SYSTEM32\LxrJD31s.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Reflection Servers - WRQ, Inc. - C:\Program Files\Reflection\rninetd.exe
O23 - Service: Windows Event Services (SERVICE32) - Unknown owner - C:\WINDOWS\system\services.exe (file missing)
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

THANKS
Post #15
  • Hi lost and confused,

    I still do not see evidence of a Firewall in your HijackThis log. As I have already told you it is essential you install one. If you do not do this, I won’t be able to continue helping you.

    Now, on with the fix :)

    Download and Run Gmer
  • Download Gmer to your desktop and unzip it to your desktop.
    • Disconnect from internet and close running programs.
    • There is a small chance this application may crash your computer so save any work you have open.
    • Double click gmer.exe.
    • Let the gmer.sys driver load if asked.
    • If it gives you a warning at program start about rootkit activity and asks if you want to run scan…say Ok.
    • If no warning….
    • Click the rootkit tab
    • To the right of the program you will see a bunch of boxes that have been checked… leave everything checked. Then click the Scan button. Wait for the scan to finish.
    • Once done click the Copy button.
    • Open Notepad and hit ctrl+v to paste the log. Save the log to your desktop please.
    • Click the >>> tab. This will open up all available tabs for you.
    • Click the Autostart tab then the scan button. Once its done click the Copy button and paste it into a new notepad document. Save that document to your desktop please.
    Stop Running Processes
  • Press and hold the Control and Alt keys and press Delete. Then locate sscc.exe and click Stop process.

    Fix Entries with HijackThis
  • Open HijackThis, perform a scan and put a check next to the following items (if present):

    O4 - HKCU\..\Run: [staeck122] C:\WINDOWS\system32\mfceee.exe
    O4 - HKCU\..\Run: [sixer566] C:\WINDOWS\system32\sscc.exe
    O23 - Service: Windows Event Services (SERVICE32) - Unknown owner - C:\WINDOWS\system\services.exe (file missing)

    Close all programs except HijackThis and click on Fix checked.

    Combofix
  • Open Notepad, and copy/paste the text in the quotebox below into it:

    File::
C:\WINDOWS\system32\mfceee.exe
C:\WINDOWS\system32\sscc.exe
C:\WINDOWS\system\services.exe


Folder::
C:\Program Files\SpyWiper


Driver::
SERVICE32
  • Save this as ComboFix-Do.txt.

    [external image: Posted Image]
  • Referring to the picture above, drag ComboFix-Do.txt into ComboFix.exe.
  • It will create a log. Be sure to save it to a convenient location.

    Run Kaspersky Online Scan
  • Please do an online scan with Kaspersky WebScanner

    Click on Kaspersky Online Scanner

    You will be promted to install an ActiveX component from Kaspersky,
    Click Yes.
    • The program will launch and then begin downloading the latest definition files:
    • Once the files have been downloaded click on NEXT
    • Now click on Scan Settings
    • In the scan settings make sure that the following are selected:
      • Scan using the following Anti-Virus database:
      Extended (if available otherwise Standard)
      • Scan Options:
      Scan Archives Scan Mail Bases
    • Click OK
    • Now under select a target to scan:Select My Computer
    • The program will start and scan your system.
    • The scan will take a while so be patient and let it run.
    • Once the scan is complete it will display if your system has been infected.
      • Now click on the Save as Text button:
    • Save the file to your desktop.
    Report Back
  • Please post the reports from Gmer, ComboFix and the Kaspersky Online Scanner, along with a new HijackThis log in your next reply.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI