What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Keep Getting Same Malware After Deleting

5 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Hi,

Running Win2KPro SP4; IE6 SP1, OE6, Ad-Aware SE Pro, Ad-Watch, AVG Anti-Spyware, AVG Free, Spybot S&D, Spyware Blaster, ALL updated daily except MS is done when they make available. The paid-for AVG stuff is on order.

On 9 Jun 07 I had various error messages and year = 2005 when boot completed. Corrected date with 'Adjust Date/Time'. Found 3 new 2005 programs: 8ABE4C4.exe, 1639E8CD.exe, & FC4ABA24.dll. Deleted 1639E8CD.exe, other 2 in use. Rebooted to DOS & deleted 8ABE4C4.exe & FC4ABA24.dll. Scanned with online TREND MICRO, detected 7 http cookies and Adware-180Solutions, deleted them.

Much more of the same happened that is too much to write about. Finally took computer to local shop; he "fixed" it. I had bought Ad-Aware Pro 2007 and installed it. That made EVERYTHING go bananas. After a week or so of that abortion I uninstalled it and reinstalled AAW SE Pro.

Things went well for a while, then I started getting Backdoor.Agent.AHJ, which also resets the year to 2005. I have tried many things but that malware keeps returning. I finally tried using Eraser to really delete the three programs. That was today, and so far so good, but I also decided to ask for help here. Kind of a shotgun approach. I hope I can avoid online scanning; my 26.4 Kbps dialup is not good for my blood pressure.

So here's a HijackThis log, hope you can help:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Logfile of HijackThis v1.99.1
Scan saved at 6:37:31 PM, on 6/26/2007
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.EXE
C:\WINNT\system32\anclb.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\WINNT\system32\RunDll32.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\WINNT\StartupMonitor.exe
C:\Program Files\Eraser\eraser.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.arkansas.net
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.arkansas.net/webmail/src/login.php
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Arkansas.Net
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINNT\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [ANCLoadBalancer] C:\WINNT\system32\anclb.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [Run StartupMonitor] StartupMonitor.exe
O4 - HKCU\..\Run: [ccleaner] "C:\Program Files\CCleaner\ccleaner.exe" /AUTO
O4 - HKCU\..\Run: [Eraser] C:\Program Files\Eraser\eraser.exe -hide
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O16 - DPF: {4E330863-6A11-11D0-BFD8-006097237877} (InstallFromTheWeb ActiveX Control) - http://tw.msi.com.tw/autobios/client/iftwclix.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1170259838203
O16 - DPF: {E735FF6D-53C6-4C4D-BDC0-26CB90EE6C88} (setup_assistant.SetupAssistant) - https://oracle.anc.net/gck/setup_assistant.CAB
O16 - DPF: {E8F628B5-259A-4734-97EE-BA914D7BE941} (Driver Agent ActiveX Control) - http://driveragent.com/files/driveragent.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{84CD0A23-BEC1-48DE-8976-26C6102AB5C9}: NameServer = 209.244.0.3 209.244.0.4
O23 - Service: 6F0D0C5E - Unknown owner - C:\WINNT\system32\1639E8CD.EXE (file missing)
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINNT\system32\drivers\KodakCCS.exe
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
I'll be offline until Thursday PM; if anyone answers during that time I'll respond that evening.

Bob
Post #2
Hello bobberles and welcome to the TomCoyote Forums

My name is Trevuren and I will be helping you with your problem.


A. You don't appear to have a software firewall running

It is important that you use a software firewall, to prevent unauthorised traffic both out of and into your computer.
If you have disabled it, please re-enable it.
If you do not have a firewall installed, please download and instal one of these excellent (and free) products: It is important to note that you should only have one firewall installed at a time.


B. Please download this file - combofix.exe by sUBs
  • Double click combofix.exe & follow the prompts.
  • When finished, it will produce a log. Please save that log to post in your next reply along with a fresh HJT log.
Note:
Do not mouse-click combofix's window while it is running. That may cause it to stall.

Regards,

Trevuren
Post #3
I don't have a firewall because I've had bad experiences with them and the "experts" say I don't need a firewall because I have dialup, hence I am not online all the the time. (Yeah, I know, it doesn't make sense to me either, but these were EXPERTS!) So I tried today to download ZA and after 30 minutes of NO movement of the progress meter (even though the Arkansas.net Activity box shows "normal" downloading speed) I decided I'd be dead before the software dribbles down to me. I gave up. But then I found those three files were again installed, so maybe they are causing blockage or who knows what. At any rate, there was no obvious evidence of their existence; I just check in system32 periodically. They were not there when I booted up today, so I don't know what triggers them. So if that is the reason, maybe I'll have better results downloading ZA after this malware is removed.

So here are the two logs, ComboFix and a fresh HJT:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

"Bob Berles" - 06/28/2007 17:02:39 - ComboFix 07-06-28.4 - Service Pack 4


((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))


C:\WINNT\system32\Msf3sf.sys
C:\WINNT\system32\winsys.exe


((((((((((((((((((((((((( Files Created from 2007-05-28 to 2007-06-28 )))))))))))))))))))))))))))))))


2007-06-28 17:01 49,152 –a—— C:\WINNT\nircmd.exe
2007-06-28 15:36 1 –a—— C:\WINNT\system32\index.dat
2007-06-26 21:38 1,070 –a—— C:\WINNT\system32\tmp.reg
2007-06-26 21:37 53,248 –a—— C:\WINNT\system32\Process.exe
2007-06-26 21:37 51,200 –a—— C:\WINNT\system32\dumphive.exe
2007-06-26 21:37 288,417 –a—— C:\WINNT\system32\SrchSTS.exe
2007-06-26 07:14 d——– C:\Program Files\Eraser
2007-06-21 07:29 d——– C:\Program Files\Lavasoft
2007-06-18 16:31 d——– C:\WINNT\system32\SoftwareDistribution
2007-06-17 12:59 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Lavasoft
2007-06-17 07:58 d——– C:\Program Files\DVD Identifier
2007-06-17 06:42 d——– C:\Program Files\ZipBackup


(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-04-28 02:02:52 ——– d—–w C:\Program Files\HDD Health
2007-04-25 07:52:16 147,216 —-a-w C:\WINNT\system32\SCHANNEL.DLL
2007-04-17 03:47:36 33,624 —-a-w C:\WINNT\system32\wups.dll
2007-04-17 03:45:54 1,710,936 —-a-w C:\WINNT\system32\wuaueng.dll
2007-04-17 03:45:48 549,720 —-a-w C:\WINNT\system32\wuapi.dll
2007-04-17 03:45:42 325,976 —-a-w C:\WINNT\system32\wucltui.dll
2007-04-17 03:45:36 203,096 —-a-w C:\WINNT\system32\wuweb.dll
2007-04-17 03:45:28 92,504 —-a-w C:\WINNT\system32\cdm.dll
2007-04-17 03:45:20 53,080 —-a-w C:\WINNT\system32\wuauclt.exe
2007-04-17 03:45:20 43,352 —-a-w C:\WINNT\system32\wups2.dll
2007-04-16 12:44:08 54,032 —-a-w C:\WINNT\system32\mpr.dll
2007-04-05 07:17:40 2,854,400 —-a-w C:\WINNT\system32\msi.dll


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}=C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll [10/22/06 11:08p]
{53707962-6F74-2D53-2644-206D7942484F}=C:\Program Files\Spybot - Search & Destroy\SDHelper.dll [05/31/05 01:04a]
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}=C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll [12/15/06 03:23a]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"nwiz"="nwiz.exe" [02/28/04 07:18p C:\WINNT\system32\nwiz.exe]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe" [04/21/07 12:58p]
"Synchronization Manager"="mobsync.exe" [07/14/03 12:00p C:\WINNT\system32\mobsync.exe]
"Cmaudio"="cmicnfg.cpl" []
"RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [01/12/05 03:01a]
"Run StartupMonitor"="StartupMonitor.exe" [05/20/00 05:23p C:\WINNT\StartupMonitor.exe]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ccleaner"="C:\Program Files\CCleaner\ccleaner.exe" [12/15/06 06:13a]
"Eraser"="C:\Program Files\Eraser\eraser.exe" [07/25/03 11:15a]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce]
"^SetupICWDesktop"=C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\shellexecutehook.dll" [09/28/06 08:13a]


**************************************************************************

catchme 0.3.721 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2007-06-28 17:03:16
Windows 5.0.2195 Service Pack 4 FAT NTAPI

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

Files hidden from API:
C:\WINNT\'–§

Completion time: 06/28/2007 17:03:53
C:\ComboFix-quarantined-files.txt … 06/28/07 05:03p

— E O F —
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Logfile of HijackThis v1.99.1
Scan saved at 5:14:09 PM, on 6/28/2007
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\anclb.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\WINNT\StartupMonitor.exe
C:\Program Files\Eraser\eraser.exe
C:\WINNT\explorer.exe
C:\Program Files\Windows NT\Accessories\WORDPAD.EXE
C:\Program Files\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.arkansas.net/webmail/src/login.php
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [Run StartupMonitor] StartupMonitor.exe
O4 - HKCU\..\Run: [ccleaner] "C:\Program Files\CCleaner\ccleaner.exe" /AUTO
O4 - HKCU\..\Run: [Eraser] C:\Program Files\Eraser\eraser.exe -hide
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O16 - DPF: {4E330863-6A11-11D0-BFD8-006097237877} (InstallFromTheWeb ActiveX Control) - http://tw.msi.com.tw/autobios/client/iftwclix.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1170259838203
O16 - DPF: {E735FF6D-53C6-4C4D-BDC0-26CB90EE6C88} (setup_assistant.SetupAssistant) - https://oracle.anc.net/gck/setup_assistant.CAB
O16 - DPF: {E8F628B5-259A-4734-97EE-BA914D7BE941} (Driver Agent ActiveX Control) - http://driveragent.com/files/driveragent.cab
O23 - Service: 6F0D0C5E - Unknown owner - C:\WINNT\system32\1639E8CD.EXE (file missing)
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINNT\system32\drivers\KodakCCS.exe

Bob
Post #4
Firewall on dialup

Please read the following: http://askbobrankin.com/do_i_need_a_firewall.html

A. Please disable AVG AntiSpyware by opening the program and on the Status page - beside "Resident Shield" click on "change status" so that it says "inactive" for it may interfere with our HJT fix.
  • Remember to reactivate this feature when all our work is finished.

B. Please RUN HijackThis, click the SCAN button to produce a log.
  • Place a check mark beside each one of the following items:

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
    O23 - Service: 6F0D0C5E - Unknown owner - C:\WINNT\system32\1639E8CD.EXE (file missing)

  • Now with all the items selected, and all windows closed except for HJT, DELETE them by clicking the FIX checked button and EXIT the program.


C. 1. Please open Notepad
  • Click Start , then Run
  • Type notepad .exe in the Run Box.
2. Now copy/paste the entire content of the codebox below into the Notepad window:

File:
C:\WINNT\system32\index.dat
C:\WINNT\system32\anclb.exe
C:\WINNT\system32\1639E8CD.EXE

Driver::
6F0D0C5E


3. Save the above as ComboFix-Do.txt

4. Then drag the ComboFix-Do.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.

[external image: Posted Image]


5. After reboot, please post the following reports/logs into your next reply:
  • Combofix.txt
  • A new HijackThis log.
Trevuren
Post #5
Hi Trevuren, Please forgive the lapse in good manners in my last post. I thank you very much for helping me. But I hope I'm not more trouble than I'm worth! In "Block A" I cannot do as you ask because beside "Resident Shield" is a circled letter "i" followed by "N/A" and neither is responsive. So I went to Services and found that AVG Anti-Spyware Guard has Startup Type: Automatic but the Status column is blank. So I pulled up Properties and went through the Start process. But when I then restarted AVG there was a very noticeable flickering on the screen and no "change status" appears. And going back to Services shows a blank Status column again. I have the free AVG; does that item not work for the freebies? (I'm still waiting for the paid version CD to arrive.) Will it be a waste of time to go ahead or is that exactly the condition we want to be in for the further operations? Or, could that be something broke in the AVG program? Should I reinstall? Bob
Post #6
1. If your trial period is over (usually 30 days), one of the features that are disabled is the shield. The other is the automatic update feature.

2. Please just disregard the part about the AVG AS shields and continue with the fix as described.

Trevuren
Post #7
Hi Trevuren,
Here's the two reports you wanted:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
"Bob Berles" - 06/29/2007 7:21:51 - ComboFix 07-06-28.4 - Service Pack 4
Command switches used :: C:\Documents and Settings\Bob Berles\Desktop\ComboFix-Do.txt


((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))


——-\LEGACY_6F0D0C5E
——-\6F0D0C5E


((((((((((((((((((((((((( Files Created from 2007-05-28 to 2007-06-29 )))))))))))))))))))))))))))))))


2007-06-29 07:23 16,384 –a—-t- C:\WINNT\system32\Perflib_Perfdata_3fc.dat
2007-06-28 17:01 49,152 –a—— C:\WINNT\nircmd.exe
2007-06-28 15:36 1 –a—— C:\WINNT\system32\index.dat
2007-06-26 21:38 1,070 –a—— C:\WINNT\system32\tmp.reg
2007-06-26 21:37 53,248 –a—— C:\WINNT\system32\Process.exe
2007-06-26 21:37 51,200 –a—— C:\WINNT\system32\dumphive.exe
2007-06-26 21:37 288,417 –a—— C:\WINNT\system32\SrchSTS.exe
2007-06-26 07:14 d——– C:\Program Files\Eraser
2007-06-21 07:29 d——– C:\Program Files\Lavasoft
2007-06-18 16:31 d——– C:\WINNT\system32\SoftwareDistribution
2007-06-17 12:59 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Lavasoft
2007-06-17 07:58 d——– C:\Program Files\DVD Identifier
2007-06-17 06:42 d——– C:\Program Files\ZipBackup


(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-04-28 02:02:52 ——– d—–w C:\Program Files\HDD Health
2007-04-25 07:52:16 147,216 —-a-w C:\WINNT\system32\SCHANNEL.DLL
2007-04-17 03:47:36 33,624 —-a-w C:\WINNT\system32\wups.dll
2007-04-17 03:45:54 1,710,936 —-a-w C:\WINNT\system32\wuaueng.dll
2007-04-17 03:45:48 549,720 —-a-w C:\WINNT\system32\wuapi.dll
2007-04-17 03:45:42 325,976 —-a-w C:\WINNT\system32\wucltui.dll
2007-04-17 03:45:36 203,096 —-a-w C:\WINNT\system32\wuweb.dll
2007-04-17 03:45:28 92,504 —-a-w C:\WINNT\system32\cdm.dll
2007-04-17 03:45:20 53,080 —-a-w C:\WINNT\system32\wuauclt.exe
2007-04-17 03:45:20 43,352 —-a-w C:\WINNT\system32\wups2.dll
2007-04-16 12:44:08 54,032 —-a-w C:\WINNT\system32\mpr.dll
2007-04-05 07:17:40 2,854,400 —-a-w C:\WINNT\system32\msi.dll


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}=C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll [06-10-22 23:08 ]
{53707962-6F74-2D53-2644-206D7942484F}=C:\Program Files\Spybot - Search & Destroy\SDHelper.dll [05-05-31 01:04 ]
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}=C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll [06-12-15 03:23 ]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"nwiz"="nwiz.exe" [04-02-28 19:18 C:\WINNT\system32\nwiz.exe]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe" [07-04-21 12:58 ]
"Synchronization Manager"="mobsync.exe" [03-07-14 12:00 C:\WINNT\system32\mobsync.exe]
"Cmaudio"="cmicnfg.cpl" []
"RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [05-01-12 03:01 ]
"Run StartupMonitor"="StartupMonitor.exe" [00-05-20 17:23 C:\WINNT\StartupMonitor.exe]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ccleaner"="C:\Program Files\CCleaner\ccleaner.exe" [06-12-15 06:13 ]
"Eraser"="C:\Program Files\Eraser\eraser.exe" [03-07-25 11:15 ]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce]
"^SetupICWDesktop"=C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\shellexecutehook.dll" [06-09-28 08:13 ]


**************************************************************************

catchme 0.3.721 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2007-06-29 07:23:40
Windows 5.0.2195 Service Pack 4 FAT NTAPI

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

Files hidden from API:
C:\WINNT\'–§

Completion time: 2007-06-29 7:25:13 - machine was rebooted
C:\ComboFix3.txt … 07-06-28 17:03
C:\ComboFix-quarantined-files.txt … 07-06-29 07:24
C:\ComboFix2.txt … 07-06-29 07:18

— E O F —
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Logfile of HijackThis v1.99.1
Scan saved at 7:29:03 AM, on 6/29/2007
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.EXE
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\WINNT\system32\RunDll32.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\WINNT\StartupMonitor.exe
C:\Program Files\Eraser\eraser.exe
C:\Program Files\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.arkansas.net/webmail/src/login.php
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [Run StartupMonitor] StartupMonitor.exe
O4 - HKCU\..\Run: [ccleaner] "C:\Program Files\CCleaner\ccleaner.exe" /AUTO
O4 - HKCU\..\Run: [Eraser] C:\Program Files\Eraser\eraser.exe -hide
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O16 - DPF: {4E330863-6A11-11D0-BFD8-006097237877} (InstallFromTheWeb ActiveX Control) - http://tw.msi.com.tw/autobios/client/iftwclix.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1170259838203
O16 - DPF: {E735FF6D-53C6-4C4D-BDC0-26CB90EE6C88} (setup_assistant.SetupAssistant) - https://oracle.anc.net/gck/setup_assistant.CAB
O16 - DPF: {E8F628B5-259A-4734-97EE-BA914D7BE941} (Driver Agent ActiveX Control) - http://driveragent.com/files/driveragent.cab
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINNT\system32\drivers\KodakCCS.exe
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Bob
Post #8
Your log looks good. If you have no more malware-related problems that you are aware of, just give me the OK and we can start the final but essential cleanup procedures and recommendations.

Trevuren
Post #10
Congratulations, your log is CLEAN

1. Re-hide your System Files and Folders to prevent any future accidents.
  • Open My Computer.
  • Select the Tools menu and click Folder Options.
  • Select the View Tab.
  • Under the Hidden files and folders heading deselect Show hidden files and folders.
  • Check the Hide protected operating system files (recommended) option.
  • Click Yes to confirm.
  • Click OK.
.2. Please DELETE Malicious Items from the AVG AntiSpyware Quarantine

A. Open AVG AntiSpyware by double clicking its icon located in the System Tray down by the clock.

B. Click on "Infections" on the AVG AntiSpyware Toolbar, then select the "Quarantine Tab"

C. Choose "Select All" at the bottom of the AVG AntiSpyware window, then click on the "Remove Finally" button and EXIT the program.



3. Here are some tips to reduce the potential for spyware infection in the future:

Make sure you keep your Windows OS current by visiting Windows update
regularly to download and install any critical updates and service packs. With out these you are leaving the backdoor open.

I strongly recommend installing the following applications:
  • Spywareblaster <= SpywareBlaster will prevent spyware from being installed.
  • Spywareguard <= SpywareGuard offers realtime protection from spyware installation attempts.
  • How to use Ad-Aware to remove Spyware <= If you suspect that you have spyware installed on your computer, here are instructions on how to download, install and then use Ad-Aware.
  • How to use Spybot to remove Spyware <= If you suspect that you have spyware installed on your computer, here are instructions on how to download, install and then use Spybot. Similar to Ad-Aware, I strongly recommend both to catch most spyware.
To protect yourself further:
  • Spyad <= IE/Spyad places over 4000 websites and domains in the IE Restricted list which will severely impair attempts to infect your system. It basically prevents any downloads (Cookies etc) from the sites listed, although you will still be able to connect to the sites.
  • MVPS Hosts file <= The MVPS Hosts file replaces your current HOSTS file with one containing well know ad sites etc. Basically, this prevents your coputer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer
  • Google Toolbar <= Get the free google toolbar to help stop pop up windows.
And also see TonyKlein's good advice
So how did I get infected in the first place?

Regards,

Trevuren
Post #11
Well, it should be congratulations to you, Trevuren, not me. After all, I may have done some of the work but I could not have done it without you. And I can see that I have a lot of work still in front of me. Thank you very much, and I hope we never have to get together again. (That sounds AWFUL!) Best regards, Bob
Post #12
Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please begin a New Topic.

Coyote's Installed programs for prevention:

http://forums.tomcoyote.org/index.php?showtopic=31418

The help you receive here is free. If you wish to show your appreciation, then you may donate to help keep us online.

Visit the CoyoteStore http://TomCoyote.org/coyotestore.php

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI