Spyware / Malware / Virus Removal

[Closed] My Pc Is Infected With Browsermodifier:win32/fotomoto An

1 min read

Looking for the outcome? Ask AI

clay sellers Topic Starter

Post #1September 9, 2007, 8:31 PM UTC last edited September 9, 2007, 9:03 PM UTC

My pc is infected with BrowserModifier:Win32/Fotomoto and Trojan:Win32/Conhook.DBoth Windows Defender and Windows Live OneCare have detected and ''removed'' both of BrowserModifier:Win32/Fotomoto and Trojan:Win32/Conhook.D
But the problem is that they keep recurring, they are detected removed and it goes on.
Please help me, i would like to know how to completely remove these malicious software because i havent had any success yet.

After reading a few posts in here I downloaded and ran HJTsetup.exe and here are the results

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 4:35:47 PM, on 9/9/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Microsoft Windows OneCare Live\Antivirus\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\Program Files\Microsoft Windows OneCare Live\Firewall\msfwsvc.exe
C:\Program Files\Microsoft Windows OneCare Live\winss.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Microsoft Windows OneCare Live\winssnotify.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\regsvr32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\jpedfola.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=566…age=about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [CTDrive] rundll32.exe C:\WINDOWS\system32\drvlod.dll,startup
O4 - HKLM\..\Run: [xolabwnq] rundll32.exe "C:\Program Files\sjcrgpmb\otcpazwt.dll",Init
O4 - HKLM\..\Run: [wvetepgv] regsvr32 /u "C:\Documents and Settings\All Users\Application Data\wvetepgv.dll"
O4 - HKLM\..\Run: [OneCareUI] "C:\Program Files\Microsoft Windows OneCare Live\winssnotify.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/su/ocx/15030/CTSUEng.cab
O16 - DPF: {1EF9F042-C2EB-4293-8213-474CAEEF531D} (TmHcmsX Control) - http://www.trendsecure.com/framework/contr…vex/TmHcmsX.CAB
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1156306197484
O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} (Get_ActiveX Control) - https://h17000.www1.hp.com/ewfrf-JAVA/Secur…loadManager.ocx
O16 - DPF: {BE833F39-1E0C-468C-BA70-25AAEE55775E} (System Requirements Lab) - http://www.systemrequirementslab.com/sysreqlab.cab
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su/ocx/15030/CTPID.cab
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: DomainService - - C:\WINDOWS\system32\jpedfola.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPH11 - HP - C:\WINDOWS\system32\HPHipm11.exe

–
End of file - 5219 bytes

I also ran option 1 in SmitfraudFix.exe here is the log file it produced

SmitFraudFix v2.221

Scan done at 16:56:54.95, Sun 09/09/2007
Run from C:\Documents and Settings\Claves Sellers\Desktop\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
The filesystem type is NTFS
Fix run in normal mode

»»»»»»»»»»»»»»»»»»»»»»»» Process

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Microsoft Windows OneCare Live\Antivirus\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\Program Files\Microsoft Windows OneCare Live\Firewall\msfwsvc.exe
C:\Program Files\Microsoft Windows OneCare Live\winss.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Microsoft Windows OneCare Live\winssnotify.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\regsvr32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\jpedfola.exe
C:\WINDOWS\system32\cmd.exe

»»»»»»»»»»»»»»»»»»»»»»»» hosts

»»»»»»»»»»»»»»»»»»»»»»»» C:\

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32

C:\WINDOWS\system32\drvlod.dll FOUND !

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles

»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Claves Sellers

»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Claves Sellers\Application Data

»»»»»»»»»»»»»»»»»»»»»»»» Start Menu

»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\CLAVES~1\FAVORI~1

»»»»»»»»»»»»»»»»»»»»»»»» Desktop

»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files

»»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys

»»»»»»»»»»»»»»»»»»»»»»»» Desktop Components

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="My Current Home Page"

»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=""

»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""

»»»»»»»»»»»»»»»»»»»»»»»» Rustock

»»»»»»»»»»»»»»»»»»»»»»»» DNS

Description: D-Link AirPlus DWL-G520 Wireless PCI Adapter(rev.

- Packet Scheduler Miniport
DNS Server Search Order: 192.168.0.1

HKLM\SYSTEM\CCS\Services\Tcpip\..\{589D6B4A-A222-45A4-AE3E-E0F7EF9C786B}: DhcpNameServer=192.168.0.1
HKLM\SYSTEM\CS1\Services\Tcpip\..\{589D6B4A-A222-45A4-AE3E-E0F7EF9C786B}: DhcpNameServer=192.168.0.1
HKLM\SYSTEM\CS2\Services\Tcpip\..\{589D6B4A-A222-45A4-AE3E-E0F7EF9C786B}: DhcpNameServer=192.168.0.1
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.0.1
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.0.1
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=192.168.0.1

»»»»»»»»»»»»»»»»»»»»»»»» Scanning for wininet.dll infection

»»»»»»»»»»»»»»»»»»»»»»»» End

clay sellers

Post #2September 9, 2007, 10:00 PM UTC last edited September 9, 2007, 10:04 PM UTC

Ok someone check this and see if I did it right.

I went back and ran Smitfraud.exe in safe mode and used option 2 to clean the registry and it gave me this in the log file

SmitFraudFix v2.221

Scan done at 17:23:25.18, Sun 09/09/2007
Run from C:\Documents and Settings\Claves Sellers\Desktop\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
The filesystem type is NTFS
Fix run in safe mode

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Before SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» Killing process

»»»»»»»»»»»»»»»»»»»»»»»» hosts

127.0.0.1 localhost

»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

GenericRenosFix by S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files

C:\WINDOWS\system32\drvlod.dll Deleted

»»»»»»»»»»»»»»»»»»»»»»»» DNS

HKLM\SYSTEM\CCS\Services\Tcpip\..\{589D6B4A-A222-45A4-AE3E-E0F7EF9C786B}: DhcpNameServer=192.168.0.1
HKLM\SYSTEM\CS1\Services\Tcpip\..\{589D6B4A-A222-45A4-AE3E-E0F7EF9C786B}: DhcpNameServer=192.168.0.1
HKLM\SYSTEM\CS2\Services\Tcpip\..\{589D6B4A-A222-45A4-AE3E-E0F7EF9C786B}: DhcpNameServer=192.168.0.1
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.0.1
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.0.1
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=192.168.0.1

»»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files

»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""

»»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning

Registry Cleaning done.

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler After SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» End

Then I ran ComboFix in regular windows mode but deactivating the virus and spyware program in windows live one care and this is the log file it produced

ComboFix 07-09-10.1 - "Claves Sellers" 2007-09-09 17:36:01.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.624 [GMT -4:00]
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\DOCUME~1\ALLUSE~1\APPLIC~1.\nmbsvupa.dll
C:\Program Files\Common Files\Yazzle1162OinUninstaller.exe
C:\Program Files\Nstbcngl
C:\Program Files\Nstbcngl\srsnhsdo.dll
C:\Program Files\SecCenter
C:\Program Files\SecCenter\scprot4.exe
C:\WINDOWS\system32\bcfwednw.exe
C:\WINDOWS\system32\gebcy.dll
C:\WINDOWS\system32\ljjkigh.dll
C:\WINDOWS\system32\winetn32.dll
C:\WINDOWS\system32\wvutspp.dll
C:\WINDOWS\system32\ycbeg.bak1
C:\WINDOWS\system32\ycbeg.bak2
C:\WINDOWS\system32\ycbeg.ini

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

——-\LEGACY_DOMAINSERVICE
——-\DomainService

((((((((((((((((((((((((( Files Created from 2007-08-10 to 2007-09-10 )))))))))))))))))))))))))))))))
.

2007-09-09 17:35 51,200 –a—— C:\WINDOWS\NirCmd.exe
2007-09-09 16:56 53,248 –a—— C:\WINDOWS\system32\Process.exe
2007-09-09 16:56 51,200 –a—— C:\WINDOWS\system32\dumphive.exe
2007-09-09 16:56 289,144 –a—— C:\WINDOWS\system32\VCCLSID.exe
2007-09-09 16:56 288,417 –a—— C:\WINDOWS\system32\SrchSTS.exe
2007-09-09 15:55 626,688 –a—— C:\WINDOWS\system32\msvcr80.dll
2007-09-09 13:57 81,024 –a—— C:\WINDOWS\system32\drivers\msfwdrv.sys
2007-09-09 13:57 67,784 –a—— C:\WINDOWS\system32\drivers\MpFilter.sys
2007-09-09 13:57 105,856 –a—— C:\WINDOWS\system32\drivers\msfwhlpr.sys
2007-09-08 19:57 95,744 –a—— C:\WINDOWS\system32\drvfak.dll
2007-09-08 19:57 15,360 –a—— C:\WINDOWS\system32\drvfakr.dll
2007-08-15 07:55 221,184 –a—— C:\WINDOWS\system32\wmpns.dll
2007-08-10 15:56 93,128 –a—— C:\WINDOWS\system32\ElbyCDIO.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-09-09 16:35 ——— d——– C:\Program Files\Trend Micro
2007-09-09 14:55 ——— d——– C:\Program Files\Doom 3
2007-09-09 14:04 ——— d——– C:\Program Files\Microsoft Windows OneCare Live
2007-08-07 15:48 25160 –a—— C:\WINDOWS\system32\drivers\ElbyCDIO.sys
2007-08-04 06:59 96704 –a—— C:\WINDOWS\system32\drivers\AnyDVD.sys
2007-08-03 18:34 ——— d——– C:\Program Files\World of Warcraft
2007-07-22 14:48 ——— d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Disney
2007-07-22 14:27 ——— d——– C:\Program Files\Disney
2007-07-22 14:27 ——— d——– C:\Program Files\DIGStream
2007-06-13 06:23 1033216 –a—— C:\WINDOWS\explorer.exe
2006-12-16 22:53 81920 –a—— C:\DOCUME~1\CLAVES~1\APPLIC~1\ezpinst.exe
2006-12-16 22:53 47360 –a—— C:\DOCUME~1\CLAVES~1\APPLIC~1\pcouffin.sys
2006-12-08 19:49 7706216 –a—— C:\DOCUME~1\CLAVES~1\winzip110.exe
2006-11-26 12:27 917504 –a—— C:\DOCUME~1\CLAVES~1\di624_revC_firmware_276.bin
2006-11-26 12:27 917504 –a—— C:\DOCUME~1\CLAVES~1\di624_revC_firmware_275.bin
2006-11-23 22:38 207529840 –a—— C:\DOCUME~1\CLAVES~1\PaintShopPro1100_EN_DE_FR_ES_IT_NL_CORELTBYB_ESD.exe
2006-11-01 01:18 10829831 –a—— C:\DOCUME~1\CLAVES~1\cisagetdinstall.exe
2006-11-01 01:18 10136798 –a—— C:\DOCUME~1\CLAVES~1\cisagetinstall.exe
2006-10-28 21:26 42343200 –a—— C:\DOCUME~1\CLAVES~1\91.47_forceware_winxp2k_english_whql.exe
2006-10-22 17:59 5570551 –a—— C:\DOCUME~1\CLAVES~1\DVDFabPlatinumNonCSS3020.exe
2006-10-21 08:26 15520048 –a—— C:\DOCUME~1\CLAVES~1\IE7-WindowsXP-x86-enu.exe
2006-10-15 23:49 7482578 –a—— C:\DOCUME~1\CLAVES~1\IntelActiveMonitor.exe
2006-10-15 23:47 1282759 –a—— C:\DOCUME~1\CLAVES~1\mbm5370.exe
2006-10-15 13:49 1502943 –a—— C:\DOCUME~1\CLAVES~1\installspeedfan431.exe
2003-09-09 13:23 102400 –a—— C:\DOCUME~1\ALLUSE~1\APPLIC~1\wvetepgv.dll
2006-12-11 13:42:04 88 –sh–r C:\WINDOWS\system32\A8817676C0.sys
2006-12-11 13:42:26 2,516 –sha-w C:\WINDOWS\system32\KGyGaAvL.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-10-22 13:22]
"OneCareUI"="C:\Program Files\Microsoft Windows OneCare Live\winssnotify.exe" [2007-08-02 10:47]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 08:00]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
"Authentication Packages"= msv1_0 C:\\WINDOWS\\system32\\gebcy

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\OneCareMP]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^InterVideo WinCinema Manager.lnk]
backup=C:\WINDOWS\pss\InterVideo WinCinema Manager.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^WinZip Quick Pick.lnk]
backup=C:\WINDOWS\pss\WinZip Quick Pick.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ANIWZCSService]
C:\Program Files\Alpha Networks\ANIWZCS Service\WZCSLDR.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AnyDVD]
"C:\Program Files\SlySoft\AnyDVD\AnyDVD.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTDrive]
rundll32.exe C:\WINDOWS\system32\drvfak.dll,startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTDVDDET]
"C:\Program Files\Creative\SBAudigy2\DVDAudio\CTDVDDET.EXE"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
C:\WINDOWS\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTHelper]
CTHELPER.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTSysVol]
C:\Program Files\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe /r

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTxfiHlp]
CTXFIHLP.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\D-Link AirPlus Xtreme G]
C:\Program Files\D-Link\AirPlus Xtreme G\AirPlusCFG.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPDJ Taskbar Utility]
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb07.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPHmon04]
C:\WINDOWS\system32\hphmon04.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Kernel and Hardware Abstraction Layer]
KHALMNPR.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Logitech Hardware Abstraction Layer]
KHALMNPR.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
nwiz.exe /install

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OneCareUI]
"C:\Program Files\Microsoft Windows OneCare Live\winssnotify.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PlayhouseDisneyDownloadManager]
C:\Program Files\DIGStream\PlayhouseDisneyDownloadManager.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Ptipbmf]
rundll32.exe ptipbmf.dll,SetWriteCacheMode

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SBDrvDet]
C:\Program Files\Creative\SB Drive Det\SBDrvDet.exe /r

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Startup Manager]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
"C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdReg]
C:\WINDOWS\UpdReg.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Wise-FTP Scheduler]
C:\Program Files\AceBIT\WISE-FTP\WF_Scheduler.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WMPNSCFG]
C:\Program Files\Windows Media Player\WMPNSCFG.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\zBrowser Launcher]
C:\Program Files\Logitech\iTouch\iTouch.exe

R0 viasraid;viasraid;C:\WINDOWS\system32\drivers\viasraid.sys
R1 cdudf_xp;cdudf_xp;C:\WINDOWS\system32\drivers\cdudf_xp.sys
R1 DVDVRRdr_xp;DVDVRRdr_xp;C:\WINDOWS\system32\drivers\DVDVRRdr_xp.sys
R1 MSFWHLPR;MSFWHLPR;C:\WINDOWS\system32\DRIVERS\msfwhlpr.sys
R1 pwd_2k;pwd_2k;C:\WINDOWS\system32\drivers\pwd_2k.sys
R1 UDFReadr;UDFReadr;C:\WINDOWS\system32\drivers\UDFReadr.sys
R2 LBeepKE;LBeepKE;C:\WINDOWS\system32\Drivers\LBeepKE.sys
R2 MSFWDrv;MSFWDrv;C:\WINDOWS\system32\DRIVERS\msfwdrv.sys
R2 msfwsvc;OneCare Firewall;"C:\Program Files\Microsoft Windows OneCare Live\Firewall\msfwsvc.exe"
R2 OneCareMP;OneCare AntiSpyware and AntiVirus;"C:\Program Files\Microsoft Windows OneCare Live\Antivirus\MsMpEng.exe"
R3 A3AB;D-Link AirPro 802.11a/b Wireless Adapter Service(A3AB);C:\WINDOWS\system32\DRIVERS\A3AB.sys
R3 dvd_2K;dvd_2K;C:\WINDOWS\system32\drivers\dvd_2K.sys
R3 mmc_2K;mmc_2K;C:\WINDOWS\system32\drivers\mmc_2K.sys
S3 Alpham;Ideazon ZBoard Composite Keyboard Driver;C:\WINDOWS\system32\DRIVERS\Alpham.sys
S3 Dot4 HPH11;Dot4 HPH11;C:\WINDOWS\system32\DRIVERS\hphid411.sys
S3 Dot4Print HPH11;Print Class Driver for IEEE-1284.4 HPH11;C:\WINDOWS\system32\DRIVERS\hphipr11.sys
S3 Dot4Usb HPH11;Dot4Usb HPH11;C:\WINDOWS\system32\drivers\hphius11.sys
S3 LCcfltr;Logitech USB Filter Driver;C:\WINDOWS\system32\drivers\lccfltr.sys
S3 MpFilter;Microsoft Malware Protection Driver;C:\WINDOWS\system32\DRIVERS\MpFilter.sys
S3 PciCon;PciCon;\??\D:\PciCon.sys

.
Contents of the 'Scheduled Tasks' folder
"2007-09-10 21:41:00 C:\WINDOWS\Tasks\RegCure Program Check.job"
"2007-01-25 09:46:26 C:\WINDOWS\Tasks\RegCure.job"
- C:\Program Files\RegCure\RegCure.exe
.
**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-09-10 17:41:11
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

**************************************************************************
.
Completion time: 2007-09-10 17:42:32 - machine was rebooted
C:\ComboFix-quarantined-files.txt … 2007-09-10 17:41
.
— E O F —

It seems to be running fine for the moment but if an expert would look over these files and tell me if I missed anything I would really appreciate it

Clay

It did create a Quarantine file which I am posting here ( should I delete the quarantine file?)

2003-09-08 20:00	  244832	–a——	C:\Qoobox\Quarantine\C\WINDOWS\system32\gebcy.dll.vir
2003-09-08 20:01	  6448	–a——	C:\Qoobox\Quarantine\C\WINDOWS\system32\ycbeg.bak1.vir
2003-09-09 13:13	  40183	–a——	C:\Qoobox\Quarantine\C\Program Files\Common Files\Yazzle1162OinUninstaller.exe.vir
2007-07-08 21:23	  15399	–a——	C:\Qoobox\Quarantine\C\ComboFix\FProps.vbs.vir
2007-09-08 19:55	  20992	–a——	C:\Qoobox\Quarantine\C\WINDOWS\system32\winetn32.dll.vir
2007-09-08 19:55	  43542	–a——	C:\Qoobox\Quarantine\C\WINDOWS\system32\wvutspp.dll.vir
2007-09-08 19:57	  44054	–a——	C:\Qoobox\Quarantine\C\WINDOWS\system32\ljjkigh.dll.vir
2007-09-09 13:38	  75328	–a——	C:\Qoobox\Quarantine\C\WINDOWS\system32\bcfwednw.exe.vir
2007-09-10 17:36	  102400	–a——	C:\Qoobox\Quarantine\C\DOCUME~1\ALLUSE~1\APPLIC~1\nmbsvupa.dll.vir
2007-09-10 17:36	  102400	–a——	C:\Qoobox\Quarantine\C\Program Files\Nstbcngl\srsnhsdo.dll.vir
2007-09-10 17:36	  2020136	–a——	C:\Qoobox\Quarantine\C\WINDOWS\system32\ycbeg.bak2.vir
2007-09-10 17:36	  274432	–a——	C:\Qoobox\Quarantine\C\Program Files\SecCenter\scprot4.exe.vir
2007-09-10 17:37	  1098	–a——	C:\Qoobox\Quarantine\Registry_backups\LEGACY_DOMAINSERVICE.reg.cf
2007-09-10 17:37	  2012055	–a——	C:\Qoobox\Quarantine\C\WINDOWS\system32\ycbeg.ini.vir
2007-09-10 17:37	  247727	–a——	C:\Qoobox\Quarantine\catchme2007-09-10_174106.70.zip
2007-09-10 17:37	  2956	–a——	C:\Qoobox\Quarantine\Registry_backups\services_DomainService.reg.cf
2007-09-10 17:37	  309	–a——	C:\Qoobox\Quarantine\catchme.log


Folder PATH listing for volume DSK1_VOL1
Volume serial number is 7956-3A00
C:\QOOBOX\QUARANTINE
|   catchme.log
|   catchme2007-09-10_174106.70.zip
|   
+—C
|   +—ComboFix
|   |	   FProps.vbs.vir
|   |	   
|   +—DOCUME~1
|   |   \—ALLUSE~1
|   |	   \—APPLIC~1
|   |			   nmbsvupa.dll.vir
|   |			   
|   +—Program Files
|   |   +—Common Files
|   |   |	   Yazzle1162OinUninstaller.exe.vir
|   |   |	   
|   |   +—Nstbcngl
|   |   |	   srsnhsdo.dll.vir
|   |   |	   
|   |   \—SecCenter
|   |		   scprot4.exe.vir
|   |		   
|   \—WINDOWS
|	   \—system32
|			   bcfwednw.exe.vir
|			   gebcy.dll.vir
|			   ljjkigh.dll.vir
|			   winetn32.dll.vir
|			   wvutspp.dll.vir
|			   ycbeg.bak1.vir
|			   ycbeg.bak2.vir
|			   ycbeg.ini.vir
|			   
\—Registry_backups
		LEGACY_DOMAINSERVICE.reg.cf
		services_DomainService.reg.cf

LDTate

Post #3September 10, 2007, 10:33 PM UTC

Open notepad and copy/paste the text in the quotebox below into it:

File::
C:\WINDOWS\system32\drvfak.dll
C:\WINDOWS\system32\drvfakr.dll
C:\DOCUME~1\ALLUSE~1\APPLIC~1\wvetepgv.dll
C:\WINDOWS\system32\gebcy

Folder::
C:\Qoobox\Quarantine
C:\Qoobox

Registry::
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
"Authentication Packages"=-
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa]
"Authentication Packages"=hex(7):6d,73,76,31,5f,30,00,00

Save this as Save this as "CFScript"

[external image: Posted Image]

Refering to the picture above, drag CFScript.txt into ComboFix.exe

Then post the results log

LDTate

Post #4September 15, 2007, 12:58 PM UTC

Due to inactivity this topic will be closed. If you need help please start a new thread and post a new HJT log

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

[Closed] My Pc Is Infected With Browsermodifier:win32/fotomoto An

✨ Ask AI

Ask AI