IndiGenus
Okay…whew 
for now my work is done. I hand it over to you to get to work.
I would hold off for now on any re-activation. I wonder how "real" that is? I've never seen malware trigger that but there is a first for everything I guess. Have you made any hardware changes recently?
STEP 1:
Go to Add or Remove Programs and uninstall the following if present.
Click Start > Control Panel > Double Click Add or Remove Programs:
Network Monitor
Web Buying
Command
STEP 2:
Please copy (Ctrl C) and paste (Ctrl V) the following text in the quote to Notepad. Save it as "All Files" and name it FixServices.bat. Please save it on your desktop.
STEP 3:
Run HijackThis. Hit None of the above, Click Do a System Scan Only. Put a Check in the box on the left side on these:
O2 - BHO: (no name) - {0B99F297-B0C1-483B-90A8-61E45BA8322A} - C:\WINDOWS\system32\ddccc.dll (file missing)
O2 - BHO: BhoApp Class - {0CB66BA8-5E1F-4963-93D1-E1D6B78FE9A2} - C:\WINDOWS\system32\bho.dll
O2 - BHO: (no name) - {203CD78F-4E66-40E4-3620-3871C17593EF} - C:\WINDOWS\system32\zma.dll (file missing)
O2 - BHO: (no name) - {213ED788-1A65-18B4-6120-3871C17593ED} - C:\WINDOWS\system32\bxtnczme.dll (file missing)
O2 - BHO: (no name) - {733E9132-53CA-4C97-9AC9-145C4502FA20} - C:\WINDOWS\system32\fccdbyx.dll (file missing)
O2 - BHO: (no name) - {8c60345b-a7fe-4236-88eb-d0dcc43db0ff} - C:\WINDOWS\system32\khwdkbg.dll
O2 - BHO: 0 - {A677F917-6C3C-4B0C-3FBC-338194D069A0} - C:\Program Files\Windows NT\labunuwir.dll
O4 - HKLM\..\Run: [runner1] C:\WINDOWS\retadpu1000106.exe 61A847B5BBF72813329B385772FF01F0B3E35B6638993F4661AA4EBD86D67C56389B284534F310
O4 - HKLM\..\Run: [howyk] C:\Program Files\iWin\howyk22011.exe
O4 - HKLM\..\Run: [pipmon] pipmon.exe
O4 - HKLM\..\Run: [Windows Framework] C:\DOCUME~1\Michael\LOCALS~1\Temp\frmwrk.exe
O4 - HKCU\..\Run: [mschkdsk.exe] C:\WINDOWS\system32\mschkdsk.exe
O4 - HKCU\..\Run: [Insider] C:\Program Files\Insider\Insider.exe
O4 - HKCU\..\Run: [Habb] "C:\WINDOWS\STEM32~1\javaw.exe" -vt yazb
O4 - HKCU\..\Run: [Ifkla] "C:\Program Files\?ppPatch\regedit.exe"
O4 - HKCU\..\Run: [WebBuying] C:\Program Files\Web Buying\v1.8.3\webbuying.exe
O4 - Global Startup: 1.exe
O4 - Global Startup: 2.exe
O4 - Global Startup: 3.exe
O20 - Winlogon Notify: fccdbyx - fccdbyx.dll (file missing)
O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINDOWS\TWljaGFlbCBCYXVlcg\command.exe
O23 - Service: Network Monitor - Unknown owner - C:\Program Files\Network Monitor\netmon.exe
Then close all windows except this one and press Fix checked.
STEP 4:
1. Please open Notepad
3. Save the above as CFScript.txt
4. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.
STEP 5:
Please do a search for the following file(s):
Start > Search > All Files And Folders
Under More Advanced Options, make sure the following are checked:
*Search system folders
*Search hidden files and folders
*Search subfolders
Then copy and paste the following(one at a time) in the search box:
pipmon.exe
1.exe
2.exe
3.exe
WinFlyer32.dll
If found delete all instances of these files.
STEP 6:
Download the trial version of AVG Anti-Spyware from here and install it. When the program has been installed, and you click the Finish button, AVG Anti-Spyware will open.
If the program does not automatically update itself during installation, or you are unsure whether it has done so, please do the following:
Please download ATF Cleaner here by Atribune. This program is for XP and Windows 2000 only.
It does not require any installation and uses minimal system resources. It is set up to clean IE, FireFox and Opera, and detects the browsers you have and grays out the other(s).
We Now Need To Boot Into Safemode Now
Restart your computer.
When the machine first starts again it will generally list some equipment that is installed in your machine,
amount of memory, hard drives installed etc (BOOT SCREEEN).
At this point you should gently tap the F8 key repeatedly until you are presented with a Options menu.
Select the option for Safe Mode using the arrow keys.
Then press enter on your keyboard to boot into Safe Mode.
Run AVG
STEP 7:
Using Internet Explorer, click on Kaspersky Online Scanner * Click 'Accept' in the window that pops up.
* You will be prompted to install an ActiveX component from Kaspersky, Click on the information bar and select Install ActiveX Control if so. This may happen more than once. That is OK. You also may get a warning from your Windows Firewall. You can tell it to unblock.
* The program will launch and then start to download the latest definition files.
* Once the scanner is installed and the definitions downloaded, click 'Next'.
* Now click on 'Scan Settings'
* In the scan settings make sure that the following are selected:
o Scan using the following Anti-Virus database: 'Extended' (If available, otherwise 'Standard')
o Scan Options: 'Scan Archives' and 'Scan Mail Bases'
* Click 'OK'
* Now under 'Select a target to scan' select 'My Computer'
* The scan will take a while, so be patient and let it run. Once the scan is complete, it will display whether your system has been infected.
* Now click on the 'Save Report As…' button:
* Make sure it says Save as a text file - change it if not
* Save the file to your desktop.
Please post the Kaspersky report and a new HijackThis log, along with the AVG log from earlier.
You may need to make multiple posts so they don't get cut off.
for now my work is done. I hand it over to you to get to work. I would hold off for now on any re-activation. I wonder how "real" that is? I've never seen malware trigger that but there is a first for everything I guess. Have you made any hardware changes recently?
STEP 1:
Go to Add or Remove Programs and uninstall the following if present.
Click Start > Control Panel > Double Click Add or Remove Programs:
Network Monitor
Web Buying
Command
STEP 2:
Please copy (Ctrl C) and paste (Ctrl V) the following text in the quote to Notepad. Save it as "All Files" and name it FixServices.bat. Please save it on your desktop.
Double click FixServices.bat. A window will open and close. This is normal.sc stop cmdService
sc delete cmdService
sc stop Network Monitor
sc delete Network Monitor
exit
STEP 3:
Run HijackThis. Hit None of the above, Click Do a System Scan Only. Put a Check in the box on the left side on these:
O2 - BHO: (no name) - {0B99F297-B0C1-483B-90A8-61E45BA8322A} - C:\WINDOWS\system32\ddccc.dll (file missing)
O2 - BHO: BhoApp Class - {0CB66BA8-5E1F-4963-93D1-E1D6B78FE9A2} - C:\WINDOWS\system32\bho.dll
O2 - BHO: (no name) - {203CD78F-4E66-40E4-3620-3871C17593EF} - C:\WINDOWS\system32\zma.dll (file missing)
O2 - BHO: (no name) - {213ED788-1A65-18B4-6120-3871C17593ED} - C:\WINDOWS\system32\bxtnczme.dll (file missing)
O2 - BHO: (no name) - {733E9132-53CA-4C97-9AC9-145C4502FA20} - C:\WINDOWS\system32\fccdbyx.dll (file missing)
O2 - BHO: (no name) - {8c60345b-a7fe-4236-88eb-d0dcc43db0ff} - C:\WINDOWS\system32\khwdkbg.dll
O2 - BHO: 0 - {A677F917-6C3C-4B0C-3FBC-338194D069A0} - C:\Program Files\Windows NT\labunuwir.dll
O4 - HKLM\..\Run: [runner1] C:\WINDOWS\retadpu1000106.exe 61A847B5BBF72813329B385772FF01F0B3E35B6638993F4661AA4EBD86D67C56389B284534F310
O4 - HKLM\..\Run: [howyk] C:\Program Files\iWin\howyk22011.exe
O4 - HKLM\..\Run: [pipmon] pipmon.exe
O4 - HKLM\..\Run: [Windows Framework] C:\DOCUME~1\Michael\LOCALS~1\Temp\frmwrk.exe
O4 - HKCU\..\Run: [mschkdsk.exe] C:\WINDOWS\system32\mschkdsk.exe
O4 - HKCU\..\Run: [Insider] C:\Program Files\Insider\Insider.exe
O4 - HKCU\..\Run: [Habb] "C:\WINDOWS\STEM32~1\javaw.exe" -vt yazb
O4 - HKCU\..\Run: [Ifkla] "C:\Program Files\?ppPatch\regedit.exe"
O4 - HKCU\..\Run: [WebBuying] C:\Program Files\Web Buying\v1.8.3\webbuying.exe
O4 - Global Startup: 1.exe
O4 - Global Startup: 2.exe
O4 - Global Startup: 3.exe
O20 - Winlogon Notify: fccdbyx - fccdbyx.dll (file missing)
O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINDOWS\TWljaGFlbCBCYXVlcg\command.exe
O23 - Service: Network Monitor - Unknown owner - C:\Program Files\Network Monitor\netmon.exe
Then close all windows except this one and press Fix checked.
STEP 4:
1. Please open Notepad
- Click Start , then Run
- Type notepad .exe in the Run Box.
File::
C:\WINDOWS\retadpu1000106.exe
C:\WINDOWS\system32\mschkdsk.exe
Folder::
C:\Program Files\iWin
C:\Program Files\Insider
C:\WINDOWS\STEM32~1
C:\Program Files\?ppPatch
C:\Program Files\Web Buying
C:\WINDOWS\TWljaGFlbCBCYXVlcg
C:\Program Files\Network Monitor
Registry::
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{733E9132-53CA-4C97-9AC9-145C4502FA20}"=-
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
"Authentication Packages"= msv1_0
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinFlyer32.dll]
3. Save the above as CFScript.txt
4. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.
STEP 5:
Please do a search for the following file(s):
Start > Search > All Files And Folders
Under More Advanced Options, make sure the following are checked:
*Search system folders
*Search hidden files and folders
*Search subfolders
Then copy and paste the following(one at a time) in the search box:
pipmon.exe
1.exe
2.exe
3.exe
WinFlyer32.dll
If found delete all instances of these files.
STEP 6:
Download the trial version of AVG Anti-Spyware from here and install it. When the program has been installed, and you click the Finish button, AVG Anti-Spyware will open.
If the program does not automatically update itself during installation, or you are unsure whether it has done so, please do the following:
- Click the Update icon at the top and under Manual Update click the Start update button.
- The program will either update or inform you that no update was available.
- It is essential that you get the update - keep trying until successful. (Note: If you have problems getting the update, you can download an installer for the full database from here (save it on your desktop). Once you have downloaded the installer, make sure that AVG Anti-Spyware is closed and then double-click on avgas-signatures-full-current.exe to install the database).
- Click the Shield icon at the top and under Resident shield is… click active. This should now
change to inactive. - Click the Update icon and untick the automatic update option.
- Click on Scanner on the toolbar.
- Click on the Settings tab.
- Under How to act? - make sure that Quarantine is selected.
- Under How to scan? - All checkboxes should be ticked.
- Under Possibly unwanted software - All checkboxes should be ticked.
- Under Reports - Select Do not automatically generate reports.
- Under What to scan? - Select Scan every file.
Please download ATF Cleaner here by Atribune. This program is for XP and Windows 2000 only.
It does not require any installation and uses minimal system resources. It is set up to clean IE, FireFox and Opera, and detects the browsers you have and grays out the other(s).
- Double-click ATF-Cleaner.exe to run the program.
- Under Main choose: Select All
- Recommend UNCHECKING COOKIES if you rely on system remembered passwords.
- Click the Empty Selected button.
If you use Firefox browser - Click Firefox at the top and choose: Select All EXCEPT FIREFOX SAVED PASSWORDS
- Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
If you use Opera browser - Click Opera at the top and choose: Select All EXCEPT COOKIES AND SAVED PASSWORDS
- Click the Empty Selected button.
- NOTE: If you would like to keep your cookies and saved passwords, please click No at the prompt.
We Now Need To Boot Into Safemode Now
Restart your computer.
When the machine first starts again it will generally list some equipment that is installed in your machine,
amount of memory, hard drives installed etc (BOOT SCREEEN).
At this point you should gently tap the F8 key repeatedly until you are presented with a Options menu.
Select the option for Safe Mode using the arrow keys.
Then press enter on your keyboard to boot into Safe Mode.
Run AVG
- Click on Scanner on the toolbar.
- Click on Complete System Scan to start the scan process.
- Let the program scan your computer.
- When the scan has finished, follow the instructions below:
- Make sure that Set all elements to: shows Quarantine
- Important: Click on the Apply all Actions button This must done before saving the report
- When the program has finished, it will display the message All actions have been applied.
- Then click the Save Scan Report button.
- Click the Save Report as button.
- Save the report to your Desktop.
[external image: Posted Image]
- Right-click the AVG Tray Icon and select Exit.
- Now copy the report back to this topic.
STEP 7:
Using Internet Explorer, click on Kaspersky Online Scanner * Click 'Accept' in the window that pops up.
* You will be prompted to install an ActiveX component from Kaspersky, Click on the information bar and select Install ActiveX Control if so. This may happen more than once. That is OK. You also may get a warning from your Windows Firewall. You can tell it to unblock.
* The program will launch and then start to download the latest definition files.
* Once the scanner is installed and the definitions downloaded, click 'Next'.
* Now click on 'Scan Settings'
* In the scan settings make sure that the following are selected:
o Scan using the following Anti-Virus database: 'Extended' (If available, otherwise 'Standard')
o Scan Options: 'Scan Archives' and 'Scan Mail Bases'
* Click 'OK'
* Now under 'Select a target to scan' select 'My Computer'
* The scan will take a while, so be patient and let it run. Once the scan is complete, it will display whether your system has been infected.
* Now click on the 'Save Report As…' button:
* Make sure it says Save as a text file - change it if not
* Save the file to your desktop.
Please post the Kaspersky report and a new HijackThis log, along with the AVG log from earlier.
You may need to make multiple posts so they don't get cut off.
It's not as bad as it looks, at least for me 
Most of what is there is all pre-written, tested, and "canned" so all I have to do is cut and paste in the details (file names, reg entries, ect…), and put it into a hopefully working order. I enjoy doing this myself or I wouldn't do it. And especially enjoy working out these hard ones…but they can take a while so be patient. That Kaspersky scan for you may take a REAL long time considering how much stuff you got. May want to set it up and get it running before bed time, work, school, whatever, and come back to find it hopefully done.
Good luck,
Dave