What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Search-daily, Hacktool.roorkit

10 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Double problem: virus warning each start & google links redirect to search-daily.com. Thanks for help.

Logfile of HijackThis v1.99.1
Scan saved at 16:06, on 2007-09-20
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\cmd.exe
C:\Program Files\Analog Devices\SoundMAX\Smtray.exe
C:\WINDOWS\System32\PELMICED.EXE
C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\RealVNC\WinVNC\winvnc.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\WINDOWS\System32\wuauclt.exe
C:\WINDOWS\System32\wuauclt.exe
C:\WINDOWS\SoftwareDistribution\Download\d3e2cd1aa350dfdef90c91dfc8e90f2d\update\update.exe
C:\HJTH\HijackThis222.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/ig?hl=fr
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {83209E61-3FA9-48D5-9EF2-F189F69DB707} - c:\windows\system32\cdmodemt.dll
O2 - BHO: (no name) - {8345D771-0195-4702-8877-F5ABE5BE993A} - c:\windows\system32\putbfzdl.dll
O2 - BHO: (no name) - {8E7F11B3-23E8-44EB-AAC5-7B07825D912A} - C:\WINDOWS\System32\adsmsextt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\Smtray.exe
O4 - HKLM\..\Run: [Mouse Suite 98 Daemon] PELMICED.EXE
O4 - HKLM\..\Run: [ConfigSafe] C:\CFGSAFE\NTFSCLUP.EXE
O4 - HKLM\..\Run: [CSScheduleCheck] C:\CFGSAFE\SCHWIZEX.EXE -CHECK
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Run VNC Server.lnk = C:\Program Files\RealVNC\WinVNC\winvnc.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd…b?1190299259906
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = cmst.lan
O17 - HKLM\Software\..\Telephony: DomainName = cmst.lan
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = cmst.lan
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\System32\NavLogon.dll
O20 - Winlogon Notify: ywwjpspb - C:\WINDOWS\SYSTEM32\cdmodemt.dll
O23 - Service: DefWatch - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
O23 - Service: Symantec AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: VPRemote Install Bootstrap Service (VPREMOTE) - Unknown owner - C:\TEMP\Clt-Inst\vpremote.exe (file missing)
Post #2
Hi, and Welcome to What The Tech :)

My name is jpshortstuff. I would be glad to take a look at your log and help you with solving any malware problems. HijackThis logs can take a while to research, so please be patient and I'd be grateful if you would note the following:
  • I will working be on your Malware issues, this may or may not, solve other issues you have with your machine.
  • The fixes are specific to your problem and should only be used for the issues on this machine.
  • Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
  • It's often worth reading through these instructions and printing them for ease of reference.
  • If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
  • Please reply to this thread. Do not start a new topic.
As I am still training here, my posts to you will be checked by an Expert member. This will ensure that all advice and instructions I give you are accurate and safe. This may mean that my replies may take a little longer.


Sorry about the delay in responding :(

If you still need help:

Show all hidden files:
  • Click Start.
  • Open My Computer.
  • Select the Tools menu and click Folder Options.
  • Select the View Tab.
  • Under the Hidden files and folders heading select Show hidden files and folders.
  • Uncheck the Hide protected operating system files (recommended) option.
  • Click Yes to confirm.
  • Click OK.
Please do not delete anything unless instructed to.


Scan again with HijackThis, and "copy/paste" a new log file into this thread.

Then I will analyze your log and sort out a fix for you :)

Also please describe how your computer behaves at the moment.


jpshortstuff
Post #3
Actually, the PC freezes after 5 minutes or receives the virus warning from symantec software.

Yves


Logfile of HijackThis v1.99.1
Scan saved at 14:54:17, on 2007-09-27
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16512)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\msiexec.exe
C:\Program Files\Analog Devices\SoundMAX\Smtray.exe
C:\WINDOWS\system32\PELMICED.EXE
C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\RealVNC\WinVNC\winvnc.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\HJTH\HijackThis222.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {83209E61-3FA9-48D5-9EF2-F189F69DB707} - c:\windows\system32\cdmodemt.dll
O2 - BHO: (no name) - {8345D771-0195-4702-8877-F5ABE5BE993A} - c:\windows\system32\putbfzdl.dll
O2 - BHO: (no name) - {8E7F11B3-23E8-44EB-AAC5-7B07825D912A} - C:\WINDOWS\System32\adsmsextt.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\Smtray.exe
O4 - HKLM\..\Run: [Mouse Suite 98 Daemon] PELMICED.EXE
O4 - HKLM\..\Run: [ConfigSafe] C:\CFGSAFE\NTFSCLUP.EXE
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
O4 - HKLM\..\Run: [CSScheduleCheck] C:\CFGSAFE\SCHWIZEX.EXE -CHECK
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Run VNC Server.lnk = C:\Program Files\RealVNC\WinVNC\winvnc.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd…b?1190299259906
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = cmst.lan
O17 - HKLM\Software\..\Telephony: DomainName = cmst.lan
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = cmst.lan
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = cmst.lan
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\System32\NavLogon.dll
O20 - Winlogon Notify: ywwjpspb - C:\WINDOWS\SYSTEM32\cdmodemt.dll
O23 - Service: DefWatch - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
O23 - Service: Symantec AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: VPRemote Install Bootstrap Service (VPREMOTE) - Unknown owner - C:\TEMP\Clt-Inst\vpremote.exe (file missing)
Post #4
Hi donjuan

Please download VundoFix.exe to your desktop.
  • Double-click VundoFix.exe to run it.
  • Click the Scan for Vundo button.
  • Once it's done scanning, click the Remove Vundo button.
  • You will receive a prompt asking if you want to remove the files, click YES
  • Once you click yes, your desktop will go blank as it starts removing Vundo.
  • When completed, it will prompt that it will reboot your computer, click OK.
  • Please post the contents of C:\vundofix.txt and a new HijackThis log.
Note: It is possible that VundoFix encountered a file it could not remove.
In this case, VundoFix will run on reboot, simply follow the above instructions starting from "Click the Scan for Vundo button." when VundoFix appears at reboot.

Thanks,

jpshortstuff
Post #5
New infected file this morning: cmdial3.dll and, google search still redirect. The reports:

VundoFix V6.5.8

Checking Java version…

Sun Java not detected
Scan started at 09:40:19 2007-09-28

Listing files found while scanning….

No infected files were found.


Beginning removal…

Logfile of HijackThis v1.99.1
Scan saved at 09:48:34, on 2007-09-28
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16512)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Analog Devices\SoundMAX\Smtray.exe
C:\WINDOWS\system32\PELMICED.EXE
C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\RealVNC\WinVNC\winvnc.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\HJTH\HijackThis222.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {83209E61-3FA9-48D5-9EF2-F189F69DB707} - c:\windows\system32\cdmodemt.dll
O2 - BHO: (no name) - {8345D771-0195-4702-8877-F5ABE5BE993A} - c:\windows\system32\putbfzdl.dll
O2 - BHO: (no name) - {8E7F11B3-23E8-44EB-AAC5-7B07825D912A} - C:\WINDOWS\System32\adsmsextt.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\Smtray.exe
O4 - HKLM\..\Run: [Mouse Suite 98 Daemon] PELMICED.EXE
O4 - HKLM\..\Run: [ConfigSafe] C:\CFGSAFE\NTFSCLUP.EXE
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
O4 - HKLM\..\Run: [CSScheduleCheck] C:\CFGSAFE\SCHWIZEX.EXE -CHECK
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Run VNC Server.lnk = C:\Program Files\RealVNC\WinVNC\winvnc.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd…b?1190299259906
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = cmst.lan
O17 - HKLM\Software\..\Telephony: DomainName = cmst.lan
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = cmst.lan
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = cmst.lan
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\System32\NavLogon.dll
O20 - Winlogon Notify: ywwjpspb - C:\WINDOWS\SYSTEM32\cdmodemt.dll
O23 - Service: DefWatch - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
O23 - Service: Symantec AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: VPRemote Install Bootstrap Service (VPREMOTE) - Unknown owner - C:\TEMP\Clt-Inst\vpremote.exe (file missing)
Post #6
Hi donjuan


We need to upload some files to Jotti

1. Click HERE to get to Jotti's site.

2. At the top of the Jotti window, use the Browse button to locate the following file on your system:

C:\windows\system32\cdmodemt.dll

3. Once you have located the file, click SUBMIT and the content of the file will be uploaded by the site and analysed.

4. Please provide me with the results of the analysis.

Please repeat steps 2-4 for these other files:
C:\windows\system32\putbfzdl.dll
C:\WINDOWS\System32\adsmsextt.dll

Thanks,

jpshortstuff
Post #7
Those are the results for the three files. File: cdmodemt.dll Status: INFECTED/MALWARE MD5: 5800a27b5109122a1df47011643fddf0 Packers detected: Analyzing… Bit9 reports: File not found Scan taken on 02 Oct 2007 13:14:34 (GMT) A-Squared Found nothing AntiVir Found PCK/Morphine ArcaVir Found nothing Avast Found nothing AVG Antivirus Found BHO.BHB BitDefender Found nothing ClamAV Found nothing CPsecure Found nothing Dr.Web Found Trojan.StartPage.20505 F-Prot Antivirus Found nothing F-Secure Anti-Virus Found nothing Fortinet Found nothing Kaspersky Anti-Virus Found nothing NOD32 Found nothing Norman Virus Control Found W32/BHO.QG Panda Antivirus Found Trj/Downloader.QLK Rising Antivirus Found nothing Sophos Antivirus Found nothing VirusBuster Found nothing VBA32 Found nothing File: putbfzdl.dll Status: INFECTED/MALWARE MD5: 7bb419253416c5935074346ff404ce83 Packers detected: Analyzing… Bit9 reports: File not found Scan taken on 02 Oct 2007 13:20:08 (GMT) A-Squared Found nothing AntiVir Found TR/Crypt.Morphine.Gen ArcaVir Found nothing Avast Found nothing AVG Antivirus Found BHO.BGW BitDefender Found nothing ClamAV Found nothing CPsecure Found nothing Dr.Web Found nothing F-Prot Antivirus Found nothing F-Secure Anti-Virus Found nothing Fortinet Found nothing Kaspersky Anti-Virus Found nothing NOD32 Found nothing Norman Virus Control Found W32/BHO.QG Panda Antivirus Found nothing Rising Antivirus Found nothing Sophos Antivirus Found nothing VirusBuster Found nothing VBA32 Found nothing File: adsmsextt.dll Status: INFECTED/MALWARE MD5: 786d2af422d50f54caaa40821973631b Packers detected: Analyzing… Bit9 reports: File not found Scan taken on 02 Oct 2007 13:23:49 (GMT) A-Squared Found nothing AntiVir Found nothing ArcaVir Found nothing Avast Found nothing AVG Antivirus Found nothing BitDefender Found nothing ClamAV Found nothing CPsecure Found nothing Dr.Web Found Trojan.PWS.Tanspy.775 F-Prot Antivirus Found nothing F-Secure Anti-Virus Found nothing Fortinet Found nothing Kaspersky Anti-Virus Found nothing NOD32 Found nothing Norman Virus Control Found nothing Panda Antivirus Found nothing Rising Antivirus Found nothing Sophos Antivirus Found nothing VirusBuster Found nothing VBA32 Found nothing
Post #8 last edited
Hi donjuan

Open HijackThis. Hit Do A System Scan Only. Place a check next to the following items (if present):
O2 - BHO: (no name) - {83209E61-3FA9-48D5-9EF2-F189F69DB707} - c:\windows\system32\cdmodemt.dll
O2 - BHO: (no name) - {8345D771-0195-4702-8877-F5ABE5BE993A} - c:\windows\system32\putbfzdl.dll
O2 - BHO: (no name) - {8E7F11B3-23E8-44EB-AAC5-7B07825D912A} - C:\WINDOWS\System32\adsmsextt.dll
O20 - Winlogon Notify: ywwjpspb - C:\WINDOWS\SYSTEM32\cdmodemt.dll

Close all browsers and windows except for HijackThis and click Fix Checked.


Please Right Click your Start button, and click Explore.
Next, locate and delete the following folders (if present):

C:\WINDOWS\System32\putbfzdl.dll <
C:\WINDOWS\System32\adsmsextt.dll <

If any of them aren't there then don't worry, but if you have a problem deleting one of them then please let me know.


Now:
  • Double-click VundoFix.exe to run it.
  • Click the Scan for Vundo button.
  • Once it's done scanning, right click inside the listbox (white box) and click add more files
  • Copy&Paste the entries below:
    • C:\WINDOWS\System32\cdmodemt.dll
  • Click Add Files and Click Close Window
  • Click the Remove Vundo button.
  • You will receive a prompt asking if you want to remove the files, click YES
  • Once you click yes, your desktop will go blank as it starts removing Vundo.
  • When completed, it will prompt that it will shutdown your computer, click OK.
  • Turn your computer back on.
  • Please post the contents of C:\vundofix.txt and a new HiJackThis log.

Please reboot your computer at this stage, unless VundoFix did already.


I'd like you to do an online scan with Kaspersky WebScanner

Follow this link in Internet Explorer (Note: You must use Internet explorer to use Kaspersky): Kaspersky WebScanner

You will be prompted to install an ActiveX component from Kaspersky,
Click Yes.
  • The program will launch and then begin downloading the latest definition files:
  • Once the files have been downloaded click on NEXT
  • Now click on Scan Settings
  • In the scan settings make sure that the following are selected:
    o Scan using the following Anti-Virus database:
    Extended (if available otherwise Standard)
    o Scan Options:
    Scan Archives Scan Mail Bases
  • Click OK
  • Now under select a target to scan:
    Select My Computer
  • The program will start and scan your system.
  • The scan will take a while so be patient and let it run.
  • Once the scan is complete it will display if your system has been infected.
    o Now click on the Save as Text button:
  • Save the file to your desktop.
Please provide me with the results of the Kaspersky scan, along with a fresh HijackThis log and the contents of C:\vundofix.txt.
Also describe how your computer is behaving at the moment.

jpshortstuff
Post #9
First, I can't remove adsmsextt.dll.

I did the Kapersky scan. Should I download the tryout?

There is no more redirection when using Google.

——————————————————————————-
KASPERSKY ONLINE SCANNER REPORT
Tuesday, October 02, 2007 3:52:45 PM
Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.93.1
Kaspersky Anti-Virus database last update: 2/10/2007
Kaspersky Anti-Virus database records: 426401
——————————————————————————-

Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true

Scan Target - Folders:
C:\

Scan Statistics:
Total number of scanned objects: 46234
Number of viruses found: 13
Number of infected objects: 79
Number of suspicious objects: 0
Duration of the scan process: 01:16:49

Infected Object Name / Virus Name / Last Action
C:\Documents and Settings\All Users\Application Data\Microsoft\Dr Watson\user.dmp Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\B40000.VBN Infected: Rootkit.Win32.Podnuha.c skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\C00001.VBN Infected: Rootkit.Win32.Podnuha.c skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\F00000.VBN Infected: Rootkit.Win32.Podnuha.d skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine1240000.VBN Infected: Rootkit.Win32.Podnuha.c skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine1280000.VBN Infected: Rootkit.Win32.Podnuha.c skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine1380000.VBN Infected: Rootkit.Win32.Podnuha.c skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine1400000.VBN Infected: Rootkit.Win32.Podnuha.c skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine1400001.VBN Infected: Rootkit.Win32.Podnuha.c skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine1440000.VBN Infected: Rootkit.Win32.Podnuha.c skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine1480000.VBN Infected: Rootkit.Win32.Podnuha.c skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine1A00000.VBN Infected: Rootkit.Win32.Podnuha.c skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine1A00001.VBN Infected: Rootkit.Win32.Podnuha.c skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine1B40000.VBN Infected: Rootkit.Win32.Podnuha.c skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine1B80000.VBN Infected: Rootkit.Win32.Podnuha.c skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine1D40000.VBN Infected: Rootkit.Win32.Podnuha.c skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine1D80000.VBN Infected: Rootkit.Win32.Podnuha.c skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine1D80001.VBN Infected: Rootkit.Win32.Podnuha.c skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine1F00000.VBN Infected: Rootkit.Win32.Podnuha.c skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine1F40000.VBN Infected: Rootkit.Win32.Podnuha.c skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine1F40001.VBN Infected: Rootkit.Win32.Podnuha.c skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine1F80000.VBN Infected: Rootkit.Win32.Podnuha.c skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine1F80001.VBN Infected: Rootkit.Win32.Podnuha.c skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine1FC0000.VBN Infected: Rootkit.Win32.Podnuha.c skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine2100000.VBN Infected: Rootkit.Win32.Podnuha.c skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine2300000.VBN/kprof Infected: Trojan-Proxy.Win32.Wopla.ag skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine2300000.VBN/koos.exe Infected: Trojan-Proxy.Win32.Wopla.ag skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine2300000.VBN/poof Infected: Trojan-Proxy.Win32.Wopla.ag skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine2300000.VBN ZIP: infected - 3 skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine2300000.VBN CryptZ: infected - 3 skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine2300001.VBN/kprof Infected: Trojan-Proxy.Win32.Wopla.ag skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine2300001.VBN/koos.exe Infected: Trojan-Proxy.Win32.Wopla.ag skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine2300001.VBN/poof Infected: Trojan-Proxy.Win32.Wopla.ag skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine2300001.VBN ZIP: infected - 3 skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine2300001.VBN CryptZ: infected - 3 skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine36C0000.VBN Infected: Rootkit.Win32.Podnuha.c skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine3B80000.VBN Infected: Rootkit.Win32.Podnuha.c skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine3BC0000.VBN Infected: Rootkit.Win32.Podnuha.c skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine3F80000.VBN Infected: Rootkit.Win32.Podnuha.c skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine4040000.VBN Infected: Rootkit.Win32.Podnuha.c skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine4040001.VBN Infected: Rootkit.Win32.Podnuha.c skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine4500000.VBN Infected: Rootkit.Win32.Podnuha.c skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine4500001.VBN Infected: Rootkit.Win32.Podnuha.c skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine4540000.VBN Infected: Rootkit.Win32.Podnuha.c skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine4F40000.VBN Infected: Rootkit.Win32.Podnuha.c skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine5000000.VBN Infected: Rootkit.Win32.Podnuha.c skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine64C0000.VBN Infected: Rootkit.Win32.Podnuha.c skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine6940000.VBN Infected: Rootkit.Win32.Podnuha.d skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine6A40000.VBN Infected: Rootkit.Win32.Podnuha.c skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\QuarantineB740000.VBN Infected: Rootkit.Win32.Podnuha.c skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\QuarantineB840000.VBN Infected: Rootkit.Win32.Podnuha.c skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\QuarantineB840001.VBN Infected: Rootkit.Win32.Podnuha.c skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\QuarantineC6C0000.VBN Infected: Rootkit.Win32.Podnuha.c skipped
C:\Documents and Settings\jlroberge\Bureau\SmitfraudFix\Reboot.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped
C:\Documents and Settings\jlroberge\Bureau\SmitfraudFix.exe/data.rar/SmitfraudFix/Reboot.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped
C:\Documents and Settings\jlroberge\Bureau\SmitfraudFix.exe/data.rar Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped
C:\Documents and Settings\jlroberge\Bureau\SmitfraudFix.exe RarSFX: infected - 2 skipped
C:\Documents and Settings\jlroberge\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\jlroberge\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\jlroberge\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\jlroberge\Local Settings\Historique\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\jlroberge\Local Settings\Temp\cjbslqnq.dll Infected: Trojan-Dropper.Win32.Agent.bxm skipped
C:\Documents and Settings\jlroberge\Local Settings\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat Object is locked skipped
C:\Documents and Settings\jlroberge\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\jlroberge\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\jlroberge\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\ldesloriers\Local Settings\temp\cjbslqnq.dll Infected: Trojan-Dropper.Win32.Agent.bxm skipped
C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Historique\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Historique\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\Program Files\RealVNC\WinVNC\othread2.dll Infected: not-a-virus:RemoteAdmin.Win32.WinVNC-based.c skipped
C:\Program Files\RealVNC\WinVNC\vnchooks.dll Infected: not-a-virus:RemoteAdmin.Win32.WinVNC-based.c skipped
C:\Program Files\RealVNC\WinVNC\winvnc.exe Infected: not-a-virus:RemoteAdmin.Win32.WinVNC-based.c skipped
C:\RECYCLER\S-1-5-21-1229272821-839522115-682003330-1109\Dc1.bak Infected: Trojan.Win32.Delf.agv skipped
C:\SUPPORT\Tool\VNC\vnc-3.3.7-x86_win32.exe/data0002 Infected: not-a-virus:RemoteAdmin.Win32.WinVNC-based.c skipped
C:\SUPPORT\Tool\VNC\vnc-3.3.7-x86_win32.exe/data0003 Infected: not-a-virus:RemoteAdmin.Win32.WinVNC-based.c skipped
C:\SUPPORT\Tool\VNC\vnc-3.3.7-x86_win32.exe/data0004 Infected: not-a-virus:RemoteAdmin.Win32.WinVNC-based.c skipped
C:\SUPPORT\Tool\VNC\vnc-3.3.7-x86_win32.exe Inno: infected - 3 skipped
C:\SUPPORT\Tool\VNC\vnc-3.3.7-x86_win32.zip/vnc-3.3.7-x86_win32.exe/data0002 Infected: not-a-virus:RemoteAdmin.Win32.WinVNC-based.c skipped
C:\SUPPORT\Tool\VNC\vnc-3.3.7-x86_win32.zip/vnc-3.3.7-x86_win32.exe/data0003 Infected: not-a-virus:RemoteAdmin.Win32.WinVNC-based.c skipped
C:\SUPPORT\Tool\VNC\vnc-3.3.7-x86_win32.zip/vnc-3.3.7-x86_win32.exe/data0004 Infected: not-a-virus:RemoteAdmin.Win32.WinVNC-based.c skipped
C:\SUPPORT\Tool\VNC\vnc-3.3.7-x86_win32.zip/vnc-3.3.7-x86_win32.exe Infected: not-a-virus:RemoteAdmin.Win32.WinVNC-based.c skipped
C:\SUPPORT\Tool\VNC\vnc-3.3.7-x86_win32.zip ZIP: infected - 4 skipped
C:\System Volume Information\_restore{41587706-12A2-4879-B882-1AA8A7898321}\RP1045\A0059242.dll Infected: Trojan.Win32.Agent.bth skipped
C:\System Volume Information\_restore{41587706-12A2-4879-B882-1AA8A7898321}\RP1048\A0070401.dll Infected: Trojan-Dropper.Win32.Agent.bzw skipped
C:\System Volume Information\_restore{41587706-12A2-4879-B882-1AA8A7898321}\RP1048\A0070402.sys Infected: Rootkit.Win32.Agent.iy skipped
C:\System Volume Information\_restore{41587706-12A2-4879-B882-1AA8A7898321}\RP1048\A0070403.dll Infected: Trojan.Win32.Agent.bsj skipped
C:\System Volume Information\_restore{41587706-12A2-4879-B882-1AA8A7898321}\RP1048\A0070404.dll Infected: Trojan.Win32.Delf.agv skipped
C:\System Volume Information\_restore{41587706-12A2-4879-B882-1AA8A7898321}\RP1048\A0070405.dll Infected: Trojan.Win32.Delf.agw skipped
C:\System Volume Information\_restore{41587706-12A2-4879-B882-1AA8A7898321}\RP1049\change.log Object is locked skipped
C:\WINDOWS\CSC\000001 Object is locked skipped
C:\WINDOWS\Debug\Netlogon.log Object is locked skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\SoftwareDistribution\EventCache\{BBC7D920-CF4F-4B25-BD8E-1654C781AC90}.bin Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINDOWS\system32\b2selxshs6s.exe Infected: Backdoor.Win32.Small.ckk skipped
C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\DEFAULT Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\Internet.evt Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\SOFTWARE Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SYSTEM Object is locked skipped
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\h323log.txt Object is locked skipped
C:\WINDOWS\system32\ioahjmcc.dll.bak Infected: Trojan-Dropper.Win32.Agent.bzw skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped

Scan process completed.

HIJACKTHIS
Logfile of HijackThis v1.99.1
Scan saved at 15:54, on 2007-10-02
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16512)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\cmd.exe
C:\Program Files\Analog Devices\SoundMAX\Smtray.exe
C:\WINDOWS\system32\PELMICED.EXE
C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\RealVNC\WinVNC\winvnc.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\HJTH\HijackThis222.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/ig?hl=fr
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {83209E61-3FA9-48D5-9EF2-F189F69DB707} - c:\windows\system32\cdmodemt.dll
O2 - BHO: (no name) - {8E7F11B3-23E8-44EB-AAC5-7B07825D912A} - C:\WINDOWS\System32\adsmsextt.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\Smtray.exe
O4 - HKLM\..\Run: [Mouse Suite 98 Daemon] PELMICED.EXE
O4 - HKLM\..\Run: [ConfigSafe] C:\CFGSAFE\NTFSCLUP.EXE
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
O4 - HKLM\..\Run: [CSScheduleCheck] C:\CFGSAFE\SCHWIZEX.EXE -CHECK
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Run VNC Server.lnk = C:\Program Files\RealVNC\WinVNC\winvnc.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/d…can_unicode.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd…b?1190299259906
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = cmst.lan
O17 - HKLM\Software\..\Telephony: DomainName = cmst.lan
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = cmst.lan
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = cmst.lan
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\System32\NavLogon.dll
O20 - Winlogon Notify: ywwjpspb - C:\WINDOWS\SYSTEM32\cdmodemt.dll
O23 - Service: DefWatch - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
O23 - Service: Symantec AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: VPRemote Install Bootstrap Service (VPREMOTE) - Unknown owner - C:\TEMP\Clt-Inst\vpremote.exe (file missing)

VUNDOFIX

Beginning removal…

VundoFix V6.5.8

Checking Java version…

Sun Java not detected
Scan started at 14:06:48 2007-10-02

Listing files found while scanning….

No infected files were found.

Thanks.
Post #13
Hi donjuan

Download ComboFix by sUBs from here or here

**Save it to your desktop**

Double click on ComboFix.exe & follow the prompts.
When finished, it shall produce a log for you. Please save that log to post in your next reply along with a fresh HJT log

Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall

jpshortstuff
Post #14
I took the liberty to remove the snapshot section of the combofix's log (the txt file was too big).

Logfile of HijackThis v1.99.1
Scan saved at 13:02, on 2007-10-03
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16512)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\cmd.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Analog Devices\SoundMAX\Smtray.exe
C:\WINDOWS\system32\PELMICED.EXE
C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\RealVNC\WinVNC\winvnc.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\HJTH\HijackThis222.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/ig?hl=fr
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {83209E61-3FA9-48D5-9EF2-F189F69DB707} - c:\windows\system32\cdmodemt.dll
O2 - BHO: (no name) - {8E7F11B3-23E8-44EB-AAC5-7B07825D912A} - C:\WINDOWS\System32\adsmsextt.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\Smtray.exe
O4 - HKLM\..\Run: [Mouse Suite 98 Daemon] PELMICED.EXE
O4 - HKLM\..\Run: [ConfigSafe] C:\CFGSAFE\NTFSCLUP.EXE
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
O4 - HKLM\..\Run: [CSScheduleCheck] C:\CFGSAFE\SCHWIZEX.EXE -CHECK
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Run VNC Server.lnk = C:\Program Files\RealVNC\WinVNC\winvnc.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/d…can_unicode.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd…b?1190299259906
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = cmst.lan
O17 - HKLM\Software\..\Telephony: DomainName = cmst.lan
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = cmst.lan
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = cmst.lan
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\System32\NavLogon.dll
O23 - Service: Kaspersky Anti-Virus 7.0 (AVP) - Unknown owner - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe" -r (file missing)
O23 - Service: DefWatch - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
O23 - Service: Symantec AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: VPRemote Install Bootstrap Service (VPREMOTE) - Unknown owner - C:\TEMP\Clt-Inst\vpremote.exe (file missing)

ComboFix 07-10-03.7 - ydeschenes 2007-10-03 12:52:16.2 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.2.1252.33.1036.18.75 [GMT -4:00]
* Created a new restore point
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\System32\cdmodemt.dll . . . . Echec de suppression
C:\WINDOWS\system32\drivers\lyuhpfbt.sys

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))


——-\LEGACY_JVMXZAYK
——-\jvmxzayk


((((((((((((((((((((((((((((( Fichiers créés 2007-09-03 to 2007-10-03 ))))))))))))))))))))))))))))))))))))
.

2007-10-03 11:35 d——– C:\Program Files\Kaspersky Lab
2007-10-03 11:33 d——– C:\kav
2007-10-02 14:17 d——– C:\WINDOWS\system32\Kaspersky Lab
2007-10-02 14:17 d——– C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2007-10-02 13:57 d——– C:\Documents and Settings\jlroberge\Application Data\TuneUp Software
2007-10-02 09:39 741,632 –a—— C:\WINDOWS\system32\htonptjm.dat
2007-10-02 09:39 35,584 –a—— C:\WINDOWS\system32\bgajhvxq.dat
2007-10-02 09:39 34,560 –a—— C:\WINDOWS\system32\cuhxtfgj.dat
2007-10-02 09:39 118,528 –a—— C:\WINDOWS\system32\rylsoici.dat
2007-09-27 14:41 29,704 –a—— C:\WINDOWS\system32\uxtuneup.dll
2007-09-27 14:41 d——– C:\Documents and Settings\administrator\Application Data\TuneUp Software
2007-09-27 14:40 d——– C:\Program Files\TuneUp Utilities 2007
2007-09-27 14:40 d——– C:\Documents and Settings\All Users\Application Data\TuneUp Software
2007-09-27 11:01 d——– C:\Program Files\Fichiers communs\Wise Installation Wizard
2007-09-21 15:28 d——– C:\WINDOWS\system32\fr-fr
2007-09-21 15:24 33,792 –a—— C:\WINDOWS\system32\dllcache\custsat.dll
2007-09-21 15:15 23,040 ——— C:\WINDOWS\system32\dllcache\fltmc.exe
2007-09-21 15:15 16,896 ——— C:\WINDOWS\system32\dllcache\fltlib.dll
2007-09-21 15:15 128,896 ——— C:\WINDOWS\system32\dllcache\fltmgr.sys
2007-09-21 14:41 d——– C:\Documents and Settings\LocalService\Menu D‚marrer
2007-09-21 13:26 d——– C:\WINDOWS\provisioning
2007-09-21 13:26 d——– C:\WINDOWS\peernet
2007-09-21 09:03 4,569 ——— C:\WINDOWS\system32\secupd.dat
2007-09-21 09:03 11,776 ——— C:\WINDOWS\system32\spnpinst.exe
2007-09-20 12:38 614,912 –a—— C:\WINDOWS\system32\h323msp.dll
2007-09-20 12:38 608,256 ——— C:\WINDOWS\system32\dllcache\xpsp2res.dll
2007-09-20 12:38 332,800 –a—— C:\WINDOWS\system32\ipnathlp.dll
2007-09-20 12:38 26,112 –a—— C:\WINDOWS\system32\xpsp1hfm.exe
2007-09-20 11:10 1,097,728 –a—— C:\WINDOWS\system32\esent.dll
2007-09-20 10:49 51,200 –a—— C:\WINDOWS\NirCmd.exe
2007-09-20 10:45 22,752 –a—— C:\WINDOWS\system32\spupdsvc.exe
2007-09-20 10:45 d–h—– C:\WINDOWS\$hf_mig$
2007-09-20 10:44 d——– C:\WINDOWS\system32\bits
2007-09-20 10:43 8,192 ——— C:\WINDOWS\system32\bitsprx2.dll
2007-09-20 10:43 7,168 ——— C:\WINDOWS\system32\bitsprx3.dll
2007-09-20 10:43 351,232 –a—— C:\WINDOWS\system32\winhttp.dll
2007-09-20 10:43 18,944 –a—— C:\WINDOWS\system32\qmgrprxy.dll
2007-09-20 10:41 43,352 –a—— C:\WINDOWS\system32\wups2.dll
2007-09-20 10:13 d——– C:\HJTH
2007-09-20 10:08 d——– C:\VundoFix Backups
2007-09-20 09:55 d-a—— C:\Documents and Settings\All Users\Application Data\TEMP
2007-09-20 09:34 d——– C:\yo
2007-09-14 15:53 d——– C:\Program Files\Yahoo!
2007-09-14 15:52 d——– C:\Program Files\CCleaner
2007-09-14 14:37 1,732 –a—— C:\WINDOWS\system32\tmp.reg
2007-09-14 14:03 d–hs—- C:\Documents and Settings\jlroberge\UserData
2007-09-14 13:28 549,720 –a—— C:\WINDOWS\system32\wuapi.dll
2007-09-14 13:28 33,624 –a—— C:\WINDOWS\system32\wups.dll
2007-09-14 13:28 325,976 –a—— C:\WINDOWS\system32\wucltui.dll
2007-09-14 13:28 187,160 –a—— C:\WINDOWS\system32\wuaueng1.dll
2007-09-14 13:28 170,776 –a—— C:\WINDOWS\system32\wuauclt1.exe
2007-09-07 16:36 17,664 C:\WINDOWS\system32\drivers\zbblupvo.sys
2007-09-07 16:24 82,944 –a—— C:\WINDOWS\system32\comaddind.dll
2007-09-07 15:57 d——– C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2007-09-07 15:52 1,046 –a—— C:\WINDOWS\system32\crtdllq.dll
2007-09-07 15:52 1,046 –a—— C:\WINDOWS\system32\cabinetg.dll
2007-09-07 15:47 1,046 –a—— C:\WINDOWS\system32\dsprpresu.dll
2007-09-07 15:45 82,944 –a—— C:\WINDOWS\system32\d3dpmesha.dll
2007-09-07 15:45 15,872 –a—— C:\WINDOWS\system32\b2selxshs6s.exe
2007-09-07 15:44 1,046 –a—— C:\WINDOWS\system32\ati2dvagp.dll
2007-09-07 15:37 73,728 –a—— C:\WINDOWS\system32\ioahjmcc.dll
2007-09-07 15:37 684,567 –a—— C:\WINDOWS\system32\libeay32.dll
2007-09-07 15:37 165,888 –a—— C:\WINDOWS\system32\msvcr71.dll
2007-09-07 15:37 147,729 –a—— C:\WINDOWS\system32\libssl32.dll
2007-09-07 15:37 123,904 –a—— C:\WINDOWS\system32\byvqzrbl.dll
2007-09-07 15:27 81,408 –a—— C:\WINDOWS\system32\cdmodemt.dll
2007-09-07 15:26 104,461 –a—— C:\WINDOWS\system32\adsmsextt.dll

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-07-30 19:19 92504 –a—— C:\WINDOWS\system32\dllcache\cdm.dll
2007-07-30 19:19 92504 –a—— C:\WINDOWS\system32\cdm.dll
2007-07-30 19:19 53080 –a—— C:\WINDOWS\system32\wuauclt.exe
2007-07-30 19:19 53080 –a—— C:\WINDOWS\system32\dllcache\wuauclt.exe
2007-07-30 19:19 203096 –a—— C:\WINDOWS\system32\wuweb.dll
2007-07-30 19:19 1712984 –a—— C:\WINDOWS\system32\wuaueng.dll
2007-07-30 19:19 1712984 –a—— C:\WINDOWS\system32\dllcache\wuaueng.dll
2007-07-19 02:58 3583488 ——— C:\WINDOWS\system32\dllcache\mshtml.dll
2007-07-12 19:30 765952 ——— C:\WINDOWS\system32\dllcache\vgx.dll
2006-02-01 10:06 2210 –a—— C:\Program Files\INSTALL.LOG
2002-07-26 18:02 153088 –a—— C:\Program Files\UNWISE.EXE
.


.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{83209E61-3FA9-48D5-9EF2-F189F69DB707}]
2007-10-03 11:31 81408 –a—— c:\windows\system32\cdmodemt.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{8E7F11B3-23E8-44EB-AAC5-7B07825D912A}]
2002-08-29 05:44 104461 –a—— C:\WINDOWS\System32\adsmsextt.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="NvQTwk" []
"Smapp"="C:\Program Files\Analog Devices\SoundMAX\Smtray.exe" [2002-06-07 08:54]
"Mouse Suite 98 Daemon"="PELMICED.EXE" [2001-06-18 05:57 C:\WINDOWS\system32\PELMICED.EXE]
"ConfigSafe"="C:\CFGSAFE\NTFSCLUP.EXE" [2001-05-18 09:17]
"vptray"="C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe" [2003-04-25 19:18]
"CSScheduleCheck"="C:\CFGSAFE\SCHWIZEX.exe" [2001-05-03 10:03]
"AVP"="C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe" [2007-06-28 12:51]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-19 19:09]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 12:24]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1229272821-839522115-682003330-1109\Scripts\Logon\]
"Script"=cmst.bat

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1229272821-839522115-682003330-1109\Scripts\Logon\1]
"Script"=Compta.bat

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1229272821-839522115-682003330-1109\Scripts\Logon\2]
"Script"=numlock.vbs

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1229272821-839522115-682003330-1118\Scripts\Logon\]
"Script"=cmst.bat

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1229272821-839522115-682003330-1118\Scripts\Logon\1]
"Script"=Compta.bat

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1229272821-839522115-682003330-1118\Scripts\Logon\2]
"Script"=numlock.vbs

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1229272821-839522115-682003330-1119\Scripts\Logon\]
"Script"=cmst.bat

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1229272821-839522115-682003330-1119\Scripts\Logon\1]
"Script"=Compta.bat

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1229272821-839522115-682003330-1119\Scripts\Logon\2]
"Script"=numlock.vbs

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1229272821-839522115-682003330-1120\Scripts\Logon\]
"Script"=cmst.bat

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1229272821-839522115-682003330-1120\Scripts\Logon\1]
"Script"=Compta.bat

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1229272821-839522115-682003330-1120\Scripts\Logon\2]
"Script"=numlock.vbs

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1229272821-839522115-682003330-1121\Scripts\Logon\]
"Script"=cmst.bat

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1229272821-839522115-682003330-1121\Scripts\Logon\1]
"Script"=Compta.bat

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1229272821-839522115-682003330-1121\Scripts\Logon\2]
"Script"=numlock.vbs

R0 uijribuw;uijribuw;C:\WINDOWS\system32\drivers\zbblupvo.sys
R1 pelmouse;Mouse Suite Driver;C:\WINDOWS\system32\DRIVERS\pelmouse.sys
R2 UxTuneUp;TuneUp Extension de thème;C:\WINDOWS\System32\svchost.exe -k netsvcs
R3 pelps2m;PS/2 Mouse Filter Driver;C:\WINDOWS\system32\DRIVERS\pelps2m.sys
S3 VPREMOTE;VPRemote Install Bootstrap Service;C:\TEMP\Clt-Inst\vpremote.exe

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp

.
Contenu du dossier 'Scheduled Tasks/Tâches planifiées'
"2007-05-14 13:00:35 C:\WINDOWS\Tasks\Image planifiée.job"
"2007-09-27 18:41:22 C:\WINDOWS\Tasks\Maintenance en 1 clic.job"
- C:\Program Files\TuneUp Utilities 2007\SystemOptimizer.exe
.
**************************************************************************

catchme 0.3.1169 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-10-03 12:57:32
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-10-03 13:00:18 - machine was rebooted
C:\ComboFix-quarantined-files.txt … 2007-10-03 13:00
C:\ComboFix2.txt … 2007-09-20 10:55
.
— E O F —
Post #15
Hi donjuan

Sorry about the delay, there was a lot to analyze in that ComboFix log.

Open HijackThis. Hit Do A System Scan Only. Place a check next to the following items (if present):
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: (no name) - {8E7F11B3-23E8-44EB-AAC5-7B07825D912A} - C:\WINDOWS\System32\adsmsextt.dll

Close all browsers and windows except for HijackThis and click Fix Checked.
Now you can close HijackThis.

1. Please open Notepad
  • Click Start, then Run
  • Type notepad.exe in the Run Box.
2. Now copy/paste the entire content of the codebox below into the Notepad window:

File::
C:\WINDOWS\system32\adsmsextt.dll
C:\WINDOWS\system32\htonptjm.dat
C:\WINDOWS\system32\bgajhvxq.dat
C:\WINDOWS\system32\cuhxtfgj.dat
C:\WINDOWS\system32\rylsoici.dat
C:\WINDOWS\system32\drivers\zbblupvo.sys
C:\WINDOWS\system32\comaddind.dll
C:\WINDOWS\system32\crtdllq.dll
C:\WINDOWS\system32\cabinetg.dll
C:\WINDOWS\system32\dsprpresu.dll
C:\WINDOWS\system32\d3dpmesha.dll
C:\WINDOWS\system32\b2selxshs6s.exe
C:\WINDOWS\system32\ioahjmcc.dll
C:\WINDOWS\system32\byvqzrbl.dll

Folder::
C:\VundoFix Backups 

Driver::
uijribuw

Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{8E7F11B3-23E8-44EB-AAC5-7B07825D912A}]

3. Save the above as CFScript.txt

4. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.

[external image: Posted Image]

5. After reboot, (in case it asks to reboot), please post the following reports/logs into your next reply:
  • Combofix.txt
  • A new HijackThis log.
Thanks,

jpshortstuff

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI