What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] Trojan Horse Dropper Agent GIT amongst others

23 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1 last edited
Hi, hope you don't mind me directing this to Simon V, but after searching hard i found this forum and a post detailing a very similar problem as the one i am experiencing; Trojan Horse Dropper Agent GIT.

First a brief summary of what happened.

I picked up a virus of some description a week ago and the installed security (F-Secure 2005) software detected it but as it began to rename or heal the trojans the virus managed to disable the internet security. It also disabled everything else that was in the system tray. After a restart there were several pop ups from F-Secure saying malicous files had been found in numerous areas of the C drive and within software. These were mainly trojans with several different names such as 'Downloader.Win32', 'Xorpix.KGB', 'Wgraph.WinBHO' and 'DropperAgent GIT'. It then connected itself to the internet and started to download something and i pulled the plug. I looked in the System Restore and all the restore points had gone. I installed AVG anti virus which took a few attempts as every time i tried it seemed as though it was trying to stop this too as the pc kept restarting and then went in to a loop on on/off/on/off etc. I installed Spyware Terminator in safe mode and AVG again and eventually things began to stabilise after removing numerous trojans and infections. The only message i am left with now is identical to that of the post on this forum which i identified earlier, which is 'Windows cannot find C:\Windows\System32\gebcc.exe'.

The combination of AVG and Spyware Terminator has now brought some stability to the pc although some of the installed software does not seem to work as previously and others have vanished so i am still concerned that other nasties could be embedded or lurking round the corner.

On your response to the earlier thread (highlighted above) you provide instructions to use CCleaner and Combofix.

The instructions on the Combofix unnerve me as they mention Windows XP Recovery and other stuff, does this mean i have to remove everything and start with a clean slate ?

Im sorry im not particulary experienced in computer technical knowhow, so id be grateful if you would give me a brief explanantion of what has happened to my pc, is there likely damage to my software, can the virus still be contained or hidden somewhere, could information such as passwords already have been stolen and do i need to take the steps as you had explained in the similar thread mentioned earlier?

Thanks very much for your time.
Post #2
Hello, and welcome to the forum; I'll be glad to help you with your computer problems.

I'll first need a HijackThis log to diagnose the problem:

Download HJTInstall.exe to your desktop.

  • Doubleclick HJTInstall.exe to install HijackThis.
  • By default it will install to C:\Program Files\Trend Micro\HijackThis .
  • Click on Install.
  • It will create a HijackThis icon on the desktop.
  • Once installed, it will launch Hijackthis.
  • Click on the Do a system scan and save a logfile button. It will scan and the log should open in Notepad. Post the contents of that report in your next reply.

Don't use the AnalyseThis button, its findings are dangerous if misinterpreted.
Don't have Hijackthis fix anything yet. Most of what it finds will be harmless or even required.
Post #3 last edited
Hi Simon, thanks very much for replying and thanks for your time and offer of assistance. :thumbup:
I dont know if its worth mentioning that AVG and Spyware Terminator were installed after the virus attack, prior
to that i was using F-Secure Internet Security.

The HijackThis log is as follows;

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\Program Files\Spyware Terminator\sp_rsser.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://mysearch.myway.com/jsp/dellsidebar.jsp?p=DK
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.virginmedia.com/customers/email…l&app=email
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.virgin.net/
R3 - URLSearchHook: (no name) - {4D25F926-B9FE-4682-BF72-8AB8210D6D75} - C:\Program Files\MyWaySA\SrchAsDe\deSrcAs.dll (file missing)
F3 - REG:win.ini: load=C:\WINDOWS\system32\gebcc.exe
O2 - BHO: (no name) - 8Cã55F3E-90C3-41AA-8705-15969AF7F210} - (no file)
O2 - BHO: (no name) - hCã5F921-B9FE-4682-BF72-8AB8210D6D75} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {D4576C73-52BD-4401-B966-5A128C4433D4} - C:\WINDOWS\system32\jkklmji.dll (file missing)
O2 - BHO: (no name) - ¸Cã3D70E-1895-11CF-8E15-001234567890} - (no file)
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O4 - HKLM\..\Run: [SpywareTerminator] "C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra button: (no name) - {200DB664-75B5-47c0-8B45-A44ACCF73F02} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll (file missing)
O9 - Extra 'Tools' menuitem: &Suspend Webpage Filter - {200DB664-75B5-47c0-8B45-A44ACCF73F02} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll (file missing)
O9 - Extra button: (no name) - {200DB664-75B5-47c0-8B45-A44ACCF73F03} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll (file missing)
O9 - Extra 'Tools' menuitem: &Deny this website - {200DB664-75B5-47c0-8B45-A44ACCF73F03} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll (file missing)
O9 - Extra button: (no name) - {200DB664-75B5-47c0-8B45-A44ACCF73F04} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll (file missing)
O9 - Extra 'Tools' menuitem: &Allow this website - {200DB664-75B5-47c0-8B45-A44ACCF73F04} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll (file missing)
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRA~1\Yahoo!\Common\yhexbmesuk.dll (file missing)
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRA~1\Yahoo!\Common\yhexbmesuk.dll (file missing)
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMesse…pDownloader.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{80D94202-8DE1-477D-A2E0-544ABFF779D9}: NameServer = 194.168.4.100 194.168.8.100
O20 - Winlogon Notify: jkklmji - jkklmji.dll (file missing)
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: F-Secure Anti-Virus 2005 (BackWeb Plug-in - 4476822) - Unknown owner - C:\PROGRA~1\F-SECU~1\backweb\4476822\Program\SERVIC~1.EXE (file missing)
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: Microsoft Office Diagnostics Service (odserv) - Unknown owner - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE (file missing)
O23 - Service: Office Source Engine (ose) - Unknown owner - C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE (file missing)
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

–
End of file - 8214 bytes
Post #4
Hi :)

You didn't include the top part of the HijackThis log. Please do so when I ask you to post a new HijackThis log.

Step 1

Please download and install CCleaner.

Open CCleaner. On the Windows tab, leave the default options alone.

  • On the Applications tab, check (tick) all the boxes except Saved Form Information. This will remove all your saved passwords if you leave this box checked.
  • Click on the Run Cleaner button at the bottom right hand corner.
  • When the cleaner is complete, click Tools in the Left Pane.
  • Verify that Uninstall is highlighted in color, or click on it.
  • In the lower right, click Save to Text File.
  • Pull down the arrow at the top of the Save dialog and choose Desktop as the location.
  • You can leave the filename as install.txt.
  • Click Save, then exit Ccleaner.

Step 2

For your information: the recovery console is only used as a safety net, not for reinstalling your operating system.

Please visit this webpage for instructions for downloading and running ComboFix:

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

Post the log from ComboFix (C:\Combofix.txt) when you've accomplished that, along with a new HijackThis log and the CCleaner Uninstall List (install.txt)
Post #5
Hi, ive carried out your instructions, just one thing, it has made IE my default internet explorer, do you know how i would change this back to Firefox ??
Sorry i didnt realise i had cut off the top part of the original log :blush:

The logs are as follows;

CCleaner;

Adobe Flash Player ActiveX
Adobe Reader 8.1.0
Ahead Nero Burning ROM
AnyDVD
Apple Mobile Device Support
Apple Software Update
ArcSoft PhotoStudio 5.5
ARTEuro
ATI Control Panel
ATI Display Driver
AVG 7.5
Browser MOUSE
Canon MP Drivers 6.0
Canon MP Navigator 1.1
Canon ScanGear Starter
Canon Utilities Easy-PhotoPrint
CCleaner (remove only)
CD-LabelPrint
ConvertXtoDVD 2.0.9b
Creative MediaSource
dBpoweramp Music Converter
Dell Driver Reset Tool
Dell System Restore
DellSupport
Dot1XCfg
DVD Decrypter (Remove Only)
DVD Shrink 3.1.6
Easy-WebPrint
F-Secure Anti-Virus 2005
Google Earth
High Definition Audio Driver Package - KB835221
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows Media Player 11 (KB939683)
Hotfix for Windows XP (KB915865)
Hotfix for Windows XP (KB926239)
Intel® PRO Network Connections Drivers
Intel® PROSafe for Wired Connections
Intel® PROSet for Wired Connections
Internet Explorer Default Page
iTunes
Jasc Paint Shop Photo Album 5
Java 2 Runtime Environment, SE v1.4.2_03
K-Lite Codec Pack 2.67 Full
Macromedia Shockwave Player
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Hotfix (KB928366)
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Office Access MUI Edition (English) 12 [pre-release]
Microsoft Office Excel MUI Edition (English) 12 [pre-release]
Microsoft Office InfoPath MUI Edition (English) 12 [pre-release]
Microsoft Office Outlook MUI Edition (English) 12 [pre-release]
Microsoft Office PowerPoint MUI Edition (English) 12 [pre-release]
Microsoft Office Professional Edition 12 [pre-release]
Microsoft Office Professional Enterprise 2007 (Beta)
Microsoft Office Proof Edition (English) 12 [pre-release]
Microsoft Office Proof Edition (French) 12 [pre-release]
Microsoft Office Proof Edition (Spanish) 12 [pre-release]
Microsoft Office Publisher MUI Edition (English) 12 [pre-release]
Microsoft Office Shared MUI Edition (English) 12 [pre-release]
Microsoft Office Word MUI Edition (English) 12 [pre-release]
Microsoft Office XP Professional with FrontPage
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Works 7.0
Mozilla Firefox (2.0.0.11)
MSXML 4.0 SP2 (KB927978)
MSXML 4.0 SP2 (KB936181)
Muiltmedia keyboard Utility 1.3
MyWay Search Assistant
OmniPage SE
Photo Loader 2.3E
Pinnacle Hollywood FX 4.6
PowerDVD 5.5
QuickTime
RealPlayer
Security Update for Step By Step Interactive Training (KB898458)
Security Update for Step By Step Interactive Training (KB923723)
Security Update for Windows Internet Explorer 7 (KB933566)
Security Update for Windows Internet Explorer 7 (KB937143)
Security Update for Windows Internet Explorer 7 (KB938127)
Security Update for Windows Internet Explorer 7 (KB939653)
Security Update for Windows Internet Explorer 7 (KB942615)
Security Update for Windows Media Player 11 (KB936782)
Security Update for Windows XP (KB890046)
Security Update for Windows XP (KB893066)
Security Update for Windows XP (KB893756)
Security Update for Windows XP (KB896358)
Security Update for Windows XP (KB896423)
Security Update for Windows XP (KB896424)
Security Update for Windows XP (KB896428)
Security Update for Windows XP (KB899587)
Security Update for Windows XP (KB899591)
Security Update for Windows XP (KB901017)
Security Update for Windows XP (KB901190)
Security Update for Windows XP (KB902400)
Security Update for Windows XP (KB904706)
Security Update for Windows XP (KB905414)
Security Update for Windows XP (KB905749)
Security Update for Windows XP (KB908519)
Security Update for Windows XP (KB908531)
Security Update for Windows XP (KB911280)
Security Update for Windows XP (KB911562)
Security Update for Windows XP (KB911567)
Security Update for Windows XP (KB911927)
Security Update for Windows XP (KB912919)
Security Update for Windows XP (KB913446)
Security Update for Windows XP (KB913580)
Security Update for Windows XP (KB914388)
Security Update for Windows XP (KB914389)
Security Update for Windows XP (KB917159)
Security Update for Windows XP (KB917422)
Security Update for Windows XP (KB917953)
Security Update for Windows XP (KB918118)
Security Update for Windows XP (KB918439)
Security Update for Windows XP (KB919007)
Security Update for Windows XP (KB920213)
Security Update for Windows XP (KB920214)
Security Update for Windows XP (KB920670)
Security Update for Windows XP (KB920683)
Security Update for Windows XP (KB920685)
Security Update for Windows XP (KB921398)
Security Update for Windows XP (KB921503)
Security Update for Windows XP (KB921883)
Security Update for Windows XP (KB922616)
Security Update for Windows XP (KB922819)
Security Update for Windows XP (KB923191)
Security Update for Windows XP (KB923414)
Security Update for Windows XP (KB923980)
Security Update for Windows XP (KB924191)
Security Update for Windows XP (KB924270)
Security Update for Windows XP (KB924667)
Security Update for Windows XP (KB925902)
Security Update for Windows XP (KB926436)
Security Update for Windows XP (KB927779)
Security Update for Windows XP (KB927802)
Security Update for Windows XP (KB928255)
Security Update for Windows XP (KB928843)
Security Update for Windows XP (KB929123)
Security Update for Windows XP (KB930178)
Security Update for Windows XP (KB931261)
Security Update for Windows XP (KB931784)
Security Update for Windows XP (KB932168)
Security Update for Windows XP (KB933729)
Security Update for Windows XP (KB935839)
Security Update for Windows XP (KB935840)
Security Update for Windows XP (KB936021)
Security Update for Windows XP (KB938829)
Security Update for Windows XP (KB941202)
Security Update for Windows XP (KB941568)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB941644)
Security Update for Windows XP (KB943460)
Security Update for Windows XP (KB943485)
Security Update for Windows XP (KB944653)
SmartSound Quicktracks Plugin
Sonic DLA
Sonic MyDVD LE
Sonic RecordNow Audio
Sonic RecordNow Copy
Sonic RecordNow Data
Sonic Update Manager
SopCast 1.1.1
Sound Blaster Live! 24-bit
SpeedTouch USB Software
Spyware Terminator
Studio 8
Studio Content CD
SureThing CD Labeler SE - Sonic
Synacast Plug-in [removed]
TVAnts 1.0
Ulead VideoStudio 10
Update for Windows XP (KB894391)
Update for Windows XP (KB898461)
Update for Windows XP (KB900485)
Update for Windows XP (KB910437)
Update for Windows XP (KB916595)
Update for Windows XP (KB920342)
Update for Windows XP (KB920872)
Update for Windows XP (KB922582)
Update for Windows XP (KB927891)
Update for Windows XP (KB929338)
Update for Windows XP (KB930916)
Update for Windows XP (KB931836)
Update for Windows XP (KB933360)
Update for Windows XP (KB936357)
Update for Windows XP (KB938828)
Update for Windows XP (KB942763)
Video Converter 2.1.14
Viewpoint Media Player
WD Diagnostics
WebFldrs XP
Westwood Shared Internet Components
WinAVIVideoConverter
Windows Installer 3.1 (KB893803)
Windows Installer Clean Up
Windows Internet Explorer 7
Windows Media Format 11 runtime
Windows Media Player 11
Windows XP Hotfix - KB885836
Windows XP Hotfix - KB885884
Windows XP Hotfix - KB886185
Windows XP Hotfix - KB887742
Windows XP Hotfix - KB888302
Windows XP Hotfix - KB890859
WinRAR archiver
Yahoo! Messenger with BT Communicator

********************************************************************************
**********************************

Combofix;

ComboFix 08-01-20.1 - Jon Hogarth 2008-01-25 8:38:02.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.598 [GMT 0:00]
Running from: C:\Documents and Settings\[removed]\My Documents\My Received Files\ComboFix.exe
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Program Files\Common Files\Yazzle1281OinUninstaller.exe
C:\Program Files\Temporary
C:\WINDOWS\hosts
C:\WINDOWS\system32\ccbeg.ini
C:\WINDOWS\system32\ccbeg.ini2
C:\WINDOWS\system32\pac.txt

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.
——-\LEGACY_NNSERV


((((((((((((((((((((((((( Files Created from 2007-12-25 to 2008-01-25 )))))))))))))))))))))))))))))))
.

2008-01-25 08:16 . 2008-01-19 11:26 211 -rahs—- C:\BOOT.BAK
2008-01-25 08:15 . 2004-08-12 14:05 260,272 -r-hs—- C:\cmldr
2008-01-25 08:05 . 2000-08-31 08:00 51,200 –a—— C:\WINDOWS\NirCmd.exe
2008-01-23 22:05 . 2008-01-23 22:05 d——– C:\Program Files\Trend Micro
2008-01-19 13:29 . 2008-01-19 15:34 d——– C:\Documents and Settings\Jon Hogarth\Application Data\AVG7
2008-01-19 13:28 . 2008-01-19 13:28 d——– C:\Documents and Settings\LocalService\Application Data\AVG7
2008-01-19 13:28 . 2008-01-19 13:28 d——– C:\Documents and Settings\All Users\Application Data\Grisoft
2008-01-19 13:28 . 2008-01-19 14:24 d——– C:\Documents and Settings\All Users\Application Data\avg7
2008-01-19 10:50 . 2008-01-19 10:50 138,752 –a—— C:\WINDOWS\system32\drivers\sp_rsdrv2.sys
2008-01-18 18:04 . 2008-01-20 17:55 d——– C:\Program Files\Spyware Terminator
2008-01-18 18:04 . 2008-01-25 08:34 d——– C:\Documents and Settings\Jon Hogarth\Application Data\Spyware Terminator
2008-01-18 18:04 . 2008-01-20 11:47 d——– C:\Documents and Settings\All Users\Application Data\Spyware Terminator
2008-01-16 21:07 . 2008-01-17 20:14 15,360 –a—— C:\WINDOWS\system32\ctfmon .exe
2008-01-14 22:36 . 2008-01-19 15:04 d——– C:\Program Files\Dot1XCfg
2008-01-14 22:33 . 2008-01-19 15:04 d——– C:\WINDOWS\system32\edcA01
2008-01-14 22:33 . 2008-01-14 22:33 d——– C:\Temp\Ryuan1

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-25 05:23 ——— d—–w C:\Program Files\eMule
2008-01-20 21:21 ——— d—–w C:\Documents and Settings\Jon Hogarth\Application Data\Vso
2008-01-20 19:34 ——— d—–w C:\Documents and Settings\Jon Hogarth\Application Data\VSO_HWE
2008-01-20 00:24 ——— d—–w C:\Program Files\iTunes
2008-01-19 15:49 ——— d—–w C:\Program Files\CCleaner
2008-01-19 15:04 ——— d—–w C:\Program Files\Virgin Net Broadband
2008-01-19 15:04 ——— d—–w C:\Program Files\Quicktime
2008-01-19 15:04 ——— d—–w C:\Program Files\DellSupport
2008-01-19 15:04 ——— d—–w C:\Program Files\Browser MOUSE
2008-01-19 15:04 ——— d—–w C:\Program Files\AnyDVD
2008-01-09 20:39 96,968 -c–a-w C:\Documents and Settings\Jon Hogarth\Application Data\GDIPFONTCACHEV1.DAT
2007-12-29 14:56 ——— d—–w C:\Program Files\SopCast
2007-12-26 15:18 ——— d—–w C:\Documents and Settings\Jon Hogarth\Application Data\SopCast
2007-12-24 14:42 ——— d—–w C:\Program Files\Illustrate
2007-12-24 14:42 ——— d—–w C:\Documents and Settings\Jon Hogarth\Application Data\AccurateRip
2007-12-15 19:19 ——— d—–w C:\Documents and Settings\Jon Hogarth\Application Data\Apple Computer
2007-12-15 17:12 ——— d—–w C:\Program Files\iPod
2007-12-15 17:11 ——— d—–w C:\Documents and Settings\All Users\Application Data\Apple Computer
2007-12-15 17:10 ——— d—–w C:\Program Files\Apple Software Update
2007-12-15 17:09 ——— d—–w C:\Program Files\Common Files\Apple
2007-12-15 17:09 ——— d—–w C:\Documents and Settings\All Users\Application Data\Apple
2007-12-10 10:58 ——— d—–w C:\Program Files\Common Files\Sonic Shared
2007-12-09 19:03 ——— d—–w C:\Program Files\LimeWire
2007-09-23 09:21 1,026,026 —-a-w C:\Documents and Settings\Limewire\VirtualDub-1.6.19.zip
2007-04-07 16:46 12,358 —-a-w C:\Documents and Settings\Limewire\Footy3.zip
2007-03-17 12:00 2,796,160 —-a-w C:\Documents and Settings\Limewire\TvantsSetup.EXE
2007-03-17 11:56 12,358 —-a-w C:\Documents and Settings\Limewire\footy2.zip
2006-01-23 14:54 181,385,638 —-a-w C:\Documents and Settings\Limewire\Nero Burning Rom 6.0 Ultra Edition Incl Keygen & Serial.zip
2006-01-15 20:31 3,773,203 —-a-w C:\Documents and Settings\Limewire\WinAvi Video Converter 7.1 with serial (latest).zip
.
—-a-w		   579,072 2008-01-18 18:36:04  C:\Program Files\Grisoft\AVG7\avgcc .exe
—-a-w		   219,136 2008-01-16 18:27:55  C:\Program Files\Grisoft\AVG7\avgw .exe
—-a-w			15,360 2008-01-17 20:14:57  C:\WINDOWS\system32\ctfmon .exe


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 05:00 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpywareTerminator"="C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe" [2008-01-18 18:05 2834432]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2008-01-19 13:28 579072]
"UserFaultCheck"="C:\WINDOWS\system32\dumprep 0 -u" [ ]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 05:00 15360]
"AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2008-01-19 13:28 219136]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 01:01:04 83360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\jkklmji]
jkklmji.dll

R1 sp_rsdrv2;Spyware Terminator Driver 2;C:\WINDOWS\system32\drivers\sp_rsdrv2.sys [2008-01-19 10:50]
S2 BackWeb Plug-in - 4476822;F-Secure Anti-Virus 2005;C:\PROGRA~1\F-SECU~1\backweb\4476822\Program\SERVIC~1.EXE []
S3 bfastfao;bfastfao;C:\DOCUME~1\JONHOG~1\LOCALS~1\Temp\bfastfao.sys [2004-05-07 15:52]
S3 PIXMCV;JVC Communication PIX-MCV Driver;C:\WINDOWS\system32\Drivers\pixmcvc.sys [2002-09-28 05:08]
S3 PIXMCVA;JVC PIX-MCV Audio Capture;C:\WINDOWS\system32\Drivers\pixmcva.sys [2002-10-03 19:53]
S3 PIXMCVV;JVC PIX-MCV Video Capture;C:\WINDOWS\system32\Drivers\pixmcvv.sys [2002-11-28 01:16]

.
Contents of the 'Scheduled Tasks' folder
"2008-01-19 21:47:01 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2008-01-25 00:02:55 C:\WINDOWS\Tasks\Scheduled scanning task.job"
- C:\PROGRA~1\F-SECU~1\ANTI-V~1\fsav.exeZ /HARD /ARCHIVE /DISINF /SCHED /NOBREAK /REPORT=C:\PROGRA~1\F-SECU~1\ANTI-V~1\report.txt
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-25 08:42:28
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-01-25 8:44:40 - machine was rebooted
ComboFix-quarantined-files.txt 2008-01-25 08:44:38
.
2008-01-08 23:04:56 — E O F —

********************************************************************************
****************************************************************

HijackThis;

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 08:50:01, on 25/01/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\Program Files\Spyware Terminator\sp_rsser.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.virginmedia.com/customers/email…l&app;=email
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.virgin.net/
R3 - URLSearchHook: (no name) - {4D25F926-B9FE-4682-BF72-8AB8210D6D75} - C:\Program Files\MyWaySA\SrchAsDe\deSrcAs.dll (file missing)
O2 - BHO: (no name) - 8Cã55F3E-90C3-41AA-8705-15969AF7F210} - (no file)
O2 - BHO: (no name) - hCã5F921-B9FE-4682-BF72-8AB8210D6D75} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - ¸Cã3D70E-1895-11CF-8E15-001234567890} - (no file)
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O4 - HKLM\..\Run: [SpywareTerminator] "C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport; to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra button: (no name) - {200DB664-75B5-47c0-8B45-A44ACCF73F02} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll (file missing)
O9 - Extra 'Tools' menuitem: &Suspend; Webpage Filter - {200DB664-75B5-47c0-8B45-A44ACCF73F02} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll (file missing)
O9 - Extra button: (no name) - {200DB664-75B5-47c0-8B45-A44ACCF73F03} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll (file missing)
O9 - Extra 'Tools' menuitem: &Deny; this website - {200DB664-75B5-47c0-8B45-A44ACCF73F03} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll (file missing)
O9 - Extra button: (no name) - {200DB664-75B5-47c0-8B45-A44ACCF73F04} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll (file missing)
O9 - Extra 'Tools' menuitem: &Allow; this website - {200DB664-75B5-47c0-8B45-A44ACCF73F04} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll (file missing)
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRA~1\Yahoo!\Common\yhexbmesuk.dll (file missing)
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRA~1\Yahoo!\Common\yhexbmesuk.dll (file missing)
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMesse…pDownloader.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{80D94202-8DE1-477D-A2E0-544ABFF779D9}: NameServer = 194.168.4.100 194.168.8.100
O20 - Winlogon Notify: jkklmji - jkklmji.dll (file missing)
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: F-Secure Anti-Virus 2005 (BackWeb Plug-in - 4476822) - Unknown owner - C:\PROGRA~1\F-SECU~1\backweb\4476822\Program\SERVIC~1.EXE (file missing)
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: Microsoft Office Diagnostics Service (odserv) - Unknown owner - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE (file missing)
O23 - Service: Office Source Engine (ose) - Unknown owner - C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE (file missing)
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

–
End of file - 7965 bytes
Post #6
Hi :)

C:\Documents and Settings\Limewire\Nero Burning Rom 6.0 Ultra Edition Incl Keygen & Serial.zip
C:\Documents and Settings\Limewire\WinAvi Video Converter 7.1 with serial (latest).zip

Pretty obvious where you got infected. Please remove all crack/keygen/serial software from your computer. They will always bring malware on your system, and it certainly won't help the cleaning process.

Step 1

You are operating your computer with multiple Anti-Virus programs running in memory at once:

AVG 7.5
F-Secure Anti-Virus 2005

Anti-Virus programs take up an enormous amount of your computer's resources when they are actively scanning your computer. Having two Anti-Virus programs running at the same time can cause your computer to run very slow, become unstable and even crash.

If you choose to install more than one antivirus program on your computer, then only one of them should be active in memory at a time.

Please disable or uninstall one or the other so they do not conflict.

Step 2

Click on Start, then Control Panel. Double click on Add or Remove Programs.

Please remove the following program(s):

  • Java 2 Runtime Environment, SE v1.4.2_03
  • MyWay Search Assistant
  • Viewpoint Media Player <– Only uninstall this one if you haven't installed it yourself.

Then download and install Java Runtime Environment (JRE) 6 Update 4.

Step 3

Open Notepad (Go to Start > Run, type Notepad and hit Enter), and copy/paste the text in the quotebox below into it:

File::

C:\Documents and Settings\Limewire\Nero Burning Rom 6.0 Ultra Edition Incl Keygen & Serial.zip
C:\Documents and Settings\Limewire\WinAvi Video Converter 7.1 with serial (latest).zip
C:\DOCUME~1\JONHOG~1\LOCALS~1\Temp\bfastfao.sys

Folder::

C:\WINDOWS\system32\edcA01
C:\Temp\Ryuan1

Registry::

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"UserFaultCheck"=-
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\jkklmji]

Driver::

bfastfao

RenV::

C:\Program Files\Grisoft\AVG7\avgcc .exe
C:\Program Files\Grisoft\AVG7\avgw .exe
C:\WINDOWS\system32\ctfmon .exe

Click on File > Save as….

In the File Name box, copy/paste CFScript.txt (Note: Do not change the filename!)

Click Save (Save the CFScript in the same location as Combofix.exe)

Close any open windows.

Close/disable all anti-virus and anti-malware programs so they do not interfere with the running of ComboFix.

[external image: Posted Image]

Referring to the picture above, drag CFScript into ComboFix.exe.
It will create a log. Be sure to save it to a convenient location.

Step 4

Please download Malwarebytes' Anti-Malware to your desktop.

  • Double-click mbam-setup.exe and follow the prompts to install the program.
  • Be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select Perform quick scan, then click Scan.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Be sure that everything is checked, and click Remove Selected.
  • When completed, a log will open in Notepad. Please save it to a convenient location. The log can also be opened by going to Start > All Programs > Malwarebytes' Anti-Malware > Logs > log-date.txt

Step 5

In your next reply, please post:

  • the Combofix log (C:\Combofix.txt)
  • the Malwarebytes' Anti-Malware report
  • a new HijackThis log
Post #7
Hey i really appreciate you taking the time to sort out my problems, i hope this forum gets the recognition it deserves. I've just got home late (its 2am in UK) so i will do all this in the morning. When the virus disabled F-Secure i removed it after i installed AVG and i also ran a tool provided by F-Secure that should have uninstalled it fully so not sure why the pc thinks its still running. When i log on the spyware shield asks if i should allow 'svchost.exe', not sure what this is or if i should block it ? I will run logs tomorrow thanks again.
Post #8

When i log on the spyware shield asks if i should allow 'svchost.exe', not sure what this is or if i should block it ?

svchost.exe is a legit process, belonging to Windows. You should allow it do to whatever it wants ;)
Post #9
Hi, ive done as you have instructed, if you dont mind, please dont close the thread yet as i will have a couple of things to ask at the end of these processes.

ComboFix log;

ComboFix 08-01-20.1 - Jon Hogarth 2008-01-26 15:02:20.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.401 [GMT 0:00]
Running from: C:\Documents and Settings\[removed]\My Documents\My Received Files\ComboFix.exe
Command switches used :: C:\Documents and Settings\Jon Hogarth\My Documents\My Received Files\CFScript.txt
* Created a new restore point

FILE
C:\DOCUME~1\JONHOG~1\LOCALS~1\Temp\bfastfao.sys
C:\Documents and Settings\Limewire\Nero Burning Rom 6.0 Ultra Edition Incl Keygen & Serial.zip
C:\Documents and Settings\Limewire\WinAvi Video Converter 7.1 with serial (latest).zip
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Temp\Ryuan1
C:\WINDOWS\system32\edcA01

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.
——-\LEGACY_BFASTFAO
——-\bfastfao


((((((((((((((((((((((((( Files Created from 2007-12-26 to 2008-01-26 )))))))))))))))))))))))))))))))
.

2008-01-26 14:55 . 2007-12-14 01:59 69,632 –a—— C:\WINDOWS\system32\javacpl.cpl
2008-01-25 08:16 . 2008-01-19 11:26 211 -rahs—- C:\BOOT.BAK
2008-01-25 08:15 . 2004-08-12 14:05 260,272 -r-hs—- C:\cmldr
2008-01-25 08:05 . 2000-08-31 08:00 51,200 –a—— C:\WINDOWS\NirCmd.exe
2008-01-23 22:05 . 2008-01-23 22:05 d——– C:\Program Files\Trend Micro
2008-01-19 13:29 . 2008-01-19 15:34 d——– C:\Documents and Settings\Jon Hogarth\Application Data\AVG7
2008-01-19 13:28 . 2008-01-19 13:28 d——– C:\Documents and Settings\LocalService\Application Data\AVG7
2008-01-19 13:28 . 2008-01-19 13:28 d——– C:\Documents and Settings\All Users\Application Data\Grisoft
2008-01-19 13:28 . 2008-01-19 14:24 d——– C:\Documents and Settings\All Users\Application Data\avg7
2008-01-19 10:50 . 2008-01-19 10:50 138,752 –a—— C:\WINDOWS\system32\drivers\sp_rsdrv2.sys
2008-01-18 18:04 . 2008-01-20 17:55 d——– C:\Program Files\Spyware Terminator
2008-01-18 18:04 . 2008-01-26 11:00 d——– C:\Documents and Settings\Jon Hogarth\Application Data\Spyware Terminator
2008-01-18 18:04 . 2008-01-20 11:47 d——– C:\Documents and Settings\All Users\Application Data\Spyware Terminator
2008-01-16 21:07 . 2008-01-17 20:14 15,360 –a—— C:\WINDOWS\system32\dllcache\ctfmon.exe
2008-01-16 21:07 . 2008-01-17 20:14 15,360 –a—— C:\WINDOWS\system32\ctfmon.exe
2008-01-14 22:36 . 2008-01-19 15:04 d——– C:\Program Files\Dot1XCfg

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-26 14:54 ——— d—–w C:\Program Files\Java
2008-01-26 08:39 ——— d—–w C:\Program Files\eMule
2008-01-20 21:21 ——— d—–w C:\Documents and Settings\Jon Hogarth\Application Data\Vso
2008-01-20 19:34 ——— d—–w C:\Documents and Settings\Jon Hogarth\Application Data\VSO_HWE
2008-01-20 00:24 ——— d—–w C:\Program Files\iTunes
2008-01-19 15:49 ——— d—–w C:\Program Files\CCleaner
2008-01-19 15:04 ——— d—–w C:\Program Files\Virgin Net Broadband
2008-01-19 15:04 ——— d—–w C:\Program Files\Quicktime
2008-01-19 15:04 ——— d—–w C:\Program Files\DellSupport
2008-01-19 15:04 ——— d—–w C:\Program Files\Browser MOUSE
2008-01-19 15:04 ——— d—–w C:\Program Files\AnyDVD
2008-01-09 20:39 96,968 -c–a-w C:\Documents and Settings\Jon Hogarth\Application Data\GDIPFONTCACHEV1.DAT
2007-12-29 14:56 ——— d—–w C:\Program Files\SopCast
2007-12-26 15:18 ——— d—–w C:\Documents and Settings\Jon Hogarth\Application Data\SopCast
2007-12-24 14:42 ——— d—–w C:\Program Files\Illustrate
2007-12-24 14:42 ——— d—–w C:\Documents and Settings\Jon Hogarth\Application Data\AccurateRip
2007-12-15 19:19 ——— d—–w C:\Documents and Settings\Jon Hogarth\Application Data\Apple Computer
2007-12-15 17:12 ——— d—–w C:\Program Files\iPod
2007-12-15 17:11 ——— d—–w C:\Documents and Settings\All Users\Application Data\Apple Computer
2007-12-15 17:10 ——— d—–w C:\Program Files\Apple Software Update
2007-12-15 17:09 ——— d—–w C:\Program Files\Common Files\Apple
2007-12-15 17:09 ——— d—–w C:\Documents and Settings\All Users\Application Data\Apple
2007-12-10 10:58 ——— d—–w C:\Program Files\Common Files\Sonic Shared
.

((((((((((((((((((((((((((((( snapshot@2008-01-25_ 8.44.27.73 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-01-25 08:37:46 233,472 —-a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000001\NTUSER.DAT
+ 2008-01-26 15:02:01 233,472 —-a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000001\NTUSER.DAT
- 2008-01-25 08:37:46 8,192 —-a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000002\UsrClass.dat
+ 2008-01-26 15:02:01 8,192 —-a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000002\UsrClass.dat
- 2008-01-25 08:37:46 233,472 —-a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000003\NTUSER.DAT
+ 2008-01-26 15:02:01 233,472 —-a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000003\NTUSER.DAT
- 2008-01-25 08:37:46 8,192 —-a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000004\UsrClass.dat
+ 2008-01-26 15:02:01 8,192 —-a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000004\UsrClass.dat
- 2008-01-25 08:37:46 8,417,280 —-a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000005\ntuser.dat
+ 2008-01-26 15:02:02 8,433,664 —-a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000005\ntuser.dat
- 2008-01-25 08:37:46 12,288 —-a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000006\UsrClass.dat
+ 2008-01-26 15:02:02 147,456 —-a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000006\UsrClass.dat
- 2003-11-19 16:36:26 24,681 -c–a-w C:\WINDOWS\system32\java.exe
+ 2007-12-14 00:57:22 135,168 —-a-w C:\WINDOWS\system32\java.exe
- 2003-11-19 16:36:30 28,779 -c–a-w C:\WINDOWS\system32\javaw.exe
+ 2007-12-14 00:57:24 135,168 —-a-w C:\WINDOWS\system32\javaw.exe
+ 2007-12-14 01:59:16 139,264 —-a-w C:\WINDOWS\system32\javaws.exe
- 2008-01-24 22:01:59 53,436 —-a-w C:\WINDOWS\system32\perfc009.dat
+ 2008-01-25 18:36:34 53,436 —-a-w C:\WINDOWS\system32\perfc009.dat
- 2008-01-24 22:01:59 381,692 —-a-w C:\WINDOWS\system32\perfh009.dat
+ 2008-01-25 18:36:34 381,692 —-a-w C:\WINDOWS\system32\perfh009.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-01-17 20:14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpywareTerminator"="C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe" [2008-01-18 18:05 2834432]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2008-01-18 18:36 579072]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe" [2007-12-14 03:42 144784]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2008-01-17 20:14 15360]
"AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2008-01-16 18:27 219136]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 01:01:04 83360]

R1 sp_rsdrv2;Spyware Terminator Driver 2;C:\WINDOWS\system32\drivers\sp_rsdrv2.sys [2008-01-19 10:50]
S2 BackWeb Plug-in - 4476822;F-Secure Anti-Virus 2005;C:\PROGRA~1\F-SECU~1\backweb\4476822\Program\SERVIC~1.EXE []
S3 PIXMCV;JVC Communication PIX-MCV Driver;C:\WINDOWS\system32\Drivers\pixmcvc.sys [2002-09-28 05:08]
S3 PIXMCVA;JVC PIX-MCV Audio Capture;C:\WINDOWS\system32\Drivers\pixmcva.sys [2002-10-03 19:53]
S3 PIXMCVV;JVC PIX-MCV Video Capture;C:\WINDOWS\system32\Drivers\pixmcvv.sys [2002-11-28 01:16]

.
Contents of the 'Scheduled Tasks' folder
"2008-01-19 21:47:01 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2008-01-25 00:02:55 C:\WINDOWS\Tasks\Scheduled scanning task.job"
- C:\PROGRA~1\F-SECU~1\ANTI-V~1\fsav.exeZ /HARD /ARCHIVE /DISINF /SCHED /NOBREAK /REPORT=C:\PROGRA~1\F-SECU~1\ANTI-V~1\report.txt
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-26 15:06:26
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-01-26 15:08:21 - machine was rebooted
ComboFix-quarantined-files.txt 2008-01-26 15:08:18
ComboFix2.txt 2008-01-25 08:44:41
.
2008-01-08 23:04:56 — E O F —


Malwarebytes' report

Malwarebytes' Anti-Malware version 1.00
Database version: 285

Scan type: Quick Scan
Objects scanned: 19495
Time elapsed: 3 minute(s), 28 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 2
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 1
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CLASSES_ROOT\abar.abarband.1 (Adware.Accoona) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\Dot1XCfg (Trojan.Downloader) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
C:\Program Files\Dot1XCfg (Trojan.Downloader) -> Quarantined and deleted successfully.

Files Infected:
(No malicious items detected)

HijackThis log;

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:37:06, on 26/01/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\Program Files\Spyware Terminator\sp_rsser.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.virginmedia.com/customers/email…l&app=email
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.virgin.net/
O2 - BHO: (no name) - 8Cã55F3E-90C3-41AA-8705-15969AF7F210} - (no file)
O2 - BHO: (no name) - hCã5F921-B9FE-4682-BF72-8AB8210D6D75} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
O2 - BHO: (no name) - ¸Cã3D70E-1895-11CF-8E15-001234567890} - (no file)
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O4 - HKLM\..\Run: [SpywareTerminator] "C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
O9 - Extra button: (no name) - {200DB664-75B5-47c0-8B45-A44ACCF73F02} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll (file missing)
O9 - Extra 'Tools' menuitem: &Suspend Webpage Filter - {200DB664-75B5-47c0-8B45-A44ACCF73F02} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll (file missing)
O9 - Extra button: (no name) - {200DB664-75B5-47c0-8B45-A44ACCF73F03} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll (file missing)
O9 - Extra 'Tools' menuitem: &Deny this website - {200DB664-75B5-47c0-8B45-A44ACCF73F03} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll (file missing)
O9 - Extra button: (no name) - {200DB664-75B5-47c0-8B45-A44ACCF73F04} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll (file missing)
O9 - Extra 'Tools' menuitem: &Allow this website - {200DB664-75B5-47c0-8B45-A44ACCF73F04} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll (file missing)
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRA~1\Yahoo!\Common\yhexbmesuk.dll (file missing)
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRA~1\Yahoo!\Common\yhexbmesuk.dll (file missing)
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMesse…pDownloader.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{80D94202-8DE1-477D-A2E0-544ABFF779D9}: NameServer = 194.168.4.100 194.168.8.100
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: F-Secure Anti-Virus 2005 (BackWeb Plug-in - 4476822) - Unknown owner - C:\PROGRA~1\F-SECU~1\backweb\4476822\Program\SERVIC~1.EXE (file missing)
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: Microsoft Office Diagnostics Service (odserv) - Unknown owner - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE (file missing)
O23 - Service: Office Source Engine (ose) - Unknown owner - C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE (file missing)
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

–
End of file - 7894 bytes
Post #10
Hi :)

Open HijackThis, perform a scan and put a check next to the following items (if present):

O2 - BHO: (no name) - 8Cã55F3E-90C3-41AA-8705-15969AF7F210} - (no file)
O2 - BHO: (no name) - hCã5F921-B9FE-4682-BF72-8AB8210D6D75} - (no file)
O2 - BHO: (no name) - ¸Cã3D70E-1895-11CF-8E15-001234567890} - (no file)
O9 - Extra button: (no name) - {200DB664-75B5-47c0-8B45-A44ACCF73F02} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll (file missing)
O9 - Extra 'Tools' menuitem: &Suspend Webpage Filter - {200DB664-75B5-47c0-8B45-A44ACCF73F02} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll (file missing)
O9 - Extra button: (no name) - {200DB664-75B5-47c0-8B45-A44ACCF73F03} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll (file missing)
O9 - Extra 'Tools' menuitem: &Deny this website - {200DB664-75B5-47c0-8B45-A44ACCF73F03} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll (file missing)
O9 - Extra button: (no name) - {200DB664-75B5-47c0-8B45-A44ACCF73F04} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll (file missing)
O9 - Extra 'Tools' menuitem: &Allow this website - {200DB664-75B5-47c0-8B45-A44ACCF73F04} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll (file missing)
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRA~1\Yahoo!\Common\yhexbmesuk.dll (file missing)
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRA~1\Yahoo!\Common\yhexbmesuk.dll (file missing)
O23 - Service: F-Secure Anti-Virus 2005 (BackWeb Plug-in - 4476822) - Unknown owner - C:\PROGRA~1\F-SECU~1\backweb\4476822\Program\SERVIC~1.EXE (file missing)

Close all programs except HijackThis and click on Fix checked.

Hi, ive done as you have instructed, if you dont mind, please dont close the thread yet as i will have a couple of things to ask at the end of these processes.

Ask away :)
Post #11
Ok, ive done that thanks Simon, is that the last stage ? I wanted to ask; 1) all my icon graphics have gone, on the desktop, in Windows control panel on the start programs list etc.. most of them are all the same now, with a basic rectangular icon, am i able to restore my icons back to normal ? 2) before the virus hit, a lot of my controls were in the system tray (for my sound equaliser settings, mouse, keyboard shortcuts etc). Will i have to re-install my hardware to have it run correctly as i cant access them. For example i have a Soundblaster sound card and i was able to change various sound settings like 'stereo to 5.1 surround' etc, but when i open it from the program files, an error states "the audio device supported by this application is not detected. This application will exit.". 3) sorry, this is probably basic knowledge, but before when i plugged in my external hard drive or put a disc in the DVD drive, it would automatically read them and an explorer window would open with a list of options. Nothing happens now, can i get this back to normal ? Thanks for your help Simon Jon
Post #12
Hi :)

1) all my icon graphics have gone, on the desktop, in Windows control panel on the start programs list etc.. most of them are all the same now, with a basic rectangular icon, am i able to restore my icons back to normal ?

2) before the virus hit, a lot of my controls were in the system tray (for my sound equaliser settings, mouse, keyboard shortcuts etc). Will i have to re-install my hardware to have it run correctly as i cant access them. For example i have a Soundblaster sound card and i was able to change various sound settings like 'stereo to 5.1 surround' etc, but when i open it from the program files, an error states "the audio device supported by this application is not detected. This application will exit.".

This was caused by the infection you had on your system. Any programs that don't function properly should be reinstalled.

3) sorry, this is probably basic knowledge, but before when i plugged in my external hard drive or put a disc in the DVD drive, it would automatically read them and an explorer window would open with a list of options. Nothing happens now, can i get this back to normal ?

I do not recommend this (it is much safer to leave autorun and autoplay disabled), but here is a fix for it:

Copy the text below into a Notepad (Go to Start > Run, type Notepad and hit Enter) document:

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer]
"NoDriveAutoRun"=dword:00000000
"NoDriveTypeAutoRun"=-

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer]
"NoDriveAutoRun"=dword:00000000
"NoDriveTypeAutoRun"=-

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom]
"AutoRun"=-

Note: Make sure there is no blank line before REGEDIT4 and one blank line at the end.

Go to File > Save As:. Save the file as "Fix.reg" (Including the quotes)

Double-click on Fix.reg. When asked if you want to merge the file with the registry, click Yes.

Delete Fix.reg and reboot your computer.

In your next reply, let me know whether you still experience problems.
Post #13 last edited
Hello again Regarding earlier queries, i understand the virus has affected the system tray so i will re-install what i can, however, the icon graphics were not affected when the virus struck and only vanished after running Malwarebytes. Another problem i just found; 4) i cant drag and drop files from explorer windows, if i cut and paste files it seems to take an age (currently running 15 minutes for 700MB file) 5) if i insert a memory card into my card reader a green icon used to appear in the system tray which would later allow me to 'remove removable disk safely' is there any way of returning this function ? Sorry to bombard you with questions cheers Simon Jon
Post #14
Hi :)

You aren't bombarding me with questions, I'd like to solve these problems.

They're actually quite interesting; how do your icons look like now? Like one of the following? [external image: Posted Image] or [external image: Posted Image]

I'll have a look for the other two problems; when copying and pasting files in explorer, do you copy them to another drive, or to another folder on the same drive?
Post #15 last edited

They're actually quite interesting; how do your icons look like now? Like one of the following? [external image: Posted Image] or [external image: Posted Image]

I'll have a look for the other two problems; when copying and pasting files in explorer, do you copy them to another drive, or to another folder on the same drive?


On the desktop the icons are a mixture of both, in the control panel they are all the icon on the left, but if i explore various folders they are a mixture of both.

When i was copying it was to another drive (memory card) though when i did it again to my external hard drive this was as expected.

I can highlight folders/files by clicking on them, but i cant drag them. When the virus attacked i did get a warning saying a malicious file was found within

the mouse, keyboard, infact everything that was in the system tray, maybe this is why. I've tried toggling mouse properties with no effect so i'll try uninstalling

and reinstalling it to refresh the drivers.

:pullhair:

cheers Simon

Jon

no that made no difference, ive googled and found others that have same problem and have been told it is down to missing reg keys.

I dont know how to progress this, but i wonder if its the same for everything that was infected in my system tray..


Holey moley, i was just closing down Windows Media Player to shut down and all of the icons refreshed on the desktop and everything is

back to normal. Checked and all others show properly too. And it will now drag and drop files too. Whats going on inside this pc. :wacko:

I think i need to go to bed and see whats what in the morning………….

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI