Spyware / Malware / Virus Removal

[Closed] "wowfx.dll" Please help.

5 min read

Looking for the outcome? Ask AI

Sinjay Topic Starter

Post #1March 20, 2008, 4:27 AM UTC

Hi
I've been experiencing the wowfx.dll virus or whatever it is, I'm very rookie so I really need help with this.
I checked out some other threads about it and followed some of the steps, I have an HJT log and I ran ATF-Cleaner. I also downloaded Combofix but I wasnt sure whether or not to run it yet.

Here is my HJT log -

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Logitech\G-series Software\LGDCore.exe
C:\Program Files\Logitech\G-series Software\LCDMon.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\WINDOWS\TEMP\winC0.exe
C:\WINDOWS\mgrs.exe
C:\WINDOWS\lsass.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Logitech\SetPoint II\SetpointII.exe
C:\Program Files\Xfire\xfire.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Logitech\G-series Software\LGDCore .exe
C:\Program Files\Logitech\G-series Software\LCDMon .exe
C:\Program Files\iTunes\iTunesHelper .exe
C:\WINDOWS\TEMP\winC0 .exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched .exe
C:\WINDOWS\lsass .exe
C:\Program Files\Common Files\Symantec Shared\ccApp .exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\ctfmon .exe
C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
C:\Program Files\Logitech\G-series Software\Applets\LCDCountdown\LCDCountdown.exe
C:\Program Files\Logitech\G-series Software\Applets\LCDPop3\LCDPOP3.exe
C:\Program Files\Logitech\G-series Software\Applets\LCDMedia.exe
C:\Program Files\Logitech\G-series Software\Applets\LCDClock.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Java\jre1.6.0_03\bin\jucheck.exe
C:\Program Files\Hijackthis\HijackThis.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\regsvr32.exe
C:\WINDOWS\system32\regsvr32.exe
C:\WINDOWS\system32\regsvr32.exe
C:\WINDOWS\system32\regsvr32.exe
C:\WINDOWS\system32\regsvr32.exe
C:\WINDOWS\system32\regsvr32.exe
C:\WINDOWS\system32\regsvr32.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.daemon-search.com/startpage

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
F3 - REG:win.ini: load=C:\WINDOWS\system32\jkhhf.exe
O3 - Toolbar: Show Norton Toolbar - {90222687-F593-4738-B738-FBEE9C7B26DF} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.5\UIBHO.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [Launch LGDCore] "C:\Program Files\Logitech\G-series Software\LGDCore.exe" /SHOWHIDE
O4 - HKLM\..\Run: [Launch LCDMon] "C:\Program Files\Logitech\G-series Software\LCDMon.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask .exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [LcdStudio] C:\Program Files\LcdStudio\LcdStudio.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [CTDrive] rundll32.exe C:\WINDOWS\system32\drvnep.dll,startup
O4 - HKLM\..\Run: [Winupdate Engine] C:\WINDOWS\system32\wupeng.exe
O4 - HKLM\..\Run: [avp] C:\WINDOWS\TEMP\winC0 .exe
O4 - HKLM\..\Run: [smgr] mgrs.exe
O4 - HKLM\..\Run: [lsass] C:\WINDOWS\lsass .exe
O4 - HKLM\..\Run: [ctfmona] C:\WINDOWS\system32\ctfmona.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Steam] "C:\Program Files\Steam\Steam.exe" -silent
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe"
O4 - HKCU\..\Run: [Spoolsv] C:\WINDOWS\system32\spoolvs.exe
O4 - HKCU\..\Run: [Ultimate Cleaner] "C:\Program Files\Ultimate Cleaner\UltimateCleaner.exe" hide
O4 - Startup: Xfire.lnk = C:\Program Files\Xfire\xfire.exe
O4 - Global Startup: SetPointII.lnk = ?
O7 - HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O11 - Options group: [INTERNATIONAL] International*
O11 - Options group: Tabbed Browsing
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab56907.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - AppInit_DLLs: C:\WINDOWS\system32\wowfx.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\wpdshserviceobj.dll
O21 - SSODL: SetupBoot - {441e2826-cef8-4223-8e52-8f594b3928ac} - C:\WINDOWS\Installer\{441e2826-cef8-4223-8e52-8f594b3928ac}\SetupBoot.dll
O21 - SSODL: CheckSetup - {c4fed913-dd67-4fb8-9c5e-53280272723f} - C:\WINDOWS\Installer\{c4fed913-dd67-4fb8-9c5e-53280272723f}\CheckSetup.dll
O21 - SSODL: UnknownChk - {1e1bf29f-36ef-4918-afa3-80a726cbae10} - C:\WINDOWS\Installer\{1e1bf29f-36ef-4918-afa3-80a726cbae10}\UnknownChk.dll
O21 - SSODL: RamCheck - {6f662f1f-5b87-4902-a0d7-bd51e5eea1cf} - C:\WINDOWS\Installer\{6f662f1f-5b87-4902-a0d7-bd51e5eea1cf}\RamCheck.dll
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: Symantec Settings Manager (ccSetMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

Thanks in advance.

Trevuren

Post #2March 20, 2008, 9:47 PM UTC

Hello Sinjay and welcome to the What the Tech Forums

My name is Trevuren and I will be helping you with your problem.

Please post a fresh HijackThis log as the one you have posted is missing some critical information. The entire upper portion is missing.

Regards,

Trevuren

Sinjay

Post #3March 21, 2008, 10:24 PM UTC

Hi Trevuren, Thanks for helping and sorry for the late reply.

Here's my log in full;

Logfile of HijackThis v1.99.1
Scan saved at 10:21:48 PM, on 3/21/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.20733)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\mgrs.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\Rundll32.exe
C:\Program Files\Logitech\SetPoint II\SetpointII.exe
C:\Program Files\Xfire\xfire.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Hijackthis\HijackThis.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Logitech\SetPoint II\LU\LULnchr.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.daemon-search.com/startpage

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.5\NppBho.dll
O2 - BHO: (no name) - {39985D09-B00D-458C-824D-52661014AB80} - C:\WINDOWS\system32\jkhhf.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: {fa62d36a-30af-f4b8-3a94-91cdca9af65b} - {b56fa9ac-dc19-49a3-8b4f-fa03a63d26af} - C:\WINDOWS\system32\jpockuwk.dll
O2 - BHO: cj helper - {F10587E9-0E47-4CBE-84AE-7DD20B8684BB} - C:\Program Files\IE Extensions\cj.v2.dll
O2 - BHO: (no name) - {FC1B64D9-3499-4791-82D5-AABAC3FAEA45} - C:\WINDOWS\system32\urqnlmj.dll (file missing)
O3 - Toolbar: Show Norton Toolbar - {90222687-F593-4738-B738-FBEE9C7B26DF} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.5\UIBHO.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [CTDrive] rundll32.exe C:\WINDOWS\system32\drvnep.dll,startup
O4 - HKLM\..\Run: [Winupdate Engine] C:\WINDOWS\system32\wupeng.exe
O4 - HKLM\..\Run: [avp] C:\WINDOWS\TEMP\winC0 .exe
O4 - HKLM\..\Run: [smgr] mgrs.exe
O4 - HKLM\..\Run: [ctfmona] C:\WINDOWS\system32\ctfmona.exe
O4 - HKLM\..\Run: [bcee518f] rundll32.exe "C:\WINDOWS\system32\yrhnolas.dll",b
O4 - HKLM\..\Run: [BMbfdd6213] Rundll32.exe "C:\WINDOWS\system32\qggvlbig.dll",s
O4 - HKCU\..\Run: [Spoolsv] C:\WINDOWS\system32\spoolvs.exe
O4 - Startup: Xfire.lnk = C:\Program Files\Xfire\xfire.exe
O4 - Global Startup: SetPointII.lnk = ?
O7 - HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O11 - Options group: [INTERNATIONAL] International*
O11 - Options group: Tabbed Browsing
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab56907.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - AppInit_DLLs: C:\WINDOWS\system32\wowfx.dll
O20 - Winlogon Notify: urqnlmj - urqnlmj.dll (file missing)
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\
O20 - Winlogon Notify: wintfj32 - C:\WINDOWS\SYSTEM32\wintfj32.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\wpdshserviceobj.dll
O21 - SSODL: SetupBoot - {441e2826-cef8-4223-8e52-8f594b3928ac} - C:\WINDOWS\Installer\{441e2826-cef8-4223-8e52-8f594b3928ac}\SetupBoot.dll
O21 - SSODL: CheckSetup - {c4fed913-dd67-4fb8-9c5e-53280272723f} - C:\WINDOWS\Installer\{c4fed913-dd67-4fb8-9c5e-53280272723f}\CheckSetup.dll
O21 - SSODL: UnknownChk - {1e1bf29f-36ef-4918-afa3-80a726cbae10} - C:\WINDOWS\Installer\{1e1bf29f-36ef-4918-afa3-80a726cbae10}\UnknownChk.dll
O21 - SSODL: RamCheck - {6f662f1f-5b87-4902-a0d7-bd51e5eea1cf} - C:\WINDOWS\Installer\{6f662f1f-5b87-4902-a0d7-bd51e5eea1cf}\RamCheck.dll
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: Symantec Settings Manager (ccSetMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

Trevuren

Post #4March 21, 2008, 11:06 PM UTC

A. I need to ask you to change your settings in Notepad so that the logs/reports that you post are not in double space format as this makes reading the reports much more difficult:

To turn off Word Wrap in Notepad

1. Click Start, then Run and type in the following: Notepad, then OK
2. A blank Notepad file will popup.
3. From the Toolbar, click on Format and remove the checkmark beside the word Word Wrap.
4. Now EXIT Notepad and we are all set to go.

B. First we must disable some of your security programs so that they do not interfere with the running of our tools:

NORTON ANTIVIRUS
Please navigate to the system tray on the bottom right hand corner and look for a [external image: Posted Image] sign.

right-click it -> chose "Disable Auto-Protect."
select a duration of 5 hours (this assures no interference with the cleanup of your pc)
click "Ok."
a popup will warn that protection will now be disabled and the sign will now look like this: [external image: Posted Image]

You succesfully disabled the Norton Antivirus Guard.

C. Please download ComboFix by sUBs from HERE or HERE directly to your Desktop.

Note: If you already have ComboFix on your machine, please DELETE it from your desktop before downloading the newest version.

Go to [external image: Posted Image] -> Run -> copy/paste the following single line command in the runbox & click OK

"%userprofile%\desktop\combofix.exe" /killall

[external image: Posted Image]

ComboFix will automatically start. Any monitoring programs will be shut down like your antivirus, antispyware programs for example.
ComboFix may restart your computer, this is normal.
When finished, it will produce a log, ComboFix.txt.
Please post ComboFix.txt in your next reply along with a new HijackThis log.

Notes:

1.Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
3. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you – please tell your helper.
4. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

Sinjay

Post #5March 21, 2008, 11:42 PM UTC

ComboFix 08-03-18.1 - Admin 2008-03-21 23:31:46.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1623 [GMT 0:00]
Running from: C:\Documents and Settings\[removed]\desktop\combofix.exe
Command switches used :: /killall

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\Admin\Application Data\trant.exe
C:\Documents and Settings\Admin\Application Data\Ultimate Cleaner
C:\Documents and Settings\Admin\Application Data\Ultimate Cleaner\settings.dat
C:\Documents and Settings\Admin\Application Data\ultra
C:\Documents and Settings\Admin\Application Data\ultra\uninstall.bat
C:\Documents and Settings\Admin\Desktop\Find Spyware Remover.lnk
C:\Documents and Settings\Admin\Desktop\Free Online Dating.lnk
C:\Documents and Settings\Admin\Desktop\Go to Casino.lnk
C:\Documents and Settings\Admin\Desktop\Ultimate Cleaner 2007.lnk
C:\Documents and Settings\All Users\Start Menu\Programs\UltimateCleaner 2007
C:\Documents and Settings\All Users\Start Menu\Programs\UltimateCleaner 2007\Register UltimateCleaner 2007.lnk
C:\Documents and Settings\All Users\Start Menu\Programs\UltimateCleaner 2007\Start UltimateCleaner 2007.lnk
C:\Documents and Settings\All Users\Start Menu\Programs\UltimateCleaner 2007\Uninstall UltimateCleaner 2007.lnk
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Helper
C:\Program Files\Helper\Helper9.dll
C:\Program Files\Helper\ifastseek.dll
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\lsass.exe
C:\Program Files\MalwareCrush
C:\Program Files\MalwareCrush\MalwareCrush .exe
C:\Program Files\QuickTime\qttask .exe
C:\Program Files\QuickTime\qttask .exe
C:\Program Files\QuickTime\qttask .exe
C:\Program Files\QuickTime\qttask .exe
C:\Program Files\QuickTime\qttask .exe
C:\Program Files\QuickTime\qttask .exe
C:\Program Files\QuickTime\qttask .exe
C:\Program Files\QuickTime\qttask .exe
C:\Program Files\smss.exe
C:\Program Files\spoolsv.exe
C:\Program Files\ucleaner_setup.exe
C:\Program Files\Ultimate Cleaner
C:\Program Files\Ultimate Cleaner\com\ucsecuredelete.dll
C:\Program Files\Ultimate Cleaner\program.info
C:\Program Files\Ultimate Cleaner\ucleaner.pkg
C:\Program Files\Ultimate Cleaner\UltimateCleaner .exe
C:\Program Files\Ultimate Cleaner\UltimateCleaner.db
C:\Program Files\Ultimate Cleaner\Uninstall.exe
C:\Program Files\Ultimate Defender
C:\Program Files\xloader10181.exe
C:\WINDOWS\Casino.ico
C:\WINDOWS\cookies.ini
C:\WINDOWS\Free Online Dating.ico
C:\WINDOWS\inf\ultra.inf
C:\WINDOWS\lsass .exe
C:\WINDOWS\mgrs.exe
C:\WINDOWS\pskt.ini
C:\WINDOWS\Spyware Remover.ico
C:\WINDOWS\system32\drvnepr.dll
C:\WINDOWS\system32\fhhkj.ini
C:\WINDOWS\system32\fhhkj.ini2
C:\WINDOWS\system32\jkhhf.dll
C:\WINDOWS\system32\jkhhf.exe
C:\WINDOWS\system32\jpockuwk.dll
C:\WINDOWS\system32\mcrh.tmp
C:\WINDOWS\system32\nlncnkwt.ini
C:\WINDOWS\system32\qggvlbig.dll
C:\WINDOWS\system32\RCX27.tmp
C:\WINDOWS\system32\RCX28.tmp
C:\WINDOWS\system32\RCX36.tmp
C:\WINDOWS\system32\RCX50.tmp
C:\WINDOWS\system32\RCX5B.tmp
C:\WINDOWS\system32\RCXDA.tmp
C:\WINDOWS\system32\twkncnln.dll
C:\WINDOWS\system32\wintfj32.dll
C:\WINDOWS\system32\wowfx.dll
C:\WINDOWS\system32\wumtccyi.dll
C:\WINDOWS\system32\xicjducy.dll
C:\WINDOWS\system32\xlibgfl254.dll

.
((((((((((((((((((((((((( Files Created from 2008-02-21 to 2008-03-21 )))))))))))))))))))))))))))))))
.

2008-03-21 23:34 . 2008-03-21 23:34 d——– C:\WINDOWS\system32\xircom
2008-03-21 23:34 . 2008-03-21 23:34 d——– C:\WINDOWS\srchasst
2008-03-21 23:34 . 2008-03-21 23:34 d——– C:\Program Files\microsoft frontpage
2008-03-21 22:16 . 2008-03-21 22:16 98,709 –a—— C:\Program Files\udefender_setup.exe
2008-03-21 22:04 . 2008-03-21 22:04 16,648 –a—— C:\Program Files\tmp308171.exe
2008-03-21 22:04 . 2008-03-21 22:04 16,632 –a—— C:\Program Files\tmp308140.exe
2008-03-21 22:04 . 2008-03-21 22:04 16,616 –a—— C:\Program Files\tmp308125.exe
2008-03-21 22:04 . 2008-03-21 22:04 16,576 –a—— C:\Program Files\tmp308156.exe
2008-03-21 22:04 . 2008-03-21 22:04 16,564 –a—— C:\Program Files\tmp308203.exe
2008-03-21 22:04 . 2008-03-21 22:04 16,516 –a—— C:\Program Files\tmp307171.exe
2008-03-21 22:04 . 2008-03-21 22:04 16,484 –a—— C:\Program Files\tmp308093.exe
2008-03-21 22:04 . 2008-03-21 22:04 13,560 –a—— C:\Program Files\tmp310421.exe
2008-03-21 22:04 . 2008-03-21 22:04 13,452 –a—— C:\Program Files\tmp310437.exe
2008-03-21 22:04 . 2008-03-21 22:04 13,388 –a—— C:\Program Files\tmp310468.exe
2008-03-21 22:04 . 2008-03-21 22:04 12,288 –a—— C:\Program Files\tmp321156.exe
2008-03-20 06:06 . 2008-03-20 06:06 19,968 –a—— C:\Program Files\tmp149390.exe
2008-03-20 06:06 . 2008-03-20 06:06 19,968 –a—— C:\Program Files\tmp148125.exe
2008-03-20 06:06 . 2008-03-20 06:06 19,968 –a—— C:\Program Files\tmp146562.exe
2008-03-20 05:20 . 2008-03-20 05:20 35,620 –a—— C:\Program Files\2272578.exe
2008-03-20 05:20 . 2008-03-20 05:20 19,968 –a—— C:\Program Files\2281937.exe
2008-03-20 04:57 . 2008-03-21 23:14 1,543,486 —hs—- C:\WINDOWS\system32\salonhry.ini
2008-03-20 03:44 . 2008-03-20 03:44 d——– C:\Program Files\IE Extensions
2008-03-20 03:44 . 2008-03-20 03:44 13,500 –a—— C:\Program Files\1237000.exe
2008-03-20 03:43 . 2008-03-20 03:43 16,476 –a—— C:\Program Files\1224843.exe
2008-03-20 03:27 . 2008-03-20 03:27 17,642,616 –a—— C:\WINDOWS\system32\MRT .exe
2008-03-20 03:26 . 2007-12-04 18:29 551,936 ——— C:\WINDOWS\system32\dllcache\oleaut32.dll
2008-03-20 03:26 . 2007-12-19 22:57 347,136 ——— C:\WINDOWS\system32\dllcache\dxtmsft.dll
2008-03-20 03:26 . 2007-12-18 09:51 179,584 ——— C:\WINDOWS\system32\dllcache\mrxdav.sys
2008-03-20 03:26 . 2008-01-11 05:57 44,544 ——— C:\WINDOWS\system32\dllcache\pngfilt.dll
2008-03-13 23:06 . 2008-03-13 23:06 41,296 –a—— C:\WINDOWS\system32\xfcodec.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-03-21 23:35 ——— d—–w C:\Program Files\Common Files\Symantec Shared
2008-03-21 23:33 ——— d—–w C:\Program Files\QuickTime
2008-03-21 23:33 ——— d—–w C:\Program Files\iTunes
2008-03-21 23:25 ——— d—–w C:\Documents and Settings\Admin\Application Data\Xfire
2008-03-21 23:22 ——— d—–w C:\Documents and Settings\All Users\Application Data\Symantec
2008-03-21 22:06 ——— d—–w C:\Program Files\MSN Messenger
2008-03-21 22:06 ——— d—–w C:\Program Files\LcdStudio
2008-03-21 22:06 ——— d—–w C:\Program Files\DAEMON Tools Lite
2008-03-21 22:03 ——— d—–w C:\Program Files\Steam
2008-03-20 06:03 ——— d—–w C:\Program Files\Xfire
2008-03-20 03:43 ——— d—–w C:\Documents and Settings\Admin\Application Data\uTorrent
2008-01-15 22:37 149,808 —-a-w C:\Program Files\ucleaner_setup .exe
2008-01-09 19:18 22,328 —-a-w C:\Documents and Settings\Admin\Application Data\PnkBstrK.sys
2005-05-14 15:40 150,576 —-a-w C:\Documents and Settings\Admin\Application Data\spyguard.exe
.

—-a-w		   149,808 2008-01-15 22:37:04  C:\Program Files\ucleaner_setup .exe
—-a-w		   115,816 2008-03-21 23:22:40  C:\Program Files\Common Files\Symantec Shared\ccApp .exe
—-a-w		   486,856 2008-03-20 06:05:52  C:\Program Files\DAEMON Tools Lite\daemon .exe
—-a-w		   267,064 2008-03-21 23:22:39  C:\Program Files\iTunes\iTunesHelper .exe
—-a-w		   132,496 2008-03-20 06:04:50  C:\Program Files\Java\jre1.6.0_03\bin\jusched .exe
—-a-w			73,728 2008-03-20 06:04:49  C:\Program Files\LcdStudio\LcdStudio .exe
—-a-w		   497,152 2008-03-20 06:04:25  C:\Program Files\Logitech\G-series Software\LCDMon .exe
—-a-w		 1,122,304 2008-03-20 06:04:25  C:\Program Files\Logitech\G-series Software\LGDCore .exe
—-a-w		 5,674,352 2008-03-20 04:40:45  C:\Program Files\MSN Messenger\MsnMsgr .Exe
—-a-w		   286,720 2008-01-16 22:17:53  C:\Program Files\QuickTime\qttask .exe
—-a-w		 1,266,936 2008-03-20 06:05:52  C:\Program Files\Steam\steam .exe
—-a-w			15,360 2008-03-21 22:03:51  C:\WINDOWS\system32\ctfmon .exe
—-a-w			19,080 2008-01-13 16:16:57  C:\WINDOWS\system32\ctfmona .exe
—-a-w		17,642,616 2008-03-20 03:27:27  C:\WINDOWS\system32\MRT .exe
—-a-w			 9,728 2008-01-15 22:36:57  C:\WINDOWS\system32\spoolvs .exe

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"="RTHDCPL.EXE" [2006-12-19 03:12 16062464 C:\WINDOWS\RTHDCPL.exe]
"SkyTel"="SkyTel.EXE" [2006-05-16 10:04 2879488 C:\WINDOWS\SkyTel.exe]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-09-17 00:07 8491008]
"nwiz"="nwiz.exe" [2007-09-17 00:07 1626112 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-09-17 00:07 81920]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-07-17 16:39 55824 C:\WINDOWS\KHALMNPR.Exe]
"Winupdate Engine"="C:\WINDOWS\system32\wupeng.exe" [ ]
"ctfmona"="C:\WINDOWS\system32\ctfmona.exe" [ ]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [ ]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [ ]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"nltide_3"="advpack.dll" [2007-12-07 02:01 124928 C:\WINDOWS\system32\advpack.dll]
"ShowDeskFix"="regsvr32 /s /n /i:u shell32" []

C:\Documents and Settings\Admin\Start Menu\Programs\Startup\
Xfire.lnk - C:\Program Files\Xfire\xfire.exe [2008-03-13 23:06:18 2979664]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
SetPointII.lnk - C:\Program Files\Logitech\SetPoint II\SetpointII.exe [2007-08-30 17:13:06 319488]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"DisableStatusMessages"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoDesktopCleanupWizard"= 1 (0x1)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoSMHelp"= 1 (0x1)
"NoResolveTrack"= 1 (0x1)
"NoResolveSearch"= 1 (0x1)
"NoSMConfigurePrograms"= 1 (0x1)

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoSMHelp"= 1 (0x1)
"NoResolveTrack"= 1 (0x1)
"NoResolveSearch"= 1 (0x1)
"NoSMConfigurePrograms"= 1 (0x1)

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"SetupBoot"= {441e2826-cef8-4223-8e52-8f594b3928ac} - C:\WINDOWS\Installer\{441e2826-cef8-4223-8e52-8f594b3928ac}\SetupBoot.dll [2008-03-20 03:43 14374]
"CheckSetup"= {c4fed913-dd67-4fb8-9c5e-53280272723f} - C:\WINDOWS\Installer\{c4fed913-dd67-4fb8-9c5e-53280272723f}\CheckSetup.dll [2008-03-20 03:44 19218]
"UnknownChk"= {1e1bf29f-36ef-4918-afa3-80a726cbae10} - C:\WINDOWS\Installer\{1e1bf29f-36ef-4918-afa3-80a726cbae10}\UnknownChk.dll [2008-03-20 03:44 19170]
"RamCheck"= {6f662f1f-5b87-4902-a0d7-bd51e5eea1cf} - C:\WINDOWS\Installer\{6f662f1f-5b87-4902-a0d7-bd51e5eea1cf}\RamCheck.dll [2008-03-20 03:44 19146]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\urqnlmj]
urqnlmj.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll, wowfx.dll

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
"DisableUnicastResponsesToMulticastBroadcast"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\MSN Messenger\\livecall.exe"=
"C:\\Program Files\\uTorrent\\uTorrent.exe"=
"C:\\Program Files\\Electronic Arts\\Crytek\\Crysis\\Bin32\\Crysis.exe"=
"C:\\Program Files\\Electronic Arts\\Crytek\\Crysis\\Bin32\\CrysisDedicatedServer.exe"=
"C:\\WINDOWS\\system32\\PnkBstrA.exe"=
"C:\\WINDOWS\\system32\\PnkBstrB.exe"=
"%windir%\\system32\\winav.exe"=
"C:\\Documents and Settings\\Admin\\Application Data\\spyguard.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=

R1 KS0108;KS0108;C:\Program Files\LcdStudio\ks0108.sys [2006-02-11 22:31]
R1 LC7981;LC7981;C:\Program Files\LcdStudio\LC7981.sys [2006-02-11 22:31]
R1 n3900;n3900;C:\Program Files\LcdStudio\n3900.sys [2006-08-08 14:46]
R1 SED133x;SED133x;C:\Program Files\LcdStudio\SED133x.sys [2006-02-11 22:31]
R1 T6963C;T6963C;C:\Program Files\LcdStudio\T6963c.sys [2006-02-11 22:31]
S1 SysTool;SysTool Overclocking Utility;C:\WINDOWS\system32\DRIVERS\SysTool.sys [2006-11-10 13:08]
S3 ABIT-IO;ABIT-IO;C:\Program Files\U-ABIT\ABITEQ\ABIT-IO.sys [2005-12-08 13:53]
S3 cpuz128;cpuz128;C:\DOCUME~1\Admin\LOCALS~1\Temp\cpuz_x32.sys []

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{79a254c3-99df-11db-91b2-806d6172696f}]
\Shell\AutoRun\command - D:\Autorun.exe root.ini

*Newly Created Service* - COMHOST
.
Contents of the 'Scheduled Tasks' folder
"2007-10-26 15:07:53 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-21 23:35:23
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

PROCESS: C:\WINDOWS\explorer.exe
-> C:\WINDOWS\Installer\{441e2826-cef8-4223-8e52-8f594b3928ac}\SetupBoot.dll
-> C:\WINDOWS\Installer\{c4fed913-dd67-4fb8-9c5e-53280272723f}\CheckSetup.dll
-> C:\WINDOWS\Installer\{1e1bf29f-36ef-4918-afa3-80a726cbae10}\UnknownChk.dll
-> C:\WINDOWS\Installer\{6f662f1f-5b87-4902-a0d7-bd51e5eea1cf}\RamCheck.dll
.
———————— Other Running Processes ————————
.
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\msiexec.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
.
**************************************************************************
.
Completion time: 2008-03-21 23:38:36 - machine was rebooted
ComboFix-quarantined-files.txt 2008-03-21 23:38:33
.
2008-03-21 22:06:43 — E O F —

And the HJT log,

Logfile of HijackThis v1.99.1
Scan saved at 23:41, on 2008-03-21
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.20733)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\msiexec.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Logitech\SetPoint II\SetpointII.exe
C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Xfire\xfire.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.daemon-search.com/startpage

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.5\NppBho.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [Winupdate Engine] C:\WINDOWS\system32\wupeng.exe
O4 - HKLM\..\Run: [ctfmona] C:\WINDOWS\system32\ctfmona.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [ccApp] C:\Program Files\Common Files\Symantec Shared\ccApp.exe
O4 - Startup: Xfire.lnk = C:\Program Files\Xfire\xfire.exe
O4 - Global Startup: SetPointII.lnk = ?
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O11 - Options group: [INTERNATIONAL] International*
O11 - Options group: Tabbed Browsing
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab56907.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: urqnlmj - urqnlmj.dll (file missing)
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\wpdshserviceobj.dll
O21 - SSODL: SetupBoot - {441e2826-cef8-4223-8e52-8f594b3928ac} - C:\WINDOWS\Installer\{441e2826-cef8-4223-8e52-8f594b3928ac}\SetupBoot.dll
O21 - SSODL: CheckSetup - {c4fed913-dd67-4fb8-9c5e-53280272723f} - C:\WINDOWS\Installer\{c4fed913-dd67-4fb8-9c5e-53280272723f}\CheckSetup.dll
O21 - SSODL: UnknownChk - {1e1bf29f-36ef-4918-afa3-80a726cbae10} - C:\WINDOWS\Installer\{1e1bf29f-36ef-4918-afa3-80a726cbae10}\UnknownChk.dll
O21 - SSODL: RamCheck - {6f662f1f-5b87-4902-a0d7-bd51e5eea1cf} - C:\WINDOWS\Installer\{6f662f1f-5b87-4902-a0d7-bd51e5eea1cf}\RamCheck.dll
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: Symantec Settings Manager (ccSetMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: Indexing Service (CiSvc) - Unknown owner - C:\WINDOWS\system32\cisvc.exe (file missing)
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Uninterruptible Power Supply (UPS) - Unknown owner - C:\WINDOWS\System32\ups.exe (file missing)

Trevuren

Post #6March 22, 2008, 1:03 AM UTC

Your system is infected with a Vundo trojan File infector. This infection attempts to rename executable files that run at startup and replace them with infected copies. We will try to reverse the process. Be advised that there is a possibility that you may have to reinstall certain programs where a legitimate replacement file can not be found. Your system is pretty messed up at present but we will give it our best.

A. Please ensure that your security programs are disabled as previously instructed.

B. 1. Please open Notepad

Click Start , then Run
Type notepad .exe in the Run Box.

2. Now copy/paste the entire content of the codebox below into the Notepad window:

KillAll::

File::
C:\Program Files\udefender_setup.exe
C:\Program Files\tmp308171.exe
C:\Program Files\tmp308140.exe
C:\Program Files\tmp308125.exe
C:\Program Files\tmp308156.exe
C:\Program Files\tmp308203.exe
C:\Program Files\tmp307171.exe
C:\Program Files\tmp308093.exe
C:\Program Files\tmp310421.exe
C:\Program Files\tmp310437.exe
C:\Program Files\tmp310468.exe
C:\Program Files\tmp321156.exe
C:\Program Files\tmp149390.exe
C:\Program Files\tmp148125.exe
C:\Program Files\tmp146562.exe
C:\Program Files\2272578.exe
C:\Program Files\2281937.exe
C:\WINDOWS\system32\salonhry.ini
C:\Program Files\1237000.exe
C:\Program Files\1224843.exe
C:\WINDOWS\system32\MRT .exe
C:\Program Files\ucleaner_setup .exe
D:\Autorun.exe root.ini

RenV::
—-a-w		   115,816 2008-03-21 23:22:40  C:\Program Files\Common Files\Symantec Shared\ccApp .exe
—-a-w		   486,856 2008-03-20 06:05:52  C:\Program Files\DAEMON Tools Lite\daemon .exe
—-a-w		   267,064 2008-03-21 23:22:39  C:\Program Files\iTunes\iTunesHelper .exe
—-a-w		   132,496 2008-03-20 06:04:50  C:\Program Files\Java\jre1.6.0_03\bin\jusched .exe
—-a-w			73,728 2008-03-20 06:04:49  C:\Program Files\LcdStudio\LcdStudio .exe
—-a-w		   497,152 2008-03-20 06:04:25  C:\Program Files\Logitech\G-series Software\LCDMon .exe
—-a-w		 1,122,304 2008-03-20 06:04:25  C:\Program Files\Logitech\G-series Software\LGDCore .exe
—-a-w		 5,674,352 2008-03-20 04:40:45  C:\Program Files\MSN Messenger\MsnMsgr .Exe
—-a-w		   286,720 2008-01-16 22:17:53  C:\Program Files\QuickTime\qttask .exe
—-a-w		 1,266,936 2008-03-20 06:05:52  C:\Program Files\Steam\steam .exe
—-a-w			15,360 2008-03-21 22:03:51  C:\WINDOWS\system32\ctfmon .exe
—-a-w		17,642,616 2008-03-20 03:27:27  C:\WINDOWS\system32\MRT .exe
—-a-w			 9,728 2008-01-15 22:36:57  C:\WINDOWS\system32\spoolvs .exe

Driver::
cpuz128

Registry::
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{79a254c3-99df-11db-91b2-806d6172696f}]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\urqnlmj]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll"
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"nltide_3"=-
"ShowDeskFix"=-

Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.

3. Save the above as CFScript.txt

4. Now drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.

5. All your monitoring programs (Antivirus/Antispyware, Guards and Shields) will be stopped.

[external image: Posted Image]

Note:
Do not mouse-click combofix's window while it is running. That may cause it to stall.

6. ComboFix will automatically REBOOT your machine when the KillAll:: switch is used..

7. Post the following logs/Reports:

ComboFix.txt
Fresh HijackThis log run after all the other tools have performed their cleanup.

CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

C. Immediately follow up with the following scan:

Using Internet Explorer, please do a Kaspersky Online Scan

Answer Yes, when prompted to install an ActiveX component.

The program will then begin downloading the latest definition files.
Once the files have been downloaded click on NEXT
Locate the Scan Settings button & configure as follows:
- Scan using the following Anti-Virus database:
  - Extended
- Scan Options:
  - Scan Archives
  - Scan Mail Bases
Click OK & have it scan My Computer
Once the scan is complete, it will provide a report if your system is infected. It does not provide an option to clean/disinfect. We only require a report from it.

[external image: Posted Image]
Click the Save as Text button to save the file to your desktop and post it in your next reply

* Turn off the real time scanner of any existing antivirus program while performing the online scan

Trevuren

Post #7March 29, 2008, 2:41 AM UTC

Due to inactivity this topic will be closed. If you need help please start a new thread and post a new HJT log

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

[Closed] "wowfx.dll" Please help.

✨ Ask AI

Ask AI