What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] Trojan and Malaware Cleancing Help Pls.

17 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Ok, so I was online browsing through 4chan. When I got a some suspisious activity my Symantec scanner started scanning e-mails like crazy; which was odd cause I wasn't sending any. Then my PC rebooted it's self. and continued it's weird activites again. So first thing I did was un plug my network cable so further damage could not be done.

After this was done I ended up running Ad-Aware, followed by Spy-Bot, then… Norton Anti-Virus. Ad-Aware pulled up some registry keys, along with what it labeled as malaware. and Spy-bot pulled up a trojan. where as norton pulled up nothing, which is odd since it's up to date. Any ways long story short. I ran them over and over on start ups and in safe mode, which now…. none of them are pulling up results. So I assume all is well… then about a day later after I come home from work my PC is at it again. Same exact thing. So…… I repeat my previous attempts and now that I'm at the supposed "clear stage." I want to figure out if I am or if I'm missing somethign and what I can do to get rid of it. I do remember Spy-bot pulling up Vitumonde as one of my results… though the rest I'm a bit vauge.

anyways here's my HJT log…. I would greatly apprechiate someone to look it over since it's WAY over my head, and help guide me to having my system secure again…



Logfile of HijackThis v1.99.1
Scan saved at 5:34:44 PM, on 5/13/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\system32\CTHELPER.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Hijackthis\HijackThis.exe
C:\Program Files\Messenger\msmsgs.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.gamespot.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
F2 - REG:system.ini: UserInit=userinit.exe,
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [WINDVDPatch] CTHELPER.EXE
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [Jet Detection] "C:\Program Files\Creative\SBLive\PROGRAM\ADGJDet.exe"
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe (file missing)
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1006.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd…b?1190268845296
O20 - Winlogon Notify: dimsntfy - %SystemRoot%\System32\dimsntfy.dll (file missing)
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation Service (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
Post #2
Hello, and Welcome :)
I will be assisting you with your malware issues.
Please be patient as I need some time to review your Hijackthis log and i will post back recommendations for repairs.
As I am still on training, everything that I post to you, must be checked by an Admin or Moderator. Thus, there may be a tiny bit of a delay between posts, but it shouldn't be too long.
  • Whatever repairs we make, are for fixing your computer problems only and by no means should be used on another computer.
  • Continue to respond to this thread until I give you the All Clean! If you have any question or you're stuck in there please reply it to me. I will try my best to help you!
  • Please bookmark or favourite this page. In case you need it as reference or etc.
Post #4
Sorry about the delay…

Disable Spybot's TeaTimer. This is a two step process.

Spybot S&D's tea timer normally provides real-time protection from spyware, however it may interfere with what we need to do. We will disable it until the machine is clean when it can be re-enabled.

First step:
  • Right-click the Spybot Icon in the System Tray (looks like a blue/white calendar with a padlock symbol)
  • If you have the new version 1.5, Click once on Resident Protection, then Right click the Spybot icon again and make sure Resident Protection is now Unchecked. The Spybot icon in the System tray should now be now colorless.
  • If you have Version 1.4, Click on Exit Spybot S&D Resident
Second step, For Either Version :
  • Open Spybot S&D
  • Click Mode, choose Advanced Mode
  • Go To the bottom of the Vertical Panel on the Left, Click Tools
  • then, also in left panel, click Resident shows a red/white shield.
  • If your firewall raises a question, say OK
  • In the Resident protection status frame, Uncheck the box labeled Resident "Tea-Timer"(Protection of over-all system settings) active
  • OK any prompts.
  • Use File, Exit to terminate Spybot
  • Reboot your machine for the changes to take effect.
Don't forget to re-enable it, when your computer is clean.


Download and Run ComboFix

Please visit this webpage for instructions for downloading ComboFix at your DESKTOP :
http://www.bleepingcomputer.com/combofix/how-to-use-combofix
Please ensure you read this guide carefully and install the Recovery Console first.

Additional links to download the tool:
http://download.bleepingcomputer.com/sUBs/ComboFix.exe
http://www.forospyware.com/sUBs/ComboFix.exe
http://subs.geekstogo.com/ComboFix.exe

Note: The Windows Recovery Console will allow you to boot up into a special recovery (repair) mode. This allows us to more easily help you should your computer have a problem after an attempted removal of malware. It is a simple procedure that will only take a few moments of your time.

Once installed, you should see a blue screen prompt that says:

The Recovery Console was successfully installed.

Please continue as follows:
  • Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
  • Click Yes to allow ComboFix to continue scanning for malware.
  • When the tool is finished, it will produce a report for you.
  • Please post the C:\ComboFix.txt along with a new HijackThis log so we may continue cleaning the system.

Thanks
Post #5
:pullhair: yeah, something is definatly up. Cause it did that weird stuff again. So I followed your instructions… Here's the HJT log first.

Logfile of HijackThis v1.99.1
Scan saved at 10:01:06 PM, on 5/19/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\system32\CTHELPER.EXE
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.gamespot.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [WINDVDPatch] CTHELPER.EXE
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [Jet Detection] "C:\Program Files\Creative\SBLive\PROGRAM\ADGJDet.exe"
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1006.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd…b?1190268845296
O20 - Winlogon Notify: dimsntfy - %SystemRoot%\System32\dimsntfy.dll (file missing)
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation Service (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe



And the comfix log I'll add in a reply. Since I have to do it again cause I didn't get to save the log.
Post #6
Ok, I just ran it again. And here's the logfile from that…. I hope to hear from you soon. This thing is driving me nuts.


ComboFix 08-05-15.2 - Terry 2008-05-19 22:06:20.4 - NTFSx86
Running from: C:\Documents and Settings\[removed]\Desktop\cf2.exe.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((( Files Created from 2008-04-20 to 2008-05-20 )))))))))))))))))))))))))))))))
.

2008-05-19 19:56 . 2008-05-19 20:26 36,447 –a—— C:\WINDOWS\totacon.config
2008-05-19 19:55 . 2008-05-19 19:55 221,184 –a—— C:\WINDOWS\totacon.exe
2008-05-16 04:56 . 2008-05-16 04:58 d——– C:\cf.exe
2008-05-13 15:49 . 2008-05-13 16:00 d——– C:\Documents and Settings\Terry\Application Data\OfficeUpdate12
2008-05-11 11:48 . 2008-05-11 11:49 d——– C:\WINDOWS\system32\scripting
2008-05-11 11:48 . 2008-05-11 11:48 d——– C:\WINDOWS\system32\en
2008-05-11 11:48 . 2008-05-11 11:48 d——– C:\WINDOWS\l2schemas
2008-05-11 11:47 . 2008-05-11 11:47 d——– C:\WINDOWS\system32\bits
2008-05-11 10:21 . 2008-05-11 10:21 d——– C:\WINDOWS\ServicePackFiles
2008-05-11 07:56 . 2008-05-11 07:56 d——– C:\WINDOWS\EHome
2008-05-11 07:46 . 2004-08-03 22:29 701,440 ——— C:\WINDOWS\system32\drivers\ati2mtag.sys
2008-05-11 05:24 . 2008-05-11 05:24 94 –a—— C:\WINDOWS\wininit.ini
2008-05-11 05:07 . 2008-05-11 05:07 269,334 –a—— C:\WINDOWS\system32\ctfmonb.bmp
2008-05-11 05:07 . 2008-05-11 05:07 160,256 –a—— C:\WINDOWS\system32\blackster.scr
2008-05-11 05:07 . 2008-05-11 05:07 103,424 –a—— C:\WINDOWS\system32\win32osf.tmp
2008-05-11 05:07 . 2008-05-11 05:07 3,584 –a—— C:\WINDOWS\system32\win32osf.exe
2008-05-11 05:06 . 2008-05-11 05:06 d——– C:\Documents and Settings\Administrator
2008-05-11 05:06 . 2008-05-19 21:55 1,024 –ah—– C:\Documents and Settings\Administrator\ntuser.dat.LOG
2008-05-11 04:08 . 2008-04-13 13:45 60,032 –a—— C:\WINDOWS\system32\drivers\usbaudio.sys
2008-05-11 04:07 . 2008-04-13 13:45 32,128 –a—— C:\WINDOWS\system32\drivers\usbccgp.sys
2008-05-11 00:41 . 2008-05-11 00:41 d——– C:\Program Files\HOJY TECH
2008-05-10 23:50 . 2008-05-15 01:48 54,156 –ah—– C:\WINDOWS\QTFont.qfn
2008-05-10 23:50 . 2008-05-10 23:50 1,409 –a—— C:\WINDOWS\QTFont.for
2008-04-25 11:34 . 2008-04-25 11:34 d——– C:\Documents and Settings\All Users\Application Data\Apple

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-05-20 02:55 ——— d—–w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-05-19 16:55 ——— d—–w C:\Program Files\Common Files\Symantec Shared
2008-05-18 05:17 ——— d—–w C:\Program Files\Steam
2008-05-13 23:21 ——— d—–w C:\Program Files\World of Warcraft
2008-05-11 10:26 ——— d—–w C:\Program Files\Norton AntiVirus
2008-05-11 05:41 ——— d–h–w C:\Program Files\InstallShield Installation Information
2008-04-28 23:21 ——— d—–w C:\Program Files\DivX
2008-04-25 16:34 ——— d—–w C:\Program Files\Apple Software Update
2008-04-17 00:56 524,288 —-a-w C:\WINDOWS\opuc.dll
2008-04-14 10:42 985,088 —-a-w C:\WINDOWS\system32\setupapi.dll
2008-04-14 10:42 11,264 —-a-w C:\WINDOWS\system32\spnpinst.exe
2008-04-14 10:41 423,936 —-a-w C:\WINDOWS\system32\licdll.dll
2008-04-14 00:25 1,804 —-a-w C:\WINDOWS\system32\dcache.bin
2008-04-14 00:16 329,728 —-a-w C:\WINDOWS\system32\netsetup.exe
2008-04-14 00:13 92,424 —-a-w C:\WINDOWS\system32\rdpdd.dll
2008-04-14 00:13 87,176 —-a-w C:\WINDOWS\system32\rdpwsx.dll
2008-04-14 00:13 40,840 —-a-w C:\WINDOWS\system32\drivers\termdd.sys
2008-04-14 00:13 21,896 —-a-w C:\WINDOWS\system32\drivers\tdtcp.sys
2008-04-14 00:13 139,656 —-a-w C:\WINDOWS\system32\drivers\rdpwd.sys
2008-04-14 00:13 12,168 —-a-w C:\WINDOWS\system32\tsddd.dll
2008-04-14 00:13 12,040 —-a-w C:\WINDOWS\system32\drivers\tdpipe.sys
2008-04-14 00:11 997,376 —-a-w C:\WINDOWS\system32\msgina.dll
2008-04-14 00:10 53,279 —-a-w C:\WINDOWS\system32\odbcji32.dll
2008-04-14 00:10 4,126 —-a-w C:\WINDOWS\system32\msdxmlc.dll
2008-04-14 00:10 3,584 —-a-w C:\WINDOWS\system32\msafd.dll
2008-04-13 21:00 103,424 —-a-w C:\WINDOWS\system32\dpcdll.dll
2008-04-13 19:30 1,845,632 —-a-w C:\WINDOWS\system32\win32k.sys
2008-04-13 19:28 175,744 —-a-w C:\WINDOWS\system32\drivers\rdbss.sys
2008-04-13 19:27 2,188,928 —-a-w C:\WINDOWS\system32\ntoskrnl.exe
2008-04-13 19:21 162,816 —-a-w C:\WINDOWS\system32\drivers\netbt.sys
2008-04-13 19:20 91,520 —-a-w C:\WINDOWS\system32\drivers\ndiswan.sys
2008-04-13 19:20 361,344 —-a-w C:\WINDOWS\system32\drivers\tcpip.sys
2008-04-13 19:20 182,656 —-a-w C:\WINDOWS\system32\drivers\ndis.sys
2008-04-13 19:19 75,264 —-a-w C:\WINDOWS\system32\drivers\ipsec.sys
2008-04-13 19:19 51,328 —-a-w C:\WINDOWS\system32\drivers\rasl2tp.sys
2008-04-13 19:19 48,384 —-a-w C:\WINDOWS\system32\drivers\raspptp.sys
2008-04-13 19:19 146,048 —-a-w C:\WINDOWS\system32\drivers\portcls.sys
2008-04-13 19:19 138,112 —-a-w C:\WINDOWS\system32\drivers\afd.sys
2008-04-13 19:18 52,480 —-a-w C:\WINDOWS\system32\drivers\i8042prt.sys
2008-04-13 19:17 83,072 —-a-w C:\WINDOWS\system32\drivers\wdmaud.sys
2008-04-13 19:17 456,576 —-a-w C:\WINDOWS\system32\drivers\mrxsmb.sys
2008-04-13 19:17 105,344 —-a-w C:\WINDOWS\system32\drivers\mup.sys
2008-04-13 19:16 49,536 —-a-w C:\WINDOWS\system32\drivers\classpnp.sys
2008-04-13 19:16 141,056 —-a-w C:\WINDOWS\system32\drivers\ks.sys
2008-04-13 19:15 64,512 —-a-w C:\WINDOWS\system32\drivers\serial.sys
2008-04-13 19:15 60,800 —-a-w C:\WINDOWS\system32\drivers\sysaudio.sys
2008-04-13 19:15 574,976 —-a-w C:\WINDOWS\system32\drivers\ntfs.sys
2008-04-13 19:15 334,848 —-a-w C:\WINDOWS\system32\drivers\srv.sys
2008-04-13 19:14 63,744 —-a-w C:\WINDOWS\system32\drivers\cdfs.sys
2008-04-13 19:14 143,744 —-a-w C:\WINDOWS\system32\drivers\fastfat.sys
2008-04-13 19:00 30,080 —-a-w C:\WINDOWS\system32\drivers\modem.sys
2008-04-13 19:00 225,664 —-a-w C:\WINDOWS\system32\drivers\tcpip6.sys
2008-04-13 19:00 19,072 —-a-w C:\WINDOWS\system32\drivers\tdi.sys
2008-04-13 18:57 41,472 —-a-w C:\WINDOWS\system32\drivers\raspppoe.sys
2008-04-13 18:57 40,576 —-a-w C:\WINDOWS\system32\drivers\ndproxy.sys
2008-04-13 18:57 34,560 —-a-w C:\WINDOWS\system32\drivers\wanarp.sys
2008-04-13 18:57 20,864 —-a-w C:\WINDOWS\system32\drivers\ipinip.sys
2008-04-13 18:57 152,832 —-a-w C:\WINDOWS\system32\drivers\ipnat.sys
2008-04-13 18:57 14,336 —-a-w C:\WINDOWS\system32\drivers\asyncmac.sys
2008-04-13 18:57 10,112 —-a-w C:\WINDOWS\system32\drivers\ndistapi.sys
2008-04-13 18:56 88,320 —-a-w C:\WINDOWS\system32\drivers\nwlnkipx.sys
2008-04-13 18:56 69,120 —-a-w C:\WINDOWS\system32\drivers\psched.sys
2008-04-13 18:56 35,072 —-a-w C:\WINDOWS\system32\drivers\msgpc.sys
2008-04-13 18:56 34,688 —-a-w C:\WINDOWS\system32\drivers\netbios.sys
2008-04-13 18:56 30,592 —-a-w C:\WINDOWS\system32\drivers\rndismp.sys
2008-04-13 18:56 30,592 ——w C:\WINDOWS\system32\drivers\rndismpx.sys
2008-04-13 18:56 12,800 —-a-w C:\WINDOWS\system32\drivers\usb8023.sys
2008-04-13 18:56 12,800 ——w C:\WINDOWS\system32\drivers\usb8023x.sys
2008-04-13 18:56 12,288 —-a-w C:\WINDOWS\system32\drivers\tunmp.sys
2008-04-13 18:55 202,624 —-a-w C:\WINDOWS\system32\drivers\rmcast.sys
2008-04-13 18:55 14,592 —-a-w C:\WINDOWS\system32\drivers\ndisuio.sys
2008-04-13 18:54 11,264 —-a-w C:\WINDOWS\system32\drivers\irenum.sys
2008-04-13 18:53 71,552 —-a-w C:\WINDOWS\system32\drivers\bridge.sys
2008-04-13 18:53 40,320 —-a-w C:\WINDOWS\system32\drivers\nmnt.sys
2008-04-13 18:53 36,608 —-a-w C:\WINDOWS\system32\drivers\ip6fw.sys
2008-04-13 18:53 264,832 —-a-w C:\WINDOWS\system32\drivers\http.sys
2008-04-13 18:51 61,824 —-a-w C:\WINDOWS\system32\drivers\nic1394.sys
2008-04-13 18:51 60,800 —-a-w C:\WINDOWS\system32\drivers\arp1394.sys
2008-04-13 18:51 59,904 —-a-w C:\WINDOWS\system32\drivers\atmarpc.sys
2008-04-13 18:51 55,808 —-a-w C:\WINDOWS\system32\drivers\atmlane.sys
2008-04-13 18:51 101,120 ——w C:\WINDOWS\system32\drivers\bthpan.sys
2008-04-13 18:45 60,160 —-a-w C:\WINDOWS\system32\drivers\drmk.sys
2008-04-13 18:44 81,664 —-a-w C:\WINDOWS\system32\drivers\videoprt.sys
2008-04-13 18:44 799,744 —-a-w C:\WINDOWS\system32\drivers\dmboot.sys
2008-04-13 18:44 20,992 —-a-w C:\WINDOWS\system32\drivers\vga.sys
2008-04-13 18:44 17,664 —-a-w C:\WINDOWS\system32\watchdog.sys
2008-04-13 18:44 153,344 —-a-w C:\WINDOWS\system32\drivers\dmio.sys
2008-04-13 18:43 14,208 ——w C:\WINDOWS\system32\drivers\wacompen.sys
2008-04-13 18:43 12,672 ——w C:\WINDOWS\system32\drivers\mutohpen.sys
2008-04-13 18:41 52,352 —-a-w C:\WINDOWS\system32\drivers\volsnap.sys
2008-04-13 18:39 7,552 —-a-w C:\WINDOWS\system32\drivers\mskssrv.sys
2008-04-13 18:39 5,504 —-a-w C:\WINDOWS\system32\drivers\mstee.sys
2008-04-13 18:39 5,376 —-a-w C:\WINDOWS\system32\drivers\mspclock.sys
2008-04-13 18:39 42,368 —-a-w C:\WINDOWS\system32\drivers\mountmgr.sys
2008-04-13 18:39 4,992 —-a-w C:\WINDOWS\system32\drivers\mspqm.sys
2008-04-13 18:39 4,352 —-a-w C:\WINDOWS\system32\drivers\swenum.sys
2008-04-13 18:39 384,768 —-a-w C:\WINDOWS\system32\drivers\update.sys
2008-04-13 18:39 24,576 —-a-w C:\WINDOWS\system32\drivers\kbdclass.sys
2008-04-13 18:39 23,040 —-a-w C:\WINDOWS\system32\drivers\mouclass.sys
2008-04-13 18:38 71,168 —-a-w C:\WINDOWS\system32\drivers\dxg.sys
2006-05-03 07:46 32 -csha-w C:\WINDOWS\{05C80C75-64C6-4435-B37F-A969DD3EB668}.dat
2006-05-03 07:46 32 -csha-w C:\WINDOWS\system32\{07929BDE-01F0-40C9-9F93-7A27C1098F63}.dat
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2006-10-18 21:05 204288]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2003-12-02 16:11 54296]
"ccRegVfy"="C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe" [2003-12-02 16:11 58392]
"WINDVDPatch"="CTHELPER.EXE" [2002-07-02 17:56 24576 C:\WINDOWS\system32\CTHELPER.EXE]
"UpdReg"="C:\WINDOWS\UpdReg.EXE" [2000-05-11 01:00 90112]
"Jet Detection"="C:\Program Files\Creative\SBLive\PROGRAM\ADGJDet.exe" [2001-11-29 01:00 28672]
"nwiz"="nwiz.exe" [2007-12-05 02:41 1626112 C:\WINDOWS\system32\nwiz.exe]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-12-05 02:41 8523776]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-12-05 02:41 81920]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 23:16 39792]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"ALUAlert"="C:\Program Files\Symantec\LiveUpdate\ALUNotify.exe" [2002-08-07 09:04 54936]
"totacon"="C:\WINDOWS\totacon.exe" [2008-05-19 19:55 221184]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AIM]
–a–c— 2006-08-01 15:35 67112 C:\PROGRA~1\AIM\aim.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Jet Detection]
–a—— 2001-11-29 01:00 28672 C:\Program Files\Creative\SBLive\PROGRAM\ADGJDet.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
C:\WINDOWS\system32\dumprep 0 -k

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
–a–c— 2001-07-09 11:50 155648 C:\WINDOWS\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
–a—— 2007-12-05 02:41 8523776 C:\WINDOWS\system32\NvCpl.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
–a—— 2007-12-05 02:41 81920 C:\WINDOWS\system32\NvMcTray.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
–a—— 2007-12-05 02:41 1626112 C:\WINDOWS\system32\nwiz.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
C:\Program Files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]
-rahs—- 2008-01-28 12:43 2097488 C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
–a–c— 2005-11-10 13:03 36975 C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Symantec NetDriver Monitor]
–a–c— 2006-05-03 03:00 100056 C:\PROGRA~1\SYMNET~1\SNDMon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdReg]
——— 2000-05-11 01:00 90112 C:\WINDOWS\UpdReg.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WINDVDPatch]
–a—— 2002-07-02 17:56 24576 C:\WINDOWS\system32\CTHELPER.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
C:\Program Files\Yahoo!\Messenger\ypager.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"aawservice"=2 (0x2)

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\LimeWire\\LimeWire.exe"=
"C:\\Program Files\\AIM\\aim.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"C:\\Program Files\\Steam\\Steam.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"C:\\Program Files\\Steam\\SteamApps\\[removed]\\team fortress 2\\hl2.exe"=
"C:\\Program Files\\Steam\\SteamApps\\[removed]\\source sdk base\\hl2.exe"=
"C:\\WINDOWS\\totacon.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3724:TCP"= 3724:TCP:Blizzard Downloader: 3724

R0 uliagpkx;ULi AGP Bus Filter Driver;C:\WINDOWS\system32\DRIVERS\agpkx.sys [2004-07-08 16:58]
R3 ULI5261;ULi Based Ethernet NT Driver;C:\WINDOWS\system32\DRIVERS\ULILAN.SYS [2004-07-26 22:19]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager\subsystems]
"Windows"= basevktgo32.dll

*Newly Created Service* - CATCHME
.
Contents of the 'Scheduled Tasks' folder
"2008-05-20 02:00:58 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2006-05-13 01:15:28 C:\WINDOWS\Tasks\Norton AntiVirus - Scan my computer.job"
- C:\PROGRA~1\NORTON~1\NAVW32.exeG/task:C:\DOCUME~1\ALLUSE~1\APPLIC~1\Symantec\NORTON~1\Tasks\mycomp.sca
"2008-05-20 00:55:14 C:\WINDOWS\Tasks\Symantec NetDetect.job"
- C:\Program Files\Symantec\LiveUpdate\NDETECT.EXE
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-05-19 22:07:02
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

PROCESS: C:\WINDOWS\system32\csrss.exe
-> C:\WINDOWS\system32\basevktgo32.dll
.
Completion time: 2008-05-19 22:07:56
ComboFix-quarantined-files.txt 2008-05-20 03:07:35
ComboFix2.txt 2008-05-20 02:58:57
ComboFix3.txt 2008-05-16 09:58:41
ComboFix4.txt 2008-05-16 08:24:26

Pre-Run: 89,649,111,040 bytes free
Post-Run: 89,637,183,488 bytes free

246 — E O F — 2008-05-17 04:33:23

:pullhair:
Post #7
RECOVERY CONSOLE

Go to Microsoft's website => http://support.microsoft.com/kb/310994

Select the download that's appropriate for your Operating System

[external image: Posted Image]

Download the file & save it as it's originally named, next to ComboFix.exe.

[external image: Posted Image]

Now close all open windows and programs, including all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

  • Drag the setup package onto ComboFix.exe and drop it.
  • Follow the prompts to start ComboFix and when prompted, agree to the End-User License Agreement to install the Microsoft Recovery Console.
  • At the next prompt, click 'No' to exit ComboFix.


Upload a File to Jotti
Please visit http://virusscan.jotti.org/
Click on Browse… and navigate to the following file: C:\WINDOWS\system32\basevktgo32.dll
Click Open
Please let me know the results.

Please also repeat that with the following files…
C:\WINDOWS\system32\ctfmonb.bmp
C:\WINDOWS\QTFont.qfn
C:\WINDOWS\QTFont.for
C:\WINDOWS\system32\{07929BDE-01F0-40C9-9F93-7A27C1098F63}.dat
C:\WINDOWS\{05C80C75-64C6-4435-B37F-A969DD3EB668}.dat


COMBOFIX-Script

  • Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the code box below: 

    File:: 
C:\WINDOWS\totacon.exe
C:\WINDOWS\totacon.config
C:\WINDOWS\system32\blackster.scr
C:\WINDOWS\system32\win32osf.tmp
C:\WINDOWS\system32\win32osf.exe

Registry::
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"totacon"=-
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager\subsystems]
"Windows"=-

DirLook::
C:\cf.exe
  • Save this as CFScript.txt and change the "Save as type" to "All Files" and place it on your desktop.

    [external image: Posted Image]
  • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
  • Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
  • ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
  • When finished, it shall produce a log for you. Copy and paste the contents of the log in your next reply.
CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.

So please post back:
Combofix results
Jotti results
Post #10
Ok, so I did what you said, and I had ot change one small part of the past code you had to CF3.exe because taht was the name of my CF file… and when it went to restart my machine. It straight up bricked my tower. So now it runs through it ususal boot screens. but when it gets to the XP loading screen my PC flashes a blue screen for a second that it's impossible to read the text on cause it's so fast of a flash, and basically it start the reboot process all over again in a never ending cycle. So now I can't acess my machine. :-( I have no clue what to do… I think I might try to run my Windows CD and do a repair. Perhaps it wil let me at least acess the machine then. :smack:
Post #11
Hi, What exactly and why did you change my instructions? You most likely will have to re-install the operating system. Do you have the windows cd? Thanks.
Post #12
the only thing I changed was in the alst part of code where it said CF.exe I changed to CF3.exe to match the name of what had the combofix file named. Anyways. I ended up doing a repair install of Windows. and I got my PC up and running at the moment. My Spybot, Norton, are coming clean. I have to reinstall Ad-Aware 2007 still. Though when I try to install. Windows XP SP3. It's telling me it failed to Install Microsoft Windows Installer 3.1 or whatever… :pullhair: But So far system seems clean besides that. Now If I could just be sure it was clean, along with getting my Windows Update to work properly. I ended up Deleting Combofix from my PC along with the other files you had me make just to be on the safe side so it didn't happen again. So, what do you think should be next?
Post #13
Please post a new Hijackthis log and an uninstall list…

uninstall list

Make an uninstall list using HijackThis
To access the Uninstall Manager you would do the following:

1. Start HijackThis
2. Click on the Config button
3. Click on the Misc Tools button
4. Click on the Open Uninstall Manager button.
5. Click on the Save list… button and specify where you would like to save this file. When you press Save button a notepad will open with the contents of that file. Simply copy and paste the contents of that notepad here on your next reply.

If you need to re-install Hijackthis then here are the instructions…

Download and Run HijackThis
Download HJTInstall.exe to your Desktop.
  • Doubleclick HJTInstall.exe to install it.
  • By default it will install to C:\Program Files\Trend Micro\HijackThis .
  • Click on Install.
  • It will create a HijackThis icon on the desktop.
  • Once installed, it will launch Hijackthis.
  • Click on the Do a system scan and save a logfile button. It will scan and the log should open in notepad.
  • Copy/Paste the log to your next reply please.
Don't use the Analyse This button, its findings are dangerous if misinterpreted.
Don't have Hijackthis fix anything yet. Most of what it finds will be harmless or even required.

So please post the uninstall list and a fresh HJT log and we'll take it from there. Hows the computer running? Back to normal?
Post #15
Ok, first I did a repair install. I have a lot of files that I don't want to loose so reformatting is out of the question. Unless I like purchase a large external. :-\

another thing is aparently I'm back in old IE because of the repair install. and my windows clock is in Military time??? I can't find where to change it.

here's the HTJ log:

Logfile of HijackThis v1.99.1
Scan saved at 16:12, on 2008-05-24
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\system32\CTHELPER.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\devldr32.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.gamespot.com/
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [WINDVDPatch] CTHELPER.EXE
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [Jet Detection] "C:\Program Files\Creative\SBLive\PROGRAM\ADGJDet.exe"
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [IMEKRMIG6.1] C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1006.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd…b?1190268845296
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation Service (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

and here's the uninstall one:

Adobe Anchor Service CS3
Adobe Asset Services CS3
Adobe Bridge CS3
Adobe Bridge Start Meeting
Adobe Camera Raw 4.0
Adobe CMaps
Adobe Color - Photoshop Specific
Adobe Color Common Settings
Adobe Color Common Settings
Adobe Color EU Extra Settings
Adobe Color JA Extra Settings
Adobe Color NA Recommended Settings
Adobe Default Language CS3
Adobe Device Central CS3
Adobe ExtendScript Toolkit 2
Adobe ExtendScript Toolkit 2
Adobe Flash Player ActiveX
Adobe Fonts All
Adobe Help Viewer CS3
Adobe Linguistics CS3
Adobe PDF Library Files
Adobe Photoshop CS3
Adobe Photoshop CS3
Adobe Reader 8.1.2
Adobe Setup
Adobe Setup
Adobe Setup
Adobe Stock Photos CS3
Adobe Type Support
Adobe Update Manager CS3
Adobe Version Cue CS3 Client
Adobe WinSoft Linguistics Plugin
Adobe XMP Panels CS3
AOL Instant Messenger
Apple Software Update
Athlon 64 Processor Driver
Calculator Powertoy for Windows XP
CCleaner (remove only)
DivX Codec
DivX Web Player
DVD Shrink 3.1.5
Easy CD Ripper 2.10
Hijackthis 1.99.1
HijackThis 1.99.1
Image Resizer Powertoy for Windows XP
J2SE Runtime Environment 5.0 Update 3
J2SE Runtime Environment 5.0 Update 6
LimeWire 4.16.6
LiveReg (Symantec Corporation)
LiveUpdate 1.80 (Symantec Corporation)
Macromedia Shockwave Player
Match-Up!
Microsoft Office 2000 SR-1 Professional
Microsoft Plus! for Windows XP
Microsoft Visual C++ 2005 Redistributable
Movie Maker Background Music Files
Movie Maker Sound Effects
Movie Maker Title Images
MPEG Suite 2001
Music Utilities
Nero OEM
Next Generation Visualisations
Norton AntiVirus 2003
Norton WMI Update
NVIDIA Drivers
PDF Settings
Peggle Extreme
Photo Viewer
PowerDVD
QuickTime
Sound Blaster Live! Web 2K/XP
Source SDK Base
Spybot - Search & Destroy
Spybot - Search & Destroy 1.5.2.20
Steam
Team Fortress 2
ULi AGP Driver 2.20
ULi LAN Driver
Ventrilo Client
Windows Media Bonus Pack for Windows XP
Windows Media Format 11 runtime
Windows Media Format Runtime
Windows Media Player 10
Windows Media Player 11
Windows Media Player Skin Importer
Windows Media Player Tray Control
WinRAR archiver
World of Warcraft
Yahoo! Install Manager
Yahoo! Messenger

there you go.

The PC is running ok so far. Minus the not being able to do the windows update thing correctly, and the military time clock. but the thing about this infection I've had is that it seems fine then a a few days later it's going nuts. like it hides it self, and none of my scanners will pick it up. You asked me to do some scans of some files on the vscan site here's those results

The C:\WINDOWS\system32\basevktgo32.dll one…

Scan taken on 22 May 2008 00:31:14 (GMT) A-Squared
Found nothing AntiVir
Found TR/Agent.AGKK.40 ArcaVir
Found nothing Avast
Found nothing AVG Antivirus
Found Generic10.YAX BitDefender
Found Trojan.Agent.AGKK ClamAV
Found Trojan.Subsys-1 CPsecure
Found Troj.W32.Agent.ehk Dr.Web
Found Trojan.Okuks.based F-Prot Antivirus
Found nothing F-Secure Anti-Virus
Found Trojan.Win32.SubSys.do Fortinet
Found nothing Ikarus
Found Trojan.Agent.AGKK Kaspersky Anti-Virus
Found Trojan.Win32.SubSys.do NOD32
Found nothing Norman Virus Control
Found nothing Panda Antivirus
Found nothing Sophos Antivirus
Found Troj/Agent-GXR VirusBuster
Found nothing VBA32
Found nothing

the C:\WINDOWS\system32\ctfmonb.bmp one.

Scan taken on 22 May 2008 00:21:12 (GMT) A-Squared
Found nothing AntiVir
Found nothing ArcaVir
Found nothing Avast
Found nothing AVG Antivirus
Found nothing BitDefender
Found nothing ClamAV
Found nothing CPsecure
Found nothing Dr.Web
Found nothing F-Prot Antivirus
Found nothing F-Secure Anti-Virus
Found nothing Fortinet
Found nothing Ikarus
Found nothing Kaspersky Anti-Virus
Found nothing NOD32
Found Win32/TrojanDownloader.FakeAlert.BU Norman Virus Control
Found nothing Panda Antivirus
Found nothing Sophos Antivirus
Found nothing VirusBuster
Found nothing VBA32
Found nothing

the C:\WINDOWS\QTFont.for
one.

Scan taken on 22 May 2008 00:24:28 (GMT) A-Squared
Found nothing AntiVir
Found nothing ArcaVir
Found nothing Avast
Found nothing AVG Antivirus
Found nothing BitDefender
Found nothing ClamAV
Found nothing CPsecure
Found nothing Dr.Web
Found nothing F-Prot Antivirus
Found nothing F-Secure Anti-Virus
Found nothing Fortinet
Found nothing Ikarus
Found nothing Kaspersky Anti-Virus
Found nothing NOD32
Found nothing Norman Virus Control
Found nothing Panda Antivirus
Found nothing Sophos Antivirus
Found nothing VirusBuster
Found nothing VBA32
Found nothing

I couldn't find the other files you wanted me to scan with it. as for now though when I look for those files…

the base one is gone.
ctfmon is there but the scan now shows it clean.
the QTfont.for is clean as well
the other files are not found when I look for them in those dir.

and that's basically a complete update there.

I'm ready for what's next.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI