What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Closed] Help, please!

3 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Hello,

I am having a problem with my computer and the internet.
I am getting 'popups' and also being unable to connect to a lot of pages.

I have performed an HiJack this scan and enclose my results:-

Here is my HiJack this log.

Logfile of HijackThis v1.99.1
Scan saved at 19:40:29, on 21/06/2008
Platform: Unknown Windows (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16681)

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\System32\mobsync.exe
C:\Windows\SOUNDMAN.EXE
C:\Program Files\ESET\nod32kui.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Windows\system32\rundll32.exe
C:\Windows\system32\rundll32.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\system32\rundll32.exe
C:\Windows\system32\rundll32.exe
C:\Windows\system32\rundll32.exe
C:\Windows\Explorer.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\Peter\Desktop\hijackthis_sfx\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.co.uk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe"
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
O4 - HKLM\..\Run: [MSServer] rundll32.exe C:\Windows\system32\khfETnol.dll,#1
O4 - HKLM\..\Run: [BM33a34432] Rundll32.exe "C:\Windows\system32\rrtrstso.dll",s
O4 - HKLM\..\Run: [309077ae] rundll32.exe "C:\Windows\system32\yugprcfk.dll",b
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O10 - Unknown file in Winsock LSP: c:\windows\system32\nlaapi.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\napinsp.dll
O11 - Options group: [INTERNATIONAL] International*
O13 - Gopher Prefix:
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://sdlc-esd.sun.com/ESD42/JSCDL/jre/6u…ows-i586-jc.cab
O16 - DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} (Java Plug-in 1.6.0_05) -
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\Windows\system32\IoctlSvc.exe
O23 - Service: @%SystemRoot%\system32\qwave.dll,-1 (QWAVE) - Unknown owner - %windir%\system32\svchost.exe (file missing)
O23 - Service: @%SystemRoot%\system32\seclogon.dll,-7001 (seclogon) - Unknown owner - %windir%\system32\svchost.exe (file missing)
O23 - Service: @%ProgramFiles%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - %ProgramFiles%\Windows Media Player\wmpnetwk.exe (file missing)

Could you please help out with this problem??

I look forward to hearing from you.

Thanx

Slider
Post #2
Hi

Rename HijackThis
There is a possibility an infection which is hiding part of the HijackThis log because it's called hijackthis.exe.
Using Windows Explore by right-clicking the Start button and left clicking Explore navigate to: C:\Users\Peter\Desktop\hijackthis_sfx\HijackThis.exe

Right-click on HijackThis.exe & select Rename to iseeu.exe and post back a new Hijackthis log.


Please make a uninstall list using HijackThis
To access the Uninstall Manager you would do the following:

1. Start HijackThis
2. Click on the Config button
3. Click on the Misc Tools button
4. Click on the Open Uninstall Manager button.
5. Click on the Save list… button and specify where you would like to save this file. When you press Save button a notepad will open with the contents of that file. Simply copy and paste the contents of that notepad here in a reply.
Post #3
Hello,

Thanx for getting in touch.

I have renamed Hijack this and re ran it.

here is the new log:-

Logfile of HijackThis v1.99.1
Scan saved at 17:45:03, on 23/06/2008
Platform: Unknown Windows (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16681)

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\SOUNDMAN.EXE
C:\Program Files\ESET\nod32kui.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Windows\system32\rundll32.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\rundll32.exe
C:\Windows\system32\rundll32.exe
C:\Users\Peter\Desktop\isssue\issue.exe.exe
C:\Windows\System32\notepad.exe
C:\Windows\system32\DllHost.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.co.uk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: {fba7a657-b00e-382a-9d84-011fa2d3de62} - {26ed3d2a-f110-48d9-a283-e00b756a7abf} - C:\Windows\system32\ypiyiyud.dll
O2 - BHO: (no name) - {BE7E4CE1-8CBA-44A6-956F-462A667D3286} - C:\Windows\system32\khfETnol.dll (file missing)
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
O4 - HKLM\..\Run: [309077ae] rundll32.exe "C:\Windows\system32\cmbvfiop.dll",b
O4 - HKLM\..\Run: [BM33a34432] Rundll32.exe "C:\Windows\system32\cdlpmqdh.dll",s
O4 - HKCU\..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O10 - Unknown file in Winsock LSP: c:\windows\system32\nlaapi.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\napinsp.dll
O11 - Options group: [INTERNATIONAL] International*
O13 - Gopher Prefix:
O16 - DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} -
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\Windows\system32\IoctlSvc.exe
O23 - Service: @%SystemRoot%\system32\qwave.dll,-1 (QWAVE) - Unknown owner - %windir%\system32\svchost.exe (file missing)
O23 - Service: @%SystemRoot%\system32\seclogon.dll,-7001 (seclogon) - Unknown owner - %windir%\system32\svchost.exe (file missing)
O23 - Service: @%ProgramFiles%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - %ProgramFiles%\Windows Media Player\wmpnetwk.exe (file missing)



Also here is the Uninstall log you requested.

Adobe Flash Player ActiveX
Adobe Reader 8.1.2
Catalyst Control Center - Branding
CCleaner (remove only)
D-Link PCI Fast Ethernet Adapter
HijackThis 1.99.1
K-Lite Codec Pack 3.8.0 Full
Microsoft .NET Framework 3.5
Microsoft .NET Framework 3.5
Microsoft Office Professional Edition 2003
Microsoft Visual C++ 2005 Redistributable
MSXML 4.0 SP2 (KB936181)
MSXML 4.0 SP2 (KB941833)
Nero 8
neroxml
NOD32 antivirus system
NOD32 FiX
RealPlayer
Realtek AC'97 Audio
Sims 2 Desktop Theme
SimsWeather (remove only)
Sony Ericsson PC Suite 3.207.00
The Sims 2
The Sims 2 Glamour Life Stuff
The Sims 2 HomeCrafter Plus
The Sims 2 Nightlife
The Sims 2 Open For Business
The Sims 2 Pets
The Sims 2 University
The Sims™ 2 Bon Voyage
The Sims™ 2 H&M® Fashion Stuff
The Sims™ 2 Kitchen & Bath Interior Design Stuff
The Sims™ 2 Seasons
The Sims™ 2 Teen Style Stuff
VCRedistSetup
WinRAR archiver


I hope to hear from you soon.

Thanx

Slider_
Post #4
Hi

If you already have Combofix, please delete this copy and download it again as it's being updated regularly.

Please visit this webpage for download links, and instructions for running the tool:

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

Please ensure you read this guide carefully and install the Recovery Console first.

The Windows Recovery Console will allow you to boot up into a special recovery (repair) mode. This allows us to more easily help you should your computer have a problem after an attempted removal of malware. It is a simple procedure that will only take a few moments of your time.

Once Recovery Console is installed, you should see a blue screen prompt like the one below:

[external image: Posted Image]

Click Yes to allow Combofix to continue scanning for malware.

When done, a log will be produced. Please post that log and a new HijackThis log in your next reply.


1.Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
3. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you – please tell your helper.
4. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.



In your next reply post:
ComboFix.txt
New HijackThis log taken after the above scan has run
Post #5
Hi,

Downloaded and ran combofix.

Output file :-

ComboFix 08-06-20.4 - Peter 2008-06-23 19:41:06.7 - NTFSx86
Microsoft® Windows Vista™ Business 6.0.6000.0.1252.1.1033.18.472 [GMT 1:00]
Running from: C:\Users\[removed]\Desktop\ComboFix.exe
* Resident AV is active

.

((((((((((((((((((((((((( Files Created from 2008-05-23 to 2008-06-23 )))))))))))))))))))))))))))))))
.

No new files created in this timespan

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-22 08:04 99,328 —-a-w C:\Windows\System32\ypiyiyud.dll
2008-06-22 08:04 81,408 —-a-w C:\Windows\System32\cmbvfiop.dll
2008-06-22 08:01 90,112 —-a-w C:\Windows\System32\cdlpmqdh.dll
2008-06-21 18:37 81,408 —-a-w C:\Windows\System32\yugprcfk.dll
2008-06-21 18:35 99,328 —-a-w C:\Windows\System32\bqlotecx.dll
2008-06-21 18:35 90,112 —-a-w C:\Windows\System32\rrtrstso.dll
2008-06-21 18:27 ——— d—–w C:\Users\Peter\AppData\Roaming\uTorrent
2008-06-21 18:08 642,560 —-a-w C:\Windows\system32\drivers\sptd.sys
2008-06-21 18:08 140,392 —-a-w C:\Windows\system32\drivers\sptd5213.sys
2008-06-12 16:13 ——— d—–w C:\Users\Sue\AppData\Roaming\U3
2008-06-11 16:17 ——— d—–w C:\Program Files\Windows Mail
2008-06-08 10:01 ——— d—–w C:\Users\Sue\AppData\Roaming\ATI
2008-06-07 21:14 ——— d—–w C:\Users\Peter\AppData\Roaming\ATI
2008-06-07 21:14 ——— d—–w C:\ProgramData\ATI
2008-06-07 21:09 ——— d—–w C:\Program Files\ATI Technologies
2008-06-07 21:03 ——— d—–w C:\Program Files\ATI
2008-06-07 15:36 ——— d—–w C:\Program Files\EA GAMES
2008-06-03 08:03 ——— d—–w C:\Program Files\Sims Weather
2008-06-03 08:02 710,938 —-a-w C:\Windows\unins000.exe
2008-06-01 08:57 ——— d—–w C:\Users\Peter\AppData\Roaming\Media Player Classic
2008-05-29 17:29 ——— d—–w C:\ProgramData\Spybot - Search & Destroy
2008-05-29 14:01 107,888 —-a-w C:\Windows\System32\CmdLineExt.dll
2008-05-28 17:00 ——— d—–w C:\Users\Peter\AppData\Roaming\Malwarebytes
2008-05-25 13:30 ——— d—–w C:\Program Files\ESET
2008-05-12 16:30 3,592,704 —-a-w C:\Windows\system32\drivers\atikmdag.sys
2008-05-12 15:56 397,312 —-a-w C:\Windows\System32\ATIDEMGX.dll
2008-05-12 15:55 43,520 —-a-w C:\Windows\System32\ati2edxx.dll
2008-05-12 15:55 327,680 —-a-w C:\Windows\System32\atipdlxx.dll
2008-05-12 15:55 266,240 —-a-w C:\Windows\System32\Ati2evxx.dll
2008-05-12 15:55 262,144 —-a-w C:\Windows\System32\Oemdspif.dll
2008-05-12 15:55 159,744 —-a-w C:\Windows\System32\atitmmxx.dll
2008-05-12 15:53 675,840 —-a-w C:\Windows\System32\Ati2evxx.exe
2008-05-12 15:40 3,101,184 —-a-w C:\Windows\System32\atiumdag.dll
2008-05-12 15:26 9,994,240 —-a-w C:\Windows\System32\atioglxx.dll
2008-05-12 15:23 4,291,584 —-a-w C:\Windows\System32\atiumdva.dll
2008-05-12 15:11 48,640 —-a-w C:\Windows\System32\amdpcom32.dll
2008-05-12 15:11 19,968 —-a-w C:\Windows\System32\atiadlxx.dll
2008-05-12 14:56 49,152 —-a-w C:\Windows\system32\drivers\ati2erec.dll
2008-05-10 03:30 14,848 —-a-w C:\Windows\System32\wshrm.dll
2008-05-10 01:21 113,664 —-a-w C:\Windows\system32\drivers\rmcast.sys
2008-05-06 16:43 ——— d–h–w C:\Program Files\InstallShield Installation Information
2008-05-06 16:43 ——— d—–w C:\Users\Peter\AppData\Roaming\InstallShield
2008-05-06 16:43 ——— d—–w C:\ProgramData\Sony Ericsson
2008-05-06 16:43 ——— d—–w C:\Program Files\Sony Ericsson
2008-05-06 13:48 ——— d—–w C:\Users\Peter\AppData\Roaming\NewsBin
2008-05-05 17:03 1,212 —-a-w C:\IP.bat
2008-05-05 16:41 ——— d—–w C:\Users\Peter\AppData\Roaming\U3
2008-04-29 21:09 ——— d—–w C:\Users\Sue\AppData\Roaming\uTorrent
2008-04-27 13:42 ——— d—–w C:\Program Files\MSXML 4.0
2008-04-26 17:55 ——— d—–w C:\Users\Sue\AppData\Roaming\Nero
2008-04-26 08:02 1,327,104 —-a-w C:\Windows\System32\quartz.dll
2008-04-25 21:49 ——— d—–w C:\Program Files\NeroInstall.bak
2008-04-25 21:33 ——— d—–w C:\Users\Peter\AppData\Roaming\Nero
2008-04-25 21:30 ——— d—–w C:\Program Files\Common Files\Nero
2008-04-25 21:28 ——— d—–w C:\ProgramData\Nero
2008-04-25 21:28 ——— d—–w C:\Program Files\Nero
2008-04-25 04:23 826,368 —-a-w C:\Windows\System32\wininet.dll
2008-04-25 04:23 56,320 —-a-w C:\Windows\System32\iesetup.dll
2008-04-25 04:23 52,736 —-a-w C:\Windows\AppPatch\iebrshim.dll
2008-04-25 04:22 26,624 —-a-w C:\Windows\System32\ieUnatt.exe
2008-04-23 08:15 ——— d—–w C:\Program Files\Common Files\xing shared
2008-04-23 08:15 ——— d—–w C:\Program Files\Common Files\Real
2008-04-23 08:14 ——— d—–w C:\Program Files\Real
2008-04-19 22:00 298,104 —-a-w C:\Windows\System32\imon.dll
2008-04-19 20:22 174 –sha-w C:\Program Files\desktop.ini
2008-04-19 20:00 87,040 —-a-w C:\Windows\System32\msoert2.dll
2008-04-19 20:00 39,424 —-a-w C:\Windows\System32\ACCTRES.dll
2008-04-19 20:00 205,824 —-a-w C:\Windows\System32\msoeacct.dll
2008-04-19 19:58 704,000 —-a-w C:\Windows\System32\PhotoScreensaver.scr
2008-04-19 19:58 67,584 —-a-w C:\Windows\System32\wlanhlp.dll
2008-04-19 19:58 542,720 —-a-w C:\Windows\System32\sysmain.dll
2008-04-19 19:58 502,784 —-a-w C:\Windows\System32\wlansvc.dll
2008-04-19 19:58 47,104 —-a-w C:\Windows\System32\wlanapi.dll
2008-04-19 19:58 297,984 —-a-w C:\Windows\System32\wlansec.dll
2008-04-19 19:58 290,816 —-a-w C:\Windows\System32\wlanmsm.dll
2008-04-19 19:58 24,064 —-a-w C:\Windows\System32\wtsapi32.dll
2008-04-19 19:58 2,923,520 —-a-w C:\Windows\explorer.exe
2008-04-19 19:57 194,560 —-a-w C:\Windows\System32\WebClnt.dll
2008-04-19 19:53 49,664 —-a-w C:\Windows\System32\csrsrv.dll
2008-04-19 19:53 376,320 —-a-w C:\Windows\System32\winsrv.dll
2008-04-19 19:49 374,456 —-a-w C:\Windows\System32\mcupdate_GenuineIntel.dll
2008-04-19 19:48 414,208 —-a-w C:\Windows\System32\msscp.dll
2008-04-19 19:47 8,147,968 —-a-w C:\Windows\System32\wmploc.DLL
2008-04-19 19:47 7,680 —-a-w C:\Windows\System32\spwmp.dll
2008-04-19 19:47 4,096 —-a-w C:\Windows\System32\dxmasf.dll
2008-04-19 19:47 356,864 —-a-w C:\Windows\System32\MediaMetadataHandler.dll
2008-04-19 19:46 86,016 —-a-w C:\Windows\System32\icfupgd.dll
2008-04-19 19:46 61,952 —-a-w C:\Windows\System32\cmifw.dll
2008-04-19 19:46 396,800 —-a-w C:\Windows\System32\MPSSVC.dll
2008-04-19 19:46 392,192 —-a-w C:\Windows\System32\FirewallAPI.dll
2008-04-19 19:46 178,688 —-a-w C:\Windows\System32\iphlpsvc.dll
2008-04-19 19:46 16,896 —-a-w C:\Windows\System32\wfapigp.dll
2008-04-19 19:44 3,504,696 —-a-w C:\Windows\System32\ntkrnlpa.exe
2008-04-19 19:44 3,470,392 —-a-w C:\Windows\System32\ntoskrnl.exe
2008-04-19 19:43 104,448 —-a-w C:\Windows\System32\DWWIN.EXE
2008-04-19 19:42 2,048 —-a-w C:\Windows\System32\msxml3r.dll
2008-04-19 19:42 1,191,936 —-a-w C:\Windows\System32\msxml3.dll
2008-04-19 19:41 8,704 —-a-w C:\Windows\System32\hcrstco.dll
2008-04-19 19:41 8,704 —-a-w C:\Windows\System32\hccoin.dll
2008-04-19 19:41 229,888 —-a-w C:\Windows\System32\msshsq.dll
.

((((((((((((((((((((((((((((( snapshot@2008-06-22_ 9.23.39.36 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-06-22 08:19:29 67,584 –s-a-w C:\Windows\bootstat.dat
+ 2008-06-23 18:21:10 67,584 –s-a-w C:\Windows\bootstat.dat
+ 2008-06-23 18:21:11 2,048 –sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2008-06-23 18:21:11 2,048 –sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
- 2008-06-22 08:20:05 262,144 –sha-w C:\Windows\ServiceProfiles\LocalService\NTUSER.DAT
+ 2008-06-23 18:30:40 262,144 –sha-w C:\Windows\ServiceProfiles\LocalService\NTUSER.DAT
+ 2008-06-23 18:30:40 262,144 —ha-w C:\Windows\ServiceProfiles\LocalService\ntuser.dat.LOG1
- 2008-06-22 08:20:05 262,144 –sha-w C:\Windows\ServiceProfiles\NetworkService\NTUSER.DAT
+ 2008-06-23 18:31:14 262,144 –sha-w C:\Windows\ServiceProfiles\NetworkService\NTUSER.DAT
+ 2008-06-23 18:31:14 262,144 —ha-w C:\Windows\ServiceProfiles\NetworkService\ntuser.dat.LOG1
- 2008-06-22 08:10:20 16,384 –sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2008-06-22 16:30:47 16,384 –sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2008-06-22 08:10:20 32,768 –sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2008-06-22 16:30:47 32,768 –sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2008-06-22 08:10:20 16,384 –sha-w C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2008-06-22 16:30:47 16,384 –sha-w C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2008-06-22 07:58:42 108,966 —-a-w C:\Windows\System32\perfc009.dat
+ 2008-06-23 18:32:39 108,966 —-a-w C:\Windows\System32\perfc009.dat
- 2008-06-22 07:58:43 625,810 —-a-w C:\Windows\System32\perfh009.dat
+ 2008-06-23 18:32:39 625,810 —-a-w C:\Windows\System32\perfh009.dat
- 2008-06-22 07:56:09 6,190 —-a-w C:\Windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-1178568672-2116349422-3943845652-1000_UserData.bin
+ 2008-06-23 16:40:35 6,420 —-a-w C:\Windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-1178568672-2116349422-3943845652-1000_UserData.bin
- 2008-06-22 07:56:09 51,848 —-a-w C:\Windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin
+ 2008-06-23 16:40:35 51,896 —-a-w C:\Windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin
- 2008-06-22 07:56:08 26,902 —-a-w C:\Windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin
+ 2008-06-23 18:32:09 26,910 —-a-w C:\Windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{26ed3d2a-f110-48d9-a283-e00b756a7abf}]
2008-06-22 09:04 99328 –a—— C:\Windows\system32\ypiyiyud.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{BE7E4CE1-8CBA-44A6-956F-462A667D3286}]
C:\Windows\system32\khfETnol.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" [2008-02-28 17:07 1828136]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"="SOUNDMAN.EXE" [2007-03-09 16:28 598016 C:\Windows\SOUNDMAN.EXE]
"nod32kui"="C:\Program Files\Eset\nod32kui.exe" [2008-04-19 23:00 949376]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 22:16 39792]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2008-04-23 09:14 185632]
"NBKeyScan"="C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2008-02-18 16:29 2221352]
"StartCCC"="C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-01-21 12:17 61440]
"309077ae"="C:\Windows\system32\cmbvfiop.dll" [2008-06-22 09:04 81408]
"BM33a34432"="C:\Windows\system32\cdlpmqdh.dll" [2008-06-22 09:01 90112]

C:\Users\Sue\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
SimsWeather.lnk - C:\Program Files\Sims Weather\SimsWeather.exe [2007-03-02 14:19:19 855552]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{BE7E4CE1-8CBA-44A6-956F-462A667D3286}"= C:\Windows\system32\khfETnol.dll [ ]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.divxa32"= divxa32.acm
"VIDC.YV12"= yv12vfw.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-1178568672-2116349422-3943845652-1000]
"EnableNotificationsRef"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-1178568672-2116349422-3943845652-1001]
"EnableNotificationsRef"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{92EEE4DF-C885-4EAE-B2DF-62DF1036C94A}"= UDP:C:\Program Files\uTorrent\uTorrent.exe:µTorrent
"{8575065F-C95E-4C09-9414-E69BB94C19AC}"= TCP:C:\Program Files\uTorrent\uTorrent.exe:µTorrent
"TCP Query User{7FE1A26A-754C-4704-9CDB-888CBF1BF402}C:\\program files\\internet explorer\\iexplore.exe"= UDP:C:\program files\internet explorer\iexplore.exe:Internet Explorer
"UDP Query User{1A83386D-6383-409C-BCF5-610D6811B66F}C:\\program files\\internet explorer\\iexplore.exe"= TCP:C:\program files\internet explorer\iexplore.exe:Internet Explorer
"TCP Query User{642D2918-1198-47E1-B324-65674B7451F8}C:\\program files\\common files\\nero\\nero web\\setupx.exe"= UDP:C:\program files\common files\nero\nero web\setupx.exe:Nero Installer
"UDP Query User{5FE4D331-F0DF-4DF4-838B-8B0355468D59}C:\\program files\\common files\\nero\\nero web\\setupx.exe"= TCP:C:\program files\common files\nero\nero web\setupx.exe:Nero Installer

R3 atikmdag;atikmdag;C:\Windows\system32\DRIVERS\atikmdag.sys [2008-05-12 17:30]
S3 R300;R300;C:\Windows\system32\DRIVERS\atikmdag.sys [2008-05-12 17:30]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{5952792a-0e3e-11dd-96a8-0080c8f924f1}]
\shell\AutoRun\command - L:\LaunchU3.exe -a

.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-23 19:44:11
Windows 6.0.6000 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-06-23 19:45:23
ComboFix-quarantined-files.txt 2008-06-23 18:45:11
ComboFix2.txt 2008-06-23 18:38:22
ComboFix3.txt 2008-06-22 08:24:34

The system cannot find message text for message number 0x2379 in the message file for Application.
The system cannot find message text for message number 0x2379 in the message file for Application.

205 — E O F — 2008-06-20 11:22:13

Hijack this log file, after running combofix.exe

Logfile of HijackThis v1.99.1
Scan saved at 19:46:56, on 23/06/2008
Platform: Unknown Windows (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16681)

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\SOUNDMAN.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Windows\Explorer.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\Peter\Desktop\isssue\issue.exe.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.co.uk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: {fba7a657-b00e-382a-9d84-011fa2d3de62} - {26ed3d2a-f110-48d9-a283-e00b756a7abf} - C:\Windows\system32\ypiyiyud.dll
O2 - BHO: (no name) - {BE7E4CE1-8CBA-44A6-956F-462A667D3286} - C:\Windows\system32\khfETnol.dll (file missing)
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
O4 - HKLM\..\Run: [309077ae] rundll32.exe "C:\Windows\system32\cmbvfiop.dll",b
O4 - HKLM\..\Run: [BM33a34432] Rundll32.exe "C:\Windows\system32\cdlpmqdh.dll",s
O4 - HKCU\..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020
O8 - Extra context menu item: E&xport; to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O10 - Unknown file in Winsock LSP: c:\windows\system32\nlaapi.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\napinsp.dll
O11 - Options group: [INTERNATIONAL] International*
O13 - Gopher Prefix:
O16 - DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} -
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\Windows\system32\IoctlSvc.exe
O23 - Service: @%SystemRoot%\system32\qwave.dll,-1 (QWAVE) - Unknown owner - %windir%\system32\svchost.exe (file missing)
O23 - Service: @%SystemRoot%\system32\seclogon.dll,-7001 (seclogon) - Unknown owner - %windir%\system32\svchost.exe (file missing)
O23 - Service: @%ProgramFiles%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - %ProgramFiles%\Windows Media Player\wmpnetwk.exe (file missing)

Thank you :thumbup:
Post #6
Hi

Remember to disconnect from the Internet before carrying out the next instruction, and to save the following script before you do.You must also manually disable your anti-virus and anti-spyware programs. See the link below for instructions on doing this.
http://www.bleepingcomputer.com/forums/topic114351.html

Open Notepad - it must be Notepad, not Wordpad.
Copy the text below in the code box by highlighting all the text with your mouse and pressing Ctrl+C 

File::
C:\Windows\System32\ypiyiyud.dll
C:\Windows\System32\cmbvfiop.dll
C:\Windows\System32\cdlpmqdh.dll
C:\Windows\System32\yugprcfk.dll
C:\Windows\System32\bqlotecx.dll
C:\Windows\System32\rrtrstso.dll 

Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{26ed3d2a-f110-48d9-a283-e00b756a7abf}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{BE7E4CE1-8CBA-44A6-956F-462A667D3286}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"309077ae"=-
"BM33a34432"=
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{BE7E4CE1-8CBA-44A6-956F-462A667D3286}"=-

Go to the Notepad window and click Edit > Paste
Then click File > Save
Name the file "CFScript.txt" (including the quotes)
Save the file to your Desktop

[external image: Posted Image]


Refering to the picture above, drag CFScript into ComboFix.exe


Please go to Kaspersky website and perform an online antivirus scan.

  • Read through the requirements and privacy statement and click on Accept button.
  • It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
  • When the downloads have finished, click on Settings.
  • Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
    • Spyware, Adware, Dialers, and other potentially dangerous programs
      Archives
      Mail databases
  • Click on My Computer under Scan.
  • Once the scan is complete, it will display the results. Click on View Scan Report.
  • You will see a list of infected items there. Click on Save Report As….
  • Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button.
  • Please post this log in your next reply.


Once you have installed the Scanner, and the updated definitions, you can disconnect from the Internet and disable your anti-virus, to reduce scanning time. Re-enable the anti-virus before reconnecting to the Internet.
Instructions on disabling a variety of security programs can be found at the link below.
http://www.bleepingcomputer.com/forums/topic114351.html

In your next reply post:
ComboFix.txt
Kaspersky report
New HijackThis log taken after the above scan has run

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI