What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Help me!

10 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Logfile of HijackThis v1.99.1
Scan saved at 3:52:10 AM, on 9/15/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS.0\System32\smss.exe
C:\WINDOWS.0\system32\csrss.exe
C:\WINDOWS.0\system32\winlogon.exe
C:\WINDOWS.0\system32\services.exe
C:\WINDOWS.0\system32\lsass.exe
C:\WINDOWS.0\system32\Ati2evxx.exe
C:\WINDOWS.0\system32\svchost.exe
C:\WINDOWS.0\system32\svchost.exe
C:\WINDOWS.0\System32\svchost.exe
C:\WINDOWS.0\system32\Ati2evxx.exe
C:\WINDOWS.0\system32\svchost.exe
C:\WINDOWS.0\system32\svchost.exe
C:\WINDOWS.0\system32\spoolsv.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Spyware Doctor\pctsAuxs.exe
C:\Program Files\Spyware Doctor\pctsSvc.exe
C:\Program Files\Spyware Doctor\pctsTray.exe
C:\WINDOWS.0\system32\rundll32.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\Documents and Settings\Administrator.JANUARY-7F91F72\Administrator.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
C:\WINDOWS.0\System32\svchost.exe
C:\WINDOWS\system32\lsivs.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS.0\explorer.exe
C:\Program Files\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ro/
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe"
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe"
O4 - HKLM\..\Run: [runner1] C:\WINDOWS.0\faceback.exe
O4 - HKLM\..\Run: [0cb3a01d] rundll32.exe "C:\WINDOWS.0\system32\mlmxpfuc.dll",b
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [Administrator] C:\Documents and Settings\Administrator.JANUARY-7F91F72\Administrator.exe
O9 - Extra button: UltimateBet - {94148DB5-B42D-4915-95DA-2CBB4F7095BF} - C:\Program Files\UltimateBet\UltimateBet.exe
O9 - Extra 'Tools' menuitem: UltimateBet - {94148DB5-B42D-4915-95DA-2CBB4F7095BF} - C:\Program Files\UltimateBet\UltimateBet.exe
O9 - Extra button: Unibet Poker - {C53BFCFC-7A54-4627-AEBA-2CD4871FCA97} - C:\Microgaming\Poker\UnibetpokerMPP\MPPoker.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{EC321E7D-3C47-4D8F-B120-7CA77AF3B9D4}: NameServer = 213.154.124.1 193.231.252.1
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS.0\system32\wpdshserviceobj.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS.0\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS.0\system32\ati2sgag.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Windows Server IP Verification Service (LSIVS) - Unknown owner - C:\WINDOWS\system32\lsivs.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe



When y have a lot of programes in use.. like winamp yahoo messenger, and other games y`am playing.. the pc is starting to work verry verry slow. and y must reboot just to can work or use it.

PLS HELP.
Post #2
hi golden fish,


the pc is starting to work verry verry slow.]

thats because the trojans are chewing up your cpu cycles. your PC can be controlled remotely

i also dont see a resident antivirus in the log. we will get two downloads to start with. the first is sdfix and runs in safe mode only. run it first.
the next is malwarebytes. you should get and use them ASAP. post the logs from each and a new hjt log. link and directions:

sdfix:

Download SDFix and save it to your Desktop.

http://downloads.andymanchesta.com/RemovalTools/SDFix.exe


Double click SDFix.exe and it will extract the files to %systemdrive%
(Drive that contains the Windows Directory, typically C:\SDFix)

Please then reboot your computer in Safe Mode by doing the following :

* Restart your computer
* After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
* Instead of Windows loading as normal, the Advanced Options Menu should appear;
* Select the first option, to run Windows in Safe Mode, then press Enter.
* Choose your usual account.

* Open the extracted SDFix folder and double click RunThis.bat to start the script.
* Type Y to begin the cleanup process.
* It will remove any Trojan Services and Registry Entries that it finds then prompt you to press any key to Reboot.
* Press any Key and it will restart the PC.
* When the PC restarts the Fixtool will run again and complete the removal process then display Finished, press any key to end the script and load your desktop icons.
* Once the desktop icons load the SDFix report will open on screen and also save into the SDFix folder as Report.txt
(Report.txt will also be copied to Clipboard ready for posting back on the forum).
* Finally paste the contents of the Report.txt back on the forum with a new HijackThis log

malwarebytes:

Please download Malwarebytes' Anti-Malware to your desktop:

http://www.besttechie.net/tools/mbam-setup.exe

* Double-click mbam-setup.exe and follow the prompts to install the program.
* Be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
* If an update is found, it will download and install the latest version.
* Once the program has loaded, select Perform FULL SCAN, then click Scan.
* When the scan is complete, click OK, then Show Results to view the results.
* Be sure that everything is checked, and click Remove Selected.
* When completed, a log will open in Notepad. Please save it to a convenient location. The log can also be opened by going to Start > All Programs > Malwarebytes' Anti-Malware > Logs > log-date.txt

post the logs and a new hjt log.
Post #3
The report from the SDFIX :


SDFix: Version 1.227
Run by [removed] on Sat 09/20/2008 at 08:02 PM

Microsoft Windows XP [Version 5.1.2600]
Running From: C:\SDFix

Checking Services :

Rootkit Found :
C:\WINDOWS.0\system32\drivers\DRIVERS.sys - Rootkit Pandex/Cutwail - Protect.sys


Restoring Default Security Values
Restoring Default Hosts File

Rebooting


Checking Files :

Trojan Files Found:

C:\WINDOWS.0\system32\gcsto.dll - Deleted
C:\213098~1 - Deleted
C:\Documents and Settings\Administrator.JANUARY-7F91F72\Favorites\VIP Casino.url - Deleted
C:\Program Files\Mjcore\Mjcore.dll - Deleted
C:\DOCUME~1\ADMINI~1.JAN\LOCALS~1\Temp\TMP1.tmp - Deleted
C:\DOCUME~1\ADMINI~1.JAN\LOCALS~1\Temp\TMP2.tmp - Deleted
C:\DOCUME~1\ADMINI~1.JAN\LOCALS~1\Temp\TMP3.tmp - Deleted
C:\DOCUME~1\ADMINI~1.JAN\LOCALS~1\Temp\TMP4.tmp - Deleted
C:\DOCUME~1\ADMINI~1.JAN\LOCALS~1\Temp\TMP5.tmp - Deleted
C:\DOCUME~1\ADMINI~1.JAN\LOCALS~1\Temp\TMP7.tmp - Deleted
C:\DOCUME~1\ADMINI~1.JAN\LOCALS~1\Temp\TMPD.tmp - Deleted
C:\DOCUME~1\ADMINI~1.JAN\LOCALS~1\Temp\TMP1.tmp - Deleted
C:\DOCUME~1\ADMINI~1.JAN\LOCALS~1\Temp\TMP15.tmp - Deleted
C:\DOCUME~1\ADMINI~1.JAN\LOCALS~1\Temp\TMP19.tmp - Deleted
C:\DOCUME~1\ADMINI~1.JAN\LOCALS~1\Temp\TMP1A.tmp - Deleted
C:\DOCUME~1\ADMINI~1.JAN\LOCALS~1\Temp\TMP2.tmp - Deleted
C:\DOCUME~1\ADMINI~1.JAN\LOCALS~1\Temp\TMP26.tmp - Deleted
C:\DOCUME~1\ADMINI~1.JAN\LOCALS~1\Temp\TMP27.tmp - Deleted
C:\DOCUME~1\ADMINI~1.JAN\LOCALS~1\Temp\TMP28.tmp - Deleted
C:\DOCUME~1\ADMINI~1.JAN\LOCALS~1\Temp\TMP29.tmp - Deleted
C:\DOCUME~1\ADMINI~1.JAN\LOCALS~1\Temp\TMP2A.tmp - Deleted
C:\DOCUME~1\ADMINI~1.JAN\LOCALS~1\Temp\TMP3.tmp - Deleted
C:\DOCUME~1\ADMINI~1.JAN\LOCALS~1\Temp\TMP32.tmp - Deleted
C:\DOCUME~1\ADMINI~1.JAN\LOCALS~1\Temp\TMP4.tmp - Deleted
C:\DOCUME~1\ADMINI~1.JAN\LOCALS~1\Temp\TMP5.tmp - Deleted
C:\DOCUME~1\ADMINI~1.JAN\LOCALS~1\Temp\TMP7.tmp - Deleted
C:\DOCUME~1\ADMINI~1.JAN\LOCALS~1\Temp\TMP88.tmp - Deleted
C:\DOCUME~1\ADMINI~1.JAN\LOCALS~1\Temp\TMPD.tmp - Deleted
C:\d.exe - Deleted
C:\d1.exe - Deleted
C:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\win32.exe - Deleted
C:\WINDOWS.0\faceback.exe - Deleted
C:\WINDOWS.0\k.txt - Deleted
C:\WINDOWS.0\system32\c.ico - Deleted
C:\WINDOWS.0\system32\drivers\DRIVERS.sys - Deleted



Folder C:\Program Files\Mjcore - Removed
Folder C:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013 - Removed


Removing Temp Files

ADS Check :



Final Check :

catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-09-20 20:05:06
Windows 5.1.2600 Service Pack 2 NTFS

detected NTDLL code modification:
ZwOpenFile

scanning hidden processes …

scanning hidden services & system hive …

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"p0"="C:\Program Files\DAEMON Tools\"
"h0"=dword:00000000
"khjeh"=hex:d0,5a,2d,07,b3,92,8e,39,d0,a9,98,da,1f,d4,d3,85,c8,37,77,9c,a3,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,72,f3,4c,d2,cb,d7,02,01,c6,9e,1a,d3,72,1f,50,d4,c4,..
"khjeh"=hex:28,15,a7,53,5b,79,a1,0f,f5,58,17,4e,43,5e,bf,b3,14,36,db,09,0b,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:d0,cb,df,1c,ca,87,74,04,0f,f2,3b,93,1d,b2,a0,aa,a5,9a,88,67,0d,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"p0"="C:\Program Files\DAEMON Tools\"
"h0"=dword:00000000
"khjeh"=hex:d0,5a,2d,07,b3,92,8e,39,d0,a9,98,da,1f,d4,d3,85,c8,37,77,9c,a3,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,72,f3,4c,d2,cb,d7,02,01,c6,9e,1a,d3,72,1f,50,d4,c4,..
"khjeh"=hex:28,15,a7,53,5b,79,a1,0f,f5,58,17,4e,43,5e,bf,b3,14,36,db,09,0b,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:d0,cb,df,1c,ca,87,74,04,0f,f2,3b,93,1d,b2,a0,aa,a5,9a,88,67,0d,..

scanning hidden registry entries …

scanning hidden files …

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


Remaining Services :




Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"="C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe:*:Enabled:Yahoo! Messenger"
"C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"="C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe:*:Enabled:Yahoo! FT Server"
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"\\??\\C:\\WINDOWS.0\\system32\\winlogon.exe"="\\??\\C:\\WINDOWS.0\\system32\\winlogon.exe:*:enabled:@shell32.dll,-1"
"C:\\WINDOWS\\system32\\lsivs.exe"="C:\\WINDOWS\\system32\\lsivs.exe:*:Enabled:LSIVS"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"

Remaining Files :


File Backups: - C:\SDFix\backups\backups.zip

Files with Hidden Attributes :

Mon 15 Sep 2008 180,184 ..SHR — "C:\WINDOWS\system32\lsivs.exe"
Sun 20 Jul 2008 4,348 A.SH. — "C:\Documents and Settings\All Users.WINDOWS.0\DRM\DRMv1.bak"

Finished!
Post #4
Malwarebytes' Anti-Malware report : Malwarebytes' Anti-Malware 1.28 Database version: 1181 Windows 5.1.2600 Service Pack 2 9/20/2008 8:49:58 PM mbam-log-2008-09-20 (20-49-58).txt Scan type: Full Scan (C:\|D:\|) Objects scanned: 118879 Time elapsed: 28 minute(s), 1 second(s) Memory Processes Infected: 1 Memory Modules Infected: 0 Registry Keys Infected: 11 Registry Values Infected: 5 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 24 Memory Processes Infected: C:\Documents and Settings\Administrator.JANUARY-7F91F72\Administrator.exe (Trojan.Agent) -> Unloaded process successfully. Memory Modules Infected: (No malicious items detected) Registry Keys Infected: HKEY_CLASSES_ROOT\bizon (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\gpiext.bho (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{17e44256-51e0-4d46-a0c8-44e80ab4ba5b} (Trojan.BHO) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{4a72e49c-df8b-4245-9131-36720f19d8ad} (Trojan.BHO) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{b116b013-918b-42c1-9933-1dfc4d654c00} (Trojan.BHO) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Typelib\{e0f01490-dcf3-4357-95aa-169a8c2b2190} (Trojan.BHO) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{ff563c4b-bfc6-4100-bfda-a204df15b2d2} (Trojan.BHO) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{ff563c4b-bfc6-4100-bfda-a204df15b2d2} (Trojan.BHO) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\contim (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> Quarantined and deleted successfully. Registry Values Infected: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Settings\bf (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Settings\bk (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Settings\iu (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Settings\mu (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\administrator (Trojan.Agent) -> Quarantined and deleted successfully. Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: C:\gkotp.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\lssyby.exe (Trojan.Dropper) -> Quarantined and deleted successfully. C:\nlitcwy.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\ombos.exe (Trojan.Dropper) -> Quarantined and deleted successfully. C:\Documents and Settings\Administrator.JANUARY-7F91F72\B.tmp (Spyware.Passwords) -> Quarantined and deleted successfully. C:\Program Files\Opera\setupapi.dll (Spyware.Passwords) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{8C69C25E-9372-4CD6-9D67-56B8C2471E42}\RP1\A0000011.exe (Trojan.Dropper) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{8C69C25E-9372-4CD6-9D67-56B8C2471E42}\RP1\A0000012.exe (Trojan.Dropper) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{8C69C25E-9372-4CD6-9D67-56B8C2471E42}\RP1\A0000014.exe (Trojan.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{8C69C25E-9372-4CD6-9D67-56B8C2471E42}\RP1\A0000016.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{8C69C25E-9372-4CD6-9D67-56B8C2471E42}\RP1\A0000017.dll (Trojan.BHO) -> Quarantined and deleted successfully. C:\WINDOWS.0\system32\cfgmgr3.dll (Trojan.BHO) -> Quarantined and deleted successfully. C:\WINDOWS.0\system32\jkkHWNhF.dll (Trojan.Vundo) -> Quarantined and deleted successfully. C:\WINDOWS.0\system32\gcait.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\WINDOWS.0\Temp\DILC.tmp (Rootkit.Agent) -> Quarantined and deleted successfully. C:\WINDOWS.0\Temp\DILD.tmp (Trojan.Downloader) -> Quarantined and deleted successfully. C:\WINDOWS.0\Temp\VRTB.tmp (Trojan.Dropper) -> Quarantined and deleted successfully. C:\WINDOWS.0\system32\mcrh.tmp (Malware.Trace) -> Quarantined and deleted successfully. C:\WINDOWS.0\system32\E.tmp (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\WINDOWS.0\services.exe (Backdoor.ProRat) -> Quarantined and deleted successfully. C:\WINDOWS.0\Temp\BN2.tmp (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS.0\Temp\BN5.tmp (Trojan.Agent) -> Quarantined and deleted successfully. C:\Documents and Settings\Administrator.JANUARY-7F91F72\Administrator.exe (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS.0\system32\drivers\etc\services (Heuristics.Reserved.Word.Exploit) -> Quarantined and deleted successfully.
Post #5
And the hijakthis log :

Logfile of HijackThis v1.99.1
Scan saved at 8:50:50 PM, on 9/20/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS.0\System32\smss.exe
C:\WINDOWS.0\system32\winlogon.exe
C:\WINDOWS.0\system32\services.exe
C:\WINDOWS.0\system32\lsass.exe
C:\WINDOWS.0\system32\Ati2evxx.exe
C:\WINDOWS.0\system32\svchost.exe
C:\WINDOWS.0\System32\svchost.exe
C:\WINDOWS.0\system32\Ati2evxx.exe
C:\WINDOWS.0\system32\spoolsv.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\lsivs.exe
C:\WINDOWS.0\system32\wscntfy.exe
C:\WINDOWS.0\Explorer.EXE
C:\WINDOWS.0\RTHDCPL.EXE
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS.0\System32\svchost.exe
C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe
C:\Program Files\winamp\winamp.exe
C:\WINDOWS.0\system32\NOTEPAD.EXE
C:\Program Files\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ro/
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe"
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O9 - Extra button: UltimateBet - {94148DB5-B42D-4915-95DA-2CBB4F7095BF} - C:\Program Files\UltimateBet\UltimateBet.exe
O9 - Extra 'Tools' menuitem: UltimateBet - {94148DB5-B42D-4915-95DA-2CBB4F7095BF} - C:\Program Files\UltimateBet\UltimateBet.exe
O9 - Extra button: Unibet Poker - {C53BFCFC-7A54-4627-AEBA-2CD4871FCA97} - C:\Microgaming\Poker\UnibetpokerMPP\MPPoker.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{EC321E7D-3C47-4D8F-B120-7CA77AF3B9D4}: NameServer = 213.154.124.1 193.231.252.1
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS.0\system32\Ati2evxx.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Windows Server IP Verification Service (LSIVS) - Unknown owner - C:\WINDOWS\system32\lsivs.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe



AND NOW ? :D
Post #6
hi golden fish,

ok thanks for the info. first we will stop a service and get another download to run. do you have a resident antivirus installed on your computer?

first:

go to start>run and type in–> services.msc, click ok<–in the list of services that comes up, under the name column look for>> Windows Server IP Verification Service

right click on it and select properties.
under the general tab:
the path to the .exe should say: C:\WINDOWS\system32\lsivs.exe
make sure that the service status is: Stopped, if not click the Stop button
and the Start up type is: disabled, if not change it to disable
click apply, then ok
reboot computer

next: we will get another download to use. links and directions:

Download combofix from one of these links and save it to your Desktop:

http://subs.geekstogo.com/ComboFix.exe
http://download.bleepingcomputer.com/sUBs/ComboFix.exe

double click on combofix.exe & follow the prompts.
When finished, it will produce a report for you.
Please post the "C:\ComboFix.txt" along with a new HijackThis log for further review

Note: Do not mouseclick combofix's window while it's running. That may cause it to stall or freeze.

please post the combofix log.
Post #7
This is the combo fix :


ComboFix 08-09-20.05 - Administrator 2008-09-21 16:32:13.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.698 [GMT 3:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS.0\file.bat
C:\WINDOWS.0\system32\drivers\Bhn06.sys
C:\WINDOWS.0\system32\regedit.exe
C:\WINDOWS.0\system32\drivers\str.sys . . . . failed to delete

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Legacy_BHN06
——-\Legacy_SYNSEND
——-\Service_Bhn06
——-\Service_synsend


((((((((((((((((((((((((( Files Created from 2008-08-21 to 2008-09-21 )))))))))))))))))))))))))))))))
.

2008-09-20 20:19 . 2008-09-20 20:19 39,424 –a—— C:\WINDOWS.0\system32\11.tmp
2008-09-20 20:19 . 2008-09-20 20:19 30,208 –a—— C:\WINDOWS.0\system32\rs32net.exe
2008-09-20 20:19 . 2008-09-20 20:19 0 –a—— C:\WINDOWS.0\system32\13.tmp
2008-09-20 20:08 . 2008-09-20 20:09 d——– C:\Program Files\Malwarebytes' Anti-Malware
2008-09-20 20:08 . 2008-09-20 20:08 d——– C:\Documents and Settings\All Users.WINDOWS.0\Application Data\Malwarebytes
2008-09-20 20:08 . 2008-09-20 20:08 d——– C:\Documents and Settings\Administrator.JANUARY-7F91F72\Application Data\Malwarebytes
2008-09-20 20:08 . 2008-09-10 00:04 38,528 –a—— C:\WINDOWS.0\system32\drivers\mbamswissarmy.sys
2008-09-20 20:08 . 2008-09-10 00:03 17,200 –a—— C:\WINDOWS.0\system32\drivers\mbam.sys
2008-09-20 20:01 . 2008-09-20 20:01 578,048 –a—— C:\WINDOWS.0\system32\dllcache\user32.dll
2008-09-20 20:00 . 2008-09-20 20:01 d——– C:\WINDOWS.0\ERUNT
2008-09-20 19:57 . 2008-09-20 20:05 d——– C:\SDFix
2008-09-15 03:41 . 2008-09-15 03:41 d——– C:\VundoFix Backups
2008-09-15 03:38 . 2008-09-15 03:38 d——– C:\WINDOWS.0\system32\xircom
2008-09-15 03:38 . 2008-09-15 03:38 d——– C:\WINDOWS.0\srchasst
2008-09-15 03:38 . 2008-09-15 03:38 d——– C:\Program Files\microsoft frontpage
2008-09-15 03:37 . 2008-09-15 03:51 534 —hs—- C:\WINDOWS.0\system32\cufpxmlm.ini
2008-09-15 03:36 . 2008-09-15 04:03 2,333 –ahs—- C:\WINDOWS.0\system32\rAGikUtv.ini
2008-09-15 03:36 . 2008-09-15 04:03 2,237 –ahs—- C:\WINDOWS.0\system32\rAGikUtv.ini2
2008-09-15 03:31 . 2008-09-15 03:31 133,248 –a—— C:\WINDOWS.0\system32\drivers\ethjibmi.sys
2008-09-15 03:31 . 2008-09-15 03:31 42,496 –a—— C:\nnhuci.exe
2008-09-15 03:31 . 2008-09-15 03:31 42,496 –a—— C:\hcsu.exe
2008-09-15 03:04 . 2008-09-16 01:55 d——– C:\Program Files\Spyware Doctor
2008-09-15 02:58 . 2008-09-16 01:55 d-a—— C:\Documents and Settings\All Users.WINDOWS.0\Application Data\TEMP
2008-09-15 02:55 . 2008-09-15 02:55 d——– C:\Program Files\mIRC
2008-09-15 02:55 . 2008-09-15 02:57 d——– C:\Documents and Settings\Administrator.JANUARY-7F91F72\Application Data\mIRC
2008-09-08 10:47 . 2008-09-08 10:47 d——– C:\Program Files\Common Files\Adobe AIR
2008-09-08 10:46 . 2008-09-08 14:45 d——– C:\Program Files\NOS
2008-09-08 10:46 . 2008-09-08 14:45 d——– C:\Documents and Settings\All Users.WINDOWS.0\Application Data\NOS
2008-08-29 10:24 . 2008-09-15 14:34 268 –ah—– C:\sqmdata19.sqm
2008-08-29 10:24 . 2008-09-15 14:34 244 –ah—– C:\sqmnoopt19.sqm
2008-08-28 23:01 . 2008-09-15 03:40 268 –ah—– C:\sqmdata18.sqm
2008-08-28 23:01 . 2008-09-15 03:40 244 –ah—– C:\sqmnoopt18.sqm
2008-08-28 11:46 . 2008-09-15 03:28 268 –ah—– C:\sqmdata17.sqm
2008-08-28 11:46 . 2008-09-15 03:28 244 –ah—– C:\sqmnoopt17.sqm
2008-08-27 17:15 . 2008-09-15 03:23 268 –ah—– C:\sqmdata16.sqm
2008-08-27 17:15 . 2008-09-15 03:23 244 –ah—– C:\sqmnoopt16.sqm
2008-08-27 10:44 . 2008-09-15 03:19 268 –ah—– C:\sqmdata15.sqm
2008-08-27 10:44 . 2008-09-15 03:19 244 –ah—– C:\sqmnoopt15.sqm
2008-08-26 23:06 . 2008-09-15 03:15 268 –ah—– C:\sqmdata14.sqm
2008-08-26 23:06 . 2008-09-15 03:15 244 –ah—– C:\sqmnoopt14.sqm

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-09-21 13:26 ——— d—–w C:\Program Files\Garena
2008-09-20 17:20 102,400 —-a-w C:\WINDOWS.0\DUMP51e8.tmp
2008-09-20 16:47 ——— d—–w C:\Program Files\Odc++
2008-09-20 14:45 ——— d—–w C:\Program Files\Warcraft III
2008-09-20 09:54 102,400 —-a-w C:\WINDOWS.0\DUMP53bd.tmp
2008-09-20 08:56 ——— d—–w C:\Program Files\Common Files\Symantec Shared
2008-09-20 08:47 ——— d—–w C:\Program Files\Norton Security Scan
2008-09-15 22:57 ——— d—–w C:\Program Files\Windows Live
2008-09-15 00:36 ——— d—–w C:\Program Files\MplayerBest
2008-09-15 00:36 ——— d—–w C:\Program Files\Java Web Start
2008-09-15 00:31 ——— d—–w C:\Program Files\Opera
2008-09-14 19:59 ——— d—–w C:\Documents and Settings\Administrator.JANUARY-7F91F72\Application Data\Microgaming
2008-09-14 07:43 ——— d—–w C:\Program Files\UltimateBet
2008-09-08 07:47 ——— d—–w C:\Program Files\Common Files\Adobe
2008-08-17 09:01 ——— d—–w C:\Program Files\IrfanView
2008-08-16 17:38 ——— d—–w C:\Program Files\winamp
2008-08-12 10:15 ——— d—–w C:\Documents and Settings\Administrator.JANUARY-7F91F72\Application Data\Ahead
2008-07-27 15:04 ——— d–h–w C:\Program Files\InstallShield Installation Information
2008-07-27 15:03 2,829 —-a-w C:\WINDOWS.0\War3Unin.pif
2008-07-27 15:03 147,456 —-a-w C:\WINDOWS.0\War3Unin.exe
2008-07-27 14:50 ——— d—–w C:\Program Files\Ocean Technology
2008-07-27 14:50 ——— d—–w C:\Program Files\DAEMON Tools
2008-07-27 13:14 611,064 —-a-w C:\WINDOWS.0\system32\drivers\sptd.sys
2008-07-25 22:51 ——— d—–w C:\Program Files\SopCast4.3
2008-07-25 16:55 ——— d—–w C:\Program Files\Common Files\LightScribe
2008-07-25 16:51 ——— d—–w C:\Program Files\Common Files\Ahead
2008-07-25 16:49 ——— d—–w C:\Program Files\Nero
2008-07-25 16:49 ——— d—–w C:\Documents and Settings\All Users.WINDOWS.0\Application Data\Nero
2008-07-25 16:44 ——— d—–w C:\Program Files\XPower_Video_Player
2008-07-21 22:08 ——— dcsh–w C:\Program Files\Common Files\WindowsLiveInstaller
2008-07-21 22:08 ——— d—–w C:\Documents and Settings\All Users.WINDOWS.0\Application Data\WLInstaller
2008-07-21 21:22 ——— d—–w C:\Program Files\Java
2008-07-19 09:37 323,584 —-a-w C:\WINDOWS.0\HideWin.exe
2008-07-18 16:22 745,472 —-a-w C:\WINDOWS.0\iun6002.exe
.

——- Sigcheck ——-

2007-08-16 20:33 675840 1e40277584e94feef0c36ed847587a68 C:\WINDOWS.0\system32\wininet.dll

2007-08-16 20:34 360704 90671a9a8f189262be5224c497c2e0c7 C:\WINDOWS.0\system32\drivers\tcpip.sys

2007-08-16 20:33 1191424 c7fc99cc8885a7d4f287e31d7a5eaf9f C:\WINDOWS.0\explorer.exe

2004-08-04 01:56 23040 b0f6c9d4e263d548375b1c3fd4229833 C:\WINDOWS.0\system32\ctfmon.exe

2004-08-04 01:56 32256 4dd46c6a63b32637aedbccc3e98ee72f C:\WINDOWS.0\system32\userinit.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Yahoo! Pager"="C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" [2007-08-30 4670704]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2006-12-23 151552]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe" [2006-09-25 98304]
"NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 163840]
"DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2006-09-14 157592]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"RTHDCPL"="RTHDCPL.EXE" [2007-05-10 C:\WINDOWS.0\RTHDCPL.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"nltide_3"="advpack.dll" [2004-08-04 C:\WINDOWS.0\system32\advpack.dll]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveTrack"= 1 (0x1)
"NoResolveSearch"= 1 (0x1)
"NoSMMyPictures"= 1 (0x1)
"NoSMConfigurePrograms"= 1 (0x1)
"NoInstrumentation"= 1 (0x1)

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveTrack"= 1 (0x1)
"NoResolveSearch"= 1 (0x1)
"NoSMMyPictures"= 1 (0x1)
"NoSMConfigurePrograms"= 1 (0x1)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"DisableUnicastResponsesToMulticastBroadcast"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\WINDOWS\\system32\\lsivs.exe"=

R2 LSIVS;Windows Server IP Verification Service;C:\WINDOWS\system32\lsivs.exe [2008-09-15 180184]
S1 ethjibmi;ethjibmi;C:\WINDOWS.0\system32\drivers\ethjibmi.sys [2008-09-15 133248]
S3 restore;restore;C:\WINDOWS.0\system32\drivers\restore.sys [ ]
S3 SetupNTGLM7X;SetupNTGLM7X;E:\NTGLM7X.sys [ ]
.
Contents of the 'Scheduled Tasks' folder
.
.
——- Supplementary Scan ——-
.
FireFox -: Profile - C:\Documents and Settings\Administrator.JANUARY-7F91F72\Application Data\Mozilla\Firefox\Profiles\fs1l01ss.default\
FF -: plugin - C:\Program Files\Java\j2re1.4.0_01\bin\NPJava11.dll
FF -: plugin - C:\Program Files\Java\j2re1.4.0_01\bin\NPJava12.dll
FF -: plugin - C:\Program Files\Java\j2re1.4.0_01\bin\NPJava13.dll
FF -: plugin - C:\Program Files\Java\j2re1.4.0_01\bin\NPJava32.dll
FF -: plugin - C:\Program Files\Java\j2re1.4.0_01\bin\NPJPI140_01.dll
FF -: plugin - C:\Program Files\Java\j2re1.4.0_01\bin\NPOJI610.dll
FF -: plugin - C:\Program Files\Mozilla Firefox\plugins\np_gp.dll
FF -: plugin - C:\Program Files\Mozilla Firefox\plugins\NPJava11.dll
FF -: plugin - C:\Program Files\Mozilla Firefox\plugins\NPJava12.dll
FF -: plugin - C:\Program Files\Mozilla Firefox\plugins\NPJava13.dll
FF -: plugin - C:\Program Files\Mozilla Firefox\plugins\NPJava32.dll
FF -: plugin - C:\Program Files\Mozilla Firefox\plugins\NPJPI140_01.dll
FF -: plugin - C:\Program Files\Mozilla Firefox\plugins\NPOJI610.dll
FF -: plugin - C:\Program Files\Yahoo!\Shared\npYState.dll
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-09-21 16:35:31
Windows 5.1.2600 Service Pack 2 NTFS

detected NTDLL code modification:
ZwOpenFile

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …


C:\WINDOWS.0\system32\drivers\anngk.sys 30848 bytes executable
C:\WINDOWS.0\system32\drivers\str.sys 0 bytes

scan completed successfully
hidden files: 2

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\scuokh]
"ImagePath"="\??\C:\WINDOWS.0\system32\drivers\anngk.sys"
.
———————— Other Running Processes ————————
.
C:\WINDOWS.0\system32\ati2evxx.exe
C:\WINDOWS.0\system32\ati2evxx.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINDOWS.0\system32\wscntfy.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\PROGRA~1\Yahoo!\MESSEN~1\Ymsgr_tray.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
C:\ComboFix\pv.cfexe
.
**************************************************************************
.
Completion time: 2008-09-21 16:36:36 - machine was rebooted
ComboFix-quarantined-files.txt 2008-09-21 13:36:33

Pre-Run: 11,558,494,208 bytes free
Post-Run: 11,515,297,792 bytes free

202



This is the HijackThis log :


Logfile of HijackThis v1.99.1
Scan saved at 4:38:03 PM, on 9/21/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS.0\System32\smss.exe
C:\WINDOWS.0\system32\winlogon.exe
C:\WINDOWS.0\system32\services.exe
C:\WINDOWS.0\system32\lsass.exe
C:\WINDOWS.0\system32\Ati2evxx.exe
C:\WINDOWS.0\system32\svchost.exe
C:\WINDOWS.0\System32\svchost.exe
C:\WINDOWS.0\system32\Ati2evxx.exe
C:\WINDOWS.0\system32\spoolsv.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\lsivs.exe
C:\WINDOWS.0\system32\wscntfy.exe
C:\WINDOWS.0\RTHDCPL.EXE
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
C:\WINDOWS.0\system32\wuauclt.exe
C:\WINDOWS.0\explorer.exe
C:\WINDOWS.0\system32\notepad.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ro/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe"
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O9 - Extra button: UltimateBet - {94148DB5-B42D-4915-95DA-2CBB4F7095BF} - C:\Program Files\UltimateBet\UltimateBet.exe
O9 - Extra 'Tools' menuitem: UltimateBet - {94148DB5-B42D-4915-95DA-2CBB4F7095BF} - C:\Program Files\UltimateBet\UltimateBet.exe
O9 - Extra button: Unibet Poker - {C53BFCFC-7A54-4627-AEBA-2CD4871FCA97} - C:\Microgaming\Poker\UnibetpokerMPP\MPPoker.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{EC321E7D-3C47-4D8F-B120-7CA77AF3B9D4}: NameServer = 213.154.124.1 193.231.252.1
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS.0\system32\Ati2evxx.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Windows Server IP Verification Service (LSIVS) - Unknown owner - C:\WINDOWS\system32\lsivs.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe

Tnx a lot. My computer seems to worck better now. Y`m verry glad that they still exists man like you.
Post #8
hi golden fish,

you had some serious malware on your machine namely rootkits. Rootkits can hide from traditional anti-malware apps. You should change all your passwords. you should monitor all financial transactions if you used your computer for banking etc. you should seriously consider reformatting your hard drive and reinstalling windows. I would not trust a compromised machine.

did you install IRC? (Internet Relay Chat)If not, look in add/remove programs and uninstall it if present.

we will use combofix again and maybe get another download to use:

Click Start, then Run and type Notepad and click OK.
Copy/paste the text in the code box below into notepad:


File::
C:\WINDOWS.0\system32\drivers\anngk.sys 
C:\WINDOWS.0\system32\drivers\str.sys
C:\WINDOWS.0\system32\rs32net.exe
C:\WINDOWS.0\system32\13.tmp
C:\WINDOWS.0\system32\11.tmp
C:\WINDOWS.0\srchasst
C:\WINDOWS.0\system32\drivers\ethjibmi.sys
C:\nnhuci.exe
C:\hcsu.exe
C:\WINDOWS.0\system32\rAGikUtv.ini
C:\WINDOWS.0\system32\rAGikUtv.ini2

Driver::
ethjibmi
anngk
str


Name the Notepad file CFScript.txt and Save it to your desktop.
now locate the file you just saved and the combofix icon, both on the desktop:
using your mouse drag the CFScript right on top of the combofix icon and release, combofix will run and produce a new log
please post the new combofix log and a new hjt log.
—————————————————
i will assume you dont have a resident anitvirus. please do a online scan here:

ESET online scanner:

http://www.eset.com/onlinescan/

uses Internet Explorer only
check "YES" to accept terms
click start button
allow the ActiveX component to install
click the start button. the Scanner will update.
check both "Remove found threats" and "Scan unwanted applications"
click scan
when done you can find the scan log at:C:\Program Files\EsetOnlineScanner\log.txt
please copy/paste that log in next reply.
—————————————————–
next:
lets get a file checked out. to help show all files do this:

FOr XP: on the desktop double click my computer,go to tools>folder options>view> then select "show hidden files and folders", then UNcheck "hide protected operating system files " also UNcheck "hide extensions for known file types" click apply to all folders, apply then ok

navigate to C:\WINDOWS\system32
look for—> lsivs.exe

if found: go to the website below, browse for the file on your computer, then click the send button to upload. you can copy/paste the results in your reply.
http://www.virustotal.com/
Post #9
The combofix report

ComboFix 08-09-20.05 - Administrator 2008-09-22 21:37:20.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.649 [GMT 3:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Administrator.JANUARY-7F91F72\Desktop\CFScript.txt
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::
C:\hcsu.exe
C:\nnhuci.exe
C:\WINDOWS.0\system32\11.tmp
C:\WINDOWS.0\system32\13.tmp
C:\WINDOWS.0\system32\drivers\anngk.sys
C:\WINDOWS.0\system32\drivers\ethjibmi.sys
C:\WINDOWS.0\system32\drivers\str.sys
C:\WINDOWS.0\system32\rAGikUtv.ini
C:\WINDOWS.0\system32\rAGikUtv.ini2
C:\WINDOWS.0\system32\rs32net.exe
C:\WINDOWS.0\srchasst :#:
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\hcsu.exe
C:\nnhuci.exe
C:\WINDOWS.0\system32\11.tmp
C:\WINDOWS.0\system32\13.tmp
C:\WINDOWS.0\system32\drivers\anngk.sys
C:\WINDOWS.0\system32\drivers\ethjibmi.sys
C:\WINDOWS.0\system32\drivers\str.sys
C:\WINDOWS.0\system32\rAGikUtv.ini
C:\WINDOWS.0\system32\rAGikUtv.ini2
C:\WINDOWS.0\system32\rs32net.exe

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Legacy_SYNSEND
——-\Service_ethjibmi
——-\Service_synsend


((((((((((((((((((((((((( Files Created from 2008-08-22 to 2008-09-22 )))))))))))))))))))))))))))))))
.

2008-09-20 20:08 . 2008-09-20 20:09 d——– C:\Program Files\Malwarebytes' Anti-Malware
2008-09-20 20:08 . 2008-09-20 20:08 d——– C:\Documents and Settings\All Users.WINDOWS.0\Application Data\Malwarebytes
2008-09-20 20:08 . 2008-09-20 20:08 d——– C:\Documents and Settings\Administrator.JANUARY-7F91F72\Application Data\Malwarebytes
2008-09-20 20:08 . 2008-09-10 00:04 38,528 –a—— C:\WINDOWS.0\system32\drivers\mbamswissarmy.sys
2008-09-20 20:08 . 2008-09-10 00:03 17,200 –a—— C:\WINDOWS.0\system32\drivers\mbam.sys
2008-09-20 20:01 . 2008-09-20 20:01 578,048 –a—— C:\WINDOWS.0\system32\dllcache\user32.dll
2008-09-20 20:00 . 2008-09-20 20:01 d——– C:\WINDOWS.0\ERUNT
2008-09-20 19:57 . 2008-09-20 20:05 d——– C:\SDFix
2008-09-15 03:41 . 2008-09-15 03:41 d——– C:\VundoFix Backups
2008-09-15 03:38 . 2008-09-15 03:38 d——– C:\WINDOWS.0\system32\xircom
2008-09-15 03:38 . 2008-09-15 03:38 d——– C:\WINDOWS.0\srchasst
2008-09-15 03:38 . 2008-09-15 03:38 d——– C:\Program Files\microsoft frontpage
2008-09-15 03:37 . 2008-09-15 03:51 534 —hs—- C:\WINDOWS.0\system32\cufpxmlm.ini
2008-09-15 03:04 . 2008-09-16 01:55 d——– C:\Program Files\Spyware Doctor
2008-09-15 02:58 . 2008-09-16 01:55 d-a—— C:\Documents and Settings\All Users.WINDOWS.0\Application Data\TEMP
2008-09-15 02:55 . 2008-09-15 02:55 d——– C:\Program Files\mIRC
2008-09-15 02:55 . 2008-09-15 02:57 d——– C:\Documents and Settings\Administrator.JANUARY-7F91F72\Application Data\mIRC
2008-09-08 10:47 . 2008-09-08 10:47 d——– C:\Program Files\Common Files\Adobe AIR
2008-09-08 10:46 . 2008-09-08 14:45 d——– C:\Program Files\NOS
2008-09-08 10:46 . 2008-09-08 14:45 d——– C:\Documents and Settings\All Users.WINDOWS.0\Application Data\NOS
2008-08-29 10:24 . 2008-09-15 14:34 268 –ah—– C:\sqmdata19.sqm
2008-08-29 10:24 . 2008-09-15 14:34 244 –ah—– C:\sqmnoopt19.sqm
2008-08-28 23:01 . 2008-09-15 03:40 268 –ah—– C:\sqmdata18.sqm
2008-08-28 23:01 . 2008-09-15 03:40 244 –ah—– C:\sqmnoopt18.sqm
2008-08-28 11:46 . 2008-09-15 03:28 268 –ah—– C:\sqmdata17.sqm
2008-08-28 11:46 . 2008-09-15 03:28 244 –ah—– C:\sqmnoopt17.sqm
2008-08-27 17:15 . 2008-09-15 03:23 268 –ah—– C:\sqmdata16.sqm
2008-08-27 17:15 . 2008-09-15 03:23 244 –ah—– C:\sqmnoopt16.sqm
2008-08-27 10:44 . 2008-09-22 13:35 268 –ah—– C:\sqmdata15.sqm
2008-08-27 10:44 . 2008-09-22 13:35 244 –ah—– C:\sqmnoopt15.sqm
2008-08-26 23:06 . 2008-09-22 09:55 268 –ah—– C:\sqmdata14.sqm
2008-08-26 23:06 . 2008-09-22 09:55 244 –ah—– C:\sqmnoopt14.sqm

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-09-21 22:47 ——— d—–w C:\Program Files\Odc++
2008-09-21 22:29 ——— d—–w C:\Program Files\Warcraft III
2008-09-21 19:17 ——— d—–w C:\Documents and Settings\Administrator.JANUARY-7F91F72\Application Data\Microgaming
2008-09-21 15:00 ——— d—–w C:\Program Files\Norton Security Scan
2008-09-21 15:00 ——— d—–w C:\Program Files\Common Files\Symantec Shared
2008-09-21 13:41 ——— d—–w C:\Program Files\Garena
2008-09-20 17:20 102,400 —-a-w C:\WINDOWS.0\DUMP51e8.tmp
2008-09-20 09:54 102,400 —-a-w C:\WINDOWS.0\DUMP53bd.tmp
2008-09-15 22:57 ——— d—–w C:\Program Files\Windows Live
2008-09-15 00:36 ——— d—–w C:\Program Files\MplayerBest
2008-09-15 00:36 ——— d—–w C:\Program Files\Java Web Start
2008-09-15 00:31 ——— d—–w C:\Program Files\Opera
2008-09-14 07:43 ——— d—–w C:\Program Files\UltimateBet
2008-09-08 07:47 ——— d—–w C:\Program Files\Common Files\Adobe
2008-08-17 09:01 ——— d—–w C:\Program Files\IrfanView
2008-08-16 17:38 ——— d—–w C:\Program Files\winamp
2008-08-12 10:15 ——— d—–w C:\Documents and Settings\Administrator.JANUARY-7F91F72\Application Data\Ahead
2008-07-27 15:04 ——— d–h–w C:\Program Files\InstallShield Installation Information
2008-07-27 15:03 2,829 —-a-w C:\WINDOWS.0\War3Unin.pif
2008-07-27 15:03 147,456 —-a-w C:\WINDOWS.0\War3Unin.exe
2008-07-27 14:50 ——— d—–w C:\Program Files\Ocean Technology
2008-07-27 14:50 ——— d—–w C:\Program Files\DAEMON Tools
2008-07-27 13:14 611,064 —-a-w C:\WINDOWS.0\system32\drivers\sptd.sys
2008-07-25 22:51 ——— d—–w C:\Program Files\SopCast4.3
2008-07-25 16:55 ——— d—–w C:\Program Files\Common Files\LightScribe
2008-07-25 16:51 ——— d—–w C:\Program Files\Common Files\Ahead
2008-07-25 16:49 ——— d—–w C:\Program Files\Nero
2008-07-25 16:49 ——— d—–w C:\Documents and Settings\All Users.WINDOWS.0\Application Data\Nero
2008-07-25 16:44 ——— d—–w C:\Program Files\XPower_Video_Player
2008-07-19 09:37 323,584 —-a-w C:\WINDOWS.0\HideWin.exe
2008-07-18 16:22 745,472 —-a-w C:\WINDOWS.0\iun6002.exe
.

——- Sigcheck ——-

2007-08-16 20:33 675840 1e40277584e94feef0c36ed847587a68 C:\WINDOWS.0\system32\wininet.dll

2007-08-16 20:34 360704 90671a9a8f189262be5224c497c2e0c7 C:\WINDOWS.0\system32\drivers\tcpip.sys

2007-08-16 20:33 1191424 c7fc99cc8885a7d4f287e31d7a5eaf9f C:\WINDOWS.0\explorer.exe

2004-08-04 01:56 23040 b0f6c9d4e263d548375b1c3fd4229833 C:\WINDOWS.0\system32\ctfmon.exe

2004-08-04 01:56 32256 4dd46c6a63b32637aedbccc3e98ee72f C:\WINDOWS.0\system32\userinit.exe
.
((((((((((((((((((((((((((((( snapshot@2008-09-21_16.36.21.67 )))))))))))))))))))))))))))))))))))))))))
.
- 2005-10-20 17:02:28 174,592 —-a-w C:\WINDOWS.0\erdnt\Hiv-backup\ERDNT.EXE
+ 2005-10-20 17:02:28 163,328 —-a-w C:\WINDOWS.0\erdnt\Hiv-backup\ERDNT.EXE
- 2005-10-20 17:02:28 174,592 —-a-w C:\WINDOWS.0\erdnt\subs\ERDNT.EXE
+ 2005-10-20 17:02:28 163,328 —-a-w C:\WINDOWS.0\erdnt\subs\ERDNT.EXE
- 2008-07-18 16:19:37 8,738 —-a-w C:\WINDOWS.0\pchealth\helpctr\Config\Cntstore.bin
+ 2008-09-22 17:08:01 8,972 —-a-w C:\WINDOWS.0\pchealth\helpctr\Config\Cntstore.bin
- 2008-07-18 16:19:35 86,339 —-a-w C:\WINDOWS.0\pchealth\helpctr\OfflineCache\index.dat
+ 2008-09-22 17:08:33 86,339 —-a-w C:\WINDOWS.0\pchealth\helpctr\OfflineCache\index.dat
- 2008-07-18 16:19:37 2,136 —-a-w C:\WINDOWS.0\pchealth\helpctr\PackageStore\SkuStore.bin
+ 2008-09-22 17:08:33 2,746 —-a-w C:\WINDOWS.0\pchealth\helpctr\PackageStore\SkuStore.bin
- 2000-08-31 05:00:00 169,984 —-a-w C:\WINDOWS.0\swreg.exe
+ 2000-08-31 05:00:00 161,792 —-a-w C:\WINDOWS.0\swreg.exe
- 2008-09-21 13:35:12 16,384 —-a-w C:\WINDOWS.0\system32\config\systemprofile\Cookies\index.dat
+ 2008-09-22 18:40:13 16,384 —-a-w C:\WINDOWS.0\system32\config\systemprofile\Cookies\index.dat
- 2008-09-21 13:35:12 16,384 —-a-w C:\WINDOWS.0\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2008-09-22 18:40:13 16,384 —-a-w C:\WINDOWS.0\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
- 2008-09-21 13:35:12 32,768 —-a-w C:\WINDOWS.0\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
+ 2008-09-22 18:40:13 32,768 —-a-w C:\WINDOWS.0\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Yahoo! Pager"="C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" [2007-08-30 4670704]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2006-12-23 151552]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe" [2006-09-25 98304]
"NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 163840]
"DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2006-09-14 157592]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"RTHDCPL"="RTHDCPL.EXE" [2007-05-10 C:\WINDOWS.0\RTHDCPL.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"nltide_3"="advpack.dll" [2004-08-04 C:\WINDOWS.0\system32\advpack.dll]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveTrack"= 1 (0x1)
"NoResolveSearch"= 1 (0x1)
"NoSMMyPictures"= 1 (0x1)
"NoSMConfigurePrograms"= 1 (0x1)
"NoInstrumentation"= 1 (0x1)

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveTrack"= 1 (0x1)
"NoResolveSearch"= 1 (0x1)
"NoSMMyPictures"= 1 (0x1)
"NoSMConfigurePrograms"= 1 (0x1)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
"DisableUnicastResponsesToMulticastBroadcast"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\WINDOWS\\system32\\lsivs.exe"=

R2 LSIVS;Windows Server IP Verification Service;C:\WINDOWS\system32\lsivs.exe [2008-09-15 180184]
S2 scuokh;scuokh;C:\WINDOWS.0\system32\drivers\anngk.sys [ ]
S3 restore;restore;C:\WINDOWS.0\system32\drivers\restore.sys [ ]
S3 SetupNTGLM7X;SetupNTGLM7X;E:\NTGLM7X.sys [ ]
.
Contents of the 'Scheduled Tasks' folder
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-09-22 21:40:51
Windows 5.1.2600 Service Pack 2 NTFS

detected NTDLL code modification:
ZwOpenFile

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
———————— Other Running Processes ————————
.
C:\WINDOWS.0\system32\ati2evxx.exe
C:\WINDOWS.0\system32\ati2evxx.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINDOWS.0\system32\wscntfy.exe
C:\PROGRA~1\Yahoo!\MESSEN~1\Ymsgr_tray.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
C:\ComboFix\pv.cfexe
C:\ComboFix\pv.cfexe
.
**************************************************************************
.
Completion time: 2008-09-22 21:41:58 - machine was rebooted
ComboFix-quarantined-files.txt 2008-09-22 18:41:55
ComboFix2.txt 2008-09-21 13:36:37

Pre-Run: 11,064,627,200 bytes free
Post-Run: 11,226,644,480 bytes free

211



The… virustotal.com report

Antivirus Version Last Update Result
AhnLab-V3 2008.9.23.0 2008.09.22 Win32/Virut.Gen
AntiVir 7.8.1.34 2008.09.22 TR/Crypt.XPACK.Gen
Authentium 5.1.0.4 2008.09.22 -
Avast 4.8.1195.0 2008.09.22 Win32:Virtob
AVG 8.0.0.161 2008.09.22 Generic11.WMJ
BitDefender 7.2 2008.09.22 Win32.Virut.K
CAT-QuickHeal 9.50 2008.09.20 -
ClamAV 0.93.1 2008.09.22 W32.Virut-27
DrWeb 4.44.0.09170 2008.09.22 Win32.Virut.40
eSafe 7.0.17.0 2008.09.22 -
eTrust-Vet 31.6.6099 2008.09.22 -
Ewido 4.0 2008.09.22 -
F-Prot 4.4.4.56 2008.09.21 -
F-Secure 8.0.14332.0 2008.09.22 Virus.Win32.Virut.bq
Fortinet 3.113.0.0 2008.09.22 W32/Virut.BQ
GData 19 2008.09.22 Win32.Virut.K
Ikarus T3.1.1.34.0 2008.09.22 -
K7AntiVirus 7.10.467 2008.09.22 Virus.Win32.Virut.LJ
Kaspersky 7.0.0.125 2008.09.22 Virus.Win32.Virut.bq
McAfee 5389 2008.09.22 W32/Virut.j
Microsoft 1.3903 2008.09.22 Virus:Win32/Virut.AI
NOD32v2 3460 2008.09.22 Win32/Virut.NBF
Norman 5.80.02 2008.09.19 W32/Virut.BN
Panda 9.0.0.4 2008.09.22 Suspicious file
PCTools 4.4.2.0 2008.09.22 -
Prevx1 V2 2008.09.22 -
Rising 20.63.02.00 2008.09.22 -
Sophos 4.33.0 2008.09.22 -
Sunbelt 3.1.1660.1 2008.09.22 -
Symantec 10 2008.09.22 W32.Virut.W
TheHacker [removed].090 2008.09.20 -
TrendMicro 8.700.0.1004 2008.09.22 PE_VIRUT.LJ
VBA32 3.12.8.5 2008.09.22 Trojan.Win32.Agent.adzq
ViRobot 2008.9.22.1387 2008.09.22 -
VirusBuster 4.5.11.0 2008.09.22 Win32.Virut.Gen.4
Webwasher-Gateway 6.6.2 2008.09.22 Trojan.Crypt.XPACK.Gen
Additional information
File size: 180184 bytes
MD5…: cdd6fe8b3522871aa8f99dd299e4a4b7
SHA1..: ab23c405771c88ce0a4471e0cd6ec214fd9a7393
SHA256: e7181b84b005ccc53c4d25efdfa51c7edfbbb4a53772d466f4cb57ec37a6b0b6
SHA512: 28568f07df0d3e1b56fed8afcce2a4724792a28609d6bc42c1b0a94637fa475a
d8e1773fb7c37e675708349f593ae6bd9b0614e6f6beec37543c06d18cbe6903
PEiD..: -
TrID..: File type identification
Generic Win/DOS Executable (49.9%)
DOS Executable Generic (49.8%)
Autodesk FLIC Image File (extensions: flc, fli, cel) (0.1%)
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x42c1d8
timedatestamp…..: 0x48cb1505 (Sat Sep 13 01:19:01 2008)
machinetype…….: 0x14c (I386)

( 3 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x2203c 0x22200 6.43 9a63bcbaf833d628129caaff89d6377a
.rdata 0x24000 0x5bc4 0x5c00 5.95 9687aa81282e615c764898a0e857fe6d
.data 0x2a000 0x91d8 0x3fd8 5.81 6e49cb5fa09bdb97d924736e7f0a1d39

( 5 imports )
> KERNEL32.dll: GetTickCount, InitializeCriticalSection, EnterCriticalSection, LeaveCriticalSection, GetLocalTime, GetStdHandle, GetModuleFileNameA, LocalAlloc, CreateFileMappingA, GetLastError, MapViewOfFile, UnmapViewOfFile, OpenFileMappingA, CloseHandle, Sleep, InterlockedExchange, CreateMutexA, OpenMutexA, CreateProcessA, SetLastError, DeleteFileA, GetTempPathA, GetTempFileNameA, CopyFileA, SetFileAttributesA, InterlockedExchangeAdd, ExitProcess, WaitForSingleObject, lstrcmpiA, lstrcpynA, CreateEventA, SetEvent, CompareStringA, WaitForMultipleObjects, GetFileAttributesA, GetCommandLineA, GetConsoleScreenBufferInfo, SetConsoleTextAttribute, GetConsoleOutputCP, WriteConsoleA, TlsSetValue, CreateThread, ResumeThread, ExitThread, GetStartupInfoA, GetModuleHandleA, RtlUnwind, HeapCreate, HeapDestroy, HeapAlloc, HeapReAlloc, HeapFree, HeapSize, HeapValidate, DeleteCriticalSection, CreateFileA, TlsAlloc, GetCurrentThreadId, TlsFree, TlsGetValue, MultiByteToWideChar, WideCharToMultiByte, UnhandledExceptionFilter, GetSystemTimeAsFileTime, GetFileType, GetCurrentProcess, DuplicateHandle, SetHandleCount, GetEnvironmentStrings, FreeEnvironmentStringsA, VirtualAlloc, VirtualQuery, GetConsoleMode, WriteFile, SetStdHandle, SetConsoleCtrlHandler, SetFilePointer, ReadFile, GetConsoleCP, SetEndOfFile
> ADVAPI32.dll: RegCreateKeyExA, RegSetValueExA, RegCloseKey, RegOpenKeyExA, RegDeleteKeyA, InitializeSecurityDescriptor, SetSecurityDescriptorDacl, GetUserNameA, RegQueryValueExA, OpenSCManagerA, OpenServiceA, CloseServiceHandle, QueryServiceStatus, ChangeServiceConfigA, ChangeServiceConfig2A, StartServiceA, CreateServiceA, DeleteService, SetServiceStatus, RegisterServiceCtrlHandlerA, StartServiceCtrlDispatcherA
> WSOCK32.dll: -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -
> iphlpapi.dll: GetIpForwardTable
> WININET.dll: InternetOpenA, InternetOpenUrlA, InternetCloseHandle, InternetReadFile

( 0 exports )



And there is a problem. The log of the http://www.eset.com/onlinescan/ i couldn`t open because.. there is no NOTEPAD on my computer. :| A lot of programs had lost there .exe . Don`t know really how to explain this but .. many programs ar now not working.
Post #10
hi golden fish,

i would use your computer as little as possible until its cleaned up. in fact you should pull the plug on your modem/router when not in use.

.exe . Don`t know really how to explain this but .. many programs ar now not working.

a virus infecting .exe

Did you consider reformatting/reinstalling windows? you have/had all the major categories of malware on your machine
did you install IRC to your computer? It could have been installed remotely if you didnt install it yourself.

go to start>run and type in cmd, click ok
at the prompt in the DOS window type;

sc stop LSIVS
click enter
sc delete LSIVS
click enter

we will delete some files in safe mode. to reach safe mode you would tap the f8 key during a computer restart. chose the first option from the list: safe mode.

copy/paste this part into notepad or wordpad if thats working. or write it down:
now boot computer into safe mode

in safe mode:
navigate to C:\WINDOWS\system32
look for and delete:
lsivs.exe
if found

look in C:/ Program Files and delete:
MplayerBest folder

also in safe mode:
Click Start>Run then type %temp%
Hit OK. Delete all the files you can.

click Start>Run then type %windir%\temp
hit ok. delete all the files you can

Empty your Temp folders. Go to Start > Run and type:cleanmgr. Windows will scan. When done check these 3 and press *ok* to remove:

Temporary Files
Temporary Internet Files
Recycle Bin

while you are in safe mode run malwarebytes once more.

———————————————
reboot normally your first stop is to get antivirus on your computer.
heres links to free av, get one of them downloaded, installed, updated. do a full scan of your computer:

http://www.avast.com/eng/free_virus_protectio.html
http://www.free-av.com/
http://free.avg.com/
http://www.clamwin.com/content/view/18/46/


after all that post a new hjt log.
Post #11
Ok. The windows that i`ve got.. is not licensed.

When y go to start > run > cmd. :) apeares a error.. like
"Windows cannot find 'cmd' . Make sure you typed the name correctly , and the try again. To serch for afile , click the Start Buton,and then click Serch ."


I think y will re-install windoes. :(

And a last advice.. tell me a -good antivirus for me. I don`t really utilise my computer for working. I use my worck computer for that. At home y just navigate and play some games. :( .

Tomorow i will reinstal my windows. and maybe y will pay more attention … I will use the
http://www.avast.com/eng/free_virus_protectio.html
http://www.free-av.com/
http://free.avg.com/
http://www.clamwin.com/content/view/18/46/
that you give to me . and y will be more attentif .. and tnx again.


Tnx for the advices… you are a great man. Good luck in your job.


p.s: sry for the bad english. but wtf :) its a free country. seeya
Post #12

windows that i`ve got.. is not licensed.

ive seen the XP black edition, never heard of the XP power edition

think y will re-install windoes

good, cause your machine is 0wned

At home y just navigate

somebody has been navigating– all over your computer and it wasnt you.

if you have a network, virus can spread to other computers and to usb flash drives. Get the basic core security applications: Antivirus, antimalware and firewall. and a legit license of windows.

info for you:

My Top Ten List
The Short Version:

1) Keep your OS, (Windows) browser (IE, FireFox) and other software up to date.
2) Know what you are installing to your computer. Alot of software can come bundled with unwanted add-ons. Do you trust the source?
3) Install, keep updated: one antivirus and two or three anti-malware applications.
4) Refrain from clicking on links or installing files you receive via E-Mail, IM, Chat Rooms or Social Sites, no matter how tempting or legitimate the message.
5) Don't click on ads/pop ups or offers from websites to install software to your computer.
6) Don't click on offers to "scan" your computer.
7) Set up and use limited accounts rather than administrator accounts.
8) Install and understand the limitations of a third party software firewall.
9) Consider using an alternate browser and E-mail client.
10) If your habits include visiting or downloading/installing files from: warez, crack sites or p2p (file sharing) networks: then you are much more likely to encounter malicious code. Do you trust the source?

happy safe surfing
Post #13
Now i have reinstalled my windows. The same Windows Xp Power Edition. Its a hacked version.. i`m from Romania.. you now that the romanians are the … biggest bastards when comes the problem of hack.. anyway … tnx again for the advices but .. 2 night ago.. when y real realized that the computer is OWNED..:) in the morning when y opened my Pc the windows ask for a ADMINSTRATOR USER password.:)) and when y tried to pres ESC or ENTER.. the pc shuts down.. anyway..tnx a gain. If you could tell me some FREE anti-virus programs or some anti spy-.ware. with regards ! The Golden Fish

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI