What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] antiviruspro2009 antiviruspro2008 url redirect problem

14 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Hi - New Member here with antiviruspro2009/8 problem. Running XP Pro SP3.

Initially I noticed machine self rebooted. Logged in, started getting all kinds of problems.
pop ups
fake antivirus scans
google search redirects (go.google….)
blocking of URL to all antivirus sites (cannot go to norton, avg, macafee, etc)
blocking of running some programs.

Ran my resident AVG 8 (probably a bit outdated) and cleaned it up some (AVG is now blocked from updates)
Downloaded and ran MBAM, see log below (now will not run)
Downloaded and ran HJT several times, latest log file below (runs OK)
Updated my HOSTS file (from MVPS.ORG)

NOW, some problems (popups, fake scans) are gone EXCEPT I still get URL blocking, search engine redirects, and inability to run/update/download most any kind of antivirus/spyware software. Cannot run resident MBAM anymore, and cannot seem to delete or reinstall it. Downloaded COMBOFIX on another computer, moved to it the sick one but it won't start up. Would appreciate any help!!!

This computer is a key machine for our business. I know I can rebuild it from scratch but am willing to put the effort in to get it clean to keep using it (if possible!)

———————————————————————————————————————————————–

Most recent HJT output:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:17:47 AM, on 11/11/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18241)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\brsvc01a.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\brss01a.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Promise\FastTrak\FtrakSvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\UPS\WSTD\MSSQL$UPSWSDBSERVER\Binn\sqlservr.exe
C:\Program Files\Sling Media\SlingAgent\SlingAgentService.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\UPS\WSTD\UPSNA1Msgr.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Express ClickYes\ClickYes.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe
C:\Program Files\Microsoft ActiveSync\Wcescomm.exe
C:\Program Files\NewTech Infosystems\NTI Shadow for ReadyNAS\Shadow.exe
C:\PROGRA~1\MICROS~3\rapimgr.exe
C:\Program Files\Google\Google Calendar Sync\GoogleCalendarSync.exe
C:\Program Files\Nikon\NkView6\NkvMon.exe
C:\UPS\WSTD\WSTDMessaging.exe
C:\Program Files\AucTamer\atamer.exe
C:\PROGRA~1\MICROS~2\OFFICE11\OUTLOOK.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [NA1Messenger] C:\UPS\WSTD\UPSNA1Msgr.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Express ClickYes] C:\Program Files\Express ClickYes\ClickYes.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [ISUSPM] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -scheduler
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\Wcescomm.exe"
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\User\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [Shadow] C:\Program Files\NewTech Infosystems\NTI Shadow for ReadyNAS\Shadow.exe –minimize
O4 - Startup: AuctionTamer.lnk = C:\Program Files\AucTamer\atamer.exe
O4 - Startup: E-mail.lnk = ?
O4 - Startup: Internet.lnk = ?
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Google Calendar Sync.lnk = C:\Program Files\Google\Google Calendar Sync\GoogleCalendarSync.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: NkvMon.exe.lnk = C:\Program Files\Nikon\NkView6\NkvMon.exe
O4 - Global Startup: QuickBooks Update Agent.lnk = C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
O4 - Global Startup: UPS WorldShip Messaging Utility.lnk = C:\UPS\WSTD\WSTDMessaging.exe
O4 - Global Startup: UPS WorldShip PLD Reminder Utility.lnk = C:\UPS\WSTD\wstdPldReminder.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite… - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: cgi.ebay.com
O15 - Trusted Zone: http://download.windowsupdate.com
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd…b?1210440667203
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1176843326984
O17 - HKLM\System\CCS\Services\Tcpip\..\{56A3EB9B-1A26-4599-88AC-9F9C5E31EBAB}: NameServer = 192.168.1.1
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\system32\brsvc01a.exe
O23 - Service: Promise FastTrak Log Service (FastTrakSvc) - Promise Technology Inc. - C:\Program Files\Promise\FastTrak\FtrakSvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Imapi Helper - Alex Feinman - C:\Program Files\Alex Feinman\ISO Recorder\ImapiHelper.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: SlingAgent Service (SlingAgentService) - Sling Media Inc. - C:\Program Files\Sling Media\SlingAgent\SlingAgentService.exe
O24 - Desktop Component 0: (no name) - file:///C:/DOCUME~1/User/LOCALS~1/Temp/msohtml1/01/clip_image002.jpg

–
End of file - 7608 bytes

———————————————————————————————————————————————–

Older output from MBAM (will not run anymore):

Malwarebytes' Anti-Malware 1.30
Database version: 1306
Windows 5.1.2600 Service Pack 3

11/10/2008 6:39:03 PM
mbam-log-2008-11-10 (18-39-03).txt

Scan type: Quick Scan
Objects scanned: 75200
Time elapsed: 8 minute(s), 52 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 3
Registry Values Infected: 1
Registry Data Items Infected: 2
Folders Infected: 0
Files Infected: 11

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\antiviruspro2009 (Rogue.Antivirus2008) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\tdssdata (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\tdss (Trojan.Agent) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\brastk (Trojan.FakeAlert) -> Quarantined and deleted successfully.

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Trojan.Agent) -> Data: c:\windows\system32\ -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Trojan.Agent) -> Data: system32\ -> Quarantined and deleted successfully.

Folders Infected:
(No malicious items detected)

Files Infected:
C:\WINDOWS\karna.dat (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\karna.dat (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\ (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\delself.bat (Malware.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\drivers\beep.sys (Fake.Beep.Sys) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\dllcache\beep.sys (Fake.Beep.Sys) -> Quarantined and deleted successfully.
C:\WINDOWS\brastk.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\_scui.cpl (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\wini10802.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\brastk.exe (Trojan.FakeAlert) -> Delete on reboot.
C:\Documents and Settings\User\Application Data\Microsoft\Internet Explorer\Quick Launch\AntivirusPro2009.lnk (Rogue.Antivirus2008) -> Quarantined and deleted successfully.
Post #2
I found the self help guide for this malware elsewhere, and did the following according to it's directions: Ran Erunt OK to save copy of registry (better late than never!?) Ran ATF cleaner OK (Main and Firefox-except for saved passwords) Downloaded new copy of MBAM-setup.exe and tried to run it, it won't start on the infected computer. Note I am having to download everything on a different uninfected computer, then I move the files to a thumb drive and then run then executables direct from the thumb drive on the infected computer. Still stuck in the swamp, surrounded by alligators, not sure what to do next. Hopefully there is some clue in the HJT log in the first post!
Post #3
Hi rtww2k,

:welcome:

My name is Tomk. I would be glad to take a look at your log and help you with solving any malware problems. HijackThis logs can take a while to research, so please be patient and I'd be grateful if you would note the following:

  • I will be working on your Malware issues, this may or may not, solve other issues you have with your machine.
  • The fixes are specific to your problem and should only be used for the issues on this machine.
  • Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
  • It's often worth reading through these instructions and printing them for ease of reference.
  • If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
  • Please reply to this thread. Do not start a new topic.

Please download SDFix and save it to your Desktop.

You should print out these instructions, or copy them to a NotePad file for reading while in Safe Mode, because you will not be able to connect to the Internet to read from this site.

Double click on SDFix.exe. It should automatically extract a folder called SDFix to your system drive (usually C:\). Please reboot your computer in Safe Mode by doing the following :
  • Restart your computer
  • After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key repeatedly;
  • Instead of Windows loading as normal, a menu with options should appear;
  • Select the first option, to run Windows in Safe Mode, then press "Enter".
  • Choose your usual user account.
  • Open the SDFix folder and double click on RunThis.bat to start the script.
  • Type Y and press Enter to begin the script.
  • It will start cleaning your PC and then prompt you to press any key to Reboot.
  • Press any key to restart the PC.
  • Your system will take longer than normal to restart as the fixtool will be removing files.
  • When the desktop loads the Fixtool will complete the removal and display Finished.
  • Press any key to end the script and to load your desktop icons.
  • A text file should automatically open, so please copy the contents and post them here. We also need you to post a new HijackThis log
Post #4
I downloaded SDFIX.exe to non infected computer. Ran fine there, created folder to make sure it ran OK. I
thumb drived SDFIX.exe to infected computer. Ran it, it starts, creates nothing, never finishes, never displays anything. I can see it in the taskmgr.exe window w/ 0% CPU. Killed it. Copied it from thumb to desktop. Ran it. Same problem. So I copied over the created folder from the non-infected to infected computer and YES was able to run it.

First run of SDFIX ran fine (in SAFE mode.)
Rebooted & logged in
It did not automatically start up so I ran it manually with "F" and it finished (in normal boot mode)

SDFix log file:


SDFix: Version 1.240
Run by [removed] on Tue 11/11/2008 at 11:34 AM

Microsoft Windows XP [Version 5.1.2600]
Running From: F:\SDFix

Checking Services :


Restoring Default Security Values
Restoring Default Hosts File

Rebooting


Checking Files :

Trojan Files Found:

C:\Program Files\Common Files\ijaqojirit._sy - Deleted
C:\DOCUME~1\User\LOCALS~1\Temp\TMP20.tmp - Deleted
C:\DOCUME~1\User\LOCALS~1\Temp\TMP5D.tmp - Deleted
C:\DOCUME~1\User\LOCALS~1\Temp\TMP76.tmp - Deleted
C:\DOCUME~1\User\LOCALS~1\Temp\TMP84.tmp - Deleted
C:\DOCUME~1\User\LOCALS~1\Temp\TMP8C.tmp - Deleted
C:\DOCUME~1\User\LOCALS~1\Temp\TMP91.tmp - Deleted
C:\DOCUME~1\User\LOCALS~1\Temp\TMPA2.tmp - Deleted
C:\DOCUME~1\User\LOCALS~1\Temp\TMPA6.tmp - Deleted
C:\DOCUME~1\User\LOCALS~1\Temp\TMPA7.tmp - Deleted
C:\DOCUME~1\User\LOCALS~1\Temp\TMPAE.tmp - Deleted
C:\DOCUME~1\User\LOCALS~1\Temp\TMPB0.tmp - Deleted
C:\DOCUME~1\User\LOCALS~1\Temp\TMPB9.tmp - Deleted
C:\DOCUME~1\User\LOCALS~1\Temp\TMPBF.tmp - Deleted
C:\DOCUME~1\User\LOCALS~1\Temp\TMPD.tmp - Deleted
C:\DOCUME~1\User\LOCALS~1\Temp\TMPD0.tmp - Deleted
C:\DOCUME~1\User\LOCALS~1\Temp\TMPDC.tmp - Deleted
C:\DOCUME~1\User\LOCALS~1\Temp\TMPE0.tmp - Deleted
C:\DOCUME~1\User\LOCALS~1\Temp\TMPF2.tmp - Deleted
C:\DOCUME~1\User\LOCALS~1\Temp\TMPFE.tmp - Deleted
C:\DOCUME~1\User\LOCALS~1\Temp\wrdwn5 - Deleted
C:\DOCUME~1\User\LOCALS~1\Temp\wrdwn6 - Deleted
C:\DOCUME~1\User\LOCALS~1\Temp\wrdwn7 - Deleted
C:\DOCUME~1\User\LOCALS~1\Temp\wrdwn8 - Deleted
C:\DOCUME~1\User\LOCALS~1\Temp\wrdwn9 - Deleted
C:\WINDOWS\system32\ygepuvu._sy - Deleted
C:\WINDOWS\system32\av.dat - Deleted


Could Not Remove C:\WINDOWS\system32\TDSSoiqh.dll
Could Not Remove C:\WINDOWS\system32\TDSShrsr.dll
Could Not Remove C:\WINDOWS\system32\TDSSriqp.dll
Could Not Remove C:\WINDOWS\system32\TDSSxfum.dll
Could Not Remove C:\WINDOWS\system32\TDSSlxwp.dll
Could Not Remove C:\WINDOWS\system32\TDSSorvd.dat
Could Not Remove C:\WINDOWS\system32\TDSSkkbi.log



Removing Temp Files

ADS Check :



Final Check :

disk not found C:\

please note that you need administrator rights to perform deep scan

Remaining Services :




Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\palmOne\\HOTSYNC.EXE"="C:\\Program Files\\palmOne\\HOTSYNC.EXE:*:Enabled:HotSyncr Manager Application"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\\Program Files\\Skype\\Phone\\Skype.exe"="C:\\Program Files\\Skype\\Phone\\Skype.exe:*:Enabled:Skype"
"C:\\Program Files\\Intuit\\QuickBooks Pro\\QBDBMgrN.exe"="C:\\Program Files\\Intuit\\QuickBooks Pro\\QBDBMgrN.exe:*:Enabled:QuickBooks 2006 Data Manager"
"C:\\Program Files\\TurboTax\\Premier 2007\\32bit\\ttax.exe"="C:\\Program Files\\TurboTax\\Premier 2007\\32bit\\ttax.exe:LocalSubNet:Enabled:TurboTax"
"C:\\Program Files\\TurboTax\\Premier 2007\\32bit\\updatemgr.exe"="C:\\Program Files\\TurboTax\\Premier 2007\\32bit\\updatemgr.exe:LocalSubNet:Enabled:TurboTax Update Manager"
"C:\\Program Files\\AVG\\AVG8\\avgupd.exe"="C:\\Program Files\\AVG\\AVG8\\avgupd.exe:*:Enabled:avgupd.exe"
"C:\\Program Files\\Logitech\\Logitech Harmony Remote Software 7\\HarmonyRemote.exe"="C:\\Program Files\\Logitech\\Logitech Harmony Remote Software 7\\HarmonyRemote.exe:*:Enabled:Logitech Harmony Remote Software 7"
"C:\\Program Files\\Microsoft ActiveSync\\rapimgr.exe"="C:\\Program Files\\Microsoft ActiveSync\\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager"
"C:\\Program Files\\Microsoft ActiveSync\\wcescomm.exe"="C:\\Program Files\\Microsoft ActiveSync\\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager"
"C:\\Program Files\\Microsoft ActiveSync\\WCESMgr.exe"="C:\\Program Files\\Microsoft ActiveSync\\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application"
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"="C:\\Program Files\\Bonjour\\mDNSResponder.exe:*:Enabled:Bonjour"
"C:\\Program Files\\iTunes\\iTunes.exe"="C:\\Program Files\\iTunes\\iTunes.exe:*:Enabled:iTunes"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\\Program Files\\Logitech\\Logitech Harmony Remote Software 7\\HarmonyRemote.exe"="C:\\Program Files\\Logitech\\Logitech Harmony Remote Software 7\\HarmonyRemote.exe:*:Enabled:Logitech Harmony Remote Software 7"
"C:\\Program Files\\Microsoft ActiveSync\\rapimgr.exe"="C:\\Program Files\\Microsoft ActiveSync\\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager"
"C:\\Program Files\\Microsoft ActiveSync\\wcescomm.exe"="C:\\Program Files\\Microsoft ActiveSync\\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager"
"C:\\Program Files\\Microsoft ActiveSync\\WCESMgr.exe"="C:\\Program Files\\Microsoft ActiveSync\\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application"

Remaining Files :

C:\WINDOWS\system32\TDSSoiqh.dll Found
C:\WINDOWS\system32\TDSShrsr.dll Found
C:\WINDOWS\system32\TDSSriqp.dll Found
C:\WINDOWS\system32\TDSSxfum.dll Found
C:\WINDOWS\system32\TDSSlxwp.dll Found
C:\WINDOWS\system32\TDSSorvd.dat Found
C:\WINDOWS\system32\TDSSkkbi.log Found

File Backups: - F:\SDFix\backups\backups.zip

Files with Hidden Attributes :

Tue 30 Nov 2004 253,952 A..HR — "C:\DRIVERS\PocketCache Trial Version\BackupRestoreBus.dll"
Wed 17 Sep 2008 1,024 …HR — "C:\WINDOWS\system32\NTSHDW3.dll"
Tue 6 Feb 2007 4,348 A.SH. — "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
Fri 29 Oct 2004 53,248 A..H. — "C:\DRIVERS\SecurDataStorRM\Files\CopyFile.exe"
Fri 29 Oct 2004 30,133 A..H. — "C:\DRIVERS\SecurDataStorRM\Files\msghxx.dllz"
Fri 29 Oct 2004 180,700 A..H. — "C:\DRIVERS\SecurDataStorRM\Files\MSVCR71.DLLz"
Fri 29 Oct 2004 1,671,168 A..H. — "C:\DRIVERS\SecurDataStorRM\Files\SecurDataStor.exe"
Fri 29 Oct 2004 84,576 A..H. — "C:\DRIVERS\SecurDataStorRM\Files\Viewer.exez"
Wed 15 Aug 2007 169 A..H. — "C:\Program Files\InterActual\InterActual Player\iti84.tmp"
Wed 27 Aug 2008 0 A.SH. — "C:\Documents and Settings\All Users\DRM\Cache\Indiv02.tmp"
Sat 19 Aug 2006 82,944 A..H. — "C:\Documents and Settings\User\My Documents\IDEAL TECHNOLOGY\~WRL4001.tmp"
Fri 18 Jan 2008 24,758,792 A..H. — "C:\WINDOWS\SoftwareDistribution.old\Download\585dc2612ebcefc90e7dee4c276ee95e\BIT22.tmp"
Sun 23 Sep 2007 0 A..H. — "C:\WINDOWS\SoftwareDistribution.old\Download\cf7ced0e70c80a1e476f1abf49afecb1\BIT16.tmp"

Finished!


———————————————————————–
HJT Log file:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:57:05 AM, on 11/11/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18241)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\brsvc01a.exe
C:\WINDOWS\system32\brss01a.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Promise\FastTrak\FtrakSvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\UPS\WSTD\MSSQL$UPSWSDBSERVER\Binn\sqlservr.exe
C:\Program Files\Sling Media\SlingAgent\SlingAgentService.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\UPS\WSTD\UPSNA1Msgr.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Microsoft ActiveSync\Wcescomm.exe
C:\Documents and Settings\User\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
C:\Program Files\NewTech Infosystems\NTI Shadow for ReadyNAS\Shadow.exe
C:\PROGRA~1\MICROS~3\rapimgr.exe
C:\Program Files\Nikon\NkView6\NkvMon.exe
C:\UPS\WSTD\WSTDMessaging.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [NA1Messenger] C:\UPS\WSTD\UPSNA1Msgr.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Express ClickYes] C:\Program Files\Express ClickYes\ClickYes.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [ISUSPM] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -scheduler
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\Wcescomm.exe"
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\User\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [Shadow] C:\Program Files\NewTech Infosystems\NTI Shadow for ReadyNAS\Shadow.exe –minimize
O4 - Startup: AuctionTamer.lnk = C:\Program Files\AucTamer\atamer.exe
O4 - Startup: E-mail.lnk = ?
O4 - Startup: Internet.lnk = ?
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Google Calendar Sync.lnk = C:\Program Files\Google\Google Calendar Sync\GoogleCalendarSync.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: NkvMon.exe.lnk = C:\Program Files\Nikon\NkView6\NkvMon.exe
O4 - Global Startup: QuickBooks Update Agent.lnk = C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
O4 - Global Startup: UPS WorldShip Messaging Utility.lnk = C:\UPS\WSTD\WSTDMessaging.exe
O4 - Global Startup: UPS WorldShip PLD Reminder Utility.lnk = C:\UPS\WSTD\wstdPldReminder.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite… - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: cgi.ebay.com
O15 - Trusted Zone: http://download.windowsupdate.com
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd…b?1210440667203
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1176843326984
O17 - HKLM\System\CCS\Services\Tcpip\..\{56A3EB9B-1A26-4599-88AC-9F9C5E31EBAB}: NameServer = 192.168.1.1
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\system32\brsvc01a.exe
O23 - Service: Promise FastTrak Log Service (FastTrakSvc) - Promise Technology Inc. - C:\Program Files\Promise\FastTrak\FtrakSvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Imapi Helper - Alex Feinman - C:\Program Files\Alex Feinman\ISO Recorder\ImapiHelper.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: SlingAgent Service (SlingAgentService) - Sling Media Inc. - C:\Program Files\Sling Media\SlingAgent\SlingAgentService.exe
O24 - Desktop Component 0: (no name) - file:///C:/DOCUME~1/User/LOCALS~1/Temp/msohtml1/01/clip_image002.jpg

–
End of file - 7406 bytes
Post #5
rtww2k,

Good job getting SDFix to run. It appears it ran from your thumb drive (F: drive). Unfortunately it wasn't able to kill everything it found.
Let's get a different look at those nasty rootkits!

Disable resident protections (Antivirus…); you'll re-enable them after the scan

Download Lop S&D < here

Double-click Lop S&D.exe
Choose the language, then choose Option 1 (Search)
Wait till the end of the scan
Post the log which is created: (%SystemDrive%\lopR.txt)
Post #6
Ran cleanly, here are the results: ——————–\\ Lop S&D 4.2.4-9c XP/Vista Microsoft Windows XP Professional ( v5.1.2600 ) Service Pack 3 X86-based PC ( Uniprocessor Free : Intel® Pentium® 4 CPU 2.80GHz ) BIOS : Award Modular BIOS v6.0 USER : User ( Administrator ) BOOT : Normal boot Antivirus : AVG Anti-Virus Free 8.0 (Not Activated) A:\ (USB) C:\ (Local Disk) - NTFS - Total:111 Go (Free:78 Go) D:\ (CD or DVD) E:\ (Local Disk) - NTFS - Total:37 Go (Free:9 Go) F:\ (USB) - FAT - Total:1906 Mo (Free:1 Go) "C:\Lop SD" ( MAJ : 01-11-2008|16:30 ) Option : [1] ( Tue 11/11/2008|12:50 ) ——————–\\ Listing folders in APPLIC~1 [09/25/2006|04:23] C:\DOCUME~1\ADMINI~1\APPLIC~1\ Adobe [09/25/2006|04:23] C:\DOCUME~1\ADMINI~1\APPLIC~1\ AdobeUM [11/11/2008|06:25] C:\DOCUME~1\ADMINI~1\APPLIC~1\ Apple Computer [11/11/2008|06:26] C:\DOCUME~1\ADMINI~1\APPLIC~1\ Identities [05/10/2008|02:18] C:\DOCUME~1\ADMINI~1\APPLIC~1\ Microsoft [11/11/2008|07:03] C:\DOCUME~1\ADMINI~1\APPLIC~1\ Mozilla [10/14/2008|11:49] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ {3276BE95_AF08_429F_A64F_CA64CB79BCF6} [05/15/2008|04:53] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Adobe [08/05/2007|03:54] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Apple [09/17/2006|05:57] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Apple Computer [11/10/2008|03:22] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ avg8 [10/17/2006|11:17] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ eFax Messenger 4.2 Setup [08/24/2007|07:18] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Google [12/12/2007|10:49] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Ilium Software [02/21/2008|09:21] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ InstallShield [01/24/2008|04:33] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Intuit [11/10/2008|06:17] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Malwarebytes [11/05/2008|10:40] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Microsoft [12/19/2007|07:51] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Microsoft Corporation [11/05/2008|10:41] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Microsoft Help [04/17/2007|02:08] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Office Genuine Advantage [08/26/2008|07:21] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Pure Networks [05/09/2008|07:38] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ SkyGolf [02/03/2007|05:38] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Skype [08/26/2008|07:08] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Sling Media [01/30/2008|03:02] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Symantec [11/01/2008|05:41] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ TEMP [08/16/2006|06:47] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Windows Genuine Advantage [08/19/2006|09:44] C:\DOCUME~1\Bonnie\APPLIC~1\ Adobe [08/19/2006|10:16] C:\DOCUME~1\Bonnie\APPLIC~1\ AdobeUM [08/19/2006|09:38] C:\DOCUME~1\Bonnie\APPLIC~1\ Identities [08/19/2006|10:12] C:\DOCUME~1\Bonnie\APPLIC~1\ Macromedia [05/10/2008|02:18] C:\DOCUME~1\Bonnie\APPLIC~1\ Microsoft [08/19/2006|09:39] C:\DOCUME~1\Bonnie\APPLIC~1\ Mozilla [08/19/2006|09:39] C:\DOCUME~1\Bonnie\APPLIC~1\ Talkback [12/01/2007|03:01] C:\DOCUME~1\DEFAUL~1\APPLIC~1\ Microsoft [12/30/2007|05:30] C:\DOCUME~1\Guest\APPLIC~1\ Identities [12/30/2007|05:33] C:\DOCUME~1\Guest\APPLIC~1\ Intuit [12/30/2007|05:32] C:\DOCUME~1\Guest\APPLIC~1\ Macromedia [05/10/2008|02:18] C:\DOCUME~1\Guest\APPLIC~1\ Microsoft [12/30/2007|05:33] C:\DOCUME~1\Guest\APPLIC~1\ Mozilla [12/30/2007|05:35] C:\DOCUME~1\Guest\APPLIC~1\ Talkback [05/10/2008|02:18] C:\DOCUME~1\LOCALS~1\APPLIC~1\ Microsoft [05/10/2008|02:18] C:\DOCUME~1\NETWOR~1\APPLIC~1\ Microsoft [01/30/2008|02:05] C:\DOCUME~1\User\APPLIC~1\ Adobe [05/15/2008|04:52] C:\DOCUME~1\User\APPLIC~1\ AdobeUM [03/19/2008|05:40] C:\DOCUME~1\User\APPLIC~1\ Apple Computer [08/18/2006|03:36] C:\DOCUME~1\User\APPLIC~1\ Arcsoft [05/10/2008|01:51] C:\DOCUME~1\User\APPLIC~1\ AVGTOOLBAR [12/15/2006|09:13] C:\DOCUME~1\User\APPLIC~1\ COWON [10/17/2006|11:17] C:\DOCUME~1\User\APPLIC~1\ eFax Messenger [08/18/2006|04:05] C:\DOCUME~1\User\APPLIC~1\ Help [08/16/2006|05:08] C:\DOCUME~1\User\APPLIC~1\ Identities [12/12/2007|10:45] C:\DOCUME~1\User\APPLIC~1\ Ilium Software [04/03/2008|05:04] C:\DOCUME~1\User\APPLIC~1\ InfraRecorder [03/03/2008|05:50] C:\DOCUME~1\User\APPLIC~1\ InstallShield [01/24/2008|04:34] C:\DOCUME~1\User\APPLIC~1\ Intuit [08/18/2006|04:14] C:\DOCUME~1\User\APPLIC~1\ Macromedia [11/10/2008|06:17] C:\DOCUME~1\User\APPLIC~1\ Malwarebytes [11/05/2008|10:44] C:\DOCUME~1\User\APPLIC~1\ Microsoft [09/02/2008|07:48] C:\DOCUME~1\User\APPLIC~1\ Mozilla [08/17/2006|02:15] C:\DOCUME~1\User\APPLIC~1\ Nikon [04/17/2007|02:30] C:\DOCUME~1\User\APPLIC~1\ OfficeUpdate12 [12/28/2007|07:19] C:\DOCUME~1\User\APPLIC~1\ RemoteCalendars [09/17/2008|08:32] C:\DOCUME~1\User\APPLIC~1\ Research In Motion [09/11/2008|06:38] C:\DOCUME~1\User\APPLIC~1\ Roxio [04/22/2007|07:56] C:\DOCUME~1\User\APPLIC~1\ Skype [08/18/2006|05:33] C:\DOCUME~1\User\APPLIC~1\ SmartFTP [10/03/2006|09:28] C:\DOCUME~1\User\APPLIC~1\ Sun [02/21/2007|01:02] C:\DOCUME~1\User\APPLIC~1\ Symantec [08/16/2006|05:11] C:\DOCUME~1\User\APPLIC~1\ Talkback ——————–\\ Scheduled Tasks located in C:\WINDOWS\Tasks [11/04/2008 11:43 AM][–a——] C:\WINDOWS\tasks\AppleSoftwareUpdate.job [11/11/2008 11:47 AM][–ah—–] C:\WINDOWS\tasks\SA.DAT [08/28/2002 10:00 PM][-r-h—–] C:\WINDOWS\tasks\desktop.ini ——————–\\ Listing Folders in C:\Program Files [08/16/2006|07:49] C:\Program Files\ Adobe [09/07/2006|03:18] C:\Program Files\ Alex Feinman [08/06/2008|03:39] C:\Program Files\ Apple Software Update [11/11/2008|11:50] C:\Program Files\ AucTamer [05/10/2008|01:51] C:\Program Files\ AVG [02/06/2007|07:52] C:\Program Files\ BidTamer [09/14/2008|08:41] C:\Program Files\ Bonjour [01/25/2008|09:37] C:\Program Files\ Brother [10/27/2008|09:10] C:\Program Files\ BurnAware Free [02/29/2008|06:52] C:\Program Files\ Canon [11/11/2008|11:41] C:\Program Files\ Common Files [08/16/2006|04:58] C:\Program Files\ ComPlus Applications [08/18/2006|09:24] C:\Program Files\ eBay [10/17/2006|11:17] C:\Program Files\ eFax Messenger 4.2 [11/11/2008|10:47] C:\Program Files\ ERUNT [09/20/2006|02:15] C:\Program Files\ Express ClickYes [11/11/2008|12:22] C:\Program Files\ Google [08/17/2006|03:00] C:\Program Files\ Hewlett-Packard [12/12/2007|10:45] C:\Program Files\ Ilium Software [04/02/2008|04:54] C:\Program Files\ InfraRecorder [10/31/2008|07:55] C:\Program Files\ InstallShield Installation Information [04/17/2007|07:45] C:\Program Files\ InterActual [09/01/2008|01:41] C:\Program Files\ Internet Explorer [08/24/2006|06:10] C:\Program Files\ Intuit [10/14/2008|11:48] C:\Program Files\ iPod [09/21/2006|06:34] C:\Program Files\ iriver [10/14/2008|11:49] C:\Program Files\ iTunes [08/02/2008|03:22] C:\Program Files\ Java [12/15/2006|09:13] C:\Program Files\ JetAudio [09/18/2008|08:53] C:\Program Files\ JL_Cmder [08/19/2006|05:50] C:\Program Files\ kAuction [05/12/2008|10:52] C:\Program Files\ Logitech [10/05/2007|02:17] C:\Program Files\ LSoft Technologies [08/22/2008|01:15] C:\Program Files\ Messenger [08/28/2008|05:17] C:\Program Files\ Microsoft ActiveSync [05/09/2007|09:49] C:\Program Files\ Microsoft CAPICOM 2.1.0.2 [08/16/2006|05:02] C:\Program Files\ microsoft frontpage [10/19/2008|03:19] C:\Program Files\ Microsoft Office [10/31/2008|07:46] C:\Program Files\ Microsoft SQL Server [11/05/2008|09:52] C:\Program Files\ Microsoft Visual Studio [11/05/2008|10:39] C:\Program Files\ Microsoft Visual Studio 8 [08/16/2006|05:46] C:\Program Files\ Microsoft.NET [05/10/2008|11:16] C:\Program Files\ Movie Maker [11/11/2008|12:02] C:\Program Files\ Mozilla Firefox [10/19/2008|03:18] C:\Program Files\ MSECACHE [08/16/2006|04:57] C:\Program Files\ MSN [08/16/2006|04:58] C:\Program Files\ MSN Gaming Zone [10/20/2007|03:01] C:\Program Files\ MSXML 4.0 [08/15/2007|03:02] C:\Program Files\ MSXML 6.0 [09/12/2008|01:17] C:\Program Files\ NETGEAR ReadyNAS [05/10/2008|11:13] C:\Program Files\ NetMeeting [09/17/2008|03:24] C:\Program Files\ NewTech Infosystems [08/17/2006|02:15] C:\Program Files\ Nikon [09/16/2008|05:34] C:\Program Files\ No-IP [02/10/2008|05:52] C:\Program Files\ Norton AntiVirus [08/16/2006|05:00] C:\Program Files\ Online Services [05/10/2008|11:13] C:\Program Files\ Outlook Express [03/15/2008|08:56] C:\Program Files\ palmOne [09/03/2008|05:49] C:\Program Files\ Promise [05/19/2008|03:49] C:\Program Files\ Quicken [09/14/2008|08:41] C:\Program Files\ QuickTime [09/17/2008|08:31] C:\Program Files\ Research In Motion [10/14/2008|11:44] C:\Program Files\ Safari [09/22/2008|08:20] C:\Program Files\ SG2 [05/09/2008|07:38] C:\Program Files\ SkyGolf [02/03/2007|05:38] C:\Program Files\ Skype [08/26/2008|07:08] C:\Program Files\ Sling Media [11/22/2007|07:14] C:\Program Files\ SmartFTP Client 2.0 [08/13/2008|10:12] C:\Program Files\ SmartFTP Client 2.0 Setup Files [08/02/2008|03:22] C:\Program Files\ Sun [09/07/2007|04:46] C:\Program Files\ Symbol OPOS Driver [11/11/2008|12:05] C:\Program Files\ Trend Micro [08/18/2006|01:25] C:\Program Files\ TTERMPRO [01/05/2008|06:00] C:\Program Files\ TurboTax [08/16/2006|05:08] C:\Program Files\ Uninstall Information [03/03/2008|07:54] C:\Program Files\ Windows Installer Clean Up [12/13/2006|03:56] C:\Program Files\ Windows Media Connect 2 [08/27/2008|05:13] C:\Program Files\ Windows Media Player [05/10/2008|11:13] C:\Program Files\ Windows NT [08/16/2006|05:00] C:\Program Files\ WindowsUpdate [02/26/2008|05:02] C:\Program Files\ WinZip [08/16/2006|05:02] C:\Program Files\ xerox ——————–\\ Listing Folders in C:\Program Files\Common Files [05/15/2008|04:53] C:\Program Files\Common Files\ Adobe [01/05/2008|06:02] C:\Program Files\Common Files\ AnswerWorks 4.0 [09/14/2008|08:40] C:\Program Files\Common Files\ Apple [12/15/2006|09:10] C:\Program Files\Common Files\ COWON [08/16/2006|05:45] C:\Program Files\Common Files\ DESIGNER [02/21/2008|09:19] C:\Program Files\Common Files\ InstallShield [10/19/2007|06:14] C:\Program Files\Common Files\ Intuit [10/03/2006|09:27] C:\Program Files\Common Files\ Java [10/29/2006|07:13] C:\Program Files\Common Files\ L&H [11/05/2008|10:39] C:\Program Files\Common Files\ Merge Modules [11/05/2008|10:39] C:\Program Files\Common Files\ Microsoft Shared [08/16/2006|04:59] C:\Program Files\Common Files\ MSSoap [08/17/2006|02:15] C:\Program Files\Common Files\ Nikon [12/31/2001|07:04] C:\Program Files\Common Files\ ODBC [05/12/2008|10:53] C:\Program Files\Common Files\ Remote Control Software Common [05/12/2008|10:52] C:\Program Files\Common Files\ Remote Control USB Driver [09/17/2008|08:36] C:\Program Files\Common Files\ Research In Motion [09/11/2008|06:43] C:\Program Files\Common Files\ Roxio Shared [08/16/2006|04:59] C:\Program Files\Common Files\ Services [02/03/2007|05:38] C:\Program Files\Common Files\ Skype [02/21/2008|09:21] C:\Program Files\Common Files\ Sonic Shared [12/31/2001|07:04] C:\Program Files\Common Files\ SpeechEngines [09/05/2007|02:41] C:\Program Files\Common Files\ SWF Studio [02/10/2008|05:52] C:\Program Files\Common Files\ Symantec Shared [05/10/2008|11:13] C:\Program Files\Common Files\ System ——————–\\ Process ( 45 Processes ) … OK ! ——————–\\ Searching with S_Lop No Lop folder found ! ——————–\\ Searching for Lop Files - Folders No Lop folder found ! ——————–\\ Searching within the Registry ….. OK ! ——————–\\ Checking the Hosts file Hosts file CLEAN ——————–\\ Searching for hidden files with Catchme disk not found C:\ please note that you need administrator rights to perform deep scan ——————–\\ Searching for other infections ——————–\\ ROOTKIT !! Rootkit Tibs ! .. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_TDSSSERV.SYS] Rootkit Tibs ! .. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_TDSSSERV.SYS] Rootkit Tibs ! .. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_TDSSSERV.SYS] [F:133][D:100]-> C:\DOCUME~1\User\LOCALS~1\Temp [F:10][D:0]-> C:\DOCUME~1\User\Cookies [F:184][D:4]-> C:\DOCUME~1\User\LOCALS~1\TEMPOR~1\content.IE5 1 - "C:\Lop SD\LopR_1.txt" - Tue 11/11/2008|12:51 - Option : [1] ——————–\\ Scan completed at 12:51:51
Post #7
rtww2k,

Please download the OTMoveIt3 by OldTimer.
  • Save it to your desktop.
  • Please double-click OTMoveIt3.exe to run it. (Note: If you are running on Vista, right-click on the file and choose Run As Administrator).
  • Copy the lines in the codebox below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):

    :Processes
explorer.exe

:Services

:Reg
[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_TDSSSERV.SYS]
[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_TDSSSERV.SYS]
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_TDSSSERV.SYS]

:Files
C:\WINDOWS\system32\TDSSoiqh.dll
C:\WINDOWS\system32\TDSShrsr.dll
C:\WINDOWS\system32\TDSSriqp.dll
C:\WINDOWS\system32\TDSSxfum.dll
C:\WINDOWS\system32\TDSSlxwp.dll
C:\WINDOWS\system32\TDSSorvd.dat
C:\WINDOWS\system32\TDSSkkbi.log

:Commands
[purity]
[emptytemp]
[start explorer]
[Reboot]
  • Return to OTMoveIt3, right click in the "Paste Instructions for Items to be Moved" window (under the yellow bar) and choose Paste.
  • Click the red Moveit! button.
  • Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
  • Close OTMoveIt3
Note: If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes. In this case, after the reboot, open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTMoveIt\MovedFiles folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post.
Post #8
Ran as suggested. I requested roboot, so I did it. On restart, XP moaned about missing something ("Files that are required for Windows to run properly ave been replaced by unrecognized versions. To maintain system stability, Window must restore the original versions of these files. Insert your Windows XP Professional CD-ROM now"). I do NOT have a good feeling about this I think the malware has reared it's ugly head. FYI prior to OTmoveit3, I checked and the URL redirections and google redirections were GONE. After last reboot, they are BACK. Login was not very clean, I checked and some drivers are have yellow exclamation points by them. One is USB root hub, and because of that I cannot move the log file to the uninfected computer. So I rebooted with F8 Safe mode, and it freezes at a corrupt system32\DRIVERS\pci.sys. It says I can repair this by starting windows setup but I am not going to do more until I get recommendations…. (I think from here on whenever there is a reboot I should do it with F8/SAFE mode, yes? I have a feeling that restarting in normal mode allowed the malware to do something very bad.) Awaiting directions….. should I try XP repair from XP SP2 CD or ?? I think I can reboot in normal mode and email log files to you…. thanks!!!
Post #9
rtww2k,

Restart like you are going into safe mode but, instead of choosing Safe Mode, chose Last Known Good Configuration.

If this works, please try to run SDFix again.
Post #10
That method stops right away with error: could not start because following file is missing: or corrupt: system32\DRIVERS\pci.sys. You can attempt to repair this file by starting Windows Setup using the original Setup CD-ROM. select 'r' at the first screen to start repair." FYI I now have XP Pro SP3 on this machine. I do NOT have the original install CD, it was scratched, and I recently ordered an as of yet unused replacement from Microsoft, it is XP Pro SP2. What next?
Post #11
rtww2k, That file is related to plug and play devices. I'd like you to try two things: First, try unplugging all peripheral devices and see if your computer will start. Second, try using your SP2 CD as I don't think that file changed between the two. Let me know how you go.
Post #12
Tomk, thanks for your help so far. Sigh, we have gone from bad to worse over here. Unplugged peripherals makes no difference. Figured out how to restore a single file (PCI.SYS) from XP install cd to C: drive using restore console (EXPAND command). Restored it. rebooted safe again, next file missing is ISAPNP.SYS. Restored it. Rebooted, next file missing is NTFS.SYS. getting nowhere fast. compared system32\drivers directory on infected machine to non-infected, it is clear there are MANY files missing from the infected, and installing them one by one is tedious and I am not sure it will be successfull (XP2 CD vs XP3 on C:). Tried rebooting normal (not SAFE mode), it hangs on the same missing NTFS.SYS file. Seems I now have an OS that is partial. I suppose the malware may have gotten mad and started deleting files (is this something ANTIVIRUSPRO2009 does?), or maybe OTMoveit3 did it? Or perhaps a bad hard drive (no errors or other indications of this). Ideas at this point? Is there any hope in saving this installation? I do not know how to proceed to do this… I could put a new drive in the machine, get it built up w/ XP, installed TBD antivirus/spy SW, and then mount infected drive as 2nd drive and clean it if malware then copy data files off it? Or maybe use scannow somehow (problem here is I have only XP2 CD, and XP3 is installed). If I do this I still will need to tackle malware. Awaiting any ideas……thanks! What a nasty piece of malware!!!
Post #13
rtww2k, I don't believe that the files are actually gone but it doesn't make any difference. I believe them stinking rootkits are hiding your files. Your computer therefore thinks they are gone so it works out the same. ANTIVIRUSPRO2009 doesn't do this, but it brings "friends" with it that do. Please go ahead and do a repair install with your windows SP2. The down side is you will have to install a lot of windows updates once we have you cleaned up.
Post #14
Repair installed of XP failed miserably. My XP SP2 install CD would not work with my XP SP3 installation on infected computer.

I made a decision to give up fighting this malware rootkit mess. It wins. Despite really good help from you, (thanks TOMK!), after it appears to have been beaten it apparently wiped out or hid a number of files in system32/drivers directory rendering my machine unbootable. Looking back I think I may have opened the door for this malware by
turning off some functions of AVG due to perceived slowness (Linkscanner and maybe more). I will leave these on in the future.


So I have yanked the drive out of the infected computer, put in new drive. Fresh installation of XP SP2 from install CD. Loaded a couple of programs from CDs, installed latest AVG antivirus/antispyware, updated HOSTS file from MVPS, mounted the infected drive through USB-IDE interface (Apricorn DriveWire), and copied over user data files. I pray I did not bring over any virus files.

So far the newly build drive is running squeeky clean. AVG scans show it is clean. Just for kicks I have included below HJT log file from newly formatted drive.

TomK, if you have any other comments or suggestions on other utilities/programs/etc that should be set up on the newly installed drive, I would much appreciate it. Thanks for all the help.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:56:37 AM, on 11/12/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\WINDOWS\system32\SETARRAY.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\Program Files\Google\Google Calendar Sync\GoogleCalendarSync.exe
C:\PROGRA~1\MICROS~3\rapimgr.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [SetArray] SETARRAY.EXE
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
O4 - Global Startup: Google Calendar Sync.lnk = C:\Program Files\Google\Google Calendar Sync\GoogleCalendarSync.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite… - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{90C6B15E-8CB2-49EA-A350-D42901236172}: NameServer = 192.168.1.1
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: avgrsstx.dll
O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe

–
End of file - 3441 bytes
Post #15
rtww2k,

Sorry it turned out this way. :rant2:

Some general reccomendations are as follows: (Use what you want, pat yourself on the back for what you're already doing)

  • Make your Internet Explorer more secure - This can be done by following these simple instructions:
    • From within Internet Explorer click on the Tools menu and then click on Options.
    • Click once on the Security tab
    • Click once on the Internet icon so it becomes highlighted.
    • Click once on the Custom Level button.
    • Change the Download signed ActiveX controls to Prompt
    • Change the Download unsigned ActiveX controls to Disable
    • Change the Initialize and script ActiveX controls not marked as safe to Disable
    • Change the Installation of desktop items to Prompt
    • Change the Launching programs and files in an IFRAME to Prompt
    • Change the Navigate sub-frames across different domains to Prompt
    • When all these settings have been made, click on the OK button.
    • If it prompts you as to whether or not you want to save the settings, press the Yes button.
  • Next press the Apply button and then the OK to exit the Internet Properties page.


Update your AntiVirus Software - It is imperative that you update your Antivirus software at least once a week
(Even more if you wish). If you do not update your antivirus software then it will not be able to catch any of the new variants that may come out.

Use a Firewall - I can not stress how important it is that you use a Firewall on your computer.
Without a firewall your computer is succeptible to being hacked and taken over.
I am very serious about this and see it happen almost every day with my clients.
Simply using a Firewall in its default configuration can lower your risk greatly.

For a tutorial on Firewalls and a listing of some available ones see the link below:

Understanding and Using Firewalls

Keep Microsoft Windows Updated - This will ensure your computer has always the latest security updates available installed on your computer. The easiest way to do this is to turn on Automatic Updates. Do this by:
  • From your desktop, right-click on My Computer,
  • click on Properties
  • Select the Automatic Updates tab
  • Click on Automatic
  • Click on Apply button
  • Click on OK to exit.
If there are new updates to install, install them immediately, until there are no more critical updates.

Install SpywareBlaster - SpywareBlaster will add a large list of programs and sites into your Internet Explorer
settings that will protect you from running and downloading known malicious programs.

A tutorial on installing & using this product can be found here:

Using SpywareBlaster to protect your computer from Spyware and Malware

Download and install the free version of WinPatrol - This program protects your computer in a variety of ways and will work well with your existing security software.
Winpatrol


Update all these programs regularly - Make sure you update all the programs I have listed regularly.
Without regular updates you WILL NOT be protected when new malicious programs are released.


Only run one Anti-Virus and Firewall program.

I would also suggest you read this:
So how did I get infected in the first place?
by Tony Klein


Also: "How to prevent malware"
by miekiemoes

Please respond back that you understand the above and let me know if you have any questions. Otherwise, this thread will be closed Resolved. :thumbup:

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI