[Resolved] Infected System Volume Information Restore?

Hi Vectris.

Let's have a quick look at your system.

Please download DDS and save it to your desktop.

• Disable any script blocking protection
• Double click dds.scr to run the tool.
• When done, DDS.txt will open.
• Click Yes at the next prompt for Optional Scan.
• Save both reports to your desktop.

—————————————————

• Post the contents of the DDS.txt report in your next reply
• Attach the Attach.txt report to your post by scroling down to the Attachments area and then clicking Browse. Browse to where you saved the file, and click Open and the click UPLOAD.

Thanks.

Ok here are the logs. DDS (Version 1.0) - NTFSx86 Run by [removed] at 17:36:49.60 on Mon 11/17/2008 Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1023.569 [GMT -5:00] ============== Running Processes =============== C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost -k DcomLaunch svchost.exe C:\WINDOWS\System32\svchost.exe -k netsvcs C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\RunDll32.exe C:\PROGRA~1\AVG\AVG8\avgtray.exe C:\Program Files\Firefox Preloader\FirefoxPreloader.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe C:\WINDOWS\system32\CTsvcCDA.exe C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe C:\WINDOWS\System32\svchost.exe -k HPZ12 C:\WINDOWS\system32\slserv.exe C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe C:\WINDOWS\System32\svchost.exe -k imgsvc C:\WINDOWS\system32\MsPMSPSv.exe C:\PROGRA~1\AVG\AVG8\avgrsx.exe C:\Program Files\iPod\bin\iPodService.exe svchost.exe C:\Documents and Settings\Daniel\Desktop\dds.scr ============== Psuedo HJT Report =============== uStart Page = hxxp://www.google.com mStart Page = hxxp://www.google.com uInternet Connection Wizard,ShellNext = iexplore uInternet Settings,ProxyOverride = *.local BHO: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll BHO: {3049C3E9-B461-4BC5-8870-4C09146192CA} - c:\program files\real\realplayer\rpbrowserrecordplugin.dll BHO: {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - c:\program files\avg\avg8\avgssie.dll BHO: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\program files\java\jre1.6.0_07\bin\ssv.dll BHO: {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - c:\program files\google\googletoolbarnotifier\4.1.805.4472\swg.dll uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe mRun: [ATIModeChange] Ati2mdxx.exe mRun: [ATIPTA] c:\program files\ati technologies\ati control panel\atiptaxx.exe mRun: [SynTPLpr] c:\program files\synaptics\syntp\SynTPLpr.exe mRun: [SynTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe mRun: [SbUsb AudCtrl] RunDll32 sbusbdll.dll,RCMonitor mRun: [CTDVDDet] c:\program files\creative\usb sbaudigy2 nx\dvdaudio\CTDVDDet.EXE mRun: [RemoteControl] "c:\program files\cyberlink\powerdvd\PDVDServ.exe" mRun: [FLMOFFICE4DMOUSE] c:\program files\ge\98059 keyboard and mouse\mouse32a.exe mRun: [atwtusb] atwtusb.exe beta mRun: [emMON] HCWemMON.exe mRun: [VBTUCopy] c:\program files\vbtucopy\VBTUCopy.exe /a /f mRun: [Profiler] c:\program files\saitek\software\Profiler.exe mRun: [SaiMfd] c:\program files\saitek\software\SaiMfd.exe mRun: [AVG8_TRAY] c:\progra~1\avg\avg8\avgtray.exe mRun: [AppleSyncNotifier] c:\program files\common files\apple\mobile device support\bin\AppleSyncNotifier.exe mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe" mRun: [TkBellExe] "c:\program files\common files\real\update_ob\realsched.exe" -osboot mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe" mRun: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\firefox preloader.lnk - c:\program files\firefox preloader\FirefoxPreloader.exe IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office10\EXCEL.EXE/3000 IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBC} - c:\program files\java\jre1.6.0_07\bin\ssv.dll IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg8\avgpp.dll Notify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.DLL SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll ============= SERVICES / DRIVERS =============== R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2008-8-17 97928] R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\avg\avg8\avgwdsvc.exe [2008-8-17 231704] S1 aiptektp;HyperPen;c:\windows\system32\drivers\aiptektp.sys [2007-1-17 22272] S2 Ca536av;DV 4500(Video);c:\windows\system32\drivers\Ca536av.sys [] S2 mrtRate;mrtRate; [] S3 A4UsbScanner;600 USB Still Image Device Service;c:\windows\system32\drivers\usbscan.sys [2004-9-21 15104] S3 Auapmnko;Auapmnko; [] S3 DCamUSBCompany;P35U Camera Capture;c:\windows\system32\drivers\p35u.sys [] S3 Fdpiep;Fdpiep; [] S3 gAGP440p;gAGP440p;\??\c:\docume~1\daniel\locals~1\temp\gAGP440p.sys [] S3 Httbioskaa;Httbioskaa; [] S3 KMW_KBD;Kensington Input Devices Class filter driver;c:\windows\system32\drivers\KMW_KBD.sys [] S3 KMW_USB;Kensington MouseWorks USB filter driver;c:\windows\system32\drivers\KMW_USB.sys [2004-3-22 9984] S3 MR97310_VGA_DUAL_CAMERA;VGA Dual Camera;c:\windows\system32\drivers\mr97310v.sys [2006-7-3 114105] S3 Nalmsys;Nalmsys;c:\windows\system32\drivers\aec.sys [2004-2-26 142464] S3 SaiH040C;SaiH040C;c:\windows\system32\drivers\SaiH040C.sys [2007-7-22 173568] S3 SaiU040C;SaiU040C;c:\windows\system32\drivers\SaiU040C.sys [2007-7-22 26496] S3 Sbuotsiui;Sbuotsiui;c:\windows\system32\drivers\mf.sys [2001-8-17 63744] S3 sbusb;Sound Blaster USB Audio Driver;c:\windows\system32\drivers\sbusb.sys [2005-5-12 892160] S3 USB28xxBGA;WinTV HVR-900;c:\windows\system32\drivers\emBDA.sys [2007-2-11 292864] S3 USB28xxOEM;WinTV OEM Filter;c:\windows\system32\drivers\emOEM.sys [2007-2-11 27904] S3 USBCamera;DV 4500(Still);c:\windows\system32\drivers\Bulk536.sys [] S3 Viewpoint Manager Service;Viewpoint Manager Service; [] S3 WLAN(WLAN);XPC 802.11b/g Wireless Kit Driver(WLAN);c:\windows\system32\drivers\zd1211u.sys [2006-1-14 278016] S3 XDva020;XDva020;\??\c:\windows\system32\XDva020.sys [] S3 XDva022;XDva022;\??\c:\windows\system32\XDva022.sys [] S3 XDva114;XDva114;\??\c:\windows\system32\XDva114.sys [] S3 XDva136;XDva136;\??\c:\windows\system32\XDva136.sys [] S3 ZD1211U(Hawking Technologies);Hawking Technologies HWU54D Hi-Gain Wireless-G USB Adapter(Hawking Technologies);c:\windows\system32\drivers\zd1211u.sys [2006-1-14 278016] S3 ZDBRGSYS;ZDBRGSYS NDIS Protocol Driver;\??\c:\windows\system32\ZDBRGSYS.SYS [] S4 hpt3xx;hpt3xx; [] =============== Created Last 30 ================ ==================== Find3M ==================== 2008-11-16 22:55 –d—– c:\program files\EOF - Song Maker 2008-11-15 02:51 –d—– c:\docume~1\daniel\applic~1\Xfire 2008-11-14 19:06 –d—– c:\program files\Xfire 2008-11-14 18:23 –d—– c:\program files\WarRock 2008-11-12 22:41 –d—– c:\program files\Icon Editor 2008-11-05 17:21 –d—– c:\program files\Anti-Malware 2008-11-03 19:54 111,928 a——- c:\windows\system32\PnkBstrB.exe 2008-11-03 19:53 66,872 a——- c:\windows\system32\PnkBstrA.exe 2008-10-22 22:17 –d—– c:\program files\Combat Arms 2008-10-18 23:01 –d—– c:\program files\RAM Booster Expert 2008-10-18 08:04 –d—– c:\program files\iTunes 2008-10-18 08:03 –d—– c:\program files\iPod 2008-10-17 17:39 –d—– c:\program files\GSC 2008-10-16 14:06 268,648 a——- c:\windows\system32\mucltui.dll 2008-10-16 14:06 208,744 a——- c:\windows\system32\muweb.dll 2008-10-14 22:37 –d—– c:\program files\Free FLV Converter 2008-10-14 22:34 270,336 a——- c:\windows\system32\TubeFinder.exe 2008-10-14 21:20 –d—– c:\program files\common files\Real 2008-10-14 21:20 499,712 a——- c:\windows\system32\msvcp71.dll 2008-10-14 21:20 348,160 a——- c:\windows\system32\msvcr71.dll 2008-10-14 21:20 –d—– c:\program files\Real 2008-10-14 18:04 –d—– c:\program files\WinRAR 3.71 2008-09-30 19:11 –d—– c:\docume~1\daniel\applic~1\Greenville_County_Schools 2008-09-30 16:43 1,286,152 a——- c:\windows\system32\msxml4.dll 2008-09-28 21:38 –d—– c:\program files\Cheat Engine 5.4 2008-09-25 16:13 –d—– c:\program files\Firefox Preloader 2008-09-17 22:30 –d—– c:\docume~1\daniel\applic~1\PE Explorer 2008-09-17 19:59 –d—– c:\docume~1\daniel\applic~1\Song_INI_Maker 2008-09-16 19:53 –d—– c:\docume~1\daniel\applic~1\GSC 2008-09-15 15:54 –d—– c:\docume~1\daniel\applic~1\DMCache 2008-09-15 06:57 1,846,016 a——- c:\windows\system32\win32k.sys 2008-09-11 16:59 –d—– c:\docume~1\alluse~1\applic~1\{3276BE95_AF08_429F_A64F_CA64CB79BCF6} 2008-09-04 11:42 1,106,944 a——- c:\windows\system32\msxml3.dll 2008-08-31 15:18 104,960 a——- c:\windows\system32\c_dll.dll 2008-08-29 20:06 1,350,664 a——- c:\windows\system32\msxml6.dll 2008-08-29 09:18 87,336 a——- c:\windows\system32\dns-sd.exe 2008-08-29 08:53 61,440 a——- c:\windows\system32\dnssd.dll 2008-08-26 02:24 826,368 a——- c:\windows\system32\wininet.dll 2008-08-23 10:31 39,424 a——- c:\windows\zipinst.exe 2008-08-17 10:29 –d—– c:\docume~1\alluse~1\applic~1\Avg8 2008-08-15 21:10 –d—– c:\docume~1\alluse~1\applic~1\NexonUS 2008-08-14 22:54 –d—– c:\docume~1\daniel\applic~1\Uniblue 2008-08-14 18:51 –d—– c:\docume~1\daniel\applic~1\SystemRequirementsLab 2008-07-29 21:51 –d—– c:\docume~1\daniel\applic~1\fretsonfire 2008-07-17 22:13 –d—– c:\docume~1\daniel\applic~1\vlc 2008-07-12 10:50 –d—– c:\docume~1\daniel\applic~1\TeamViewer 2008-06-02 18:46 –d—– c:\docume~1\daniel\applic~1\Microsoft Games 2008-03-10 19:10 –d—– c:\docume~1\daniel\applic~1\Malwarebytes 2008-03-10 19:10 –d—– c:\docume~1\alluse~1\applic~1\Malwarebytes 2008-03-10 15:44 –d—– c:\docume~1\alluse~1\applic~1\SUPERAntiSpyware.com 2008-03-10 15:44 –d—– c:\docume~1\daniel\applic~1\SUPERAntiSpyware.com 2007-10-30 20:06 –d—– c:\docume~1\alluse~1\applic~1\Viewpoint 2007-09-25 18:49 –d—– c:\docume~1\alluse~1\applic~1\SMART Technologies Inc 2007-09-25 18:49 –d—– c:\docume~1\daniel\applic~1\SMART Technologies Inc 2007-08-18 01:11 –d—– c:\docume~1\daniel\applic~1\Viewpoint 2007-08-07 08:20 –d—– c:\docume~1\alluse~1\applic~1\Trymedia 2007-08-03 20:02 –d—– c:\docume~1\daniel\applic~1\Serif 2007-05-05 14:08 –d—– c:\docume~1\alluse~1\applic~1\Autodesk 2007-03-15 09:27 –d—– c:\docume~1\alluse~1\applic~1\Intuit 2006-01-08 00:07 –d—– c:\docume~1\alluse~1\applic~1\Ahead 2004-12-21 09:01 –d—– c:\docume~1\alluse~1\applic~1\Minnetonka Audio Software 2004-03-15 10:49 –d—– c:\docume~1\alluse~1\applic~1\MSN6 2004-03-04 09:21 –d—– c:\docume~1\alluse~1\applic~1\Macrovision ============= FINISH: 17:37:57.17 =============== [attachment removed]

Hi

Your computer look fine to me, are you having any other problems apart from this system restore message?

System restore:
We will now clear your existing system restore points and establish a new clean restore point:

• Go to Start > All Programs > Accessories > System Tools > System Restore
• Select Create a restore point, and OK it.
• Next, go to Start > Run and type in cleanmgr
• Select the More options tab
• Choose the option to clean up system restore and OK it.
  
  This will remove all restore points except the new one you just created.

Reboot your computer and let me know if you are still getting the AVG alert.

Thanks.

I made the new restore point but encountered a problem when using cleanmgr. I typed it in run and it immediately started a full disk clean, I had to cancel because my dad has several old important video files on this computer that he doesn't want compressed, and there years old so they will most likely get compressed. Besides I just don't need anything compacted. Do you have an alternate way to delete all my old restore points?

OK, here's another method:

• Right-click My Computer, hit Properties.
• Click the System Restore tab.
• Check Turn Off System Restore For All Drives, click Apply and then hit Yes at the prompt
• Uncheck that checkbox and then hit Apply again.
• Exit

That should do the trick, let me know how it goes. Post a new HijackThis log as well please.

Thanks.

Hi

Let me know, and then please try this online scan:

Please go to Kaspersky website and perform an online antivirus scan.

• Read through the requirements and privacy statement and click on Accept button.
• It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
• When the downloads have finished, click on Settings.
• Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
  • Spyware, Adware, Dialers, and other potentially dangerous programs
    Archives
    Mail databases
• Click on My Computer under Scan.
• Once the scan is complete, it will display the results. Click on View Scan Report.
• You will see a list of infected items there. Click on Save Report As….
• Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button.
• Please post this log in your next reply.

Thanks.

Good news, I haven't gotten the error again and the screensaver has come up multiple times. The bad news is that Kapersky detected 1 infection. I'm not sure what it is because at 30% done with the scan Firefox crashed. I don't have time to let it finish tonight as it took 2 hours to finish 30%. I'll see if I can get it done tomorrow.

If you don't want to try Kaspersky again, or if doesn't work, then give this one a go instead:

Run Eset NOD32 Online AntiVirus
http://www.eset.eu/online-scanner
Note: You will need to use Internet Explorer for this scan.

• Tick the box next to YES, I accept the Terms of Use.
• Click Start
• When asked, allow the activex control to install
• Disable your current Antivirus software. You can usually do this with its Notfication Tray icon near the clock.
• Click Start
• Make sure that the option "Remove found threats" is Un-checked, and the option "Scan unwanted applications" is checked
• Click Scan
• Wait for the scan to finish
• Re-enable your Anvirisus software.
• A logfile is created and located at C:\Program Files\EsetOnlineScanner\log.txt. Please include this on your post.

Thanks.

Ok I ran the Kapersky scan again today and it was successful. It detected one thing after scanning for 6 hours -.- Also, I saw no remove feature for the infection, is there a way to get rid of it? ——————————————————————————– KASPERSKY ONLINE SCANNER 7 REPORT Friday, November 21, 2008 Operating System: Microsoft Windows XP Professional Service Pack 2 (build 2600) Kaspersky Online Scanner 7 version: 7.0.25.0 Program database last update: Friday, November 21, 2008 10:02:06 Records in database: 1399208 ——————————————————————————– Scan settings: Scan using the following database: extended Scan archives: yes Scan mail databases: yes Scan area - My Computer: C:\ D:\ E:\ F:\ Scan statistics: Files scanned: 244373 Threat name: 1 Infected objects: 1 Suspicious objects: 0 Duration of the scan: 06:13:46 File name / Threat name / Threats count C:\Documents and Settings\Daniel\Application Data\Sun\Java\Deployment\cache\6.0\63\59ef263f-6db2702b Infected: Trojan-Downloader.Java.OpenConnection.ar 1 The selected area was scanned.

Hi

Kaspersky just scans, allowing us to decide what to do with what it finds. And this is what we do:

Please download ATF Cleaner by Atribune.
Download - ATF Cleaner»
Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.

(If you use FireFox or the Opera browser
To keep saved passwords, click No at the prompt.)

It's normal after running ATF cleaner that the PC will be slower to boot the first time or two.


Please post a new HijackThis log after this. How's the computer running at the moment?

Thanks.

Hi Vectris

Log looks good

You can now delete any other tools I had you download and use, unless you wish to keep them.


Set correct settings for files that should be hidden in Windows XP

• Click Start > My Computer > Tools menu (at top of page) > Folder Options > View tab.
• Under "Hidden files and folders" if necessary select Do not show hidden files and folders.
• If unchecked please checkHide protected operating system files (Recommended)
• If necessary check "Display content of system folders"
• If necessary Uncheck Hide file extensions for known file types.
• Click OK

Now that your system appears to be clean, theres just a few steps I'd like you to take to prevent any future infections.

• System restore:
  We will now clear your existing system restore points and establish a new clean restore point:
  • Go to Start > All Programs > Accessories > System Tools > System Restore
  • Select Create a restore point, and Ok it.
  • Next, go to Start > Run and type in cleanmgr
  • Select the More options tab
  • Choose the option to clean up system restore and OK it.
    
    This will remove all restore points except the new one you just created.
  Make sure you do this now, as your System Restore currently has infected files in it.
  
  
• Keeping your Windows up-to-date is crucial to your computer's security. Please go to the Windows Update Site (using Internet Explorer) and download and install all critical updates on a regular basis.
  
  
• You don't appear to be running any third party Firewall software.
  
  Install a firewall! Without a firewall you are very susceptible to being hacked, and people could gain access to your computer. If you don't have a firewall I strongly recommend you download ONE of the following:
  1) Comodo
  2) Agnitum
  3) Sunbelt/Kerio
  
  
• Make sure you update your Anti-Virus software regularly, new viruses are being developed all the time.
  
  
• Some more programs that it would be useful to have [OPTIONAL but RECOMMENDED]:
  
  Download Spybot Search and Destroy 1.5 from here
  Check for Updates/ Immunize and run a Full System Scan on a regular basis.
  
  SpywareBlaster is another real-time scanner that prevents most spyware from even being installed.
  Freely available: Download SpywareBlaster
  
  Download and install the free version of WinPatrol. This program protects your computer in a variety of ways and will work well with your existing security software. Have a look at this tutorial to help you get started with the program.

Also, please read this great article by Tony Klein: So How Did I Get Infected In First Place

Glad we could be of assistance.

Please reply to this thread once more if you are satisfied so that we can mark the problem as resolved.

Stay Clean!

jpshortstuff

Thanks, I did what you suggested and I'll look into getting a firewall. Thanks for the help.