What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] Trojan.Vundo + Fixed part of it and now I get BUNCH of

9 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1 last edited
I went thru the self help thing. I have both the hijack this log and malwarebytes log.
I had also used ERUNT before I ran Malware bytes.
I also ran VUNDOFIX but it didnt detect anything.

Right now, w hen I turn on the computer..I get a lotta errors..But it does work..

Basically it gives bunch of DLL errors with BAD IMAGE or something. I can attach some SS if needed.
ALso, pop ups are crazy with firefox. I have to use Maxthon to browse right now.
My bro in law also downloaded something called StopZilla…I dunno if thats a problem.
Spybot had detected Vundomunde and told me to rerun it after reboot with no internet connection and I can remove it than. I tried it but it still detects it.

Here are the logs…


MalwareBytes Log ;

Malwarebytes' Anti-Malware 1.24
Database version: 1061
Windows 5.1.2600 Service Pack 3

3:19:54 AM 11/30/2008
mbam-log-11-30-2008 (03-19-47).txt

Scan type: Full Scan (C:\|)
Objects scanned: 107118
Time elapsed: 39 minute(s), 46 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 4
Registry Keys Infected: 8
Registry Values Infected: 1
Registry Data Items Infected: 2
Folders Infected: 0
Files Infected: 14

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
C:\WINDOWS\system32\lehqfvcu.dll (Trojan.Vundo) -> No action taken.
C:\WINDOWS\system32\xxyxWQkI.dll (Trojan.Vundo) -> No action taken.
C:\WINDOWS\system32\srkrcxxh.dll (Trojan.Vundo) -> No action taken.
C:\WINDOWS\system32\dgbqtp.dll (Trojan.Vundo) -> No action taken.

Registry Keys Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{a9047516-2a39-4715-9aa7-bbe2c07a18d6} (Trojan.Vundo) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{a9047516-2a39-4715-9aa7-bbe2c07a18d6} (Trojan.Vundo) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{bca76b94-966c-4ff6-93d5-6bb02b330672} (Trojan.Vundo) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{bca76b94-966c-4ff6-93d5-6bb02b330672} (Trojan.Vundo) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{a7cddcdc-beeb-4685-a062-978f5e07ceee} (Adware.Shopping.Report) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Track System (Trojan.Vundo) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> No action taken.

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\0c93ea83 (Trojan.Vundo) -> No action taken.

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Notification Packages (Trojan.Vundo) -> Data: c:\windows\system32\xxyxwqki -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Authentication Packages (Trojan.Vundo) -> Data: c:\windows\system32\xxyxwqki -> No action taken.

Folders Infected:
(No malicious items detected)

Files Infected:
C:\WINDOWS\system32\xxyxWQkI.dll (Trojan.Vundo) -> No action taken.
C:\WINDOWS\system32\IkQWxyxx.ini (Trojan.Vundo) -> No action taken.
C:\WINDOWS\system32\IkQWxyxx.ini2 (Trojan.Vundo) -> No action taken.
C:\WINDOWS\system32\dgbqtp.dll (Trojan.Vundo) -> No action taken.
C:\WINDOWS\system32\lehqfvcu.dll (Trojan.Vundo) -> No action taken.
C:\WINDOWS\system32\ucvfqhel.ini (Trojan.Vundo) -> No action taken.
C:\WINDOWS\system32\srkrcxxh.dll (Trojan.Vundo) -> No action taken.
C:\Documents and Settings\Parthiv Thakore\Local Settings\Temp\__8B.tmp (Adware.SurfAccuracy) -> No action taken.
C:\Documents and Settings\Parthiv Thakore\Local Settings\Temporary Internet Files\Content.IE5\CB4V36V9\zc113432[1] (Trojan.Vundo) -> No action taken.
C:\Documents and Settings\Parthiv Thakore\Local Settings\Temporary Internet Files\Content.IE5\RZBJE5FT\index[1] (Trojan.Vundo) -> No action taken.
C:\System Volume Information\_restore{949FBAD4-A295-4EC3-85C3-28D1CF909E7C}\RP919\A0065694.dll (Adware.Shopper) -> No action taken.
C:\System Volume Information\_restore{949FBAD4-A295-4EC3-85C3-28D1CF909E7C}\RP955\A0070667.dll (Adware.CommAd) -> No action taken.
C:\System Volume Information\_restore{949FBAD4-A295-4EC3-85C3-28D1CF909E7C}\RP955\A0070668.dll (Adware.SurfAccuracy) -> No action taken.
C:\WINDOWS\system32\fCRiJyxX.dll (Trojan.Vundo) -> No action taken.





HIJACKTHIS LOG :


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 3:28:29 AM, on 11/30/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18241)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\fxssvc.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\stsystra.exe
C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe
C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Maxthon\Maxthon.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul…rch/search.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: (no name) - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - (no file)
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O3 - Toolbar: Veoh Browser Plug-in - {D0943516-5076-4020-A3B5-AEFAF26AB263} - C:\Program Files\Veoh Networks\Veoh\Plugins\reg\VeohToolbar.dll
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe /r
O4 - HKCU\..\Run: [SetDefaultMIDI] MIDIDef.exe
O4 - HKCU\..\Run: [Creative Detector] "C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" /R
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {1D082E71-DF20-4AAF-863B-596428C49874} (TPIR Control) - http://www.worldwinner.com/games/v50/tpir/tpir.cab
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.3.3.102.cab
O16 - DPF: {8A94C905-FF9D-43B6-8708-F0F22D22B1CB} (Wwlaunch Control) - http://www.worldwinner.com/games/shared/wwlaunch.cab
O16 - DPF: {A903E5AB-C67E-40FB-94F1-E1305982F6E0} (KooPlayer Control) - http://www.idesitv.com/livetv.ocx
O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} (Get_ActiveX Control) - https://h17000.www1.hp.com/ewfrf-JAVA/Secur…loadManager.ocx
O16 - DPF: {ADACAA8F-3595-47FE-9C31-9C7471B9BEC7} (OCXDownloadChecker Control) - http://68.213.32.251/cab/OCXChecker_8198.cab
O16 - DPF: {C52439A0-2693-4E40-B141-9F9AD5257241} (Lexmark eDiagnostics Class) - https://ediagnostics.lexmark.com/serval.cab
O16 - DPF: {CAFEEFAC-0015-0000-0003-ABCDEFFEDCBA} (Java Plug-in 1.5.0_03) -
O16 - DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} (Java Plug-in 1.5.0_06) -
O16 - DPF: {FAE74270-E5EE-49C3-B816-EA8B4D55F38F} (H2hPool Control) - http://www.worldwinner.com/games/v53/h2hpool/h2hpool.cab
O16 - DPF: {FEC048AB-277A-460C-BF50-1A4193AEF148} (DownloadCenter Control) - http://68.213.32.251/cab/DownloadCenter_8200.cab
O18 - Filter hijack: text/html - {3294ee9c-ae77-426e-bf9f-eef3deae8c01} - C:\WINDOWS\system32\iehlpr32.dll
O20 - AppInit_DLLs: dgbqtp.dll
O20 - Winlogon Notify: khffExwu - khffExwu.dll (file missing)
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Creative Labs Licensing Service - Creative Labs - C:\Program Files\Common Files\Creative Labs Shared\Service\CreativeLicensing.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: dlcd_device - - C:\WINDOWS\system32\dlcdcoms.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

–
End of file - 7093 bytes



THanks for the help in advance.
Post #2
Hello

Disable resident protections (Antivirus…); you'll re-enable them after the scan

Download Lop S&D < here

Double-click Lop S&D.exe
Choose the language, then choose Option 1 (Search)
Wait till the end of the scan
Post the log which is created: (%SystemDrive%\lopR.txt)
Post #3
——————–\\ Lop S&D 4.2.4-9c XP/Vista

Microsoft Windows XP Professional ( v5.1.2600 ) Service Pack 3
X86-based PC ( Multiprocessor Free : Intel® Pentium® D CPU 2.80GHz )
BIOS : Phoenix ROM BIOS PLUS Version 1.10 A05
USER : Parthiv Thakore ( Administrator )
BOOT : Normal boot
A:\ (USB)
C:\ (Local Disk) - NTFS - Total:232 Go (Free:209 Go)
D:\ (USB)
E:\ (USB)
F:\ (USB)
G:\ (USB)
H:\ (CD or DVD)
I:\ (CD or DVD)

"C:\Lop SD" ( MAJ : 01-11-2008|16:30 )
Option : [1] ( Sun 11/30/2008|13:53 )

——————–\\ Listing folders in APPLIC~1

[04/27/2008|09:44] C:\DOCUME~1\ADMINI~1\APPLIC~1\ Microsoft

[07/22/2008|06:36] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Adobe
[07/16/2007|02:34] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Apple
[11/13/2006|11:40] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Apple Computer
[04/27/2008|09:45] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Avg7
[04/06/2007|03:12] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Broderbund Software
[06/08/2006|08:27] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Creative Labs
[07/20/2008|11:44] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ GTek
[06/17/2006|03:49] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ InstallShield
[09/28/2008|12:20] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Kaspersky Lab
[08/07/2008|10:44] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Kaspersky Lab Setup Files
[08/17/2008|01:49] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Malwarebytes
[08/10/2008|02:32] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Microsoft
[06/18/2006|09:08] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Microsoft Games
[04/06/2007|03:59] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Protexis
[06/13/2006|04:26] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Real
[04/06/2007|03:15] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Riverdeep Interactive Learning Limited
[06/08/2006|09:25] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ RoboForm
[11/28/2008|01:53] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ SITEguard
[08/10/2008|02:28] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Spybot - Search & Destroy
[11/29/2008|12:10] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ STOPzilla!
[02/01/2007|03:12] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ TDK
[11/19/2008|11:22] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ TVU Networks
[08/10/2008|02:18] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Uniblue
[07/07/2006|11:19] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Windows Genuine Advantage
[12/19/2007|06:49] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ yahoo!

[06/07/2006|09:49] C:\DOCUME~1\DEFAUL~1\APPLIC~1\ Microsoft

[06/17/2006|03:45] C:\DOCUME~1\LOCALS~1\APPLIC~1\ Macromedia
[04/27/2008|09:44] C:\DOCUME~1\LOCALS~1\APPLIC~1\ Microsoft

[04/27/2008|09:44] C:\DOCUME~1\NETWOR~1\APPLIC~1\ Microsoft

[06/17/2006|03:18] C:\DOCUME~1\PARTHI~1\APPLIC~1\ .bittorrent
[12/19/2007|12:27] C:\DOCUME~1\PARTHI~1\APPLIC~1\ Adobe
[08/01/2006|06:57] C:\DOCUME~1\PARTHI~1\APPLIC~1\ AdobeAUM
[07/22/2008|06:35] C:\DOCUME~1\PARTHI~1\APPLIC~1\ AdobeUM
[07/27/2007|02:07] C:\DOCUME~1\PARTHI~1\APPLIC~1\ Apple Computer
[04/01/2007|09:37] C:\DOCUME~1\PARTHI~1\APPLIC~1\ Creative
[01/12/2007|05:19] C:\DOCUME~1\PARTHI~1\APPLIC~1\ Digital Album Organizer
[11/29/2008|12:38] C:\DOCUME~1\PARTHI~1\APPLIC~1\ DMCache
[06/07/2006|10:05] C:\DOCUME~1\PARTHI~1\APPLIC~1\ Identities
[07/22/2008|06:30] C:\DOCUME~1\PARTHI~1\APPLIC~1\ InstallShield
[08/01/2007|07:25] C:\DOCUME~1\PARTHI~1\APPLIC~1\ Jasc Software Inc
[02/27/2007|10:32] C:\DOCUME~1\PARTHI~1\APPLIC~1\ Leadertech
[12/24/2007|04:50] C:\DOCUME~1\PARTHI~1\APPLIC~1\ Macromedia
[08/17/2008|01:49] C:\DOCUME~1\PARTHI~1\APPLIC~1\ Malwarebytes
[06/13/2006|04:23] C:\DOCUME~1\PARTHI~1\APPLIC~1\ Media Player Classic
[09/21/2008|12:51] C:\DOCUME~1\PARTHI~1\APPLIC~1\ Microsoft
[06/19/2006|04:11] C:\DOCUME~1\PARTHI~1\APPLIC~1\ Microsoft Games
[08/17/2008|12:35] C:\DOCUME~1\PARTHI~1\APPLIC~1\ mIRC
[11/27/2008|09:04] C:\DOCUME~1\PARTHI~1\APPLIC~1\ Move Networks
[06/22/2007|09:56] C:\DOCUME~1\PARTHI~1\APPLIC~1\ Mozilla
[12/24/2007|04:50] C:\DOCUME~1\PARTHI~1\APPLIC~1\ PlayFirst
[09/30/2007|11:54] C:\DOCUME~1\PARTHI~1\APPLIC~1\ Real
[07/29/2006|02:03] C:\DOCUME~1\PARTHI~1\APPLIC~1\ Sun
[01/20/2008|03:38] C:\DOCUME~1\PARTHI~1\APPLIC~1\ TVU Networks
[08/10/2008|02:18] C:\DOCUME~1\PARTHI~1\APPLIC~1\ Uniblue
[09/09/2006|09:11] C:\DOCUME~1\PARTHI~1\APPLIC~1\ Ventrilo
[08/07/2008|10:58] C:\DOCUME~1\PARTHI~1\APPLIC~1\ WinRAR
[12/19/2007|06:48] C:\DOCUME~1\PARTHI~1\APPLIC~1\ Yahoo!

——————–\\ Scheduled Tasks located in C:\WINDOWS\Tasks

[11/18/2008 03:31 PM][–a——] C:\WINDOWS\tasks\Uniblue SpyEraser Nag.job
[08/10/2008 02:27 PM][–a——] C:\WINDOWS\tasks\Uniblue SpyEraser.job
[11/26/2008 06:14 PM][–a——] C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[11/30/2008 01:50 PM][–ah—–] C:\WINDOWS\tasks\SA.DAT
[08/10/2004 06:00 AM][-r-h—–] C:\WINDOWS\tasks\desktop.ini

——————–\\ Listing Folders in C:\Program Files

[08/01/2006|06:57] C:\Program Files\ Adobe
[08/06/2008|11:07] C:\Program Files\ Apple Software Update
[06/07/2006|11:05] C:\Program Files\ ATI Technologies
[08/27/2007|06:22] C:\Program Files\ AvailaSoft
[11/28/2008|01:51] C:\Program Files\ Common Files
[06/07/2006|09:45] C:\Program Files\ ComPlus Applications
[06/08/2006|09:03] C:\Program Files\ CONEXANT
[06/08/2006|08:31] C:\Program Files\ Creative
[04/30/2008|09:44] C:\Program Files\ Dell Photo AIO Printer 944
[11/09/2008|02:36] C:\Program Files\ DivX
[04/30/2008|05:05] C:\Program Files\ Dl_cats
[11/30/2008|12:59] C:\Program Files\ ERUNT
[06/07/2006|09:57] C:\Program Files\ GemMaster
[12/19/2007|06:44] C:\Program Files\ Google
[12/19/2007|07:06] C:\Program Files\ Grisoft
[08/17/2008|02:11] C:\Program Files\ Hijackthis
[03/14/2007|04:54] C:\Program Files\ HP
[07/20/2008|11:42] C:\Program Files\ IGN
[09/28/2008|01:26] C:\Program Files\ InstallShield Installation Information
[06/07/2006|10:59] C:\Program Files\ Intel
[09/28/2008|01:10] C:\Program Files\ Internet Explorer
[08/06/2008|10:53] C:\Program Files\ iPod
[08/06/2008|10:53] C:\Program Files\ iTunes
[06/17/2006|03:49] C:\Program Files\ Jasc Software Inc
[10/12/2008|06:53] C:\Program Files\ Java
[07/22/2008|10:04] C:\Program Files\ LimeWire
[08/17/2008|01:49] C:\Program Files\ Malwarebytes' Anti-Malware
[04/07/2008|10:15] C:\Program Files\ Maxthon
[06/13/2006|04:29] C:\Program Files\ Media Player Classic
[09/19/2008|07:43] C:\Program Files\ Messenger
[06/18/2006|12:52] C:\Program Files\ Microsoft ActiveSync
[06/07/2006|09:50] C:\Program Files\ microsoft frontpage
[11/03/2008|08:52] C:\Program Files\ Microsoft Office
[06/01/2008|10:00] C:\Program Files\ Microsoft Research
[06/18/2006|12:52] C:\Program Files\ Microsoft Visual Studio
[06/18/2006|12:57] C:\Program Files\ Microsoft Works
[06/18/2006|12:51] C:\Program Files\ Microsoft.NET
[08/17/2008|12:34] C:\Program Files\ mIRC
[09/19/2008|07:38] C:\Program Files\ Movie Maker
[11/30/2008|12:55] C:\Program Files\ Mozilla Firefox
[08/03/2007|05:45] C:\Program Files\ MSBuild
[11/03/2008|08:51] C:\Program Files\ MSECache
[06/07/2006|09:43] C:\Program Files\ MSN
[06/07/2006|09:43] C:\Program Files\ MSN Gaming Zone
[11/16/2006|04:00] C:\Program Files\ MSXML 4.0
[08/03/2007|05:55] C:\Program Files\ MSXML 6.0
[09/19/2008|07:34] C:\Program Files\ NetMeeting
[06/18/2006|12:58] C:\Program Files\ OfficeUpdate11
[09/11/2006|05:30] C:\Program Files\ Online Services
[11/19/2008|11:57] C:\Program Files\ Online TV & Radio Stations
[09/19/2008|07:34] C:\Program Files\ Outlook Express
[07/22/2008|06:31] C:\Program Files\ Philips
[06/13/2006|04:29] C:\Program Files\ QuickTime
[07/11/2008|10:52] C:\Program Files\ QuickTime Alternative
[08/10/2008|02:26] C:\Program Files\ Real
[06/13/2006|04:26] C:\Program Files\ Real Alternative
[08/03/2007|05:41] C:\Program Files\ Reference Assemblies
[06/07/2006|09:59] C:\Program Files\ RGB
[06/08/2006|09:25] C:\Program Files\ Siber Systems
[06/08/2006|08:23] C:\Program Files\ SigmaTel
[11/29/2008|01:05] C:\Program Files\ Spybot - Search & Destroy
[11/28/2008|01:51] C:\Program Files\ STOPzilla!
[04/27/2008|09:52] C:\Program Files\ The Print Shop 21
[11/30/2008|12:56] C:\Program Files\ Trend Micro
[08/10/2008|02:27] C:\Program Files\ Uniblue
[04/07/2008|10:17] C:\Program Files\ Uninstall Information
[09/28/2008|01:26] C:\Program Files\ v8200
[11/09/2008|11:17] C:\Program Files\ Veoh Networks
[08/03/2007|03:05] C:\Program Files\ WaveReader
[04/11/2007|03:07] C:\Program Files\ Web Publish
[08/03/2007|05:55] C:\Program Files\ Windows Media Connect 2
[08/03/2007|05:55] C:\Program Files\ Windows Media Player
[09/11/2006|05:28] C:\Program Files\ Windows NT
[06/07/2006|09:45] C:\Program Files\ Windows Plus
[06/07/2006|09:48] C:\Program Files\ WindowsUpdate
[08/07/2008|10:58] C:\Program Files\ WinRAR
[06/07/2006|09:50] C:\Program Files\ xerox
[06/13/2006|04:27] C:\Program Files\ XP Codec Pack
[12/19/2007|06:49] C:\Program Files\ Yahoo!

——————–\\ Listing Folders in C:\Program Files\Common Files

[07/22/2008|06:36] C:\Program Files\Common Files\ Adobe
[08/06/2008|10:50] C:\Program Files\Common Files\ Apple
[06/08/2006|08:26] C:\Program Files\Common Files\ Creative Labs Shared
[06/18/2006|12:52] C:\Program Files\Common Files\ DESIGNER
[08/17/2008|01:48] C:\Program Files\Common Files\ Download Manager
[03/14/2007|04:56] C:\Program Files\Common Files\ Hewlett-Packard
[06/17/2006|03:48] C:\Program Files\Common Files\ InstallShield
[11/28/2008|01:51] C:\Program Files\Common Files\ iS3
[06/17/2006|03:48] C:\Program Files\Common Files\ Jasc Software Inc
[08/03/2007|04:11] C:\Program Files\Common Files\ Java
[06/18/2006|12:52] C:\Program Files\Common Files\ L&H
[11/03/2008|08:52] C:\Program Files\Common Files\ Microsoft Shared
[06/07/2006|09:47] C:\Program Files\Common Files\ MSSoap
[06/07/2006|04:37] C:\Program Files\Common Files\ ODBC
[05/26/2008|06:05] C:\Program Files\Common Files\ Real
[06/07/2006|09:47] C:\Program Files\Common Files\ Services
[06/07/2006|04:37] C:\Program Files\Common Files\ SpeechEngines
[09/19/2008|07:34] C:\Program Files\Common Files\ System
[05/26/2008|06:06] C:\Program Files\Common Files\ xing shared

——————–\\ Process

( 37 Processes )

… OK !

——————–\\ Searching with S_Lop

No Lop folder found !

——————–\\ Searching for Lop Files - Folders

No Lop folder found !

——————–\\ Searching within the Registry

….. OK !

——————–\\ Checking the Hosts file

Hosts file CLEAN


——————–\\ Searching for hidden files with Catchme

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-11-30 13:54:09
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes …
scanning hidden files …
scan completed successfully
hidden processes: 0
hidden files: 0

——————–\\ Searching for other infections

——————–\\ Suspect ..

C:\WINDOWS\system32\TDSSarxx.dll
C:\WINDOWS\system32\TDSSkkai.log
C:\WINDOWS\system32\TDSSlxcp.dll
C:\WINDOWS\system32\TDSSmtye.dat
C:\WINDOWS\system32\TDSSvkql.dll

——————–\\ Cracks & Keygens ..

C:\DOCUME~1\PARTHI~1\Shared\(ECHOS) akele hum akele tum (Crack) (Vocal).wma


[F:11395][D:69]-> C:\DOCUME~1\PARTHI~1\LOCALS~1\Temp
[F:28][D:0]-> C:\DOCUME~1\PARTHI~1\Cookies
[F:511][D:25]-> C:\DOCUME~1\PARTHI~1\LOCALS~1\TEMPOR~1\content.IE5

1 - "C:\Lop SD\LopR_1.txt" - Sun 11/30/2008|13:55 - Option : [1]

——————–\\ Scan completed at 13:55:59
Post #4
Hello

We will begin with ComboFix.exe. Please visit this webpage for download links, and instructions for running the tool:

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

* Ensure you have disabled all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Please include the C:\ComboFix.txt in your next reply for further review.
Post #5
ComboFix 08-11-30.01 - Parthiv Thakore 2008-11-30 15:20:56.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1655 [GMT -5:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Parthiv Thakore\Local Settings\Temporary Internet Files\CPV.stt
c:\documents and settings\Parthiv Thakore\Local Settings\Temporary Internet Files\fbk.sts
c:\windows\IE4 Error Log.txt
c:\windows\system32\av.dat
c:\windows\system32\av.exe
c:\windows\system32\Drivers\TDSSmqlt.sys
c:\windows\system32\getwn32.dll
c:\windows\system32\hrdsbqrh.dll
c:\windows\system32\lhzyhh.dll
c:\windows\system32\msansspc.dll
c:\windows\system32\qivicwqi.dll
c:\windows\system32\rtfpspfb.dll
c:\windows\system32\TDSSarxx.dll
c:\windows\system32\TDSSkkai.log
c:\windows\system32\TDSSmtye.dat
c:\windows\system32\TDSSvkql.dll
c:\windows\system32\vfqbil.dll
c:\windows\system32\wertyu.dll
c:\windows\system32\yxsdorko.dll
c:\windows\wiaserviv.log

.
((((((((((((((((((((((((( Files Created from 2008-10-28 to 2008-11-30 )))))))))))))))))))))))))))))))
.

2008-11-30 13:52 . 2008-11-30 13:55 d——– C:\Lop SD
2008-11-30 01:00 . 2008-11-30 01:00 d——– C:\ERDNT
2008-11-30 00:59 . 2008-11-30 00:59 d——– c:\program files\ERUNT
2008-11-30 00:56 . 2008-11-30 00:56 d——– c:\program files\Trend Micro
2008-11-30 00:35 . 2008-11-30 00:35 d——– C:\VundoFix Backups
2008-11-29 00:09 . 2008-11-29 00:09 248 –a—— c:\windows\system32\drivers\kgpcpy.cfg
2008-11-28 13:54 . 2008-11-28 14:03 2,408 –a—— c:\windows\system32\drivers\kgpfr2.cfg
2008-11-28 13:53 . 2008-11-28 13:53 d——– c:\documents and settings\All Users\Application Data\SITEguard
2008-11-28 13:51 . 2008-11-28 13:51 d——– c:\program files\STOPzilla!
2008-11-28 13:51 . 2008-11-28 13:51 d——– c:\program files\Common Files\iS3
2008-11-28 13:51 . 2008-11-29 00:10 d——– c:\documents and settings\All Users\Application Data\STOPzilla!
2008-11-27 22:35 . 2008-11-28 09:40 2,271 –a—— c:\windows\system32\TDSSlxcp.dll
2008-11-23 21:01 . 2007-02-01 18:02 313,344 –a—— C:\hjsplit.exe
2008-11-19 23:22 . 2008-11-19 23:22 d——– c:\documents and settings\Parthiv Thakore\LocalLow
2008-11-19 23:22 . 2008-11-19 23:22 d——– c:\documents and settings\All Users\Application Data\TVU Networks
2008-11-12 11:19 . 2008-09-04 12:15 1,106,944 —–c— c:\windows\system32\dllcache\msxml3.dll
2008-11-12 11:19 . 2008-10-24 06:21 455,296 —–c— c:\windows\system32\dllcache\mrxsmb.sys
2008-11-11 14:35 . 2008-11-11 14:35 364,544 -ra—— c:\windows\system32\IS3DBA5.dll
2008-11-09 14:23 . 2008-11-29 00:38 d——– c:\documents and settings\Parthiv Thakore\Application Data\DMCache
2008-11-03 20:51 . 2008-11-03 20:51 d——– c:\program files\MSECache
2008-10-24 05:41 . 2008-10-15 11:34 337,408 —–c— c:\windows\system32\dllcache\netapi32.dll
2008-10-23 10:01 . 2008-10-23 10:01 17,408 -ra—— c:\windows\system32\SZIO5.dll
2008-10-23 10:00 . 2008-10-23 10:00 536,576 -ra—— c:\windows\system32\SZComp5.dll
2008-10-23 10:00 . 2008-10-23 10:00 278,528 -ra—— c:\windows\system32\SZBase5.dll
2008-10-17 10:42 . 2008-10-17 10:42 152 –a—— c:\windows\wininit.ini
2008-10-15 19:32 . 2008-08-14 05:11 2,189,184 —–c— c:\windows\system32\dllcache\ntoskrnl.exe
2008-10-15 19:32 . 2008-08-14 05:09 2,145,280 —–c— c:\windows\system32\dllcache\ntkrnlmp.exe
2008-10-15 19:32 . 2008-08-14 04:33 2,066,048 —–c— c:\windows\system32\dllcache\ntkrnlpa.exe
2008-10-15 19:32 . 2008-08-14 04:33 2,023,936 —–c— c:\windows\system32\dllcache\ntkrpamp.exe
2008-10-15 19:32 . 2008-09-15 07:12 1,846,400 —–c— c:\windows\system32\dllcache\win32k.sys
2008-10-15 19:32 . 2008-09-08 05:41 333,824 —–c— c:\windows\system32\dllcache\srv.sys
2008-10-08 13:27 . 2008-10-08 13:27 49,664 -ra—— c:\windows\system32\drivers\SZKG.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-11-29 06:05 ——— d—–w c:\program files\Spybot - Search & Destroy
2008-11-28 02:04 ——— d—–w c:\documents and settings\Parthiv Thakore\Application Data\Move Networks
2008-11-20 04:57 ——— d—–w c:\program files\Online TV & Radio Stations
2008-11-09 19:36 ——— d—–w c:\program files\DivX
2008-11-09 16:17 ——— d—–w c:\program files\Veoh Networks
2008-10-24 11:21 455,296 —-a-w c:\windows\system32\drivers\mrxsmb.sys
2008-10-16 19:13 202,776 —-a-w c:\windows\system32\wuweb.dll
2008-10-16 19:13 1,809,944 —-a-w c:\windows\system32\wuaueng.dll
2008-10-16 19:12 561,688 —-a-w c:\windows\system32\wuapi.dll
2008-10-16 19:12 323,608 —-a-w c:\windows\system32\wucltui.dll
2008-10-16 19:09 92,696 —-a-w c:\windows\system32\cdm.dll
2008-10-16 19:09 51,224 —-a-w c:\windows\system32\wuauclt.exe
2008-10-16 19:09 43,544 —-a-w c:\windows\system32\wups2.dll
2008-10-16 19:08 34,328 —-a-w c:\windows\system32\wups.dll
2008-10-12 23:53 ——— d—–w c:\program files\Java
2008-09-30 21:43 1,286,152 —-a-w c:\windows\system32\msxml4.dll
2008-09-29 18:08 126,976 —-a-r c:\windows\system32\IS3HTUI5.dll
2008-09-29 18:07 61,440 —-a-r c:\windows\system32\IS3Hks5.dll
2008-09-29 18:07 372,736 —-a-r c:\windows\system32\IS3UI5.dll
2008-09-29 18:07 23,040 —-a-r c:\windows\system32\IS3XDat5.dll
2008-09-29 18:06 94,208 —-a-r c:\windows\system32\IS3Inet5.dll
2008-09-29 18:06 90,112 —-a-r c:\windows\system32\IS3Svc5.dll
2008-09-29 18:06 212,992 —-a-r c:\windows\system32\IS3Win325.dll
2008-09-29 18:03 708,608 —-a-r c:\windows\system32\IS3Base5.dll
2008-09-28 18:26 ——— d–h–w c:\program files\InstallShield Installation Information
2008-09-28 18:26 ——— d—–w c:\program files\v8200
2008-09-28 17:20 ——— d—–w c:\documents and settings\All Users\Application Data\Kaspersky Lab
2008-09-19 21:55 200,704 —-a-w c:\windows\system32\ssldivx.dll
2008-09-19 21:55 1,044,480 —-a-w c:\windows\system32\libdivx.dll
2008-09-15 12:12 1,846,400 —-a-w c:\windows\system32\win32k.sys
2008-09-10 01:14 1,307,648 —-a-w c:\windows\system32\msxml6.dll
2008-09-04 17:15 1,106,944 —-a-w c:\windows\system32\msxml3.dll
2008-08-22 07:08 878,592 —-a-w c:\windows\system32\wininet.dll
2008-08-22 07:08 43,008 —-a-w c:\windows\system32\licmgr10.dll
2008-08-22 07:07 18,944 —-a-w c:\windows\system32\corpol.dll
2008-08-22 07:06 72,704 —-a-w c:\windows\system32\admparse.dll
2008-08-22 07:06 71,680 —-a-w c:\windows\system32\iesetup.dll
2008-08-22 07:06 434,176 —-a-w c:\windows\system32\vbscript.dll
2008-08-22 07:05 48,640 —-a-w c:\windows\system32\PrivacIE.dll
2008-08-22 07:05 48,128 —-a-w c:\windows\system32\mshtmler.dll
2008-08-22 07:05 35,840 —-a-w c:\windows\system32\imgutil.dll
2008-08-22 07:04 45,568 —-a-w c:\windows\system32\mshta.exe
2008-08-22 06:57 156,160 —-a-w c:\windows\system32\msls31.dll
2008-08-14 10:09 2,145,280 —-a-w c:\windows\system32\ntoskrnl.exe
2008-08-14 09:33 2,023,936 —-a-w c:\windows\system32\ntkrnlpa.exe
2008-08-05 21:55 265,720 —-a-w c:\windows\system32\msdbg2.dll
2006-10-03 06:43 2,402,550 —-a-w c:\windows\inf\SET5BA.tmp
2004-11-25 00:00 61,440 —-a-w c:\documents and settings\Parthiv Thakore\GypsyPatcher.exe
2007-04-06 20:54 80 –sh–r c:\windows\system32\18CBEC2B90.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Creative Detector"="c:\program files\Creative\MediaSource\Detector\CTDetect.exe" [2004-12-02 102400]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]
"SetDefaultMIDI"="MIDIDef.exe" [2004-12-22 c:\windows\MIDIDEF.EXE]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTSysVol"="c:\program files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe" [2005-02-15 57344]
"SigmatelSysTrayApp"="stsystra.exe" [2005-03-22 c:\windows\stsystra.exe]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2008-04-23 29696]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LMIinit]
2007-11-15 17:46 87352 c:\windows\system32\LMIinit.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=dgbqtp.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.ffds"= ffdshow.ax
"vidc.GEOS"= c:\windows\system32\v8200\GEO-MPEG4\2008.1.7.18.9\GeoCodecD.dll
"vidc.GEOV"= c:\windows\system32\v8200\GEO-MPEG4\2008.1.7.18.9\GeoCodec.dll
"vidc.GEOX"= c:\windows\system32\v8200\GEO-MPEG4\2008.1.7.18.9\GeoCodec.dll
"vidc.GM40"= c:\windows\system32\v8200\GEO-MPEG4-ASP\2008.1.23.13.16\GXAMP4.dll
"vidc.GMP4"= c:\windows\system32\v8200\GEO-MPEG4-ASP\2008.1.23.13.16\GXAMP4.dll
"vidc.GM4H"= c:\windows\system32\v8200\GEO-MPEG4-ASP\2008.1.23.13.16\GXAMP4D.dll
"vidc.GM4S"= c:\windows\system32\v8200\GEO-MPEG4-ASP\2008.1.23.13.16\GXAMP4D.dll
"vidc.G264"= c:\windows\system32\v8200\GEO-H264\2008.1.7.18.7\GX264.dll
"vidc.G26S"= c:\windows\system32\v8200\GEO-H264\2008.1.7.18.7\GX264D.dll
"vidc.GM20"= c:\windows\system32\v8200\GEO-MPEG2\2008.1.11.20.2\GXGM20.dll
"vidc.GJPG"= c:\windows\system32\v8200\GEO-JPEG\2008.1.24.19.52\GXJPG.dll
"vidc.GAVC"= c:\windows\system32\v8200\GEO-H264-V2\2008.1.18.16.54\GXAVC.dll
"vidc.GAVS"= c:\windows\system32\v8200\GEO-H264-V2\2008.1.18.16.54\GXAVCD.dll
"msacm.geoadpcm"= c:\windows\system32\v8200\GEO-ADPCM\2007.8.14.5.32\GeoADPCM.acm

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll, msansspc.dll

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\WINDOWS\\system32\\dlcdcoms.exe"=
"c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\dlcdPSWX.EXE"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\mIRC\\mirc.exe"=
"c:\\Program Files\\Veoh Networks\\Veoh\\VeohClient.exe"=
"c:\\mIRC\\mirc.exe"=
"c:\\Program Files\\Maxthon\\Maxthon.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\v8200\\DMMultiView\\MultiView.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"135:TCP"= 135:TCP:TCP Port 135
"5000:TCP"= 5000:TCP:TCP Port 5000
"5001:TCP"= 5001:TCP:TCP Port 5001
"5002:TCP"= 5002:TCP:TCP Port 5002
"5003:TCP"= 5003:TCP:TCP Port 5003
"5004:TCP"= 5004:TCP:TCP Port 5004
"5005:TCP"= 5005:TCP:TCP Port 5005
"5006:TCP"= 5006:TCP:TCP Port 5006
"5007:TCP"= 5007:TCP:TCP Port 5007
"5008:TCP"= 5008:TCP:TCP Port 5008
"5009:TCP"= 5009:TCP:TCP Port 5009
"5010:TCP"= 5010:TCP:TCP Port 5010
"5011:TCP"= 5011:TCP:TCP Port 5011
"5012:TCP"= 5012:TCP:TCP Port 5012
"5013:TCP"= 5013:TCP:TCP Port 5013
"5014:TCP"= 5014:TCP:TCP Port 5014
"5015:TCP"= 5015:TCP:TCP Port 5015
"5016:TCP"= 5016:TCP:TCP Port 5016
"5017:TCP"= 5017:TCP:TCP Port 5017
"5018:TCP"= 5018:TCP:TCP Port 5018
"5019:TCP"= 5019:TCP:TCP Port 5019
"5020:TCP"= 5020:TCP:TCP Port 5020
"808:TCP"= 808:TCP:ccproxy port

R2 LMIRfsDriver;LogMeIn Remote File System Driver;\??\c:\windows\system32\drivers\LMIRfsDriver.sys [2008-04-30 46112]
S2 LMIInfo;LogMeIn Kernel Information Provider;\??\c:\program files\LogMeIn\x86\RaInfo.sys []
S3 dlcd_device;dlcd_device;c:\windows\system32\dlcdcoms.exe -service []
S4 LMIRfsClientNP;LMIRfsClientNP; []

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e9cb14fe-567f-11dd-888d-001372d0c2dc}]
\Shell\Auto\command - wscript "esta ig.vbs"
\Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL wscript "esta ig.vbs"

*Newly Created Service* - CATCHME
*Newly Created Service* - PROCEXP90
.
Contents of the 'Scheduled Tasks' folder

2008-11-26 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]

2008-11-18 c:\windows\Tasks\Uniblue SpyEraser Nag.job
- c:\program files\Uniblue\SpyEraser\SpyEraser.exe []

2008-08-10 c:\windows\Tasks\Uniblue SpyEraser.job
- c:\program files\Uniblue\SpyEraser\SpyEraser.exe []
.
- - - - ORPHANS REMOVED - - - -

Notify-khffExwu - khffExwu.dll


.
——- Supplementary Scan ——-
.
FireFox -: Profile - c:\documents and settings\Parthiv Thakore\Application Data\Mozilla\Firefox\Profiles\5tuxkkf3.default\
FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.yahoo.com/
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-11-30 15:23:40
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(648)
c:\windows\system32\LMIinit.dll
c:\windows\system32\LMIRfsClientNP.dll
.
Completion time: 2008-11-30 15:25:17
ComboFix-quarantined-files.txt 2008-11-30 20:24:57

Pre-Run: 226,113,593,344 bytes free
Post-Run: 226,599,006,208 bytes free

239 — E O F — 2008-11-13 05:10:47
Post #6
Hello

Open notepad and copy/paste the text in the quotebox below into it:
http://forums.whatthetech.com/Trojan_Vundo_Fixed_part_now_I_get_BUNCH_Startup_errors_t97379.html#entry505370

Collect::
c:\windows\system32\drivers\kgpcpy.cfg
c:\windows\system32\drivers\kgpfr2.cfg
c:\windows\system32\TDSSlxcp.dll

Registry::
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=""

Suspect::
Save this as CFScript.txt


[external image: Posted Image]

Refering to the picture above, drag CFScript.txt into ComboFix.exe

When finished, it shall produce a log for you. Post that log in your next reply.

**Note**

When CF finishes running, the ComboFix log will open along with a message box–do not be alarmed. With the above script, ComboFix will capture files to submit for analysis.
  • Ensure you are connected to the internet and click OK on the message box.
  • A browser will open.
  • Simply follow the instructions to copy/paste/send the requested file.
Post #7 last edited
ComboFix 08-11-30.01 - Parthiv Thakore 2008-11-30 16:18:39.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1620 [GMT -5:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Parthiv Thakore\Desktop\CFScript.txt
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\drivers\kgpcpy.cfg
c:\windows\system32\drivers\kgpfr2.cfg
c:\windows\system32\TDSSlxcp.dll

.
((((((((((((((((((((((((( Files Created from 2008-10-28 to 2008-11-30 )))))))))))))))))))))))))))))))
.

2008-11-30 13:52 . 2008-11-30 13:55 d——– C:\Lop SD
2008-11-30 01:00 . 2008-11-30 01:00 d——– C:\ERDNT
2008-11-30 00:59 . 2008-11-30 00:59 d——– c:\program files\ERUNT
2008-11-30 00:56 . 2008-11-30 00:56 d——– c:\program files\Trend Micro
2008-11-30 00:35 . 2008-11-30 00:35 d——– C:\VundoFix Backups
2008-11-28 13:53 . 2008-11-28 13:53 d——– c:\documents and settings\All Users\Application Data\SITEguard
2008-11-28 13:51 . 2008-11-28 13:51 d——– c:\program files\STOPzilla!
2008-11-28 13:51 . 2008-11-28 13:51 d——– c:\program files\Common Files\iS3
2008-11-28 13:51 . 2008-11-29 00:10 d——– c:\documents and settings\All Users\Application Data\STOPzilla!
2008-11-23 21:01 . 2007-02-01 18:02 313,344 –a—— C:\hjsplit.exe
2008-11-19 23:22 . 2008-11-19 23:22 d——– c:\documents and settings\Parthiv Thakore\LocalLow
2008-11-19 23:22 . 2008-11-19 23:22 d——– c:\documents and settings\All Users\Application Data\TVU Networks
2008-11-12 11:19 . 2008-09-04 12:15 1,106,944 —–c— c:\windows\system32\dllcache\msxml3.dll
2008-11-12 11:19 . 2008-10-24 06:21 455,296 —–c— c:\windows\system32\dllcache\mrxsmb.sys
2008-11-11 14:35 . 2008-11-11 14:35 364,544 -ra—— c:\windows\system32\IS3DBA5.dll
2008-11-09 14:23 . 2008-11-29 00:38 d——– c:\documents and settings\Parthiv Thakore\Application Data\DMCache
2008-11-03 20:51 . 2008-11-03 20:51 d——– c:\program files\MSECache
2008-10-24 05:41 . 2008-10-15 11:34 337,408 —–c— c:\windows\system32\dllcache\netapi32.dll
2008-10-23 10:01 . 2008-10-23 10:01 17,408 -ra—— c:\windows\system32\SZIO5.dll
2008-10-23 10:00 . 2008-10-23 10:00 536,576 -ra—— c:\windows\system32\SZComp5.dll
2008-10-23 10:00 . 2008-10-23 10:00 278,528 -ra—— c:\windows\system32\SZBase5.dll
2008-10-17 10:42 . 2008-10-17 10:42 152 –a—— c:\windows\wininit.ini
2008-10-15 19:32 . 2008-08-14 05:11 2,189,184 —–c— c:\windows\system32\dllcache\ntoskrnl.exe
2008-10-15 19:32 . 2008-08-14 05:09 2,145,280 —–c— c:\windows\system32\dllcache\ntkrnlmp.exe
2008-10-15 19:32 . 2008-08-14 04:33 2,066,048 —–c— c:\windows\system32\dllcache\ntkrnlpa.exe
2008-10-15 19:32 . 2008-08-14 04:33 2,023,936 —–c— c:\windows\system32\dllcache\ntkrpamp.exe
2008-10-15 19:32 . 2008-09-15 07:12 1,846,400 —–c— c:\windows\system32\dllcache\win32k.sys
2008-10-15 19:32 . 2008-09-08 05:41 333,824 —–c— c:\windows\system32\dllcache\srv.sys
2008-10-08 13:27 . 2008-10-08 13:27 49,664 -ra—— c:\windows\system32\drivers\SZKG.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-11-29 06:05 ——— d—–w c:\program files\Spybot - Search & Destroy
2008-11-28 02:04 ——— d—–w c:\documents and settings\Parthiv Thakore\Application Data\Move Networks
2008-11-20 04:57 ——— d—–w c:\program files\Online TV & Radio Stations
2008-11-09 19:36 ——— d—–w c:\program files\DivX
2008-11-09 16:17 ——— d—–w c:\program files\Veoh Networks
2008-10-24 11:21 455,296 —-a-w c:\windows\system32\drivers\mrxsmb.sys
2008-10-16 19:13 202,776 —-a-w c:\windows\system32\wuweb.dll
2008-10-16 19:13 1,809,944 —-a-w c:\windows\system32\wuaueng.dll
2008-10-16 19:12 561,688 —-a-w c:\windows\system32\wuapi.dll
2008-10-16 19:12 323,608 —-a-w c:\windows\system32\wucltui.dll
2008-10-16 19:09 92,696 —-a-w c:\windows\system32\cdm.dll
2008-10-16 19:09 51,224 —-a-w c:\windows\system32\wuauclt.exe
2008-10-16 19:09 43,544 —-a-w c:\windows\system32\wups2.dll
2008-10-16 19:08 34,328 —-a-w c:\windows\system32\wups.dll
2008-10-12 23:53 ——— d—–w c:\program files\Java
2008-09-30 21:43 1,286,152 —-a-w c:\windows\system32\msxml4.dll
2008-09-29 18:08 126,976 —-a-r c:\windows\system32\IS3HTUI5.dll
2008-09-29 18:07 61,440 —-a-r c:\windows\system32\IS3Hks5.dll
2008-09-29 18:07 372,736 —-a-r c:\windows\system32\IS3UI5.dll
2008-09-29 18:07 23,040 —-a-r c:\windows\system32\IS3XDat5.dll
2008-09-29 18:06 94,208 —-a-r c:\windows\system32\IS3Inet5.dll
2008-09-29 18:06 90,112 —-a-r c:\windows\system32\IS3Svc5.dll
2008-09-29 18:06 212,992 —-a-r c:\windows\system32\IS3Win325.dll
2008-09-29 18:03 708,608 —-a-r c:\windows\system32\IS3Base5.dll
2008-09-28 18:26 ——— d–h–w c:\program files\InstallShield Installation Information
2008-09-28 18:26 ——— d—–w c:\program files\v8200
2008-09-28 17:20 ——— d—–w c:\documents and settings\All Users\Application Data\Kaspersky Lab
2008-09-19 21:55 200,704 —-a-w c:\windows\system32\ssldivx.dll
2008-09-19 21:55 1,044,480 —-a-w c:\windows\system32\libdivx.dll
2008-09-15 12:12 1,846,400 —-a-w c:\windows\system32\win32k.sys
2008-09-10 01:14 1,307,648 —-a-w c:\windows\system32\msxml6.dll
2008-09-04 17:15 1,106,944 —-a-w c:\windows\system32\msxml3.dll
2008-08-22 07:08 878,592 —-a-w c:\windows\system32\wininet.dll
2008-08-22 07:08 43,008 —-a-w c:\windows\system32\licmgr10.dll
2008-08-22 07:07 18,944 —-a-w c:\windows\system32\corpol.dll
2008-08-22 07:06 72,704 —-a-w c:\windows\system32\admparse.dll
2008-08-22 07:06 71,680 —-a-w c:\windows\system32\iesetup.dll
2008-08-22 07:06 434,176 —-a-w c:\windows\system32\vbscript.dll
2008-08-22 07:05 48,640 —-a-w c:\windows\system32\PrivacIE.dll
2008-08-22 07:05 48,128 —-a-w c:\windows\system32\mshtmler.dll
2008-08-22 07:05 35,840 —-a-w c:\windows\system32\imgutil.dll
2008-08-22 07:04 45,568 —-a-w c:\windows\system32\mshta.exe
2008-08-22 06:57 156,160 —-a-w c:\windows\system32\msls31.dll
2008-08-14 10:09 2,145,280 —-a-w c:\windows\system32\ntoskrnl.exe
2008-08-14 09:33 2,023,936 —-a-w c:\windows\system32\ntkrnlpa.exe
2008-08-05 21:55 265,720 —-a-w c:\windows\system32\msdbg2.dll
2006-10-03 06:43 2,402,550 —-a-w c:\windows\inf\SET5BA.tmp
2004-11-25 00:00 61,440 —-a-w c:\documents and settings\Parthiv Thakore\GypsyPatcher.exe
2007-04-06 20:54 80 –sh–r c:\windows\system32\18CBEC2B90.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Creative Detector"="c:\program files\Creative\MediaSource\Detector\CTDetect.exe" [2004-12-02 102400]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]
"SetDefaultMIDI"="MIDIDef.exe" [2004-12-22 c:\windows\MIDIDEF.EXE]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTSysVol"="c:\program files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe" [2005-02-15 57344]
"SigmatelSysTrayApp"="stsystra.exe" [2005-03-22 c:\windows\stsystra.exe]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2008-04-23 29696]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LMIinit]
2007-11-15 17:46 87352 c:\windows\system32\LMIinit.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.ffds"= ffdshow.ax
"vidc.GEOS"= c:\windows\system32\v8200\GEO-MPEG4\2008.1.7.18.9\GeoCodecD.dll
"vidc.GEOV"= c:\windows\system32\v8200\GEO-MPEG4\2008.1.7.18.9\GeoCodec.dll
"vidc.GEOX"= c:\windows\system32\v8200\GEO-MPEG4\2008.1.7.18.9\GeoCodec.dll
"vidc.GM40"= c:\windows\system32\v8200\GEO-MPEG4-ASP\2008.1.23.13.16\GXAMP4.dll
"vidc.GMP4"= c:\windows\system32\v8200\GEO-MPEG4-ASP\2008.1.23.13.16\GXAMP4.dll
"vidc.GM4H"= c:\windows\system32\v8200\GEO-MPEG4-ASP\2008.1.23.13.16\GXAMP4D.dll
"vidc.GM4S"= c:\windows\system32\v8200\GEO-MPEG4-ASP\2008.1.23.13.16\GXAMP4D.dll
"vidc.G264"= c:\windows\system32\v8200\GEO-H264\2008.1.7.18.7\GX264.dll
"vidc.G26S"= c:\windows\system32\v8200\GEO-H264\2008.1.7.18.7\GX264D.dll
"vidc.GM20"= c:\windows\system32\v8200\GEO-MPEG2\2008.1.11.20.2\GXGM20.dll
"vidc.GJPG"= c:\windows\system32\v8200\GEO-JPEG\2008.1.24.19.52\GXJPG.dll
"vidc.GAVC"= c:\windows\system32\v8200\GEO-H264-V2\2008.1.18.16.54\GXAVC.dll
"vidc.GAVS"= c:\windows\system32\v8200\GEO-H264-V2\2008.1.18.16.54\GXAVCD.dll
"msacm.geoadpcm"= c:\windows\system32\v8200\GEO-ADPCM\2007.8.14.5.32\GeoADPCM.acm

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll, msansspc.dll

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\WINDOWS\\system32\\dlcdcoms.exe"=
"c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\dlcdPSWX.EXE"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\mIRC\\mirc.exe"=
"c:\\Program Files\\Veoh Networks\\Veoh\\VeohClient.exe"=
"c:\\mIRC\\mirc.exe"=
"c:\\Program Files\\Maxthon\\Maxthon.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\v8200\\DMMultiView\\MultiView.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"135:TCP"= 135:TCP:TCP Port 135
"5000:TCP"= 5000:TCP:TCP Port 5000
"5001:TCP"= 5001:TCP:TCP Port 5001
"5002:TCP"= 5002:TCP:TCP Port 5002
"5003:TCP"= 5003:TCP:TCP Port 5003
"5004:TCP"= 5004:TCP:TCP Port 5004
"5005:TCP"= 5005:TCP:TCP Port 5005
"5006:TCP"= 5006:TCP:TCP Port 5006
"5007:TCP"= 5007:TCP:TCP Port 5007
"5008:TCP"= 5008:TCP:TCP Port 5008
"5009:TCP"= 5009:TCP:TCP Port 5009
"5010:TCP"= 5010:TCP:TCP Port 5010
"5011:TCP"= 5011:TCP:TCP Port 5011
"5012:TCP"= 5012:TCP:TCP Port 5012
"5013:TCP"= 5013:TCP:TCP Port 5013
"5014:TCP"= 5014:TCP:TCP Port 5014
"5015:TCP"= 5015:TCP:TCP Port 5015
"5016:TCP"= 5016:TCP:TCP Port 5016
"5017:TCP"= 5017:TCP:TCP Port 5017
"5018:TCP"= 5018:TCP:TCP Port 5018
"5019:TCP"= 5019:TCP:TCP Port 5019
"5020:TCP"= 5020:TCP:TCP Port 5020
"808:TCP"= 808:TCP:ccproxy port

R2 LMIRfsDriver;LogMeIn Remote File System Driver;\??\c:\windows\system32\drivers\LMIRfsDriver.sys [2008-04-30 46112]
S2 LMIInfo;LogMeIn Kernel Information Provider;\??\c:\program files\LogMeIn\x86\RaInfo.sys []
S3 dlcd_device;dlcd_device;c:\windows\system32\dlcdcoms.exe -service []
S4 LMIRfsClientNP;LMIRfsClientNP; []

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e9cb14fe-567f-11dd-888d-001372d0c2dc}]
\Shell\Auto\command - wscript "esta ig.vbs"
\Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL wscript "esta ig.vbs"

*Newly Created Service* - CATCHME
*Newly Created Service* - PROCEXP90
.
Contents of the 'Scheduled Tasks' folder

2008-11-26 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]

2008-11-18 c:\windows\Tasks\Uniblue SpyEraser Nag.job
- c:\program files\Uniblue\SpyEraser\SpyEraser.exe []

2008-08-10 c:\windows\Tasks\Uniblue SpyEraser.job
- c:\program files\Uniblue\SpyEraser\SpyEraser.exe []
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-11-30 16:19:28
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(648)
c:\windows\system32\LMIinit.dll
c:\windows\system32\LMIRfsClientNP.dll
.
Completion time: 2008-11-30 16:21:08
ComboFix-quarantined-files.txt 2008-11-30 21:20:33
ComboFix2.txt 2008-11-30 20:25:17

Pre-Run: 226,633,596,928 bytes free
Post-Run: 226,622,054,400 bytes free

211 — E O F — 2008-11-13 05:10:47






I did submit the file too.

Malware Submission
Your file was successfully submitted. Please let the user helping you know that you have submitted the file.
Post #8
Hello

Please download the OTMoveIt3 by OldTimer or from here.
  • Save it to your desktop.
  • Please double-click OTMoveIt3.exe to run it. (Note: If you are running on Vista, right-click on the file and choose Run As Administrator).
  • Copy the lines in the codebox below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):

    :Processes
explorer.exe

:Services

:Reg
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e9cb14fe-567f-11dd-888d-001372d0c2dc}]

:Commands
[purity]
[emptytemp]
[start explorer]
[Reboot]
  • Return to OTMoveIt3, right click in the "Paste Instructions for Items to be Moved" window (under the yellow bar) and choose Paste.
  • Click the red Moveit! button.
  • Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
  • Close OTMoveIt3
Note: If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes. In this case, after the reboot, open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTMoveIt\MovedFiles folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post.




Please download Malwarebytes' Anti-Malware from Here or Here

Double Click mbam-setup.exe to install the application.
  • Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select "Perform Quick Scan", then click Scan.
  • The scan may take some time to finish,so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected.
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  • Copy&Paste the entire report in your next reply.
Extra Note:
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.






Go to Kaspersky website and perform an online antivirus scan.

  • Read through the requirements and privacy statement and click on Accept button.
  • It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
  • When the downloads have finished, click on Settings.
  • Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
    • Spyware, Adware, Dialers, and other potentially dangerous programs
      Archives
      Mail databases
  • Click on My Computer under Scan.
  • Once the scan is complete, it will display the results. Click on View Scan Report.
  • You will see a list of infected items there. Click on Save Report As….
  • Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button. Then post it here.
Post #9
========== PROCESSES ========== Process explorer.exe killed successfully. ========== SERVICES/DRIVERS ========== ========== REGISTRY ========== Registry key HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e9cb14fe-567f-11dd-888d-001372d0c2dc}\\ deleted successfully. ========== COMMANDS ========== File delete failed. C:\DOCUME~1\PARTHI~1\LOCALS~1\Temp\Perflib_Perfdata_a8c.dat scheduled to be deleted on reboot. User's Temp folder emptied. User's Temporary Internet Files folder emptied. User's Internet Explorer cache folder emptied. Local Service Temp folder emptied. File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot. Local Service Temporary Internet Files folder emptied. Windows Temp folder emptied. Java cache emptied. FireFox cache emptied. Temp folders emptied. Explorer started successfully OTMoveIt3 by OldTimer - Version 1.0.7.1 log created on 11302008_185220 DOing the other stuff now…
Post #11
MalwareByte log : Malwarebytes' Anti-Malware 1.30 Database version: 1439 Windows 5.1.2600 Service Pack 3 11/30/2008 8:24:00 PM mbam-log-2008-11-30 (20-24-00).txt Scan type: Full Scan (C:\|) Objects scanned: 106086 Time elapsed: 55 minute(s), 50 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 1 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 18 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{c5428486-50a0-4a02-9d20-520b59a9f9b3} (Adware.Shopping.Report) -> Quarantined and deleted successfully. Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: C:\Documents and Settings\All Users\Application Data\STOPzilla!\Quarantine\2ba08b1e-8119-44ee-83e9-85cd7fcffece.pre (Trojan.Vundo) -> Quarantined and deleted successfully. C:\Documents and Settings\All Users\Application Data\STOPzilla!\Quarantine\731d9bfb-099a-431f-a593-40e4c89c02e5.pre (Trojan.TDSS) -> Quarantined and deleted successfully. C:\Documents and Settings\All Users\Application Data\STOPzilla!\Quarantine\bb9d42ef-1ab4-4234-8396-09bddfa04391.pre (Trojan.TDSS) -> Quarantined and deleted successfully. C:\Documents and Settings\All Users\Application Data\STOPzilla!\Quarantine\c9967bbf-d68b-4dfe-b2fa-26d030edd77e.pre (Trojan.TDSS) -> Quarantined and deleted successfully. C:\Documents and Settings\All Users\Application Data\STOPzilla!\Quarantine\dbda9184-9bdd-45e8-84a2-0e762435c931.pre (Trojan.TDSS) -> Quarantined and deleted successfully. C:\Qoobox\Quarantine\C\WINDOWS\system32\TDSSarxx.dll.vir (Trojan.TDSS) -> Quarantined and deleted successfully. C:\Qoobox\Quarantine\C\WINDOWS\system32\TDSSvkql.dll.vir (Trojan.TDSS) -> Quarantined and deleted successfully. C:\Qoobox\Quarantine\C\WINDOWS\system32\drivers\TDSSmqlt.sys.vir (Trojan.TDSS) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{949FBAD4-A295-4EC3-85C3-28D1CF909E7C}\RP954\A0069652.dll (Trojan.TDSS) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{949FBAD4-A295-4EC3-85C3-28D1CF909E7C}\RP954\A0069653.dll (Trojan.Vundo) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{949FBAD4-A295-4EC3-85C3-28D1CF909E7C}\RP954\A0069654.dll (Trojan.TDSS) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{949FBAD4-A295-4EC3-85C3-28D1CF909E7C}\RP954\A0070652.sys (Trojan.TDSS) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{949FBAD4-A295-4EC3-85C3-28D1CF909E7C}\RP954\A0070653.dll (Trojan.TDSS) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{949FBAD4-A295-4EC3-85C3-28D1CF909E7C}\RP955\A0070701.dll (Trojan.Vundo) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{949FBAD4-A295-4EC3-85C3-28D1CF909E7C}\RP955\A0070702.dll (Trojan.Vundo) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{949FBAD4-A295-4EC3-85C3-28D1CF909E7C}\RP958\A0070868.sys (Trojan.TDSS) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{949FBAD4-A295-4EC3-85C3-28D1CF909E7C}\RP958\A0070869.dll (Trojan.TDSS) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{949FBAD4-A295-4EC3-85C3-28D1CF909E7C}\RP958\A0070870.dll (Trojan.TDSS) -> Quarantined and deleted successfully.
Post #12
HJT LOG : and gonna do the kaspersky thing now…




Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:28:42 PM, on 11/30/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18241)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\stsystra.exe
C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe
C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\fxssvc.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Maxthon\Maxthon.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: (no name) - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - (no file)
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O3 - Toolbar: Veoh Browser Plug-in - {D0943516-5076-4020-A3B5-AEFAF26AB263} - C:\Program Files\Veoh Networks\Veoh\Plugins\reg\VeohToolbar.dll
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe /r
O4 - HKCU\..\Run: [SetDefaultMIDI] MIDIDef.exe
O4 - HKCU\..\Run: [Creative Detector] "C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" /R
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {1D082E71-DF20-4AAF-863B-596428C49874} (TPIR Control) - http://www.worldwinner.com/games/v50/tpir/tpir.cab
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.3.3.102.cab
O16 - DPF: {8A94C905-FF9D-43B6-8708-F0F22D22B1CB} (Wwlaunch Control) - http://www.worldwinner.com/games/shared/wwlaunch.cab
O16 - DPF: {A903E5AB-C67E-40FB-94F1-E1305982F6E0} (KooPlayer Control) - http://www.idesitv.com/livetv.ocx
O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} (Get_ActiveX Control) - https://h17000.www1.hp.com/ewfrf-JAVA/Secur…loadManager.ocx
O16 - DPF: {ADACAA8F-3595-47FE-9C31-9C7471B9BEC7} (OCXDownloadChecker Control) - http://68.213.32.251/cab/OCXChecker_8198.cab
O16 - DPF: {C52439A0-2693-4E40-B141-9F9AD5257241} (Lexmark eDiagnostics Class) - https://ediagnostics.lexmark.com/serval.cab
O16 - DPF: {CAFEEFAC-0015-0000-0003-ABCDEFFEDCBA} (Java Plug-in 1.5.0_03) -
O16 - DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} (Java Plug-in 1.5.0_06) -
O16 - DPF: {FAE74270-E5EE-49C3-B816-EA8B4D55F38F} (H2hPool Control) - http://www.worldwinner.com/games/v53/h2hpool/h2hpool.cab
O16 - DPF: {FEC048AB-277A-460C-BF50-1A4193AEF148} (DownloadCenter Control) - http://68.213.32.251/cab/DownloadCenter_8200.cab
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Creative Labs Licensing Service - Creative Labs - C:\Program Files\Common Files\Creative Labs Shared\Service\CreativeLicensing.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: dlcd_device - - C:\WINDOWS\system32\dlcdcoms.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

–
End of file - 6555 bytes
Post #13
Kaspersky Report… ——————————————————————————– KASPERSKY ONLINE SCANNER 7 REPORT Sunday, November 30, 2008 Operating System: Microsoft Windows XP Professional Service Pack 3 (build 2600) Kaspersky Online Scanner 7 version: 7.0.25.0 Program database last update: Sunday, November 30, 2008 23:01:23 Records in database: 1428745 ——————————————————————————– Scan settings: Scan using the following database: extended Scan archives: yes Scan mail databases: yes Scan area - My Computer: A:\ C:\ D:\ E:\ F:\ G:\ H:\ I:\ Scan statistics: Files scanned: 63325 Threat name: 5 Infected objects: 5 Suspicious objects: 0 Duration of the scan: 01:19:03 File name / Threat name / Threats count C:\Documents and Settings\Parthiv Thakore\Shared\money hai toh honey hai .mp3 Infected: Trojan-Downloader.WMA.GetCodec.n 1 C:\mIRC\mirc.exe Infected: not-a-virus:Client-IRC.Win32.mIRC.621 1 C:\Program Files\mIRC\mirc.exe Infected: not-a-virus:Client-IRC.Win32.mIRC.63 1 C:\Qoobox\Quarantine\C\WINDOWS\system32\av.dat.vir Infected: not-a-virus:AdWare.Win32.BHO.efr 1 C:\Qoobox\Quarantine\C\WINDOWS\system32\msansspc.dll.vir Infected: Trojan.Win32.Monder.zzr 1 The selected area was scanned.
Post #14
Delete this file
C:\Documents and Settings\Parthiv Thakore\Shared\money hai toh honey hai .mp3


Follow these steps to uninstall Combofix and tools used in the removal of malware
  • Click START then RUN
  • Now type Combofix /u in the runbox and click OK. Note the space between the X and the U, it needs to be there.
    [external image: Posted Image]



  • Make sure you have an Internet Connection.
  • Download OTCleanIt to your desktop and run it
  • A list of tool components used in the Cleanup of malware will be downloaded.
  • If your Firewall or Real Time protection attempts to block OTCleanUp to reach the Internet, please allow the application to do so.
  • Click Yes to beging the Cleanup process and remove these components, including this application.
  • You will be asked to reboot the machine to finish the Cleanup process. If you are asked to reboot the machine choose Yes.



Your using an old version of Adobe Acrobat Reader, this can leave your pc open to vulnerabilities, you can update it here :
http://www.adobe.com/products/acrobat/readstep2.html




Below I have included a number of recommendations for how to protect your computer against malware infections.

* Keep Windows updated by regularly checking their website at :
http://windowsupdate.microsoft.com/
This will ensure your computer has always the latest security updates available installed on your computer.

* To reduce re-infection for malware in the future, I strongly recommend installing these free programs:

SpywareBlaster protects against bad ActiveX

* SpywareGuard offers realtime protection from spyware installation attempts. Make sure you are only running one real-time anti-spyware protection program or there will be a conflict.

Make Internet Explorer more secure
  • Click Start > Run
  • Type Inetcpl.cpl & click OK
  • Click on the Security tab
  • Click Reset all zones to default level
  • Make sure the Internet Zone is selected & Click Custom level
  • In the ActiveX section, set the first two options ("Download signed and unsigned ActiveX controls) to "Prompt", and ("Initialize and Script ActiveX controls not marked as safe") to "Disable".
  • Next Click OK, then Apply button and then OK to exit the Internet Properties page.


*ATF Cleaner - Cleans temporary files from IE and Windows, empties the recycle bin and more. Great tool to help speed up your computer and knock out those nasties that like to reside in the temp folders.

*NoScript - Addon for Firefox that stops all scripts from running on websites. Stops malicious software from invading via flash, java, javascript, and many other entry points.

*Keep a backup of your important files - Now, more than ever, it's especially important to protect your digital files and memories. This article is full of good information on alternatives for home backup solutions.

* MVPS Hosts file replaces your current HOSTS file with one containing well known ad sites and other bad sites. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer, meaning it will be difficult to infect yourself in the future.

* Please consider using an alternate browser. Mozilla's Firefox browser is fantastic; it is much more
secure than Internet Explorer, immune to almost all known browser hijackers, and also has the best built-in pop up
blocker (as an added benefit!) that I have ever seen. If you are interested, Firefox may be downloaded from
Here

* Take a good look at the following suggestions for malware prevention by reading Tony Klein’s article 'How Did I Get Infected In The First Place'
Here

Thank you for your patience, and performing all of the procedures requested.
Post #15
Ok done most of the things u had said. I do use mozilla almost 99% of the time. Just for certaint hings Icouldnt use firefox. I tried to install No script but it downloaded a file that I couldnt open and didnt know what to do with it.. noscript-1.8.6-fx+sm+fn.xpi I got blaster and SG both installed…

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI