Spyware / Malware / Virus Removal

[Resolved] Malicious Trojan Horse has disabled computer

10 min read

Looking for the outcome? Ask AI

brianleo Topic Starter

Post #1January 15, 2009, 5:56 AM UTC

Blair I was able to get log files using an earlier version of HijackThis. But I am unable to install ver 2.0.2 of HijackThis. After double clicking, I get the hour glass for a few seconds, then nothing. It seems that this malware has disabled some functions of my computer. In the System Configuration Utility, I found a few files which look suspicious. Winloggn Sprof Csrssc Vav Hdlftidl Stsystra Is there anything else I can try? ——————————- This morning I wrote the following but was kicked back for including the log files of an earlier ver of HJT Can you please help with a problem computer? AVG has identified at least 5 Trojan horses but freezes before it can remove them. Trojan horse Downloader.Generic3.3SZP Trojan horse Downloader.Generic7.ANZS Trojan horse Downloader.Small.61.AA Trojan horse BackDoor.RBot.KY Adware Generic.VDM AVG update fails each time it attempts to access the Internet. Computer will often freeze at login or just after the desktop screen has appeared; no icons appear and nothing in the sys tray. After a second or third attempt, icons appear and all seems ok. Most programs will not run as computer will eventually freeze. Browser is immediately hijacked. Malwarebytes will not run. Hard drive runs almost constantly. Network cable has been disconnected. I followed instructions as best I could. I could not get find Folder Options either by your directions or in the Control Panel. It’s gone or hidden. I ran ATF and freed up over 97MB. I have run ERUNT. Malwarebytes will not run. After double clicking, I see hour glass, then nothing happens.

LDTate

Post #2January 18, 2009, 1:52 AM UTC

Hello and Welcome to the forum.

Unable to access websites

DO NOT use any TOOLS such as Combofix, Vundofix, or HijackThis fixes without supervision.

Doing so could make your pc inoperatible and could require a full reinstall of your OS, losing all your programs and data.

Stay with this topic until I give you the all clean post.

You might want to print these instructions out.

I suggest you do this:

Double-click My Computer.
Click the Tools menu, and then click Folder Options.
Click the View tab.
Uncheck "Hide file extensions for known file types."
Under the "Hidden files" folder, select "Show hidden files and folders."
Uncheck "Hide protected operating system files."
Click Apply, and then click OK.

Please do not delete anything unless instructed to.

NOTE: worksnow is actually Combofix renamed so user is able download and run Combofix

Download worksnow from HERE:

* IMPORTANT !!! Save worksnow to your Desktop

Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. Note: If you are having difficulty properly disabling your protective programs, or are unsure as to what programs need to be disabled, please refer to the information available through this link : Protective Programs
Double click on worksnow & follow the prompts.

Note: worksnow will run without the Recovery Console installed.

Note: Combofix will run without the Recovery Console installed.
As part of it's process, combofix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.
"copy/paste" a new HijackThis log file into this thread as well.

Notes:

1.Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
3. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you – please tell your helper.
4. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

Give it atleast 20-30 minutes to finish if needed.

Also please describe how your computer behaves at the moment.

brianleo

Post #3January 22, 2009, 4:36 AM UTC

Although computer is more responsive, the HD is still exhibiting continuous activity. When using IE, images are not present. Google, my homepage shows a box with red x rather than the words Google. I am no longer being hijacked. Media player has comm error. QuickTime Player also having problems. WordPerfect seems to work OK

Log files are as follows.

ComboFix 09-01-21.02 - dany 2009-01-21 20:47:44.3 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1022.651 [GMT -7:00]
Running from: c:\documents and settings\[removed]\Desktop\worksnow.exe
AV: AVG Anti-Virus Free *On-access scanning enabled* (Outdated)
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat
c:\documents and settings\dany\Application Data\gadcom
c:\documents and settings\dany\Application Data\gadcom\gadcom.exe
c:\documents and settings\dany\Local Settings\Temporary Internet Files\fbk.sts
c:\windows\system32\ajaiqz.dll
c:\windows\system32\ajmasvak.ini
c:\windows\system32\bcjxnpxb.ini
c:\windows\system32\bvrwuobm.ini
c:\windows\system32\byXQHxuV.dll
c:\windows\system32\cequbcim.dll
c:\windows\system32\chclmpvi.ini
c:\windows\system32\cmnmxstt.ini
c:\windows\system32\config\systemprofile\Desktop\Antivirus 2009.lnk
c:\windows\system32\config\systemprofile\Desktop\Antivirus XP 2008.lnk
c:\windows\system32\config\systemprofile\Desktop\SystemDefender.lnk
c:\windows\system32\cvpddx.dll
c:\windows\system32\ddcBUNHy.dll
c:\windows\system32\drivers\TDSSmxjt.sys
c:\windows\system32\dtehuwuy.ini
c:\windows\system32\fnkikh.dll
c:\windows\system32\fnnkncql.dll
c:\windows\system32\ftgmhpkg.dll
c:\windows\system32\gwgccsqe.dll
c:\windows\system32\hbpufbax.ini
c:\windows\system32\hdlftidl.dll
c:\windows\system32\hfsbxswl.ini
c:\windows\system32\hurykgna.ini
c:\windows\system32\hxygijtp.ini
c:\windows\system32\iobrqxdn.dll
c:\windows\system32\ivpmlchc.dll
c:\windows\system32\jhahtaet.ini
c:\windows\system32\jxmhdm.dll
c:\windows\system32\lditfldh.ini
c:\windows\system32\leckcz.dll
c:\windows\system32\lhbyjdxb.ini
c:\windows\system32\ljJDWMFy.dll
c:\windows\system32\llbkekvh.ini
c:\windows\system32\lrcpvbfm.ini
c:\windows\system32\lxwxbmam.dll
c:\windows\system32\mbouwrvb.dll
c:\windows\system32\micbuqec.ini
c:\windows\system32\myualxcb.dll
c:\windows\system32\ndxqrboi.ini
c:\windows\system32\noqglsps.dll
c:\windows\system32\oeauwcgo.dll
c:\windows\system32\ogcwuaeo.ini
c:\windows\system32\pwmzge.dll
c:\windows\system32\rivipr.dll
c:\windows\system32\rqpqslfc.dll
c:\windows\system32\spslgqon.ini
c:\windows\system32\steeywtv.dll
c:\windows\system32\T2
c:\windows\system32\TDSScfub.log
c:\windows\system32\TDSSfpmp.dll
c:\windows\system32\TDSSmhxt.dat
c:\windows\system32\TDSSnmxh.log
c:\windows\system32\TDSSnrsr.dll
c:\windows\system32\TDSSoeqh.dll
c:\windows\system32\TDSSoity.dll
c:\windows\system32\TDSSosvd.dll
c:\windows\system32\TDSSriqp.dll
c:\windows\system32\TDSSsbhc.log
c:\windows\system32\tkaebm.dll
c:\windows\system32\ttBeNTwa.ini
c:\windows\system32\ttBeNTwa.ini2
c:\windows\system32\ttsxmnmc.dll
c:\windows\system32\ubeemjah.ini
c:\windows\system32\uipenyjj.dll
c:\windows\system32\urqpoNdA.dll
c:\windows\system32\verxeout.dll
c:\windows\system32\vgafxafa.ini
c:\windows\system32\vtwyeets.ini
c:\windows\system32\VuxHQXyb.ini
c:\windows\system32\VuxHQXyb.ini2
c:\windows\system32\vzwcez.dll
c:\windows\system32\wofejwip.ini
c:\windows\system32\wuoiguqq.dll
c:\windows\system32\wvUljKCU.dll
c:\windows\system32\wxssjajs.dll
c:\windows\system32\xabfupbh.dll
c:\windows\system32\xauzry.dll
c:\windows\system32\xgkcfxke.dll
c:\windows\system32\xjjiwt.dll
c:\windows\system32\xjqffpmo.ini
c:\windows\system32\xqepnnci.ini
.
—- Previous Run ——-
.
c:\docume~1\dany\LOCALS~1\Temp\tmp1.tmp
c:\docume~1\dany\LOCALS~1\Temp\tmp2.tmp
c:\temp\1cb
c:\temp\1cb\syscheck.log
c:\windows\fmark2.dat
c:\windows\IE4 Error Log.txt
c:\windows\kernel32.exe
c:\windows\system32.exe
c:\windows\system32\drivers\tdssserv.sys
c:\windows\system32\mcrh.tmp
c:\windows\system32\pac.txt
c:\windows\system32\prunnet.exe
c:\windows\system32\TDSSoeqh.dll
c:\windows\system32\tdssservers.dat

—– BITS: Possible infected sites —–

hxxp://childhe.com
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Legacy_MYWEBSEARCHSERVICE
——-\Service_MyWebSearchService

((((((((((((((((((((((((( Files Created from 2008-12-22 to 2009-01-22 )))))))))))))))))))))))))))))))
.

2009-01-21 17:23 . 2009-01-21 17:23 82,944 –a—— c:\windows\system32\piwjefow.dll
2009-01-21 17:21 . 2009-01-21 17:21 126,464 –a—— c:\windows\system32\ystiaqbb.dll
2009-01-21 17:21 . 2009-01-21 17:21 126,464 –a—— c:\windows\system32\esccyi.dll
2009-01-14 00:11 . 2009-01-14 00:11 76,040 –a—— c:\windows\system32\drivers\avgtdix.sys
2009-01-14 00:11 . 2009-01-14 00:11 10,520 –a—— c:\windows\system32\avgrsstx.dll
2009-01-14 00:10 . 2009-01-21 20:48 d——– c:\windows\system32\drivers\Avg
2009-01-14 00:10 . 2009-01-14 00:10 d——– c:\program files\AVG
2009-01-14 00:10 . 2009-01-14 00:10 97,928 –a—— c:\windows\system32\drivers\avgldx86.sys
2009-01-13 21:44 . 2009-01-14 08:33 d–h—– C:\$AVG8.VAULT$
2009-01-13 21:25 . 2009-01-14 00:10 d——– c:\documents and settings\All Users\Application Data\avg8
2009-01-13 18:49 . 2004-08-04 00:56 21,504 –a—— c:\windows\system32\hidserv.dll
2009-01-13 18:49 . 2004-08-04 00:56 21,504 –a—— c:\windows\system32\dllcache\hidserv.dll
2009-01-13 18:45 . 2004-08-03 23:08 31,616 –a—— c:\windows\system32\drivers\usbccgp.sys
2008-12-23 15:51 . 2008-12-23 15:51 15,000 –a—— c:\windows\system32\tyshb36rfjdf.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-01-14 04:44 ——— d—–w c:\program files\DIGStream
2009-01-14 03:37 ——— d—–w c:\program files\Spybot - Search & Destroy
2009-01-14 03:37 ——— d—–w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-01-14 02:48 ——— d—–w c:\documents and settings\All Users\Application Data\Yahoo!
2009-01-14 02:37 ——— d—–w c:\program files\Yahoo!
2009-01-14 02:37 ——— d—–w c:\documents and settings\dany\Application Data\Yahoo!
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{61392654-9ffa-4290-a287-9255bc3b48dc}]
2009-01-21 17:21 126464 –a—— c:\windows\system32\esccyi.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-10 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSConfig"="c:\windows\PCHealth\HelpCtr\Binaries\MSConfig.exe" [2005-09-26 169984]
"WN311T.exe"="c:\program files\NETGEAR\WN311T\WN311T.exe" [2008-03-10 565248]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-09-06 413696]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2005-06-10 81920]
"ISUSPM Startup"="c:\program files\Common Files\InstallShield\UpdateService\isuspm.exe" [2005-06-10 249856]
"ehTray"="c:\windows\ehome\ehtray.exe" [2005-09-29 67584]
"DMXLauncher"="c:\program files\Dell\Media Experience\DMXLauncher.exe" [2005-10-05 94208]
"DLA"="c:\windows\System32\DLA\DLACTRLW.EXE" [2005-09-08 122940]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-01-14 1261336]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-08-05 344064]
"SigmatelSysTrayApp"="stsystra.exe" [2005-03-22 c:\windows\stsystra.exe]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2006-05-12 24576]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"MyWebSearchService"=2 (0x2)

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgemc.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2009-01-14 97928]
R3 NETMW145;Marvell TOPDOG ™ 802.11n Driver for Windows XP;c:\windows\system32\drivers\NETMW145.sys [2008-10-10 722560]
R4 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [2009-01-14 875288]
R4 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2009-01-14 231704]
R4 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2009-01-14 76040]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{361ac05d-0e0d-11da-9aa9-806d6172696f}]
\Shell\AutoRun\command - E:\setup.exe
.
Contents of the 'Scheduled Tasks' folder

2008-12-18 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 12:34]

2009-01-22 c:\windows\Tasks\Check Updates for Windows Live Toolbar.job
- c:\program files\Windows Live Toolbar\MSNTBUP.EXE [2007-10-19 10:20]

2009-01-18 c:\windows\Tasks\pfhwcczb.job
- c:\windows\system32\urqpoNdA.dll []
.
- - - - ORPHANS REMOVED - - - -

BHO-{2775955A-E01D-46E0-A85E-65A09BEF48B3} - (no file)
BHO-{2E77A496-938A-4448-9E40-1FED03024C10} - (no file)
BHO-{41C54865-D56C-4946-84A9-45A9CC417E7B} - (no file)
BHO-{58434c01-9ea4-4f0e-b479-04f06e897c1a} - (no file)
BHO-{66885CA4-B2B7-46BE-94FF-E5862465F4F1} - (no file)
BHO-{6D794CB4-C7CD-4c6f-BFDC-9B77AFBDC02C} - c:\windows\system32\ddcBUNHy.dll
BHO-{7670C419-7219-48F9-BD92-D58113DE70B3} - c:\windows\system32\awTNeBtt.dll
BHO-{793DB3FE-955D-4443-AA60-E21DC7D6567D} - c:\windows\system32\byXQHxuV.dll
BHO-{8e7e3773-b391-45fd-97b0-08c5abb9f407} - (no file)
BHO-{974DBC6D-88A4-4702-A910-34766EE1FDE2} - (no file)
BHO-{9E83E460-7EAA-481B-91BA-8E3089234358} - (no file)
BHO-{CE23F7EB-AF4B-402A-AA3B-CAB82031BD7F} - (no file)
BHO-{E83DB368-5A48-4784-8A41-FA1C40D580BD} - (no file)
BHO-{F9F8E826-1A41-4EA9-A226-5CF6096B4246} - (no file)
HKCU-Run-XP Cleaner - c:\program files\XP Cleaner\xpc.exe
HKCU-Run-msnmsgr - c:\program files\Windows Live\Messenger\MsnMsgr.Exe
HKLM-Run-sprof - c:\program files\sprof\sprof.exe
HKLM-Run-MSKDetectorExe - c:\program files\McAfee\SpamKiller\MSKDetct.exe
ShellExecuteHooks-{6D794CB4-C7CD-4c6f-BFDC-9B77AFBDC02C} - c:\windows\system32\ddcBUNHy.dll
Notify-jkkIYooP - jkkIYooP.dll

.
——- Supplementary Scan ——-
.
uStart Page = hxxp://google.com/
uSearchMigratedDefaultURL = 687474703a2f2f7777772e676f6f676c652e636f6d2f
mSearch Bar = 687474703a2f2f7777772e676f6f676c652e636f6d2f
mSearchMigratedDefaultURL = 687474703a2f2f7777772e676f6f676c652e636f6d2f
mSearchURL = 687474703a2f2f7777772e676f6f676c652e636f6d2f
IE: &Search - ?p=ZNman000
IE: &Windows Live Search - c:\program files\Windows Live Toolbar\msntb.dll/search.htm
IE: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
IE: {{B4B52284-A248-4c51-9F7C-F0A0C67FCC9D} - c:\program files\PartyGaming\PartyCasino\RunApp.exe
Trusted Zone: amaena.com
Trusted Zone: avsystemcare.com
Trusted Zone: onerateld.com
Trusted Zone: safetydownload.com
Trusted Zone: trustedantivirus.com
Trusted Zone: virusschlacht.com
Trusted Zone: amaena.com
Trusted Zone: avsystemcare.com
Trusted Zone: musicmatch.com\online
Trusted Zone: onerateld.com
Trusted Zone: safetydownload.com
Trusted Zone: trustedantivirus.com
Trusted Zone: virusschlacht.com
DPF: {B6827EA8-89DD-42CD-8E39-8D9432DCF302} - hxxp://dexpages.com/Desktop-Icon.exe
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-01-21 20:55:33
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
———————— Other Running Processes ————————
.
c:\windows\system32\ati2evxx.exe
c:\windows\ehome\ehrecvr.exe
c:\windows\ehome\ehSched.exe
c:\program files\AVG\AVG8\avgrsx.exe
c:\windows\ehome\mcrdsvc.exe
c:\windows\system32\dllhost.exe
c:\windows\ehome\ehmsas.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2009-01-21 20:59:19 - machine was rebooted [dany]
ComboFix-quarantined-files.txt 2009-01-22 03:59:16

Pre-Run: 61,782,040,576 bytes free
Post-Run: 61,575,389,184 bytes free

Current=2 Default=2 Failed=3 LastKnownGood=4 Sets=1,2,3,4
273 — E O F — 2008-12-18 10:01:10

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:01:48 PM, on 1/21/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\NETGEAR\WN311T\WN311T.exe
C:\WINDOWS\stsystra.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\Dell\Media Experience\DMXLauncher.exe
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\rundll32.exe
C:\PROGRA~1\AVG\AVG8\avgscanx.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: {cd84b3cb-5529-782a-0924-aff945629316} - {61392654-9ffa-4290-a287-9255bc3b48dc} - C:\WINDOWS\system32\esccyi.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKLM\..\Run: [WN311T.exe] C:\Program Files\NETGEAR\WN311T\WN311T.exe
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [DMXLauncher] C:\Program Files\Dell\Media Experience\DMXLauncher.exe
O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O8 - Extra context menu item: &Search - ?p=ZNman000
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: PartyCasino - {B4B52284-A248-4c51-9F7C-F0A0C67FCC9D} - C:\Program Files\PartyGaming\PartyCasino\RunApp.exe (file missing)
O9 - Extra 'Tools' menuitem: PartyCasino - {B4B52284-A248-4c51-9F7C-F0A0C67FCC9D} - C:\Program Files\PartyGaming\PartyCasino\RunApp.exe (file missing)
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Littlewoods Casino - {BAA37C20-5000-11DB-B0DE-0800200C9A66} - http://www.littlewoodscasino.com (file missing) (HKCU)
O9 - Extra 'Tools' menuitem: Littlewoods Casino - {BAA37C20-5000-11DB-B0DE-0800200C9A66} - http://www.littlewoodscasino.com (file missing) (HKCU)
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O15 - Trusted Zone: *.amaena.com
O15 - Trusted Zone: *.avsystemcare.com
O15 - Trusted Zone: *.onerateld.com
O15 - Trusted Zone: *.safetydownload.com
O15 - Trusted Zone: *.trustedantivirus.com
O15 - Trusted Zone: *.virusschlacht.com
O15 - Trusted Zone: *.amaena.com (HKLM)
O15 - Trusted Zone: *.avsystemcare.com (HKLM)
O15 - Trusted Zone: *.onerateld.com (HKLM)
O15 - Trusted Zone: *.safetydownload.com (HKLM)
O15 - Trusted Zone: *.trustedantivirus.com (HKLM)
O15 - Trusted Zone: *.virusschlacht.com (HKLM)
O16 - DPF: {B6827EA8-89DD-42CD-8E39-8D9432DCF302} - http://dexpages.com/Desktop-Icon.exe
O16 - DPF: {D8089245-3211-40F6-819B-9E5E92CD61A2} (FlashXControl Object) - https://signin3.valueactive.com/Register/Br…018/flashax.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe

–
End of file - 7340 bytes

LDTate

Post #4January 22, 2009, 1:26 PM UTC

Download DelDomains.inf
http://www.mvps.org/winhelp2002/DelDomains.inf

Right-click and select….. Save Target As….Save

This download includes a simple batch file (mvps.bat) that will rename the existing HOSTS file to HOSTS.MVP then copy the included updated HOSTS file to the proper location. For more information please see the readme.txt included in the download.
http://www.mvps.org/winhelp2002/readme.txt

Next:

Copy/paste the text in the Codebox below into notepad:

Here's how to do that:
Click Start > Run type Notepad click OK.
This will open an empty notepad file:

Take your mouse, and place your cursor at the beginning of the text in the box below, then click and hold the left mouse button, while pulling your mouse over the text. This should highlight the text. Now release the left mouse button. Now, with the cursor over the highlighted text, right click the mouse for options, and select 'copy'. Now over the empty Notepad box, right click your mouse again, and select 'paste' and you will have copied and pasted the text.

File::
c:\windows\system32\piwjefow.dll
c:\windows\system32\ystiaqbb.dll
c:\windows\system32\esccyi.dll
c:\windows\system32\tyshb36rfjdf.dll

Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{61392654-9ffa-4290-a287-9255bc3b48dc}]

Save this file to your desktop, Save this as "CFScript"

Here's how to do that:
1.Click File;
2.Click Save As… Change the directory to your desktop;
3.Change the Save as type to "All Files";
4.Type in the file name: CFScript
5.Click Save …

[external image: Posted Image]

Drag CFScript.txt into ComboFix.exe

Then post the results log and a new HijackThis log.

Also please describe how your computer behaves at the moment.

brianleo

Post #5January 22, 2009, 7:22 PM UTC

HD is no longer exhibiting excessive activity.

Still having same issue with IE: many images are not present. Google, my homepage shows a small icon ( the little red, green ,blue objects in a box) and simple text "Google" not the normal logo with colored font. Other web sites are similar. Not being hijacked.

Both Media player and QuickTime Player still having problems. Players cannot read music files. Media player has "unknown error: C00D11CD"

WordPerfect working OK

Log files are as follows.

ComboFix 09-01-21.04 - dany 2009-01-22 11:36:47.4 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1022.620 [GMT -7:00]
Running from: c:\documents and settings\[removed]\Desktop\worksnow.exe
Command switches used :: c:\documents and settings\dany\Desktop\CFScript.txt
AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated)
* Created a new restore point

FILE ::
c:\windows\system32\esccyi.dll
c:\windows\system32\piwjefow.dll
c:\windows\system32\tyshb36rfjdf.dll
c:\windows\system32\ystiaqbb.dll
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\piwjefow.dll
c:\windows\system32\tyshb36rfjdf.dll
c:\windows\system32\ystiaqbb.dll

.
((((((((((((((((((((((((( Files Created from 2008-12-22 to 2009-01-22 )))))))))))))))))))))))))))))))
.

2009-01-22 11:14 . 2009-01-22 11:17 d——– C:\backup-1-22-09
2009-01-21 21:01 . 2009-01-21 21:01 d——– c:\program files\Trend Micro
2009-01-14 00:11 . 2009-01-14 00:11 76,040 –a—— c:\windows\system32\drivers\avgtdix.sys
2009-01-14 00:11 . 2009-01-14 00:11 10,520 –a—— c:\windows\system32\avgrsstx.dll
2009-01-14 00:10 . 2009-01-22 10:21 d——– c:\windows\system32\drivers\Avg
2009-01-14 00:10 . 2009-01-14 00:10 d——– c:\program files\AVG
2009-01-14 00:10 . 2009-01-14 00:10 97,928 –a—— c:\windows\system32\drivers\avgldx86.sys
2009-01-13 21:44 . 2009-01-21 21:28 d–h—– C:\$AVG8.VAULT$
2009-01-13 21:25 . 2009-01-14 00:10 d——– c:\documents and settings\All Users\Application Data\avg8
2009-01-13 18:49 . 2004-08-04 00:56 21,504 –a—— c:\windows\system32\hidserv.dll
2009-01-13 18:49 . 2004-08-04 00:56 21,504 –a—— c:\windows\system32\dllcache\hidserv.dll
2009-01-13 18:45 . 2004-08-03 23:08 31,616 –a—— c:\windows\system32\drivers\usbccgp.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-01-14 04:44 ——— d—–w c:\program files\DIGStream
2009-01-14 03:37 ——— d—–w c:\program files\Spybot - Search & Destroy
2009-01-14 03:37 ——— d—–w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-01-14 02:48 ——— d—–w c:\documents and settings\All Users\Application Data\Yahoo!
2009-01-14 02:37 ——— d—–w c:\program files\Yahoo!
2009-01-14 02:37 ——— d—–w c:\documents and settings\dany\Application Data\Yahoo!
2008-12-14 22:57 2,828 –sha-w c:\windows\system32\KGyGaAvL.sys
2008-12-13 06:40 3,593,216 ——w c:\windows\system32\dllcache\mshtml.dll
2008-12-11 11:57 333,184 —-a-w c:\windows\system32\drivers\srv.sys
2008-12-11 11:57 333,184 ——w c:\windows\system32\dllcache\srv.sys
2008-10-24 11:10 453,632 ——w c:\windows\system32\dllcache\mrxsmb.sys
2008-10-23 13:01 283,648 —-a-w c:\windows\system32\gdi32.dll
2008-10-23 13:01 283,648 ——w c:\windows\system32\dllcache\gdi32.dll
.

((((((((((((((((((((((((((((( snapshot@2009-01-21_20.58.07.87 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-12-09 23:24:37 17,593,280 —-a-w c:\windows\system32\MRT.exe
+ 2009-01-10 01:35:28 20,853,704 —-a-w c:\windows\system32\MRT.exe
- 2007-07-27 16:41:40 16,760 —-a-w c:\windows\system32\spmsg.dll
+ 2007-11-30 12:39:22 17,272 ——w c:\windows\system32\spmsg.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-10 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WN311T.exe"="c:\program files\NETGEAR\WN311T\WN311T.exe" [2008-03-10 565248]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-09-06 413696]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2005-06-10 81920]
"ISUSPM Startup"="c:\program files\Common Files\InstallShield\UpdateService\isuspm.exe" [2005-06-10 249856]
"ehTray"="c:\windows\ehome\ehtray.exe" [2005-09-29 67584]
"DMXLauncher"="c:\program files\Dell\Media Experience\DMXLauncher.exe" [2005-10-05 94208]
"DLA"="c:\windows\System32\DLA\DLACTRLW.EXE" [2005-09-08 122940]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-01-14 1261336]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-08-05 344064]
"SigmatelSysTrayApp"="stsystra.exe" [2005-03-22 c:\windows\stsystra.exe]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2006-05-12 24576]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"MyWebSearchService"=2 (0x2)

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgemc.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2009-01-14 97928]
R3 NETMW145;Marvell TOPDOG ™ 802.11n Driver for Windows XP;c:\windows\system32\drivers\NETMW145.sys [2008-10-10 722560]
R4 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [2009-01-14 875288]
R4 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2009-01-14 231704]
R4 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2009-01-14 76040]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{361ac05d-0e0d-11da-9aa9-806d6172696f}]
\Shell\AutoRun\command - E:\setup.exe
.
Contents of the 'Scheduled Tasks' folder

2008-12-18 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 12:34]

2009-01-22 c:\windows\Tasks\Check Updates for Windows Live Toolbar.job
- c:\program files\Windows Live Toolbar\MSNTBUP.EXE [2007-10-19 10:20]

2009-01-22 c:\windows\Tasks\pfhwcczb.job
- c:\windows\system32\urqpoNdA.dll []
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://google.com/
uSearchMigratedDefaultURL = 687474703a2f2f7777772e676f6f676c652e636f6d2f
mSearch Bar = 687474703a2f2f7777772e676f6f676c652e636f6d2f
mSearchMigratedDefaultURL = 687474703a2f2f7777772e676f6f676c652e636f6d2f
mSearchURL = 687474703a2f2f7777772e676f6f676c652e636f6d2f
IE: &Search - ?p=ZNman000
IE: &Windows Live Search - c:\program files\Windows Live Toolbar\msntb.dll/search.htm
IE: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
IE: {{B4B52284-A248-4c51-9F7C-F0A0C67FCC9D} - c:\program files\PartyGaming\PartyCasino\RunApp.exe
DPF: {B6827EA8-89DD-42CD-8E39-8D9432DCF302} - hxxp://dexpages.com/Desktop-Icon.exe
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-01-22 11:38:26
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2009-01-22 11:39:51
ComboFix-quarantined-files.txt 2009-01-22 18:39:50
ComboFix2.txt 2009-01-22 03:59:20

Pre-Run: 61,503,893,504 bytes free
Post-Run: 61,484,429,312 bytes free

Current=2 Default=2 Failed=3 LastKnownGood=4 Sets=1,2,3,4
137 — E O F — 2009-01-22 04:40:22

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:45:16 AM, on 1/22/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\NETGEAR\WN311T\WN311T.exe
C:\WINDOWS\stsystra.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\Program Files\Dell\Media Experience\DMXLauncher.exe
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [WN311T.exe] C:\Program Files\NETGEAR\WN311T\WN311T.exe
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [DMXLauncher] C:\Program Files\Dell\Media Experience\DMXLauncher.exe
O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O8 - Extra context menu item: &Search - ?p=ZNman000
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: PartyCasino - {B4B52284-A248-4c51-9F7C-F0A0C67FCC9D} - C:\Program Files\PartyGaming\PartyCasino\RunApp.exe (file missing)
O9 - Extra 'Tools' menuitem: PartyCasino - {B4B52284-A248-4c51-9F7C-F0A0C67FCC9D} - C:\Program Files\PartyGaming\PartyCasino\RunApp.exe (file missing)
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Littlewoods Casino - {BAA37C20-5000-11DB-B0DE-0800200C9A66} - http://www.littlewoodscasino.com (file missing) (HKCU)
O9 - Extra 'Tools' menuitem: Littlewoods Casino - {BAA37C20-5000-11DB-B0DE-0800200C9A66} - http://www.littlewoodscasino.com (file missing) (HKCU)
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: {B6827EA8-89DD-42CD-8E39-8D9432DCF302} - http://dexpages.com/Desktop-Icon.exe
O16 - DPF: {D8089245-3211-40F6-819B-9E5E92CD61A2} (FlashXControl Object) - https://signin3.valueactive.com/Register/Br…018/flashax.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe

–
End of file - 6445 bytes

brianleo

Post #6January 22, 2009, 9:33 PM UTC

Update to earlier post of this morning 1-22-09. I have resolved Media Player and QuickTime issues. However, after a reboot AVG found (and Healed) Trojan Horse Generic 12AZKS. It also found tracking cooking from tribalfusion and adbrite which were moved to the vault.

LDTate

Post #7January 23, 2009, 1:38 AM UTC

Copy/paste the text in the Codebox below into notepad:

Here's how to do that:
Click Start > Run type Notepad click OK.
This will open an empty notepad file:

Take your mouse, and place your cursor at the beginning of the text in the box below, then click and hold the left mouse button, while pulling your mouse over the text. This should highlight the text. Now release the left mouse button. Now, with the cursor over the highlighted text, right click the mouse for options, and select 'copy'. Now over the empty Notepad box, right click your mouse again, and select 'paste' and you will have copied and pasted the text.

File::
c:\windows\system32\urqpoNdA.dll
c:\windows\Tasks\pfhwcczb.job

brianleo

Post #8January 25, 2009, 1:57 AM UTC

Issue with IE remains: many images are not present. Google, my homepage shows a small icon ( the little red, green ,blue objects in a box) and simple text "Google" not the normal logo with colored font. Other web sites are similar. Not being hijacked.

HD is no longer exhibiting excessive activity.

After running ComboFix and HijackThis, I also ran Malwarebytes -4 infected objects were found.

Log files are as follows:

ComboFix 09-01-21.04 - dany 2009-01-24 18:28:23.5 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1022.618 [GMT -7:00]
Running from: c:\documents and settings\[removed]\Desktop\worksnow.exe
Command switches used :: c:\documents and settings\dany\Desktop\CFScript.txt
AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated)
* Created a new restore point
.

((((((((((((((((((((((((( Files Created from 2008-12-25 to 2009-01-25 )))))))))))))))))))))))))))))))
.

2009-01-24 18:26 . 2009-01-24 18:27 d——– C:\32788R22FWJFW
2009-01-22 12:58 . 2009-01-22 12:58 d——– c:\documents and settings\All Users\Application Data\Apple Computer
2009-01-22 12:41 . 2009-01-22 12:41 d——– c:\program files\Windows Media Connect 2
2009-01-22 12:41 . 2006-10-04 07:06 1,197,294 ——— c:\windows\system32\dllcache\sysmain.sdb
2009-01-22 12:41 . 2006-10-04 07:06 764,868 ——— c:\windows\system32\dllcache\apph_sp.sdb
2009-01-22 12:41 . 2006-10-04 07:06 217,118 ——— c:\windows\system32\dllcache\apphelp.sdb
2009-01-22 12:39 . 2009-01-22 12:40 d——– c:\windows\system32\drivers\UMDF
2009-01-22 11:14 . 2009-01-22 11:17 d——– C:\backup-1-22-09
2009-01-21 21:01 . 2009-01-21 21:01 d——– c:\program files\Trend Micro
2009-01-14 00:11 . 2009-01-14 00:11 76,040 –a—— c:\windows\system32\drivers\avgtdix.sys
2009-01-14 00:11 . 2009-01-14 00:11 10,520 –a—— c:\windows\system32\avgrsstx.dll
2009-01-14 00:10 . 2009-01-24 17:57 d——– c:\windows\system32\drivers\Avg
2009-01-14 00:10 . 2009-01-14 00:10 d——– c:\program files\AVG
2009-01-14 00:10 . 2009-01-14 00:10 97,928 –a—— c:\windows\system32\drivers\avgldx86.sys
2009-01-13 21:44 . 2009-01-22 14:00 d–h—– C:\$AVG8.VAULT$
2009-01-13 21:25 . 2009-01-14 00:10 d——– c:\documents and settings\All Users\Application Data\avg8
2009-01-13 18:49 . 2004-08-04 00:56 21,504 –a—— c:\windows\system32\hidserv.dll
2009-01-13 18:49 . 2004-08-04 00:56 21,504 –a—— c:\windows\system32\dllcache\hidserv.dll
2009-01-13 18:45 . 2004-08-03 23:08 31,616 –a—— c:\windows\system32\drivers\usbccgp.sys
2009-01-05 16:18 . 2009-01-05 16:18 90,112 –a—— c:\windows\system32\QuickTimeVR.qtx
2009-01-05 16:18 . 2009-01-05 16:18 57,344 –a—— c:\windows\system32\QuickTime.qts

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-01-22 20:26 ——— d—–w c:\program files\QuickTime
2009-01-14 04:44 ——— d—–w c:\program files\DIGStream
2009-01-14 03:37 ——— d—–w c:\program files\Spybot - Search & Destroy
2009-01-14 03:37 ——— d—–w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-01-14 02:48 ——— d—–w c:\documents and settings\All Users\Application Data\Yahoo!
2009-01-14 02:37 ——— d—–w c:\program files\Yahoo!
2009-01-14 02:37 ——— d—–w c:\documents and settings\dany\Application Data\Yahoo!
2008-12-14 22:57 2,828 –sha-w c:\windows\system32\KGyGaAvL.sys
2008-12-13 06:40 3,593,216 ——w c:\windows\system32\dllcache\mshtml.dll
2008-12-11 11:57 333,184 —-a-w c:\windows\system32\drivers\srv.sys
2008-12-11 11:57 333,184 ——w c:\windows\system32\dllcache\srv.sys
.

((((((((((((((((((((((((((((( snapshot@2009-01-21_20.58.07.87 )))))))))))))))))))))))))))))))))))))))))
.
+ 2006-10-04 14:05:26 39,424 ——w c:\windows\AppPatch\acadproc.dll
- 2006-05-12 14:47:00 1,863,680 —-a-w c:\windows\assembly\GAC\EhCM\6.0.3000.0__31bf3856ad364e35\EhCM.dll
+ 2009-01-22 19:48:17 1,863,680 —-a-w c:\windows\assembly\GAC\EhCM\6.0.3000.0__31bf3856ad364e35\ehcm.dll
- 2006-05-12 14:47:00 864,256 —-a-w c:\windows\assembly\GAC\ehepg\6.0.3000.0__31bf3856ad364e35\ehepg.dll
+ 2009-01-22 19:48:17 868,352 —-a-w c:\windows\assembly\GAC\ehepg\6.0.3000.0__31bf3856ad364e35\ehepg.dll
- 2006-05-12 14:47:00 204,800 —-a-w c:\windows\assembly\GAC\ehiPlay\6.0.3000.0__31bf3856ad364e35\ehiPlay.dll
+ 2009-01-22 19:48:18 204,800 —-a-w c:\windows\assembly\GAC\ehiPlay\6.0.3000.0__31bf3856ad364e35\ehiplay.dll
- 2005-08-05 19:01:54 239,104 —-a-w c:\windows\Driver Cache\i386\psisdecd.dll
+ 2006-10-09 23:12:14 235,008 —-a-w c:\windows\Driver Cache\i386\psisdecd.dll
- 2005-12-15 17:14:04 1,863,680 —-a-w c:\windows\ehome\ehcm.dll
+ 2006-10-09 23:16:00 1,863,680 —-a-w c:\windows\ehome\ehcm.dll
- 2005-12-15 17:06:16 864,256 —-a-w c:\windows\ehome\ehepg.dll
+ 2006-10-09 23:07:44 868,352 —-a-w c:\windows\ehome\ehepg.dll
- 2005-12-15 17:14:50 332,288 —-a-w c:\windows\ehome\ehglid.dll
+ 2006-10-09 23:17:04 328,704 —-a-w c:\windows\ehome\ehglid.dll
- 2004-08-10 09:11:48 178,688 —-a-w c:\windows\ehome\ehkeyctl.dll
+ 2006-10-09 23:18:32 178,176 —-a-w c:\windows\ehome\ehkeyctl.dll
- 2005-12-15 17:14:40 237,568 —-a-w c:\windows\ehome\ehrecvr.exe
+ 2006-10-09 23:16:56 237,568 —-a-w c:\windows\ehome\ehrecvr.exe
- 2005-12-15 17:18:12 3,219,456 —-a-w c:\windows\ehome\ehshell.exe
+ 2006-10-09 23:19:14 3,223,552 —-a-w c:\windows\ehome\ehshell.exe
- 2005-12-15 17:14:28 558,080 —-a-w c:\windows\ehome\ehui.dll
+ 2006-10-09 23:16:30 558,592 —-a-w c:\windows\ehome\ehui.dll
- 2005-12-15 17:11:02 106,496 —-a-w c:\windows\ehome\mstvcapn.dll
+ 2006-10-09 23:12:52 107,008 —-a-w c:\windows\ehome\mstvcapn.dll
- 2004-08-10 10:00:00 192,512 —-a-w c:\windows\inf\unregmp2.exe
+ 2006-11-02 01:31:34 315,904 —-a-w c:\windows\inf\unregmp2.exe
- 2004-08-10 10:00:00 8,192 —-a-w c:\windows\system32\asferror.dll
+ 2006-10-19 04:47:08 7,168 —-a-w c:\windows\system32\asferror.dll
- 2004-08-10 10:00:00 480,768 —-a-w c:\windows\system32\audiodev.dll
+ 2006-10-19 04:47:08 276,992 —-a-w c:\windows\system32\audiodev.dll
- 2006-03-03 12:26:29 429,056 —-a-w c:\windows\system32\blackbox.dll
+ 2006-10-19 04:47:10 542,720 —-a-w c:\windows\system32\blackbox.dll
- 2005-08-03 23:29:52 207,872 —-a-w c:\windows\system32\cewmdm.dll
+ 2006-10-19 04:47:10 229,376 —-a-w c:\windows\system32\cewmdm.dll
- 2005-12-15 17:14:04 1,863,680 ——w c:\windows\system32\dllcache\ehcm.dll
+ 2006-10-09 23:16:00 1,863,680 ——w c:\windows\system32\dllcache\ehcm.dll
- 2005-12-15 17:06:16 864,256 ——w c:\windows\system32\dllcache\ehepg.dll
+ 2006-10-09 23:07:44 868,352 ——w c:\windows\system32\dllcache\ehepg.dll
- 2005-12-15 17:14:50 332,288 ——w c:\windows\system32\dllcache\ehglid.dll
+ 2006-10-09 23:17:04 328,704 ——w c:\windows\system32\dllcache\ehglid.dll
- 2005-12-15 17:18:12 3,219,456 ——w c:\windows\system32\dllcache\ehshell.exe
+ 2006-10-09 23:19:14 3,223,552 ——w c:\windows\system32\dllcache\ehshell.exe
- 2005-12-15 17:14:28 558,080 ——w c:\windows\system32\dllcache\ehui.dll
+ 2006-10-09 23:16:30 558,592 ——w c:\windows\system32\dllcache\ehui.dll
+ 2006-10-09 23:12:44 456,192 ——w c:\windows\system32\dllcache\encdec.dll
- 2008-06-11 09:47:52 96,768 ——w c:\windows\system32\dllcache\logagent.exe
+ 2008-06-18 08:09:22 100,864 ——w c:\windows\system32\dllcache\logagent.exe
- 2005-12-15 17:13:54 1,669,632 ——w c:\windows\system32\dllcache\msvidctl.dll
+ 2006-10-09 23:15:52 1,669,632 ——w c:\windows\system32\dllcache\msvidctl.dll
+ 2006-10-09 23:12:14 235,008 ——w c:\windows\system32\dllcache\psisdecd.dll
+ 2006-10-09 23:12:40 291,840 ——w c:\windows\system32\dllcache\sbe.dll
- 2007-10-27 23:39:46 228,864 ——w c:\windows\system32\dllcache\wmasf.dll
+ 2007-10-28 00:40:30 222,720 ——w c:\windows\system32\dllcache\wmasf.dll
- 2008-06-11 09:58:16 988,672 ——w c:\windows\system32\dllcache\WMNetmgr.dll
+ 2008-06-18 12:03:08 938,496 ——w c:\windows\system32\dllcache\WMNetmgr.dll
- 2008-06-11 09:58:24 2,330,624 ——w c:\windows\system32\dllcache\WMVCore.dll
+ 2008-06-18 12:03:14 2,458,112 ——w c:\windows\system32\dllcache\WMVCore.dll
+ 2006-10-19 04:47:22 671,232 ——w c:\windows\system32\drivers\UMDF\wpdmtpdr.dll
- 2006-03-03 12:33:01 18,944 —-a-w c:\windows\system32\drivers\wpdusb.sys
+ 2006-10-19 03:00:00 38,528 —-a-w c:\windows\system32\drivers\wpdusb.sys
+ 2006-09-29 01:55:50 77,568 ——w c:\windows\system32\drivers\WudfPf.sys
+ 2006-09-29 02:00:34 82,944 ——w c:\windows\system32\drivers\WudfRd.sys
- 2005-08-03 23:29:52 178,936 —-a-w c:\windows\system32\drmupgds.exe
+ 2006-10-19 03:00:46 249,856 —-a-w c:\windows\system32\drmupgds.exe
- 2006-03-03 12:26:57 581,632 —-a-w c:\windows\system32\drmv2clt.dll
+ 2006-10-19 04:47:10 991,744 —-a-w c:\windows\system32\drmv2clt.dll
- 2005-08-05 19:01:54 356,352 —-a-w c:\windows\system32\encdec.dll
+ 2006-10-09 23:12:44 456,192 —-a-w c:\windows\system32\encdec.dll
- 2005-08-03 23:29:52 6,656 —-a-w c:\windows\system32\laprxy.dll
+ 2006-10-19 04:47:14 11,264 —-a-w c:\windows\system32\LAPRXY.dll
- 2008-06-11 09:47:52 96,768 —-a-w c:\windows\system32\logagent.exe
+ 2008-06-18 08:09:22 100,864 —-a-w c:\windows\system32\logagent.exe
- 2005-08-03 23:29:52 106,496 —-a-w c:\windows\system32\mfplat.dll
+ 2006-10-19 04:47:14 212,992 —-a-w c:\windows\system32\MFPLAT.dll
+ 2006-10-19 04:47:14 259,072 ——w c:\windows\system32\MP43DECD.dll
- 2004-08-10 10:00:00 310,272 —-a-w c:\windows\system32\mp43dmod.dll
+ 2006-10-19 04:47:14 4,096 —-a-w c:\windows\system32\MP43DMOD.dll
+ 2006-10-19 04:47:14 317,440 ——w c:\windows\system32\MP4SDECD.dll
- 2004-08-10 10:00:00 384,512 —-a-w c:\windows\system32\mp4sdmod.dll
+ 2006-10-19 04:47:14 4,096 —-a-w c:\windows\system32\MP4SDMOD.dll
+ 2006-10-19 04:47:14 259,072 ——w c:\windows\system32\MPG4DECD.dll
- 2004-08-10 10:00:00 240,640 —-a-w c:\windows\system32\mpg4dmod.dll
+ 2006-10-19 04:47:14 4,096 —-a-w c:\windows\system32\MPG4DMOD.dll
- 2008-12-09 23:24:37 17,593,280 —-a-w c:\windows\system32\MRT.exe
+ 2009-01-10 01:35:28 20,853,704 —-a-w c:\windows\system32\MRT.exe
+ 2006-10-02 22:28:42 312,128 ——w c:\windows\system32\msdelta.dll
- 2005-08-03 23:29:52 115,200 —-a-w c:\windows\system32\msnetobj.dll
+ 2006-10-19 04:47:16 179,712 —-a-w c:\windows\system32\msnetobj.dll
- 2005-08-03 23:29:52 25,088 —-a-w c:\windows\system32\MsPMSNSv.dll
+ 2006-10-19 04:47:16 27,136 —-a-w c:\windows\system32\mspmsnsv.dll
- 2005-08-03 23:29:52 173,568 —-a-w c:\windows\system32\MsPMSP.dll
+ 2006-10-19 04:47:16 175,616 —-a-w c:\windows\system32\mspmsp.dll
- 2005-08-03 23:29:52 353,520 —-a-w c:\windows\system32\MSSCP.dll
+ 2006-10-19 04:47:16 414,208 —-a-w c:\windows\system32\msscp.dll
- 2005-12-15 17:13:54 1,669,632 —-a-w c:\windows\system32\msvidctl.dll
+ 2006-10-09 23:15:52 1,669,632 —-a-w c:\windows\system32\msvidctl.dll
- 2005-08-03 23:29:52 315,904 —-a-w c:\windows\system32\MSWMDM.dll
+ 2006-10-19 04:47:16 321,536 —-a-w c:\windows\system32\mswmdm.dll
+ 2006-10-19 04:47:18 284,160 ——w c:\windows\system32\PortableDeviceApi.dll
+ 2006-10-19 04:47:18 101,888 ——w c:\windows\system32\PortableDeviceClassExtension.dll
+ 2006-10-19 04:47:18 166,912 ——w c:\windows\system32\PortableDeviceTypes.dll
+ 2006-10-19 04:47:18 132,096 ——w c:\windows\system32\PortableDeviceWiaCompat.dll
+ 2006-10-19 04:47:18 199,168 ——w c:\windows\system32\PortableDeviceWMDRM.dll
- 2005-08-05 19:01:54 239,104 —-a-w c:\windows\system32\psisdecd.dll
+ 2006-10-09 23:12:14 235,008 —-a-w c:\windows\system32\psisdecd.dll
- 2005-08-03 23:29:52 221,184 —-a-w c:\windows\system32\qasf.dll
+ 2006-10-19 04:47:18 211,456 —-a-w c:\windows\system32\qasf.dll
- 2005-08-05 19:01:54 282,112 —-a-w c:\windows\system32\sbe.dll
+ 2006-10-09 23:12:40 291,840 —-a-w c:\windows\system32\sbe.dll
- 2005-08-04 01:05:58 47,104 —-a-w c:\windows\system32\uwdf.exe
+ 2006-10-19 04:58:00 8,704 —-a-w c:\windows\system32\uwdf.exe
- 2005-08-04 01:05:53 15,872 —-a-w c:\windows\system32\wdfapi.dll
+ 2006-10-19 04:47:18 4,096 —-a-w c:\windows\system32\wdfapi.dll
- 2005-08-04 01:05:55 38,912 —-a-w c:\windows\system32\wdfmgr.exe
+ 2006-10-19 04:58:00 8,704 —-a-w c:\windows\system32\wdfmgr.exe
- 2005-08-03 23:29:52 359,936 —-a-w c:\windows\system32\wmadmod.dll
+ 2006-10-19 04:47:18 757,248 —-a-w c:\windows\system32\WMADMOD.dll
- 2005-08-03 23:29:52 716,288 —-a-w c:\windows\system32\wmadmoe.dll
+ 2006-10-19 04:47:18 1,117,696 —-a-w c:\windows\system32\WMADMOE.dll
- 2007-10-27 23:39:46 228,864 —-a-w c:\windows\system32\wmasf.dll
+ 2007-10-28 00:40:30 222,720 —-a-w c:\windows\system32\wmasf.dll
- 2005-08-03 23:29:52 29,184 —-a-w c:\windows\system32\WMDMLOG.dll
+ 2006-10-19 04:47:18 33,792 —-a-w c:\windows\system32\wmdmlog.dll
- 2005-08-03 23:29:52 37,376 —-a-w c:\windows\system32\WMDMPS.dll
+ 2006-10-19 04:47:18 37,376 —-a-w c:\windows\system32\wmdmps.dll
- 2005-08-03 23:29:52 344,064 —-a-w c:\windows\system32\WMDRMdev.dll
+ 2006-10-19 04:47:18 429,056 —-a-w c:\windows\system32\wmdrmdev.dll
- 2005-08-03 23:29:52 290,816 —-a-w c:\windows\system32\WMDRMNet.dll
+ 2006-10-19 04:47:20 348,672 —-a-w c:\windows\system32\wmdrmnet.dll
- 2005-08-03 23:29:52 180,224 —-a-w c:\windows\system32\wmdrmsdk.dll
+ 2006-10-19 04:47:20 535,040 —-a-w c:\windows\system32\wmdrmsdk.dll
- 2004-08-10 10:00:00 189,440 —-a-w c:\windows\system32\wmerror.dll
+ 2006-10-19 04:47:20 227,328 —-a-w c:\windows\system32\wmerror.dll
- 2005-08-03 23:29:52 150,016 —-a-w c:\windows\system32\wmidx.dll
+ 2006-10-19 04:47:20 157,184 —-a-w c:\windows\system32\wmidx.dll
- 2008-06-11 09:58:16 988,672 —-a-w c:\windows\system32\WMNetmgr.dll
+ 2008-06-18 12:03:08 938,496 —-a-w c:\windows\system32\WMNetmgr.dll
- 2007-04-30 14:20:24 5,537,792 —-a-w c:\windows\system32\wmp.dll
+ 2006-10-19 04:47:20 10,834,432 —-a-w c:\windows\system32\wmp.dll
- 2004-08-10 10:00:00 131,072 —-a-w c:\windows\system32\wmpasf.dll
+ 2006-10-19 04:47:20 242,688 —-a-w c:\windows\system32\wmpasf.dll
- 2004-08-10 10:00:00 278,528 —-a-w c:\windows\system32\wmpdxm.dll
+ 2006-10-19 04:47:20 314,880 —-a-w c:\windows\system32\wmpdxm.dll
+ 2006-10-19 04:47:20 295,936 ——w c:\windows\system32\wmpeffects.dll
- 2004-08-10 10:00:00 1,582,080 —-a-w c:\windows\system32\wmpencen.dll
+ 2006-10-19 04:47:20 1,661,440 —-a-w c:\windows\system32\wmpencen.dll
- 2005-06-24 01:15:30 3,371,008 —-a-w c:\windows\system32\wmploc.dll
+ 2006-10-19 04:47:20 8,231,936 —-a-w c:\windows\system32\wmploc.dll
+ 2006-10-19 04:47:20 613,376 ——w c:\windows\system32\wmpmde.dll
+ 2006-10-19 04:47:20 130,048 ——w c:\windows\system32\wmpps.dll
- 2004-08-10 10:00:00 81,920 —-a-w c:\windows\system32\wmpshell.dll
+ 2006-10-19 04:47:20 99,840 —-a-w c:\windows\system32\wmpshell.dll
- 2004-08-10 10:00:00 174,080 —-a-w c:\windows\system32\wmpsrcwp.dll
+ 2006-10-19 04:47:20 204,288 —-a-w c:\windows\system32\wmpsrcwp.dll
- 2005-08-03 23:29:52 771,584 —-a-w c:\windows\system32\wmsdmod.dll
+ 2006-10-19 04:47:22 4,096 —-a-w c:\windows\system32\wmsdmod.dll
- 2005-08-03 23:29:52 1,119,744 —-a-w c:\windows\system32\wmsdmoe2.dll
+ 2006-10-19 04:47:22 4,096 —-a-w c:\windows\system32\wmsdmoe2.dll
- 2005-08-03 23:29:54 407,552 —-a-w c:\windows\system32\wmspdmod.dll
+ 2006-10-19 04:47:22 603,648 —-a-w c:\windows\system32\WMSPDMOD.dll
- 2005-08-03 23:29:54 940,544 —-a-w c:\windows\system32\wmspdmoe.dll
+ 2006-10-19 04:47:22 1,329,152 —-a-w c:\windows\system32\WMSPDMOE.dll
- 2005-08-03 23:29:54 1,216,000 —-a-w c:\windows\system32\wmvadvd.dll
+ 2006-10-19 04:47:22 4,096 —-a-w c:\windows\system32\WMVADVD.dll
- 2005-08-03 23:29:54 1,512,448 —-a-w c:\windows\system32\WMVADVE.DLL
+ 2006-10-19 04:47:22 4,096 —-a-w c:\windows\system32\WMVADVE.DLL
- 2008-06-11 09:58:24 2,330,624 —-a-w c:\windows\system32\WMVCore.dll
+ 2008-06-18 12:03:14 2,458,112 —-a-w c:\windows\system32\WMVCore.dll
+ 2006-10-19 04:47:22 1,543,680 ——w c:\windows\system32\WMVDECOD.dll
- 2005-08-03 23:29:54 826,368 —-a-w c:\windows\system32\wmvdmod.dll
+ 2006-10-19 04:47:22 4,096 —-a-w c:\windows\system32\wmvdmod.dll
- 2005-08-03 23:29:54 1,003,008 —-a-w c:\windows\system32\wmvdmoe2.dll
+ 2006-10-19 04:47:22 4,096 —-a-w c:\windows\system32\wmvdmoe2.dll
+ 2006-10-19 04:47:22 1,574,912 ——w c:\windows\system32\WMVENCOD.dll
+ 2006-10-19 04:47:22 1,382,912 ——w c:\windows\system32\WMVSDECD.dll
+ 2006-10-19 04:47:22 767,488 ——w c:\windows\system32\WMVSENCD.dll
+ 2006-10-19 04:47:22 656,896 ——w c:\windows\system32\WMVXENCD.dll
- 2006-03-03 12:33:09 38,912 —-a-w c:\windows\system32\wpd_ci.dll
+ 2006-10-19 04:47:22 629,760 —-a-w c:\windows\system32\wpd_ci.dll
- 2006-03-03 12:32:57 61,952 —-a-w c:\windows\system32\wpdconns.dll
+ 2006-10-19 04:47:22 35,840 —-a-w c:\windows\system32\wpdconns.dll
- 2006-03-03 12:33:00 114,176 —-a-w c:\windows\system32\wpdmtp.dll
+ 2006-10-19 04:47:22 154,624 —-a-w c:\windows\system32\wpdmtp.dll
- 2006-03-03 12:33:00 66,560 —-a-w c:\windows\system32\wpdmtpus.dll
+ 2006-10-19 04:47:22 63,488 —-a-w c:\windows\system32\wpdmtpus.dll
+ 2006-10-19 04:47:22 2,603,008 ——w c:\windows\system32\WpdShext.dll
+ 2006-10-19 03:00:14 17,408 ——w c:\windows\system32\wpdshextautoplay.exe
+ 2006-10-19 04:47:22 38,400 ——w c:\windows\system32\wpdshextres.dll
+ 2006-10-19 04:47:22 133,632 ——w c:\windows\system32\WPDShServiceObj.dll
- 2006-03-03 12:33:10 329,728 —-a-w c:\windows\system32\wpdsp.dll
+ 2006-10-19 04:47:22 356,352 —-a-w c:\windows\system32\wpdsp.dll
+ 2006-09-29 03:13:26 95,344 ——w c:\windows\system32\WUDFCoinstaller.dll
+ 2006-09-29 01:56:38 146,432 ——w c:\windows\system32\WudfHost.exe
+ 2006-09-29 01:56:16 165,376 ——w c:\windows\system32\WudfPlatform.dll
+ 2006-09-29 01:56:14 55,808 ——w c:\windows\system32\WudfSvc.dll
+ 2006-09-29 01:56:38 316,416 ——w c:\windows\system32\WUDFx.dll
.
– Snapshot reset to current date –
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-10 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WN311T.exe"="c:\program files\NETGEAR\WN311T\WN311T.exe" [2008-03-10 565248]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2005-06-10 81920]
"ISUSPM Startup"="c:\program files\Common Files\InstallShield\UpdateService\isuspm.exe" [2005-06-10 249856]
"ehTray"="c:\windows\ehome\ehtray.exe" [2005-09-29 67584]
"DMXLauncher"="c:\program files\Dell\Media Experience\DMXLauncher.exe" [2005-10-05 94208]
"DLA"="c:\windows\System32\DLA\DLACTRLW.EXE" [2005-09-08 122940]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-01-14 1261336]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-08-05 344064]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-01-05 413696]
"SigmatelSysTrayApp"="stsystra.exe" [2005-03-22 c:\windows\stsystra.exe]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2006-05-12 24576]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"MyWebSearchService"=2 (0x2)

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgemc.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2009-01-14 97928]
R3 NETMW145;Marvell TOPDOG ™ 802.11n Driver for Windows XP;c:\windows\system32\drivers\NETMW145.sys [2008-10-10 722560]
R4 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [2009-01-14 875288]
R4 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2009-01-14 231704]
R4 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2009-01-14 76040]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{361ac05d-0e0d-11da-9aa9-806d6172696f}]
\Shell\AutoRun\command - E:\setup.exe
.
Contents of the 'Scheduled Tasks' folder

2009-01-22 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 12:34]

2009-01-22 c:\windows\Tasks\Check Updates for Windows Live Toolbar.job
- c:\program files\Windows Live Toolbar\MSNTBUP.EXE [2007-10-19 10:20]

2009-01-25 c:\windows\Tasks\pfhwcczb.job
- c:\windows\system32\urqpoNdA.dll []
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://google.com/
uSearchMigratedDefaultURL = 687474703a2f2f7777772e676f6f676c652e636f6d2f
mSearch Bar = 687474703a2f2f7777772e676f6f676c652e636f6d2f
mSearchMigratedDefaultURL = 687474703a2f2f7777772e676f6f676c652e636f6d2f
mSearchURL = 687474703a2f2f7777772e676f6f676c652e636f6d2f
IE: &Search - ?p=ZNman000
IE: &Windows Live Search - c:\program files\Windows Live Toolbar\msntb.dll/search.htm
IE: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
IE: {{B4B52284-A248-4c51-9F7C-F0A0C67FCC9D} - c:\program files\PartyGaming\PartyCasino\RunApp.exe
DPF: {B6827EA8-89DD-42CD-8E39-8D9432DCF302} - hxxp://dexpages.com/Desktop-Icon.exe
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-01-24 18:30:09
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2009-01-24 18:31:31
ComboFix-quarantined-files.txt 2009-01-25 01:31:29
ComboFix2.txt 2009-01-22 18:39:53
ComboFix3.txt 2009-01-22 03:59:20

Pre-Run: 61,033,209,856 bytes free
Post-Run: 61,050,781,696 bytes free

Current=2 Default=2 Failed=3 LastKnownGood=4 Sets=1,2,3,4
329 — E O F — 2009-01-22 21:32:08

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 6:34:31 PM, on 1/24/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\NETGEAR\WN311T\WN311T.exe
C:\WINDOWS\stsystra.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\Dell\Media Experience\DMXLauncher.exe
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\WINDOWS\eHome\ehmsas.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\WordPerfect Office 12\Programs\wpwin12.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\winhlp32.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [WN311T.exe] C:\Program Files\NETGEAR\WN311T\WN311T.exe
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [DMXLauncher] C:\Program Files\Dell\Media Experience\DMXLauncher.exe
O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O8 - Extra context menu item: &Search - ?p=ZNman000
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: PartyCasino - {B4B52284-A248-4c51-9F7C-F0A0C67FCC9D} - C:\Program Files\PartyGaming\PartyCasino\RunApp.exe (file missing)
O9 - Extra 'Tools' menuitem: PartyCasino - {B4B52284-A248-4c51-9F7C-F0A0C67FCC9D} - C:\Program Files\PartyGaming\PartyCasino\RunApp.exe (file missing)
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Littlewoods Casino - {BAA37C20-5000-11DB-B0DE-0800200C9A66} - http://www.littlewoodscasino.com (file missing) (HKCU)
O9 - Extra 'Tools' menuitem: Littlewoods Casino - {BAA37C20-5000-11DB-B0DE-0800200C9A66} - http://www.littlewoodscasino.com (file missing) (HKCU)
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: {B6827EA8-89DD-42CD-8E39-8D9432DCF302} - http://dexpages.com/Desktop-Icon.exe
O16 - DPF: {D8089245-3211-40F6-819B-9E5E92CD61A2} (FlashXControl Object) - https://signin3.valueactive.com/Register/Br…018/flashax.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe

–
End of file - 6564 bytes

Malwarebytes' Anti-Malware 1.33
Database version: 1691
Windows 5.1.2600 Service Pack 2

1/24/2009 6:47:09 PM
mbam-log-2009-01-24 (18-47-09).txt

Scan type: Quick Scan
Objects scanned: 51184
Time elapsed: 3 minute(s), 37 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 3
Registry Values Infected: 1
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{3ba4271e-5c1e-48e2-b432-d8bf420dd31d} (Rogue.DeusCleaner) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{54a3f8b7-228e-4ed8-895b-de832b2c3959} (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{6fd31ed6-7c94-4bbc-8e95-f927f4d3a949} (Adware.180Solutions) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\rhcv29j0ep79 (Rogue.AntivirusXP2008) -> Quarantined and deleted successfully.

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

LDTate

Post #9January 25, 2009, 12:40 PM UTC

Open Internet Explorer Go to Tools and choose for Internet Options Go to the Advanced tab Click on Reset… and allow if any warnings are given Let the computer do its work if it has to Now see whether the problem has stopped. Your Add-ons are also disabled at the moment so lets enable them: Go to Tools then navigate to Manage Add-ons and click on Enable or Disable Add-ons In the list of Disabled Add-ons please click on the upper one Click on Enable Do this with all the Add-ons Click OK

brianleo

Post #10January 25, 2009, 6:20 PM UTC

Followed your instructions. IE working fine and web pages look complete.

However, I rebooted and ran Malwarebytes. It reported finding a Trojan horse Generic 12AZKY. I had it sent to the VAULT. When checking items in Quarantine it not show up. This same Trojan showed up yesterday at which time I had it HEALED. AVG's vault listed it four previous times. Vault was emptied and Hijackthis was run.

AVG also keeps "warning" of tracking cookies which it calls "potentially dangerous". This time Atdmt and Webtrends were found.
Are these tracking cookies a serious threat and why do they keep appearing? My Internet session consisted of going only to 3 trusted sites.

Thanks for your continued support.

Log files are as follows:

Malwarebytes' Anti-Malware 1.33
Database version: 1691
Windows 5.1.2600 Service Pack 2

1/25/2009 10:10:03 AM
mbam-log-2009-01-25 (10-10-03).txt

Scan type: Quick Scan
Objects scanned: 51335
Time elapsed: 2 minute(s), 40 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:05:04 AM, on 1/25/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\NETGEAR\WN311T\WN311T.exe
C:\WINDOWS\stsystra.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\Dell\Media Experience\DMXLauncher.exe
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [WN311T.exe] C:\Program Files\NETGEAR\WN311T\WN311T.exe
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [DMXLauncher] C:\Program Files\Dell\Media Experience\DMXLauncher.exe
O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: PartyCasino - {B4B52284-A248-4c51-9F7C-F0A0C67FCC9D} - C:\Program Files\PartyGaming\PartyCasino\RunApp.exe (file missing)
O9 - Extra 'Tools' menuitem: PartyCasino - {B4B52284-A248-4c51-9F7C-F0A0C67FCC9D} - C:\Program Files\PartyGaming\PartyCasino\RunApp.exe (file missing)
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Littlewoods Casino - {BAA37C20-5000-11DB-B0DE-0800200C9A66} - http://www.littlewoodscasino.com (file missing) (HKCU)
O9 - Extra 'Tools' menuitem: Littlewoods Casino - {BAA37C20-5000-11DB-B0DE-0800200C9A66} - http://www.littlewoodscasino.com (file missing) (HKCU)
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: {B6827EA8-89DD-42CD-8E39-8D9432DCF302} - http://dexpages.com/Desktop-Icon.exe
O16 - DPF: {D8089245-3211-40F6-819B-9E5E92CD61A2} (FlashXControl Object) - https://signin3.valueactive.com/Register/Br…018/flashax.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe

–
End of file - 6496 bytes

LDTate

Post #11January 25, 2009, 11:01 PM UTC

You'll get cookies whenever you're online.

Please use the Internet Explorer browser (or FireFox with IETab), and do an online scan with Kaspersky Online Scanner

Note: If you have used this particular scanner before, you MAY HAVE TO UNINSTALL the program through Add/Remove Programs before downloading the new ActiveX component

Click Yes, when prompted to install its ActiveX component.
(Note.. for Internet Explorer 7 users: If at any time you have trouble with the "Accept" button of the license, click on the "Zoom" tool located at the bottom right of the IE window and set the zoom to 75 %. Once the license has been accepted, reset to 100%.)
The program launches and downloads the latest definition files.

Once the files are downloaded click on Next
Click on Scan Settings and configure as follows:
- Scan using the following Anti-Virus database:
  - Extended
- Scan Options:Scan Archives
  Scan Mail Bases
Click OK and, under select a target to scan, select My Computer

When the scan is done, in the Scan is completed window (below), any infection is displayed.
There is no option to clean/disinfect, however, we need to analyze the information on the report.
To obtain the report:
Click on: Save Report As (above - red blinking arrow)
Next, in the Save as prompt, Save in area, select: Desktop
In the File name area, use KScan, or something similar
In Save as type, click the drop arrow and select: Text file [*.txt]
Then, click: Save
Please post the Kaspersky Online Scanner Report in your reply.

brianleo

Post #12January 26, 2009, 6:05 AM UTC

Scanner report from Kaspersky Online ——————————————————————————– KASPERSKY ONLINE SCANNER 7 REPORT Sunday, January 25, 2009 Operating System: Microsoft Windows XP Professional Service Pack 2 (build 2600) Kaspersky Online Scanner 7 version: 7.0.25.0 Program database last update: Monday, January 26, 2009 02:18:39 Records in database: 1696302 ——————————————————————————– Scan settings: Scan using the following database: extended Scan archives: yes Scan mail databases: yes Scan area - My Computer: C:\ D:\ Scan statistics: Files scanned: 65760 Threat name: 4 Infected objects: 4 Suspicious objects: 0 Duration of the scan: 00:44:18 File name / Threat name / Threats count C:\i386\f3PSSavr.scr Infected: not-a-virus:WebToolbar.Win32.MyWebSearch.bg 1 C:\Qoobox\Quarantine\C\WINDOWS\system32\piwjefow.dll.vir Infected: Trojan.Win32.Monder.araj 1 C:\Qoobox\Quarantine\C\WINDOWS\system32\tyshb36rfjdf.dll.vir Infected: Trojan-Downloader.Win32.Small.ahzt 1 C:\Qoobox\Quarantine\C\WINDOWS\system32\ystiaqbb.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.gjj 1 The selected area was scanned.

LDTate

Post #13January 26, 2009, 9:32 PM UTC

Delete this file
C:\i386\f3PSSavr.scr

After the above:

The following will implement some cleanup procedures as well as reset System Restore points:

Click START then RUN
Now type Combofix /u in the runbox and click OK. Note the space between the X and the U, it needs to be there.
- [external image: Posted Image]
To be on the safe side, I would also change all my passwords.

brianleo

Post #14January 27, 2009, 5:07 AM UTC

Deleted C:\i386\f3PSSavr.scr and ran Combofix /u, All seems to be working well…blazing fast. Thank you for all the help.

LDTate

Post #15January 27, 2009, 2:39 PM UTC

To be on the safe side, I would also change all my passwords.

Here's my usual all clean post

Log looks good

Make your Internet Explorer more secure - This can be done by following these simple instructions:
- From within Internet Explorer click on the Tools menu and then click on Options.
- Click once on the Security tab
- Click once on the Internet icon so it becomes highlighted.
- Click once on the Custom Level button.
- Change the Download signed ActiveX controls to Prompt
- Change the Download unsigned ActiveX controls to Disable
- Change the Initialize and script ActiveX controls not marked as safe to Disable
- Change the Installation of desktop items to Prompt
- Change the Launching programs and files in an IFRAME to Prompt
- Change the Navigate sub-frames across different domains to Prompt
- When all these settings have been made, click on the OK button.
- If it prompts you as to whether or not you want to save the settings, press the Yes button.
Next press the Apply button and then the OK to exit the Internet Properties page.

[*]Update your AntiVirus Software - It is imperative that you update your Antivirus software at least once a week

(Even more if you wish). If you do not update your antivirus software then it will not be able to catch any of the new variants that may come out.

[*]Use a Firewall - I can not stress how important it is that you use a Firewall on your computer.

Without a firewall your computer is succeptible to being hacked and taken over.
I am very serious about this and see it happen almost every day with my clients.
Simply using a Firewall in its default configuration can lower your risk greatly.

[*]Visit Microsoft's Windows Update Site Frequently - It is important that you visit http://www.windowsupdate.com regularly.

This will ensure your computer has always the latest security updates available installed on your computer.
If there are new updates to install, install them immediately, reboot your computer, and revisit the site
until there are no more critical updates.

[*]MVPS Hosts file replaces your current HOSTS file with one containing well known ad sites and other bad sites. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer, meaning it will be difficult to infect yourself in the future.

[*] Winpatrol

[*]Update all these programs regularly - Make sure you update all the programs I have listed regularly.

Without regular updates you WILL NOT be protected when new malicious programs are released.

Only run one Anti-Virus and Firewall program.

I would also suggest you read this:
So how did I get infected in the first place?
by Tony Klein

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

[Resolved] Malicious Trojan Horse has disabled computer

✨ Ask AI

Ask AI