Spyware / Malware / Virus Removal

[Resolved] bitsprx.dll trojan won't leave my system!

5 min read

Looking for the outcome? Ask AI

skolpo Topic Starter

Post #1February 3, 2009, 10:12 PM UTC

I did all (well most, I think) of the basic procedures already. I scanned with malwarebytes, superantispyware, DLed spybot, tried to remove it with hijackthis. None of it is working! Please help. This is what I got from the hijackthis log

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:11:11, on 2/3/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
C:\WINDOWS1\System32\smss.exe
C:\WINDOWS1\system32\winlogon.exe
C:\WINDOWS1\system32\services.exe
C:\WINDOWS1\system32\lsass.exe
C:\WINDOWS1\system32\svchost.exe
C:\WINDOWS1\System32\svchost.exe
C:\WINDOWS1\system32\svchost.exe
C:\WINDOWS1\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS1\system32\nvsvc32.exe
C:\WINDOWS1\system32\svchost.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\AIM95\aim.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\WINDOWS1\system32\ctfmon.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\SpeedFan\speedfan.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS1\explorer.exe
C:\Program Files\Microsoft Office\Office12\WINWORD.EXE
C:\PROGRA~1\MICROS~2\Office12\OUTLOOK.EXE
C:\WINDOWS1\system32\NOTEPAD.EXE
C:\Documents and Settings\slt\Desktop\Games & Programs\HijackThis.exe
C:\WINDOWS1\system32\NOTEPAD.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

O2 - BHO: (no name) - {57B73B74-D4B2-4E82-BB25-2499A057670B} - C:\WINDOWS1\system32\bitsprx.dll
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS1\system32\NvCpl.dll,NvStartup
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM95\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [STYLEXP] C:\Program Files\TGTSoft\StyleXP\StyleXP.exe -Hide
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS1\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [TaskSwitchXP] C:\Program Files\TaskSwitchXP\TaskSwitchXP.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [addon_ql] C:\WINDOWS1\system32\dgfix.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [TaskSwitchXP] C:\Program Files\TaskSwitchXP\TaskSwitchXP.exe (User 'Default user')
O4 - Startup: SpeedFan.lnk = C:\Program Files\SpeedFan\speedfan.exe
O4 - Global Startup: Microsoft Office Outlook 2007.lnk = ?
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM95\aim.exe
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Unknown owner - C:\Program Files\Common Files\Maxtor\Schedule2\schedul2.exe (file missing)
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS1\system32\nvsvc32.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe

–
End of file - 3173 bytes

I also did combofix and this is the log from it.

ComboFix 09-02-02.04 - slt 2009-02-03 10:51:47.6 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.3071.2500 [GMT -8:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows1\system32\404Fix.exe
c:\windows1\system32\Agent.OMZ.Fix.exe
c:\windows1\system32\dumphive.exe
c:\windows1\system32\IEDFix.C.exe
c:\windows1\system32\IEDFix.exe
c:\windows1\system32\o4Patch.exe
c:\windows1\system32\Process.exe
c:\windows1\system32\SrchSTS.exe
c:\windows1\system32\tmp.reg
c:\windows1\system32\VACFix.exe
c:\windows1\system32\VCCLSID.exe
c:\windows1\system32\WS2Fix.exe

.
((((((((((((((((((((((((( Files Created from 2009-01-03 to 2009-02-03 )))))))))))))))))))))))))))))))
.

2009-02-03 02:17 . 2009-02-03 03:35 d——– c:\windows1\system32\CatRoot_bak
2009-02-02 18:18 . 2009-02-02 18:18 d–h—– c:\documents and settings\All Users.WINDOWS1\Application Data\{0E8E33D8-193A-414A-A909-0F101A142D26}
2009-02-02 18:15 . 2009-02-02 18:15 d——– c:\program files\Stardock Games
2009-02-02 15:05 . 2009-02-02 15:05 d——– c:\documents and settings\All Users.WINDOWS1\Application Data\2DBoy
2009-02-02 12:58 . 2009-02-02 12:58 d——– c:\program files\WorldOfGoo
2009-01-31 23:51 . 2008-12-25 19:19 25,600 –a—— c:\windows1\system32\DUALSHOCK3FF.dll
2009-01-31 23:47 . 2008-11-22 13:48 11,392 –a—— c:\windows1\system32\drivers\dualshock3.sys
2009-01-31 22:48 . 2005-03-09 20:50 46,592 –a—— c:\windows1\system32\libusb0.dll
2009-01-31 22:48 . 2005-03-09 20:50 33,792 –a—— c:\windows1\system32\drivers\libusb0.sys
2009-01-31 15:01 . 2009-01-31 15:00 410,984 –a—— c:\windows1\system32\deploytk.dll
2009-01-31 15:01 . 2009-01-31 15:00 73,728 –a—— c:\windows1\system32\javacpl.cpl
2009-01-31 13:14 . 2009-01-31 13:14 d——– c:\documents and settings\slt\Application Data\2K Sports
2009-01-31 13:04 . 2009-01-31 13:14 d——– c:\program files\NBA 2K9
2009-01-29 21:22 . 2002-12-31 04:00 96,256 –a—— c:\windows1\system32\bitsprx.dll
2009-01-29 02:31 . 2009-01-29 02:47 d——– c:\program files\Guitar FX BOX 2.6
2009-01-29 02:18 . 2009-01-29 19:40 d——– c:\program files\Guitar FX BOX 2.7
2009-01-28 03:52 . 2009-01-28 03:53 d——– c:\program files\GuitarFX 3
2009-01-25 04:17 . 2009-01-31 01:36 d——– C:\download
2009-01-05 02:00 . 2002-12-17 16:23 33,340 ——— c:\windows1\system32\dbmsqlgc.dll
2009-01-05 02:00 . 2002-10-20 14:05 24,576 ——— c:\windows1\system32\dbmsgnet.dll
2009-01-05 01:59 . 2009-01-05 01:59 d——– c:\program files\Microsoft SQL Server
2009-01-05 01:58 . 2009-01-05 01:58 d——– c:\program files\Vstplugins
2009-01-05 01:58 . 2009-01-05 01:59 d——– c:\documents and settings\All Users.WINDOWS1\Application Data\Sony

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-02-03 18:40 ——— d—–w c:\program files\SpeedFan
2009-01-31 23:00 ——— d—–w c:\program files\Java
2009-01-18 01:01 ——— d—–w c:\documents and settings\slt\Application Data\Move Networks
2009-01-11 19:12 ——— d—–w c:\program files\Steam
2009-01-10 10:52 ——— d—–w c:\documents and settings\slt\Application Data\Babylon
2009-01-10 10:51 ——— d—–w c:\documents and settings\All Users.WINDOWS1\Application Data\Babylon
2009-01-05 09:59 ——— d—–w c:\documents and settings\slt\Application Data\Sony
2009-01-05 09:58 ——— d—–w c:\program files\Sony
2009-01-05 09:57 ——— d—–w c:\program files\Sony Setup
2008-12-29 16:36 ——— d—–w c:\program files\Common Files\Maxtor
2008-12-26 13:47 ——— d—–w c:\program files\Hasbro
2008-12-25 20:55 604 —ha-w c:\program files\STLL Notifier
2008-12-25 20:55 ——— d—–w c:\documents and settings\slt\Application Data\Sibelius Software
2008-12-25 20:55 ——— d—–w c:\documents and settings\All Users.WINDOWS1\Application Data\Sibelius Software
2008-12-25 20:52 ——— d—–w c:\program files\Sibelius Software
2008-12-25 20:48 ——— d—–w c:\program files\Babylon
2008-12-25 20:44 ——— d—–w c:\documents and settings\slt\Application Data\Nero
2008-12-25 20:43 ——— d—–w c:\program files\Nero 9
2008-12-25 20:43 ——— d—–w c:\program files\Common Files\Nero
2008-12-25 20:29 ——— d—–w c:\program files\Absolute Sound Recorder
2008-12-18 16:42 ——— d—–w c:\program files\EA GAMES
2008-12-15 07:52 ——— d—–w c:\program files\Image Grabber II.NET
2008-12-09 16:19 ——— d—–w c:\program files\Common Files\Ahead
2008-12-09 11:58 ——— d—–w c:\program files\MagicISO
2008-12-09 09:32 ——— d—–w c:\program files\mkv2vob
2008-12-09 09:31 ——— d—–w c:\program files\Common Files\Wise Installation Wizard
2008-12-08 11:56 ——— d—–w c:\program files\MSI
2008-12-08 11:55 ——— d—–w c:\program files\Google
2008-12-07 14:17 ——— d—–w c:\program files\Unlocker
2008-12-07 10:13 ——— d—–w c:\documents and settings\All Users.WINDOWS1\Application Data\Maxtor
2008-12-07 10:08 392,320 —-a-w c:\windows1\system32\drivers\timntr.sys
2008-12-07 10:08 32,768 —-a-w c:\windows1\system32\drivers\tifsfilt.sys
2008-12-07 10:08 120,992 —-a-w c:\windows1\system32\drivers\snapman.sys
2008-12-07 08:44 ——— d–h–w c:\program files\InstallShield Installation Information
2008-12-07 01:05 ——— d—–w c:\documents and settings\All Users.WINDOWS1\Application Data\FLEXnet
2008-12-07 01:00 ——— d—–w c:\program files\Common Files\Adobe
2008-12-07 00:52 ——— d—–w c:\program files\Common Files\Macrovision Shared
2008-12-07 00:40 ——— d—–w c:\program files\Windows Installer Clean Up
2008-12-07 00:39 ——— d—–w c:\program files\MSECACHE
2008-12-05 23:19 ——— d—–w c:\program files\Warcraft III
2008-12-05 12:20 7,727 —-a-w c:\windows1\system32\drivers\CDSpace5.cfg
2008-12-04 11:19 ——— d—–w c:\program files\Bonjour
2008-12-04 11:18 ——— d—–w c:\program files\GameTap
2008-12-04 11:18 ——— d—–w c:\documents and settings\All Users.WINDOWS1\Application Data\GameTap
2008-12-04 11:10 ——— d—–w c:\program files\Common Files\Macrovision Shared(2)
2008-12-04 11:00 ——— d—–w c:\documents and settings\All Users.WINDOWS1\Application Data\Razer(2)
2008-11-23 01:37 3,766 -csha-w c:\documents and settings\All Users.WINDOWS1\Application Data\KGyGaAvL.sys
2008-11-03 09:44 499,712 —-a-w c:\windows1\system32\msvcp71.dll
2008-11-03 09:44 348,160 —-a-w c:\windows1\system32\msvcr71.dll
2008-04-18 10:01 88 -csh–r c:\documents and settings\All Users.WINDOWS1\Application Data\A5192E5071.sys
2005-12-05 07:12 20,640 -c–a-w c:\windows1\inf\pxhelp20.sys
2003-03-16 11:00 7,216 -c–a-w c:\windows1\inf\RAMDISK.SYS
2007-09-19 20:23 135,680 —-a-w c:\program files\mozilla firefox\components\GoogleDesktopMozilla.dll
2006-05-03 09:06 163,328 –sh–r c:\windows1\system32\flvDX.dll
2007-02-21 10:47 31,232 –sh–r c:\windows1\system32\msfDX.dll
.

——- Sigcheck ——-

2002-12-31 04:00 360448 b51b0046d15982530af09f3d01ff48ab c:\windows1\$NtUninstallKB917953$\tcpip.sys
2006-04-20 04:18 360576 b2220c618b42a2212a59d91ebd6fc4b4 c:\windows1\$NtUninstallKB941644$\tcpip.sys
2008-06-20 02:45 360320 2a5554fc5b1e04e131230e3ce035c3f9 c:\windows1\SoftwareDistribution\Download\ad744bdeedce85bf37a096f34577ff3a\sp2gdr\tcpip.sys
2008-06-20 02:44 360960 744e57c99232201ae98c49168b918f48 c:\windows1\SoftwareDistribution\Download\ad744bdeedce85bf37a096f34577ff3a\sp2qfe\tcpip.sys
2008-06-20 03:51 361600 9aefa14bd6b182d61e3119fa5f436d3d c:\windows1\SoftwareDistribution\Download\ad744bdeedce85bf37a096f34577ff3a\sp3gdr\tcpip.sys
2008-06-20 03:59 361600 ad978a1b783b5719720cff204b666c8e c:\windows1\SoftwareDistribution\Download\ad744bdeedce85bf37a096f34577ff3a\sp3qfe\tcpip.sys
2008-04-13 11:20 361344 93ea8d04ec73a85db02eb8805988f733 c:\windows1\SoftwareDistribution\Download\e9500597a78495f397efb821e37bf356\tcpip.sys
2007-10-30 08:53 360832 ea3d7525f41beb321c3f6e2162277e92 c:\windows1\system32\dllcache\tcpip.sys
2007-10-30 08:53 360832 ea3d7525f41beb321c3f6e2162277e92 c:\windows1\system32\drivers\tcpip.sys
.
((((((((((((((((((((((((((((( snapshot_2009-02-03_ 1.51.26.50 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-07-19 05:10:20 36,552 -c–a-w c:\windows1\system32\dllcache\wups.dll
+ 2008-10-16 22:08:58 34,328 -c–a-w c:\windows1\system32\dllcache\wups.dll
+ 2006-01-09 17:36:06 40,960 —-a-w c:\windows1\system32\swsc.exe
- 2008-07-19 05:10:20 36,552 —-a-w c:\windows1\system32\wups.dll
+ 2008-10-16 22:08:58 34,328 —-a-w c:\windows1\system32\wups.dll
- 2008-07-19 05:10:40 45,768 —-a-w c:\windows1\system32\wups2.dll
+ 2008-10-16 22:09:44 43,544 —-a-w c:\windows1\system32\wups2.dll
+ 2009-02-03 18:39:00 16,384 —-atw c:\windows1\temp\Perflib_Perfdata_300.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{57B73B74-D4B2-4E82-BB25-2499A057670B}]
2002-12-31 04:00 96256 –a—— c:\windows1\system32\bitsprx.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AIM"="c:\program files\AIM95\aim.exe" [2004-04-27 61440]
"STYLEXP"="c:\program files\TGTSoft\StyleXP\StyleXP.exe" [2005-08-18 1359872]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2008-08-19 1576176]
"ctfmon.exe"="c:\windows1\system32\ctfmon.exe" [2002-12-31 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-11-20 290088]
"NvCplDaemon"="c:\windows1\system32\NvCpl.dll" [2008-10-07 13574144]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"TaskSwitchXP"="c:\program files\TaskSwitchXP\TaskSwitchXP.exe" [2005-08-24 61952]
"addon_ql"="c:\windows1\system32\dgfix.exe" [2005-12-07 61606]

c:\documents and settings\slt\Start Menu\Programs\Startup\
SpeedFan.lnk - c:\program files\SpeedFan\speedfan.exe [2008-08-19 3562496]

c:\documents and settings\All Users.WINDOWS1\Start Menu\Programs\Startup\
Microsoft Office Outlook 2007.lnk - c:\windows1\Installer\{90120000-0030-0000-0000-0000000FF1CE}\outicon.exe [2007-11-25 845584]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoSimpleStartMenu"= 0 (0x0)

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoSimpleStartMenu"= 1 (0x1)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"UIHost"="c:\program files\TGTSoft\StyleXP\Logon\CurrentLogon.EXE"

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.I420"= i420vfw.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS1^Start Menu^Programs^Startup^Adobe Gamma Loader.lnk]
path=c:\documents and settings\All Users.WINDOWS1\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk
backup=c:\windows1\pss\Adobe Gamma Loader.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS1^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
path=c:\documents and settings\All Users.WINDOWS1\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
backup=c:\windows1\pss\HP Digital Imaging Monitor.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
c:\windows1\system32\dumprep 0 -k [X]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UserFaultCheck]
c:\windows1\system32\dumprep 0 -u [X]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
–a—— 2002-12-31 04:00 15360 c:\windows1\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
–a–c— 2006-02-19 02:41 49152 c:\program files\HP\HP Software Update\hpwuSchd2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
–a—— 2008-10-07 12:33 13574144 c:\windows1\system32\nvcpl.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
–a—— 2008-11-04 10:30 413696 c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WINDVDPatch]
–a–c— 2002-07-02 17:56 24576 c:\windows1\system32\CTHELPER.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\WINDOWS1\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Common Files\\Adobe\\CS4ServiceManager\\CS4ServiceManager.exe"=
"c:\\Program Files\\Stardock Games\\Sins of a Solar Empire\\Sins of a Solar Empire.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\globallyopenports\list]
"5353:TCP"= 5353:TCP:Adobe CSI CS4

R0 elzeclcc;elzeclcc;c:\windows1\system32\drivers\elzeclcc.sys [2002-12-31 23424]
R1 sasdifsv;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [2008-08-19 8944]
R1 saskutil;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [2008-08-19 55024]
R1 XSPACEWG;XSPACEWG;c:\windows1\system32\drivers\XSpaceWg.sys [2007-11-25 3543]
R2 dualshock3;DUALSHOCK3 Controller HID Minidriver (USB) Beta;c:\windows1\system32\drivers\dualshock3.sys [2009-01-31 11392]
R2 SVKP;SVKP;c:\windows1\system32\SVKP.sys [2007-11-26 2368]
R3 cdspacex;cdspacex;c:\windows1\system32\drivers\CDSPACEX.sys [2007-11-25 22571]
R3 RecFltr;Reclusa Keyboard;c:\windows1\system32\drivers\RecFltr.sys [2008-02-03 41984]
R3 sasenum;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [2008-08-19 7408]
R3 TwoRabts;Two Rabbits Live Bus;c:\windows1\system32\drivers\TwoRabts.sys [2007-11-25 11120]
S3 libusb0;LibUsb-Win32 - Kernel Driver, Version 0.1.10.1;c:\windows1\system32\drivers\libusb0.sys [2009-01-31 33792]
S3 Razerlow;Razerlow USB Filter Driver;c:\windows1\system32\drivers\Razerlow.sys [2007-11-30 13225]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\F]
\Shell\AutoRun\command - F:\autoplay.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\H]
\Shell\AutoRun\command - H:\Autorun.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\K]
\Shell\AutoRun\command - K:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2e433e60-9c39-11dc-ac0a-001bb9a9b824}]
\Shell\AutoRun\command - c:\windows1\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL resycled\boot.com u:
\Shell\Open\command - u:\resycled\boot.com u:

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{33ca29fa-ac43-11dd-9b5a-001bb9a9b824}]
\Shell\AutoRun\command - K:\LaunchU3.exe -a
.
Contents of the 'Scheduled Tasks' folder

2009-01-30 c:\windows1\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.google.com
FF - ProfilePath - c:\documents and settings\slt\Application Data\Mozilla\Firefox\Profiles\b2otr4eh.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.csupomona.edu/
FF - plugin: c:\program files\GameTap\bin\Release\npgametaptool.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-02-03 10:55:30
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_USERS\S-1-5-21-484763869-261903793-839522115-1003\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:32,7f,5f,7a,56,dd,f8,01,75,b9,12,5a,59,52,26,52,15,91,ea,3e,0a,4d,c0,
a4,6d,23,90,ab,f4,7c,9b,dd,42,9b,9c,3d,d3,4e,b7,d0,2a,11,ae,fa,39,2e,0c,60,\
"??"=hex:df,75,41,29,bc,8f,20,3e,a4,a1,ce,c8,8a,a0,fc,03
.
Completion time: 2009-02-03 11:01:00
ComboFix-quarantined-files.txt 2009-02-03 19:00:55
ComboFix2.txt 2009-02-03 18:19:09
ComboFix3.txt 2009-02-03 09:53:37
ComboFix4.txt 2009-02-03 09:27:51
ComboFix5.txt 2009-02-03 18:51:20

Pre-Run: 20,640,866,304 bytes free
Post-Run: 20,624,080,896 bytes free

268 — E O F — 2008-09-24 04:17:35

Now my clock no longer runs in AM/PM instead it's a 24hour clock and this file won't go away! please help. any help is appreciated.

LDTate

Post #2February 4, 2009, 12:37 AM UTC last edited February 4, 2009, 12:50 AM UTC

O2 - BHO: (no name) - {57B73B74-D4B2-4E82-BB25-2499A057670B} - C:\WINDOWS1\system32\bitsprx.dll

Password stealer trojan, detected by Kaspersky antivirus as Rootkit.Win32.Podnuha

[external image: Posted Image]

DO NOT use any TOOLS such as Combofix, Vundofix, or HijackThis fixes without supervision.

Doing so could make your pc inoperatible and could require a full reinstall of your OS, losing all your programs and data.

Stay with this topic until I give you the all clean post.

You might want to print these instructions out.

I suggest you do this:

Double-click My Computer.
Click the Tools menu, and then click Folder Options.
Click the View tab.
Uncheck "Hide file extensions for known file types."
Under the "Hidden files" folder, select "Show hidden files and folders."
Uncheck "Hide protected operating system files."
Click Apply, and then click OK.

Please do not delete anything unless instructed to.

Copy/paste the text in the Codebox below into notepad:

Here's how to do that:
Click Start > Run type Notepad click OK.
This will open an empty notepad file:

Take your mouse, and place your cursor at the beginning of the text in the box below, then click and hold the left mouse button, while pulling your mouse over the text. This should highlight the text. Now release the left mouse button. Now, with the cursor over the highlighted text, right click the mouse for options, and select 'copy'. Now over the empty Notepad box, right click your mouse again, and select 'paste' and you will have copied and pasted the text.

File::
c:\windows1\system32\bitsprx.dll
c:\windows1\system32\drivers\elzeclcc.sys
u:\resycled\boot.com
Driver::
elzeclcc

Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{57B73B74-D4B2-4E82-BB25-2499A057670B}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\F]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\H]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2e433e60-9c39-11dc-ac0a-001bb9a9b824}]

Save this file to your desktop, Save this as "CFScript"

Here's how to do that:
1.Click File;
2.Click Save As… Change the directory to your desktop;
3.Change the Save as type to "All Files";
4.Type in the file name: CFScript
5.Click Save …

[external image: Posted Image]

Drag CFScript.txt into ComboFix.exe

Then post the results log and a new HijackThis log.

Also please describe how your computer behaves at the moment.

skolpo

Post #3February 4, 2009, 2:10 AM UTC

Hi LDTate. Thanks for your response! I think the file is finally removed! Thank you! Here's the logs

Hijackthis

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:07:34, on 2/3/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
C:\WINDOWS1\System32\smss.exe
C:\WINDOWS1\system32\winlogon.exe
C:\WINDOWS1\system32\services.exe
C:\WINDOWS1\system32\lsass.exe
C:\WINDOWS1\system32\svchost.exe
C:\WINDOWS1\System32\svchost.exe
C:\WINDOWS1\system32\svchost.exe
C:\WINDOWS1\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS1\system32\nvsvc32.exe
C:\WINDOWS1\system32\svchost.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\AIM95\aim.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\WINDOWS1\system32\ctfmon.exe
C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\SpeedFan\speedfan.exe
C:\WINDOWS1\system32\notepad.exe
C:\WINDOWS1\explorer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS1\system32\NvCpl.dll,NvStartup
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM95\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [STYLEXP] C:\Program Files\TGTSoft\StyleXP\StyleXP.exe -Hide
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS1\system32\ctfmon.exe
O4 - Startup: SpeedFan.lnk = C:\Program Files\SpeedFan\speedfan.exe
O4 - Global Startup: Microsoft Office Outlook 2007.lnk = ?
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM95\aim.exe
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Unknown owner - C:\Program Files\Common Files\Maxtor\Schedule2\schedul2.exe (file missing)
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS1\system32\nvsvc32.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe

–
End of file - 2926 bytes

Combofix

ComboFix 09-02-02.04 - slt 2009-02-03 17:50:35.8 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.3071.2460 [GMT -8:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\slt\Desktop\CFScript.txt
* Created a new restore point

FILE ::
c:\windows1\system32\bitsprx.dll
c:\windows1\system32\drivers\elzeclcc.sys
u:\resycled\boot.com
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows1\system32\bitsprx.dll
c:\windows1\system32\drivers\elzeclcc.sys

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Legacy_ELZECLCC
——-\Service_elzeclcc

((((((((((((((((((((((((( Files Created from 2009-01-04 to 2009-02-04 )))))))))))))))))))))))))))))))
.

2009-02-03 14:10 . 2009-02-03 14:10 d——– c:\program files\Trend Micro
2009-02-03 02:17 . 2009-02-03 03:35 d——– c:\windows1\system32\CatRoot_bak
2009-02-02 18:18 . 2009-02-02 18:18 d–h—– c:\documents and settings\All Users.WINDOWS1\Application Data\{0E8E33D8-193A-414A-A909-0F101A142D26}
2009-02-02 18:15 . 2009-02-02 18:15 d——– c:\program files\Stardock Games
2009-02-02 15:05 . 2009-02-02 15:05 d——– c:\documents and settings\All Users.WINDOWS1\Application Data\2DBoy
2009-02-02 12:58 . 2009-02-02 12:58 d——– c:\program files\WorldOfGoo
2009-01-31 23:51 . 2008-12-25 19:19 25,600 –a—— c:\windows1\system32\DUALSHOCK3FF.dll
2009-01-31 23:47 . 2008-11-22 13:48 11,392 –a—— c:\windows1\system32\drivers\dualshock3.sys
2009-01-31 22:48 . 2005-03-09 20:50 46,592 –a—— c:\windows1\system32\libusb0.dll
2009-01-31 22:48 . 2005-03-09 20:50 33,792 –a—— c:\windows1\system32\drivers\libusb0.sys
2009-01-31 15:01 . 2009-01-31 15:00 410,984 –a—— c:\windows1\system32\deploytk.dll
2009-01-31 15:01 . 2009-01-31 15:00 73,728 –a—— c:\windows1\system32\javacpl.cpl
2009-01-31 13:14 . 2009-01-31 13:14 d——– c:\documents and settings\slt\Application Data\2K Sports
2009-01-31 13:04 . 2009-01-31 13:14 d——– c:\program files\NBA 2K9
2009-01-29 02:31 . 2009-01-29 02:47 d——– c:\program files\Guitar FX BOX 2.6
2009-01-29 02:18 . 2009-01-29 19:40 d——– c:\program files\Guitar FX BOX 2.7
2009-01-28 03:52 . 2009-01-28 03:53 d——– c:\program files\GuitarFX 3
2009-01-25 04:17 . 2009-01-31 01:36 d——– C:\download
2009-01-05 02:00 . 2002-12-17 16:23 33,340 ——— c:\windows1\system32\dbmsqlgc.dll
2009-01-05 02:00 . 2002-10-20 14:05 24,576 ——— c:\windows1\system32\dbmsgnet.dll
2009-01-05 01:59 . 2009-01-05 01:59 d——– c:\program files\Microsoft SQL Server
2009-01-05 01:58 . 2009-01-05 01:58 d——– c:\program files\Vstplugins
2009-01-05 01:58 . 2009-01-05 01:59 d——– c:\documents and settings\All Users.WINDOWS1\Application Data\Sony

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-02-03 23:00 ——— d—–w c:\program files\SpeedFan
2009-01-31 23:00 ——— d—–w c:\program files\Java
2009-01-18 01:01 ——— d—–w c:\documents and settings\slt\Application Data\Move Networks
2009-01-11 19:12 ——— d—–w c:\program files\Steam
2009-01-10 10:52 ——— d—–w c:\documents and settings\slt\Application Data\Babylon
2009-01-10 10:51 ——— d—–w c:\documents and settings\All Users.WINDOWS1\Application Data\Babylon
2009-01-05 09:59 ——— d—–w c:\documents and settings\slt\Application Data\Sony
2009-01-05 09:58 ——— d—–w c:\program files\Sony
2009-01-05 09:57 ——— d—–w c:\program files\Sony Setup
2008-12-29 16:36 ——— d—–w c:\program files\Common Files\Maxtor
2008-12-26 13:47 ——— d—–w c:\program files\Hasbro
2008-12-25 20:55 604 —ha-w c:\program files\STLL Notifier
2008-12-25 20:55 ——— d—–w c:\documents and settings\slt\Application Data\Sibelius Software
2008-12-25 20:55 ——— d—–w c:\documents and settings\All Users.WINDOWS1\Application Data\Sibelius Software
2008-12-25 20:52 ——— d—–w c:\program files\Sibelius Software
2008-12-25 20:48 ——— d—–w c:\program files\Babylon
2008-12-25 20:44 ——— d—–w c:\documents and settings\slt\Application Data\Nero
2008-12-25 20:43 ——— d—–w c:\program files\Nero 9
2008-12-25 20:43 ——— d—–w c:\program files\Common Files\Nero
2008-12-25 20:29 ——— d—–w c:\program files\Absolute Sound Recorder
2008-12-18 16:42 ——— d—–w c:\program files\EA GAMES
2008-12-15 07:52 ——— d—–w c:\program files\Image Grabber II.NET
2008-12-09 16:19 ——— d—–w c:\program files\Common Files\Ahead
2008-12-09 11:58 ——— d—–w c:\program files\MagicISO
2008-12-09 09:32 ——— d—–w c:\program files\mkv2vob
2008-12-09 09:31 ——— d—–w c:\program files\Common Files\Wise Installation Wizard
2008-12-08 11:56 ——— d—–w c:\program files\MSI
2008-12-08 11:55 ——— d—–w c:\program files\Google
2008-12-07 14:17 ——— d—–w c:\program files\Unlocker
2008-12-07 10:13 ——— d—–w c:\documents and settings\All Users.WINDOWS1\Application Data\Maxtor
2008-12-07 10:08 392,320 —-a-w c:\windows1\system32\drivers\timntr.sys
2008-12-07 10:08 32,768 —-a-w c:\windows1\system32\drivers\tifsfilt.sys
2008-12-07 10:08 120,992 —-a-w c:\windows1\system32\drivers\snapman.sys
2008-12-07 08:44 ——— d–h–w c:\program files\InstallShield Installation Information
2008-12-07 01:05 ——— d—–w c:\documents and settings\All Users.WINDOWS1\Application Data\FLEXnet
2008-12-07 01:00 ——— d—–w c:\program files\Common Files\Adobe
2008-12-07 00:52 ——— d—–w c:\program files\Common Files\Macrovision Shared
2008-12-07 00:40 ——— d—–w c:\program files\Windows Installer Clean Up
2008-12-07 00:39 ——— d—–w c:\program files\MSECACHE
2008-12-05 23:19 ——— d—–w c:\program files\Warcraft III
2008-12-05 12:20 7,727 —-a-w c:\windows1\system32\drivers\CDSpace5.cfg
2008-12-04 11:19 ——— d—–w c:\program files\Bonjour
2008-12-04 11:18 ——— d—–w c:\program files\GameTap
2008-12-04 11:18 ——— d—–w c:\documents and settings\All Users.WINDOWS1\Application Data\GameTap
2008-12-04 11:10 ——— d—–w c:\program files\Common Files\Macrovision Shared(2)
2008-12-04 11:00 ——— d—–w c:\documents and settings\All Users.WINDOWS1\Application Data\Razer(2)
2008-11-23 01:37 3,766 -csha-w c:\documents and settings\All Users.WINDOWS1\Application Data\KGyGaAvL.sys
2008-04-18 10:01 88 -csh–r c:\documents and settings\All Users.WINDOWS1\Application Data\A5192E5071.sys
2005-12-05 07:12 20,640 -c–a-w c:\windows1\inf\pxhelp20.sys
2003-03-16 11:00 7,216 -c–a-w c:\windows1\inf\RAMDISK.SYS
2007-09-19 20:23 135,680 —-a-w c:\program files\mozilla firefox\components\GoogleDesktopMozilla.dll
2006-05-03 09:06 163,328 –sh–r c:\windows1\system32\flvDX.dll
2007-02-21 10:47 31,232 –sh–r c:\windows1\system32\msfDX.dll
.

——- Sigcheck ——-

2002-12-31 04:00 360448 b51b0046d15982530af09f3d01ff48ab c:\windows1\$NtUninstallKB917953$\tcpip.sys
2006-04-20 04:18 360576 b2220c618b42a2212a59d91ebd6fc4b4 c:\windows1\$NtUninstallKB941644$\tcpip.sys
2008-06-20 02:45 360320 2a5554fc5b1e04e131230e3ce035c3f9 c:\windows1\SoftwareDistribution\Download\ad744bdeedce85bf37a096f34577ff3a\sp2gdr\tcpip.sys
2008-06-20 02:44 360960 744e57c99232201ae98c49168b918f48 c:\windows1\SoftwareDistribution\Download\ad744bdeedce85bf37a096f34577ff3a\sp2qfe\tcpip.sys
2008-06-20 03:51 361600 9aefa14bd6b182d61e3119fa5f436d3d c:\windows1\SoftwareDistribution\Download\ad744bdeedce85bf37a096f34577ff3a\sp3gdr\tcpip.sys
2008-06-20 03:59 361600 ad978a1b783b5719720cff204b666c8e c:\windows1\SoftwareDistribution\Download\ad744bdeedce85bf37a096f34577ff3a\sp3qfe\tcpip.sys
2008-04-13 11:20 361344 93ea8d04ec73a85db02eb8805988f733 c:\windows1\SoftwareDistribution\Download\e9500597a78495f397efb821e37bf356\tcpip.sys
2007-10-30 08:53 360832 ea3d7525f41beb321c3f6e2162277e92 c:\windows1\system32\dllcache\tcpip.sys
2007-10-30 08:53 360832 ea3d7525f41beb321c3f6e2162277e92 c:\windows1\system32\drivers\tcpip.sys
.
((((((((((((((((((((((((((((( snapshot_2009-02-03_ 1.51.26.50 )))))))))))))))))))))))))))))))))))))))))
.
- 2005-10-21 03:02:28 163,328 -c–a-w c:\windows1\erdnt\subs\ERDNT.EXE
+ 2005-10-21 04:02:28 163,328 —-a-w c:\windows1\erdnt\subs\ERDNT.EXE
- 2008-07-19 05:10:20 36,552 -c–a-w c:\windows1\system32\dllcache\wups.dll
+ 2008-10-16 22:08:58 34,328 -c–a-w c:\windows1\system32\dllcache\wups.dll
- 2008-07-19 05:10:20 36,552 —-a-w c:\windows1\system32\wups.dll
+ 2008-10-16 22:08:58 34,328 —-a-w c:\windows1\system32\wups.dll
- 2008-07-19 05:10:40 45,768 —-a-w c:\windows1\system32\wups2.dll
+ 2008-10-16 22:09:44 43,544 —-a-w c:\windows1\system32\wups2.dll
+ 2009-02-04 01:57:38 16,384 —-atw c:\windows1\temp\Perflib_Perfdata_518.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AIM"="c:\program files\AIM95\aim.exe" [2004-04-27 61440]
"STYLEXP"="c:\program files\TGTSoft\StyleXP\StyleXP.exe" [2005-08-18 1359872]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2008-08-19 1576176]
"ctfmon.exe"="c:\windows1\system32\ctfmon.exe" [2002-12-31 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-11-20 290088]
"NvCplDaemon"="c:\windows1\system32\NvCpl.dll" [2008-10-07 13574144]

c:\documents and settings\slt\Start Menu\Programs\Startup\
SpeedFan.lnk - c:\program files\SpeedFan\speedfan.exe [2008-08-19 3562496]

c:\documents and settings\All Users.WINDOWS1\Start Menu\Programs\Startup\
Microsoft Office Outlook 2007.lnk - c:\windows1\Installer\{90120000-0030-0000-0000-0000000FF1CE}\outicon.exe [2007-11-25 845584]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoSimpleStartMenu"= 0 (0x0)

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoSimpleStartMenu"= 1 (0x1)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"UIHost"="c:\program files\TGTSoft\StyleXP\Logon\CurrentLogon.EXE"

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.I420"= i420vfw.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS1^Start Menu^Programs^Startup^Adobe Gamma Loader.lnk]
path=c:\documents and settings\All Users.WINDOWS1\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk
backup=c:\windows1\pss\Adobe Gamma Loader.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS1^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
path=c:\documents and settings\All Users.WINDOWS1\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
backup=c:\windows1\pss\HP Digital Imaging Monitor.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
c:\windows1\system32\dumprep 0 -k [X]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UserFaultCheck]
c:\windows1\system32\dumprep 0 -u [X]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
–a—— 2002-12-31 04:00 15360 c:\windows1\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
–a–c— 2006-02-19 02:41 49152 c:\program files\HP\HP Software Update\hpwuSchd2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
–a—— 2008-10-07 12:33 13574144 c:\windows1\system32\nvcpl.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
–a—— 2008-11-04 10:30 413696 c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WINDVDPatch]
–a–c— 2002-07-02 17:56 24576 c:\windows1\system32\CTHELPER.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\WINDOWS1\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Common Files\\Adobe\\CS4ServiceManager\\CS4ServiceManager.exe"=
"c:\\Program Files\\Stardock Games\\Sins of a Solar Empire\\Sins of a Solar Empire.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\globallyopenports\list]
"5353:TCP"= 5353:TCP:Adobe CSI CS4

R1 sasdifsv;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [2008-08-19 8944]
R1 saskutil;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [2008-08-19 55024]
R1 XSPACEWG;XSPACEWG;c:\windows1\system32\drivers\XSpaceWg.sys [2007-11-25 3543]
R2 dualshock3;DUALSHOCK3 Controller HID Minidriver (USB) Beta;c:\windows1\system32\drivers\dualshock3.sys [2009-01-31 11392]
R2 SVKP;SVKP;c:\windows1\system32\SVKP.sys [2007-11-26 2368]
R3 cdspacex;cdspacex;c:\windows1\system32\drivers\CDSPACEX.sys [2007-11-25 22571]
R3 RecFltr;Reclusa Keyboard;c:\windows1\system32\drivers\RecFltr.sys [2008-02-03 41984]
R3 sasenum;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [2008-08-19 7408]
R3 TwoRabts;Two Rabbits Live Bus;c:\windows1\system32\drivers\TwoRabts.sys [2007-11-25 11120]
S3 libusb0;LibUsb-Win32 - Kernel Driver, Version 0.1.10.1;c:\windows1\system32\drivers\libusb0.sys [2009-01-31 33792]
S3 Razerlow;Razerlow USB Filter Driver;c:\windows1\system32\drivers\Razerlow.sys [2007-11-30 13225]

— Other Services/Drivers In Memory —

*NewlyCreated* - ELZECLCC

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\K]
\Shell\AutoRun\command - K:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{33ca29fa-ac43-11dd-9b5a-001bb9a9b824}]
\Shell\AutoRun\command - K:\LaunchU3.exe -a
.
Contents of the 'Scheduled Tasks' folder

2009-01-30 c:\windows1\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.google.com
FF - ProfilePath - c:\documents and settings\slt\Application Data\Mozilla\Firefox\Profiles\b2otr4eh.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.csupomona.edu/
FF - plugin: c:\program files\GameTap\bin\Release\npgametaptool.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-02-03 17:58:07
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

c:\windows1\system.ini 0 bytes

scan completed successfully
hidden files: 1

**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_USERS\S-1-5-21-484763869-261903793-839522115-1003\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:32,7f,5f,7a,56,dd,f8,01,75,b9,12,5a,59,52,26,52,15,91,ea,3e,0a,4d,c0,
a4,6d,23,90,ab,f4,7c,9b,dd,42,9b,9c,3d,d3,4e,b7,d0,2a,11,ae,fa,39,2e,0c,60,\
"??"=hex:df,75,41,29,bc,8f,20,3e,a4,a1,ce,c8,8a,a0,fc,03
.
———————— Other Running Processes ————————
.
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows1\system32\nvsvc32.exe
c:\program files\Microsoft Office\Office12\OUTLOOK.EXE
c:\program files\iPod\bin\iPodService.exe
.
**************************************************************************
.
Completion time: 2009-02-03 18:07:02 - machine was rebooted
ComboFix-quarantined-files.txt 2009-02-04 02:07:00
ComboFix2.txt 2009-02-03 22:56:33
ComboFix3.txt 2009-02-03 19:01:01
ComboFix4.txt 2009-02-03 18:19:09
ComboFix5.txt 2009-02-04 01:49:38

Pre-Run: 25,288,826,880 bytes free
Post-Run: 25,215,471,616 bytes free

267 — E O F — 2008-09-24 04:17:35

LDTate

Post #4February 4, 2009, 2:12 AM UTC

Do you have an anti-virus program?

skolpo

Post #5February 4, 2009, 2:21 AM UTC

erm, no i don't. All I have really is Super Anti-Spyware.

LDTate

Post #6February 4, 2009, 2:22 AM UTC

Get a free one.

Grisoft AVG
http://free.avg.com/download-avg-anti-virus-free-edition

avast! 4
http://www.avast.com/eng/download-avast-home.html

Or

Avira AntiVir Personal - FREE Antivirus
http://www.free-av.com/en/download/1/downl…_antivirus.html

Run a full scan and let us know what it finds along with a new HijackThis log.

Also please describe how your computer behaves at the moment

skolpo

Post #7February 4, 2009, 2:31 AM UTC

okay i'll try out the AVG one and do a full scan. My computer seems to be running pretty good right now! =)

LDTate

Post #8February 4, 2009, 2:33 AM UTC

After the AVG scan:

Good job

The following will implement some cleanup procedures as well as reset System Restore points:

Click START then RUN
Now type Combofix /u in the runbox and click OK. Note the space between the X and the U, it needs to be there.
- [external image: Posted Image]
To be on the safe side, I would also change all my passwords.

Here's my usual all clean post

Log looks good
- Make your Internet Explorer more secure - This can be done by following these simple instructions:
  - From within Internet Explorer click on the Tools menu and then click on Options.
  - Click once on the Security tab
  - Click once on the Internet icon so it becomes highlighted.
  - Click once on the Custom Level button.
  - Change the Download signed ActiveX controls to Prompt
  - Change the Download unsigned ActiveX controls to Disable
  - Change the Initialize and script ActiveX controls not marked as safe to Disable
  - Change the Installation of desktop items to Prompt
  - Change the Launching programs and files in an IFRAME to Prompt
  - Change the Navigate sub-frames across different domains to Prompt
  - When all these settings have been made, click on the OK button.
  - If it prompts you as to whether or not you want to save the settings, press the Yes button.
- Next press the Apply button and then the OK to exit the Internet Properties page.
Update your AntiVirus Software - It is imperative that you update your Antivirus software at least once a week
(Even more if you wish). If you do not update your antivirus software then it will not be able to catch any of the new variants that may come out.
Use a Firewall - I can not stress how important it is that you use a Firewall on your computer.
Without a firewall your computer is succeptible to being hacked and taken over.
I am very serious about this and see it happen almost every day with my clients.
Simply using a Firewall in its default configuration can lower your risk greatly.
Visit Microsoft's Windows Update Site Frequently - It is important that you visit http://www.windowsupdate.com regularly.
This will ensure your computer has always the latest security updates available installed on your computer.
If there are new updates to install, install them immediately, reboot your computer, and revisit the site
until there are no more critical updates.
MVPS Hosts file replaces your current HOSTS file with one containing well known ad sites and other bad sites. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer, meaning it will be difficult to infect yourself in the future.
Winpatrol
Update all these programs regularly - Make sure you update all the programs I have listed regularly.
Without regular updates you WILL NOT be protected when new malicious programs are released.

Only run one Anti-Virus and Firewall program.

I would also suggest you read this:
So how did I get infected in the first place?
by Tony Klein

skolpo

Post #9February 4, 2009, 5:07 AM UTC

The scan finally finished. It found a few backdoors here and there. When I tried to run the ComboFix /u, the anti-virus said that a threat was detected so I stopped the command from getting through. What should I do?

LDTate

Post #10February 4, 2009, 2:59 PM UTC

You can remove these files and folders if listed: C:\ComboFix C:\QooBox C:\combofix.txt C:\combofix-quarantine-files.txt

LDTate

Post #11February 9, 2009, 10:05 PM UTC

Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance. If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread. Everyone else please begin a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

[Resolved] bitsprx.dll trojan won't leave my system!

✨ Ask AI

Ask AI