Another Win32:BHO-KD Infection

system · 2008-01-03T14:35:42.000Z

HijackThis Log:-

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:33:10, on 03/01/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\WLTRYSVC.EXE
C:\WINDOWS\System32\bcmwltry.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Dell\Bluetooth Software\bin\btwdins.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\System32\hkcmd.exe
C:\WINDOWS\system32\WLTRAY.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\PROGRA~1\MICROS~3\wcescomm.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
C:\PROGRA~1\MICROS~3\rapimgr.exe
C:\Program Files\Dell\Bluetooth Software\BTTray.exe
C:\PROGRA~1\Dell\BLUETO~1\BTSTAC~1.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Acrobat\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM..\Run: [Broadcom Wireless Manager UI] C:\WINDOWS\system32\WLTRAY.exe
O4 - HKLM..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM..\Run: [Windows Defender] “C:\Program Files\Windows Defender\MSASCui.exe” -hide
O4 - HKCU..\Run: [H/PC Connection Agent] “C:\PROGRA~1\MICROS~3\wcescomm.exe”
O4 - HKCU..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18..\Run: [DWQueuedReporting] “C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe” -t (User ‘SYSTEM’)
O4 - HKUS.DEFAULT..\Run: [DWQueuedReporting] “C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe” -t (User ‘Default user’)
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
O4 - Global Startup: BTTray.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Send To &Bluetooth - C:\Program Files\Dell\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra ‘Tools’ menuitem: Create Mobile Favorite… - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra ‘Tools’ menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\Dell\Bluetooth Software\btsendto_ie.htm
O9 - Extra ‘Tools’ menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\Dell\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra ‘Tools’ menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {5C6698D9-7BE4-4122-8EC5-291D84DBD4A0} (Facebook Photo Uploader 4 Control) - http://upload.facebook.com/controls/FacebookPhotoUploader3.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.co.uk/scan_uk/scan8/oscan8.cab
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/FacebookPhotoUploader.cab
O16 - DPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} (Performance Viewer Activex Control) - https://secure.logmein.com/activex/ractrl.cab?lmi=100
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Bluetooth Service (btwdins) - WIDCOMM, Inc. - C:\Program Files\Dell\Bluetooth Software\bin\btwdins.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE

–
End of file - 6823 bytes

oldman960 · 2008-01-03T16:10:47.000Z

Sorry about the delay, I’m at work, so it’s rather hit and miss.

I just want to make sure these guys are gone.

Open a new Notepad session (Do not use a Word Processor or WordPad). Click “Format” and be certain that Word Wrap is not enabled.

Copy and paste all the text in the quote box below into Notepad.

Click File, Save as…, and set the location to your Desktop, and enter (including quotation marks) as the filename: “CFscript.txt” . Using your mouse left button, drag the new file CFscript.txt and drop it on the ComboFix.exe icon as shown at the bottom of this post.

File:: C:\WINDOWS\system32\pvxnshwf.dat C:\WINDOWS\system32\huslroeo.dat C:\WINDOWS\system32\sajnihsj.dat C:\WINDOWS\system32\tphmlmoq.dat C:\WINDOWS\system32\oigkpjhj.dat

This will start ComboFix again.Close all browser/windows first. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply .

system · 2008-01-04T07:49:39.000Z

ComboFix Log:-

ComboFix 08-01-03.3 - Dave Witcher 2008-01-04 7:46:23.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.342 [GMT 0:00]
Running from: C:\Documents and Settings\Dave Witcher\Desktop\ComboFix.exe
Command switches used :: D:\CFscript.txt

Created a new restore point

FILE
C:\WINDOWS\system32\huslroeo.dat
C:\WINDOWS\system32\oigkpjhj.dat
C:\WINDOWS\system32\pvxnshwf.dat
C:\WINDOWS\system32\sajnihsj.dat
C:\WINDOWS\system32\tphmlmoq.dat
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\huslroeo.dat
C:\WINDOWS\system32\oigkpjhj.dat
C:\WINDOWS\system32\pvxnshwf.dat
C:\WINDOWS\system32\sajnihsj.dat
C:\WINDOWS\system32\tphmlmoq.dat

.
((((((((((((((((((((((((( Files Created from 2007-12-04 to 2008-01-04 )))))))))))))))))))))))))))))))
.

2008-01-03 14:32 . 2008-01-03 14:32 d-------- C:\Program Files\Trend Micro
2008-01-03 14:22 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\NirCmd.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-12-04 14:56 93,264 ----a-w C:\WINDOWS\system32\drivers\aswmon.sys
2007-12-04 14:55 94,544 ----a-w C:\WINDOWS\system32\drivers\aswmon2.sys
2007-12-04 14:53 23,152 ----a-w C:\WINDOWS\system32\drivers\aswRdr.sys
2007-12-04 14:51 42,912 ----a-w C:\WINDOWS\system32\drivers\aswTdi.sys
2007-12-04 14:49 26,624 ----a-w C:\WINDOWS\system32\drivers\aavmker4.sys
2007-12-04 13:04 837,496 ----a-w C:\WINDOWS\system32\aswBoot.exe
2007-12-04 12:54 95,608 ----a-w C:\WINDOWS\system32\AVASTSS.scr
2007-11-13 10:25 20,480 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys
2007-11-09 16:26 --------- d-----w C:\Program Files\SystemErrorFixer
2007-11-07 20:42 --------- d-----w C:\Documents and Settings\Dave Witcher\Application Data\Teleca
2007-11-07 20:41 --------- d-----w C:\Program Files\Common Files\Teleca Shared
2007-11-07 20:24 --------- d-----w C:\Documents and Settings\Dave Witcher\Application Data\systemerrorfixer
2007-11-07 20:19 --------- d-----w C:\Program Files\Common Files\SystemErrorFixer
2007-11-07 20:19 --------- d-----r C:\Documents and Settings\All Users\Application Data\systemerrorfixer
2007-10-29 22:43 1,287,680 ----a-w C:\WINDOWS\system32\quartz.dll
2007-10-27 17:40 222,720 ----a-w C:\WINDOWS\system32\wmasf.dll
2007-03-04 17:43 18,696 ----a-w C:\Documents and Settings\Dave Witcher\Application Data\GDIPFONTCACHEV1.DAT
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
Note empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
“H/PC Connection Agent”=“C:\PROGRA~1\MICROS~3\wcescomm.exe” [2006-06-26 16:13 1207080]
“ctfmon.exe”=“C:\WINDOWS\system32\ctfmon.exe” [2004-08-04 00:56 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
“SynTPLpr”=“C:\Program Files\Synaptics\SynTP\SynTPLpr.exe” [2004-05-13 19:23 98304]
“SynTPEnh”=“C:\Program Files\Synaptics\SynTP\SynTPEnh.exe” [2004-05-14 09:35 536576]
“IgfxTray”=“C:\WINDOWS\System32\igfxtray.exe” [2004-02-25 16:42 155648]
“HotKeysCmds”=“C:\WINDOWS\System32\hkcmd.exe” [2004-02-25 16:38 118784]
“Broadcom Wireless Manager UI”=“C:\WINDOWS\system32\WLTRAY.exe” [2006-11-01 12:48 1392640]
“NeroFilterCheck”=“C:\WINDOWS\system32\NeroCheck.exe” [2001-07-09 11:50 155648]
“avast!”=“C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe” [2007-12-04 13:00 79224]
“Windows Defender”=“C:\Program Files\Windows Defender\MSASCui.exe” [2006-11-03 18:20 866584]

[HKEY_USERS.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
“DWQueuedReporting”=“C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe” [2007-03-13 15:38 39264]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup
Acrobat Assistant.lnk - C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe [2007-01-22 14:10:36]
BTTray.lnk - C:\Program Files\Dell\Bluetooth Software\BTTray.exe [2004-04-26 17:13:54]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 01:01:04]

S3 se59bus;Sony Ericsson Device 089 driver (WDM);C:\WINDOWS\system32\DRIVERS\se59bus.sys [2006-09-05 19:07]
S3 se59mdfl;Sony Ericsson Device 089 USB WMC Modem Filter;C:\WINDOWS\system32\DRIVERS\se59mdfl.sys [2006-09-05 19:07]
S3 se59mdm;Sony Ericsson Device 089 USB WMC Modem Driver;C:\WINDOWS\system32\DRIVERS\se59mdm.sys [2006-09-05 19:07]
S3 se59obex;Sony Ericsson Device 089 USB WMC OBEX Interface;C:\WINDOWS\system32\DRIVERS\se59obex.sys [2006-09-05 19:09]

.
Contents of the ‘Scheduled Tasks’ folder
“2008-01-03 14:30:53 C:\WINDOWS\Tasks\MP Scheduled Scan.job”

C:\Program Files\Windows Defender\MpCmdRun.exe
.

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-04 07:47:28
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

.
Completion time: 2008-01-04 7:48:04
ComboFix-quarantined-files.txt 2008-01-04 07:47:48
ComboFix2.txt 2008-01-03 14:30:14
.
2007-12-29 09:36:35 — E O F —

oldman960 · 2008-01-04T13:28:06.000Z

That looks good. Is everything ok now?

system · 2008-01-04T13:37:13.000Z

Oldman,

Look great thanks! I ran another Boot Time Scan and it found a few issues wich were moved to the chest. Should I delete these now?

I’m running XP with Avast 4.7 and the Windows firewall. Should i use anything else for the future?

Thanks,

Phil B

oldman960 · 2008-01-04T13:39:53.000Z

What did the boot time scan find?

I’ve have something for you in the clean up session. An antispyware program is good to have.

system · 2008-01-04T13:45:12.000Z

It found
Win32:delf-FNP
Win32:delf-GFV
Win32:BHO-KD

and moved them to the chest.

Is the free AVG Anti-spyware any good?

oldman960 · 2008-01-04T13:52:43.000Z

Avg is ok, I like SAS my self.

Can you navigate to this folder, in windows explorer

C:\program files\Alwil Software\avast4\data\logs

click on the logs folder, then in the right hand panel, double click on the warning log. It will open with notepad. Please copy and paste the last 10-15 lines and post them here. I just want to see the files detected.

thanks

system · 2008-01-04T14:06:07.000Z

There you go…

oldman960 · 2008-01-04T14:19:12.000Z

It looks like the avast detections where before you ran combofix the last time. Combofix removed those files.

I’d like you to do this cleanup list, the go to the link below and do an online scan. You will have to pause the avast standard shield during the scan Right click the “a” icon select pause, then stabdard shield. Remember to resume it after the scan. You can do the firewall after the scan.

Please post the results in your next reply.

http://www.eset.com/onlinescan/

1.Click start button, click run, copy and paste the line below into the box, click ok

combofix /u

2.Please download the OTMoveIt by OldTimer.
[*] Save it to your desktop.
[*] Please double-click OTMoveIt2.exe to run it.

Then click the Clean Up button. You may get prompted by your firewall that OTMoveIt wants to contact the internet - allow this. A cleanup.txt will be downloaded, a message dialog will ask you if you want to proceed with the cleanup process, click Yes. This will delete all the tools you have downloaded plus itself.

3.Create a new restore point

You must be logged on to an administrator account
Go to Start - All Programs - Accessories - System Tools - System Restore.
Click Create a restore point, and then click Next.
In the text box labeled Restore Point Description, type a name for this restore point , click create

Remove old restore points

4.Disk Cleanup

Go to Start - All Programs - Accessories - system tools. Launch the Disk Cleanup tool and let it run. When it finishes a box with tabs will appear, select the more options tab. On this tab you will find a section for System Restore. If you press the Clean Up button for that section, Windows will delete all restore points except for the most recent one.

5.Download and run this clean up utility. You can use it regularly. When it’s first run, it is in demo mode to show you what it will remove. Review it and then rerun in real mode. It is configurable.

CleanUp

It looks like you are using windows firewall. It doesn’t provide outbound protection. A third party firewall will.

A discussion on free firewalls can be found here.

http://forum.avast.com/index.php?topic=30808.0

system · 2008-01-04T14:45:19.000Z

Gonna have to do that at home tonight - I’m doing this at work for a friend and the PC is not connected to the net to do online scans so there will be a couple of days delay before I get to it - the wife has too much decorating for me at home to spend sat at the PC!!!

system · 2008-01-04T21:40:03.000Z

ESET scan attached as a jpeg as I do not know how to output a report file. Thanks.

system · 2008-01-04T22:03:32.000Z

Oldman,

I have run all the clean up instructions. One thing - I installed Cleanup 4.5 but could not find the tab to delete restore points. I have also installed Superantispyware so hopefully I should be ok now. Thanks for your help.

Phil B

system · 2008-01-04T22:59:57.000Z

Hello Oldman!

I need your help in removing this Shit virus. it seems i am not the only person hit by this stubborn shit.

I have followed some of the procedures you suggested to the other people hit by same shit.

I run combo fix which generated the following log…

Please advise me what next,…
ComboFix 08-01-04.1 - Fayaz Malik 2008-01-04 22:15:39.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.420 [GMT 0:00]
Running from: C:\Documents and Settings\Fayaz Malik\Local Settings\Temporary Internet Files\Content.IE5\N87U69IG\ComboFix[1].exe

Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\All Users\Application Data.\salesmonitor
C:\Documents and Settings\All Users\Application Data\WinAntiVirus Pro 2007
C:\Documents and Settings\All Users\Application Data\WinAntiVirus Pro 2007\Data\Abbr
C:\Documents and Settings\All Users\Application Data\WinAntiVirus Pro 2007\Data\ActivationCode
C:\Documents and Settings\All Users\Application Data\WinAntiVirus Pro 2007\Data\ProductCode
C:\Documents and Settings\Family and Friends\Application Data\WinAntiVirus Pro 2007
C:\Documents and Settings\Family and Friends\Application Data\WinAntiVirus Pro 2007\avtasks.dat
C:\Documents and Settings\Family and Friends\Application Data\WinAntiVirus Pro 2007\history.db
C:\Documents and Settings\Family and Friends\Application Data\WinAntiVirus Pro 2007\Logs\update.log
C:\Documents and Settings\Family and Friends\Application Data\WinAntiVirus Pro 2007\Logs\wa7Support.log
C:\Documents and Settings\Family and Friends\Application Data\WinAntiVirus Pro 2007\Logs\winav.log
C:\Documents and Settings\Family and Friends\Application Data\WinAntiVirus Pro 2007\PGE.dat
C:\Documents and Settings\Family and Friends\err.log
C:\Documents and Settings\Family and Friends\ResErrors.log
C:\Documents and Settings\Fayaz Malik\Application Data\hidires
C:\Documents and Settings\Fayaz Malik\err.log
C:\Documents and Settings\Fayaz Malik\ResErrors.log
C:\Documents and Settings\Guest\Application Data\WinAntiVirus Pro 2007
C:\Documents and Settings\Guest\Application Data\WinAntiVirus Pro 2007\avtasks.dat
C:\Documents and Settings\Guest\Application Data\WinAntiVirus Pro 2007\CookieList.dat
C:\Documents and Settings\Guest\Application Data\WinAntiVirus Pro 2007\history.db
C:\Documents and Settings\Guest\Application Data\WinAntiVirus Pro 2007\Logs\update.log
C:\Documents and Settings\Guest\Application Data\WinAntiVirus Pro 2007\Logs\wa7Support.log
C:\Documents and Settings\Guest\Application Data\WinAntiVirus Pro 2007\Logs\winav.log
C:\Documents and Settings\Guest\Application Data\WinAntiVirus Pro 2007\PGE.dat
C:\Documents and Settings\Guest\err.log
C:\Documents and Settings\Guest\ResErrors.log
C:\Program Files\Common Files\drivecleaner free
C:\Program Files\outlook
C:\UWA7P
C:\WINDOWS\system32[u]0[/u]_exception.nls
C:\WINDOWS\system32\cnbjmo.dll
C:\WINDOWS\system32\drivers\qwkckmxa.dat
C:\WINDOWS\system32\drivers\runtime2.sys
C:\WINDOWS\system32\nsi62.dll
C:\WINDOWS\system32\stera.log

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.
-------\LEGACY_FOPN
-------\LEGACY_NJOOOFLZ
-------\LEGACY_RUNTIME
-------\LEGACY_RUNTIME2
-------\m_hook
-------\njoooflz
-------\runtime

((((((((((((((((((((((((( Files Created from 2007-12-04 to 2008-01-04 )))))))))))))))))))))))))))))))
.

2008-01-04 22:14 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\NirCmd.exe
2007-12-30 22:56 . 2007-12-30 22:56 d-------- C:\Documents and Settings\Guest\Application Data\Yahoo!
2007-12-04 01:48 . 2007-12-22 03:12 77,353 --a------ C:\WINDOWS\system32\adssite_sidebar_uninstall.exe

system · 2008-01-04T23:01:03.000Z

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-04 13:41 --------- d-----w C:\Documents and Settings\Fayaz Malik\Application Data\Jasc Software Inc
2008-01-01 17:48 --------- d-----w C:\Documents and Settings\Fayaz Malik\Application Data\Skype
2007-12-09 15:19 --------- d-----w C:\Documents and Settings\All Users\Application Data\Yahoo! Companion
2007-12-09 15:17 --------- d—a-w C:\Documents and Settings\Fayaz Malik\Application Data\yahoo!
2007-12-04 20:40 --------- d-----w C:\Documents and Settings\Fayaz Malik\Application Data\DataLayer
2007-12-04 14:56 93,264 ----a-w C:\WINDOWS\system32\drivers\aswmon.sys
2007-12-04 14:55 94,544 ----a-w C:\WINDOWS\system32\drivers\aswmon2.sys
2007-12-04 14:53 23,152 ----a-w C:\WINDOWS\system32\drivers\aswRdr.sys
2007-12-04 14:51 42,912 ----a-w C:\WINDOWS\system32\drivers\aswTdi.sys
2007-12-04 14:49 26,624 ----a-w C:\WINDOWS\system32\drivers\aavmker4.sys
2007-12-03 01:48 --------- d-----w C:\Program Files\Windows Live Toolbar
2007-11-22 20:44 --------- d-----w C:\Documents and Settings\All Users\Application Data\BOC425
2007-11-21 22:36 --------- d-----w C:\Program Files\eMule
2007-11-21 21:42 --------- d-----w C:\Program Files\Dcads Games Collection
2007-11-21 21:09 --------- d-----w C:\Program Files\BearShare Applications
2007-11-21 21:06 --------- d-----w C:\Program Files\LimeWire
2007-11-17 14:10 --------- d-----w C:\Program Files\Picasa2
2007-11-13 10:25 20,480 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys
2007-11-10 17:56 --------- d-----w C:\Program Files\SecondLife
2007-11-10 14:20 --------- d-----w C:\Documents and Settings\Fayaz Malik\Application Data\SecondLife
2007-11-10 11:41 --------- d-----w C:\Program Files\PC Registry Cleaner
2007-11-09 23:14 --------- d-----w C:\Documents and Settings\Fayaz Malik\Application Data\Nokia Multimedia Player
2007-11-06 22:12 --------- d-----w C:\Program Files\Comodo
2007-11-05 08:47 --------- d-----w C:\Documents and Settings\Fayaz Malik\Application Data\Comodo
2007-11-05 08:47 --------- d-----w C:\Documents and Settings\All Users\Application Data\Comodo
2007-11-04 18:07 --------- d-----w C:\Program Files\McAfee.com
2007-11-04 18:05 --------- d-----w C:\Documents and Settings\All Users\Application Data\McAfee
2007-11-04 18:03 --------- d-----w C:\Documents and Settings\All Users\Application Data\SiteAdvisor
2007-11-04 16:13 --------- d-----w C:\Program Files\Alwil Software
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
Note empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE~\Browser Helper Objects{1648E328-3E5A-4EA5-A9C6-E5F09EE272DA}]
2007-12-03 17:12 282624 --a------ C:\WINDOWS\system32\adssite_sidebar.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
“msnmsgr”=“C:\Program Files\MSN Messenger\msnmsgr.exe” [2007-01-19 11:54 5674352]
“Yahoo! Pager”=“C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.exe” [2007-08-30 16:43 4670704]
“swg”=“C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe” [2007-04-02 12:04 68856]
“MSMSGS”=“C:\Program Files\Messenger\msmsgs.exe” [2004-10-13 16:24 1694208]
“ctfmon.exe”=“C:\WINDOWS\system32\ctfmon.exe” [2004-08-04 05:00 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
“MSConfig”=“C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe” [2005-09-27 00:34 169984]
“avast!”=“C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe” [2007-12-04 13:00 79224]
“ATIPTA”=“C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe” [2005-08-05 21:05 344064]
“ISUSScheduler”=“C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe” [2005-06-10 10:44 81920]
“ISUSPM Startup”=“C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe” [2005-06-10 10:44 249856]
“IntelWireless”=“C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe” [2004-10-30 14:59 385024]
“QuickTime Task”=“C:\Program Files\QuickTime\qttask.exe” [2007-01-20 17:32 282624]
“TkBellExe”=“C:\Program Files\Common Files\Real\Update_OB\realsched.exe” [2006-12-25 01:37 185896]

[HKEY_USERS.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
“CTFMON.EXE”=“C:\WINDOWS\system32\CTFMON.EXE” [2004-08-04 05:00 15360]
“Nokia.PCSync”=“C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe” [2007-06-19 09:17 1241088]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
“DisableRegistryTools”= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\IntelWireless]
C:\Program Files\Intel\Wireless\Bin\LgNotify.dll 2004-09-07 16:08 110592 C:\Program Files\Intel\Wireless\Bin\LgNotify.dll

SafeBoot registry key needs repairs. This machine cannot enter Safe Mode.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\File system]
@=“Driver Group”

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vgasave.sys]
@=“Driver”

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal{4D36E967-E325-11CE-BFC1-08002BE10318}]
@=“DiskDrive”

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal{4D36E96A-E325-11CE-BFC1-08002BE10318}]
@=“Hdc”

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal{4D36E96B-E325-11CE-BFC1-08002BE10318}]
@=“Keyboard”

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal{4D36E96F-E325-11CE-BFC1-08002BE10318}]
@=“Mouse”

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal{4D36E97D-E325-11CE-BFC1-08002BE10318}]
@=“System”

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal{71A27CDD-812A-11D0-BEC7-08002BE2092F}]
@=“Volume”

system · 2008-01-04T23:01:38.000Z

HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Fayaz Malik^Start Menu^Programs^Startup^Zapu Acceleration Engine.lnk]
path=C:\Documents and Settings\Fayaz Malik\Start Menu\Programs\Startup\Zapu Acceleration Engine.lnk
backup=C:\WINDOWS\pss\Zapu Acceleration Engine.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Fayaz Malik^Start Menu^Programs^Startup^Zapu.lnk]
path=C:\Documents and Settings\Fayaz Malik\Start Menu\Programs\Startup\Zapu.lnk
backup=C:\WINDOWS\pss\Zapu.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Activate Scanner]
C:\PROGRA~1\QUICKH~1\ACTIVATE.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Photo Downloader]
2005-06-06 22:46 57344 --a------ C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2007-10-10 19:51 39792 --a------ C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Apoint]
2004-09-13 16:33 155648 --a------ C:\Program Files\Apoint\Apoint.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BOC-425]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\COMODO Firewall Pro]
C:\Program Files\Comodo\Firewall\CPF.exe /background

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
2004-08-04 05:00 15360 --a------ C:\WINDOWS\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DataLayer]
2007-05-04 07:17 863744 --a------ C:\PROGRA~1\COMMON~1\PCSuite\DATALA~1\DATALA~1.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Dell QuickSet]
2005-09-01 17:24 684032 --a------ C:\Program Files\Dell\QuickSet\quickset.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Disk Monitor]
C:\Documents and Settings\Fayaz Malik\Disk_Monitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\dla]
2004-12-06 01:05 127035 --a------ C:\WINDOWS\system32\dla\tfswctrl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\dlccmon.exe]
2005-07-22 07:03 425984 --a------ C:\Program Files\Dell Photo AIO Printer 924\dlccmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DMXLauncher]
2005-01-27 01:02 86016 --a------ C:\Program Files\Dell\Media Experience\DMXLauncher.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DVDLauncher]
2005-02-23 16:19 53248 --------- C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Email Protection]
C:\PROGRA~1\QUICKH~1\EmlProxy.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Globe7]
C:\Program Files\Globe7\Globe7.exe /hide

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Desktop Search]
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe /startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\hid_start]
C:\WINDOWS\System32\Rundll32.exe C:\WINDOWS\system32\gzmrotate.dll DllVerify

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Load]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Messenger]
C:\PROGRA~1\QUICKH~1\SCANMSG.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MskAgentexe]
C:\Program Files\McAfee\MSK\MskAgent.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
C:\Program Files\Messenger\msmsgs.exe /background

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
C:\Program Files\MSN Messenger\msnmsgr.exe /background

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OASClnt]
C:\Program Files\McAfee.com\VSO\oasclnt.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\On-Line Protection]
C:\PROGRA~1\QUICKH~1\CATEYE.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\outlook]
C:\Program Files\outlook\outlook.exe /auto

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCSuiteTrayApplication]
C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Picasa Media Detector]
2007-10-23 21:18 443968 --a------ C:\Program Files\Picasa2\PicasaMediaDetector.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PronunciationPatterns]
2007-04-02 12:04 68856 --a------ C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
C:\Program Files\QuickTime\qttask.exe -atboottime

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Run]

oldman960 · 2008-01-05T02:29:24.000Z

Hi pbunn

The esset log should be located at C:\Program Files\EsetOnlineScanner\log.txt

The clean up for the restore points that I was refering to is in windows, not the cleanup program I had you download.

Click start button, All Programs - Accessories - system tools. Launch the Disk Cleanup tool and let it run. When it finishes a box with tabs will appear, select the more options tab. On this tab you will find a section for System Restore. If you press the Clean Up button for that section, Windows will delete all restore points except for the most recent one.

Remember, if you installed the free version of SAS, it will be on demand only. Which means you will have to run scans manually and regularly. The same for AVG, though there may be a trial period with on access, then they will revert to on demand.

I have looked throgh your logs for mlvtgmlv.sys, it is nowhere to be seen. The 2nd eset detection is a folder I missed, we’ll remove that now.

I’m very curious as to where the mlvtgmlv.sys came from and if another will appear. I’d like you to run combofix again, this time before you run it rename it to pbunnfix.exe

Download ComboFix from Here or Here to your Desktop.

Don’t run it yet, we’ll run it with this script.

Open a new Notepad session (Do not use a Word Processor or WordPad). Click “Format” and be certain that Word Wrap is not enabled.

Copy and paste all the text in the quote box below into Notepad.

Click File, Save as…, and set the location to your Desktop, and enter (including quotation marks) as the filename: “CFscript.txt” . Using your mouse left button, drag the new file CFscript.txt and drop it on the ComboFix.exe icon as shown at the bottom of this post.

This will start ComboFix .Close all browser/windows first. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply together with a new HJT log.

Folder:: C:\Program Files\SystemErrorFixer C:\Documents and Settings\Dave Witcher\Application Data\systemerrorfixer C:\Program Files\Common Files\SystemErrorFixer C:\Program Files\SystemErrorFixer

Click here to download HJTsetup.exe

oldman960 · 2008-01-05T05:43:39.000Z

@faymak

I started a new thread for you in the virus and worms forum, it’s called “faymak’s BHO thread” you can reach it here

http://forum.avast.com/index.php?topic=32435.0

system · 2008-01-05T08:37:53.000Z

Oldman,

Eset scanner log attached - I’m doing the other stuff now…

version=4

OnlineScanner.ocx=1.0.0.56

OnlineScannerDLLA.dll=1, 0, 0, 51

OnlineScannerDLLW.dll=1, 0, 0, 51

OnlineScannerUninstaller.exe=1, 0, 0, 49

vers_standard_module=2766 (20080104)

vers_arch_module=1.060 (20071228)

vers_adv_heur_module=1.064 (20070717)

EOSSerial=7a4e967b0264f745ace04ae72880f9ab

end=finished

remove_checked=true

unwanted_checked=false

utc_time=2008-01-04 09:31:07

local_time=2008-01-04 09:31:07 (+0000, GMT Standard Time)

country=“United Kingdom”

osver=5.1.2600 NT Service Pack 2

scanned=153144

found=3

scan_time=1347

C:\Documents and Settings\Dave Witcher\My Documents\Data Backup\APEC Ltd\Collins&Aikman\Programs\Ford\CD3XX\IB2 sanity check C&A updates 200106.xls probably unknown MACRO virus (cleaned) 00000000000000000000000000000000
C:\Program Files\Common Files\SystemErrorFixer\strpmon.exe probably a variant of Win32/Genetik trojan (unable to clean - deleted) 00000000000000000000000000000000
C:\WINDOWS\system32\drivers\mlvtgmlv.sys probably a variant of Win32/Rootkit.Agent.NDA trojan (unable to clean - deleted) 00000000000000000000000000000000

system · 2008-01-05T08:50:45.000Z

OLdman,

Combofix and HJT logs attached.

Phil B

Announcements