Another Win32:BHO-KD Infection

oldman960 · 2008-01-03T16:10:47.000Z

Sorry about the delay, I’m at work, so it’s rather hit and miss.

I just want to make sure these guys are gone.

Open a new Notepad session (Do not use a Word Processor or WordPad). Click “Format” and be certain that Word Wrap is not enabled.

Copy and paste all the text in the quote box below into Notepad.

Click File, Save as…, and set the location to your Desktop, and enter (including quotation marks) as the filename: “CFscript.txt” . Using your mouse left button, drag the new file CFscript.txt and drop it on the ComboFix.exe icon as shown at the bottom of this post.

File:: C:\WINDOWS\system32\pvxnshwf.dat C:\WINDOWS\system32\huslroeo.dat C:\WINDOWS\system32\sajnihsj.dat C:\WINDOWS\system32\tphmlmoq.dat C:\WINDOWS\system32\oigkpjhj.dat

This will start ComboFix again.Close all browser/windows first. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply .

system · 2008-01-04T07:49:39.000Z

ComboFix Log:-

ComboFix 08-01-03.3 - Dave Witcher 2008-01-04 7:46:23.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.342 [GMT 0:00]
Running from: C:\Documents and Settings\Dave Witcher\Desktop\ComboFix.exe
Command switches used :: D:\CFscript.txt

Created a new restore point

FILE
C:\WINDOWS\system32\huslroeo.dat
C:\WINDOWS\system32\oigkpjhj.dat
C:\WINDOWS\system32\pvxnshwf.dat
C:\WINDOWS\system32\sajnihsj.dat
C:\WINDOWS\system32\tphmlmoq.dat
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\huslroeo.dat
C:\WINDOWS\system32\oigkpjhj.dat
C:\WINDOWS\system32\pvxnshwf.dat
C:\WINDOWS\system32\sajnihsj.dat
C:\WINDOWS\system32\tphmlmoq.dat

.
((((((((((((((((((((((((( Files Created from 2007-12-04 to 2008-01-04 )))))))))))))))))))))))))))))))
.

2008-01-03 14:32 . 2008-01-03 14:32 d-------- C:\Program Files\Trend Micro
2008-01-03 14:22 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\NirCmd.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-12-04 14:56 93,264 ----a-w C:\WINDOWS\system32\drivers\aswmon.sys
2007-12-04 14:55 94,544 ----a-w C:\WINDOWS\system32\drivers\aswmon2.sys
2007-12-04 14:53 23,152 ----a-w C:\WINDOWS\system32\drivers\aswRdr.sys
2007-12-04 14:51 42,912 ----a-w C:\WINDOWS\system32\drivers\aswTdi.sys
2007-12-04 14:49 26,624 ----a-w C:\WINDOWS\system32\drivers\aavmker4.sys
2007-12-04 13:04 837,496 ----a-w C:\WINDOWS\system32\aswBoot.exe
2007-12-04 12:54 95,608 ----a-w C:\WINDOWS\system32\AVASTSS.scr
2007-11-13 10:25 20,480 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys
2007-11-09 16:26 --------- d-----w C:\Program Files\SystemErrorFixer
2007-11-07 20:42 --------- d-----w C:\Documents and Settings\Dave Witcher\Application Data\Teleca
2007-11-07 20:41 --------- d-----w C:\Program Files\Common Files\Teleca Shared
2007-11-07 20:24 --------- d-----w C:\Documents and Settings\Dave Witcher\Application Data\systemerrorfixer
2007-11-07 20:19 --------- d-----w C:\Program Files\Common Files\SystemErrorFixer
2007-11-07 20:19 --------- d-----r C:\Documents and Settings\All Users\Application Data\systemerrorfixer
2007-10-29 22:43 1,287,680 ----a-w C:\WINDOWS\system32\quartz.dll
2007-10-27 17:40 222,720 ----a-w C:\WINDOWS\system32\wmasf.dll
2007-03-04 17:43 18,696 ----a-w C:\Documents and Settings\Dave Witcher\Application Data\GDIPFONTCACHEV1.DAT
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
Note empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
“H/PC Connection Agent”=“C:\PROGRA~1\MICROS~3\wcescomm.exe” [2006-06-26 16:13 1207080]
“ctfmon.exe”=“C:\WINDOWS\system32\ctfmon.exe” [2004-08-04 00:56 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
“SynTPLpr”=“C:\Program Files\Synaptics\SynTP\SynTPLpr.exe” [2004-05-13 19:23 98304]
“SynTPEnh”=“C:\Program Files\Synaptics\SynTP\SynTPEnh.exe” [2004-05-14 09:35 536576]
“IgfxTray”=“C:\WINDOWS\System32\igfxtray.exe” [2004-02-25 16:42 155648]
“HotKeysCmds”=“C:\WINDOWS\System32\hkcmd.exe” [2004-02-25 16:38 118784]
“Broadcom Wireless Manager UI”=“C:\WINDOWS\system32\WLTRAY.exe” [2006-11-01 12:48 1392640]
“NeroFilterCheck”=“C:\WINDOWS\system32\NeroCheck.exe” [2001-07-09 11:50 155648]
“avast!”=“C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe” [2007-12-04 13:00 79224]
“Windows Defender”=“C:\Program Files\Windows Defender\MSASCui.exe” [2006-11-03 18:20 866584]

[HKEY_USERS.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
“DWQueuedReporting”=“C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe” [2007-03-13 15:38 39264]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup
Acrobat Assistant.lnk - C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe [2007-01-22 14:10:36]
BTTray.lnk - C:\Program Files\Dell\Bluetooth Software\BTTray.exe [2004-04-26 17:13:54]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 01:01:04]

S3 se59bus;Sony Ericsson Device 089 driver (WDM);C:\WINDOWS\system32\DRIVERS\se59bus.sys [2006-09-05 19:07]
S3 se59mdfl;Sony Ericsson Device 089 USB WMC Modem Filter;C:\WINDOWS\system32\DRIVERS\se59mdfl.sys [2006-09-05 19:07]
S3 se59mdm;Sony Ericsson Device 089 USB WMC Modem Driver;C:\WINDOWS\system32\DRIVERS\se59mdm.sys [2006-09-05 19:07]
S3 se59obex;Sony Ericsson Device 089 USB WMC OBEX Interface;C:\WINDOWS\system32\DRIVERS\se59obex.sys [2006-09-05 19:09]

.
Contents of the ‘Scheduled Tasks’ folder
“2008-01-03 14:30:53 C:\WINDOWS\Tasks\MP Scheduled Scan.job”

C:\Program Files\Windows Defender\MpCmdRun.exe
.

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-04 07:47:28
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

.
Completion time: 2008-01-04 7:48:04
ComboFix-quarantined-files.txt 2008-01-04 07:47:48
ComboFix2.txt 2008-01-03 14:30:14
.
2007-12-29 09:36:35 — E O F —

oldman960 · 2008-01-04T13:28:06.000Z

That looks good. Is everything ok now?

system · 2008-01-04T13:37:13.000Z

Oldman,

Look great thanks! I ran another Boot Time Scan and it found a few issues wich were moved to the chest. Should I delete these now?

I’m running XP with Avast 4.7 and the Windows firewall. Should i use anything else for the future?

Thanks,

Phil B

oldman960 · 2008-01-04T13:39:53.000Z

What did the boot time scan find?

I’ve have something for you in the clean up session. An antispyware program is good to have.

system · 2008-01-04T13:45:12.000Z

It found
Win32:delf-FNP
Win32:delf-GFV
Win32:BHO-KD

and moved them to the chest.

Is the free AVG Anti-spyware any good?

oldman960 · 2008-01-04T13:52:43.000Z

Avg is ok, I like SAS my self.

Can you navigate to this folder, in windows explorer

C:\program files\Alwil Software\avast4\data\logs

click on the logs folder, then in the right hand panel, double click on the warning log. It will open with notepad. Please copy and paste the last 10-15 lines and post them here. I just want to see the files detected.

thanks

system · 2008-01-04T14:06:07.000Z

There you go…

oldman960 · 2008-01-04T14:19:12.000Z

It looks like the avast detections where before you ran combofix the last time. Combofix removed those files.

I’d like you to do this cleanup list, the go to the link below and do an online scan. You will have to pause the avast standard shield during the scan Right click the “a” icon select pause, then stabdard shield. Remember to resume it after the scan. You can do the firewall after the scan.

Please post the results in your next reply.

http://www.eset.com/onlinescan/

1.Click start button, click run, copy and paste the line below into the box, click ok

combofix /u

2.Please download the OTMoveIt by OldTimer.
[*] Save it to your desktop.
[*] Please double-click OTMoveIt2.exe to run it.

Then click the Clean Up button. You may get prompted by your firewall that OTMoveIt wants to contact the internet - allow this. A cleanup.txt will be downloaded, a message dialog will ask you if you want to proceed with the cleanup process, click Yes. This will delete all the tools you have downloaded plus itself.

3.Create a new restore point

You must be logged on to an administrator account
Go to Start - All Programs - Accessories - System Tools - System Restore.
Click Create a restore point, and then click Next.
In the text box labeled Restore Point Description, type a name for this restore point , click create

Remove old restore points

4.Disk Cleanup

Go to Start - All Programs - Accessories - system tools. Launch the Disk Cleanup tool and let it run. When it finishes a box with tabs will appear, select the more options tab. On this tab you will find a section for System Restore. If you press the Clean Up button for that section, Windows will delete all restore points except for the most recent one.

5.Download and run this clean up utility. You can use it regularly. When it’s first run, it is in demo mode to show you what it will remove. Review it and then rerun in real mode. It is configurable.

CleanUp

It looks like you are using windows firewall. It doesn’t provide outbound protection. A third party firewall will.

A discussion on free firewalls can be found here.

http://forum.avast.com/index.php?topic=30808.0

system · 2008-01-04T14:45:19.000Z

Gonna have to do that at home tonight - I’m doing this at work for a friend and the PC is not connected to the net to do online scans so there will be a couple of days delay before I get to it - the wife has too much decorating for me at home to spend sat at the PC!!!

system · 2008-01-04T21:40:03.000Z

ESET scan attached as a jpeg as I do not know how to output a report file. Thanks.

system · 2008-01-04T22:03:32.000Z

Oldman,

I have run all the clean up instructions. One thing - I installed Cleanup 4.5 but could not find the tab to delete restore points. I have also installed Superantispyware so hopefully I should be ok now. Thanks for your help.

Phil B

system · 2008-01-04T22:59:57.000Z

Hello Oldman!

I need your help in removing this Shit virus. it seems i am not the only person hit by this stubborn shit.

I have followed some of the procedures you suggested to the other people hit by same shit.

I run combo fix which generated the following log…

Please advise me what next,…
ComboFix 08-01-04.1 - Fayaz Malik 2008-01-04 22:15:39.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.420 [GMT 0:00]
Running from: C:\Documents and Settings\Fayaz Malik\Local Settings\Temporary Internet Files\Content.IE5\N87U69IG\ComboFix[1].exe

Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\All Users\Application Data.\salesmonitor
C:\Documents and Settings\All Users\Application Data\WinAntiVirus Pro 2007
C:\Documents and Settings\All Users\Application Data\WinAntiVirus Pro 2007\Data\Abbr
C:\Documents and Settings\All Users\Application Data\WinAntiVirus Pro 2007\Data\ActivationCode
C:\Documents and Settings\All Users\Application Data\WinAntiVirus Pro 2007\Data\ProductCode
C:\Documents and Settings\Family and Friends\Application Data\WinAntiVirus Pro 2007
C:\Documents and Settings\Family and Friends\Application Data\WinAntiVirus Pro 2007\avtasks.dat
C:\Documents and Settings\Family and Friends\Application Data\WinAntiVirus Pro 2007\history.db
C:\Documents and Settings\Family and Friends\Application Data\WinAntiVirus Pro 2007\Logs\update.log
C:\Documents and Settings\Family and Friends\Application Data\WinAntiVirus Pro 2007\Logs\wa7Support.log
C:\Documents and Settings\Family and Friends\Application Data\WinAntiVirus Pro 2007\Logs\winav.log
C:\Documents and Settings\Family and Friends\Application Data\WinAntiVirus Pro 2007\PGE.dat
C:\Documents and Settings\Family and Friends\err.log
C:\Documents and Settings\Family and Friends\ResErrors.log
C:\Documents and Settings\Fayaz Malik\Application Data\hidires
C:\Documents and Settings\Fayaz Malik\err.log
C:\Documents and Settings\Fayaz Malik\ResErrors.log
C:\Documents and Settings\Guest\Application Data\WinAntiVirus Pro 2007
C:\Documents and Settings\Guest\Application Data\WinAntiVirus Pro 2007\avtasks.dat
C:\Documents and Settings\Guest\Application Data\WinAntiVirus Pro 2007\CookieList.dat
C:\Documents and Settings\Guest\Application Data\WinAntiVirus Pro 2007\history.db
C:\Documents and Settings\Guest\Application Data\WinAntiVirus Pro 2007\Logs\update.log
C:\Documents and Settings\Guest\Application Data\WinAntiVirus Pro 2007\Logs\wa7Support.log
C:\Documents and Settings\Guest\Application Data\WinAntiVirus Pro 2007\Logs\winav.log
C:\Documents and Settings\Guest\Application Data\WinAntiVirus Pro 2007\PGE.dat
C:\Documents and Settings\Guest\err.log
C:\Documents and Settings\Guest\ResErrors.log
C:\Program Files\Common Files\drivecleaner free
C:\Program Files\outlook
C:\UWA7P
C:\WINDOWS\system32[u]0[/u]_exception.nls
C:\WINDOWS\system32\cnbjmo.dll
C:\WINDOWS\system32\drivers\qwkckmxa.dat
C:\WINDOWS\system32\drivers\runtime2.sys
C:\WINDOWS\system32\nsi62.dll
C:\WINDOWS\system32\stera.log

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.
-------\LEGACY_FOPN
-------\LEGACY_NJOOOFLZ
-------\LEGACY_RUNTIME
-------\LEGACY_RUNTIME2
-------\m_hook
-------\njoooflz
-------\runtime

((((((((((((((((((((((((( Files Created from 2007-12-04 to 2008-01-04 )))))))))))))))))))))))))))))))
.

2008-01-04 22:14 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\NirCmd.exe
2007-12-30 22:56 . 2007-12-30 22:56 d-------- C:\Documents and Settings\Guest\Application Data\Yahoo!
2007-12-04 01:48 . 2007-12-22 03:12 77,353 --a------ C:\WINDOWS\system32\adssite_sidebar_uninstall.exe

system · 2008-01-04T23:01:03.000Z

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-04 13:41 --------- d-----w C:\Documents and Settings\Fayaz Malik\Application Data\Jasc Software Inc
2008-01-01 17:48 --------- d-----w C:\Documents and Settings\Fayaz Malik\Application Data\Skype
2007-12-09 15:19 --------- d-----w C:\Documents and Settings\All Users\Application Data\Yahoo! Companion
2007-12-09 15:17 --------- d—a-w C:\Documents and Settings\Fayaz Malik\Application Data\yahoo!
2007-12-04 20:40 --------- d-----w C:\Documents and Settings\Fayaz Malik\Application Data\DataLayer
2007-12-04 14:56 93,264 ----a-w C:\WINDOWS\system32\drivers\aswmon.sys
2007-12-04 14:55 94,544 ----a-w C:\WINDOWS\system32\drivers\aswmon2.sys
2007-12-04 14:53 23,152 ----a-w C:\WINDOWS\system32\drivers\aswRdr.sys
2007-12-04 14:51 42,912 ----a-w C:\WINDOWS\system32\drivers\aswTdi.sys
2007-12-04 14:49 26,624 ----a-w C:\WINDOWS\system32\drivers\aavmker4.sys
2007-12-03 01:48 --------- d-----w C:\Program Files\Windows Live Toolbar
2007-11-22 20:44 --------- d-----w C:\Documents and Settings\All Users\Application Data\BOC425
2007-11-21 22:36 --------- d-----w C:\Program Files\eMule
2007-11-21 21:42 --------- d-----w C:\Program Files\Dcads Games Collection
2007-11-21 21:09 --------- d-----w C:\Program Files\BearShare Applications
2007-11-21 21:06 --------- d-----w C:\Program Files\LimeWire
2007-11-17 14:10 --------- d-----w C:\Program Files\Picasa2
2007-11-13 10:25 20,480 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys
2007-11-10 17:56 --------- d-----w C:\Program Files\SecondLife
2007-11-10 14:20 --------- d-----w C:\Documents and Settings\Fayaz Malik\Application Data\SecondLife
2007-11-10 11:41 --------- d-----w C:\Program Files\PC Registry Cleaner
2007-11-09 23:14 --------- d-----w C:\Documents and Settings\Fayaz Malik\Application Data\Nokia Multimedia Player
2007-11-06 22:12 --------- d-----w C:\Program Files\Comodo
2007-11-05 08:47 --------- d-----w C:\Documents and Settings\Fayaz Malik\Application Data\Comodo
2007-11-05 08:47 --------- d-----w C:\Documents and Settings\All Users\Application Data\Comodo
2007-11-04 18:07 --------- d-----w C:\Program Files\McAfee.com
2007-11-04 18:05 --------- d-----w C:\Documents and Settings\All Users\Application Data\McAfee
2007-11-04 18:03 --------- d-----w C:\Documents and Settings\All Users\Application Data\SiteAdvisor
2007-11-04 16:13 --------- d-----w C:\Program Files\Alwil Software
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
Note empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE~\Browser Helper Objects{1648E328-3E5A-4EA5-A9C6-E5F09EE272DA}]
2007-12-03 17:12 282624 --a------ C:\WINDOWS\system32\adssite_sidebar.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
“msnmsgr”=“C:\Program Files\MSN Messenger\msnmsgr.exe” [2007-01-19 11:54 5674352]
“Yahoo! Pager”=“C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.exe” [2007-08-30 16:43 4670704]
“swg”=“C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe” [2007-04-02 12:04 68856]
“MSMSGS”=“C:\Program Files\Messenger\msmsgs.exe” [2004-10-13 16:24 1694208]
“ctfmon.exe”=“C:\WINDOWS\system32\ctfmon.exe” [2004-08-04 05:00 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
“MSConfig”=“C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe” [2005-09-27 00:34 169984]
“avast!”=“C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe” [2007-12-04 13:00 79224]
“ATIPTA”=“C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe” [2005-08-05 21:05 344064]
“ISUSScheduler”=“C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe” [2005-06-10 10:44 81920]
“ISUSPM Startup”=“C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe” [2005-06-10 10:44 249856]
“IntelWireless”=“C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe” [2004-10-30 14:59 385024]
“QuickTime Task”=“C:\Program Files\QuickTime\qttask.exe” [2007-01-20 17:32 282624]
“TkBellExe”=“C:\Program Files\Common Files\Real\Update_OB\realsched.exe” [2006-12-25 01:37 185896]

[HKEY_USERS.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
“CTFMON.EXE”=“C:\WINDOWS\system32\CTFMON.EXE” [2004-08-04 05:00 15360]
“Nokia.PCSync”=“C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe” [2007-06-19 09:17 1241088]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
“DisableRegistryTools”= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\IntelWireless]
C:\Program Files\Intel\Wireless\Bin\LgNotify.dll 2004-09-07 16:08 110592 C:\Program Files\Intel\Wireless\Bin\LgNotify.dll

SafeBoot registry key needs repairs. This machine cannot enter Safe Mode.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\File system]
@=“Driver Group”

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vgasave.sys]
@=“Driver”

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal{4D36E967-E325-11CE-BFC1-08002BE10318}]
@=“DiskDrive”

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal{4D36E96A-E325-11CE-BFC1-08002BE10318}]
@=“Hdc”

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal{4D36E96B-E325-11CE-BFC1-08002BE10318}]
@=“Keyboard”

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal{4D36E96F-E325-11CE-BFC1-08002BE10318}]
@=“Mouse”

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal{4D36E97D-E325-11CE-BFC1-08002BE10318}]
@=“System”

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal{71A27CDD-812A-11D0-BEC7-08002BE2092F}]
@=“Volume”

system · 2008-01-04T23:01:38.000Z

HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Fayaz Malik^Start Menu^Programs^Startup^Zapu Acceleration Engine.lnk]
path=C:\Documents and Settings\Fayaz Malik\Start Menu\Programs\Startup\Zapu Acceleration Engine.lnk
backup=C:\WINDOWS\pss\Zapu Acceleration Engine.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Fayaz Malik^Start Menu^Programs^Startup^Zapu.lnk]
path=C:\Documents and Settings\Fayaz Malik\Start Menu\Programs\Startup\Zapu.lnk
backup=C:\WINDOWS\pss\Zapu.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Activate Scanner]
C:\PROGRA~1\QUICKH~1\ACTIVATE.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Photo Downloader]
2005-06-06 22:46 57344 --a------ C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2007-10-10 19:51 39792 --a------ C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Apoint]
2004-09-13 16:33 155648 --a------ C:\Program Files\Apoint\Apoint.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BOC-425]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\COMODO Firewall Pro]
C:\Program Files\Comodo\Firewall\CPF.exe /background

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
2004-08-04 05:00 15360 --a------ C:\WINDOWS\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DataLayer]
2007-05-04 07:17 863744 --a------ C:\PROGRA~1\COMMON~1\PCSuite\DATALA~1\DATALA~1.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Dell QuickSet]
2005-09-01 17:24 684032 --a------ C:\Program Files\Dell\QuickSet\quickset.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Disk Monitor]
C:\Documents and Settings\Fayaz Malik\Disk_Monitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\dla]
2004-12-06 01:05 127035 --a------ C:\WINDOWS\system32\dla\tfswctrl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\dlccmon.exe]
2005-07-22 07:03 425984 --a------ C:\Program Files\Dell Photo AIO Printer 924\dlccmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DMXLauncher]
2005-01-27 01:02 86016 --a------ C:\Program Files\Dell\Media Experience\DMXLauncher.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DVDLauncher]
2005-02-23 16:19 53248 --------- C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Email Protection]
C:\PROGRA~1\QUICKH~1\EmlProxy.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Globe7]
C:\Program Files\Globe7\Globe7.exe /hide

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Desktop Search]
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe /startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\hid_start]
C:\WINDOWS\System32\Rundll32.exe C:\WINDOWS\system32\gzmrotate.dll DllVerify

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Load]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Messenger]
C:\PROGRA~1\QUICKH~1\SCANMSG.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MskAgentexe]
C:\Program Files\McAfee\MSK\MskAgent.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
C:\Program Files\Messenger\msmsgs.exe /background

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
C:\Program Files\MSN Messenger\msnmsgr.exe /background

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OASClnt]
C:\Program Files\McAfee.com\VSO\oasclnt.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\On-Line Protection]
C:\PROGRA~1\QUICKH~1\CATEYE.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\outlook]
C:\Program Files\outlook\outlook.exe /auto

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCSuiteTrayApplication]
C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Picasa Media Detector]
2007-10-23 21:18 443968 --a------ C:\Program Files\Picasa2\PicasaMediaDetector.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PronunciationPatterns]
2007-04-02 12:04 68856 --a------ C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
C:\Program Files\QuickTime\qttask.exe -atboottime

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Run]

oldman960 · 2008-01-05T02:29:24.000Z

Hi pbunn

The esset log should be located at C:\Program Files\EsetOnlineScanner\log.txt

The clean up for the restore points that I was refering to is in windows, not the cleanup program I had you download.

Click start button, All Programs - Accessories - system tools. Launch the Disk Cleanup tool and let it run. When it finishes a box with tabs will appear, select the more options tab. On this tab you will find a section for System Restore. If you press the Clean Up button for that section, Windows will delete all restore points except for the most recent one.

Remember, if you installed the free version of SAS, it will be on demand only. Which means you will have to run scans manually and regularly. The same for AVG, though there may be a trial period with on access, then they will revert to on demand.

I have looked throgh your logs for mlvtgmlv.sys, it is nowhere to be seen. The 2nd eset detection is a folder I missed, we’ll remove that now.

I’m very curious as to where the mlvtgmlv.sys came from and if another will appear. I’d like you to run combofix again, this time before you run it rename it to pbunnfix.exe

Download ComboFix from Here or Here to your Desktop.

Don’t run it yet, we’ll run it with this script.

Open a new Notepad session (Do not use a Word Processor or WordPad). Click “Format” and be certain that Word Wrap is not enabled.

Copy and paste all the text in the quote box below into Notepad.

Click File, Save as…, and set the location to your Desktop, and enter (including quotation marks) as the filename: “CFscript.txt” . Using your mouse left button, drag the new file CFscript.txt and drop it on the ComboFix.exe icon as shown at the bottom of this post.

This will start ComboFix .Close all browser/windows first. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply together with a new HJT log.

Folder:: C:\Program Files\SystemErrorFixer C:\Documents and Settings\Dave Witcher\Application Data\systemerrorfixer C:\Program Files\Common Files\SystemErrorFixer C:\Program Files\SystemErrorFixer

Click here to download HJTsetup.exe

oldman960 · 2008-01-05T05:43:39.000Z

@faymak

I started a new thread for you in the virus and worms forum, it’s called “faymak’s BHO thread” you can reach it here

http://forum.avast.com/index.php?topic=32435.0

system · 2008-01-05T08:37:53.000Z

Oldman,

Eset scanner log attached - I’m doing the other stuff now…

version=4

OnlineScanner.ocx=1.0.0.56

OnlineScannerDLLA.dll=1, 0, 0, 51

OnlineScannerDLLW.dll=1, 0, 0, 51

OnlineScannerUninstaller.exe=1, 0, 0, 49

vers_standard_module=2766 (20080104)

vers_arch_module=1.060 (20071228)

vers_adv_heur_module=1.064 (20070717)

EOSSerial=7a4e967b0264f745ace04ae72880f9ab

end=finished

remove_checked=true

unwanted_checked=false

utc_time=2008-01-04 09:31:07

local_time=2008-01-04 09:31:07 (+0000, GMT Standard Time)

country=“United Kingdom”

osver=5.1.2600 NT Service Pack 2

scanned=153144

found=3

scan_time=1347

C:\Documents and Settings\Dave Witcher\My Documents\Data Backup\APEC Ltd\Collins&Aikman\Programs\Ford\CD3XX\IB2 sanity check C&A updates 200106.xls probably unknown MACRO virus (cleaned) 00000000000000000000000000000000
C:\Program Files\Common Files\SystemErrorFixer\strpmon.exe probably a variant of Win32/Genetik trojan (unable to clean - deleted) 00000000000000000000000000000000
C:\WINDOWS\system32\drivers\mlvtgmlv.sys probably a variant of Win32/Rootkit.Agent.NDA trojan (unable to clean - deleted) 00000000000000000000000000000000

system · 2008-01-05T08:50:45.000Z

OLdman,

Combofix and HJT logs attached.

Phil B

oldman960 · 2008-01-05T09:13:43.000Z

These folders seem to be all over. Last one.

Seeing how I’m going to get you to download OTMOVEIT anyway, we’ll use it.

Please download the OTMoveIt http://download.bleepingcomputer.com/oldtimer/OTMoveIt.exe by OldTimer.
Save it to your desktop.
Please double-click OTMoveIt.exe to run it.
Copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy):

C:\Documents and Settings\All Users\Application Data\systemerrorfixer

Return to OTMoveIt, right click on the “Paste List of Files/Folders to be moved” window and choose Paste.
Click the red Moveit! button.
Copy everything on the Results window to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it on your next reply with a new Hijack log.
Close OTMoveIt

Just tell me if the folder was successfully removed.

If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes.

This looks good. I don’t see where, or what could have created that file.

Any more avast detections?

Announcements