Infected by virus

vanijayram · March 16, 2012

Hi,

My system is affected by virus. I have followed the preliminary steps . Here are my logs:

.

DDS (Ver_2011-08-26.01) - NTFSx86

Internet Explorer: 8.0.6001.18702

Run by Vidhya at 13:03:58 on 2012-03-16

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3062.1809 [GMT -4:00]

.

AV: Symantec Endpoint Protection *Enabled/Updated* {FB06448E-52B8-493A-90F3-E43226D3305C}

FW: AVG Firewall *Disabled*

.

============== Running Processes ===============

.

C:\WINDOWS\system32\svchost -k DcomLaunch

C:\WINDOWS\system32\svchost -k rpcss

C:\WINDOWS\System32\svchost.exe -k netsvcs

C:\Program Files\Symantec\Symantec Endpoint Protection\Smc.exe

C:\WINDOWS\system32\svchost.exe -k NetworkService

C:\WINDOWS\System32\svchost.exe -k eapsvcs

C:\WINDOWS\system32\svchost.exe -k LocalService

C:\WINDOWS\System32\svchost.exe -k dot3svc

C:\WINDOWS\Explorer.EXE

C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\system32\svchost.exe -k LocalService

C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

C:\Program Files\IBM\SQLLIB\bin\db2dasrrm.exe

C:\Program Files\IBM\SQLLIB\BIN\db2mgmtsvc.exe

C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE

C:\Program Files\Java\jre6\bin\jqs.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe

C:\WINDOWS\system32\DRIVERS\o2flash.exe

C:\PROGRA~1\PHAROS~1\Core\CTskMstr.exe

C:\WINDOWS\system32\svchost.exe -k imgsvc

C:\Program Files\Symantec\Symantec Endpoint Protection\Rtvscan.exe

C:\PROGRA~1\IBM\SQLLIB\bin\db2syscs.exe

C:\Program Files\IBM\SQLLIB\BIN\db2rcmd.exe

C:\Program Files\IBM\SQLLIB\BIN\db2fmp.exe

C:\WINDOWS\System32\alg.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe

C:\Documents and Settings\All Users\Application Data\eYryLom6muHhor.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe

C:\Program Files\Symantec\Symantec Endpoint Protection\SmcGui.exe

C:\WINDOWS\system32\taskmgr.exe

C:\WINDOWS\system32\wbem\wmiprvse.exe

.

============== Pseudo HJT Report ===============

.

uStart Page = hxxp://google.com/

uSearch Page = hxxp://www.google.com

uSearch Bar = hxxp://www.google.com/ie

uDefault_Search_URL = hxxp://www.google.com/ie

uSearchAssistant = hxxp://www.google.com/ie

uSearchURL,(Default) = hxxp://www.google.com/search?q=%s

uURLSearchHooks: H - No File

mURLSearchHooks: H - No File

BHO: SnagIt Toolbar Loader: {00c6482d-c502-44c8-8409-fce54ad9c208} - c:\program files\techsmith\snagit 10\SnagitBHO.dll

BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File

BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll

BHO: Canon Easy-WebPrint EX BHO: {3785d0ad-bfff-47f6-bf5b-a587c162fed9} - c:\program files\canon\easy-webprint ex\ewpexbho.dll

BHO: Somoto Toolbar: {652853ad-5592-4231-88c6-706613a52e61} - c:\program files\somototoolbar\vmntemplateX.dll

BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:\progra~1\micros~2\office14\GROOVEEX.DLL

BHO: SSVHelper Class: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre6\bin\ssv.dll

BHO: AVG Security Toolbar: {95b7759c-8c7f-4bf1-b163-73684a933233} - c:\program files\avg secure search\9.0.0.18\AVG Secure Search_toolbar.dll

BHO: Office Document Cache Handler: {b4f3a835-0e21-4959-ba22-42b3008e02ff} - c:\progra~1\micros~2\office14\URLREDIR.DLL

BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll

BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

TB: Somoto Toolbar: {652853ad-5592-4231-88c6-706613a52e61} - c:\program files\somototoolbar\vmntemplateX.dll

TB: Snagit: {8ff5e183-abde-46eb-b09e-d2aab95cabe3} - c:\program files\techsmith\snagit 10\SnagitIEAddin.dll

TB: Canon Easy-WebPrint EX: {759d9886-0c6f-4498-bab6-4a5f47c6c72f} - c:\program files\canon\easy-webprint ex\ewpexhlp.dll

TB: AVG Security Toolbar: {95b7759c-8c7f-4bf1-b163-73684a933233} - c:\program files\avg secure search\9.0.0.18\AVG Secure Search_toolbar.dll

TB: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File

TB: {D4027C7F-154A-4066-A1AD-4243D8127440} - No File

TB: {8FF5E180-ABDE-46EB-B09E-D2AAB95CABE3} - No File

{e7df6bff-55a5-4eb7-a673-4ed3e9456d39}

EB: Canon Easy-WebPrint EX: {21347690-ec41-4f9a-8887-1f4aee672439} - c:\program files\canon\easy-webprint ex\ewpexhlp.dll

uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe

uRun: [OfficeSyncProcess] "c:\program files\microsoft office\office14\MSOSYNC.EXE"

uRun: [Akamai NetSession Interface] "c:\documents and settings\vidhya\local settings\application data\akamai\netsession_win.exe"

uRun: [itibiti.exe] c:\program files\itibiti soft phone\Itibiti.exe

uRun: [ApacheTomcatMonitor7.0_Tomcat7] "c:\program files\apache software foundation\tomcat 7.0\bin\Tomcat7w.exe" //MS//Tomcat7

mRun: [sunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"

mRun: [RTHDCPL] RTHDCPL.EXE

mRun: [Alcmtr] ALCMTR.EXE

mRun: [OEM13Mon.exe] c:\windows\OEM13Mon.exe

mRun: [igfxTray] c:\windows\system32\igfxtray.exe

mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe

mRun: [MFARestart] "c:\documents and settings\all users\application data\mfadata\pack\avgrunasx.exe" /usereg

mRun: [APSDaemon] "c:\program files\common files\apple\apple application support\APSDaemon.exe"

mRun: [iJNetworkScanUtility] c:\program files\canon\canon ij network scan utility\CNMNSUT.exe

mRun: [vProt] "c:\program files\avg secure search\vprot.exe"

mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime

mRun: [Persistence] c:\windows\system32\igfxpers.exe

mRun: [ccApp] "c:\program files\common files\symantec shared\ccApp.exe"

mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"

mRun: [CanonMyPrinter] c:\program files\canon\myprinter\BJMyPrt.exe /logon

mRun: [CanonSolutionMenuEx] c:\program files\canon\solution menu ex\CNSEMAIN.EXE /logon

mRun: [broadcom Wireless Manager UI] c:\windows\system32\WLTRAY.exe

mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"

mRun: [DB2COPY1 - db2systray.exe DB2] c:\progra~1\ibm\sqllib\bin\db2systray.exe DB2

mRun: [HWllHxOwIMY.exe] c:\documents and settings\all users\application data\HWllHxOwIMY.exe

mRun: [Malwarebytes' Anti-Malware] "c:\program files\malwarebytes' anti-malware\mbamgui.exe" /starttray

mRunOnce: [AvgUninstallURL] cmd.exe /c start http://www.avg.com/ww.special-uninstallation-feedback-appf?lic="&"inst=NzctNzAyMjA0Mjc5LVZJUCsxLUZMMTArMS1ERFQrMzM4OTYtVFVHKzMtREQxMEYrMS1TVDEwRkFQUCsxLUYxME0xMkFUKzEtRjEwTTEyQSsxLUYxME0xMkFCKzEtVTEwKzEtRjEwTTEyQVRCKzEtRlVJKzItRjEwVEIrMi1TVDEwVEJGKzE"&"prod=0"&"ver=10.0.1416

mRunOnce: [Malwarebytes Anti-Malware] c:\program files\malwarebytes' anti-malware\mbamgui.exe /install /silent

mRunOnce: [innoSetupRegFile.0000000001] "c:\windows\is-HNUHG.exe" /REG /REGSVRMODE

StartupFolder: c:\docume~1\vidhya\startm~1\programs\startup\onenot~1.lnk - c:\program files\microsoft office\office14\ONENOTEM.EXE

IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200

IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office14\EXCEL.EXE/3000

IE: Google Sidewiki... - c:\program files\google\google toolbar\component\GoogleToolbarDynamic_mui_en_D183CA64F05FDD98.dll/cmsidewiki.html

IE: Se&nd to OneNote - c:\progra~1\micros~2\office14\ONBttnIE.dll/105

IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe

IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe

IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0016-0000-0000-ABCDEFFEDCBC} - c:\program files\java\jre6\bin\jp2iexp.dll

IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\program files\microsoft office\office14\ONBttnIE.dll

IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - c:\program files\microsoft office\office14\ONBttnIELinkedNotes.dll

DPF: {31435657-9980-0010-8000-00AA00389B71} - hxxp://download.microsoft.com/download/e/2/f/e2fcec4b-6c8b-48b7-adab-ab9c403a978f/wvc1dmo.cab

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab

DPF: {983A9C21-8207-4B58-BBB8-0EBC3D7C5505} - hxxps://usnjym03.tcs.com/dwa8W.cab

DPF: {C1F8FC10-E5DB-4112-9DBF-6C3FF728D4E3} - hxxp://support.dell.com/systemprofiler/DellSystemLite.CAB

DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab

DPF: {CF84DAC5-A4F5-419E-A0BA-C01FFD71112F} - hxxp://content.systemrequirementslab.com.s3.amazonaws.com/global/bin/srldetect_intel_4.5.3.0.cab

DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

TCP: DhcpNameServer = 172.20.24.1

TCP: Interfaces\{3278EBCC-BD6A-4644-8F5F-D055857AADAB} : DhcpNameServer = 172.20.24.1

Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - c:\program files\common files\microsoft shared\office14\MSOXMLMF.DLL

Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - c:\program files\common files\avg secure search\viprotocolinstaller\9.0.1\ViProtocol.dll

Notify: igfxcui - igfxdev.dll

SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\progra~1\micros~2\office14\GROOVEEX.DLL

.

================= FIREFOX ===================

.

FF - ProfilePath - c:\documents and settings\vidhya\application data\mozilla\firefox\profiles\2k5zys0a.default\

FF - prefs.js: browser.search.selectedEngine - Blekko

FF - prefs.js: browser.startup.homepage - hxxp://blekko.com?source=c3348dd4&tbp=homepage&toolbarid=blekkotb&u=20120311587E4F7486570026FA31FD98

FF - prefs.js: keyword.URL - hxxp://www.bing.com/search?pc=Z133&form=ZGAADF&install_date=20110908&q=

FF - prefs.js: network.proxy.type - 4

FF - plugin: c:\progra~1\micros~2\office14\NPAUTHZ.DLL

FF - plugin: c:\progra~1\micros~2\office14\NPSPWRAP.DLL

FF - plugin: c:\program files\adobe\reader 10.0\reader\air\nppdf32.dll

FF - plugin: c:\program files\canon\easy-photoprint ex\NPEZFFPI.DLL

FF - plugin: c:\program files\google\picasa3\npPicasa3.dll

FF - plugin: c:\program files\google\update\1.3.21.99\npGoogleUpdate3.dll

FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll

FF - plugin: c:\program files\microsoft silverlight\4.1.10111.0\npctrlui.dll

FF - plugin: c:\windows\system32\tvuax\npTVUAx.dll

.

---- FIREFOX POLICIES ----

FF - user.js: yahoo.ytff.general.dontshowhpoffer - true

============= SERVICES / DRIVERS ===============

.

R2 ccEvtMgr;Symantec Event Manager;c:\program files\common files\symantec shared\ccSvcHst.exe [2011-1-3 108392]

R2 ccSetMgr;Symantec Settings Manager;c:\program files\common files\symantec shared\ccSvcHst.exe [2011-1-3 108392]

R2 DB2MGMTSVC_DB2COPY1;DB2 Management Service (DB2COPY1);c:\program files\ibm\sqllib\bin\db2mgmtsvc.exe [2011-11-22 37736]

R2 DB2REMOTECMD_DB2COPY1;DB2 Remote Command Server (DB2COPY1);c:\program files\ibm\sqllib\bin\db2rcmd.exe [2011-11-22 34664]

R2 MBAMService;MBAMService;c:\program files\malwarebytes' anti-malware\mbamservice.exe [2012-3-16 652360]

R2 Symantec AntiVirus;Symantec Endpoint Protection;c:\program files\symantec\symantec endpoint protection\Rtvscan.exe [2011-1-3 1839776]

R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\common files\symantec shared\eengine\EraserUtilRebootDrv.sys [2012-2-3 106104]

R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2012-3-16 20464]

R3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [2012-3-16 40776]

R3 NAVENG;NAVENG;c:\progra~1\common~1\symant~1\virusd~1\20120315.002\NAVENG.SYS [2012-3-15 86136]

R3 NAVEX15;NAVEX15;c:\progra~1\common~1\symant~1\virusd~1\20120315.002\NAVEX15.SYS [2012-3-15 1576312]

R3 O2MDRDR;O2MDRDR;c:\windows\system32\drivers\o2media.sys [2012-1-21 51288]

R3 O2SDRDR;O2SDRDR;c:\windows\system32\drivers\o2sd.sys [2012-1-21 43608]

R3 OEM13Afx;Provides a software interface to control audio effects of OEM013 camera.;c:\windows\system32\drivers\OEM13Afx.sys [2011-3-26 141376]

R3 OEM13Vfx;Creative Camera OEM013 Video VFX Driver;c:\windows\system32\drivers\OEM13Vfx.sys [2011-3-26 7424]

R3 OEM13Vid;Creative Camera OEM013 Driver;c:\windows\system32\drivers\OEM13Vid.sys [2011-3-26 235200]

S0 cerc6;cerc6; [x]

S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2011-3-28 136176]

S2 vToolbarUpdater;vToolbarUpdater;c:\program files\common files\avg secure search\vtoolbarupdater\9.0.1\toolbarupdater.exe --> c:\program files\common files\avg secure search\vtoolbarupdater\9.0.1\ToolbarUpdater.exe [?]

S3 COH_Mon;COH_Mon;c:\windows\system32\drivers\COH_Mon.sys [2011-1-3 23888]

S3 cpudrv;cpudrv;c:\program files\systemrequirementslab\cpudrv.sys [2011-6-2 11336]

S3 DB2GOVERNOR_DB2COPY1;DB2 Governor (DB2COPY1);c:\program files\ibm\sqllib\bin\db2govds.exe [2011-11-22 23912]

S3 DB2LICD_DB2COPY1;DB2 License Server (DB2COPY1);c:\program files\ibm\sqllib\bin\db2licd.exe [2011-11-22 128360]

S3 gupdatem;Google Update Service (gupdatem);c:\program files\google\update\GoogleUpdate.exe [2011-3-28 136176]

S3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\program files\microsoft office\office14\GROOVE.EXE [2011-6-12 31125880]

S3 osppsvc;Office Software Protection Platform;c:\program files\common files\microsoft shared\officesoftwareprotectionplatform\OSPPSVC.EXE [2010-1-10 4640000]

S3 PbsAuDrv;PolderbitS Audio Driver;c:\windows\system32\drivers\pbsaudrv.sys --> c:\windows\system32\drivers\pbsaudrv.sys [?]

S3 Tomcat7;Apache Tomcat 7;"c:\program files\apache software foundation\tomcat 7.0\bin\tomcat7.exe" //rs//tomcat7 --> c:\program files\apache software foundation\tomcat 7.0\bin\tomcat7.exe [?]

.

=============== Created Last 30 ================

.

2012-03-16 16:42:37 709968 ----a-w- c:\windows\is-HNUHG.exe

2012-03-16 16:41:09 40776 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2012-03-16 15:29:35 -------- d--h--w- c:\documents and settings\vidhya\application data\Malwarebytes

2012-03-16 15:29:27 -------- d-----w- c:\documents and settings\all users\application data\Malwarebytes

2012-03-16 15:29:26 20464 ----a-w- c:\windows\system32\drivers\mbam.sys

2012-03-16 15:29:26 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2012-03-16 13:44:06 427032 ----a-w- c:\windows\system32\PerfStringBackup.TMP

2012-03-16 05:38:58 -------- d--h--w- c:\documents and settings\vidhya\local settings\application data\blekkotb

2012-03-16 04:27:25 337920 ---ha-w- c:\documents and settings\all users\application data\eYryLom6muHhor.exe

2012-03-16 04:24:56 428544 ---ha-w- c:\documents and settings\all users\application data\HWllHxOwIMY.exe

2012-03-11 18:30:27 -------- d--h--w- c:\program files\Rampant Logic Postscript Viewer

2012-03-09 14:35:51 -------- d--h--w- c:\program files\spring-framework-3.1.1.RELEASE

2012-03-05 16:04:43 -------- d--h--w- c:\documents and settings\vidhya\application data\Evaer

2012-03-05 16:00:58 70656 ---ha-w- c:\windows\system32\yv12vfw.dll

2012-03-05 16:00:58 413760 ---ha-w- c:\windows\system32\MPG4c32.dll

2012-03-05 16:00:58 352256 ---ha-w- c:\windows\system32\lame.ax

2012-03-05 16:00:57 -------- d--h--w- c:\program files\Supertintin for Skype

2012-03-03 17:01:24 -------- d--h--w- c:\program files\apache-log4j-1.2.16

2012-02-28 16:40:01 -------- d--h--w- c:\documents and settings\vidhya\application data\LyX2.0

2012-02-28 16:35:56 -------- d--h--w- c:\program files\LyX20

2012-02-28 16:04:46 -------- d--h--w- c:\documents and settings\vidhya\application data\MiKTeX

2012-02-28 16:04:30 -------- d--h--w- c:\documents and settings\vidhya\local settings\application data\MiKTeX

2012-02-28 16:00:57 -------- d--h--w- c:\documents and settings\vidhya\application data\WinEdt Team

2012-02-23 22:57:45 -------- d--h--w- c:\program files\WinEdt Team

2012-02-23 22:47:35 -------- d--h--w- c:\documents and settings\all users\application data\MiKTeX

2012-02-23 22:45:32 -------- d--h--w- c:\program files\MiKTeX 2.8

2012-02-19 04:21:00 -------- d--h--w- c:\documents and settings\vidhya\application data\GetRightToGo

.

==================== Find3M ====================

.

2012-03-07 01:38:06 60 ---ha-w- c:\windows\wpd99.drv

2012-02-11 14:56:02 414368 ---ha-w- c:\windows\system32\FlashPlayerCPLApp.cpl

2012-02-03 09:22:18 1860096 ---ha-w- c:\windows\system32\win32k.sys

2012-01-23 23:21:37 356352 ---ha-w- c:\windows\system32\AegisI5Installer.exe

2012-01-20 19:40:08 60808 ---ha-w- c:\windows\system32\S32EVNT1.DLL

2012-01-20 19:40:08 125488 ---ha-w- c:\windows\system32\drivers\SYMEVENT.SYS

2012-01-11 19:06:47 3072 ---h--w- c:\windows\system32\iacenc.dll

2012-01-09 16:20:25 139784 ---ha-w- c:\windows\system32\drivers\rdpwd.sys

2012-01-07 14:22:08 460800 ---ha-w- c:\windows\system32\LAVSplitter.ax

2012-01-07 14:22:04 448000 ---ha-w- c:\windows\system32\LAVVideo.ax

2012-01-07 14:22:04 212992 ---ha-w- c:\windows\system32\LAVAudio.ax

2012-01-07 14:22:00 172032 ---ha-w- c:\windows\system32\libbluray.dll

2012-01-07 14:21:50 6366094 ---ha-w- c:\windows\system32\avcodec-lav-53.dll

2012-01-07 14:21:50 354979 ---ha-w- c:\windows\system32\swscale-lav-2.dll

2012-01-07 14:21:50 203306 ---ha-w- c:\windows\system32\avutil-lav-51.dll

2012-01-07 14:21:50 138727 ---ha-w- c:\windows\system32\avfilter-lav-2.dll

2012-01-07 14:21:50 1007151 ---ha-w- c:\windows\system32\avformat-lav-53.dll

2012-01-07 14:20:24 142336 ---ha-w- c:\windows\system32\IntelQuickSyncDecoder.dll

2011-12-19 06:31:00 160256 ---ha-w- c:\windows\system32\xvid.ax

2011-12-17 19:46:36 916992 ---ha-w- c:\windows\system32\wininet.dll

2011-12-17 19:46:36 43520 ---h--w- c:\windows\system32\licmgr10.dll

2011-12-17 19:46:36 1469440 ---h--w- c:\windows\system32\inetcpl.cpl

.

============= FINISH: 13:11:42.12 ===============

I have all my important college work stored in my laptop. I would be very grateful if you could help resolve the issue.

Thanks,

Vani

attach.zip

Maniac · March 16, 2012

Hello Vani! My name is Maniac and I will be glad to help you solve your malware problem.

Please note:

If you are a paying customer, you have the privilege to contact the help desk at support@malwarebytes.org or here (http://helpdesk.malwarebytes.org/home). If you choose this option to get help, please let me know.
I recommend you to keep the instructions I will be giving you so that they are available to you at any time. You can save them in a text file or print them.
Make sure you read all of the instructions and fixes thoroughly before continuing with them.
Follow my instructions strictlya and don’t hesitate to stop and ask me if you have any questions.
Post your log files, don't attach them. Every log file should be copy/pasted in your next reply.

Step 1

Please uninstall the following application: Yontoo Layers Runtime 1.10.01 .

Step 2

Launch Malwarebytes' Anti-Malware
Go to Update tab and select Check for Updates. If an update is found, it will download and install the latest version.
Go to Scanner tab and select Perform Quick Scan, then click Scan.
The scan may take some time to finish,so please be patient.
When the scan is complete, click OK, then Show Results to view the results.
Make sure that everything is checked, and click Remove Selected.
When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Extra Note)
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Copy&Paste the entire report in your next reply.

Extra Note: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer,please do so immediately.

In your next reply, post the following log files:

Malwarebytes' Anti-Malware log
a new fresh DDS log file

vanijayram · March 16, 2012

Hi Maniac,

Thanks a lot for your reply.

I tried the instructions stated above.

I was unable to remove Yantoo Layers Runtime . It reports 'Initailisation Set up error' when I tried to uninstall it. Also, it states it occupies 0 kb in my system.
I ran the malwarebytes after updation. I have copy pasted the logs
malwarebytes log :

Malwarebytes Anti-Malware (Trial) 1.60.1.1000

www.malwarebytes.org

Database version: v2012.01.13.04

Windows XP Service Pack 3 x86 NTFS (Safe Mode/Networking)

Internet Explorer 8.0.6001.18702

Vidhya :: VIDHYA-8F36C4A7 [administrator]

Protection: Disabled

3/16/2012 11:32:30 AM

mbam-log-2012-03-16 (11-32-30).txt

Scan type: Full scan

Scan options disabled: P2P

Objects scanned: 409222

Time elapsed: 1 hour(s), 3 minute(s), 58 second(s)

Memory Processes Detected: 0

(No malicious items detected)

Memory Modules Detected: 0

(No malicious items detected)

Registry Keys Detected: 2

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SETUP.EXE (Trojan.FakeVLC) -> Quarantined and deleted successfully.

HKCR\.fsharproj (Trojan.BHO) -> Quarantined and deleted successfully.

Registry Values Detected: 0

(No malicious items detected)

Registry Data Items Detected: 9

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced|Start_ShowControlPanel (PUM.Hijack.StartMenu) -> Bad: (0) Good: (1) -> Quarantined and repaired successfully.

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced|Start_ShowHelp (PUM.Hijack.StartMenu) -> Bad: (0) Good: (1) -> Quarantined and repaired successfully.

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced|Start_ShowMyComputer (PUM.Hijack.StartMenu) -> Bad: (0) Good: (1) -> Quarantined and repaired successfully.

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced|Start_ShowMyDocs (PUM.Hijack.StartMenu) -> Bad: (0) Good: (1) -> Quarantined and repaired successfully.

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced|Start_ShowRun (PUM.Hijack.StartMenu) -> Bad: (0) Good: (1) -> Quarantined and repaired successfully.

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced|Start_ShowSearch (PUM.Hijack.StartMenu) -> Bad: (0) Good: (1) -> Quarantined and repaired successfully.

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer|NoDesktop (PUM.Hidden.Desktop) -> Bad: (1) Good: (0) -> Quarantined and repaired successfully.

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System|DisableTaskMgr (PUM.Hijack.TaskManager) -> Bad: (1) Good: (0) -> Quarantined and repaired successfully.

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System|DisableTaskMgr (PUM.Hijack.TaskManager) -> Bad: (1) Good: (0) -> Quarantined and repaired successfully.

Folders Detected: 0

(No malicious items detected)

Files Detected: 6

C:\Documents and Settings\Vidhya\Local Settings\Temp\ICReinstall\cnet2_PCI_Install_5719_0331_zip[1].exe (PUP.CNET.Adware.Bundle) -> Quarantined and deleted successfully.

C:\Documents and Settings\Vidhya\Local Settings\Temp\ICReinstall\cnet2_R35845_EXE[1].exe (PUP.CNET.Adware.Bundle) -> Quarantined and deleted successfully.

C:\Documents and Settings\Vidhya\Local Settings\Temp\ICReinstall\cnet2_setup_exe[1].exe (PUP.CNET.Adware.Bundle) -> Quarantined and deleted successfully.

C:\Documents and Settings\Vidhya\Local Settings\Temp\ICReinstall\cnet_PSViewerSetup_exe.exe (PUP.CNET.Adware.Bundle) -> Quarantined and deleted successfully.

C:\Personal\College\FrenzSent\VidSent\toef\setup.exe (Trojan.FakeVLC) -> Quarantined and deleted successfully.

C:\RECYCLER\S-1-5-21-746137067-2147135071-1417001333-1003\Dc798.exe (PUP.CNET.Adware.Bundle) -> Quarantined and deleted successfully.

(end)

DDS Log :

.

DDS (Ver_2011-08-26.01) - NTFSx86

Internet Explorer: 8.0.6001.18702

Run by Vidhya at 18:57:11 on 2012-03-16

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3062.1708 [GMT -4:00]

.

AV: Symantec Endpoint Protection *Enabled/Updated* {FB06448E-52B8-493A-90F3-E43226D3305C}

FW: AVG Firewall *Disabled*

.

============== Running Processes ===============

.

C:\WINDOWS\system32\svchost -k DcomLaunch

C:\WINDOWS\system32\svchost -k rpcss

C:\WINDOWS\System32\svchost.exe -k netsvcs

C:\Program Files\Symantec\Symantec Endpoint Protection\Smc.exe

C:\WINDOWS\system32\svchost.exe -k NetworkService

C:\WINDOWS\System32\svchost.exe -k eapsvcs

C:\WINDOWS\system32\svchost.exe -k LocalService

C:\WINDOWS\System32\svchost.exe -k dot3svc

C:\WINDOWS\Explorer.EXE

C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\RTHDCPL.EXE

C:\WINDOWS\OEM13Mon.exe

C:\WINDOWS\system32\igfxtray.exe

C:\WINDOWS\system32\hkcmd.exe

C:\Program Files\Canon\Canon IJ Network Scan Utility\CNMNSUT.exe

C:\WINDOWS\system32\igfxsrvc.exe

C:\WINDOWS\system32\svchost.exe -k LocalService

C:\WINDOWS\system32\igfxpers.exe

C:\Program Files\Common Files\Symantec Shared\ccApp.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\Program Files\Canon\MyPrinter\BJMyPrt.exe

C:\Program Files\Canon\Solution Menu EX\CNSEMAIN.EXE

C:\WINDOWS\system32\WLTRAY.exe

C:\PROGRA~1\IBM\SQLLIB\BIN\db2systray.exe

C:\Documents and Settings\All Users\Application Data\HWllHxOwIMY.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\IBM\SQLLIB\bin\db2dasrrm.exe

C:\Program Files\Microsoft Office\Office14\MSOSYNC.EXE

C:\Program Files\IBM\SQLLIB\BIN\db2mgmtsvc.exe

C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE

C:\Program Files\Java\jre6\bin\jqs.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe

C:\WINDOWS\system32\DRIVERS\o2flash.exe

C:\PROGRA~1\PHAROS~1\Core\CTskMstr.exe

C:\Documents and Settings\All Users\Application Data\eYryLom6muHhor.exe

C:\WINDOWS\system32\svchost.exe -k imgsvc

C:\Program Files\Symantec\Symantec Endpoint Protection\Rtvscan.exe

C:\PROGRA~1\IBM\SQLLIB\bin\db2syscs.exe

C:\Program Files\IBM\SQLLIB\BIN\db2rcmd.exe

C:\Program Files\Symantec\Symantec Endpoint Protection\SmcGui.exe

C:\Program Files\IBM\SQLLIB\BIN\db2fmp.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\WINDOWS\System32\alg.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe

C:\WINDOWS\system32\NOTEPAD.EXE