Malware taking over

[noideawhatimdoin]

i'm having the exact same issue. i'll try the same fix. let me know if it works for you.

I ran the Combofix and it worked!! No problems. here is the log

ComboFix 09-02-19.01 - Veronica 2009-02-21 12:03:35.1 - NTFSx86

Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1023.627 [GMT -5:00]

Running from: c:documents and settingsVeronicaDesktopComboFix.exe

AV: McAfee VirusScan *On-access scanning disabled* (Updated)

FW: McAfee Personal Firewall *enabled*

* Created a new restore point

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:program filesdateone23.txt

c:program fileswinfin34.txt

c:windowssystem32init32.exe

Infected copy of c:windowssystem32userinit.exe was found and disinfected

Restored copy from - c:windowssystem32dllcacheuserinit.exe

.

((((((((((((((((((((((((( Files Created from 2009-01-21 to 2009-02-21 )))))))))))))))))))))))))))))))

.

2009-02-21 10:47 . 2009-02-21 10:47 <DIR> d-------- c:program filesTrend Micro

2009-02-21 10:32 . 2009-02-21 10:32 <DIR> d-------- c:program filesMalwarebytes' Anti-Malware

2009-02-21 10:32 . 2009-02-21 10:32 <DIR> d-------- c:documents and settingsVeronicaApplication DataMalwarebytes

2009-02-21 10:32 . 2009-02-21 10:32 <DIR> d-------- c:documents and settingsAll UsersApplication DataMalwarebytes

2009-02-21 10:32 . 2009-02-11 10:19 38,496 --a------ c:windowssystem32driversmbamswissarmy.sys

2009-02-21 10:32 . 2009-02-11 10:19 15,504 --a------ c:windowssystem32driversmbam.sys

2009-02-19 23:07 . 2009-02-19 23:17 250 --a------ c:windowsgmer.ini

2009-02-19 22:29 . 2009-02-19 22:29 <DIR> d-------- c:documents and settingsAll UsersApplication DataCitrix

2009-02-19 22:22 . 2009-02-19 22:22 <DIR> d-------- c:documents and settingsVeronicaApplication DataMcAfee

2009-01-24 07:04 . 2009-02-20 10:58 <DIR> d-------- c:windowssystem32configsystemprofileApplication DataSACore

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-02-21 16:02 --------- d-----w c:program filesMcAfee

2009-02-20 04:17 --------- d-----w c:documents and settingsLocalServiceApplication DataSACore

2009-02-20 03:22 --------- d-----w c:documents and settingsAll UsersApplication DataMcAfee

2009-01-12 01:00 --------- d-----w c:documents and settingsVeronicaApplication DataZoomBrowser EX

2009-01-11 22:02 --------- d-----w c:documents and settingsAll UsersApplication DataZoomBrowser

2009-01-09 17:03 79,304 ----a-w c:windowssystem32driversmfeavfk.sys

2009-01-09 17:03 40,552 ----a-w c:windowssystem32driversmfesmfk.sys

2009-01-09 17:03 35,272 ----a-w c:windowssystem32driversmfebopk.sys

2009-01-09 17:03 34,216 ----a-w c:windowssystem32driversmferkdk.sys

2009-01-09 17:03 213,640 ----a-w c:windowssystem32driversmfehidk.sys

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun]

"NvMediaCenter"="c:windowssystem32NVMCTRAY.DLL" [2003-10-06 49152]

"ctfmon.exe"="c:windowssystem32ctfmon.exe" [2004-08-04 15360]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun]

"NvCplDaemon"="c:windowssystem32NvCpl.dll" [2003-10-06 5058560]

"McENUI"="c:progra~1McAfeeMHNMcENUI.exe" [2009-01-09 1176808]

"mcagent_exe"="c:program filesMcAfee.comAgentmcagent.exe" [2009-01-08 645328]

"iTunesHelper"="c:program filesiTunesiTunesHelper.exe" [2005-06-24 278528]

"QuickTime Task"="c:program filesQuickTimeqttask.exe" [2007-11-25 98304]

"Acrobat Assistant 8.0"="c:program filesAdobeAcrobat 8.0AcrobatAcrotray.exe" [2007-05-10 624248]

"nwiz"="nwiz.exe" [2003-10-06 c:windowssystem32nwiz.exe]

"BCMSMMSG"="BCMSMMSG.exe" [2003-08-29 c:windowsBCMSMMSG.exe]

[HKEY_LOCAL_MACHINEsoftwaremicrosoftwindows ntcurrentversiondrivers32]

"aux"= ctwdm32.dll

"VIDC.ACDV"= ACDV.dll

[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionrun-]

"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:program filesCommon FilesNeroLibNMBgMonitor.exe"

[HKEY_LOCAL_MACHINEsoftwaremicrosoftwindowscurrentversionrun-]

"Acrobat Assistant 8.0"="c:program filesAdobeAcrobat 8.0AcrobatAcrotray.exe"

"NeroFilterCheck"=c:program filesCommon FilesNeroLibNeroCheck.exe

"Device Detector"=DevDetect.exe -autorun

"LanguageShortcut"="c:program filesCyberLinkPowerDVDLanguageLanguage.exe"

"NBKeyScan"="c:program filesNeroNero8Nero BackItUpNBKeyScan.exe"

"RemoteControl"="c:program filesCyberLinkPowerDVDPDVDServ.exe"

"McENUI"=c:progra~1McAfeeMHNMcENUI.exe /hide

[HKEY_LOCAL_MACHINEsoftwaremicrosoftsecurity center]

"AntiVirusDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINEsoftwaremicrosoftsecurity centerMonitoringMcAfeeAntiVirus]

"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINEsoftwaremicrosoftsecurity centerMonitoringMcAfeeFirewall]

"DisableMonitoring"=dword:00000001

[HKLM~servicessharedaccessparametersfirewallpolicystandardprofile]

"EnableFirewall"= 0 (0x0)

[HKLM~servicessharedaccessparametersfirewallpolicystandardprofileAuthoriz

edApplicationsList]

"%windir%system32sessmgr.exe"=

"%windir%Network Diagnosticxpnetdiag.exe"=

"c:Program FilesCyberLinkPowerDVDPowerDVD.exe"=

"c:Program FilesiTunesiTunes.exe"=

"c:Program FilesCommon FilesMcAfeeMNAMcNASvc.exe"=

R2 {95808DC4-FA4A-4c74-92FE-5B863F82066B};{95808DC4-FA4A-4c74-92FE-5B863F82066B};c:program filesCyberLinkPowerDVD000.fcl [2006-11-02 15:51:58 13560]

R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:program filesMcAfeeSiteAdvisorMcSACore.exe [2008-09-30 210216]

R2 Prvflder;Prvflder;c:windowssystem32driversprvflder.sys [2006-04-21 70912]

S2 0079511235232232mcinstcleanup;McAfee Application Installer Cleanup (0079511235232232);c:windowsTEMP007951~1.EXE c:progra~1COMMON~1McAfeeINSTAL~1cleanup.ini -cleanup -nolog -service --> c:windowsTEMP007951~1.EXE c:progra~1COMMON~1McAfeeINSTAL~1cleanup.ini -cleanup -nolog -service [?]

--- Other Services/Drivers In Memory ---

*NewlyCreated* - 0079511235232232MCINSTCLEANUP

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionSvchost - NetSvcs

UxTuneUp

[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoint

s2G]

ShellAutoRuncommand - G:LaunchU3.exe -a

[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoint

s2{4fbbced2-6fdc-11dc-8a11-00c0a883c38b}]

ShellAutoRuncommand - G:LaunchU3.exe -a

.

Contents of the 'Scheduled Tasks' folder

2009-02-15 c:windowsTasksMcDefragTask.job

- c:program filesmcafeemqcQcConsol.exe [2009-01-09 10:53]

2009-02-01 c:windowsTasksMcQcTask.job

- c:program filesmcafeemqcQcConsol.exe [2009-01-09 10:53]

.

.

------- Supplementary Scan -------

.

uStart Page = hxxp://www.comcast.net/

uSearchURL,(Default) = hxxp://search.yahoo.com/search?fr=mcafee&p=%s

IE: Append to existing PDF - c:program filesAdobeAcrobat 8.0AcrobatAcroIEFavClient.dll/AcroIEAppend.html

IE: Convert link target to Adobe PDF - c:program filesAdobeAcrobat 8.0AcrobatAcroIEFavClient.dll/AcroIECapture.html

IE: Convert link target to existing PDF - c:program filesAdobeAcrobat 8.0AcrobatAcroIEFavClient.dll/AcroIEAppend.html

IE: Convert selected links to Adobe PDF - c:program filesAdobeAcrobat 8.0AcrobatAcroIEFavClient.dll/AcroIECaptureSelLinks.html

IE: Convert selected links to existing PDF - c:program filesAdobeAcrobat 8.0AcrobatAcroIEFavClient.dll/AcroIEAppendSelLinks.html

IE: Convert selection to Adobe PDF - c:program filesAdobeAcrobat 8.0AcrobatAcroIEFavClient.dll/AcroIECapture.html

IE: Convert selection to existing PDF - c:program filesAdobeAcrobat 8.0AcrobatAcroIEFavClient.dll/AcroIEAppend.html

IE: Convert to Adobe PDF - c:program filesAdobeAcrobat 8.0AcrobatAcroIEFavClient.dll/AcroIECapture.html

IE: Do&wnload by ReGet Deluxe - c:program filesCommon FilesReGet SharedCC_Link.htm

IE: Download A&ll by ReGet Deluxe - c:program filesCommon FilesReGet SharedCC_All.htm

IE: E&xport to Microsoft Excel - c:progra~1MICROS~2OFFICE11EXCEL.EXE/3000

Trusted Zone: comcast.netlogin

Trusted Zone: internet

Trusted Zone: mcafee.com

.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-02-21 12:07:59

Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINESystemControlSet001Services{95808DC4-FA4A-4c74-92FE-5B863F82066B}]

"ImagePath"="??c:program filesCyberLinkPowerDVD000.fcl"

.

------------------------ Other Running Processes ------------------------

.

c:progra~1McAfeeMSCmcmscsvc.exe

c:windowssystem32rundll32.exe

c:program filesCommon FilesMcAfeeMNAMcNASvc.exe

c:progra~1COMMON~1McAfeeMcProxyMcProxy.exe

c:windowssystem32devldr32.exe

c:progra~1McAfeeVIRUSS~1Mcshield.exe

c:program filesMcAfeeMPFMpfSrv.exe

c:program filesMcAfeeMSKmsksrver.exe

c:program filesNeroNero8Nero BackItUpNBService.exe

c:windowssystem32nvsvc32.exe

c:program filesMicrosoft Private Folder 1.0PrfldSvc.exe

c:program filesCyberLinkShared filesRichVideo.exe

c:program filesCanonCALCALMAIN.exe

c:program filesiPodbiniPodService.exe

c:program filesCommon FilesMacrovision SharedFLEXnet PublisherFNPLicensingService.exe

.

**************************************************************************

.

Completion time: 2009-02-21 12:12:01 - machine was rebooted

ComboFix-quarantined-files.txt 2009-02-21 17:11:55

Pre-Run: 26,712,215,552 bytes free

Post-Run: 27,216,478,208 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe

[boot loader]

timeout=2

default=multi(0)disk(0)rdisk(0)partition(1)WINDOWS

[operating systems]

c:cmdconsBOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

multi(0)disk(0)rdisk(0)partition(1)WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

168 --- E O F --- 2009-02-21 15:03:44

[AdvancedSetup]

Update and Scan with Malwarebytes' Anti-Malware

• Start MalwareBytes AntiMalware (Vista users must Right click and choose RunAs Admin)
  
• Please DO NOT run MBAM in Safe Mode unless requested to, you MUST run it in normal Windows mode.
  
  • Update Malwarebytes' Anti-Malware
  • Select the Update tab
    
  • Click Update
    

  [*]When the update is complete, select the Scanner tab

  [*]Select Perform quick scan, then click Scan.

  [*]When the scan is complete, click OK, then Show Results to view the results.

  [*]Be sure that everything is checked, and click Remove Selected.

  [*]When completed, a log will open in Notepad. please copy and paste the log into your next reply

  • If you accidently close it, the log file is saved here and will be named like this:
    
  • C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\mbam-log-date (time).txt
    

Then RESTART the computer

AFTER the reboot run HJT Do a system scan and save a logfile

The post back NEW MBAM and HJT logs in that order please.

[AdvancedSetup]

Due to the lack of feedback this Topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!

The fixes and advice in this thread are for this machine only. Do not apply the instructions from this thread to your own machine. Please start a new thread describing your issue and someone will be along to assist you.