tr.trash/gen Trojan

[monkfish]

Hello. I am new to the forum.

I would greatly appreciate any help in removing the TR.trash/gen trojan from my system, which I think is being generated by Vundo. I have pasted logs from dds.com software and malware bytes scan to help. I have read a thread you had posted in Nov of 2008 when another person seemd to be infected. I could not find the method with which to get rid of this infection. Its seems that the vundo resides in teh system volume and there might be something wrong with system restore as well. I have aslo zipped and uploaded the "attach. txt" dds.com generated.

Any help would be greatly appreciated. Thank you in advance for your attention to this matter. MONKFISH

DDS (Ver_09-02-01.01) - NTFSx86

Run by Alkis at 17:43:41.76 on Fri 03/06/2009

Internet Explorer: 8.0.6001.18372

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1023.146 [GMT -5:00]

AV: Avira AntiVir PersonalEdition *On-access scanning enabled* (Updated)

FW: NVIDIA Firewall *enabled*

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch

svchost.exe

C:\WINDOWS\System32\svchost.exe -k netsvcs

C:\Program Files\Ahead\InCD\InCDsrv.exe

C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\AntiVir PersonalEdition Classic\sched.exe

C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe

C:\WINDOWS\system32\CTsvcCDA.EXE

C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe

C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe

C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe

C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe

C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe

C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\Program Files\Autodesk\VIZ2007\mentalray\satellite\raysat_3dsmax8server.exe

C:\WINDOWS\system32\svchost.exe -k imgsvc

C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe

C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe

C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nTrayFw.exe

C:\WINDOWS\SOUNDMAN.EXE

C:\Program Files\Creative\SBAudigy4\DVDAudio\CTDVDDET.EXE

C:\Program Files\Creative\SBAudigy4\Surround Mixer\CTSysVol.exe

C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe

C:\WINDOWS\CTHELPER.EXE

C:\Program Files\Ahead\InCD\InCD.exe

C:\Program Files\Microsoft Hardware\Keyboard\type32.exe

C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe

C:\Program Files\Logitech\QuickCam\Quickcam.exe

C:\Program Files\ResChanger 2005\ResChanger2005.exe

C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe

C:\Program Files\VisualTaskTips\VisualTaskTips.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Skype\Phone\Skype.exe

C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe

C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE

C:\Program Files\Logitech\SetPoint\SetPoint.exe

C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe

C:\Program Files\Common Files\Logitech\KhalShared\KHALMNPR.EXE

C:\Program Files\Common Files\Logishrd\LQCVFX\COCIManager.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Documents and Settings\Alkis\My Documents\dds.com

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.yahoo.com/

uInternet Connection Wizard,ShellNext = iexplore

BHO: Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\program files\yahoo!\companion\installs\cpn\yt.dll

BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 7.0\activex\AcroIEHelper.dll

BHO: Skype add-on (mastermind): {22bf413b-c6d2-4d91-82a9-a0f997ba588c} - c:\program files\skype\toolbars\internet explorer\SkypeIEPlugin.dll

TB: {0BF43445-2F28-4351-9252-17FE6E806AA0} - No File

TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn\yt.dll

TB: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File

TB: {A057A204-BACC-4D26-9990-79A187E2698E} - No File

uRun: [ResChanger 2005] c:\program files\reschanger 2005\ResChanger2005.exe

uRun: [Creative Detector] c:\program files\creative\mediasource\detector\CTDetect.exe /R

uRun: [VisualTaskTips] c:\program files\visualtasktips\VisualTaskTips.exe

uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe

uRun: [skype] "c:\program files\skype\phone\Skype.exe" /nosplash /minimized

mRun: [nTrayFw] c:\program files\nvidia corporation\networkaccessmanager\bin\nTrayFw.exe

mRun: [soundMan] SOUNDMAN.EXE

mRun: [NVIDIA nTune] "c:\program files\nvidia corporation\ntune\\nTune.exe" clear

mRun: [Launch Ai Booster] "c:\program files\asus\ai booster\OverClk.exe"

mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup

mRun: [nwiz] nwiz.exe /install

mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit

mRun: [CTDVDDET] "c:\program files\creative\sbaudigy4\dvdaudio\CTDVDDET.EXE"

mRun: [CTSysVol] c:\program files\creative\sbaudigy4\surround mixer\CTSysVol.exe /r

mRun: [RCSystem] "c:\program files\creative\shared files\module loader\DLLML.exe" RCSystem * -Startup

mRun: [CTHelper] CTHELPER.EXE

mRun: [updReg] c:\windows\UpdReg.EXE

mRun: [NeroFilterCheck] c:\windows\system32\NeroCheck.exe

mRun: [inCD] c:\program files\ahead\incd\InCD.exe

mRun: [intelliType] "c:\program files\microsoft hardware\keyboard\type32.exe"

mRun: [ink Monitor] c:\program files\epson\ink monitor\InkMonitor.exe

mRun: [avgnt] "c:\program files\antivir personaledition classic\avgnt.exe" /min

mRun: [LogitechQuickCamRibbon] "c:\program files\logitech\quickcam\Quickcam.exe" /hide

mRun: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE

mRun: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE

mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime

StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\adobeg~1.lnk - c:\program files\common files\adobe\calibration\Adobe Gamma Loader.exe

StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\adober~1.lnk - c:\program files\adobe\acrobat 7.0\reader\reader_sl.exe

StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\autoca~1.lnk - c:\program files\common files\autodesk shared\acstart17.exe

StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\epsons~1.lnk - c:\windows\system32\spool\drivers\w32x86\3\E_SRCV02.EXE

StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\logitech desktop messenger.lnk - c:\program files\logitech\desktop messenger\8876480\program\LogitechDesktopMessenger.exe

StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\logitech setpoint.lnk - c:\program files\logitech\setpoint\SetPoint.exe

StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\micros~1.lnk - c:\program files\microsoft office\office10\OSA.EXE

StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\satara~1.lnk - c:\program files\silicon image\3114 sataraid5\sam.jar

IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office10\EXCEL.EXE/3000

IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe

IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {08B0E5C0-4FCB-11CF-AAA5-00401C608501}

IE: {77BF5300-1474-4EC7-9980-D32B190E9B07} - {77BF5300-1474-4EC7-9980-D32B190E9B07} - c:\program files\skype\toolbars\internet explorer\SkypeIEPlugin.dll

LSP: %SYSTEMROOT%\system32\nvappfilter.dll

Trusted Zone: ameritrade.com\wwws

DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} - hxxp://support.dell.com/systemprofiler/SysPro.CAB

DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} - hxxp://a1540.g.akamai.net/7/1540/52/20061205/qtinstall.info.apple.com/qtactivex/qtplugin.cab

DPF: {0742B9EF-8C83-41CA-BFBA-830A59E23533} - hxxps://support.microsoft.com/OAS/ActiveX/MSDcode.cab

DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} - hxxp://www.ipix.com/download/ipixx.cab

DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://download.microsoft.com/download/8/b/d/8bd77752-5704-4d68-a152-f7252adaa4f2/LegitCheckControl.cab

DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} - hxxp://upload.facebook.com/controls/FacebookPhotoUploader.cab

DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab

Handler: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - c:\program files\logitech\desktop messenger\8876480\program\GAPlugProtocol-8876480.dll

Notify: WBSrv - c:\progra~1\stardock\object~1\window~1\wbsrv.dll

AppInit_DLLs: wbsys.dll

SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\alkis\applic~1\mozilla\firefox\profiles\in3s4vaz.default\

FF - component: c:\program files\mozilla firefox\extensions\talkback@mozilla.org\components\qfaservices.dll

============= SERVICES / DRIVERS ===============

R1 avgio;avgio;c:\program files\antivir personaledition classic\avgio.sys [2007-2-20 11840]

R1 NTGDT;NTGDT;c:\windows\system32\drivers\NTGDT.SYS [2008-10-9 18144]

R2 aawservice;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\aawservice.exe [2008-5-12 611664]

R2 AntiVirScheduler;AntiVir PersonalEdition Classic Scheduler;c:\program files\antivir personaledition classic\sched.exe [2007-2-20 68865]

R2 AntiVirService;AntiVir PersonalEdition Classic Guard;c:\program files\antivir personaledition classic\avguard.exe [2007-2-20 151297]

R2 RaySat_3dsmax8Server;RaySat_3dsmax8 Server;c:\program files\autodesk\viz2007\mentalray\satellite\raysat_3dsmax8server.exe [2006-3-24 65536]

R3 avgntflt;avgntflt;c:\program files\antivir personaledition classic\avgntflt.sys [2007-2-20 52032]

=============== Created Last 30 ================

2009-03-05 12:29 <DIR> --d----- c:\docume~1\alkis\applic~1\Malwarebytes

2009-03-05 12:29 15,504 a------- c:\windows\system32\drivers\mbam.sys

2009-03-05 12:29 38,496 a------- c:\windows\system32\drivers\mbamswissarmy.sys

2009-03-05 12:29 <DIR> --d----- c:\program files\Malwarebytes' Anti-Malware

2009-03-05 12:29 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Malwarebytes

2009-03-05 01:21 <DIR> --d--r-- c:\program files\Skype

2009-03-04 23:41 <DIR> --d----- c:\program files\Macromedia

2009-03-04 23:41 <DIR> --d----- c:\program files\common files\Macromedia

2009-03-03 22:44 4,958,588 a------- c:\windows\{00000005-00000000-00000008-00001102-00000008-10211102}.BAK

2009-02-23 21:53 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Avg8

2009-02-23 19:49 10,520 a------- c:\windows\system32\avgrsstx(2).dll

2009-02-23 19:49 <DIR> --d----- c:\windows\system32\drivers\Avg(2)

2009-02-23 19:49 <DIR> --d----- c:\program files\AVG

2009-02-23 17:23 144 a--sh--- c:\windows\system32\1822379296.dat

2009-02-21 12:32 <DIR> --d----- c:\program files\Digital Support

2009-02-17 12:54 <DIR> --d----- c:\program files\MSECache

2009-02-11 12:36 <DIR> --dsh--- c:\documents and settings\alkis\IECompatCache

2009-02-11 12:34 <DIR> --dsh--- c:\documents and settings\alkis\IETldCache

2009-02-11 12:31 <DIR> -cd-h--- c:\windows\ie8

2009-02-11 12:28 79,360 -c------ c:\windows\system32\dllcache\iecompat.dll

2009-02-10 22:45 <DIR> --d----- c:\docume~1\alkis\applic~1\Digital Support

2009-02-10 22:39 <DIR> --d----- c:\docume~1\alkis\applic~1\IObit

==================== Find3M ====================

2009-03-06 11:47 0 a------- c:\windows\system32\drivers\lvuvc.hs

2009-03-06 11:47 0 a------- c:\windows\system32\drivers\logiflt.iad

2009-01-15 02:05 911,872 a------- c:\windows\system32\wininet.dll

2009-01-15 02:05 43,008 a------- c:\windows\system32\licmgr10.dll

2009-01-15 02:04 18,944 a------- c:\windows\system32\corpol.dll

2009-01-15 02:01 34,304 a------- c:\windows\system32\imgutil.dll

2009-01-15 02:00 48,128 a------- c:\windows\system32\mshtmler.dll

2009-01-15 02:00 45,568 a------- c:\windows\system32\mshta.exe

2009-01-15 01:50 156,160 a------- c:\windows\system32\msls31.dll

2008-01-12 22:00 32 a------- c:\docume~1\alluse~1\applic~1\ezsid.dat

2005-07-14 21:36 8 a------- c:\docume~1\alkis\applic~1\usb.dat.bin

2008-09-04 06:33 32,768 a--sh--- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012008090420080905\index.dat

============= FINISH: 17:43:53.09 ===============

Malwarebytes' Anti-Malware 1.34

Database version: 1820

Windows 5.1.2600 Service Pack 3

3/6/2009 12:56:04 PM

mbam-log-2009-03-06 (12-56-04).txt

Scan type: Full Scan (C:\|)

Objects scanned: 186588

Time elapsed: 33 minute(s), 4 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 2

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

C:\System Volume Information\_restore{7E52BD57-90C0-4DDE-82A7-635B412433CD}\RP692\A0302086.exe (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{7E52BD57-90C0-4DDE-82A7-635B412433CD}\RP692\A0302087.exe (Trojan.Vundo) -> Quarantined and deleted successfully.

ddsATTAChtxt.zip

ddsATTAChtxt.zip

[SpySentinel]

Welcome to Malwarebytes'

Please post your log in the Malware Removal - HijackThis Logs Forum so we can help you get cleaned.