Fake "Security Centre" rears its head again

dutchroll · May 23, 2008

UH OH!

IIIIIIIT'S BAAAAAACK!!!!!

I kid you not.......................

From having the pc very much behaving itself over the last couple of days (since deletion of that offending .dll file), and from a couple of hours ago when I left it alone to go outside and do some work around the house, I have just switched it back on and ........lo and behold.......it booted up with the fake "windows security centre" again!!!

The NOD32 antivirus is still working. Everything else is still working. The only new software installed apart from what has been instructed was the very latest version of Flashplayer from the recommended website (that was a day or 2 ago because I needed it). System resources are fine at the moment and it is running things at normal speed.

My web access today has been no different to any other day. Trusted websites (if there is such a thing) I've been using for quite a while now. Nothing unusual has downloaded or happened. In fact, most web access has been on my uninfected laptop and it's still fine.

This is getting very, very weird. It is similar to what happened when I first posted, except that instead of the malware remnants apparently fixing themselves after a couple of weeks, it has managed to repair itself after a couple of days!

There it is, "Windows Security Centre", sitting down in the system tray, laughing its head off at me, sending its "virus activity detected" popups whenever I switch web pages. I'm also back to the popup threats that system will be shutdown while the virus scan is running, etc, etc, etc. I'm not particularly amused. I'm going to go out on a limb here and try a Panda scan again, while the system is still running OK.

AdvancedSetup · May 23, 2008

Well now - isn't that a joy.

Please update MB and do a Quick Scan. Then run the Deckards scan again and post both logs and we'll see what we can find.

You should also install this product to help prevent future infections. SpywareBlaster 4.0 Download

Get all the updates and apply ALL the protection settings.

dutchroll · May 23, 2008

OK I'll install the SpywareBlaster.

An interesting turn of events happened while I was following the above instructions:

1. A Panda scan was running.

2. When I saw your reply, I immediately updated Malwarebytes and ran it, and saved the log. It detected new malware, as you'll see in the log, which required a reboot to fix. I selected not to do the reboot, because I wanted to run the Deckards straight away.

3. While the Deckard's was running, the system went into its uncontrollable "shutdown" mode, as was happening before with this malware and a Panda scan running. This prevented the Deckards from completing.

4. Upon rebooting, the "Windows Security Centre" did not start, presumably because the reboot ran the fix determined by Malwarebytes. So the system seems to be running normally again! (but for how long??)

Here are the Malwarebytes (pre-reboot) and Deckards (post-reboot) logs:

Malwarebytes' Anti-Malware 1.12

Database version: 779

Scan type: Quick Scan

Objects scanned: 42030

Time elapsed: 8 minute(s), 15 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 1

Registry Keys Infected: 1

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 1

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

C:\WINDOWS\system32\xfxwjdol.dll (Trojan.FakeAlert) -> No action taken.

Registry Keys Infected:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\xfxwjdol (Trojan.FakeAlert) -> No action taken.

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

C:\WINDOWS\system32\xfxwjdol.dll (Trojan.FakeAlert) -> No action taken.

Deckard's System Scanner v20071014.68

Run by Mike&Sarah on 2008-05-23 18:21:59

Computer is in Normal Mode.

--------------------------------------------------------------------------------

-- HijackThis (run as Mike&Sarah.exe) ------------------------------------------

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 6:22:11 PM, on 23/05/2008

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16640)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Windows Defender\MsMpEng.exe

C:\WINDOWS\System32\svchost.exe

D:\Lavasoft\Ad-Aware 2007\aawservice.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Samsung\SmarThru\PORTCTRL.EXE

C:\Program Files\Common Files\Real\Update_OB\realsched.exe

C:\WINDOWS\RTHDCPL.EXE

D:\Maxtor\OneTouch\utils\Onetouch.exe

C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe

D:\Microsoft Office\Office12\GrooveMonitor.exe

C:\Program Files\Common Files\Grass Valley\ProCoder 3\Kernel\PNXSERVR.exe

C:\Program Files\Windows Defender\MSASCui.exe

D:\ESET NOD32 Antivirus\egui.exe

C:\Program Files\Common Files\Teleca Shared\CapabilityManager.exe

C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe

D:\ESET NOD32 Antivirus\ekrn.exe

C:\WINDOWS\system32\hasplms.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe

C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe

C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe

C:\Program Files\Common Files\Logishrd\LQCVFX\COCIManager.exe

C:\Documents and Settings\Mike&Sarah\Desktop\dss.exe

C:\WINDOWS\system32\wuauclt.exe

D:\Computer\MIKE&S~1.EXE

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

O2 - BHO: btorbit.com - {000123B4-9B42-4900-B3F7-F4B073EFC214} - C:\Program Files\Orbitdownloader\orbitcth.dll

O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - D:\Microsoft Office\Office12\GrooveShellExtensions.dll

O4 - HKLM\..\Run: [GW Port Controller] C:\Program Files\Samsung\SmarThru\PORTCTRL.EXE

O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot

O4 - HKLM\..\Run: [CTxfiHlp] CTXFIHLP.EXE

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE

O4 - HKLM\..\Run: [skyTel] SkyTel.EXE

O4 - HKLM\..\Run: [MaxtorOneTouch] D:\Maxtor\OneTouch\utils\Onetouch.exe

O4 - HKLM\..\Run: [mxomssmenu] "C:\Program Files\Maxtor\OneTouch Status\maxmenumgr.exe"

O4 - HKLM\..\Run: [sony Ericsson PC Suite] "D:\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions

O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe

O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe"

O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam\Quickcam.exe" /hide

O4 - HKLM\..\Run: [GrooveMonitor] "D:\Microsoft Office\Office12\GrooveMonitor.exe"

O4 - HKLM\..\Run: [NexusServer] "C:\Program Files\Common Files\Grass Valley\ProCoder 3\Kernel\PNXSERVR.exe" -SelfLaunch

O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide

O4 - HKLM\..\Run: [egui] "D:\ESET NOD32 Antivirus\egui.exe" /hide /waitservice

O4 - HKCU\..\Run: [bgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"

O4 - HKCU\..\Run: [skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')

O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - D:\MICROS~1\Office12\ONBttnIE.dll

O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - D:\MICROS~1\Office12\ONBttnIE.dll

O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\PROGRA~1\Skype\Phone\IEPlugin\SKYPEI~1.DLL (file missing)

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\MICROS~1\Office12\REFIEBAR.DLL

O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\WINDOWS\System32\shdocvw.dll

O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\WINDOWS\System32\shdocvw.dll

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/d...can_unicode.cab

O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/activescan/cabs/as2stubie.cab

O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} (OnlineScanner Control) - http://www.eset.eu/buxus/docs/OnlineScanner.cab

O16 - DPF: {5EDB10D9-7E95-4833-A218-62F375DAFCF1} (Aventail Installer ) - https://qvpn.qantas.com.au/postauthI/epi.cab

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/microsoftu...b?1188686252156

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu...b?1188686237640

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/flas...ent/swflash.cab

O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - D:\Microsoft Office\Office12\GrooveSystemServices.dll

O18 - Protocol: hiro - {50BA1131-168F-4C08-A69B-4012273F222E} - C:\Program Files\Hiro-Media\HiroClient\HiroProtocolHandler.dll

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL

O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - D:\Lavasoft\Ad-Aware 2007\aawservice.exe

O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe

O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe

O23 - Service: Automatic LiveUpdate Scheduler - Unknown owner - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe (file missing)

O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe

O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - D:\ESET NOD32 Antivirus\EHttpSrv.exe

O23 - Service: Eset Service (ekrn) - ESET - D:\ESET NOD32 Antivirus\ekrn.exe

O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

O23 - Service: HASP License Manager (hasplms) - Aladdin Knowledge Systems Ltd. - C:\WINDOWS\system32\hasplms.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: LVCOMSer - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe

O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe

O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exe

O23 - Service: MaxBackServiceInt - Unknown owner - D:\Maxtor\Maxtor Backup\MaxBackServiceInt.exe

O23 - Service: NBService - Nero AG - D:\Nero\Nero 7\Nero BackItUp\NBService.exe

O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe

O23 - Service: MaxSyncService (NTService1) - - D:\Maxtor\OneTouch\Utils\SyncServices.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

--

End of file - 9405 bytes

-- Files created between 2008-04-23 and 2008-05-23 -----------------------------

2008-05-23 18:19:31 0 dr-h----- C:\Documents and Settings\Mike&Sarah\Recent

2008-05-17 19:51:53 6528 -r-h----t C:\Documents and Settings\Mike&Sarah\Backup Status

2008-05-17 18:30:46 0 d-------- C:\Documents and Settings\All Users\Application Data\ESET

2008-05-17 17:31:11 0 dr------- C:\Documents and Settings\NetworkService\Favorites

2008-05-17 10:38:04 19968 --a------ C:\WINDOWS\system32\cpuinf32.dll

2008-05-17 10:38:04 0 d-------- C:\Program Files\Interapple

2008-05-17 10:37:11 0 d-------- C:\Documents and Settings\Administrator\WINDOWS

2008-05-17 10:22:59 0 d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab

2008-05-17 10:22:58 0 d-------- C:\WINDOWS\system32\Kaspersky Lab

2008-05-16 17:53:37 0 d-------- C:\Documents and Settings\Administrator\Application Data\Malwarebytes

2008-05-16 16:21:52 0 d-------- C:\Program Files\EsetOnlineScanner

2008-05-16 15:08:25 0 d-------- C:\Documents and Settings\Administrator\Application Data\Orbit

2008-05-16 15:00:19 0 d--h----- C:\Documents and Settings\Administrator\Templates

2008-05-16 15:00:19 0 dr------- C:\Documents and Settings\Administrator\Start Menu

2008-05-16 15:00:19 0 dr-h----- C:\Documents and Settings\Administrator\SendTo

2008-05-16 15:00:19 0 d--h----- C:\Documents and Settings\Administrator\Recent

2008-05-16 15:00:19 0 d--h----- C:\Documents and Settings\Administrator\PrintHood

2008-05-16 15:00:19 1048576 --ah----- C:\Documents and Settings\Administrator\NTUSER.DAT

2008-05-16 15:00:19 0 d--h----- C:\Documents and Settings\Administrator\NetHood

2008-05-16 15:00:19 0 d-------- C:\Documents and Settings\Administrator\My Documents

2008-05-16 15:00:19 0 d--h----- C:\Documents and Settings\Administrator\Local Settings

2008-05-16 15:00:19 0 d-------- C:\Documents and Settings\Administrator\Favorites

2008-05-16 15:00:19 0 d-------- C:\Documents and Settings\Administrator\Desktop

2008-05-16 15:00:19 0 d--hs---- C:\Documents and Settings\Administrator\Cookies

2008-05-16 15:00:19 0 dr-h----- C:\Documents and Settings\Administrator\Application Data

2008-05-16 15:00:19 0 d---s---- C:\Documents and Settings\Administrator\Application Data\Microsoft

2008-04-29 17:19:08 45568 --a------ C:\WINDOWS\system32\WNDTLS32.DLL <Not Verified; DBS GmbH, Bremen-Germany; TX Text-Control>

2008-04-29 17:19:08 64000 --a------ C:\WINDOWS\system32\TXTLS32.DLL <Not Verified; DBS GmbH; TX Text-Control>

2008-04-29 17:19:08 250880 --a------ C:\WINDOWS\system32\TX32.DLL

2008-04-29 17:19:05 0 d-------- C:\acrsk

2008-04-29 09:05:38 0 d-------- C:\Program Files\Hiro-Media

2008-04-29 09:05:38 0 d-------- C:\Documents and Settings\All Users\Application Data\Hiro-Media

2008-04-25 08:23:30 0 dr------- C:\Documents and Settings\LocalService\Favorites

2008-04-24 16:34:20 0 d-------- C:\cmdcons

2008-04-24 15:24:47 0 d-------- C:\Program Files\Windows Defender

2008-04-24 15:21:11 0 d-------- C:\Program Files\Panda Security

2008-04-24 14:49:23 53248 --a------ C:\WINDOWS\PSEXESVC.EXE <Not Verified; Sysinternals; Sysinternals PsExec>

2008-04-24 14:41:36 68096 --a------ C:\WINDOWS\zip.exe

2008-04-24 14:41:36 49152 --a------ C:\WINDOWS\VFind.exe

2008-04-24 14:41:36 212480 --a------ C:\WINDOWS\swxcacls.exe <Not Verified; SteelWerX; SteelWerX Extended Configurator ACLists>

2008-04-24 14:41:36 136704 --a------ C:\WINDOWS\swsc.exe <Not Verified; SteelWerX; SteelWerX Service Controller>

2008-04-24 14:41:36 161792 --a------ C:\WINDOWS\swreg.exe <Not Verified; SteelWerX; SteelWerX Registry Editor>

2008-04-24 14:41:36 98816 --a------ C:\WINDOWS\sed.exe

2008-04-24 14:41:36 80412 --a------ C:\WINDOWS\grep.exe

2008-04-24 14:41:36 73728 --a------ C:\WINDOWS\fdsv.exe <Not Verified; Smallfrogs Studio; >

2008-04-24 14:11:46 0 d-------- C:\Documents and Settings\Mike&Sarah\Application Data\Malwarebytes

2008-04-24 14:11:34 0 d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes

2008-04-24 12:52:41 0 d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft

2008-04-24 12:51:31 0 d-------- C:\Program Files\Common Files\Wise Installation Wizard

-- Find3M Report ---------------------------------------------------------------

2008-05-23 18:21:41 0 d-------- C:\Documents and Settings\Mike&Sarah\Application Data\Skype

2008-05-22 11:17:21 278 --a------ C:\053347d72ebcd5e.dat

2008-05-22 00:37:41 0 d-------- C:\Program Files\Microsoft Silverlight

2008-05-18 09:00:06 0 d-------- C:\Documents and Settings\Mike&Sarah\Application Data\Adobe

2008-05-17 18:00:35 0 d-------- C:\Program Files\Common Files\Symantec Shared

2008-05-17 17:39:14 0 d-------- C:\Program Files\Common Files

2008-05-16 20:20:42 0 d-------- C:\Program Files\Logitech

2008-05-16 16:07:06 0 d-------- C:\Documents and Settings\Mike&Sarah\Application Data\Orbit

2008-05-16 15:45:48 0 d-------- C:\Program Files\QuickTime

2008-05-16 15:13:35 0 d-------- C:\Program Files\Common Files\Macromedia

2008-05-02 13:41:36 0 d-------- C:\Documents and Settings\Mike&Sarah\Application Data\Macromedia

2008-04-25 09:29:26 356 --a------ C:\Documents and Settings\Mike&Sarah\Application Data\preferences.xml

2008-04-25 09:29:13 0 d-------- C:\Documents and Settings\Mike&Sarah\Application Data\Jeppesen Sanderson

2008-04-24 15:47:17 0 d-------- C:\Program Files\Common Files\Autodesk Shared

2008-04-24 12:38:48 0 d-------- C:\Documents and Settings\Mike&Sarah\Application Data\Lavasoft

2008-04-22 18:22:46 0 d-------- C:\Documents and Settings\Mike&Sarah\Application Data\Real

2008-04-16 14:18:37 0 d-------- C:\Program Files\Canon

2008-04-09 21:04:22 0 d-------- C:\Program Files\Common Files\SureThing Shared

2008-04-09 17:47:17 0 d-------- C:\Documents and Settings\Mike&Sarah\Application Data\Grass Valley

2008-04-09 17:43:42 0 d-------- C:\Program Files\Gabest

2008-04-09 17:41:26 0 d-------- C:\Program Files\URLSnooper2

2008-04-09 17:40:02 0 d-------- C:\Program Files\Common Files\Canopus Shared

2008-04-09 17:40:01 0 d--h----- C:\Program Files\InstallShield Installation Information

2008-04-09 17:39:21 0 d-------- C:\Program Files\Common Files\Snell & Wilcox Shared

2008-04-09 17:39:07 0 d-------- C:\Program Files\Common Files\Grass Valley

2008-04-09 14:15:50 556 --a------ C:\Documents and Settings\Mike&Sarah\Application Data\AutoGK.ini

2008-04-09 14:01:09 0 d-------- C:\Program Files\Orbitdownloader

2008-04-09 13:52:44 46 --a------ C:\WINDOWS\system32\DonationCoder_urlsnooper_InstallInfo.dat

2008-04-09 13:52:44 0 d-------- C:\Documents and Settings\Mike&Sarah\Application Data\DonationCoder

2008-04-03 11:52:48 0 d-------- C:\Program Files\Common Files\Adobe

2008-04-03 11:51:38 0 d-------- C:\Program Files\Common Files\Macrovision Shared

2008-03-31 15:52:15 0 d-------- C:\Program Files\LCDHype

2008-03-31 15:44:01 0 d-------- C:\Program Files\DIFX

2008-03-31 15:44:00 0 d-------- C:\Program Files\Common Files\Ulead Systems

2008-03-31 15:43:37 0 d-------- C:\Program Files\Common Files\Aladdin Shared

2008-03-31 15:43:24 0 d-------- C:\Documents and Settings\Mike&Sarah\Application Data\Chief Architect Full Version 11

2008-03-31 15:43:01 0 d-------- C:\Program Files\Chief Architect Inc

2008-03-31 14:58:24 0 d-------- C:\Program Files\Microsoft Works

2008-03-31 14:58:14 0 d-------- C:\Program Files\MSBuild

2008-03-31 14:57:10 0 d-------- C:\Program Files\Microsoft.NET

2008-03-31 14:54:14 0 d-------- C:\Program Files\Microsoft Visual Studio 8

-- Registry Dump ---------------------------------------------------------------

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"GW Port Controller"="C:\Program Files\Samsung\SmarThru\PORTCTRL.EXE" [09/02/2004 02:03 PM]

"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [20/09/2006 10:27 PM]

"CTxfiHlp"="CTXFIHLP.EXE" [11/08/2006 01:56 PM C:\WINDOWS\system32\CTXFIHLP.EXE]

"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [13/02/2006 11:05 PM]

"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [13/02/2006 11:05 PM]

"RTHDCPL"="RTHDCPL.EXE" [30/10/2006 07:49 PM C:\WINDOWS\RTHDCPL.exe]

"SkyTel"="SkyTel.EXE" [16/05/2006 06:04 PM C:\WINDOWS\SkyTel.exe]

"MaxtorOneTouch"="D:\Maxtor\OneTouch\utils\Onetouch.exe" [27/03/2006 03:04 PM]

"mxomssmenu"="C:\Program Files\Maxtor\OneTouch Status\maxmenumgr.exe" [17/10/2005 04:24 PM]

"Sony Ericsson PC Suite"="D:\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [26/10/2005 05:17 PM]

"NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [09/03/2007 06:53 PM]

"LogitechCommunicationsManager"="C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe" [25/07/2007 03:02 PM]

"LogitechQuickCamRibbon"="C:\Program Files\Logitech\QuickCam\Quickcam.exe" [25/07/2007 03:06 PM]

"GrooveMonitor"="D:\Microsoft Office\Office12\GrooveMonitor.exe" [24/08/2007 06:00 AM]

"NexusServer"="C:\Program Files\Common Files\Grass Valley\ProCoder 3\Kernel\PNXSERVR.exe" [26/03/2007 05:45 PM]

"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [03/11/2006 07:20 PM]

"egui"="D:\ESET NOD32 Antivirus\egui.exe" [13/03/2008 04:48 PM]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Start WingMan Profiler"="" []

"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [12/03/2007 01:49 PM]

"Skype"="C:\Program Files\Skype\Phone\Skype.exe" [30/03/2007 01:34 PM]

"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [04/08/2004 12:56 AM]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"DisableRegistryTools"=0 (0x0)

"HideLegacyLogonScripts"=0 (0x0)

"HideLogoffScripts"=0 (0x0)

"RunLogonScriptSync"=1 (0x1)

"RunStartupScriptSync"=0 (0x0)

"HideStartupScripts"=0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]

"HideLegacyLogonScripts"=0 (0x0)

"HideLogoffScripts"=0 (0x0)

"RunLogonScriptSync"=1 (0x1)

"RunStartupScriptSync"=0 (0x0)

"HideStartupScripts"=0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]

"NoRecentDocsMenu"=01000000

"NoRecentDocsNetHood"=01000000

"NoSMMyDocs"=01000000

"NoSMMyPictures"=01000000

"NoUserNameInStartMenu"=01000000

"ClearRecentDocsOnExit"=01000000

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]

SecurityProviders msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll,

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]

@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vds]

@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}]

@="Volume shadow copy"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{59196830-250e-11db-8298-101111111111}]

AutoRun\command- H:\InstallTomTomHOME.exe

-- End of Deckard's System Scanner: finished at 2008-05-23 18:23:10 ------------

AdvancedSetup · May 23, 2008

Please check for updates again for MB and run it again and fix selected if found.

That log from MB says you did not allow it to fix an item. So we want to make sure you select and fix it.

Please copy / paste this entry into notepad and do a Save As and for file type select "All Files" and save

it to your desktop as as MBSCAN.bat

@ECHO OFF
MD C:\MBHOLDING
MOVE C:\053347d72ebcd5e.dat C:\MBHOLDING
ATTRIB %windir%\system32\*.* > "%USERPROFILE%\Desktop\MBFiles.txt"
DIR /o:e C:\ >> "%USERPROFILE%\Desktop\MBFiles.txt"
ATTRIB C:\*.* >> "%USERPROFILE%\Desktop\MBFiles.txt"
ATTRIB *.* >> "%USERPROFILE%\Desktop\MBFiles.txt"
DIR C:\MBHOLDING >> "%USERPROFILE%\Desktop\MBFiles.txt"

Please run that batch file by double clicking it and it will create a new text file named MBFiles.txt and put it on your desktop.

Then reply back and attach that file here via the upload button - don't post it directly, just upload it.

Also download and install WinPatrol and it will watch for changes to your system as well. WinPatrol

dutchroll · May 23, 2008

OK no probs.

Malwarebytes has been run again and nothing was detected. Could it be that upon the reboot it fixed those items? This was what it suggested when it first discovered them (ie, that a reboot was necessary).

The file upload is done with this reply.

I've installed SpywareBlaster and WinPatrol and they are running. I'll switch the PC off now and check back in the morning for any updates. Cheers.

MBFiles.txt

AdvancedSetup · May 23, 2008

Yes the reboot removed them. You simply copied the log before it had actually cleaned up so that's fine.

Curious how or why you got reinfected so fast again though. I was hoping to find something obvious in the files listed but nothing stands out.

Please update Spybot Search & Destroy and run another scan with it and let me know if it finds anything.

Then after a reboot, run one more Deckard's scan and post that please.

I would hold of on any Vista upgrade plans for a least a few days.

dutchroll · May 24, 2008

Yes that makes at least two of us who are curious as to why this is happening!

I'm a bit confused about the turn of events yesterday prior to having this infection rear up again:

This PC is normally turned off at night. It was running (without the infection showing in any obvious way) fine yesterday afternoon with no apparent problems. Most of what I was doing on it involved monitoring this forum and some minor browsing, with most of my other internet access (and any downloads) being done through the uninfected laptop. I left it on & went outside. My wife got home from work and said that she just did her normal checking Outlook, hotmail, and a regular trusted website (a work discussion forum), and then left the computer running and went off to do other stuff. However when I got back from outside, it was shutdown. She says she may have inadvertently shut it down, though she wouldn't normally do this and doesn't remember doing it (she was very tired). It was upon turning it back on that the virus popped back up again and started the Security Centre, fake popups, etc.

I wonder about this because the infection certainly appears to have caused or led to random shutdowns/reboots when the PC was unattended in the past.

That last Malwarebytes run I did upon discovering the reinfection detected the fake warning alerts - interestingly this was the first time Malwarebytes had detected anything so I assume there was a relevant update sometime in the last 48hrs or so. BTW, the computer has been behaving again since Malwarebytes removed those items it detected.

Spybot run just now found only 5 tracking cookies, which were fixed.

Here is the Deckard's log after the subsequent reboot:

Deckard's System Scanner v20071014.68

Run by Mike&Sarah on 2008-05-24 10:36:44

Computer is in Normal Mode.

--------------------------------------------------------------------------------

-- HijackThis (run as Mike&Sarah.exe) ------------------------------------------

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 10:36:49 AM, on 24/05/2008

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16640)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Windows Defender\MsMpEng.exe

C:\WINDOWS\System32\svchost.exe

D:\Lavasoft\Ad-Aware 2007\aawservice.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe

C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe

D:\ESET NOD32 Antivirus\ekrn.exe

C:\WINDOWS\system32\hasplms.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe

C:\Program Files\Samsung\SmarThru\PORTCTRL.EXE

C:\Program Files\Common Files\Real\Update_OB\realsched.exe

C:\WINDOWS\RTHDCPL.EXE

D:\Maxtor\OneTouch\utils\Onetouch.exe

C:\Program Files\Maxtor\OneTouch Status\maxmenumgr.exe

C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe

C:\Program Files\Logitech\QuickCam\Quickcam.exe

D:\Microsoft Office\Office12\GrooveMonitor.exe

C:\Program Files\Common Files\Teleca Shared\CapabilityManager.exe

C:\Program Files\Common Files\Grass Valley\ProCoder 3\Kernel\PNXSERVR.exe

C:\Program Files\Windows Defender\MSASCui.exe

D:\ESET NOD32 Antivirus\egui.exe

C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe

C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe

C:\Program Files\Skype\Phone\Skype.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe

C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe

C:\WINDOWS\system32\wuauclt.exe

C:\Program Files\Common Files\Logishrd\LQCVFX\COCIManager.exe

C:\Program Files\Skype\Plugin Manager\SkypePM.exe