Logs for MBAB scan - XP Service Center virus

Apotheosis · November 26, 2008

MBAB scan...Panda scan running right now...

Malwarebytes' Anti-Malware 1.30

Database version: 1424

Windows 5.1.2600 Service Pack 3

11/26/2008 7:50:02 AM

mbam-log-2008-11-26 (07-50-02).txt

Scan type: Quick Scan

Objects scanned: 48080

Time elapsed: 7 minute(s), 10 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 6

Registry Values Infected: 2

Registry Data Items Infected: 0

Folders Infected: 4

Files Infected: 42

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{df780f87-ff2b-4df8-92d0-73db16a1543a} (Adware.PopCap) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{2d2bee6e-3c9a-4d58-b9ec-458edb28d0f6} (Rogue.DriveCleaner) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\xpprotectioncenter (Rogue.XPProtectionCenter) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\XPProtectionCenter (Rogue.XPProtectionCenter) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\tdssdata (Trojan.Agent) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\tdss (Trojan.Agent) -> Quarantined and deleted successfully.

Registry Values Infected:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xp protection center (Rogue.XPProtectionCenter) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\brastk (Trojan.FakeAlert) -> Quarantined and deleted successfully.

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

C:\Program Files\XPProtectionCenter (Rogue.XPProtectionCenter) -> Quarantined and deleted successfully.

C:\Program Files\XPProtectionCenter\data (Rogue.XPProtectionCenter) -> Quarantined and deleted successfully.

C:\Program Files\XPProtectionCenter\Microsoft.VC80.CRT (Rogue.XPProtectionCenter) -> Quarantined and deleted successfully.

C:\Documents and Settings\Owner\Start Menu\Programs\XPProtectionCenter (Rogue.XPProtectionCenter) -> Quarantined and deleted successfully.

Files Infected:

C:\Program Files\XPProtectionCenter\XPProtectionCenter.exe (Rogue.XPProtectionCenter) -> Quarantined and deleted successfully.

C:\WINDOWS\karna.dat (Trojan.FakeAlert) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\karna.dat (Trojan.FakeAlert) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\TDSScfum.dll (Trojan.TDSS) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\TDSSnrsr.dll (Trojan.TDSS) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\TDSSofxh.dll (Trojan.TDSS) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\TDSSriqp.dll (Trojan.TDSS) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\_scui.cpl (Rogue.XPProtectionCenter) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\drivers\TDSSmact.sys (Trojan.TDSS) -> Quarantined and deleted successfully.

C:\Program Files\XPProtectionCenter\AVEngn.dll (Rogue.XPProtectionCenter) -> Quarantined and deleted successfully.

C:\Program Files\XPProtectionCenter\htmlayout.dll (Rogue.XPProtectionCenter) -> Quarantined and deleted successfully.

C:\Program Files\XPProtectionCenter\pthreadVC2.dll (Rogue.XPProtectionCenter) -> Quarantined and deleted successfully.

C:\Program Files\XPProtectionCenter\Uninstall.exe (Rogue.XPProtectionCenter) -> Quarantined and deleted successfully.

C:\Program Files\XPProtectionCenter\wscui.cpl (Rogue.XPProtectionCenter) -> Quarantined and deleted successfully.

C:\Program Files\XPProtectionCenter\XPProtectionCenter.cfg (Rogue.XPProtectionCenter) -> Quarantined and deleted successfully.

C:\Program Files\XPProtectionCenter\data\daily.cvd (Rogue.XPProtectionCenter) -> Quarantined and deleted successfully.

C:\Program Files\XPProtectionCenter\Microsoft.VC80.CRT\Microsoft.VC80.CRT.manifest (Rogue.XPProtectionCenter) -> Quarantined and deleted successfully.

C:\Program Files\XPProtectionCenter\Microsoft.VC80.CRT\msvcm80.dll (Rogue.XPProtectionCenter) -> Quarantined and deleted successfully.

C:\Program Files\XPProtectionCenter\Microsoft.VC80.CRT\msvcp80.dll (Rogue.XPProtectionCenter) -> Quarantined and deleted successfully.

C:\Program Files\XPProtectionCenter\Microsoft.VC80.CRT\msvcr80.dll (Rogue.XPProtectionCenter) -> Quarantined and deleted successfully.

C:\Documents and Settings\Owner\Start Menu\Programs\XPProtectionCenter\Uninstall.lnk (Rogue.XPProtectionCenter) -> Quarantined and deleted successfully.

C:\Documents and Settings\Owner\Start Menu\Programs\XPProtectionCenter\XPProtectionCenter.lnk (Rogue.XPProtectionCenter) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\drivers\beep.sys (Fake.Beep.Sys) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\dllcache\beep.sys (Fake.Beep.Sys) -> Quarantined and deleted successfully.

C:\WINDOWS\brastk.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\wini10895.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\brastk.exe (Trojan.FakeAlert) -> Delete on reboot.

C:\Documents and Settings\Owner\Desktop\XPProtectionCenter.lnk (Rogue.XPProtectionCenter) -> Quarantined and deleted successfully.

C:\Documents and Settings\Owner\Application Data\Microsoft\Internet Explorer\Quick Launch\XPProtectionCenter.lnk (Rogue.XPProtectionCenter) -> Quarantined and deleted successfully.

C:\Documents and Settings\Owner\Local Settings\Temp\wrdwn2 (Trojan.FakeAlert) -> Quarantined and deleted successfully.

C:\Documents and Settings\Owner\Local Settings\Temp\wrdwn3 (Trojan.FakeAlert) -> Quarantined and deleted successfully.

C:\Documents and Settings\Owner\Local Settings\Temp\wrdwn4 (Trojan.FakeAlert) -> Quarantined and deleted successfully.

C:\Documents and Settings\Owner\Local Settings\Temp\wrdwn5 (Trojan.FakeAlert) -> Quarantined and deleted successfully.

C:\Documents and Settings\Owner\Local Settings\Temp\wrdwn6 (Trojan.FakeAlert) -> Quarantined and deleted successfully.

C:\Documents and Settings\Owner\Local Settings\Temp\wrdwn7 (Trojan.FakeAlert) -> Quarantined and deleted successfully.

C:\Documents and Settings\Owner\Local Settings\Temp\wrdwn8 (Trojan.FakeAlert) -> Quarantined and deleted successfully.

C:\Documents and Settings\Owner\Local Settings\Temp\wrdwn9 (Trojan.FakeAlert) -> Quarantined and deleted successfully.

C:\Documents and Settings\Owner\Local Settings\Temp\TDSSab46.tmp (Trojan.FakeAlert) -> Quarantined and deleted successfully.

C:\Documents and Settings\Owner\Local Settings\Temp\TDSSb0a2.tmp (Trojan.FakeAlert) -> Quarantined and deleted successfully.

C:\WINDOWS\smdat32a.sys (Rootkit.Agent) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\TDSSfxwp.dll (Rootkit.Agent) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\TDSStkdv.log (Trojan.TDSS) -> Quarantined and deleted successfully.

Apotheosis · November 26, 2008

Panda Active Scan log:

;*******************************************************************************

********************************************************************************

*

*******************

ANALYSIS: 2008-11-26 08:49:41

PROTECTIONS: 0

MALWARE: 28

SUSPECTS: 1

;*******************************************************************************

********************************************************************************

*

*******************

PROTECTIONS

Description Version Active Updated

;===============================================================================

================================================================================

=

===================

;===============================================================================

================================================================================

=

===================

MALWARE

Id Description Type Active Severity Disinfectable Disinfected Location

;===============================================================================

================================================================================

=

===================

00013869 adware/cydoor Adware No 0 Yes No hkey_current_user\software\cydoor

00013869 adware/cydoor Adware No 0 Yes No hkey_local_machine\software\cydoor

00018331 adware/gator Adware No 0 Yes No c:\documents and settings\all users\start menu\programs\gain publishing

00024343 adware/keenvalue Adware No 0 Yes No HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{0428FFC7-1931-45b7-95CB-3CBB919777E1}

00024343 adware/keenvalue Adware No 0 Yes No hkey_local_machine\software\perfectnav

00029258 application/altnet HackTools No 0 Yes No hkey_local_machine\software\microsoft\windows\currentversion\app management\arpcache\altnetdm

00034477 spyware/new.net Spyware No 1 Yes No HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{4A2AACF3-ADF6-11D5-98A9-00E018981B9E}

00041446 application/myway HackTools No 0 Yes No HKEY_CLASSES_ROOT\Interface\{0494D0D4-F8E0-41AD-92A3-14154ECE70AC}

00041446 application/myway HackTools No 0 Yes No HKEY_CLASSES_ROOT\Interface\{0494D0D6-F8E0-41AD-92A3-14154ECE70AC}

00041446 application/myway HackTools No 0 Yes No HKEY_CLASSES_ROOT\Interface\{0494D0DA-F8E0-41AD-92A3-14154ECE70AC}

00041446 application/myway HackTools No 0 Yes No HKEY_CLASSES_ROOT\Interface\{0494D0DC-F8E0-41AD-92A3-14154ECE70AC}

00041446 application/myway HackTools No 0 Yes No HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{0494D0D9-F8E0-41AD-92A3-14154ECE70AC}

00041446 application/myway HackTools No 0 Yes No HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{0494D0D1-F8E0-41AD-92A3-14154ECE70AC}

00041446 application/myway HackTools No 0 Yes No hkey_local_machine\software\myway

00139061 Cookie/Doubleclick TrackingCookie No 0 Yes No C:\Documents and Settings\Owner\Cookies\owner@doubleclick[2].txt

00139064 Cookie/Atlas DMT TrackingCookie No 0 Yes No C:\Documents and Settings\Owner\Cookies\owner@atdmt[2].txt

00145405 Cookie/RealMedia TrackingCookie No 0 Yes No C:\Documents and Settings\Owner\Cookies\owner@247realmedia[1].txt

00145457 Cookie/FastClick TrackingCookie No 0 Yes No C:\Documents and Settings\Owner\Cookies\owner@fastclick[1].txt

00145731 Cookie/Tribalfusion TrackingCookie No 0 Yes No C:\Documents and Settings\Owner\Cookies\owner@tribalfusion[2].txt

00147824 Cookie/Clickbank TrackingCookie No 0 Yes No C:\Documents and Settings\Owner\Cookies\owner@clickbank[1].txt

00162900 Cookie/MediaTickets TrackingCookie No 0 Yes No C:\Documents and Settings\Owner\Cookies\owner@kinghost[1].txt

00167642 Cookie/Com.com TrackingCookie No 0 Yes No C:\Documents and Settings\Owner\Cookies\owner@com[1].txt

00167704 Cookie/Xiti TrackingCookie No 0 Yes No C:\Documents and Settings\Owner\Cookies\owner@xiti[1].txt

00167753 Cookie/Statcounter TrackingCookie No 0 Yes No C:\Documents and Settings\Owner\Cookies\owner@statcounter[1].txt

00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\Documents and Settings\Owner\Cookies\owner@ad.yieldmanager[2].txt

00168061 Cookie/Apmebf TrackingCookie No 0 Yes No C:\Documents and Settings\Owner\Cookies\owner@apmebf[1].txt

00168076 Cookie/BurstNet TrackingCookie No 0 Yes No C:\Documents and Settings\Owner\Cookies\owner@burstnet[2].txt

00169190 Cookie/Advertising TrackingCookie No 0 Yes No C:\Documents and Settings\Owner\Cookies\owner@advertising[1].txt

00170556 Cookie/RealMedia TrackingCookie No 0 Yes No C:\Documents and Settings\Owner\Cookies\owner@realmedia[2].txt

00172221 Cookie/Zedo TrackingCookie No 0 Yes No C:\Documents and Settings\Owner\Cookies\owner@zedo[2].txt

00184846 Cookie/Adrevolver TrackingCookie No 0 Yes No C:\Documents and Settings\Owner\Cookies\owner@adrevolver[2].txt

00262020 Cookie/Atwola TrackingCookie No 0 Yes No C:\Documents and Settings\Owner\Cookies\owner@atwola[1].txt

00461493 Adware/XPProtectionCenter Adware No 0 No No C:\Documents and Settings\Owner\Local Settings\Temp\wrdwn19[XPProtectionCenter.exe]

00461493 Adware/XPProtectionCenter Adware No 0 No No C:\Documents and Settings\Owner\Local Settings\Temp\wrdwn14[XPProtectionCenter.exe]

00461493 Adware/XPProtectionCenter Adware No 0 No No C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\N8HK7GCD\Binaries1[1].cab[XPProtectionCenter.exe]

00461495 Adware/XPProtectionCenter Adware No 0 No No C:\Documents and Settings\Owner\Local Settings\Temp\wrdwn23[wscui.cpl]

00461495 Adware/XPProtectionCenter Adware No 0 No No C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\I3HXZPT1\BinariesSC[1].cab[wscui.cpl]

00461495 Adware/XPProtectionCenter Adware No 0 No No C:\Documents and Settings\Owner\Local Settings\Temp\wrdwn12[wscui.cpl]

00461495 Adware/XPProtectionCenter Adware No 0 No No C:\Documents and Settings\Owner\Local Settings\Temp\wrdwn18[wscui.cpl]

03074964 Trj/CI.A Virus/Trojan No 0 No No C:\Documents and Settings\Owner\Local Settings\Temp\wrdwn15[AVEngn.dll]

03074964 Trj/CI.A Virus/Trojan No 0 No No C:\Documents and Settings\Owner\Local Settings\Temp\wrdwn20[AVEngn.dll]

03839851 Trj/Downloader.MDW Virus/Trojan No 1 Yes No C:\System Volume Information\_restore{990E8A1A-F525-4D02-B4BA-DD2DF68E3DCF}\RP1307\A0131041.sys

;===============================================================================

================================================================================

=

===================

SUSPECTS

Sent Location

;===============================================================================

================================================================================

=

===================

No C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\0F53AD4D\Install[1].exe

;===============================================================================

================================================================================

=

===================

VULNERABILITIES

Id Severity Description

;===============================================================================

================================================================================

=

===================

;===============================================================================

================================================================================

=

===================

Apotheosis · November 26, 2008

and lastly....hijack this log....

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 8:58:42 AM, on 11/26/2008

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16735)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\NETGEAR\WG511\Utility\WG511WLU.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\WINDOWS\System32\Ati2evxx.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\WINDOWS\system32\HPZipm12.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\wanmpsvc.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll

O4 - HKLM\..\Run: [WG511WLU] C:\Program Files\NETGEAR\WG511\Utility\WG511WLU.exe -hide

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime

O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')

O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe

O4 - Global Startup: America Online 8.0 Tray Icon.lnk = C:\Program Files\America Online 8.0\aoltray.exe

O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)

O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll

O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)

O16 - DPF: {0FFFFFFF-0FFF-0FFF-0FFF-0FFFFFFFFFFF} - http://www.h-desk-soft.com/hdesk_offer_02/HDeskSetup_A.exe

O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/activescan/cabs/as2stubie.cab

O16 - DPF: {6F750202-1362-4815-A476-88533DE61D0C} (Kodak Gallery Easy Upload Manager Class) - http://www.kodakgallery.com/downloads/BUM/..._2/axofupld.cab

O16 - DPF: {9600F64D-755F-11D4-A47F-0001023E6D5A} (Shutterfly Picture Upload Plugin) - http://web1.shutterfly.com/downloads/Uploader.cab

O16 - DPF: {E008A543-CEFB-4559-912F-C27C2B89F13B} (Domino Web Access 7 Control) - https://remotemail.rccl.com/,DanaInfo=RCLMA...l.com+dwa7W.cab

O16 - DPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} (Performance Viewer Activex Control) - https://secure.logmein.com/activex/interim/...trl.cab?lmi=100

O20 - AppInit_DLLs: karna.dat

O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe

O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: OneCare AntiSpyware and AntiVirus (OneCareMP) - Unknown owner - C:\Program Files\Microsoft Windows OneCare Live\Antivirus\MsMpEng.exe (file missing)

O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

--

End of file - 4785 bytes

Apotheosis · November 26, 2008

EDIT! virus is called 'XP Protection Center' (not service center).

Note, after MBAB scan, virus appeared to be gone! No more pop-ups or infection notices, nor any problems browsing internet. Thanks guys!!!

Katana · November 30, 2008

Please note that all instructions given are customised for this computer only, the tools used may cause damage if used on a computer with different infections.
If you think you have similar problems, please post a log in the HJT forum and wait for help.

Hello and welcome to the forums

My name is Katana and I will be helping you to remove any infection(s) that you may have.

Please observe these rules while we work:

Please Read All Instructions Carefully
If you don't understand something, stop and ask! Don't keep going on.
Please do not run any other tools or scans whilst I am helping you
Please continue to respond until I give you the "All Clear"
(Just because you can't see a problem doesn't mean it isn't there)

If you can do those few things, everything should go smoothly

Please Note, your security programs may give warnings for some of the tools I will ask you to use.

Be assured, any links I give are safe

----------------------------------------------------------------------------------------

I apologize for the delay in responding, but as you can probably see the forums are quite busy.

Unfortunately there are far more people needing help than there are helpers.

If you still require help please do the following

Step 1

OTMoveIt

Please download OTMoveIt3 by OldTimer and save it to your desktop

Double-click OTMoveIt3.exe to run it.
Copy the lines in the codebox below. ( Make sure you include :Reg )

:Reg

[-hkey_current_user\software\cydoor]

[-hkey_local_machine\software\cydoor]

[-hkey_local_machine\software\perfectnav]

[-hkey_local_machine\software\microsoft\windows\currentversion\app management\arpcache\altnetdm]

[-hkey_local_machine\software\myway]

[-hkey_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{0428FFC7-1931-45b7-95CB-3CBB919777E1}]

[-hkey_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{4A2AACF3-ADF6-11D5-98A9-00E018981B9E}]

[-hkey_CLASSES_ROOT\Interface\{0494D0D4-F8E0-41AD-92A3-14154ECE70AC}]

[-hkey_CLASSES_ROOT\Interface\{0494D0D6-F8E0-41AD-92A3-14154ECE70AC}]

[-hkey_CLASSES_ROOT\Interface\{0494D0DA-F8E0-41AD-92A3-14154ECE70AC}]

[-hkey_CLASSES_ROOT\Interface\{0494D0DC-F8E0-41AD-92A3-14154ECE70AC}]

[-hkey_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{0494D0D9-F8E0-41AD-92A3-14154ECE70AC}]

[-hkey_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{0494D0D1-F8E0-41AD-92A3-14154ECE70AC}]

:Files

C:\Documents and Settings\Owner\Local Settings\Temp\wrdwn19

C:\Documents and Settings\Owner\Local Settings\Temp\wrdwn14

C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\N8HK7GCD\*.*

C:\Documents and Settings\Owner\Local Settings\Temp\wrdwn23

C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\I3HXZPT1\*.*

C:\Documents and Settings\Owner\Local Settings\Temp\wrdwn12

C:\Documents and Settings\Owner\Local Settings\Temp\wrdwn18

c:\documents and settings\all users\start menu\programs\gain publishing

:Commands

[Purity]

[EmptyTemp]

Return to OTMoveIt3, right click in the Paste List of Files/Folders to Move window (under the yellow bar) and choose Paste.

Click the red Moveit! button.
Copy everything in the Results window (under the green bar), and paste it in your next reply.
Close OTMoveIt3

If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes.

----------------------------------------------------------- -----------------------------------------------------------

Step 2

Fix With HJT

Close all other windows and then start HiJack This

Click Do A System Scan Only

When it has finished scanning put a check next to the following lines IF still present

O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O20 - AppInit_DLLs: karna.dat

- Close ALL open windows (especially Internet Explorer!)-

Now click Fix checked

Click yes to any prompts

Close HijackThis

----------------------------------------------------------- -----------------------------------------------------------

Step 3

Download and Run RSIT

Please download Random's System Information Tool by random/random from here and save it to your desktop.
Double click on RSIT.exe to run RSIT.
Click Continue at the disclaimer screen.
Once it has finished, two logs will open:
- log.txt will be opened maximized.
- info.txt will be opened minimized.
[*]Please post the contents of both log.txt and info.txt.

----------------------------------------------------------- -----------------------------------------------------------

Step 4

Logs/Information to Post in Reply

Please post the following logs/Information in your reply

OTMI Log
RSIT Log/s
How are things running now ?

Apotheosis · December 1, 2008

hi Katana, thank you for this. I will not be at the infected computer until Wednesday 12/3/08. I will follow your instructions then.

Apotheosis · December 3, 2008

step 1:

========== REGISTRY ==========

Registry key hkey_current_user\software\cydoor\\ not found.

Registry key hkey_local_machine\software\cydoor\\ not found.

Registry key hkey_local_machine\software\perfectnav\\ deleted successfully.

Registry key hkey_local_machine\software\microsoft\windows\currentversion\app management\arpcache\altnetdm\\ deleted successfully.

Registry key hkey_local_machine\software\myway\\ not found.

Registry key hkey_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{0428FFC7-1931-45b7-95CB-3CBB919777E1}\\ not found.

Registry key hkey_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{4A2AACF3-ADF6-11D5-98A9-00E018981B9E}\\ not found.

Registry key hkey_CLASSES_ROOT\Interface\{0494D0D4-F8E0-41AD-92A3-14154ECE70AC}\\ not found.

Registry key hkey_CLASSES_ROOT\Interface\{0494D0D6-F8E0-41AD-92A3-14154ECE70AC}\\ not found.

Registry key hkey_CLASSES_ROOT\Interface\{0494D0DA-F8E0-41AD-92A3-14154ECE70AC}\\ not found.

Registry key hkey_CLASSES_ROOT\Interface\{0494D0DC-F8E0-41AD-92A3-14154ECE70AC}\\ not found.

Registry key hkey_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{0494D0D9-F8E0-41AD-92A3-14154ECE70AC}\\ not found.

Registry key hkey_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{0494D0D1-F8E0-41AD-92A3-14154ECE70AC}\\ not found.

========== FILES ==========

File/Folder C:\Documents and Settings\Owner\Local Settings\Temp\wrdwn19 not found.

File/Folder C:\Documents and Settings\Owner\Local Settings\Temp\wrdwn14 not found.

C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\N8HK7GCD\desktop.ini moved successfully.

C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\N8HK7GCD\f_moved[1].gif moved successfully.

C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\N8HK7GCD\icon14[1].gif moved successfully.

C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\N8HK7GCD\p_mq_add[1].gif moved successfully.

C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\N8HK7GCD\t_reply[1].gif moved successfully.

File/Folder C:\Documents and Settings\Owner\Local Settings\Temp\wrdwn23 not found.

C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\I3HXZPT1\css_img_quote[1].gif moved successfully.

C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\I3HXZPT1\desktop.ini moved successfully.

C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\I3HXZPT1\icon13[1].gif moved successfully.

C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\I3HXZPT1\icon2[1].gif moved successfully.

C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\I3HXZPT1\nav_m[1].gif moved successfully.

C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\I3HXZPT1\rating_0_mini[1].gif moved successfully.

C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\I3HXZPT1\stats[1].gif moved successfully.

C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\I3HXZPT1\t_new[1].gif moved successfully.

File/Folder C:\Documents and Settings\Owner\Local Settings\Temp\wrdwn12 not found.

File/Folder C:\Documents and Settings\Owner\Local Settings\Temp\wrdwn18 not found.

File/Folder c:\documents and settings\all users\start menu\programs\gain publishing not found.

========== COMMANDS ==========

User's Temp folder emptied.

User's Temporary Internet Files folder emptied.

User's Internet Explorer cache folder emptied.

Local Service Temp folder emptied.

File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.

Local Service Temporary Internet Files folder emptied.

File delete failed. C:\WINDOWS\temp\Perflib_Perfdata_2e0.dat scheduled to be deleted on reboot.

Windows Temp folder emptied.

FireFox cache emptied.

Temp folders emptied.

OTMoveIt3 by OldTimer - Version 1.0.7.1 log created on 12032008_125844

restart requested, will do so now.

Apotheosis · December 3, 2008

after reboot: