Virtumonde trojan trouble

hairpiece · November 26, 2008

Hi there, just looking for abit of help removing these 2 annoying files lurking in my reg, have used both spybot and MBAB will post logs also. Have also just completed a panda scan posting that aswell. I appreciate all help and advice that can be given! Apologies if anything is incorrect with these logs, i will rectify as soon as i can!

Thanks again,

hairpiece

MBAB log

Malwarebytes' Anti-Malware 1.30

Database version: 1423

Windows 5.1.2600 Service Pack 2

26/11/2008 11:52:17

mbam-log-2008-11-26 (11-52-17).txt

Scan type: Quick Scan

Objects scanned: 52418

Time elapsed: 6 minute(s), 12 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 1

Registry Data Items Infected: 1

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cpm5796bdc3 (Trojan.Agent) -> Quarantined and deleted successfully.

Registry Data Items Infected:

HKEY_CLASSES_ROOT\regfile\shell\open\command\ (Broken.OpenCommand) -> Bad: ("regedit.exe" "%1") Good: (regedit.exe "%1") -> Quarantined and deleted successfully.

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

Panda Log

;*******************************************************************************

********************************************************************************

*

*******************

ANALYSIS: 2008-11-26 16:54:04

PROTECTIONS: 1

MALWARE: 39

SUSPECTS: 0

;*******************************************************************************

********************************************************************************

*

*******************

PROTECTIONS

Description Version Active Updated

;===============================================================================

================================================================================

=

===================

AVG Anti-Virus Free 8.0 Yes Yes

;===============================================================================

================================================================================

=

===================

MALWARE

Id Description Type Active Severity Disinfectable Disinfected Location

;===============================================================================

================================================================================

=

===================

00139064 Cookie/Atlas DMT TrackingCookie No 0 Yes No C:\Documents and Settings\Aaron\Cookies\aaron@atdmt[2].txt

00145466 Cookie/Advertising TrackingCookie No 0 Yes No C:\Documents and Settings\Aaron\Application Data\Mozilla\Firefox\Profiles\9w05s4s3.default\cookies-1.txt[.servedby.advertising.com/]

00145731 Cookie/Tribalfusion TrackingCookie No 0 Yes No C:\Documents and Settings\Aaron\Cookies\aaron@tribalfusion[1].txt

00145732 Cookie/Falkag TrackingCookie No 0 Yes No C:\Documents and Settings\Aaron\Application Data\Mozilla\Firefox\Profiles\9w05s4s3.default\cookies-1.txt[.as-eu.falkag.net/]

00147054 Cookie/Hypercount TrackingCookie No 0 Yes No C:\Documents and Settings\Aaron\Application Data\Mozilla\Firefox\Profiles\9w05s4s3.default\cookies-1.txt[.hypercount.com/]

00149064 Cookie/Maxserving TrackingCookie No 0 Yes No C:\Documents and Settings\Aaron\Application Data\Mozilla\Firefox\Profiles\9w05s4s3.default\cookies-1.txt[.maxserving.com/]

00149116 Cookie/Ccbill TrackingCookie No 0 Yes No C:\Documents and Settings\Aaron\Application Data\Mozilla\Firefox\Profiles\9w05s4s3.default\cookies-1.txt[.ccbill.com/]

00152401 Cookie/Belnk TrackingCookie No 0 Yes No C:\Documents and Settings\Aaron\Application Data\Mozilla\Firefox\Profiles\9w05s4s3.default\cookies-1.txt[.belnk.com/]

00162900 Cookie/MediaTickets TrackingCookie No 0 Yes No C:\Documents and Settings\Aaron\Application Data\Mozilla\Firefox\Profiles\9w05s4s3.default\cookies-1.txt[.kinghost.com/]

00167642 Cookie/Com.com TrackingCookie No 0 Yes No C:\Documents and Settings\Aaron\Application Data\Mozilla\Firefox\Profiles\9w05s4s3.default\cookies-1.txt[.com.com/]

00167672 Cookie/DomainSponsor TrackingCookie No 0 Yes No C:\Documents and Settings\Aaron\Application Data\Mozilla\Firefox\Profiles\9w05s4s3.default\cookies-1.txt[landing.domainsponsor.com/]

00167677 Cookie/WebPower TrackingCookie No 0 Yes No C:\Documents and Settings\Aaron\Application Data\Mozilla\Firefox\Profiles\9w05s4s3.default\cookies-1.txt[.webpower.com/]

00167704 Cookie/Xiti TrackingCookie No 0 Yes No C:\Documents and Settings\Aaron\Cookies\aaron@xiti[1].txt

00167730 Cookie/Hitbox TrackingCookie No 0 Yes No C:\Documents and Settings\Aaron\Application Data\Mozilla\Firefox\Profiles\9w05s4s3.default\cookies-1.txt[.ehg.hitbox.com/]

00167733 Cookie/Adserver TrackingCookie No 0 Yes No C:\Documents and Settings\Aaron\Application Data\Mozilla\Firefox\Profiles\9w05s4s3.default\cookies-1.txt[.z1.adserver.com/]

00167749 Cookie/Toplist TrackingCookie No 0 Yes No C:\Documents and Settings\Aaron\Application Data\Mozilla\Firefox\Profiles\9w05s4s3.default\cookies-1.txt[.toplist.cz/]

00167759 Cookie/Sextracker TrackingCookie No 0 Yes No C:\Documents and Settings\Aaron\Application Data\Mozilla\Firefox\Profiles\9w05s4s3.default\cookies-1.txt[counter9.sextracker.com/]

00167761 Cookie/Sextracker TrackingCookie No 0 Yes No C:\Documents and Settings\Aaron\Application Data\Mozilla\Firefox\Profiles\9w05s4s3.default\cookies-1.txt[counter8.sextracker.com/]

00167784 Cookie/Com.com TrackingCookie No 0 Yes No C:\Documents and Settings\Aaron\Application Data\Mozilla\Firefox\Profiles\9w05s4s3.default\cookies-1.txt[ad.sensismediasmart.com.au/]

00167790 Cookie/Qsrch TrackingCookie No 0 Yes No C:\Documents and Settings\Aaron\Application Data\Mozilla\Firefox\Profiles\9w05s4s3.default\cookies-1.txt[.qsrch.com/]

00168057 Cookie/Sextracker TrackingCookie No 0 Yes No C:\Documents and Settings\Aaron\Application Data\Mozilla\Firefox\Profiles\9w05s4s3.default\cookies-1.txt[counter10.sextracker.com/]

00168061 Cookie/Apmebf TrackingCookie No 0 Yes No C:\Documents and Settings\Aaron\Application Data\Mozilla\Firefox\Profiles\9w05s4s3.default\cookies-1.txt[.apmebf.com/]

00168101 Cookie/Falkag TrackingCookie No 0 Yes No C:\Documents and Settings\Aaron\Application Data\Mozilla\Firefox\Profiles\9w05s4s3.default\cookies-1.txt[.as-us.falkag.net/]

00168110 Cookie/Server.iad.Liveperson TrackingCookie No 0 Yes No C:\Documents and Settings\Aaron\Application Data\Mozilla\Firefox\Profiles\9w05s4s3.default\cookies-1.txt[server.iad.liveperson.net/hc/77228595]

00168110 Cookie/Server.iad.Liveperson TrackingCookie No 0 Yes No C:\Documents and Settings\Aaron\Application Data\Mozilla\Firefox\Profiles\9w05s4s3.default\cookies-1.txt[server.iad.liveperson.net/]

00168110 Cookie/Server.iad.Liveperson TrackingCookie No 0 Yes No C:\Documents and Settings\Aaron\Application Data\Mozilla\Firefox\Profiles\9w05s4s3.default\cookies-1.txt[server.iad.liveperson.net/hc/77228595]

00169190 Cookie/Advertising TrackingCookie No 0 Yes No C:\Documents and Settings\Aaron\Cookies\aaron@advertising[1].txt

00170087 Cookie/Hbmediapro TrackingCookie No 0 Yes No C:\Documents and Settings\Aaron\Application Data\Mozilla\Firefox\Profiles\9w05s4s3.default\cookies-1.txt[.adopt.hbmediapro.com/]

00170495 Cookie/PointRoll TrackingCookie No 0 Yes No C:\RECYCLER\S-1-5-21-155206220-439152911-2501358109-1006\Dc19.txt

00170550 Cookie/Humanclick TrackingCookie No 0 Yes No C:\Documents and Settings\Aaron\Application Data\Mozilla\Firefox\Profiles\9w05s4s3.default\cookies-1.txt[hc2.humanclick.com/hc/28781733]

00170550 Cookie/Humanclick TrackingCookie No 0 Yes No C:\Documents and Settings\Aaron\Application Data\Mozilla\Firefox\Profiles\9w05s4s3.default\cookies-1.txt[hc2.humanclick.com/]

00171718 Cookie/Enhance TrackingCookie No 0 Yes No C:\Documents and Settings\Aaron\Application Data\Mozilla\Firefox\Profiles\9w05s4s3.default\cookies-1.txt[c.enhance.com/]

00173545 Cookie/Rn11 TrackingCookie No 0 Yes No C:\Documents and Settings\Aaron\Application Data\Mozilla\Firefox\Profiles\9w05s4s3.default\cookies-1.txt[.rn11.com/]

00173905 Cookie/Xmts TrackingCookie No 0 Yes No C:\Documents and Settings\Aaron\Application Data\Mozilla\Firefox\Profiles\9w05s4s3.default\cookies-1.txt[.xmts.net/]

00175950 Cookie/cs.sexcounter TrackingCookie No 0 Yes No C:\Documents and Settings\Aaron\Application Data\Mozilla\Firefox\Profiles\9w05s4s3.default\cookies-1.txt[.cs.sexcounter.com/]

00182104 Cookie/Hitbox TrackingCookie No 0 Yes No C:\Documents and Settings\Aaron\Application Data\Mozilla\Firefox\Profiles\9w05s4s3.default\cookies-1.txt[.phg.hitbox.com/]

00187950 Cookie/bravenetA TrackingCookie No 0 Yes No C:\Documents and Settings\Aaron\Application Data\Mozilla\Firefox\Profiles\9w05s4s3.default\cookies-1.txt[.bravenet.com/]

00191644 Cookie/adultfriendfinder TrackingCookie No 0 Yes No C:\Documents and Settings\Aaron\Application Data\Mozilla\Firefox\Profiles\9w05s4s3.default\cookies-1.txt[.adultfriendfinder.com/]

00194327 Cookie/Go TrackingCookie No 0 Yes No C:\Documents and Settings\Aaron\Application Data\Mozilla\Firefox\Profiles\9w05s4s3.default\cookies-1.txt[.go.com/]

00199309 Cookie/Falkag TrackingCookie No 0 Yes No C:\Documents and Settings\Aaron\Application Data\Mozilla\Firefox\Profiles\9w05s4s3.default\cookies-1.txt[sel.as-eu.falkag.net/]

00262020 Cookie/Atwola TrackingCookie No 0 Yes No C:\RECYCLER\S-1-5-21-155206220-439152911-2501358109-1006\Dc23.txt

00262020 Cookie/Atwola TrackingCookie No 0 Yes No C:\RECYCLER\S-1-5-21-155206220-439152911-2501358109-1006\Dc248.txt

00262020 Cookie/Atwola TrackingCookie No 0 Yes No C:\Documents and Settings\Aaron\Application Data\Mozilla\Firefox\Profiles\9w05s4s3.default\cookies-1.txt[.atwola.com/]

03839851 Trj/Downloader.MDW Virus/Trojan No 1 Yes No C:\System Volume Information\_restore{46DC962F-A2D1-4267-B515-6377F620BB7C}\RP936\A0110952.sys

;===============================================================================

================================================================================

=

===================

SUSPECTS

Sent Location 5%

;===============================================================================

================================================================================

=

===================

;===============================================================================

================================================================================

=

===================

VULNERABILITIES

Id Severity Description 5%

;===============================================================================

================================================================================

=

===================

;===============================================================================

================================================================================

=

===================

Hijackthis log

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 16:57:30, on 26/11/2008

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16735)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Intel\Wireless\Bin\EvtEng.exe

C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe

C:\WINDOWS\system32\spoolsv.exe

C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe

C:\WINDOWS\system32\CTsvcCDA.EXE

C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE

C:\Program Files\Microsoft LifeCam\MSCamS32.exe

C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Sony\VAIO Event Service\VESMgr.exe

C:\PROGRA~1\AVG\AVG8\avgrsx.exe

C:\Program Files\Canon\CAL\CALMAIN.exe

C:\PROGRA~1\AVG\AVG8\avgemc.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe

C:\Program Files\Sony\VAIO Power Management\SPMgr.exe

C:\WINDOWS\system32\RunDll32.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\RTHDCPL.EXE

C:\Program Files\PowerISO\PWRISOVM.EXE

C:\WINDOWS\system32\ICO.EXE

C:\Program Files\Sony\ISB Utility\ISBMgr.exe

C:\WINDOWS\system32\hkcmd.exe

C:\Program Files\Toshiba\TOSHIBA Multimedia Center\Surround Mixer\CTSysVol.exe

C:\PROGRA~1\AVG\AVG8\avgtray.exe

C:\Program Files\Apoint\Apoint.exe

C:\WINDOWS\vVX1000.exe

C:\Program Files\Canon\MyPrinter\BJMyPrt.exe

C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe

C:\Program Files\Apoint\Apntex.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Toshiba\MediaSource\RemoteControl\RcMan.exe

C:\Program Files\Toshiba\MediaSource\Detector\CTDetect.exe

C:\Documents and Settings\Aaron\Local Settings\Application Data\Google\Update\GoogleUpdate.exe

C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

C:\Program Files\Toshiba\MediaSource\RemoteControl\OSDMenu.EXE

C:\Program Files\Mozilla Firefox\firefox.exe

C:\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page = http://go.microsoft.com/fwlink/?LinkId=54843

R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)

O2 - BHO: XBTP05231 Class - {031F120A-BBAF-45d8-B306-375F2A6B9398} - (no file)

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll

O2 - BHO: Orange - {4E7BD74F-2B8D-469E-A1FB-F862B587B57D} - (no file)

O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O2 - BHO: (no name) - {8b3fd806-bbd0-4ed6-8f93-79ae677be13e} - C:\WINDOWS\system32\kujelegu.dll (file missing)

O3 - Toolbar: Alcohol Soft - Alcohol 120% Toolbar - {1CE4EE89-2D5C-4361-AF3B-D902AB545381} - (no file)

O3 - Toolbar: Orange - {4E7BD74F-2B8D-469E-A1FB-F862B587B57D} - (no file)

O4 - HKLM\..\Run: [VAIO Update 2] "C:\Program Files\Sony\VAIO Update 2\VAIOUpdt.exe" /Stationary

O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot

O4 - HKLM\..\Run: [sunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe

O4 - HKLM\..\Run: [sonyPowerCfg] C:\Program Files\Sony\VAIO Power Management\SPMgr.exe

O4 - HKLM\..\Run: [sbUsb AudCtrl] RunDll32 sbusbdll.dll,RCMonitor

O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime

O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE

O4 - HKLM\..\Run: [PrepareYourVAIO] C:\Program Files\Sony\Prepare your VAIO\PYVAlert.exe

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [Mouse Suite 98 Daemon] ICO.EXE

O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe

O4 - HKLM\..\Run: [iSBMgr.exe] C:\Program Files\Sony\ISB Utility\ISBMgr.exe

O4 - HKLM\..\Run: [igfxTray] C:\WINDOWS\system32\igfxtray.exe

O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe

O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Toshiba\TOSHIBA Multimedia Center\Surround Mixer\CTSysVol.exe /r

O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"

O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe

O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe

O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE

O4 - HKLM\..\Run: [LifeCam] "C:\Program Files\Microsoft LifeCam\LifeExp.exe"

O4 - HKLM\..\Run: [VX1000] C:\WINDOWS\vVX1000.exe

O4 - HKLM\..\Run: [CanonSolutionMenu] C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe /logon

O4 - HKLM\..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe /logon

O4 - HKLM\..\Run: [sSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot

O4 - HKLM\..\Run: [OpwareSE4] "C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe"

O4 - HKLM\..\Run: [CPM5796bdc3] Rundll32.exe "c:\windows\system32\guzuyavu.dll",a

O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [RemoteCenter] C:\Program Files\Toshiba\MediaSource\RemoteControl\RcMan.exe

O4 - HKCU\..\Run: [Creative Detector] C:\Program Files\Toshiba\MediaSource\Detector\CTDetect.exe /R

O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Aaron\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c

O4 - HKCU\..\Run: [spybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-19\..\Run: [sodokimipu] Rundll32.exe "C:\WINDOWS\system32\neduwozi.dll",s (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll

O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll

O14 - IERESET.INF: START_PAGE_URL=http://www.orange.co.uk

O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab

O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab31267.cab

O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://cdn2.zone.msn.com/binFramework/v10/...ro.cab34246.cab

O16 - DPF: {E5D419D6-A846-4514-9FAD-97E826C84822} - http://fdl.msn.com/zone/datafiles/heartbeat.cab

O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL

O20 - AppInit_DLLs: avgrsstx.dll C:\WINDOWS\system32\sivotumo.dll c:\windows\system32\fetijonu.dll

O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe

O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe

O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe

O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE

O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: PIXMA Extended Survey Program (IJPLMSVC) - Unknown owner - C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE

O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe

O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe

O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe

O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe

O23 - Service: VAIO Event Service - Sony Corporation - C:\Program Files\Sony\VAIO Event Service\VESMgr.exe

--

End of file - 10674 bytes

1972vet · November 26, 2008

Please download combofix from This Webpage...and read through the instructions there for running the tool.

***Important Note***

Please read through the guidance on that web page carefully and thoroughly...and install the Recovery Console. Using this tool without the Recovery Console installed is NOT RECOMMENDED.

The Windows Recovery Console will allow you to boot into a special recovery (repair) mode that is not otherwise available. This allows us to more easily help you should your computer have a problem after an attempted removal of malware. It's a simple procedure that will only take a few moments.

Once installed, a blue screen prompt should appear that reads as follows:

The Recovery Console was successfully installed.

When you see that screen, please continue as follows:

Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
Click Yes to allow ComboFix to continue scanning for malware.

When the tool is finished, it will produce a report for you.

Please post back the following on your next reply:

C:\ComboFix.txt

New HijackThis log.

hairpiece · November 27, 2008

thanks for the speedy reply, just completed all the steps and here are the logs!

Combofix log.

ComboFix 08-11-27.01 - Aaron 2008-11-27 14:13:56.1 - NTFSx86

Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.122 [GMT 0:00]

Running from: c:\documents and settings\Aaron\Desktop\ComboFix.exe

Command switches used :: c:\documents and settings\Aaron\Desktop\WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe

* Created a new restore point

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\windows\system32\pthreadVC.dll

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Legacy_VFILT

((((((((((((((((((((((((( Files Created from 2008-10-27 to 2008-11-27 )))))))))))))))))))))))))))))))

.

2008-11-26 16:56 . 2008-11-26 16:56 <DIR> d-------- C:\hi-jack this

2008-11-26 13:53 . 2008-11-26 13:53 <DIR> d-------- c:\program files\Panda Security

2008-11-26 13:53 . 2008-06-19 17:24 28,544 --a------ c:\windows\system32\drivers\pavboot.sys

2008-11-26 13:38 . 2008-11-26 13:38 401,720 --a------ C:\HiJackThis.exe

2008-11-26 01:24 . 2008-11-26 01:24 <DIR> d-------- c:\documents and settings\Aaron\Application Data\Malwarebytes

2008-11-26 01:23 . 2008-11-26 01:23 <DIR> d-------- c:\program files\Malwarebytes' Anti-Malware

2008-11-26 01:23 . 2008-11-26 01:23 <DIR> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes

2008-11-26 01:23 . 2008-10-22 16:10 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys

2008-11-26 01:23 . 2008-10-22 16:10 15,504 --a------ c:\windows\system32\drivers\mbam.sys

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2008-11-25 15:22 --------- d-----w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy

2008-11-25 13:25 --------- d-----w c:\program files\Spybot - Search & Destroy

2008-11-24 18:20 --------- d-----w c:\documents and settings\Aaron\Application Data\uTorrent

2008-11-15 22:24 --------- d-----w c:\documents and settings\Aaron\Application Data\Skype

2008-11-15 21:00 --------- d-----w c:\documents and settings\Aaron\Application Data\skypePM

2008-10-26 16:08 --------- d-----w c:\program files\SoulseekNS

2008-10-25 16:42 --------- d--h--w c:\program files\InstallShield Installation Information

2008-10-25 16:33 --------- d-----w c:\program files\VstPlugins

2008-10-25 16:33 --------- d-----w c:\program files\Image-Line

2008-10-25 16:31 --------- d-----w c:\program files\Soulseek-Test

2008-10-24 11:10 453,632 ----a-w c:\windows\system32\drivers\mrxsmb.sys

2008-10-18 12:11 --------- d-----w c:\documents and settings\All Users\Application Data\Soulseek

2008-10-07 11:09 --------- d-----w c:\program files\Canon

2008-10-07 11:09 --------- d-----w c:\documents and settings\All Users\Application Data\CanonIJPLM

2008-10-07 10:53 --------- d-----w c:\program files\Common Files\ScanSoft Shared

2008-10-07 10:53 --------- d-----w c:\program files\Common Files\InstallShield

2008-10-07 10:53 --------- d-----w c:\documents and settings\All Users\Application Data\ScanSoft

2008-10-07 10:53 --------- d-----w c:\documents and settings\All Users\Application Data\InstallShield

2008-10-07 10:53 --------- d-----w c:\documents and settings\Aaron\Application Data\ScanSoft

2008-10-07 10:52 --------- d-----w c:\program files\ScanSoft

2008-10-07 10:48 --------- d-----w c:\program files\Common Files\Canon

2008-10-07 10:43 --------- d--h--w c:\documents and settings\All Users\Application Data\CanonBJ

2008-10-07 10:42 --------- d--h--w c:\program files\CanonBJ

2008-10-02 14:31 --------- d-----w c:\program files\MagicISO

2008-09-30 10:54 --------- d-----w c:\program files\Microsoft LifeCam

2008-09-28 14:11 --------- d-----w c:\program files\Croteam

2008-01-19 10:45 67,464 ----a-w c:\documents and settings\Aaron\Application Data\GDIPFONTCACHEV1.DAT

2007-01-08 18:43 278,528 -c--a-w c:\program files\Common Files\FDEUnInstaller.exe

2006-11-18 18:37 40 -c--a-w c:\documents and settings\Aaron\language.dat

2006-03-02 11:29 428 -c--a-w c:\documents and settings\Aaron\Application Data\wklnhst.dat

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]

"RemoteCenter"="c:\program files\Toshiba\MediaSource\RemoteControl\RcMan.exe" [2004-08-17 143360]

"Creative Detector"="c:\program files\Toshiba\MediaSource\Detector\CTDetect.exe" [2003-10-02 98304]

"Google Update"="c:\documents and settings\Aaron\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2008-11-13 133104]

"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2008-09-16 1833296]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"SunJavaUpdateSched"="c:\program files\Java\jre1.5.0_06\bin\jusched.exe" [2005-11-10 36975]

"SonyPowerCfg"="c:\program files\Sony\VAIO Power Management\SPMgr.exe" [2005-01-14 184320]

"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-05-27 413696]

"PWRISOVM.EXE"="c:\program files\PowerISO\PWRISOVM.EXE" [2008-01-20 217088]

"PrepareYourVAIO"="c:\program files\Sony\Prepare your VAIO\PYVAlert.exe" [2005-01-21 118784]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2005-02-17 5406720]

"ISBMgr.exe"="c:\program files\Sony\ISB Utility\ISBMgr.exe" [2004-02-20 32768]

"IgfxTray"="c:\windows\system32\igfxtray.exe" [2005-02-22 155648]

"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2005-02-22 126976]

"CTSysVol"="c:\program files\Toshiba\TOSHIBA Multimedia Center\Surround Mixer\CTSysVol.exe" [2003-09-17 57344]

"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2008-11-27 1261336]

"Apoint"="c:\program files\Apoint\Apoint.exe" [2003-11-07 114688]

"LifeCam"="c:\program files\Microsoft LifeCam\LifeExp.exe" [2007-05-17 279912]

"VX1000"="c:\windows\vVX1000.exe" [2007-04-10 709992]

"CanonSolutionMenu"="c:\program files\Canon\SolutionMenu\CNSLMAIN.exe" [2007-05-14 644696]

"CanonMyPrinter"="c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2007-04-03 1603152]

"SSBkgdUpdate"="c:\program files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2006-10-25 210472]

"OpwareSE4"="c:\program files\ScanSoft\OmniPageSE4\OpwareSE4.exe" [2007-02-04 79400]

"SbUsb AudCtrl"="sbusbdll.dll" [2004-09-28 c:\windows\system32\sbusbdll.dll]

"RTHDCPL"="RTHDCPL.EXE" [2005-02-21 c:\windows\RTHDCPL.EXE]

"Mouse Suite 98 Daemon"="ICO.EXE" [2002-03-14 c:\windows\system32\ico.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-04 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\VESWinlogon]

2005-01-18 12:48 73728 c:\windows\system32\VESWinlogon.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]

"vidc.yv12"= c:\progra~1\ACEMEG~1\SystemS\ATI\atiyuv12.DLL

"vidc.divx"= c:\progra~1\ACEMEG~1\SystemS\DivX\DivX520.dll

"midi1"= mapledxp.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]

SecurityProviders msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll, zwebauth.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]

backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]

path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk

backup=c:\windows\pss\Microsoft Office.lnkCommon Startup

HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ares

HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper

HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechVideoTray

HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LVCOMSX

HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WindowBlinds

HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\

1972vet · November 28, 2008

Your Java application is out of date and causes a slight security risk as a result.

Please follow these steps to remove older version Java components:

Close any open programs you may have running, especially your web browser.
Click Start-->Control Panel-->Add or Remove Programs.
Click once on any item having Java Runtime Environment in it's name then click the "Remove" button.

Not every version of Java will begin with "Java" so be sure to read each entry in the list.

Repeat the third step above as many times as necessary to remove all versions of Java.

***NOTE***

If you are asked to reboot at any point during the uninstallations, please do so. Then go back to Add/Remove and continue with the rest of the removals...when finished uninstalling all of them, reboot the computer.

Navigate to and delete: C:\Program Files\Java<--the Java folder indicated in Bold Red Text (if found)
Then go to this page.
Scroll down to where it says "The Java Runtime Environment (JRE) allows end-users to run Java applications" and click the "Download" button to the right. Select the platform for "Windows".
Check the box that says: "I agree to the Java SE Runtime Environment # License Agreement", then click Continue...The page will refresh

Then, click on the link to download Windows Offline Installation. Save it to your desktop.

Now, from your desktop, double-click on the executable to install the newest version.

Next, please be sure to disable Spybot Search and Destroy's Tea Timer Registry Protection function:

1) Run Spybot-S&D

2) Go to the Mode menu, and make sure "Advanced Mode" is selected

3) On the left hand side, choose Tools -> Resident

4) Uncheck "Resident TeaTimer" and OK any prompts

5) Restart your computer.

Please open a blank Notepad by clicking start-->run

Then, in the run box type Notepad.exe and click "OK".

Copy the below text in Bold and paste it into the blank Notepad. Save it as CFScript.txt...Change the "Save as type" to All Files and save it to your desktop. Now drag the text document over to your Combofix.exe

Combofix will run again automatically. Please post back the new log that will be generated. Thanks!

Folder::

c:\documents and settings\Aaron\Application Data\uTorrent

c:\program files\SoulseekNS

c:\program files\Soulseek-Test

c:\documents and settings\All Users\Application Data\Soulseek

c:\Program Files\ares

c:\Program Files\uTorrent

Registry::

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"c:\Program Files\uTorrent\utorrent.exe"=-

"c:\Program Files\SoulseekNS\slsk.exe"=-

hairpiece · November 28, 2008

yeah followed those steps.. here is the new log!

ComboFix 08-11-27.07 - Aaron 2008-11-28 13:09:03.2 - NTFSx86

Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.142 [GMT 0:00]

Running from: c:\documents and settings\Aaron\Desktop\ComboFix.exe

Command switches used :: c:\documents and settings\Aaron\Desktop\CFScript.txt

* Created a new restore point

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\documents and settings\Aaron\Application Data\uTorrent

c:\documents and settings\Aaron\Application Data\uTorrent\24-Season4-DVD-MEDiEVAL.torrent

c:\documents and settings\Aaron\Application Data\uTorrent\dht.dat

c:\documents and settings\Aaron\Application Data\uTorrent\dht.dat.old

c:\documents and settings\Aaron\Application Data\uTorrent\resume.dat

c:\documents and settings\Aaron\Application Data\uTorrent\resume.dat.old

c:\documents and settings\Aaron\Application Data\uTorrent\rss.dat

c:\documents and settings\Aaron\Application Data\uTorrent\rss.dat.old

c:\documents and settings\Aaron\Application Data\uTorrent\settings.dat

c:\documents and settings\Aaron\Application Data\uTorrent\settings.dat.old

c:\documents and settings\Aaron\Application Data\uTorrent\Top.Gear.S07.E01.PDTV.XviD-m00tv.torrent

c:\documents and settings\Aaron\Application Data\uTorrent\utorrent.lng

c:\documents and settings\All Users\Application Data\Soulseek

c:\program files\Soulseek-Test

c:\program files\Soulseek-Test\attributes.cfg

c:\program files\Soulseek-Test\private_chat_logs\k1LLbOy.txt

c:\program files\Soulseek-Test\private_chat_logs\mindthegap.txt

c:\program files\Soulseek-Test\private_chat_logs\napster2005.txt

c:\program files\SoulseekNS

c:\program files\SoulseekNS\message.wav

c:\program files\SoulseekNS\Readme.txt

c:\program files\SoulseekNS\slsk.exe

c:\program files\SoulseekNS\uninstall.exe

c:\program files\uTorrent

c:\program files\uTorrent\Uninstall.exe

c:\program files\uTorrent\utorrent.exe

.

((((((((((((((((((((((((( Files Created from 2008-10-28 to 2008-11-28 )))))))))))))))))))))))))))))))

.

2008-11-28 12:54 . 2008-11-28 12:54 410,976 --a------ c:\windows\system32\deploytk.dll

2008-11-28 12:54 . 2008-11-28 12:54 73,728 --a------ c:\windows\system32\javacpl.cpl

2008-11-28 12:53 . 2008-11-28 12:53 <DIR> d-------- c:\program files\Java