Help! Really need help getting rid of this virus

TomVM · June 13, 2011

Had the Windows xp recovery virus...was in the process of getting rid of it but reached a point where I'm not just not making any progress. Still getting re-directed using google, not getting any sound from webpages, can only run in safemode(if i start it up normally anytime I go to open a program it gives me the "open with what" stuff. Tried here last week but didnt get a responce after 3 or 4 days so tried to get rid of it myself, figure I'll try again. Heres my dds log(from safemode).

.

DDS (Ver_2011-06-12.02) - NTFSx86 NETWORK

Internet Explorer: 8.0.6001.18702

Run by Administrator at 16:09:45 on 2011-06-13

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.255.33 [GMT -5:00]

.

AV: AntiVir Desktop *Enabled/Updated* {AD166499-45F9-482A-A743-FDD3350758C7}

.

============== Running Processes ===============

.

C:\WINDOWS\system32\svchost.exe -k DcomLaunch

svchost.exe

C:\WINDOWS\system32\svchost.exe -k netsvcs

svchost.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Internet Explorer\IEXPLORE.EXE

E:\Spybot - Search & Destroy\SpybotSD.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Internet Explorer\IEXPLORE.EXE

.

============== Pseudo HJT Report ===============

.

BHO: {016b137a-25a5-4f83-819d-73d935cff6a5} - c:\windows\system32\atmpvcno32.dll

BHO: {01cdd32f-5300-4db6-85a3-19dfd96fb327} - c:\windows\system32\atmpvcno32.dll

BHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\program files\yahoo!\companion\installs\cpn0\yt.dll

BHO: DriveLetterAccess: {5ca3d70e-1895-11cf-8e15-001234567890} - c:\windows\system32\dla\tfswshx.dll

BHO: Skype Plug-In: {ae805869-2e5c-4ed4-8f7b-f1f7851a4497} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll

BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll

BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

BHO: 54b0da84: {f4ed1805-763c-5305-6768-199661688e1a} - c:\windows\system32\msvcr7132.dll

BHO: SingleInstance Class: {fdad4da1-61a2-4fd8-9c17-86f7ac245081} - c:\program files\yahoo!\companion\installs\cpn0\YTSingleInstance.dll

TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn0\yt.dll

uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe

uRunOnce: [nltide_2] regsvr32 /s /n /i:U shell32

mRun: [updateManager] "c:\program files\common files\sonic\update manager\sgtray.exe" /r

mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime

mRun: [avgnt] "c:\program files\avira\antivir desktop\avgnt.exe" /min

mRun: [HostManager] c:\program files\common files\aol\1293679480\ee\AOLSoftware.exe

mRun: [sunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"

mRun: [PHIME2002ASync] c:\windows\system32\ime\tintlgnt\TINTSETP.EXE /SYNC

mRun: [PHIME2002A] c:\windows\system32\ime\tintlgnt\TINTSETP.EXE /IMEName

mRun: [iMJPMIG8.1] "c:\windows\ime\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32

mRun: [dla] c:\windows\system32\dla\tfswctrl.exe

mRun: [ATIModeChange] Ati2mdxx.exe

mRun: [ArcSoft MediaImpression Monitor] c:\program files\kodak\mediaimpression se\ArcMonitor.exe

mRun: [ArcSoft Connection Service] c:\program files\common files\arcsoft\connection service\bin\ACDaemon.exe

mRun: [Malwarebytes' Anti-Malware (reboot)] "e:\malwarebytes' anti-malware2\abc123.com.exe" /runcleanupscript

dRunOnce: [nltide_2] regsvr32 /s /n /i:U shell32

IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe

IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe

IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll

DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos-beta/OnlineScanner.cab

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://javadl-esd.sun.com/update/1.6.0/jinstall-6-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab

DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

TCP: DhcpNameServer = 192.168.2.1

TCP: Interfaces\{ABF422BA-5F59-4A3F-A4FB-06CFF8994ABB} : DhcpNameServer = 192.168.2.1

Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll

Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL

AppInit_DLLs: c:\windows\system32\msvcr7132.dll

SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

Hosts: 127.0.0.1 www.spywareinfo.com

.

================= FIREFOX ===================

.

FF - ProfilePath -

.

============= SERVICES / DRIVERS ===============

.

S0 qhjlext;qhjlext;c:\windows\system32\drivers\sjjah.sys --> c:\windows\system32\drivers\sjjah.sys [?]

S1 avgio;avgio;c:\program files\avira\antivir desktop\avgio.sys [2010-11-24 11608]

S2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\avira\antivir desktop\sched.exe [2010-11-24 136360]

S2 AntiVirService;Avira AntiVir Guard;c:\program files\avira\antivir desktop\avguard.exe [2010-11-24 269480]

S2 avgntflt;avgntflt;c:\windows\system32\drivers\avgntflt.sys [2010-11-24 61960]

S2 LicCtrlService;LicCtrl Service;c:\windows\Runservice.exe [2010-11-6 2560]

S2 PEVSystemStart;PEVSystemStart;"c:\combofix\pev.cfxxe" exec /i "c:\combofix\regt.cfxxe" /s "c:\combofix\cregb.dat" --> c:\combofix\pev.cfxxe [?]

S2 ShellHWDetection32;Shell Hardware Detection ;c:\windows\system32\msvidctl32.exe [2011-6-12 774656]

.

=============== Created Last 30 ================

.

2011-06-13 18:16:37 774656 ----a-w- c:\windows\system32\setupapi32.exe

2011-06-13 18:16:36 175616 ----a-w- c:\windows\system32\msvcr7132.dll

2011-06-12 21:30:16 98816 ----a-w- c:\windows\sed.exe

2011-06-12 21:30:16 518144 ----a-w- c:\windows\SWREG.exe

2011-06-12 21:30:16 256512 ----a-w- c:\windows\PEV.exe

2011-06-12 21:30:16 208896 ----a-w- c:\windows\MBR.exe

2011-06-12 21:22:29 774656 ----a-w- c:\windows\system32\msvidctl32.exe

2011-06-12 21:21:45 358912 ----a-w- c:\windows\system32\atmpvcno32.dll

2011-06-09 18:42:57 -------- d-----w- c:\documents and settings\all users\application data\mI28321OhLjN28321

2011-06-09 00:14:42 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl

2011-06-07 20:21:29 -------- d-sha-r- C:\cmdcons

2011-06-07 17:01:13 -------- d-----w- c:\program files\ESET

2011-06-06 05:09:12 -------- d-----w- c:\documents and settings\administrator.owner-75fdfe945\local settings\application data\Apple Computer

2011-06-06 00:44:09 -------- d-----w- c:\documents and settings\administrator.owner-75fdfe945\local settings\application data\AOL

2011-06-06 00:44:09 -------- d-----w- c:\documents and settings\administrator.owner-75fdfe945\local settings\application data\AIM

2011-06-05 21:46:44 -------- d-----w- c:\windows\pss

2011-06-05 17:13:05 -------- d-----w- c:\documents and settings\administrator.owner-75fdfe945\application data\Avira

2011-06-05 07:21:34 -------- d-sh--w- c:\documents and settings\administrator.owner-75fdfe945\PrivacIE

2011-06-05 07:20:06 -------- d-----w- c:\documents and settings\administrator.owner-75fdfe945\application data\Malwarebytes

2011-06-04 23:32:16 39984 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2011-06-01 21:02:31 -------- d-----w- c:\windows\system32\wbem\repository\FS

2011-06-01 21:02:31 -------- d-----w- c:\windows\system32\wbem\Repository

2011-06-01 04:56:02 -------- d-----w- c:\documents and settings\all users\application data\Spybot - Search & Destroy

2011-06-01 04:54:31 -------- d-----w- c:\program files\Spybot - Search & Destroy 2

2011-05-29 19:51:11 -------- d-----w- C:\found.003

2011-05-23 12:05:41 -------- d-----w- c:\documents and settings\all users\application data\Malwarebytes

2011-05-23 12:05:35 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

.

==================== Find3M ====================

.

2011-06-13 18:16:34 1481 --sha-w- c:\windows\system32\mmf.sys

.

============= FINISH: 16:11:22.01 ===============

screen317 · June 17, 2011

Hi and welcome to Malwarebytes.

Please download exeHelper from one of these two places:

http://www.raktor.net/exeHelper/exeHelper.com

http://www.raktor.net/exeHelper/exeHelper.scr

Save it to your Desktop and run it. When it finishes, restart your computer and see if you can run .exe files now.

If so, please update MBAM, run a Quick Scan, and post its log.

Next, download DDS by sUBs and save it to your Desktop.

Double-click on the DDS icon and let the scan run. When it has run two logs will be produced, please post only DDS.txt directly into your reply.

TomVM · June 17, 2011

I'm able to run .exe files now thanks. Still getting the redirects and no sound on webpages. I have the mbam and dds logs. Also have an avira log since it caught a trojan while I was in the middle of the mbam scan. Thanks so much for the help so far.

MBAM

Malwarebytes' Anti-Malware 1.51.0.1200

www.malwarebytes.org

Database version: 6874

Windows 5.1.2600 Service Pack 3

Internet Explorer 8.0.6001.18702

6/17/2011 12:11:19 AM

mbam-log-2011-06-17 (00-11-18).txt

Scan type: Full scan (C:\|D:\|E:\|)

Objects scanned: 223999

Time elapsed: 54 minute(s), 24 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

DDS

.

DDS (Ver_2011-06-12.02) - NTFSx86

Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_26

Run by Owner at 0:14:05 on 2011-06-17

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.255.39 [GMT -5:00]

.

AV: AntiVir Desktop *Enabled/Updated* {AD166499-45F9-482A-A743-FDD3350758C7}

.

============== Running Processes ===============

.

C:\WINDOWS\system32\svchost.exe -k DcomLaunch

svchost.exe

C:\WINDOWS\System32\svchost.exe -k netsvcs

svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Avira\AntiVir Desktop\sched.exe

svchost.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Avira\AntiVir Desktop\avgnt.exe

C:\WINDOWS\system32\dla\tfswctrl.exe

C:\Program Files\Kodak\MediaImpression SE\ArcMonitor.exe

C:\Program Files\Internet Explorer\IEXPLORE.EXE

C:\Program Files\Common Files\Java\Java Update\jusched.exe

C:\Program Files\AIM\aim.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe

C:\Program Files\Avira\AntiVir Desktop\avguard.exe

C:\Program Files\Internet Explorer\IEXPLORE.EXE

E:\Malwarebytes' Anti-Malware2\abc123.com.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\Program Files\Avira\AntiVir Desktop\avshadow.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\WINDOWS\runservice.exe

C:\WINDOWS\system32\svchost.exe -k imgsvc

C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe

C:\PROGRA~1\Yahoo!\Messenger\ymsgr_tray.exe

C:\WINDOWS\system32\NOTEPAD.EXE

C:\Program Files\internet explorer\iexplore.exe

.

============== Pseudo HJT Report ===============

.

uStart Page = hxxp://www.yahoo.com/