1. Computer problem? Tech Support Guy is completely free -- paid for by advertisers and donations. Click here to join today! If you're new to Tech Support Guy, we highly recommend that you visit our Guide for New Members.

Solved: VirusRemoval.vbs

Discussion in 'Virus & Other Malware Removal' started by akfak, Apr 3, 2008.

Thread Status:
Not open for further replies.
Advertisement
  1. akfak

    akfak Thread Starter

    Joined:
    Oct 31, 2007
    Messages:
    13
    Hello

    I have successfully removed this virus (according to the scan of Kaspersky 7), but when I start the computer I still get the following message:

    (In the titlebar): Windows Script Host
    (Message): Can not find script file "C:\WINDOWS\system32\VirusRemoval.vbs."

    Does this mean I still have the virus? Is this just a residual from having the virus? How can I get rid of it?

    Thanks.
     
  2. Cookiegal

    Cookiegal Administrator Malware Specialist Coordinator

    Joined:
    Aug 27, 2003
    Messages:
    115,269
    It's likely a registry key is still trying to load it.

    Click here to download HJTsetup.exe.
    • Save HJTsetup.exe to your desktop.
    • Double click on the HJTsetup.exe icon on your desktop.
    • By default it will install to C:\Program Files\Hijack This.
    • Continue to click Next in the setup dialogue boxes until you get to the Select Addition Tasks dialogue.
    • Put a check by Create a desktop icon then click Next again.
    • Continue to follow the rest of the prompts from there.
    • At the final dialogue box click Finish and it will launch Hijack This.
    • Click on the Do a system scan and save a log file button. It will scan and then ask you to save the log.
    • Click Save to save the log file and then the log will open in notepad.
    • Click on "Edit > Select All" then click on "Edit > Copy" to copy the entire contents of the log.
    • Come back here to this thread and Paste the log in your next reply.
    • DO NOT have Hijack This fix anything yet. Most of what it finds will be harmless or even required.

    Note: During this process, it would help a great deal and be very much appreciated if you would refrain from installing any new software or hardware on this machine, unless absolutely necessary, until the clean up process is finished as it makes our job more tedious, with additional new files that may have to be researched, which is very time consuming.

    Also, please do not run any security programs or fixes on your own as doing so may compromise what we will be doing. It is important that you wait for instructions.
     
  3. akfak

    akfak Thread Starter

    Joined:
    Oct 31, 2007
    Messages:
    13
    the HijackThis file is below.

    For the record, I did a registry search for all VirusRemoval.vbs entries, and there were about 5 or 6 entries. The problem is, I'm not sure what to do with them - if I should just delete the VirusRemoval.vbs part or if I should remove the whole thing. All of the entries are accompanied by wscript.exe...not sure if that's a good file or a bad one, so I haven't done anything.

    The other keys are:
    HKLM\Software\Microsoft\WindowsNT\Current Version\Winlogon
    Name: Userinit
    Type: REG_SZ
    Data: C:\WINDOWS\system32\userinit.exe, C:\WINDOWS\system32\wscript.exe C:\WINDOWS\system32\VirusRemoval.vbs

    HKEY_USERS\S-1-5-21-1482476501-879983540-725345543-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoint....
    (Sorry, I didn't write the whole key down, but there are two entries like this, and they both have the following data:)
    Name: Default
    Type: REG_SZ
    Data: wscript.exe VirusRemoval.vbs

    HKEY_CURRENT_USER\SoftwareSoftware\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{373c4757-f4bb-11dc-8dce-001aa025e80f}\Shell\AutoRun\command
    and
    HKEY_CURRENT_USER\SoftwareSoftware\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{373c4757-f4bb-11dc-8dce-001aa025e80f}\Shell\open\command
    which both have the following info:
    Name: Default
    Type: REG_SZ
    Data: wscript.exe VirusRemoval.vbs

    I hope that helps. Or maybe it's too much info...I don't know...

    Thanks for your help!

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 4:26:59 PM, on 4/8/2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\wscntfy.exe
    C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
    C:\Program Files\Analog Devices\Core\smax4pnp.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
    C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
    C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
    C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe
    C:\Program Files\Microsoft Encarta\Encarta Premium DVD 2007\EDICT.EXE
    C:\Program Files\Picasa2\PicasaMediaDetector.exe
    C:\Program Files\Google\Google Updater\GoogleUpdater.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    C:\Program Files\Launchy\Launchy.exe
    C:\Program Files\Concepts Data Systems\Power Ge'ez 2005\pg2005.exe
    C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
    C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
    C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
    C:\WINDOWS\system32\calc.exe
    C:\Program Files\Microsoft Office\OFFICE11\EXCEL.EXE
    C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://sujin.com.np/
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Sujin.com.np
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
    F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\wscript.exe C:\WINDOWS\system32\VirusRemoval.vbs
    O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Smart Web Printing\hpswp_printenhancer.dll
    O2 - BHO: HP Print Clips - {053F9267-DC04-4294-A72C-58F732D338C0} - C:\Program Files\HP\Smart Web Printing\hpswp_framework.dll
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: Encarta Web Companion Helper Object - {955BE0B8-BC85-4CAF-856E-8E0D8B610560} - C:\Program Files\Common Files\Microsoft Shared\Encarta Web Companion\2007\ENCWCBAR.DLL
    O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll
    O3 - Toolbar: Encarta Web Companion - {147D6308-0614-4112-89B1-31402F9B82C4} - C:\Program Files\Common Files\Microsoft Shared\Encarta Web Companion\2007\ENCWCBAR.DLL
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
    O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKLM\..\Run: [googletalk] C:\Program Files\Google\Google Talk\googletalk.exe /autostart
    O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
    O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
    O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe"
    O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe"
    O4 - HKCU\..\Run: [E07AXLRD_2836890] "C:\Program Files\Microsoft Encarta\Encarta Premium DVD 2007\EDICT.EXE" -m
    O4 - HKCU\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe
    O4 - Global Startup: Google Updater.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
    O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    O4 - Global Startup: Launchy.lnk = C:\Program Files\Launchy\Launchy.exe
    O4 - Global Startup: Power Ge'ez 2005.lnk = ?
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
    O9 - Extra button: Web Anti-Virus statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\SCIEPlgn.dll
    O9 - Extra button: HP Clipbook - {58ECB495-38F0-49cb-A538-10282ABF65E7} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll
    O9 - Extra button: HP Smart Select - {700259D7-1666-479a-93B1-3250410481E8} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: Encarta Search Bar - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Common Files\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~3\GOEC62~1.DLL
    O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
    O23 - Service: Kaspersky Anti-Virus 7.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
    O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
    O23 - Service: Google Desktop Manager 5.7.801.1629 (GoogleDesktopManager-010108-205858) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

    --
    End of file - 7012 bytes
     
  4. Cookiegal

    Cookiegal Administrator Malware Specialist Coordinator

    Joined:
    Aug 27, 2003
    Messages:
    115,269
    Please visit Combofix Guide & Instructions for instructions for downloading and running ComboFix:

    Post the log from ComboFix when you've accomplished that along with a new HijackThis log.

    Important notes regarding ComboFix:

    ComboFix may reset a number of Internet Explorer's settings, including making it the default browser. This can easily be changed once we're finished.

    Combofix also prevents autorun of ALL CDs, floppies and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you, please let me know. This can be undone manually when we're finished.
     
  5. akfak

    akfak Thread Starter

    Joined:
    Oct 31, 2007
    Messages:
    13
    Not sure if this is some sort of joke or fluke or what...

    But, when I tried to download this, a virus warning popped up for Heur Invader. I stopped whatever process it was trying to run, but the .exe file had already downloaded. I saved it onto a flash disk because the computer with the virus doesn't have internet at the moment.

    When I plugged the flash disk into the computer with this problem, another virus warning popped up, saying that "virus Heur.Invader" was on Combofix.exe//PE_Patch.UPX/327882R2FWJFW\catchme.cfexe//PE_Patch.UPX

    I have yet to run this Combo Fix program, but I won't do it while I'm getting all these virus warnings.

    Is this what's supposed to happen?!?!?!
     
  6. Cookiegal

    Cookiegal Administrator Malware Specialist Coordinator

    Joined:
    Aug 27, 2003
    Messages:
    115,269
    That's exactly why you are supposed to disable all anti-virus programs as they will disable ComboFix by removing some of its components. They are not malicious but are falsely detected by many anti-virus applications because of the nature of their function.

    Please remove what the Combofix already downloaded, read the instructions carefully and download ComboFix again.
     
  7. akfak

    akfak Thread Starter

    Joined:
    Oct 31, 2007
    Messages:
    13
    I will try this again and let you know. For the record, I read the instructions carefully and it told me to disable the antivirus software before running ComboFix. It never told me I would get anti-virus warnings 1) upon download of the file and 2) upon clicking the removable disk that the executable is located on.

    Thanks.
     
  8. Cookiegal

    Cookiegal Administrator Malware Specialist Coordinator

    Joined:
    Aug 27, 2003
    Messages:
    115,269
    OK. I'm just wondering why are you not able to download it directly to the infected computer? :)
     
  9. akfak

    akfak Thread Starter

    Joined:
    Oct 31, 2007
    Messages:
    13
    Yeah...that would be the obvious question, I know.

    I am in Ethiopia and don't have an internet connection on the computer that is infected (they tell me it's coming...I've been hearing it for about a month now). I use flash disks to transfer stuff from the computers that I do use the internet on to the computer that is now infected.

    Unfortunately, it's common belief here that having anti-virus software installed on your computer is enough...they don't consider updating the software...therein lies the problem. My flash disk gets infected every time I plug it in to one of these computers.

    This is another reason why I'm so slow in responding. Thanks for your help (and patience).
     
  10. Cookiegal

    Cookiegal Administrator Malware Specialist Coordinator

    Joined:
    Aug 27, 2003
    Messages:
    115,269
    Thanks for the clarification.

    Are you able to run ComboFix?
     
  11. akfak

    akfak Thread Starter

    Joined:
    Oct 31, 2007
    Messages:
    13
    Hello!

    I've disappeared for a while...sorry about that. I just went through the whole ComboFix thing. Then I rebooted my computer and that window at startup didn't show up, so that's good!

    Here's the logfile:

    ComboFix 08-06-20.4 - user 2008-06-25 12:04:34.1 - NTFSx86
    Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.91 [GMT 3:00]
    Running from: C:\Documents and Settings\user\Desktop\ComboFix.exe
    Command switches used :: C:\Documents and Settings\user\Desktop\WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
    * Created a new restore point
    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    C:\WINDOWS\system32\amvo.exe
    C:\WINDOWS\system32\amvo0.dll

    .
    ((((((((((((((((((((((((( Files Created from 2008-05-25 to 2008-06-25 )))))))))))))))))))))))))))))))
    .

    2008-06-23 12:02 . 2008-06-23 12:02 <DIR> d-------- C:\WINDOWS\Sun
    2008-06-22 19:38 . 2008-03-25 02:37 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl
    2008-06-22 19:36 . 2008-06-22 19:38 <DIR> d-------- C:\Program Files\Java
    2008-06-22 18:20 . 2008-06-22 18:20 <DIR> d-------- C:\Program Files\Common Files\Java
    2008-06-11 10:16 . 2008-05-08 17:02 203,136 -----c--- C:\WINDOWS\system32\dllcache\rmcast.sys
    2008-06-11 08:33 . 2008-06-13 14:05 272,128 -----c--- C:\WINDOWS\system32\dllcache\bthport.sys
    2008-06-07 20:31 . 2008-06-07 20:31 <DIR> d-------- C:\WINDOWS\system32\scripting
    2008-06-07 20:31 . 2008-06-07 20:31 <DIR> d-------- C:\WINDOWS\system32\en
    2008-06-07 20:31 . 2008-06-07 20:31 <DIR> d-------- C:\WINDOWS\system32\bits
    2008-06-07 20:31 . 2008-06-07 20:31 <DIR> d-------- C:\WINDOWS\l2schemas
    2008-06-07 20:28 . 2008-06-07 20:32 <DIR> d-------- C:\WINDOWS\ServicePackFiles
    2008-06-07 20:15 . 2008-06-07 20:15 <DIR> d-------- C:\WINDOWS\EHome
    2008-06-07 20:01 . 2008-04-14 03:12 4,274,816 --------- C:\WINDOWS\system32\nv4_disp.dll
    2008-06-07 20:00 . 2008-04-14 03:12 1,737,856 --------- C:\WINDOWS\system32\mtxparhd.dll
    2008-06-07 19:59 . 2004-08-03 22:41 1,041,536 --------- C:\WINDOWS\system32\drivers\hsfdpsp2.sys
    2008-06-07 19:58 . 2008-04-14 03:11 136,192 --------- C:\WINDOWS\system32\aaclient.dll
    2008-06-07 19:58 . 2008-04-13 21:36 44,928 --------- C:\WINDOWS\system32\drivers\agpcpq.sys
    2008-06-07 19:58 . 2008-04-13 21:36 42,368 --------- C:\WINDOWS\system32\drivers\agp440.sys
    2008-06-07 19:58 . 2008-04-14 03:11 4,255 --------- C:\WINDOWS\system32\drivers\adv01nt5.dll
    2008-06-07 19:58 . 2008-04-14 03:11 3,967 --------- C:\WINDOWS\system32\drivers\adv02nt5.dll
    2008-06-07 19:58 . 2008-04-14 03:11 3,775 --------- C:\WINDOWS\system32\drivers\adv11nt5.dll
    2008-06-07 19:58 . 2008-04-14 03:11 3,711 --------- C:\WINDOWS\system32\drivers\adv09nt5.dll
    2008-06-07 19:58 . 2008-04-14 03:11 3,647 --------- C:\WINDOWS\system32\drivers\adv07nt5.dll
    2008-06-07 19:58 . 2008-04-14 03:11 3,615 --------- C:\WINDOWS\system32\drivers\adv05nt5.dll
    2008-06-07 19:58 . 2008-04-14 03:11 3,135 --------- C:\WINDOWS\system32\drivers\adv08nt5.dll
    2008-06-07 15:10 . 2008-06-25 12:01 54,156 --ah----- C:\WINDOWS\QTFont.qfn
    2008-06-07 15:10 . 2008-06-07 15:10 1,409 --a------ C:\WINDOWS\QTFont.for
    2008-06-07 15:08 . 2008-06-07 15:08 <DIR> d-------- C:\Program Files\iPod
    2008-06-07 15:07 . 2008-06-07 15:08 <DIR> d-------- C:\Program Files\iTunes
    2008-06-07 15:05 . 2008-06-07 15:05 <DIR> d-------- C:\Program Files\QuickTime

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-06-25 09:11 9,619,488 --sha-w C:\WINDOWS\system32\drivers\fidbox.dat
    2008-06-25 09:11 531,744 --sha-w C:\WINDOWS\system32\drivers\fidbox2.dat
    2008-06-25 09:02 --------- d-----w C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
    2008-06-25 09:01 50,636 --sha-w C:\WINDOWS\system32\drivers\fidbox2.idx
    2008-06-25 09:01 104,492 --sha-w C:\WINDOWS\system32\drivers\fidbox.idx
    2008-06-24 17:30 --------- d-----w C:\Documents and Settings\All Users\Application Data\Google Updater
    2008-06-13 11:05 272,128 ------w C:\WINDOWS\system32\drivers\bthport.sys
    2008-05-30 06:12 88,774 ----a-w C:\WINDOWS\system32\drivers\klick.dat
    2008-05-29 08:06 96,966 ----a-w C:\WINDOWS\system32\drivers\klin.dat
    2008-05-29 08:06 112,144 ----a-w C:\WINDOWS\system32\drivers\kl1.sys
    2008-05-22 16:43 --------- d-----w C:\Program Files\Microsoft Silverlight
    2008-05-15 14:32 --------- d-----w C:\Documents and Settings\user\Application Data\Launchy
    2008-05-08 14:02 203,136 ----a-w C:\WINDOWS\system32\drivers\rmcast.sys
    2008-04-14 00:12 69,120 ----a-w C:\WINDOWS\notepad.exe
    2008-04-14 00:12 50,688 ----a-w C:\WINDOWS\twain_32.dll
    2008-04-14 00:12 32,866 ------w C:\WINDOWS\slrundll.exe
    2008-04-14 00:12 283,648 ----a-w C:\WINDOWS\winhlp32.exe
    2008-04-14 00:12 146,432 ----a-w C:\WINDOWS\regedit.exe
    2008-04-14 00:12 10,752 ----a-w C:\WINDOWS\hh.exe
    2008-04-14 00:12 1,033,728 ----a-w C:\WINDOWS\explorer.exe
    2008-04-14 00:11 451,072 ----a-w C:\WINDOWS\AppPatch\aclayers.dll
    2008-04-14 00:11 39,424 ------w C:\WINDOWS\AppPatch\acadproc.dll
    2008-04-14 00:11 245,248 ----a-w C:\WINDOWS\AppPatch\acspecfc.dll
    2008-04-14 00:11 141,312 ----a-w C:\WINDOWS\AppPatch\aclua.dll
    2008-04-14 00:11 116,224 ----a-w C:\WINDOWS\AppPatch\acxtrnal.dll
    2008-04-14 00:11 1,852,928 ----a-w C:\WINDOWS\AppPatch\acgenral.dll
    2008-03-31 18:14 102,768 --sh--r C:\6l6w8.com
    .

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe" [2005-10-29 03:25 94208]
    "Picasa Media Detector"="C:\Program Files\Picasa2\PicasaMediaDetector.exe" [2008-02-26 04:23 443968]
    "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-14 03:12 15360]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 21:50 155648]
    "ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" [2006-01-03 04:41 45056]
    "SoundMAXPnP"="C:\Program Files\Analog Devices\Core\smax4pnp.exe" [2006-05-01 21:07 843776]
    "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 22:16 39792]
    "googletalk"="C:\Program Files\Google\Google Talk\googletalk.exe" [2007-01-02 00:22 3739648]
    "Google Desktop Search"="C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" [2008-04-18 18:46 29744]
    "HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2007-03-11 21:34 49152]
    "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-03-28 23:37 413696]
    "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-03-30 10:36 267048]
    "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe" [2008-03-25 04:28 144784]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "Picasa Media Detector"="C:\Program Files\Picasa2\PicasaMediaDetector.exe" [2008-02-26 04:23 443968]

    C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
    Google Updater.lnk - C:\Program Files\Google\Google Updater\GoogleUpdater.exe [2008-02-19 14:56:19 125624]
    HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2007-03-11 21:26:24 210520]
    Launchy.lnk - C:\Program Files\Launchy\Launchy.exe [2008-02-19 14:46:17 274432]
    Power Ge'ez 2005.lnk - C:\Program Files\Concepts Data Systems\Power Ge'ez 2005\pg2005.exe [2008-02-15 02:45:05 499712]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
    "AppInit_DLLs"=C:\PROGRA~1\Google\GOOGLE~3\GOEC62~1.DLL

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
    "DisableMonitoring"=dword:00000001

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
    "C:\\Program Files\\Google\\Google Talk\\googletalk.exe"=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
    "C:\\Program Files\\Kaspersky Lab\\Kaspersky Anti-Virus 7.0\\avp.exe"=
    "C:\\Program Files\\iTunes\\iTunes.exe"=

    R0 atiide;atiide;C:\WINDOWS\system32\DRIVERS\atiide.sys [2006-09-14 06:01]
    R3 klim5;Kaspersky Anti-Virus NDIS Filter;C:\WINDOWS\system32\DRIVERS\klim5.sys [2007-12-13 13:28]
    S3 GoogleDesktopManager-022208-143751;Google Desktop Manager 5.7.802.22438;"C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" [2008-04-18 18:46]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
    hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{373c4757-f4bb-11dc-8dce-001aa025e80f}]
    \Shell\AutoRun\command - wscript.exe VirusRemoval.vbs
    \Shell\open\Command - wscript.exe VirusRemoval.vbs

    *Newly Created Service* - CATCHME
    .
    Contents of the 'Scheduled Tasks' folder
    "2008-06-19 15:03:09 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
    - C:\Program Files\Apple Software Update\SoftwareUpdate.exe
    .
    **************************************************************************

    catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-06-25 12:11:38
    Windows 5.1.2600 Service Pack 3 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    Completion time: 2008-06-25 12:15:25
    ComboFix-quarantined-files.txt 2008-06-25 09:15:20

    Pre-Run: 9,680,240,640 bytes free
    Post-Run: 10,501,378,048 bytes free

    WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
    [boot loader]
    timeout=2
    default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
    [operating systems]
    multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect
    C:\CMDCONS\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

    148 --- E O F --- 2008-06-20 17:02:40
     
  12. Cookiegal

    Cookiegal Administrator Malware Specialist Coordinator

    Joined:
    Aug 27, 2003
    Messages:
    115,269
    Open Notepad and copy and paste the text in the code box below into it:

    Code:
    File::
    C:\6l6w8.com
    C:\WINDOWS\system32\VirusRemoval.vbs
    
    Registry::
    [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{373c4757-f4bb-11dc-8dce-001aa025e80f}]
    
    Save the file to your desktop and name it CFScript.txt

    Then drag the CFScript.txt into the ComboFix.exe as shown in the screenshot below.

    [​IMG]


    This will start ComboFix again. It may ask to reboot. Post the contents of Combofix.txt in your next reply together with a new HijackThis log.
     
  13. akfak

    akfak Thread Starter

    Joined:
    Oct 31, 2007
    Messages:
    13
    Thanks!

    Here's the ComboFix log:

    ComboFix 08-06-20.4 - user 2008-06-26 10:10:01.2 - NTFSx86
    Running from: C:\Documents and Settings\user\Desktop\ComboFix.exe
    Command switches used :: C:\Documents and Settings\user\Desktop\CFScript.txt
    * Created a new restore point

    FILE ::
    C:\6l6w8.com
    C:\WINDOWS\system32\VirusRemoval.vbs
    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    C:\6l6w8.com

    .
    ((((((((((((((((((((((((( Files Created from 2008-05-26 to 2008-06-26 )))))))))))))))))))))))))))))))
    .

    2008-06-23 12:02 . 2008-06-23 12:02 <DIR> d-------- C:\WINDOWS\Sun
    2008-06-22 19:38 . 2008-03-25 02:37 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl
    2008-06-22 19:36 . 2008-06-22 19:38 <DIR> d-------- C:\Program Files\Java
    2008-06-22 18:20 . 2008-06-22 18:20 <DIR> d-------- C:\Program Files\Common Files\Java
    2008-06-11 10:16 . 2008-05-08 17:02 203,136 -----c--- C:\WINDOWS\system32\dllcache\rmcast.sys
    2008-06-11 08:33 . 2008-06-13 14:05 272,128 -----c--- C:\WINDOWS\system32\dllcache\bthport.sys
    2008-06-07 20:31 . 2008-06-07 20:31 <DIR> d-------- C:\WINDOWS\system32\scripting
    2008-06-07 20:31 . 2008-06-07 20:31 <DIR> d-------- C:\WINDOWS\system32\en
    2008-06-07 20:31 . 2008-06-07 20:31 <DIR> d-------- C:\WINDOWS\system32\bits
    2008-06-07 20:31 . 2008-06-07 20:31 <DIR> d-------- C:\WINDOWS\l2schemas
    2008-06-07 20:28 . 2008-06-07 20:32 <DIR> d-------- C:\WINDOWS\ServicePackFiles
    2008-06-07 20:15 . 2008-06-07 20:15 <DIR> d-------- C:\WINDOWS\EHome
    2008-06-07 20:01 . 2008-04-14 03:12 4,274,816 --------- C:\WINDOWS\system32\nv4_disp.dll
    2008-06-07 20:00 . 2008-04-14 03:12 1,737,856 --------- C:\WINDOWS\system32\mtxparhd.dll
    2008-06-07 19:59 . 2004-08-03 22:41 1,041,536 --------- C:\WINDOWS\system32\drivers\hsfdpsp2.sys
    2008-06-07 19:58 . 2008-04-14 03:11 136,192 --------- C:\WINDOWS\system32\aaclient.dll
    2008-06-07 19:58 . 2008-04-13 21:36 44,928 --------- C:\WINDOWS\system32\drivers\agpcpq.sys
    2008-06-07 19:58 . 2008-04-13 21:36 42,368 --------- C:\WINDOWS\system32\drivers\agp440.sys
    2008-06-07 19:58 . 2008-04-14 03:11 4,255 --------- C:\WINDOWS\system32\drivers\adv01nt5.dll
    2008-06-07 19:58 . 2008-04-14 03:11 3,967 --------- C:\WINDOWS\system32\drivers\adv02nt5.dll
    2008-06-07 19:58 . 2008-04-14 03:11 3,775 --------- C:\WINDOWS\system32\drivers\adv11nt5.dll
    2008-06-07 19:58 . 2008-04-14 03:11 3,711 --------- C:\WINDOWS\system32\drivers\adv09nt5.dll
    2008-06-07 19:58 . 2008-04-14 03:11 3,647 --------- C:\WINDOWS\system32\drivers\adv07nt5.dll
    2008-06-07 19:58 . 2008-04-14 03:11 3,615 --------- C:\WINDOWS\system32\drivers\adv05nt5.dll
    2008-06-07 19:58 . 2008-04-14 03:11 3,135 --------- C:\WINDOWS\system32\drivers\adv08nt5.dll
    2008-06-07 15:10 . 2008-06-26 09:51 54,156 --ah----- C:\WINDOWS\QTFont.qfn
    2008-06-07 15:10 . 2008-06-07 15:10 1,409 --a------ C:\WINDOWS\QTFont.for
    2008-06-07 15:08 . 2008-06-07 15:08 <DIR> d-------- C:\Program Files\iPod
    2008-06-07 15:07 . 2008-06-07 15:08 <DIR> d-------- C:\Program Files\iTunes
    2008-06-07 15:05 . 2008-06-07 15:05 <DIR> d-------- C:\Program Files\QuickTime

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-06-26 07:13 9,685,792 --sha-w C:\WINDOWS\system32\drivers\fidbox.dat
    2008-06-26 07:13 536,864 --sha-w C:\WINDOWS\system32\drivers\fidbox2.dat
    2008-06-26 07:02 --------- d-----w C:\Documents and Settings\All Users\Application Data\Google Updater
    2008-06-26 06:52 --------- d-----w C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
    2008-06-25 14:42 51,140 --sha-w C:\WINDOWS\system32\drivers\fidbox2.idx
    2008-06-25 14:42 130,412 --sha-w C:\WINDOWS\system32\drivers\fidbox.idx
    2008-06-13 11:05 272,128 ------w C:\WINDOWS\system32\drivers\bthport.sys
    2008-05-30 06:12 88,774 ----a-w C:\WINDOWS\system32\drivers\klick.dat
    2008-05-29 08:06 96,966 ----a-w C:\WINDOWS\system32\drivers\klin.dat
    2008-05-29 08:06 112,144 ----a-w C:\WINDOWS\system32\drivers\kl1.sys
    2008-05-22 16:43 --------- d-----w C:\Program Files\Microsoft Silverlight
    2008-05-15 14:32 --------- d-----w C:\Documents and Settings\user\Application Data\Launchy
    2008-05-08 14:02 203,136 ----a-w C:\WINDOWS\system32\drivers\rmcast.sys
    2008-05-07 05:12 1,288,192 ----a-w C:\WINDOWS\system32\quartz.dll
    2008-04-23 04:16 826,368 ----a-w C:\WINDOWS\system32\wininet.dll
    2008-04-14 02:42 985,088 ----a-w C:\WINDOWS\system32\setupapi.dll
    2008-04-14 02:42 11,264 ----a-w C:\WINDOWS\system32\spnpinst.exe
    2008-04-14 02:41 423,936 ----a-w C:\WINDOWS\system32\licdll.dll
    2008-04-14 00:25 1,804 ----a-w C:\WINDOWS\system32\dcache.bin
    2008-04-14 00:16 329,728 ----a-w C:\WINDOWS\system32\netsetup.exe
    2008-04-14 00:13 92,424 ----a-w C:\WINDOWS\system32\rdpdd.dll
    2008-04-14 00:13 87,176 ----a-w C:\WINDOWS\system32\rdpwsx.dll
    2008-04-14 00:13 299,520 ----a-w C:\WINDOWS\system32\drmclien.dll
    2008-04-14 00:13 12,168 ----a-w C:\WINDOWS\system32\tsddd.dll
    2008-04-14 00:11 997,376 ----a-w C:\WINDOWS\system32\msgina.dll
    2008-04-14 00:10 53,279 ----a-w C:\WINDOWS\system32\odbcji32.dll
    2008-04-14 00:10 4,126 ----a-w C:\WINDOWS\system32\msdxmlc.dll
    2008-04-14 00:10 3,584 ----a-w C:\WINDOWS\system32\msafd.dll
    2008-04-13 21:00 103,424 ----a-w C:\WINDOWS\system32\dpcdll.dll
    2008-04-13 19:30 1,845,632 ----a-w C:\WINDOWS\system32\win32k.sys
    2008-04-13 19:24 2,145,280 ----a-w C:\WINDOWS\system32\ntoskrnl.exe
    2008-04-13 18:44 17,664 ----a-w C:\WINDOWS\system32\watchdog.sys
    2008-04-13 18:35 24,064 ----a-w C:\WINDOWS\system32\pidgen.dll
    2008-04-13 18:31 7,424 ----a-w C:\WINDOWS\system32\kd1394.dll
    2008-04-13 18:31 2,023,936 ----a-w C:\WINDOWS\system32\ntkrnlpa.exe
    2008-04-13 18:30 61,440 ----a-w C:\WINDOWS\system32\msvcrt40.dll
    2008-04-13 18:14 76,800 ------w C:\WINDOWS\system32\msshavmsg.dll
    2008-04-13 17:39 438,784 ----a-w C:\WINDOWS\system32\xpob2res.dll
    2008-04-13 17:39 2,897,920 ----a-w C:\WINDOWS\system32\xpsp2res.dll
    2008-04-13 17:39 187,392 ----a-w C:\WINDOWS\system32\xpsp1res.dll
    2008-04-13 17:37 208,384 ----a-w C:\WINDOWS\system32\rsaenh.dll
    2008-04-13 17:37 138,752 ----a-w C:\WINDOWS\system32\dssenh.dll
    2008-04-13 17:28 2,940,928 ----a-w C:\WINDOWS\system32\wmploc.dll
    2008-04-13 17:27 79,872 ----a-w C:\WINDOWS\system32\msxml6r.dll
    2008-04-13 17:26 94,208 ----a-w C:\WINDOWS\system32\odbcint.dll
    2008-04-13 17:26 12,288 ----a-w C:\WINDOWS\system32\odbcp32r.dll
    2008-04-13 17:26 12,288 ----a-w C:\WINDOWS\system32\mscpx32r.dll
    2008-04-13 17:24 20,480 ----a-w C:\WINDOWS\system32\msorc32r.dll
    2008-04-13 17:23 8,192 ----a-w C:\WINDOWS\system32\asferror.dll
    2008-04-13 17:23 168,448 ----a-w C:\WINDOWS\system32\wmerror.dll
    2008-04-13 17:21 733,696 ----a-w C:\WINDOWS\system32\qedwipes.dll
    2008-04-13 17:09 4,096 ----a-w C:\WINDOWS\system32\dsprpres.dll
    2008-04-13 17:03 63,488 ----a-w C:\WINDOWS\system32\browselc.dll
    2008-04-13 17:03 549,376 ----a-w C:\WINDOWS\system32\shdoclc.dll
    2008-04-13 16:48 1,647,616 ----a-w C:\WINDOWS\system32\winbrand.dll
    2008-04-13 16:45 216,064 ----a-w C:\WINDOWS\system32\moricons.dll
    2008-04-13 16:23 48,128 ----a-w C:\WINDOWS\system32\msprivs.dll
    2008-04-13 16:22 48,128 ----a-w C:\WINDOWS\system32\inetres.dll
    2008-04-13 15:39 884,736 ----a-w C:\WINDOWS\system32\msimsg.dll
    .

    ((((((((((((((((((((((((((((( [email protected]_12.14.56.43 )))))))))))))))))))))))))))))))))))))))))
    .
    - 2008-06-25 09:01:47 2,048 --s-a-w C:\WINDOWS\bootstat.dat
    + 2008-06-26 06:51:48 2,048 --s-a-w C:\WINDOWS\bootstat.dat
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe" [2005-10-29 03:25 94208]
    "Picasa Media Detector"="C:\Program Files\Picasa2\PicasaMediaDetector.exe" [2008-02-26 04:23 443968]
    "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-14 03:12 15360]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 21:50 155648]
    "ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" [2006-01-03 04:41 45056]
    "SoundMAXPnP"="C:\Program Files\Analog Devices\Core\smax4pnp.exe" [2006-05-01 21:07 843776]
    "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 22:16 39792]
    "googletalk"="C:\Program Files\Google\Google Talk\googletalk.exe" [2007-01-02 00:22 3739648]
    "Google Desktop Search"="C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" [2008-04-18 18:46 29744]
    "HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2007-03-11 21:34 49152]
    "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-03-28 23:37 413696]
    "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-03-30 10:36 267048]
    "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe" [2008-03-25 04:28 144784]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "Picasa Media Detector"="C:\Program Files\Picasa2\PicasaMediaDetector.exe" [2008-02-26 04:23 443968]

    C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
    Google Updater.lnk - C:\Program Files\Google\Google Updater\GoogleUpdater.exe [2008-02-19 14:56:19 125624]
    HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2007-03-11 21:26:24 210520]
    Launchy.lnk - C:\Program Files\Launchy\Launchy.exe [2008-02-19 14:46:17 274432]
    Power Ge'ez 2005.lnk - C:\Program Files\Concepts Data Systems\Power Ge'ez 2005\pg2005.exe [2008-02-15 02:45:05 499712]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
    "AppInit_DLLs"=C:\PROGRA~1\Google\GOOGLE~3\GOEC62~1.DLL

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
    "DisableMonitoring"=dword:00000001

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
    "C:\\Program Files\\Google\\Google Talk\\googletalk.exe"=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
    "C:\\Program Files\\Kaspersky Lab\\Kaspersky Anti-Virus 7.0\\avp.exe"=
    "C:\\Program Files\\iTunes\\iTunes.exe"=

    R0 atiide;atiide;C:\WINDOWS\system32\DRIVERS\atiide.sys [2006-09-14 06:01]
    R3 klim5;Kaspersky Anti-Virus NDIS Filter;C:\WINDOWS\system32\DRIVERS\klim5.sys [2007-12-13 13:28]
    S3 GoogleDesktopManager-022208-143751;Google Desktop Manager 5.7.802.22438;"C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" [2008-04-18 18:46]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
    hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{77f5119f-e7d3-11dc-8dae-001aa025e80f}]
    \Shell\Auto\command - F:\Folders.exe
    \Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Folders.exe

    .
    Contents of the 'Scheduled Tasks' folder
    "2008-06-19 15:03:09 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
    - C:\Program Files\Apple Software Update\SoftwareUpdate.exe
    .
    **************************************************************************

    catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-06-26 10:13:10
    Windows 5.1.2600 Service Pack 3 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    Completion time: 2008-06-26 10:14:52
    ComboFix-quarantined-files.txt 2008-06-26 07:14:48
    ComboFix2.txt 2008-06-25 09:15:26

    Pre-Run: 10,649,190,400 bytes free
    Post-Run: 11,149,336,576 bytes free

    179 --- E O F --- 2008-06-20 17:02:40


    ----------------------------------------------------

    And here's the HijackThis log:

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 10:16:30 AM, on 6/26/2008
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16674)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
    C:\Program Files\Analog Devices\Core\smax4pnp.exe
    C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
    C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe
    C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
    C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Google\Google Updater\GoogleUpdater.exe
    C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    C:\Program Files\Launchy\Launchy.exe
    C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
    C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
    C:\WINDOWS\system32\wscntfy.exe
    C:\WINDOWS\system32\notepad.exe
    C:\WINDOWS\explorer.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://sujin.com.np/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page = http://go.microsoft.com/fwlink/?LinkId=54843
    O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Smart Web Printing\hpswp_printenhancer.dll
    O2 - BHO: HP Print Clips - {053F9267-DC04-4294-A72C-58F732D338C0} - C:\Program Files\HP\Smart Web Printing\hpswp_framework.dll
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
    O2 - BHO: Encarta Web Companion Helper Object - {955BE0B8-BC85-4CAF-856E-8E0D8B610560} - C:\Program Files\Common Files\Microsoft Shared\Encarta Web Companion\2007\ENCWCBAR.DLL
    O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll
    O3 - Toolbar: Encarta Web Companion - {147D6308-0614-4112-89B1-31402F9B82C4} - C:\Program Files\Common Files\Microsoft Shared\Encarta Web Companion\2007\ENCWCBAR.DLL
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
    O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
    O4 - HKLM\..\Run: [googletalk] C:\Program Files\Google\Google Talk\googletalk.exe /autostart
    O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
    O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe"
    O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe"
    O4 - HKCU\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKUS\S-1-5-18\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'Default user')
    O4 - Global Startup: Google Updater.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
    O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    O4 - Global Startup: Launchy.lnk = C:\Program Files\Launchy\Launchy.exe
    O4 - Global Startup: Power Ge'ez 2005.lnk = ?
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
    O9 - Extra button: Web Anti-Virus statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\SCIEPlgn.dll
    O9 - Extra button: HP Clipbook - {58ECB495-38F0-49cb-A538-10282ABF65E7} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll
    O9 - Extra button: HP Smart Select - {700259D7-1666-479a-93B1-3250410481E8} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: Encarta Search Bar - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Common Files\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/win...ls/en/x86/client/wuweb_site.cab?1208243615234
    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/mic...ls/en/x86/client/muweb_site.cab?1208268406765
    O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~3\GOEC62~1.DLL
    O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
    O23 - Service: Kaspersky Anti-Virus 7.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
    O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
    O23 - Service: Google Desktop Manager 5.7.802.22438 (GoogleDesktopManager-022208-143751) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

    --
    End of file - 8149 bytes


    Thanks again!
     
  14. Cookiegal

    Cookiegal Administrator Malware Specialist Coordinator

    Joined:
    Aug 27, 2003
    Messages:
    115,269
    Can you tell me what your F drive is? Is it an external or flash drive?

    Please insert it before doing the following:

    I'm attaching a MountPoints Diagnostic.zip file to this post. Save it to your desktop. Unzjip it and double click the MountPoints Diagnostic.bat file and let it run. It will create a report in Notepad named Diagnostic.txt. Please upload the Diagnostic.txt file as an attachment.
     

    Attached Files:

  15. akfak

    akfak Thread Starter

    Joined:
    Oct 31, 2007
    Messages:
    13
    Yeah,

    It looks like I've gotten a virus now on my flash disk, which is the F: drive. The problem is that no one here understands how to update their virus definitions, so if I need to give someone a document, my flash disk always gets a virus.

    Question (which I suppose you'll help me answer anyway): How do I get rid of this virus? I always format the hard drive (taking the important docs off first, of course). Problem is, I've got another external hard drive with over 100GB of stuff on it that now has a virus. I don't have the storage anywhere else to move these docs to format the drive...I also think my iPod has a virus. (I am in virus hell!)

    Anyway, I have attached the diagnostic.txt file. I see that it's got an autorun.inf file on it...
     

    Attached Files:

  16. Sponsor

As Seen On
As Seen On...

Welcome to Tech Support Guy!

Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.

If you're not already familiar with forums, watch our Welcome Guide to get started.

Join over 733,556 other people just like you!

Thread Status:
Not open for further replies.

Short URL to this thread: https://techguy.org/699841

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Dismiss Notice