Please help I can't seem to shake this infection

Unknown · June 2007

Logfile of HijackThis v1.99.1
Scan saved at 7:22:19 PM, on 6/13/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Adobe\Reader 8.0\Reader\AcroRd32.exe
C:\Documents and Settings\Chris\Desktop\HijackThis.exe

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [PtiuPbmd] Rundll32.exe ptipbm.dll,SetWriteBack
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKCU\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /0
O4 - HKCU\..\Run: [AdobeUpdater] C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://housecall65.trendmicro.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {E8F628B5-259A-4734-97EE-BA914D7BE941} (Driver Agent ActiveX Control) - http://driveragent.com/files/driveragent.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Net Agent - Unknown owner - C:\WINDOWS\dls0523pmw.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Windows Overlay Components - Unknown owner - C:\WINDOWS\wgesrgu.exe

peku006 · June 2007

Hi perasite and welcome to Icrontic Spyware & Virus Removal I'm checking your log, so please be patient.

peku006 · June 2007

Hi perasite
I don't see any indication of a Firewall in your HijackThis log.
What Firewall you use?

Please do the following...

step 1
You currently are running HijackThis from here:
C:\Documents and Settings\Chris\Desktop\HijackThis.exe
Please make a folder here:
c:\HJT
place HijackThis in that folder and
rename hijackthis.exe to scanner.exe

step 2
Run HijackThis
Click on the Scan button
Put a check beside all of the items listed below (if present):
O23 - Service: Windows Overlay Components - Unknown owner - C:\WINDOWS\wgesrgu.exe
O23 - Service: Net Agent - Unknown owner - C:\WINDOWS\dls0523pmw.exe
Close all open windows and browsers
Click on the "Fix Checked" button
When completed, close the application.

step 3
Please copy (Ctrl+C) and paste (Ctrl+V) the following text in the quote to Notepad. Save it as "All Files" and name it FixServices.bat Please save it on your desktop.

@echo off
sc stop"Net Agent"
sc delete"Net Agent"
sc stop"Windows Overlay Components"
sc delete"Windows Overlay Components"
exit

Double click FixServices.bat. A window will open and close. This is normal.

step 4
Download combofix from one of these links:
Link1
Link2
Double click combofix.exe & follow the prompts.
When finished, it shall produce a log for you.
Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall

step 5
Open HijackThis
- Click the Do a system scan and save a log file button

step 6
Please, post these logs:
combofix.log
hjt-log

perasite · June 2007

ok thanks.

HJT log:

Logfile of HijackThis v1.99.1
Scan saved at 2:12:45 PM, on 6/14/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\HJT\scanner.exe.exe

O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {5ADF3862-9E2E-4ad3-86F7-4510E6550CD0} - C:\WINDOWS\system32\frlgcxfj.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: (no name) - {B8D3CDAA-D4CD-4C9A-ADA0-F016E4423202} - C:\Program Files\Windows Media Player\hoqe.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [PtiuPbmd] Rundll32.exe ptipbm.dll,SetWriteBack
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKCU\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /0
O4 - HKCU\..\Run: [AdobeUpdater] C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://housecall65.trendmicro.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {E8F628B5-259A-4734-97EE-BA914D7BE941} (Driver Agent ActiveX Control) - http://driveragent.com/files/driveragent.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

combo fix log:

ComboFix 07-06-13.3
"Chris" - 2007-06-14 14:04:25 - Service Pack 2 NTFS

(((((((((((((((((((((((((((((((((((((((((((( V Log )))))))))))))))))))))))))))))))))))))))))))))))))))))))

C:\WINDOWS\system32\mllmk.dll
C:\WINDOWS\system32\sstqo.dll
C:\WINDOWS\system32\bgbfxvch.dll
C:\WINDOWS\system32\gebyw.dll
C:\WINDOWS\system32\kiysmnhv.dll
C:\WINDOWS\system32\lmvmjsom.dll
C:\WINDOWS\system32\uqdpcdwa.dll
C:\WINDOWS\system32\uvaclvvu.dll
C:\WINDOWS\system32\vtstr.dll
C:\WINDOWS\system32\urqomli.dll
C:\WINDOWS\system32\kmllm.ini
C:\WINDOWS\system32\opqss.bak1
C:\WINDOWS\system32\opqss.bak2
C:\WINDOWS\system32\opqss.ini
C:\WINDOWS\system32\oqtss.ini
C:\WINDOWS\system32\wybeg.ini
C:\WINDOWS\system32\vhnmsyik.ini
C:\WINDOWS\system32\awdcpdqu.ini
C:\WINDOWS\system32\uvvlcavu.ini
C:\WINDOWS\system32\rtstv.ini
C:\WINDOWS\system32\opqss.bak1
C:\WINDOWS\system32\opqss.bak2
C:\WINDOWS\system32\opqss.ini
C:\WINDOWS\system32\ssqpo.dll
C:\WINDOWS\system32\hggddba.dll

* * * POST RUN FILES/FOLDERS * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

C:\DOCUME~1\Chris\APPLIC~1.\tsks~1
C:\DOCUME~1\Chris\MYDOCU~1.\stem~1
C:\Program Files\Messenger\lacury.dll
C:\Program Files\Messenger\prolygu.html
C:\Temp\0b9
C:\Temp\0b9\tmpTF.log
C:\Temp\tn3
C:\WINDOWS\cfg32.exe
C:\WINDOWS\cfg32a.exe
C:\WINDOWS\cs_cache.ini
C:\WINDOWS\dls0523pmw.exe
C:\WINDOWS\offun.exe
C:\WINDOWS\rau001978.exe
C:\WINDOWS\retadpu1000106.exe
C:\WINDOWS\retadpu2000219.exe
C:\WINDOWS\system32\drivers\core.cache.dsk
C:\WINDOWS\system32\drivers\core.sys
C:\WINDOWS\system32\dwdsregt.exe
C:\WINDOWS\system32\msnav32.ax
C:\WINDOWS\system32\owinpndt.exe
C:\WINDOWS\system32\pog
C:\WINDOWS\system32\T3
C:\WINDOWS\system32\T3\am67.exe
C:\WINDOWS\system32\T4
C:\WINDOWS\system32\T4\amst5.exe
C:\WINDOWS\wr.txt

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

\LEGACY_CORE

\core

((((((((((((((((((((((((( Files Created from 2007-05-14 to 2007-06-14 )))))))))))))))))))))))))))))))

2007-06-14 14:00 105,434 --a

C:\WINDOWS\qwr67.exe
2007-06-14 13:57 49,152 --a

C:\WINDOWS\nircmd.exe
2007-06-14 13:54 <DIR> d

C:\HJT
2007-06-13 22:38 62,516 --a

C:\WINDOWS\system32\frlgcxfj.dll
2007-06-13 08:31 <DIR> d

C:\DOCUME~1\Chris\.housecall6.6
2007-06-13 08:28 <DIR> d

C:\Program Files\Lavasoft
2007-06-13 08:28 <DIR> d

C:\DOCUME~1\Chris\APPLIC~1\Lavasoft
2007-06-11 12:29 <DIR> d

C:\Program Files\Enigma Software Group
2007-06-10 22:34 2,580 --a

C:\WINDOWS\system32\nmlejdai.exe
2007-06-10 22:28 499,712 --a

C:\WINDOWS\system32\msvcp71.dll
2007-06-10 22:28 348,160 --a

C:\WINDOWS\system32\msvcr71.dll
2007-06-10 22:28 24,064 --a

C:\WINDOWS\system32\msxml3a.dll
2007-06-10 22:28 <DIR> dr

C:\DOCUME~1\ALLUSE~1\APPLIC~1\SalesMonitor
2007-06-10 22:28 <DIR> d--hs---- C:\UWA7P
2007-06-10 22:28 <DIR> d

C:\DOCUME~1\ALLUSE~1\APPLIC~1\WinAntiVirus Pro 2007
2007-06-10 22:16 932 --a

C:\WINDOWS\system32\winpfz32.sys
2007-06-10 22:16 46,592 --a

C:\WINDOWS\wgesrgu.exe
2007-06-10 22:16 391,920 -r-hs---- C:\WINDOWS\wgesrguA.exe
2007-06-10 22:16 <DIR> d

C:\WINDOWS\system32\TQ0
2007-06-10 22:16 <DIR> d

C:\WINDOWS\system32\T7
2007-06-10 22:16 <DIR> d

C:\WINDOWS\system32\T6
2007-06-10 22:16 <DIR> d

C:\WINDOWS\system32\T1QaSQ
2007-06-10 22:16 <DIR> d

C:\Temp\x2b
2007-06-10 22:16 <DIR> d

C:\Temp
2007-06-09 23:04 178,408 --a

C:\WINDOWS\system32\muweb.dll
2007-06-09 23:04 127,208 --a

C:\WINDOWS\system32\mucltui.dll
2007-06-09 22:57 32,592 --a

C:\WINDOWS\system32\msonpmon.dll
2007-06-09 22:56 <DIR> d

C:\Program Files\MSBuild
2007-06-09 22:56 <DIR> d

C:\Program Files\Microsoft Works
2007-06-09 22:55 <DIR> d

C:\Program Files\Microsoft.NET
2007-06-09 22:53 <DIR> d

C:\WINDOWS\SHELLNEW
2007-06-09 22:52 <DIR> d

C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft Help
2007-06-09 22:51 <DIR> dr-h

C:\MSOCache
2007-06-09 22:51 <DIR> d

C:\WINDOWS\SxsCaPendDel
2007-05-31 10:37 <DIR> d

C:\DOCUME~1\Chris\APPLIC~1\Yahoo!
2007-05-31 10:31 <DIR> d

C:\DOCUME~1\ALLUSE~1\APPLIC~1\Yahoo!
2007-05-31 10:30 <DIR> d

C:\Program Files\Yahoo!

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-06-14 18:07:10

d

w C:\Program Files\Messenger
2007-06-10 02:01:27

d

w C:\DOCUME~1\Chris\APPLIC~1\uTorrent
2007-06-05 18:06:08

d

w C:\Program Files\World of Warcraft
2007-05-16 15:12:02 683,520 ----a-w C:\WINDOWS\system32\inetcomm.dll
2007-05-11 19:23:43

d

w C:\Program Files\Xvid
2007-05-08 20:40:04

d

w C:\DOCUME~1\Chris\APPLIC~1\MySpace
2007-05-08 20:40:03

d

w C:\Program Files\MySpace
2007-04-25 14:21:15 144,896 ----a-w C:\WINDOWS\system32\schannel.dll
2007-04-20 22:34:08

d

w C:\DOCUME~1\Chris\APPLIC~1\Turbine
2007-04-20 11:55:24

d

w C:\Program Files\Turbine
2007-04-20 11:54:53

d

w C:\DOCUME~1\Chris\APPLIC~1\GetRightToGo
2007-04-18 16:12:23 2,854,400 ----a-w C:\WINDOWS\system32\msi.dll
2007-04-17 06:46:43

d

w C:\Program Files\utorrent
2007-03-17 13:43:01 292,864 ----a-w C:\WINDOWS\system32\winsrv.dll
2007-03-15 16:23:16 497,496 ----a-w C:\WINDOWS\system32\XceedZip.dll
2007-03-15 16:19:58 526,184 ----a-w C:\WINDOWS\system32\XceedCry.dll

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]
{5ADF3862-9E2E-4ad3-86F7-4510E6550CD0}=C:\WINDOWS\system32\frlgcxfj.dll [2007-06-13 22:38]
{72853161-30C5-4D22-B7F9-0BBC1D38A37E}=C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL [2006-10-27 00:48]
{AA58ED58-01DD-4d91-8333-CF10577473F7}=c:\program files\google\googletoolbar3.dll [2007-01-20 00:55]
{B8D3CDAA-D4CD-4C9A-ADA0-F016E4423202}=C:\Program Files\Windows Media Player\hoqe.dll [2007-04-06 15:27]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"nwiz"="nwiz.exe" [2006-10-22 13:22 C:\WINDOWS\system32\nwiz.exe]
"PtiuPbmd"="ptipbm.dll" [2003-01-15 07:41 C:\WINDOWS\system32\ptipbm.dll]
"SoundMan"="SOUNDMAN.EXE" [2004-06-18 04:31 C:\WINDOWS\SOUNDMAN.EXE]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-10-22 13:22]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpySweeper"="C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" [2004-09-13 10:21]
"AdobeUpdater"="C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe" [2007-03-01 10:37]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2006-02-28 08:00]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"MySpaceIM"=C:\Program Files\MySpace\IM\MySpaceIM.exe

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0]
Source= C:\Program Files\Messenger\prolygu.html
FriendlyName=

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"="C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL" [2006-10-27 00:48]

**************************************************************************

catchme 0.3.721 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2007-06-14 14:10:20
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-06-14 14:11:02 - machine was rebooted
C:\ComboFix-quarantined-files.txt ... 2007-06-14 14:10

--- E O F ---

peku006 · June 2007

Hi perasite
Please do the following...

step 1

Download

RogueRemover by malwarebytes.org from here
Double-click on rr-free-setup.exe to start the installation of RogueRemover
Click Next
Click I agree
Click Install
Untick Show Readme
Click Finish
This will now launch RogueRemover
Close the help window
Click Check for updates
If there are any updates found click Download
Wait for any updates to finish downloading/installing, then click Close in the update window
Click on Scan
If nothing is found, then close RogueRemover
If RogueRemover did find something, it will present a list of detected items
Click on Save log
Click OK at the prompt
Click Remove selected
Click YES at the prompt
Wait for removal to complete & then close RogueRemover
Use notepad to open this file
- C:\Program Files\RogueRemover\RRLog******.txt
Note: ****** is the time when you ran RogueRemover
Post the contents of that file as a reply to this topic

step2
Run HijackThis
Click on the Scan button
Put a check beside all of the items listed below (if present):
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: (no name) - {5ADF3862-9E2E-4ad3-86F7-4510E6550CD0} - C:\WINDOWS\system32\frlgcxfj.dll
O2 - BHO: (no name) - {B8D3CDAA-D4CD-4C9A-ADA0-F016E4423202} - C:\Program Files\Windows Media Player\hoqe.dll
Close all open windows and browsers
Click on the "Fix Checked" button
When completed, close the application.

step 3
Please Open notepad and copy/paste the text in the quotebox below into it:

File::
C:\WINDOWS\qwr67.exe
C:\WINDOWS\system32\frlgcxfj.dll
C:\WINDOWS\system32\nmlejdai.exe
C:\WINDOWS\system32\winpfz32.sys
C:\WINDOWS\wgesrgu.exe
C:\WINDOWS\wgesrguA.exe
C:\WINDOWS\system32\T1QaSQ
C:\WINDOWS\system32\T6
C:\WINDOWS\system32\T7
C:\WINDOWS\system32\TQ0

Folder::
C:\UWA7P

Registry::
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Explorer\Browser Helper Objects]
{B8D3CDAA-D4CD-4C9A-ADA0-F016E4423202}=-
[-HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0]

Save this as ComboFix-Do.txt
Then drag the ComboFix-Do.txt into ComboFix.exe as you see in the screenshot below.

This will start ComboFix again. After reboot, (in case it asks to reboot),

step 4
Open HijackThis
- Click the Do a system scan and save a log file button

step 5
Please, post these logs:
RR. Log
Combofix.log
Hjt-log

perasite · June 2007

"Chris" - 2007-06-28 18:11:28 - ComboFix 07-06-27.7 - Service Pack 2 NTFS
Command switches used :: C:\HJT\ComboFix-Do.txt

(((((((((((((((((((((((((((((((((((((((((((( V Log )))))))))))))))))))))))))))))))))))))))))))))))))))))))

C:\WINDOWS\system32\frlgcxfj.dll

* * * POST RUN FILES/FOLDERS * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

C:\DOCUME~1\ALLUSE~1\APPLIC~1.\salesmonitor
C:\UWA7P
C:\WINDOWS\qwr67.exe
C:\WINDOWS\system32\frlgcxfj.dll
C:\WINDOWS\system32\nmlejdai.exe
C:\WINDOWS\system32\T1QaSQ
C:\WINDOWS\system32\T6
C:\WINDOWS\system32\T6\amwr.exe
C:\WINDOWS\system32\T7
C:\WINDOWS\system32\T7\wb22.exe
C:\WINDOWS\system32\TQ0
C:\WINDOWS\system32\winpfz32.sys
C:\WINDOWS\system32\zxdnt3d.cfg
C:\WINDOWS\wgesrgu.exe
C:\WINDOWS\wgesrguA.exe

((((((((((((((((((((((((( Files Created from 2007-05-28 to 2007-06-28 )))))))))))))))))))))))))))))))

2007-06-28 18:00 <DIR> d

C:\Program Files\RogueRemover
2007-06-14 13:57 49,152 --a

C:\WINDOWS\nircmd.exe
2007-06-14 13:54 <DIR> d

C:\HJT
2007-06-13 08:31 <DIR> d

C:\DOCUME~1\Chris\.housecall6.6
2007-06-13 08:28 <DIR> d

C:\Program Files\Lavasoft
2007-06-13 08:28 <DIR> d

C:\DOCUME~1\Chris\APPLIC~1\Lavasoft
2007-06-11 12:29 <DIR> d

C:\Program Files\Enigma Software Group
2007-06-10 22:28 499,712 --a

C:\WINDOWS\system32\msvcp71.dll
2007-06-10 22:28 348,160 --a

C:\WINDOWS\system32\msvcr71.dll
2007-06-10 22:28 24,064 --a

C:\WINDOWS\system32\msxml3a.dll
2007-06-10 22:28 <DIR> d

C:\DOCUME~1\ALLUSE~1\APPLIC~1\WinAntiVirus Pro 2007
2007-06-10 22:16 <DIR> d

C:\Temp\x2b
2007-06-10 22:16 <DIR> d

C:\Temp
2007-06-09 23:04 271,224 --a

C:\WINDOWS\system32\mucltui.dll
2007-06-09 23:04 208,248 --a

C:\WINDOWS\system32\muweb.dll
2007-06-09 22:57 32,592 --a

C:\WINDOWS\system32\msonpmon.dll
2007-06-09 22:56 <DIR> d

C:\Program Files\MSBuild
2007-06-09 22:56 <DIR> d

C:\Program Files\Microsoft Works
2007-06-09 22:55 <DIR> d

C:\Program Files\Microsoft.NET
2007-06-09 22:53 <DIR> d

C:\WINDOWS\SHELLNEW
2007-06-09 22:52 <DIR> d

C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft Help
2007-06-09 22:51 <DIR> dr-h

C:\MSOCache
2007-06-09 22:51 <DIR> d

C:\WINDOWS\SxsCaPendDel
2007-05-31 10:37 <DIR> d

C:\DOCUME~1\Chris\APPLIC~1\Yahoo!
2007-05-31 10:31 <DIR> d

C:\DOCUME~1\ALLUSE~1\APPLIC~1\Yahoo!
2007-05-31 10:30 <DIR> d

C:\Program Files\Yahoo!

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-06-28 18:23:05

d

w C:\Program Files\World of Warcraft
2007-06-14 18:07:10

d

w C:\Program Files\Messenger
2007-06-10 02:01:27

d

w C:\DOCUME~1\Chris\APPLIC~1\uTorrent
2007-05-16 15:12:02 683,520 ----a-w C:\WINDOWS\system32\inetcomm.dll
2007-05-11 19:23:43

d

w C:\Program Files\Xvid
2007-05-08 20:40:04

d

w C:\DOCUME~1\Chris\APPLIC~1\MySpace
2007-05-08 20:40:03

d

w C:\Program Files\MySpace
2007-04-25 14:21:15 144,896 ----a-w C:\WINDOWS\system32\schannel.dll
2007-04-18 16:12:23 2,854,400 ----a-w C:\WINDOWS\system32\msi.dll
2007-04-17 02:47:36 33,624 ----a-w C:\WINDOWS\system32\wups.dll
2007-04-17 02:45:54 1,710,936 ----a-w C:\WINDOWS\system32\wuaueng.dll
2007-04-17 02:45:48 549,720 ----a-w C:\WINDOWS\system32\wuapi.dll
2007-04-17 02:45:42 325,976 ----a-w C:\WINDOWS\system32\wucltui.dll
2007-04-17 02:45:36 203,096 ----a-w C:\WINDOWS\system32\wuweb.dll
2007-04-17 02:45:28 92,504 ----a-w C:\WINDOWS\system32\cdm.dll
2007-04-17 02:45:20 53,080 ----a-w C:\WINDOWS\system32\wuauclt.exe
2007-04-17 02:45:20 43,352 ----a-w C:\WINDOWS\system32\wups2.dll

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]
{72853161-30C5-4D22-B7F9-0BBC1D38A37E}=C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL [2006-10-27 00:48]
{AA58ED58-01DD-4d91-8333-CF10577473F7}=c:\program files\google\googletoolbar3.dll [2007-01-20 00:55]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"nwiz"="nwiz.exe" [2006-10-22 13:22 C:\WINDOWS\system32\nwiz.exe]
"PtiuPbmd"="ptipbm.dll" [2003-01-15 07:41 C:\WINDOWS\system32\ptipbm.dll]
"SoundMan"="SOUNDMAN.EXE" [2004-06-18 04:31 C:\WINDOWS\SOUNDMAN.EXE]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-10-22 13:22]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpySweeper"="C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" [2004-09-13 10:21]
"AdobeUpdater"="C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe" [2007-03-01 10:37]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2006-02-28 08:00]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"MySpaceIM"=C:\Program Files\MySpace\IM\MySpaceIM.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"="C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL" [2006-10-27 00:48]

**************************************************************************

catchme 0.3.721 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2007-06-28 18:13:37
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-06-28 18:14:24 - machine was rebooted
C:\ComboFix-quarantined-files.txt ... 2007-06-28 18:14
C:\ComboFix2.txt ... 2007-06-14 14:11

--- E O F ---

Logfile of HijackThis v1.99.1
Scan saved at 6:17:34 PM, on 6/28/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\HJT\scanner.exe.exe

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [PtiuPbmd] Rundll32.exe ptipbm.dll,SetWriteBack
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKCU\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /0
O4 - HKCU\..\Run: [AdobeUpdater] C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://housecall65.trendmicro.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {E8F628B5-259A-4734-97EE-BA914D7BE941} (Driver Agent ActiveX Control) - http://driveragent.com/files/driveragent.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

RR didn't give me an option to save a log.

peku006 · June 2007

Hi perasite

You aren't running Anti Virus Software. Please download and install one of them first!!!
Use an Anti Virus Software - It is very important that your computer has an anti-virus software running on your machine. This alone can save you a lot of trouble with malware in the future. See this link for a listing of some on line & their stand-alone anti virus programs:
Computer Safety On line - Anti-Virus
I use AVG Anti-Virus (Free Edition) but you might just prefer something different!
Update your Anti Virus Software - It is imperitive that you update your Anti virus software at least once a week (Even more if you wish). If you do not update your anti virus software then it will not be able to catch any of the new variants that may come out.

it seems you don't have any evidence of a third party firewall.
As the term conveys, a firewall is an extra layer of security installed onto computers, which restricts access to systems from the outside world. Firewalls protect against hackers and malicious intruders. I want you to download a free firewall NOW from one of these excellent vendors:
1) ZoneAlarm
2) Agnitum
3) Sunbelt/Kerio
4) Comodo
If you are using the built-in Windows XP firewall, it is not recommended as it does not block outgoing connections. This means that any malware on your computer is free to "phone home" for more instructions. Simply put, Windows XP contains a mediocre firewall. This firewall is NO replacement for a dedicated software solution. Remember to use only one firewall at the same time.

As you did this, we can begin with the fix.
Step 1: Delete bad programs

Click Start
Go to Control Panel
Go to Add/Remove Programs
Find and click Remove for the following (if present):
WinAntiVirus Pro 2007

Step 2: Delete bad folders
Use Explorer to navigate to and delete the following folders (if they are present):

Folders:
C:\Documents and Settings\All Users\Application Data\WinAntiVirus Pro 2007
C:\Temp
Now just exit Explorer

Step 3: Run Panda active scan
Please run this online scan:
Panda ActiveScan

Once you are on the Panda site, click the Scan your PC button
A new window will open...click the Check Now button
Enter your Country
Enter your State/Province
Enter your e-mail address and click send
Select either Home User or Company
Click the big Scan Now button
If it wants to install an ActiveX component allow it
It will start downloading the files it requires for the scan (Note: It may take a couple of minutes)
When download is complete, click on Local Disks to start the scan
When the scan completes, if anything malicious is detected, click the See Report button, then Save Report and save it to a convenient location.

Post the contents of the Panda scan report, along with a new HijackThis Log

Please help I can't seem to shake this infection

Comments