Yet another NOD32 winlogon.exe ursnif.a virus

Unknown · June 2009

Hello,

Beginning last week, NOD32's AMON module detected the following threat:

File: C:\WINDOWS\SYSTEM32\WINLOGON.EXE
Threat: Win32/Spy.Ursnif.A virus

I am unable to select the Clean option, and since this is probably a necessary system file, Delete and Rename do not seem to be viable options. I have also run Malwarebytes with no success (detects virus, unable to clean). Below is the HijackThis Log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:12:27 AM, on 6/28/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16850)
Boot mode: Normal

Running processes:
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Launch Manager\QtZgAcer.EXE
C:\Program Files\Eset\nod32kui.exe
C:\acer\epm\epm-dm.exe
C:\Program Files\Taskbar Shuffle\taskbarshuffle.exe
C:\Program Files\StickyPad\StickyPad.exe
C:\Program Files\Desktop Calendar\Desktop Calendar.exe
C:\Acer\eManager\anbmServ.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
C:\Program Files\Eset\nod32krn.exe
C:\Program Files\Common Files\SafeNet Sentinel\Sentinel Protection Server\WinNT\spnsrvnt.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\TightVNC\WinVNC.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Mozilla Thunderbird\thunderbird.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?

LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?

LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?

LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?

LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://global.acer.com/
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\sdra64.exe,
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program

Files\Adobe\Adobe Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: bho2gr Class - {31FF080D-12A3-439A-A2EF-4BA95A3148E8} - C:\Program Files\GetRight\xx2gr.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06

\bin\ssv.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program

Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Adobe Acrobat

7.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: (no name) - {DE9C389F-3316-41A7-809B-AA305ED9D922} - (no file)
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [LManager] C:\Program Files\Launch Manager\QtZgAcer.EXE
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [WinVNC] "C:\Program Files\TightVNC\WinVNC.exe" -servicehelper
O4 - HKLM\..\Run: [EPM-DM] c:\acer\epm\epm-dm.exe
O4 - HKLM\..\Run: [ePowerManagement] C:\Acer\ePM\ePM.exe boot
O4 - HKCU\..\Run: [Taskbar Shuffle] C:\Program Files\Taskbar Shuffle\taskbarshuffle.exe
O4 - HKCU\..\Run: [Sticky Pad] C:\Program Files\StickyPad\StickyPad.exe
O4 - HKCU\..\Run: [Desktop Calendar] C:\Program Files\Desktop Calendar\Desktop Calendar.exe
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Adobe

Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Adobe

Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Adobe

Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Adobe

Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Adobe Acrobat

7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Adobe

Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0

\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0

\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Download with GetRight - C:\Program Files\GetRight\GRdownload.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11

\EXCEL.EXE/3000
O8 - Extra context menu item: Open with GetRight Browser - C:\Program Files\GetRight\GRbrowse.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06

\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program

Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11

\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program

Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program

Files\Messenger\msmsgs.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems

Shared\Service\Adobelmsvc.exe
O23 - Service: Notebook Manager Service (anbmService) - OSA Technologies Inc. -

C:\Acer\eManager\anbmServ.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Diskeeper - Diskeeper Corporation - C:\Program Files\Diskeeper

Corporation\Diskeeper\DkService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common

Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SentinelProtectionServer - SafeNet, Inc - C:\Program Files\Common Files\SafeNet

Sentinel\Sentinel Protection Server\WinNT\spnsrvnt.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program

Files\Viewpoint\Common\ViewpointService.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. -

C:\WINDOWS\wanmpsvc.exe
O23 - Service: VNC Server (winvnc) - TightVNC Group - C:\Program Files\TightVNC\WinVNC.exe

--
End of file - 7512 bytes

Katana · June 2009

Please note that all instructions given are customised for this computer only,
the tools used may cause damage if used on a computer with different infections.

If you think you have similar problems, please post a log in the HJT forum and wait for help.

Hello and welcome to the forums

My name is Katana and I will be helping you to remove any infection(s) that you may have.

Please observe these rules while we work:

Please Read All Instructions Carefully
If you don't understand something, stop and ask! Don't keep going on.
Please do not run any other tools or scans whilst I am helping you
Failure to reply within 5 days will result in the topic being closed.
Please continue to respond until I give you the "All Clear"
(Just because you can't see a problem doesn't mean it isn't there)

If you can do those few things, everything should go smoothly

Please Note, your security programs may give warnings for some of the tools I will ask you to use.
Be assured, any links I give are safe

==============================WARNING==============================
There is some evidence of what may be a very nasty infection.
If the Computer has been used for any important data, you are strongly advised to do the following, immediately:

If you have ever used this computer for shopping, banking, or any transactions relating to your financial well being:
Call all of your banks, credit card companies, and financial institutions, informing them that you may be a victim of identity theft, and to put a watch on your accounts or change all your account numbers.
From a clean computer, change ALL your online passwords -- for ISP login, email, banks, financial accounts, PayPal, eBay, online companies, and any online forums or groups you belong to.
DO NOT change passwords or do any transactions while using the infected computer because the attacker will get the new password and transaction information.
Take any other steps you think appropriate for an attempted identity theft.

==============================WARNING==============================

What infection does MBAM detect that it can't remove ?

Step 1

Malwarebytes' Anti-Malware

Start MalwareBytes AntiMalware
- Update Malwarebytes' Anti-Malware
- Select the Update tab
- Click Update
When the update is complete, select the Scanner tab
Select Perform full scan, then click Scan.
When the scan is complete, click OK, then Show Results to view the results.
Be sure that everything is checked, and click Remove Selected.
When completed, a log will open in Notepad. please copy and paste the log into your next reply
- If you accidently close it, the log file is saved here and will be named like this:
- C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\mbam-log-date (time).txt

Step 2

Download and Run ComboFix (by sUBs)
Please visit this webpage for instructions for downloading and running ComboFix:

Bleeping Computer ComboFix Tutorial

You must download it to and run it from your Desktop
Now STOP all your monitoring programs (Antivirus/Antispyware, Guards and Shields) as they could easily interfere with ComboFix.
Double click combofix.exe & follow the prompts.
When finished, it will produce a log. Please save that log to post in your next reply
Re-enable all the programs that were disabled during the running of ComboFix..

A word of warning: Neither I nor sUBs are responsible for any damage you may have caused your machine by running ComboFix on your own.
This tool is not a toy and not for everyday use.
ComboFix SHOULD NOT be used unless requested by a forum helper

Step 3

Installed Programs

Please could you give me a list of the programs that are installed.

Start HijackThis
Click on the Misc Tools button
Click on the Open Uninstall Manager button.

You will see a list with the programs installed in your computer.
Click on save list button and specify where you would like to save this file.
When you press Save button a notepad will open with the contents of that file.
Simply copy and paste the contents of that notepad into your next post.

Logs/Information to Post in Reply
Please post the following logs/Information in your reply

MalwareBytes Log
Combofix Log
Installed Programs List

aznintent · June 2009

The following logs have been posted:

MalwareBytes
*There are alot more infections detected this time compared to the first time I ran the program.

Malwarebytes' Anti-Malware 1.38
Database version: 2347
Windows 5.1.2600 Service Pack 2

6/28/2009 10:24:35 PM
mbam-log-2009-06-28 (22-24-35).txt

Scan type: Full Scan (C:\|D:\|)
Objects scanned: 178224
Time elapsed: 52 minute(s), 59 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 4
Registry Values Infected: 1
Registry Data Items Infected: 2
Folders Infected: 1
Files Infected: 156

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{19127ad2-394b-70f5-c650-b97867baa1f7} (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{43bf8cd1-c5d5-2230-7bb2-98f22c2b7dc6} (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{19127ad2-394b-70f5-c650-b97867baa1f7} (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{43bf8cd1-c5d5-2230-7bb2-98f22c2b7dc6} (Backdoor.Bot) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Network\UID (Malware.Trace) -> Quarantined and deleted successfully.

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Trojan.FakeAlert) -> Data: c:\windows\system32\sdra64.exe -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Hijack.Userinit) -> Bad: (C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\sdra64.exe,) Good: (Userinit.exe) -> Quarantined and deleted successfully.

Folders Infected:
C:\WINDOWS\system32\lowsec (Stolen.data) -> Delete on reboot.

Files Infected:
c:\documents and settings\Albert\local settings\Temp\3FE3.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\Albert\local settings\Temp\3FEB.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\Albert\local settings\Temp\3FEF.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\Albert\local settings\Temp\4003.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\Albert\local settings\Temp\4004.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\Albert\local settings\Temp\400D.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\Albert\local settings\Temp\401C.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\Albert\local settings\Temp\4033.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\Albert\local settings\Temp\4043.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\Albert\local settings\Temp\4047.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\Albert\local settings\Temp\4079.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\Albert\local settings\Temp\407E.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\Albert\local settings\Temp\4090.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\Albert\local settings\Temp\40AC.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\Albert\local settings\Temp\40B2.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\Albert\local settings\Temp\40C3.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\Albert\local settings\Temp\40CC.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\Albert\local settings\Temp\40E1.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\Albert\local settings\Temp\411D.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\Albert\local settings\Temp\412C.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\Albert\local settings\Temp\414F.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\Albert\local settings\Temp\4158.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\Albert\local settings\Temp\4163.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\Albert\local settings\Temp\4171.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\Albert\local settings\Temp\418F.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\Albert\local settings\Temp\4199.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\Albert\local settings\Temp\41A1.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\Albert\local settings\Temp\41AC.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\Albert\local settings\Temp\41B5.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\Albert\local settings\Temp\41C6.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\Albert\local settings\Temp\41D0.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\Albert\local settings\Temp\41F8.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\Albert\local settings\Temp\4210.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\Albert\local settings\Temp\4213.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\Albert\local settings\Temp\421C.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\Albert\local settings\Temp\421F.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\Albert\local settings\Temp\4227.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\Albert\local settings\Temp\423A.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\Albert\local settings\Temp\424C.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\Albert\local settings\Temp\425D.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\Albert\local settings\Temp\426F.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\Albert\local settings\Temp\427D.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\Albert\local settings\Temp\4283.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\Albert\local settings\Temp\42A3.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\Albert\local settings\Temp\42A4.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\Albert\local settings\Temp\42B4.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\Albert\local settings\Temp\42BA.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\Albert\local settings\Temp\42BD.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\Albert\local settings\Temp\42DE.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\Albert\local settings\Temp\42F0.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\Albert\local settings\Temp\4300.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\Albert\local settings\Temp\4324.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\Albert\local settings\Temp\4336.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\Albert\local settings\Temp\433D.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\Albert\local settings\Temp\4348.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\Albert\local settings\Temp\435C.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\Albert\local settings\Temp\4361.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\Albert\local settings\Temp\4370.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\Albert\local settings\Temp\4384.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\Albert\local settings\Temp\4399.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\Albert\local settings\Temp\439B.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\Albert\local settings\Temp\43AC.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\Albert\local settings\Temp\43B3.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\Albert\local settings\Temp\43C6.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\Albert\local settings\Temp\43DE.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\Albert\local settings\Temp\43EF.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\Albert\local settings\Temp\43FD.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\Albert\local settings\Temp\440D.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\Albert\local settings\Temp\441F.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\Albert\local settings\Temp\442A.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\Albert\local settings\Temp\444F.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\Albert\local settings\Temp\4476.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\Albert\local settings\Temp\448A.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\Albert\local settings\Temp\44A7.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\Albert\local settings\Temp\44B3.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\Albert\local settings\Temp\44B6.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\Albert\local settings\Temp\44C8.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\Albert\local settings\Temp\44D0.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\Albert\local settings\Temp\44D7.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\Albert\local settings\Temp\44F1.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\Albert\local settings\Temp\4502.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\Albert\local settings\Temp\4515.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\Albert\local settings\Temp\451C.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\Albert\local settings\Temp\4523.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\Albert\local settings\Temp\4526.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\Albert\local settings\Temp\4539.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\Albert\local settings\Temp\4541.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\Albert\local settings\Temp\455A.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\Albert\local settings\Temp\4567.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\Albert\local settings\Temp\3F06.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\Albert\local settings\Temp\3F07.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\Albert\local settings\Temp\3F0A.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\Albert\local settings\Temp\3F0D.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\Albert\local settings\Temp\3F23.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\Albert\local settings\Temp\3F31.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\Albert\local settings\Temp\3F4E.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\Albert\local settings\Temp\3F5C.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\Albert\local settings\Temp\3F66.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\Albert\local settings\Temp\3F77.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\Albert\local settings\Temp\3F7C.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\Albert\local settings\Temp\3F8D.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\Albert\local settings\Temp\3F92.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\Albert\local settings\Temp\3FA2.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\Albert\local settings\Temp\3FB9.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\Albert\local settings\Temp\3FBF.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\Albert\local settings\Temp\4578.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\Albert\local settings\Temp\4582.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\Albert\local settings\Temp\4587.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\Albert\local settings\Temp\4597.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\Albert\local settings\Temp\45AF.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\Albert\local settings\Temp\45B1.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\Albert\local settings\Temp\45C2.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\Albert\local settings\Temp\45D4.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\Albert\local settings\Temp\45E9.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\Albert\local settings\Temp\45F4.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\Albert\local settings\Temp\45F8.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\Albert\local settings\Temp\4607.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\Albert\local settings\Temp\4621.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\Albert\local settings\Temp\4630.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\Albert\local settings\Temp\4636.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\Albert\local settings\Temp\463F.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\Albert\local settings\Temp\464B.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\Albert\local settings\Temp\465A.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\Albert\local settings\Temp\466D.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\Albert\local settings\Temp\4694.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\Albert\local settings\Temp\469C.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\Albert\local settings\Temp\46A3.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\Albert\local settings\Temp\46BD.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\Albert\local settings\Temp\46CB.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\Albert\local settings\Temp\46D5.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\Albert\local settings\Temp\46E3.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\Albert\local settings\Temp\46E8.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\Albert\local settings\Temp\46FA.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\Albert\local settings\Temp\4704.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\Albert\local settings\Temp\4719.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\Albert\local settings\Temp\472D.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\Albert\local settings\Temp\4739.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\Albert\local settings\Temp\4746.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\Albert\local settings\Temp\4750.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\Albert\local settings\Temp\475F.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\Albert\local settings\Temp\476C.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\Albert\local settings\Temp\476E.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\Albert\local settings\Temp\3FD4.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\Albert\local settings\Temp\4106.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\Albert\local settings\Temp\4205.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\Albert\local settings\Temp\4313.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\Albert\local settings\Temp\443E.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\Albert\local settings\Temp\456D.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\Albert\local settings\Temp\467B.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
c:\program files\VideoLAN\VLC\plugins\libmux_mpjpeg_plugin.dll (Trojan.Dropper) -> Quarantined and deleted successfully.
c:\WINDOWS\ld11.exe (Trojan.Agent) -> Quarantined and deleted successfully.
c:\windows\system32\lowsec\local.ds (Stolen.data) -> Delete on reboot.
c:\windows\system32\lowsec\user.ds (Stolen.data) -> Delete on reboot.
c:\documents and settings\Albert\local settings\Temp\ro_1246075358.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\sdra64.exe (Trojan.FakeAlert) -> Delete on reboot.
C:\WINDOWS\010112010146118114.dat (Worm.KoobFace) -> Quarantined and deleted successfully.

Combofix
*Exited out of AV scanner, but process was still running in the Task Manager

ComboFix 09-06-26.02 - Albert 06/28/2009 22:33.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1534.1116 [GMT -4:00]
Running from: c:\documents and settings\Albert\Desktop\ComboFix.exe
AV: Eset NOD32 antivirus system 2.51 *On-access scanning enabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
* Resident AV is active

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\wbem\proquota.exe

c:\windows\system32\proquota.exe . . . is missing!!

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

\Legacy_TDSSSERV

\Service_TDSSserv

((((((((((((((((((((((((( Files Created from 2009-05-28 to 2009-06-29 )))))))))))))))))))))))))))))))
.

2009-06-28 14:12 . 2009-06-28 14:12

d

w- c:\program files\Trend Micro
2009-06-25 01:39 . 2009-06-17 15:27 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-06-25 01:39 . 2009-06-25 01:40

d

w- c:\program files\Malwarebytes' Anti-Malware
2009-06-25 01:39 . 2009-06-17 15:27 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-06-20 02:33 . 2009-05-19 05:36 2884832

w- c:\documents and settings\All Users\Application Data\AOL OCP\AIM\Storage\All Users\SUDS_BBC2683C\CACHE\4426.0.4\vwpt.exe
2009-06-20 02:33 . 2009-05-19 05:36 28

w- c:\documents and settings\All Users\Application Data\AOL OCP\AIM\Storage\All Users\SUDS_BBC2683C\CACHE\4426.0.4\unregister.bat
2009-06-20 02:33 . 2009-05-19 05:36 30512

w- c:\documents and settings\All Users\Application Data\AOL OCP\AIM\Storage\All Users\SUDS_BBC2683C\CACHE\4426.0.4\Uninstaller.exe
2009-06-20 02:33 . 2009-05-19 05:35 376568

w- c:\documents and settings\All Users\Application Data\AOL OCP\AIM\Storage\All Users\SUDS_BBC2683C\CACHE\4426.0.4\unagi3.exe
2009-06-19 19:21 . 2009-06-19 19:21

d

w- c:\program files\LG Electronics
2009-06-19 19:21 . 2008-11-11 17:42 24832 ----a-w- c:\windows\system32\drivers\lgusbmodem.sys
2009-06-19 19:21 . 2008-11-11 17:41 19968 ----a-w- c:\windows\system32\drivers\lgusbdiag.sys
2009-06-19 19:21 . 2008-11-11 17:41 13056 ----a-w- c:\windows\system32\drivers\lgusbbus.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-06-29 02:39 . 2007-01-07 22:09

d

w- c:\program files\Taskbar Shuffle
2009-06-28 02:46 . 2007-01-06 07:16

d

w- c:\program files\Mozilla Thunderbird
2009-06-27 03:16 . 2007-01-06 15:07

d

w- c:\program files\ESET
2009-06-25 01:29 . 2007-01-06 18:03

d

w- c:\program files\Steam
2009-06-25 01:24 . 2009-05-06 00:12

d

w- c:\documents and settings\Albert\Application Data\foobar2000
2009-06-25 01:24 . 2007-01-06 15:55

d

w- c:\documents and settings\Albert\Application Data\Azureus
2009-06-22 20:30 . 2007-01-06 17:35

d

w- c:\program files\AIM6
2009-06-19 19:22 . 2007-01-16 05:31

d

w- c:\program files\BitPim
2009-06-19 19:21 . 2004-12-27 15:57

d--h--w- c:\program files\InstallShield Installation Information
2009-06-09 00:39 . 2007-01-06 15:43

d

w- c:\program files\GetRight
2009-05-19 05:36 . 2009-06-20 02:32 1484856

w- c:\documents and settings\All Users\Application Data\AOL OCP\AIM\Storage\All Users\SUDS_BBC2683C\CACHE\4426.0.4\toolbar.exe
2009-05-19 05:36 . 2009-06-20 02:32 25

w- c:\documents and settings\All Users\Application Data\AOL OCP\AIM\Storage\All Users\SUDS_BBC2683C\CACHE\4426.0.4\register.bat
2009-05-19 05:36 . 2009-06-20 02:32 97072

w- c:\documents and settings\All Users\Application Data\AOL OCP\AIM\Storage\All Users\SUDS_BBC2683C\CACHE\4426.0.4\bsetutil.exe
2009-05-19 05:36 . 2009-06-20 02:32 142040

w- c:\documents and settings\All Users\Application Data\AOL OCP\AIM\Storage\All Users\SUDS_BBC2683C\CACHE\4426.0.4\alsetup.exe
2009-05-19 05:36 . 2009-06-20 02:32 111920

w- c:\documents and settings\All Users\Application Data\AOL OCP\AIM\Storage\All Users\SUDS_BBC2683C\CACHE\4426.0.4\AOLSearch.dll
2009-05-18 02:13 . 2007-01-06 17:22

d

w- c:\documents and settings\All Users\Application Data\AOL
2009-05-07 15:44 . 1980-01-01 05:00 344064 ----a-w- c:\windows\system32\localspl.dll
2009-05-06 00:11 . 2009-05-06 00:11

d

w- c:\program files\foobar2000
2009-04-29 04:56 . 1980-01-01 05:00 827392 ----a-w- c:\windows\system32\wininet.dll
2009-04-29 04:55 . 1980-01-01 05:00 78336 ----a-w- c:\windows\system32\ieencode.dll
2009-04-17 09:58 . 1980-01-01 05:00 1846656 ----a-w- c:\windows\system32\win32k.sys
2009-04-15 15:11 . 1980-01-01 05:00 584192 ----a-w- c:\windows\system32\rpcrt4.dll
2007-01-07 05:42 . 2007-01-07 05:42 813 ----a-w- c:\program files\Steam.lnk
2008-12-19 21:42 . 2007-01-06 07:00 67688 ----a-w- c:\program files\mozilla firefox\components\jar50.dll
2008-12-19 21:42 . 2007-01-06 07:00 54368 ----a-w- c:\program files\mozilla firefox\components\jsd3250.dll
2008-12-19 21:42 . 2007-01-06 07:00 34944 ----a-w- c:\program files\mozilla firefox\components\myspell.dll
2008-12-19 21:42 . 2007-01-06 07:00 46712 ----a-w- c:\program files\mozilla firefox\components\spellchk.dll
2008-12-19 21:42 . 2007-01-06 07:00 172136 ----a-w- c:\program files\mozilla firefox\components\xpinstal.dll
.

Sigcheck

[7] 2006-04-20 12:18 360576 B2220C618B42A2212A59D91EBD6FC4B4 c:\windows\$hf_mig$\KB917953\SP2QFE\tcpip.sys
[7] 2007-10-30 16:53 360832 64798ECFA43D78C7178375FCDD16D8C8 c:\windows\$hf_mig$\KB941644\SP2QFE\tcpip.sys
[7] 2008-06-20 10:44 360960 744E57C99232201AE98C49168B918F48 c:\windows\$hf_mig$\KB951748\SP2QFE\tcpip.sys
[7] 2008-06-20 11:51 361600 9AEFA14BD6B182D61E3119FA5F436D3D c:\windows\$hf_mig$\KB951748\SP3GDR\tcpip.sys
[7] 2008-06-20 11:59 361600 AD978A1B783B5719720CFF204B666C8E c:\windows\$hf_mig$\KB951748\SP3QFE\tcpip.sys
[7] 2004-08-04 10:00 359040 9F4B36614A0FC234525BA224957DE55C c:\windows\$NtUninstallKB917953$\tcpip.sys
[7] 2006-04-20 11:51 359808 1DBF125862891817F374F407626967F4 c:\windows\$NtUninstallKB941644$\tcpip.sys
[-] 2008-02-02 20:17 360064 482AB7F9CD41702E8F856C11CFEFB02D c:\windows\$NtUninstallKB951748$\tcpip.sys
[-] 2008-04-13 19:20 361344 93EA8D04EC73A85DB02EB8805988F733 c:\windows\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\tcpip.sys
[-] 2008-09-14 13:39 360320 3ADCE4790F591BF160A94F6F08039577 c:\windows\system32\dllcache\TCPIP.SYS
[-] 2008-09-14 13:39 360320 3ADCE4790F591BF160A94F6F08039577 c:\windows\system32\drivers\TCPIP.SYS

[-] 2008-04-14 00:12 507904 ED0EF0A136DEC83DF69F04118870003E c:\windows\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\winlogon.exe
[-] 2008-09-13 12:54 502272 !HASH: ERROR_LOCK_VIOLATION ! c:\windows\system32\winlogon.exe
[7] 2004-08-04 02:00 502272 01C3346C241652F43AED8E2149881BFE c:\windows\system32\dllcache\winlogon.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Taskbar Shuffle"="c:\program files\Taskbar Shuffle\taskbarshuffle.exe" [2008-04-17 818176]
"Sticky Pad"="c:\program files\StickyPad\StickyPad.exe" [2007-04-24 528441]
"Desktop Calendar"="c:\program files\Desktop Calendar\Desktop Calendar.exe" [2003-10-31 442368]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPLpr"="c:\program files\Synaptics\SynTP\SynTPLpr.exe" [2005-07-28 82009]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2005-08-01 729177]
"LManager"="c:\program files\Launch Manager\QtZgAcer.EXE" [2004-12-09 311296]
"nod32kui"="c:\program files\Eset\nod32kui.exe" [2007-01-06 921600]
"WinVNC"="c:\program files\TightVNC\WinVNC.exe" [2007-05-08 589824]
"EPM-DM"="c:\acer\epm\epm-dm.exe" [2005-01-25 180224]
"ePowerManagement"="c:\acer\ePM\ePM.exe" [2005-01-21 2889216]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Acrobat Speed Launcher.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Acrobat Speed Launcher.lnk
backup=c:\windows\pss\Adobe Acrobat Speed Launcher.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Gamma.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Gamma.lnk
backup=c:\windows\pss\Adobe Gamma.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^America Online 9.0 Tray Icon.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\America Online 9.0 Tray Icon.lnk
backup=c:\windows\pss\America Online 9.0 Tray Icon.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Image Zone Fast Start.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HP Image Zone Fast Start.lnk
backup=c:\windows\pss\HP Image Zone Fast Start.lnkCommon Startup

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"c:\\Program Files\\Azureus\\Azureus.exe"=
"c:\\Program Files\\Wolfram Research\\Mathematica\\5.2\\Mathematica.exe"=
"c:\\Program Files\\Wolfram Research\\Mathematica\\5.2\\MathKernel.exe"=
"c:\\Program Files\\Wolfram Research\\Mathematica\\5.2\\math.exe"=
"c:\\Program Files\\Steam\\steamapps\\aznintent@hotmail.com\\counter-strike\\hl.exe"=
"c:\\Program Files\\America Online 9.0\\waol.exe"=
"c:\\Program Files\\Common Files\\AOL\\ACS\\acsd.exe"=
"c:\\Program Files\\AIM6\\aim6.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\VideoLAN\\VLC\\vlc.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\Steam\\steam.exe"=
"c:\\Program Files\\TightVNC\\WinVNC.exe"=
"c:\\Program Files\\WS_FTP Pro\\wsftppro.exe"=
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"c:\\Program Files\\Common Files\\SafeNet Sentinel\\Sentinel Protection Server\\WinNT\\spnsrvnt.exe"=

R2 SBKUPNT;SBKUPNT;c:\windows\system32\drivers\SBKUPNT.SYS [5/19/2008 7:32 PM 14976]
R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [2/10/2009 12:10 AM 24652]
S2 nqsht;nqsht;\??\c:\windows\system32\drivers\pnusyvnj.sys --> c:\windows\system32\drivers\pnusyvnj.sys [?]
S3 CONAN;CONAN;c:\windows\system32\drivers\o2mmb.sys [12/22/2005 7:12 PM 193878]
S3 MbxStby;MbxStby;c:\windows\system32\drivers\MbxStby.sys [10/27/2005 9:24 AM 7100]

--- Other Services/Drivers In Memory ---

*Deregistered* - DS1410D
.
Contents of the 'Scheduled Tasks' folder
.
.

Supplementary Scan

.
uStart Page = about:blank
uInternet Connection Wizard,ShellNext = hxxp://global.acer.com/
IE: Convert link target to Adobe PDF - c:\program files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert link target to existing PDF - c:\program files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert selected links to Adobe PDF - c:\program files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert selected links to existing PDF - c:\program files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Convert selection to Adobe PDF - c:\program files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert selection to existing PDF - c:\program files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert to Adobe PDF - c:\program files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert to existing PDF - c:\program files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Download with GetRight - c:\program files\GetRight\GRdownload.htm
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Open with GetRight Browser - c:\program files\GetRight\GRbrowse.htm
LSP: c:\windows\system32\imon.dll
FF - ProfilePath - c:\documents and settings\Albert\Application Data\Mozilla\Firefox\Profiles\egxkq3f0.default\
FF - component: c:\program files\Mozilla Firefox\components\xpinstal.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-06-28 22:39
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.

LOCKED REGISTRY KEYS

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{4F56E727-0A5D-9C93-99600FC5295CA3F5}\{8257E326-E765-C505-3AEB2DA5981E86BA}\{7ADCE296-1D79-0777-094B0CE9C6E4DF1E}*]
"1D1OWFM6WKF6TLM3S2BGKKUUDG1"=hex:01,00,01,00,00,00,00,00,71,4a,e0,45,b7,4f,44,
fb,35,81,92,71,e8,29,5a,84,14,35,16,70,d8,6e,ff,61

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{90C9B227-00E9-ED2B-D8335C00663422E2}\{BA143829-6513-6AB3-17B76E63BBBF825B}\{B7811D8F-B091-6828-D848878685722533}*]
"{3EE4C831-B7E0-4ed1-B9FC-EDC523C9612F}1"=hex:01,00,01,00,0c,00,00,00,ab,29,b9,
14,27,c0,55,d4,ee,97,15,1b,10,6f,e9,49,d3,7d,28,a0,ad,3f,99,e8,6d,de,78,c2,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{91EC4B89-4AF2-1685-8B077627C8A43419}\{2EE609D8-52A7-5ABD-6D921F70AFC106D5}\{F0CB3253-4F19-C88D-A2C81B3BBC751916}*]
"{3EE4C831-B7E0-4ed1-B9FC-EDC523C9612F}1"=hex:01,00,01,00,0c,00,00,00,ab,29,b9,
14,27,c0,55,d4,ee,97,15,1b,10,6f,e9,49,d3,7d,28,a0,ad,3f,99,e8,6d,de,78,c2,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B2236175-3D9F-05C6-8B4893E47EF3B357}\{715026F0-32B2-9A38-0A89C09A617BF317}\{121623C5-7E2D-B1BB-98FD332A06B7F4F2}*]
"1D1OWFM6WKF6TLM3S2BGKKUUDG1"=hex:01,00,01,00,00,00,00,00,71,4a,e0,45,b7,4f,44,
fb,35,81,92,71,e8,29,5a,84,14,35,16,70,d8,6e,ff,61
.

DLLs Loaded Under Running Processes

- - - - - - - > 'winlogon.exe'(996)
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'lsass.exe'(1052)
c:\windows\system32\imon.dll

- - - - - - - > 'explorer.exe'(3928)
c:\windows\system32\WPDShServiceObj.dll
c:\program files\WS_FTP Pro\nsftpch.dll
c:\windows\system32\MSVCRT40.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.

Other Running Processes

.
c:\windows\system32\ati2evxx.exe
c:\windows\system32\ati2evxx.exe
c:\acer\eManager\anbmServ.exe
c:\program files\Diskeeper Corporation\Diskeeper\DkService.exe
c:\program files\ESET\nod32krn.exe
c:\windows\system32\HPZipm12.exe
c:\program files\Common Files\SafeNet Sentinel\Sentinel Protection Server\WinNT\spnsrvnt.exe
c:\windows\wanmpsvc.exe
.
**************************************************************************
.
Completion time: 2009-06-29 22:43 - machine was rebooted
ComboFix-quarantined-files.txt 2009-06-29 02:43

Pre-Run: 2,378,813,440 bytes free
Post-Run: 2,973,552,640 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

227 --- E O F --- 2009-06-19 19:19

Installed Programs List

ACDSee 9 Photo Manager
Acer eManager for Notebook
Acer ePowerManagement
Acer GridVista
Adobe Bridge 1.0
Adobe Common File Installer
Adobe Creative Suite 2
Adobe Flash Player ActiveX
Adobe Flash Player Plugin
Adobe Help Center 1.0
Adobe Stock Photos 1.0
Agere Systems HDA Modem
AIM 6
AOL Coach Version 1.0(Build:20030807.3)
AOL Uninstaller (Choose which Products to Remove)
ATI - Software Uninstall Utility
ATI Control Panel
ATI Display Driver
Azureus
BitPim 1.0.6
Broadcom Gigabit Integrated Controller
CCleaner (remove only)
Critical Update for Windows Media Player 11 (KB959772)
dBpowerAMP Music Converter
Desktop Calendar 0.42b
Diskeeper Professional Premier Edition
DVD Decrypter (Remove Only)
ffdshow (remove only)
foobar2000 v0.9.6.5
GetRight
High Definition Audio Driver Package - KB835221
HijackThis 2.0.2
Hotfix for Windows Internet Explorer 7 (KB947864)
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows Media Player 11 (KB939683)
Hotfix for Windows XP (KB909095)
Hotfix for Windows XP (KB915865)
Hotfix for Windows XP (KB926239)
Hotfix for Windows XP (KB935448)
Hotfix for Windows XP (KB952287)
HP Image Zone 4.7
HP PSC & OfficeJet 4.7
HP Software Update
Ipswitch WS_FTP Pro
J2SE Runtime Environment 5.0 Update 6
Launch Manager
LG USB Modem driver
Malwarebytes' Anti-Malware
Mathematica 5.2 for Students
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Hotfix (KB928366)
Microsoft .NET Framework 2.0 Service Pack 1
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft National Language Support Downlevel APIs
Microsoft Office 2003 Primary Interop Assemblies
Microsoft Office Professional Edition 2003
Microsoft Silverlight
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual Studio 2005 Tools for Office Runtime
Microsoft Visual Studio 2005 Tools for Office Runtime
Mozilla Firefox (2.0.0.20)
Mozilla Thunderbird (2.0.0.22)
Mp3tag v2.41
MSXML 4.0 SP2 (KB927978)
MSXML 4.0 SP2 (KB936181)
MSXML 4.0 SP2 (KB954430)
Nero 6 Ultra Edition
NOD32 antivirus system
O2Micro MemoryCardBus & Smart Card Reader Windows Driver
O2Micro MemoryCardBus Windows Driver
Paint Shop Pro 6.0 (ESD)
PC Wizard 2008.1.85.1
PowerDVD
PRO/II 8.1
QuickTime
RealPlayer Basic
Realtek High Definition Audio Driver
SAMSUNG CDMA Modem Driver Set
Security Update for Windows Internet Explorer 7 (KB928090)
Security Update for Windows Internet Explorer 7 (KB929969)
Security Update for Windows Internet Explorer 7 (KB931768)
Security Update for Windows Internet Explorer 7 (KB933566)
Security Update for Windows Internet Explorer 7 (KB937143)
Security Update for Windows Internet Explorer 7 (KB938127)
Security Update for Windows Internet Explorer 7 (KB939653)
Security Update for Windows Internet Explorer 7 (KB942615)
Security Update for Windows Internet Explorer 7 (KB944533)
Security Update for Windows Internet Explorer 7 (KB950759)
Security Update for Windows Internet Explorer 7 (KB953838)
Security Update for Windows Internet Explorer 7 (KB956390)
Security Update for Windows Internet Explorer 7 (KB958215)
Security Update for Windows Internet Explorer 7 (KB960714)
Security Update for Windows Internet Explorer 7 (KB961260)
Security Update for Windows Internet Explorer 7 (KB963027)
Security Update for Windows Internet Explorer 7 (KB969897)
Security Update for Windows Media Player (KB911564)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player 11 (KB936782)
Security Update for Windows Media Player 11 (KB954154)
Security Update for Windows Media Player 6.4 (KB925398)
Security Update for Windows XP (KB893756)
Security Update for Windows XP (KB896358)
Security Update for Windows XP (KB896423)
Security Update for Windows XP (KB896424)
Security Update for Windows XP (KB896428)
Security Update for Windows XP (KB899587)
Security Update for Windows XP (KB899591)
Security Update for Windows XP (KB900725)
Security Update for Windows XP (KB901017)
Security Update for Windows XP (KB901190)
Security Update for Windows XP (KB901214)
Security Update for Windows XP (KB902400)
Security Update for Windows XP (KB904706)
Security Update for Windows XP (KB905414)
Security Update for Windows XP (KB905749)
Security Update for Windows XP (KB908519)
Security Update for Windows XP (KB911562)
Security Update for Windows XP (KB911927)
Security Update for Windows XP (KB912919)
Security Update for Windows XP (KB913580)
Security Update for Windows XP (KB914388)
Security Update for Windows XP (KB914389)
Security Update for Windows XP (KB917422)
Security Update for Windows XP (KB917953)
Security Update for Windows XP (KB918118)
Security Update for Windows XP (KB918439)
Security Update for Windows XP (KB919007)
Security Update for Windows XP (KB920213)
Security Update for Windows XP (KB920670)
Security Update for Windows XP (KB920683)
Security Update for Windows XP (KB920685)
Security Update for Windows XP (KB921398)
Security Update for Windows XP (KB921503)
Security Update for Windows XP (KB922616)
Security Update for Windows XP (KB922819)
Security Update for Windows XP (KB923191)
Security Update for Windows XP (KB923414)
Security Update for Windows XP (KB923561)
Security Update for Windows XP (KB923694)
Security Update for Windows XP (KB923980)
Security Update for Windows XP (KB924191)
Security Update for Windows XP (KB924270)
Security Update for Windows XP (KB924667)
Security Update for Windows XP (KB925902)
Security Update for Windows XP (KB926255)
Security Update for Windows XP (KB926436)
Security Update for Windows XP (KB927779)
Security Update for Windows XP (KB927802)
Security Update for Windows XP (KB928255)
Security Update for Windows XP (KB928843)
Security Update for Windows XP (KB929123)
Security Update for Windows XP (KB930178)
Security Update for Windows XP (KB931261)
Security Update for Windows XP (KB931784)
Security Update for Windows XP (KB932168)
Security Update for Windows XP (KB933729)
Security Update for Windows XP (KB935839)
Security Update for Windows XP (KB935840)
Security Update for Windows XP (KB936021)
Security Update for Windows XP (KB937894)
Security Update for Windows XP (KB938464)
Security Update for Windows XP (KB938829)
Security Update for Windows XP (KB941202)
Security Update for Windows XP (KB941568)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB941644)
Security Update for Windows XP (KB941693)
Security Update for Windows XP (KB943055)
Security Update for Windows XP (KB943460)
Security Update for Windows XP (KB943485)
Security Update for Windows XP (KB944653)
Security Update for Windows XP (KB945553)
Security Update for Windows XP (KB946026)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB948590)
Security Update for Windows XP (KB948881)
Security Update for Windows XP (KB950749)
Security Update for Windows XP (KB950760)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951698)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952004)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB953839)
Security Update for Windows XP (KB954211)
Security Update for Windows XP (KB954600)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956391)
Security Update for Windows XP (KB956572)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956841)
Security Update for Windows XP (KB957095)
Security Update for Windows XP (KB957097)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958687)
Security Update for Windows XP (KB958690)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960225)
Security Update for Windows XP (KB960715)
Security Update for Windows XP (KB960803)
Security Update for Windows XP (KB961373)
Security Update for Windows XP (KB961501)
Security Update for Windows XP (KB968537)
Security Update for Windows XP (KB969898)
Security Update for Windows XP (KB970238)
Sentinel Protection Installer 7.0.0
SIM4MEPortal 1.0
SIMSCI Common Framework 1.0
SIMSCI Common Framework 2.0
Steam
StickyPad
Suite Specific
Synaptics Pointing Device Driver
Taskbar Shuffle version 2.5
TDM 3.01
TightVNC 1.3.9
TuneXP 1.5
Update for Windows XP (KB894391)
Update for Windows XP (KB898461)
Update for Windows XP (KB900485)
Update for Windows XP (KB908531)
Update for Windows XP (KB910437)
Update for Windows XP (KB911280)
Update for Windows XP (KB916595)
Update for Windows XP (KB920872)
Update for Windows XP (KB922582)
Update for Windows XP (KB927891)
Update for Windows XP (KB929338)
Update for Windows XP (KB930916)
Update for Windows XP (KB931836)
Update for Windows XP (KB932823-v3)
Update for Windows XP (KB933360)
Update for Windows XP (KB936357)
Update for Windows XP (KB938828)
Update for Windows XP (KB942763)
Update for Windows XP (KB951072-v2)
Update for Windows XP (KB955839)
Update for Windows XP (KB967715)
Video Converter
VideoLAN VLC media player 0.8.6a
Viewpoint Media Player
Winamp (remove only)
Windows Installer 3.1 (KB893803)
Windows Internet Explorer 7
Windows Media Format 11 runtime
Windows Media Format 11 runtime
Windows Media Player 11
Windows Media Player 11
Windows XP Hotfix - KB873339
Windows XP Hotfix - KB885835
Windows XP Hotfix - KB885836
Windows XP Hotfix - KB886185
Windows XP Hotfix - KB887472
Windows XP Hotfix - KB888302
Windows XP Hotfix - KB890859
Windows XP Hotfix - KB891781
WinRAR
WinRAR archiver
Wolfram Notebook Indexer 1.1

Katana · June 2009

Please do the following:

Go Start > Run and copy/paste the following single-line command into the Run box and click OK:

cmd /c PEV -l "%systemdrive%\proquota.exe" >Log.txt&Log.txt&del Log.txt

A Notepad file will open. Post the contents of Log.txt in your next reply.

aznintent · June 2009

----a-w- 50,176 2008-04-14 00:12:32 C:\WINDOWS\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\proquota.exe

Entries: 1 (1)
Directories: 0 Files: 1
Bytes: 50,176 Blocks: 98

Katana · June 2009

Information

IMPORTANT
I notice there are signs of one or more P2P (Person to Person) File Sharing Programs on your computer.

Azureus
I'd like you to read the Guidelines for P2P Programs where we explain why it's not a good idea to have them.

Also available here.

My recommendation is you go to Control Panel > Add/Remove Programs and uninstall any P2P programs
Please note: you must NOT use any P2P whilst we are cleaning your machine.

Step 1

Custom CFScript

Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the code box below:

http://icrontic.com/forum/showthread.php?p=694138#post694138
Suspect::
c:\windows\system32\drivers\TCPIP.SYS
c:\windows\system32\winlogon.exe
FCopy::
c:\windows\system32\dllcache\winlogon.exe|c:\windows\system32\winlogon.exe
C:\WINDOWS\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\proquota.exe|c:\windows\system32\proquota.exe
Driver::
nqsht
RegNull::
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{4F56E727-0A5D-9C93-99600FC5295CA3F5}\{8257E326-E765-C505-3AEB2DA5981E86BA}\{7ADCE296-1D79-0777-094B0CE9C6E4DF1E}*]
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{90C9B227-00E9-ED2B-D8335C00663422E2}\{BA143829-6513-6AB3-17B76E63BBBF825B}\{B7811D8F-B091-6828-D848878685722533}*]
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{91EC4B89-4AF2-1685-8B077627C8A43419}\{2EE609D8-52A7-5ABD-6D921F70AFC106D5}\{F0CB3253-4F19-C88D-A2C81B3BBC751916}*]
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B2236175-3D9F-05C6-8B4893E47EF3B357}\{715026F0-32B2-9A38-0A89C09A617BF317}\{121623C5-7E2D-B1BB-98FD332A06B7F4F2}*]
ADS::

Save this as CFScript.txt and place it on your desktop.
Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
When finished, it will produce a log for you. Copy and paste the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.
Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.

A word of warning: Neither I nor sUBs are responsible for any damage you may have caused your machine by running ComboFix on your own. This tool is not a toy and not for everyday use.
ComboFix SHOULD NOT be used unless requested by a forum helper

Step 2

Kaspersky Online Scanner .
Your Antivirus and/or Antispyware may give a warning during the scan. This is perfectly normal
NOTE:- This scan is best done from IE (Internet Explorer)
NOTE:- Vista users should start IE by Start(Vista Orb) >> Internet Explorer >> Right-Click Run As Admin
Go Here http://www.kaspersky.com/kos/eng/partner/default/kavwebscan.html

Read the Requirements and limitations before you click Accept.
Once the database has downloaded, click My Computer in the left pane
Now go and put the kettle on !
When the scan has completed, click Save Report As...
Enter a name for the file in the Filename: text box and then click the down arrow to the right of Save as type: and select text file (*.txt)
Click Save - by default the file will be saved to your Desktop, but you can change this if you wish.

**Note**

To optimize scanning time and produce a more sensible report for review:

Close any open programs.
Turn off the real-time scanner of all antivirus or antispyware programs while performing the online scan.

Note for Internet Explorer 7 users: If at any time you have trouble viewing the accept button of the license, click on the Zoom tool located at the bottom right of the IE window and set the zoom to 75%. Once the license is accepted, reset to 100%.

Logs/Information to Post in Reply
Please post the following logs/Information in your reply
Some of the logs I request will be quite large, You may need to split them over a couple of replies.

Combofix Log
Kaspersky Log
How are things running now ?

Additional Notes

Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system.

Please download Java SE Runtime Environment (JRE) . ( don't install it yet )

Scroll down to where it says "Java SE Runtime Environment (JRE)".
Click the "Download" button to the right.
- Platform = Windows
- Language = Multi Language
Check the box that says: "Accept License Agreement".
The page will refresh.
Click on the link to download Windows Offline Installation with or without Multi-language and save to your desktop.

Now download JavaRa and unzip it to your desktop.

***Please close any instances of Internet Explorer (or other web browser) before continuing!***

Double-click on JavaRa.exe to start the program.
From the drop-down menu, choose English and click on Select.
JavaRa will open; click on Remove Older Versions to remove the older versions of Java installed on your computer.
Click Yes when prompted. When JavaRa is done, a notice will appear that a logfile has been produced. Click OK.
A logfile will pop up. Please save it to a convenient location.

Now install the Java SE Runtime Environment (JRE) package you downloaded
(it comes with a toolbar pre-selected, so make sure you uncheck the box)

You can delete JavaRa (zip and exe)

aznintent · July 2009

I thank you for your help thus far Katana. However, after some thinking, I would not have felt comfortable using my computer for financial transactions even after cleaning the system of the virus. I have therefore decided to wipe the drive and reload a factory image instead. This thread can be closed. Thanks again!

Katana · July 2009

Thanks for letting me know

To be honest, a reformat/reinstall is always the best option after an infection of this type.
We would always recommend it, but too many people would rather try cleaning.

The following is some info to help you stay safe and clean.

You may already have some of the following programs, but I include the full list for the benefit of all the other people who will be reading this thread in the future.
( Vista users must ensure that any programs are Vista compatible BEFORE installing )

Online Scanners
I would recommend a scan at one or more of the following sites at least once a month.

http://www.pandasecurity.com/activescan
http://www.kaspersky.com/kos/eng/partner/71706/kavwebscan.html

!!! Make sure that all your programs are updated !!!
Secunia Software Inspector does all the work for you, .... see HERE for details

AntiSpyware

AntiSpyware is not the same thing as Antivirus.
Different AntiSpyware programs detect different things, so in this case it is recommended that you have more than one.
You should only have one running all the time, the other/s should be used "on demand" on a regular basis.
Most of the programs in this list have a free (for Home Users ) and paid versions,
it is worth paying for one and having "realtime" protection, unless you intend to do a manual scan often.
Spybot - Search & Destroy <<< A must have program
- It includes host protection and registry protection
- A hosts file is a bit like a phone book, it points to the actual numeric address (i.e. the IP address) from the human friendly name of a website. This feature can be used to block malicious websites
MalwareBytes Anti-malware <<< A New and effective program
a-squared Free <<< A good "realtime" or "on demand" scanner
superantispyware <<< A good "realtime" or "on demand" scanner

Prevention

These programs don't detect malware, they help stop it getting on your machine in the first place.
Each does a different job, so you can have more than one
Winpatrol
- An excellent startup manager and then some !!
- Notifies you if programs are added to startup
- Allows delayed startup
- A must have addition
SpywareBlaster 4.0
- SpywareBlaster sets killbits in the registry to prevent known malicious activex controls from installing themselves on your computer.
SpywareGuard 2.2
- SpywareGuard provides real-time protection against spyware.
- Not required if you have other "realtime" antispyware or Winpatrol
ZonedOut
- Formerly known as IE-SPYAD, adds a long list of sites and domains associated with known advertisers and marketers to the Restricted sites zone of Internet Explorer.
MVPS HOSTS
- This little program packs a powerful punch as it blocks ads, banners, 3rd party Cookies, 3rd party page counters, web bugs, and many hijackers.
- For information on how to download and install, please read this tutorial by WinHelp2002.
- Not required if you are using other host file protections

Internet Browsers

Microsoft has worked hard to make IE.7 a more secure browser, unfortunately whilst it is still the leading browser of choice it will always be under attack from the bad guys.
Using a different web browser can help stop malware getting on your machine.
- Make your Internet Explorer more secure - This can be done by following these simple instructions:
  1. From within Internet Explorer click on the Tools menu and then click on Options.
  2. Click once on the Security tab
  3. Click once on the Internet icon so it becomes highlighted.
  4. Click once on the Custom Level button.
    - Change the Download signed ActiveX controls to Prompt
    - Change the Download unsigned ActiveX controls to Disable
    - Change the Initialise and script ActiveX controls not marked as safe to Disable
    - Change the Installation of desktop items to Prompt
    - Change the Launching programs and files in an IFRAME to Prompt
    - Change the Navigate sub-frames across different domains to Prompt
    - When all these settings have been made, click on the OK button.
    - If it prompts you as to whether or not you want to save the settings, press the Yes button.
  5. Next press the Apply button and then the OK to exit the Internet Properties page.
If you are still using IE6 then either update, or get one of the following.
- FireFox
  - With many addons available that make customization easy this is a very popular choice
  - NoScript and AdBlockPlus addons are essential
- Opera
  - Another popular alternative
- Netscape
  - Another popular alternative
  - Also has Addons available

Cleaning Temporary Internet Files and Tracking Cookies

Temporary Internet Files are mainly the files that are downloaded when you open a web page.
Unfortunately, if the site you visit is of a dubious nature or has been hacked, they can also be an entry point for malware.
It is a good idea to empty the Temporary Internet Files folder on a regular basis.

Tracking Cookies are files that websites use to monitor which sites you visit and how often.
A lot of Antispyware scanners pick up these tracking cookies and flag them as unwanted.
CAUTION :- If you delete all your cookies you will lose any autologin information for sites that you visit, and will need your passwords

Both of these can be cleaned manually, but a quicker option is to use a program
ATF Cleaner
- Free and very simple to use
CCleaner
- Free and very flexible, you can chose which cookies to keep

Also PLEASE read this article.....So How Did I Get Infected In The First Place

The last and most important thing I can tell you is UPDATE.
If you don't update your security programs (Antivirus, Antispyware even Windows) then you are at risk.
Malware changes on a day to day basis. You should update every week at the very least.

If you follow this advice then (with a bit of luck) you will never have to hear from me again

If you could post back one more time to let me know everything is OK, then I can have this thread archived.

Happy surfing K'

aznintent · July 2009

Finished reloading the original image and everything is working great. Thanks again for your help!

Yet another NOD32 winlogon.exe ursnif.a virus

Comments