Malware infection - need help please

Quizzical · September 26, 2009

Problem began 4 days ago.
Became concerned after unusual "security alert" that wouldn't clear
AVG scan identified Clicker.AAWS and Downloader.Zlob and quarantined
Not sorted though - Symptoms after that included IE (which I don't normally use) opening by itself every few minutes
I noticed a couple of spurious processes running (a.exe) which I manually deleted
Also none of my anti-malware apps would run, including AVG which was now disabled as well
Tried HJT, Spybot, Adaware already on my PC - none worked
Next ran HouseCall which identified an infected .sys file it labelled as TR/PCK.Tdss.C.92
Still couldn't run any apps
Next installed Avira and this was able to run a full scan, identifying and quarantining the file that HouseCall had quarantined plus 3 others KillIt.exe, KillWind.exe and 1890hp.exe which it labelled as Hupigon.huap
Still unable to run any other malware apps, but Avira apparently running OK
Installed MBAM, it updated, then launched and then crashed after 4 secs
Tried running some other things, Rootrepeal, GMER, got Blue Screened

I've now no idea what to do for the best and would really appreciate some help.

Sorry if anything I've tried has made the problem more difficult to solve

screen317 · September 27, 2009

Hi and welcome to Malwarebytes.

Please visit this webpage for instructions for running ComboFix:

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

When the tool is finished, it will produce a report for you.
Please post the C:\ComboFix.txt along with a new HijackThis log so we may continue cleaning the system.

-screen317

Quizzical · September 27, 2009

Hello and thanks for your reply.

ComboFix appeared to remove/fix some files during the process but I can't see details of that in the log. You're probably not surprised by that but just thought I'd mention it.

Log follows:

ComboFix 09-09-25.01 - Compaq_Owner 27/09/2009 8:53.1.2 - NTFSx86

Microsoft Windows XP Home Edition 5.1.2600.2.1252.44.1033.18.1023.673 [GMT 1:00]

Running from: c:\documents and settings\Compaq_Owner\Desktop\ComboFix.exe

AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\documents and settings\Compaq_Owner\Application Data\Desktopicon

c:\documents and settings\Compaq_Owner\Application Data\Desktopicon\eBayShortcuts.exe

c:\documents and settings\Compaq_Owner\My Documents\ZbThumbnail.info

c:\windows\jestertb.dll

c:\windows\system32\ps2.bat

E:\Autorun.inf

Infected copy of c:\windows\system32\eventlog.dll was found and disinfected

Restored copy from - c:\windows\system32\dllcache\eventlog.dll

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Legacy_uac4pdt

-------\Legacy_UACd.sys

-------\Legacy_{79007602-0CDB-4405-9DBF-1257BB3226ED}

-------\Service_uac4pdt

-------\Service_UACd.sys

((((((((((((((((((((((((( Files Created from 2009-08-27 to 2009-09-27 )))))))))))))))))))))))))))))))

.

2009-09-26 11:01 . 2009-09-27 07:25 -------- d-----w- c:\program files\Spybot - Search & Destroy

2009-09-26 10:03 . 2009-09-26 10:03 -------- d-----w- c:\program files\ERUNT

2009-09-25 21:27 . 2009-09-23 16:02 102664 ----a-w- c:\windows\system32\drivers\tmcomm.sys

2009-09-24 21:07 . 2009-07-28 15:33 55656 ----a-w- c:\windows\system32\drivers\avgntflt.sys

2009-09-24 21:07 . 2009-03-30 09:33 96104 ----a-w- c:\windows\system32\drivers\avipbb.sys

2009-09-24 21:07 . 2009-02-13 11:29 22360 ----a-w- c:\windows\system32\drivers\avgntmgr.sys

2009-09-24 21:07 . 2009-02-13 11:17 45416 ----a-w- c:\windows\system32\drivers\avgntdd.sys

2009-09-24 21:07 . 2009-09-24 21:07 -------- d-----w- c:\program files\Avira

2009-09-24 21:07 . 2009-09-24 21:07 -------- d-----w- c:\documents and settings\All Users\Application Data\Avira

2009-09-24 16:06 . 2009-09-24 16:06 -------- d-----w- c:\documents and settings\Compaq_Owner\Application Data\Azureus

2009-09-23 18:38 . 2009-09-23 18:40 -------- d-----w- c:\documents and settings\Compaq_Owner\DoctorWeb

2009-09-23 17:29 . 2009-09-23 17:29 -------- d-----w- c:\program files\OEBW

2009-09-23 16:02 . 2009-09-25 21:27 -------- d-----w- c:\documents and settings\Compaq_Owner\.housecall6.6

2009-09-22 22:55 . 2009-09-22 22:55 -------- d-----w- c:\documents and settings\Compaq_Owner\Application Data\Malwarebytes

2009-09-22 22:55 . 2009-09-22 22:55 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes

2009-09-22 17:03 . 2009-09-27 07:16 0 ----a-r- c:\windows\win32k.sys

2009-09-22 17:03 . 2009-09-22 17:03 68608 ----a-w- c:\windows\system32\drivers\cyehxtksmqecxrxe.sys

2009-09-22 17:03 . 2009-09-22 17:03 -------- d-----w- C:\spoolerlogs

2009-09-22 16:53 . 2009-09-22 16:53 68608 ----a-w- c:\windows\system32\drivers\rpvnyycbvorxvmtn.sys

2009-09-06 17:01 . 2009-09-06 17:01 -------- d-----w- c:\program files\CopyFilenames

2009-08-29 08:18 . 2009-08-29 08:18 -------- d-----w- c:\documents and settings\All Users\Application Data\Azureus

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-09-27 08:01 . 2009-09-06 12:09 0 ----a-w- c:\windows\system32\drivers\lvuvc.hs

2009-09-27 07:25 . 2005-09-10 17:06 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy

2009-09-26 10:39 . 2009-06-12 05:57 -------- d-----w- c:\program files\Unlocker

2009-09-25 22:41 . 2008-05-03 12:10 -------- d-----w- c:\program files\Lavasoft

2009-09-25 22:40 . 2005-09-10 17:06 -------- d-----w- c:\program files\Spybot

2009-09-25 22:38 . 2009-08-21 12:08 -------- d-----w- c:\program files\PicaLoader

2009-09-25 22:36 . 2008-05-31 21:53 -------- d-----w- c:\documents and settings\All Users\Application Data\avg8

2009-09-23 22:44 . 2009-02-17 19:53 -------- d-----w- c:\program files\Azureus

2009-09-22 23:22 . 2008-06-12 17:37 -------- d-----w- c:\program files\PowerPacket

2009-09-20 20:00 . 2005-09-03 15:15 -------- d-----w- c:\documents and settings\All Users\Application Data\Retrospect

2009-09-06 19:10 . 2005-10-28 16:23 -------- d-----w- c:\documents and settings\Compaq_Owner\Application Data\Skype

2009-09-06 15:01 . 2008-10-19 15:31 -------- d-----w- c:\documents and settings\Compaq_Owner\Application Data\skypePM

2009-09-06 12:09 . 2008-02-04 16:56 -------- d-----w- c:\program files\Common Files\Logishrd

2009-08-26 21:07 . 2005-08-31 14:08 -------- d-----w- c:\program files\TotalRecorder

2009-08-17 09:01 . 2005-08-30 17:50 63904 ----a-w- c:\documents and settings\Compaq_Owner\Local Settings\Application Data\GDIPFONTCACHEV1.DAT

2009-08-15 13:27 . 2009-08-15 13:27 -------- d-----w- c:\program files\MSBuild

2009-08-15 13:27 . 2009-08-15 13:27 -------- d-----w- c:\program files\Reference Assemblies

2009-08-15 13:23 . 2009-08-15 13:23 -------- d-----w- c:\program files\MSXML 6.0

2009-08-15 09:32 . 2009-08-14 11:08 -------- d-----w- c:\documents and settings\All Users\Application Data\NOS

2009-08-15 09:32 . 2009-08-14 11:08 -------- d-----w- c:\program files\NOS

2009-08-10 16:49 . 2005-08-31 13:54 -------- d-----w- c:\program files\whisper

2009-07-29 09:23 . 2004-08-04 12:00 119808 ----a-w- c:\windows\system32\t2embed.dll

2009-07-29 04:53 . 2004-08-04 12:00 82432 ----a-w- c:\windows\system32\fontsub.dll

2005-09-14 09:58 . 2005-09-09 11:08 20480 ----a-w- c:\program files\Common Files\UninstallDrv.exe

2005-10-28 07:31 . 2005-08-31 11:40 56 --sha-r- c:\windows\system32\5A04C4CEF8.sys

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2004-10-13 1694208]

"updateMgr"="c:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 313472]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"hpsysdrv"="c:\windows\system\hpsysdrv.exe" [1998-05-07 52736]

"Recguard"="c:\windows\SMINST\RECGUARD.EXE" [2004-04-14 233472]

"PS2"="c:\windows\system32\ps2.exe" [2003-09-12 98304]

"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]

"AGRSMMSG"="AGRSMMSG.exe" - c:\windows\AGRSMMSG.exe [2004-06-29 88363]

c:\documents and settings\Compaq_Owner\Start Menu\Programs\Startup\

ERUNT AutoBackup.lnk - c:\program files\ERUNT\AUTOBACK.EXE [2005-10-20 38912]

c:\documents and settings\All Users\Start Menu\Programs\Startup\

Logitech SetPoint.lnk - c:\program files\Logitech\SetPoint\SetPoint.exe [2008-7-21 805392]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]

2008-05-02 01:42 72208 ----a-w- c:\program files\Common Files\Logitech\Bluetooth\LBTWLgn.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]

"mixer"=DrvTrNTm.dll

"wave"=DrvTrNTm.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]

@=""

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]

"QuickTime Task"="c:\program files\QuickTime\qttask.exe" -atboottime

"Kernel and Hardware Abstraction Layer"=KHALMNPR.EXE

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\Messenger\\msmsgs.exe"=

"c:\\WINDOWS\\system32\\fxsclnt.exe"=

"c:\\Program Files\\DTV\\DVB-T USB 2.0\\DVB-Tplayer.exe"=

"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=

"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=

"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=

"c:\\Program Files\\AIM6\\aim6.exe"=

"c:\\WINDOWS\\system32\\dpvsetup.exe"=

"c:\\Program Files\\TotalRecorder\\TotalRecorder.exe"=

"c:\\Program Files\\Netscape\\Netscape\\Netscp.exe"=

"c:\\Program Files\\Azureus\\Azureus.exe"=

"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"49251:TCP"= 49251:TCP:v

"49251:UDP"= 49251:UDP:v

R0 HFXP2;HFXP2;c:\windows\system32\drivers\hfxp2.sys [24/07/2008 22:39 17264]

R1 HFSYS;HFSYS;c:\windows\system32\drivers\hfsys.sys [12/01/2004 01:34 19732]

R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [24/09/2009 22:07 108289]

R3 PRISM_A00;Wireless PCI 802.11b/g adapter WN4201B Driver;c:\windows\system32\drivers\PCTELSAP.SYS [02/01/2005 01:00 306560]

R3 TotRec7;Total Recorder WDM audio driver;c:\windows\system32\drivers\TotRec7.sys [17/08/2008 14:48 126984]

R3 WDM_Capture_220A;DVB-T TV Receiver;c:\windows\system32\drivers\WDM_Capture_220A.sys [06/04/2006 13:57 18432]

S3 Arcadyan;Arcadyan NDIS Protocol Driver;c:\progra~1\PC-DOC~1\DIAGNO~1\Arcadyan.SYS [20/08/2004 03:14 17422]

S3 PLCMPR5;PLCMPR5 NDIS Protocol Driver;\??\c:\windows\system32\PLCMPR5.SYS --> c:\windows\system32\PLCMPR5.SYS [?]

S3 PLCNDIS5;PLCNDIS5 NDIS Protocol Driver;c:\windows\system32\PLCNDIS5.SYS [26/04/2004 11:11 17280]

S3 WDM_Loader_220A;DVB-T TV Loader;c:\windows\system32\drivers\WDM_Loader_220A.sys [06/04/2006 13:56 15488]

S4 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [06/11/2008 20:55 24652]

.

Contents of the 'Scheduled Tasks' folder

.

------- Supplementary Scan -------

.

uStart Page = hxxp://www.google.com/

mStart Page = about:blank

uInternet Connection Wizard,ShellNext = iexplore

uSearchURL,(Default) = hxxp://www.google.com/search?q=%s

TCP: {08422DD0-F4AF-4740-8A75-0201C59D6AC5} = 212.159.6.9,212.159.6.10

Handler: copernicagent - {A979B6BD-E40B-4A07-ABDD-A62C64A4EBF6} - c:\progra~1\COPERN~1\COPERN~1.DLL

Handler: copernicagentcache - {AAC34CFD-274D-4A9D-B0DC-C74C05A67E1D} - c:\progra~1\COPERN~1\COPERN~1.DLL

DPF: {FE8FE5F0-E1EE-4ACD-81E0-2A6CFECB8431} - hxxp://downloads.exam2score.com/ePenClientSpec.ocx

FF - ProfilePath - c:\documents and settings\Compaq_Owner\Application Data\Mozilla\Firefox\Profiles\zkvadj3e.default\

FF - prefs.js: browser.startup.homepage - hxxp://www.google.co.uk/

FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll

FF - plugin: c:\program files\Mozilla Firefox\plugins\npViewpoint.dll

FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll

.

- - - - ORPHANS REMOVED - - - -

Notify-avgrsstarter - avgrsstx.dll

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-09-27 09:02

Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

.

--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10c.exe,-101"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\Elevation]

"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\LocalServer32]

@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10c.exe"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}]

@Denied: (A 2) (Everyone)

@="IFlashBroker3"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(844)

c:\windows\system32\Ati2evxx.dll

c:\program files\common files\logitech\bluetooth\LBTWlgn.dll

c:\program files\common files\logitech\bluetooth\LBTServ.dll

- - - - - - - > 'explorer.exe'(2844)

c:\program files\Logitech\SetPoint\lgscroll.dll

c:\progra~1\WINDOW~1\wmpband.dll

.

------------------------ Other Running Processes ------------------------

.

c:\windows\system32\ati2evxx.exe

c:\program files\Avira\AntiVir Desktop\avguard.exe

c:\progra~1\Dantz\RETROS~1\retrorun.exe

c:\windows\system32\ati2evxx.exe

c:\progra~1\Dantz\RETROS~1\wdsvc.exe

c:\windows\system32\wdfmgr.exe

c:\windows\system32\MsPMSPSv.exe

c:\program files\Canon\CAL\CALMAIN.exe

c:\windows\system32\wscntfy.exe

c:\program files\Common Files\Logishrd\KHAL2\KHALMNPR.exe

.

**************************************************************************

.

Completion time: 2009-09-27 9:07 - machine was rebooted

ComboFix-quarantined-files.txt 2009-09-27 08:07

Pre-Run: 100,086,472,704 bytes free

Post-Run: 99,959,095,296 bytes free

214 --- E O F --- 2009-08-15 13:32

Whatever ComboFix did, I was then able to download, install and successfully run HJT - Log follows:

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 09:16:42, on 27/09/2009

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Avira\AntiVir Desktop\sched.exe

C:\Program Files\Avira\AntiVir Desktop\avguard.exe

C:\PROGRA~1\Dantz\RETROS~1\retrorun.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\PROGRA~1\Dantz\RETROS~1\wdsvc.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\MsPMSPSv.exe

C:\Program Files\Canon\CAL\CALMAIN.exe

C:\windows\system\hpsysdrv.exe

C:\WINDOWS\AGRSMMSG.exe

C:\WINDOWS\system32\ps2.exe

C:\Program Files\Avira\AntiVir Desktop\avgnt.exe

C:\Program Files\Messenger\msmsgs.exe

C:\Program Files\Logitech\SetPoint\SetPoint.exe

C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE

C:\WINDOWS\explorer.exe

C:\WINDOWS\system32\notepad.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank

N3 - Netscape 7: user_pref("browser.startup.homepage", "http://www.google.com"); (C:\Documents and Settings\COMPAQ_OWNER\Application Data\Mozilla\Profiles\default\qy4mtwbp.slt\prefs.js)

N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CProgram%20Files%5CNetscape%5CNetscape%5Csearchplugins%5CNetscape_UK.src"); (C:\Documents and Settings\COMPAQ_OWNER\Application Data\Mozilla\Profiles\default\qy4mtwbp.slt\prefs.js)

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - (no file)

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.3.4501.1418\swg.dll

O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll

O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll

O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe

O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe

O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE

O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe

O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min

O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background

O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_1_0 -reboot 1

O4 - Startup: ERUNT AutoBackup.lnk = C:\Program Files\ERUNT\AUTOBACK.EXE

O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll

O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204

O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) - https://www-secure.symantec.com/techsupp/as...rl/LSSupCtl.cab

O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - https://www-secure.symantec.com/techsupp/as...rl/SymAData.cab

O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

O16 - DPF: {FE8FE5F0-E1EE-4ACD-81E0-2A6CFECB8431} (ePenClientSpec.ucEPenClientspec) - http://downloads.exam2score.com/ePenClientSpec.ocx

O17 - HKLM\System\CCS\Services\Tcpip\..\{08422DD0-F4AF-4740-8A75-0201C59D6AC5}: NameServer = 212.159.6.9,212.159.6.10

O17 - HKLM\System\CS1\Services\Tcpip\..\{08422DD0-F4AF-4740-8A75-0201C59D6AC5}: NameServer = 212.159.6.9,212.159.6.10

O17 - HKLM\System\CS2\Services\Tcpip\..\{08422DD0-F4AF-4740-8A75-0201C59D6AC5}: NameServer = 212.159.6.9,212.159.6.10

O17 - HKLM\System\CS3\Services\Tcpip\..\{08422DD0-F4AF-4740-8A75-0201C59D6AC5}: NameServer = 212.159.6.9,212.159.6.10

O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - (no file)

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL

O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe

O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe

O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe

O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe

O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\Logitech\Bluetooth\LBTServ.exe

O23 - Service: NMSAccess - Unknown owner - C:\Program Files\CDBurnerXP\NMSAccess.exe

O23 - Service: Retrospect Launcher (RetroLauncher) - Dantz Development Corporation - C:\PROGRA~1\Dantz\RETROS~1\retrorun.exe

O23 - Service: Retrospect Helper - Dantz Development Corporation - C:\PROGRA~1\Dantz\RETROS~1\rthlpsvc.exe

O23 - Service: Retrospect WD Service (RetroWDSvc) - Dantz Development Corporation - C:\PROGRA~1\Dantz\RETROS~1\wdsvc.exe

O24 - Desktop Component 0: (no name) - file:///C:/DOCUME~1/COMPAQ~1/LOCALS~1/Temp/msohtml1/01/clip_image002.jpg

--

End of file - 6772 bytes

screen317 · September 27, 2009

Hi,

Next, please use the Internet Explorer browser and click here to use the F-Secure Online Scanner.

Click Start Scanning.
You should get a notification bar (on top) to install the ActiveX control.
Click on it and select to install the ActiveX.
Once the ActiveX is installed, you should accept the License terms by clicking OK below to start the scan.
In case you are having problems with installing the ActiveX/starting the scan, please read here.
Click the Full System Scan button.
It will start to download scanner components and databases. This can take a while.
The main scan will start.
Once the scan has finished scanning, click the Automatic cleaning (recommended) button
It could be possible that your firewall gives an alert - allow it, because that's a connection you establish to submit infected files to F-Secure.
The cleaning can take a while, so please be patient.
Then click the Show report button and Copy/Paste what is present under results in your next reply.

Next, download my Security Check from here or here.

Save it to your Desktop.
Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
A Notepad document should open automatically called checkup.txt; please post the contents of that document.

Let me know how things are running now and what issues remain.

-screen317

Quizzical · September 28, 2009

Ok, thanks again. Ran the two things you suggested and the logs follow below. Anything untoward?

Since then I've run Avira and it has detected two nasties (which weren't there on last night's scan) and also 25 "hidden files" which were also there last night and which it says it can't shift (despite my attempt to clean out IE temp files). There are 8 further warnings. Do I need to do anything about these? I've posted the Avira report also, after your Security Check file checkup.txt.

Everything appears to be running smoothly, though one or two processes I don't recognise (fssm32.exe is one of them) are now running - perhaps these are connected with what you asked me to do?

I would normally make regular use of SpyBot and Adaware alongside AVG and I'm still a bit spooked as to how the stuff that caused the trouble these last few days got onto my machine - what did I do wrong?

Is there something better you can recommend?

Many thanks for all your time and help - you guys are stars !!

Here's the F-Secure report...

Scanning Report

Monday, September 28, 2009 18:31:29 - 19:29:13

Computer name: STARSKY

Scanning type: Scan system for malware, spyware and rootkits

Target: C:\ D:\ E:\

--------------------------------------------------------------------------------

No malware found

--------------------------------------------------------------------------------

Statistics

Scanned:

Files: 56894

System: 4743

Not scanned: 13

Actions:

Disinfected: 0

Renamed: 0

Deleted: 0

Not cleaned: 0

Submitted: 0

Files not scanned:

C:\PAGEFILE.SYS

C:\WINDOWS\SYSTEM32\DUMPREP.EXE

C:\WINDOWS\SYSTEM32\MRT.EXE

C:\WINDOWS\SYSTEM32\CONFIG\DEFAULT

C:\WINDOWS\SYSTEM32\CONFIG\SAM

C:\WINDOWS\SYSTEM32\CONFIG\SECURITY

C:\WINDOWS\SYSTEM32\CONFIG\SOFTWARE

C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM

C:\SYSTEM VOLUME INFORMATION\MOUNTPOINTMANAGERREMOTEDATABASE

C:\PROGRAM FILES\SPYBOT - SEARCH & DESTROY\SPYBOTSD.EXE

C:\PROGRAM FILES\SPYBOT\SPYBOTSD.EXE

C:\PROGRAM FILES\COMMON FILES\AOL\LOADER\AOLLOAD.EXE

C:\DOCUMENTS AND SETTINGS\COMPAQ_OWNER\MY DOCUMENTS\STEVE\SPYWARE\HIJACKTHIS.EXE

--------------------------------------------------------------------------------

Options

Scanning engines:

Scanning options:

Scan defined files: COM EXE SYS OV? BIN SCR DLL SHS HTM HTML HTT VBS JS INF VXD DO? XL? RTF CPL WIZ HTA PP? PWZ P?T MSO PIF . ACM ASP AX CNV CSC DRV INI MDB MPD MPP MPT OBD OBT OCX PCI TLB TSP WBK WBT WPC WSH VWP WML BOO HLP TD0 TT6 MSG ASD JSE VBE WSC CHM EML PRC SHB LNK WSF {* PDF ZL? XML XXX ANI AVB BAT CMD JOB LSP MAP MHT MIF PHP POT SWF WMF NWS TAR

Use advanced heuristics

--------------------------------------------------------------------------------

Copyright

screen317 · September 30, 2009

Ok, thanks again. Ran the two things you suggested and the logs follow below. Anything untoward?

Those "hidden" temp files are rather untoward, though they might have been part of the online scan. Grab a fresh copy of ComboFix, run it, and post its log.

Actually before you do that, navigate to Start --> Control Panel --> Add or Remove Programs, and uninstall the following programs (if present):

Java Web Start

Java™ 6 Update 3

Java 2 Runtime Environment, SE v1.4.2_03

Java 2 Runtime Environment, SE v1.4.0_01

Java 2 Runtime Environment, SE v1.4.1_02

Adobe Reader 7.1.0

Restart your computer.

Get the latest version of Java and Adobe Reader.

Then run ComboFix and post its log.

Since then I've run Avira and it has detected two nasties (which weren't there on last night's scan) and also 25 "hidden files" which were also there last night and which it says it can't shift (despite my attempt to clean out IE temp files). There are 8 further warnings. Do I need to do anything about these? I've posted the Avira report also, after your Security Check file checkup.txt.

We'll see after you post the ComboFix log.

Everything appears to be running smoothly, though one or two processes I don't recognise (fssm32.exe is one of them) are now running - perhaps these are connected with what you asked me to do?

That's from the F-Secure online scan.

I would normally make regular use of SpyBot and Adaware alongside AVG and I'm still a bit spooked as to how the stuff that caused the trouble these last few days got onto my machine - what did I do wrong?

Could be a number of things; the most common being visiting porn, keygen, and crack sites. Could be from social networking sites, P2P programs, etc. It's a tainted cyberworld we live in.

Also, anti-malware programs are not infallible; the criminals come up with more deceptive tactics and often the major corporations are left behind.

-screen317

Quizzical · September 30, 2009

Hello and thanks again for your continued support. I've uninstalled all the things you listed, re-started, installed new Java and Adobe, then ran ComboFix. It appeared to run successfully, did not this time reboot into safe mode before scanning; logfile below.

All seemed to be running smoothly, so I tried moving back towards "normal" working, but some weird things are still happening.

1. I ran Avira and it reported exactly the same set of hidden files as last time, at the same location. But when I navigate to the folder where the files are located and get Avira to scan the folder (using the right-click menu) it reports no files present. Haven't bothered to post the Avira report since it's the same details as yesterday, but will do so if you'd like to see it.

2. Avira flagged that it needed to be updated but the updater wouldn't run (it launched and then hung, several times). I manually updated from the website.

3. Tried Spybot but cannot run it, or uninstall it or reinstall it. It doesn't appear in Control Panel

screen317 · September 30, 2009

Hi,

Next, please open Notepad - don't use any other text editor than notepad or the script will fail.

Copy/paste the text in the quotebox below into Notepad:

Folder::
c:\documents and settings\compaq_owner\local settings\temporary internet files\content.ie5

Save this as CFScript

Then drag the CFScript into ComboFix.exe as you see in the screenshot below.

This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply together with a new HijackThis log.

After that, please reboot to Safe Mode (tap the F8 key just before Windows starts to load and select the Safe Mode option from the menu). See if you can delete Spybot's folder now.

-screen317

Quizzical · October 1, 2009

OK, I copied the script and used it to launch ComboFix. Rebooted into Safe Mode but was unable to delete the Spybot folder. When Windows came to delete the SpybotSD.exe file access was denied. (FYI, there are two copies of Spybot files. When I first had problems I reinstalled Spybot into a differently named folder, but neither SpybotSD.exe file will run, or delete.) I do have two utilities (Unlocker and MoveOnBoot) that I have used before but have not yet tried on this Spybot problem in case it messes up anything you're trying do to help me.

I have also run Avira again and again it has identified the same 25 hidden files as before, in the same location as before. It also says it has found two further infections, looks like in the system restore, so I'm posting the log for that scan as well in case it tells you stuff.

Question - I have avoided, for the past week, using anything on the internet for which a password is required; do you think I'm safe to start doing that again yet?

Many thanks once more for your continued patience.

Combo Fix and HJT and Avira logs follow....

ComboFix 09-09-30.06 - Compaq_Owner 01/10/2009 17:57.3.2 - NTFSx86

Microsoft Windows XP Home Edition 5.1.2600.2.1252.44.1033.18.1023.595 [GMT 1:00]

Running from: c:\documents and settings\Compaq_Owner\Desktop\ComboFix.exe

Command switches used :: c:\documents and settings\Compaq_Owner\Desktop\CFScript.txt

AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\documents and settings\compaq_owner\local settings\temporary internet files\content.ie5\81AVO1YR\desktop.ini

c:\documents and settings\compaq_owner\local settings\temporary internet files\content.ie5\98U6ZA0R\[1]

c:\documents and settings\compaq_owner\local settings\temporary internet files\content.ie5\98U6ZA0R\[10]

c:\documents and settings\compaq_owner\local settings\temporary internet files\content.ie5\98U6ZA0R\[11]

c:\documents and settings\compaq_owner\local settings\temporary internet files\content.ie5\98U6ZA0R\[12]

c:\documents and settings\compaq_owner\local settings\temporary internet files\content.ie5\98U6ZA0R\[13]

c:\documents and settings\compaq_owner\local settings\temporary internet files\content.ie5\98U6ZA0R\[14]

c:\documents and settings\compaq_owner\local settings\temporary internet files\content.ie5\98U6ZA0R\[15]

c:\documents and settings\compaq_owner\local settings\temporary internet files\content.ie5\98U6ZA0R\[2]

c:\documents and settings\compaq_owner\local settings\temporary internet files\content.ie5\98U6ZA0R\[3]

c:\documents and settings\compaq_owner\local settings\temporary internet files\content.ie5\98U6ZA0R\[4]

c:\documents and settings\compaq_owner\local settings\temporary internet files\content.ie5\98U6ZA0R\[5]

c:\documents and settings\compaq_owner\local settings\temporary internet files\content.ie5\98U6ZA0R\[6]

c:\documents and settings\compaq_owner\local settings\temporary internet files\content.ie5\98U6ZA0R\[7]

c:\documents and settings\compaq_owner\local settings\temporary internet files\content.ie5\98U6ZA0R\[8]

c:\documents and settings\compaq_owner\local settings\temporary internet files\content.ie5\98U6ZA0R\[9]

c:\documents and settings\compaq_owner\local settings\temporary internet files\content.ie5\98U6ZA0R\desktop.ini

c:\documents and settings\compaq_owner\local settings\temporary internet files\content.ie5\98U6ZA0R\eTicket.pdf

c:\documents and settings\compaq_owner\local settings\temporary internet files\content.ie5\desktop.ini

c:\documents and settings\compaq_owner\local settings\temporary internet files\content.ie5\FFNH1X0A\desktop.ini

c:\documents and settings\compaq_owner\local settings\temporary internet files\content.ie5\index.dat

c:\documents and settings\compaq_owner\local settings\temporary internet files\content.ie5\W12Z4TAV\desktop.ini

.

((((((((((((((((((((((((( Files Created from 2009-09-01 to 2009-10-01 )))))))))))))))))))))))))))))))

.

2009-09-30 20:56 . 2009-09-10 13:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2009-09-30 20:56 . 2009-09-30 22:03 -------- d-----w- c:\program files\Malwarebytes

2009-09-30 20:56 . 2009-09-10 13:53 19160 ----a-w- c:\windows\system32\drivers\mbam.sys

2009-09-30 17:26 . 2009-09-30 17:26 411368 ----a-w- c:\windows\system32\deploytk.dll

2009-09-28 17:31 . 2009-09-28 17:31 -------- d-----w- c:\documents and settings\All Users\Application Data\F-Secure

2009-09-27 08:16 . 2009-09-27 08:16 -------- d-----w- c:\program files\Trend Micro

2009-09-26 11:01 . 2009-09-30 20:35 -------- d-----w- c:\program files\Spybot - Search & Destroy