This is a read-only archive of malwareremoval.com. No new posts or registrations. Privacy Page
Malware Removal Forums

HiJackThis logfile- computer acting very strangely

13 min read

This thread's last reply is from January 8, 2009, 7:28 AM UTC. Software, malware, and removal-tool advice below may be out of date — treat specific steps and download links with caution.

TimAi
December 27, 2008, 4:02 AM UTC
OK, so, always had a firewall, always use antivirus everyday, Spybot & adaware roughly once per week.

About a week and a half ago, AVG's infections jump from a handful to upwards of 50,000. It keeps spitting out "Trojan Horse Downloader" I get rid of everything I can, but every scan is the same. After restarting/shut down- they're all back again. Spybot and Adaware weren't finding anything.

I took a closer look at some of the infections AVG was showing and they all trace back to "D:\documents and settings\tim\searched" I tried to delete the folder by the usual means, but when i get to "Tim" there is no "Searched" folder there. tried to use the Windows search to find it- nothing.

So, i put in the full path and finally get into the "Searched" folder and all it contains are several hundred thousand MP3 files, all are listed as only being 45k (obviously fake). Each file is titled like any other MP3 "Artist" - "Song Title"

Trying to select and delete the files crashes the program or spits out generic "file can't be accessed" and "please specify a valid path" errors, i'm assuming because the folder is 'hidden'. Trying to move the files to another folder (one that can be seen) crashes the program.

Another weird thing- it's not letting me turn on Windows' Automatic Updates. I click the button to turn it on and nothing happens. Tried through "Internet Options" - same thing. And of course when i go to update windows manually- it says i need to enable Automatic Updates first and wont let me continue (duh).

the boards say many others out there that are having the same problem. I'm hoping there is a fix by now- i just reinstalled windows and really don't want to sit through it all again.

I'm running windows XP with SP3 installed

thanks in advance for any help i can get!


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:28:53 PM, on 12/26/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
D:\WINDOWS\system32\LEXBCES.EXE
D:\WINDOWS\system32\spoolsv.exe
D:\WINDOWS\system32\LEXPPS.EXE
D:\PROGRA~1\COMMON~1\aol\ACS\acsd.exe
D:\WINDOWS\ATKKBService.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
D:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
D:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
D:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
D:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
D:\WINDOWS\system32\nvsvc32.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\wanmpsvc.exe
D:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
D:\WINDOWS\SOUNDMAN.EXE
D:\WINDOWS\system32\RUNDLL32.EXE
C:\PROGRA~1\AVG\AVG8\avgtray.exe
D:\Program Files\Java\jre1.6.0_04\bin\jusched.exe
D:\Program Files\Common Files\AOL\1224032402\ee\AOLSoftware.exe
D:\Documents and Settings\Tim\nview.exe
D:\WINDOWS\system32\ctfmon.exe
D:\WINDOWS\system32\svchost.exe
C:\Program Files\America Online 9.0\aoltray.exe
D:\WINDOWS\system32\wscntfy.exe
D:\Program Files\Java\jre1.6.0_04\bin\jucheck.exe
D:\WINDOWS\system32\rundll32.exe
D:\Program Files\AutorunRemover\AutorunRemover.exe
C:\Program Files\AVG\AVG8\avgui.exe
C:\Program Files\AVG\AVG8\avgscanx.exe
D:\WINDOWS\system32\rundll32.exe
D:\WINDOWS\explorer.exe
C:\Program Files\America Online 9.0\waol.exe
C:\Program Files\America Online 9.0\shellmon.exe
C:\Program Files\America Online 9.0\aolwbspd.exe
D:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE D:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE D:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "D:\Program Files\Java\jre1.6.0_04\bin\jusched.exe"
O4 - HKLM\..\Run: [HostManager] D:\Program Files\Common Files\AOL\1224032402\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [QuickTime Task] "D:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Windows Logon Applicationedc] D:\Documents and Settings\Tim\winlogon.exe
O4 - HKLM\..\Run: [NVIDIA nView] D:\Documents and Settings\Tim\nview.exe
O4 - HKLM\..\Run: [0cec51f5] rundll32.exe "D:\WINDOWS\system32\djdkinvu.dll",b
O4 - HKCU\..\Run: [ctfmon.exe] D:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: America Online 9.0 Tray Icon.lnk = C:\Program Files\America Online 9.0\aoltray.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~1\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - D:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - D:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{52A1F4AC-E11F-4DFB-966F-27A6CF18ED38}: NameServer = 205.188.146.145
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O18 - Filter hijack: text/html - {e78882db-cb15-4489-b390-4aa430424cbd} - (no file)
O20 - AppInit_DLLs: avgrsstx.dll gawvrx.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - D:\PROGRA~1\COMMON~1\aol\ACS\acsd.exe
O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - D:\WINDOWS\ATKKBService.exe
O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: ForceWare Intelligent Application Manager (IAM) - Unknown owner - D:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
O23 - Service: Forceware Web Interface (ForcewareWebInterface) - Apache Software Foundation - D:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - D:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: ForceWare IP service (nSvcIp) - NVIDIA - D:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
O23 - Service: ForceWare user log service (nSvcLog) - NVIDIA - D:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - D:\WINDOWS\system32\nvsvc32.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - D:\WINDOWS\wanmpsvc.exe

--
End of file - 6442 bytes
MikeSwim07
December 28, 2008, 4:38 PM UTC
Hello, and to the Malware Removal forums.
My name is Michael I'll be glad to help you with your computer problems.

HijackThis logs can take some time to research, so please be patient with me. I know that you need
your computer working as quickly as possible, and I will work hard to help see that happen.

Please be patient and I'd be grateful if you would note the following:
  • I will working be on your Malware issues, this may or may not, solve other issues you have with your machine.
  • The fixes are specific to your problem and should only be used for this issue on this machine.
  • Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
  • If after 5 days you have not responded to this topic, it will be closed, and you will need to start a new one.
  • It's often worth reading through these instructions and printing them for ease of reference.
  • If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
  • Please reply to this thread. Do not start a new topic.
  • All of my posts need to be checked by a teacher, so please be patient while I attempt to remove your malware.


Make an uninstall list using HijackThis
To access the Uninstall Manager you would do the following:
  • Start HijackThis
  • Click on the Config button
  • Click on the Misc Tools button
  • Click on the Open Uninstall Manager button.
  • Click on the Save list... button and specify where you would like to save this file. When you press Save button a notepad will open with the contents of that file. Save the file to your desktop.


Please post this log on your next reply.

Thanks, Michael
TimAi
December 30, 2008, 3:16 AM UTC
Hi Michael!

Thanks for the welcome and for replying. I followed your instructions, but when i click the "Save List" button, the window closes and nothing happens. Is there something else I can try?
MikeSwim07
December 30, 2008, 4:31 PM UTC
Rename Hijackthis

Rename HijackThis.exe to TimAi.exe by doing the following;

  • Navigate here using Windows Explorer (windows button + E) or My Computer -> Local Disk C: -> C:\Program Files\Trend Micro\HijackThis
  • Right-click on the HijackThis.exe
  • Choose from the pull-down menu; "Rename"
  • And now Rename HijackThis.exe to TimAi.exe
  • Now right click on the renamed hijackthis and click Send to... and then Desktop (create shortcut)...
  • Now go to your desktop and delete the old shortcut called "Hijackthis" Make sure you keep the one called TimAi.exe
  • Now double click the new shortcut.
  • Take a fresh HijackThis log (click Do a system scan and save a log file)
  • Post the fresh HijackThis log here after running ComboFix.


Download and Run ComboFix

Please visit this webpage for instructions for downloading ComboFix at your DESKTOP :
http://www.bleepingcomputer.com/combofix/how-to-use-combofix
Please ensure you read this guide carefully and install the Recovery Console first.

Additional links to download the tool:
http://download.bleepingcomputer.com/sUBs/ComboFix.exe
http://www.forospyware.com/sUBs/ComboFix.exe
http://subs.geekstogo.com/ComboFix.exe

Note: The Windows Recovery Console will allow you to boot up into a special recovery (repair) mode. This allows us to more easily help you should your computer have a problem after an attempted removal of malware. It is a simple procedure that will only take a few moments of your time.

Once installed, you should see a blue screen prompt that says:

The Recovery Console was successfully installed.

Please continue as follows:
  • Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix. A guide to do this can be found here.
    The ones that need to be closed/disabled are:
    AVG8
  • Click Yes to allow ComboFix to continue scanning for malware.
  • When the tool is finished, it will produce a report for you.
  • Please post the C:\ComboFix.txt along with a new HijackThis log so we may continue cleaning the system.
TimAi
December 31, 2008, 10:20 PM UTC
MICHAEL!

More problems- I Downloaded ComboFix and Microsoft Recovery console, but when I drag the file over and drop it on ComboFix as the installation instructions say to, and the blue screen pops up like it's trying to install, but then I get a massage stating "Were you trying to run CFScript? the name CFScript appears to be incorrectly spelt."

Also, somehow "Antivirus 2009" managed to get installed on my comp. Windows reocognizes it as an antivirus, but it's not on my start menu, or the"Add/Rmove Programs" list. So that means it's bogus, right?

By the way, do I have to uninstall AVG to get combofix to run? Because I turned all the features off but Combofix still says that there is antivirus software running.
MikeSwim07
January 1, 2009, 1:35 PM UTC
More problems- I Downloaded ComboFix and Microsoft Recovery console, but when I drag the file over and drop it on ComboFix as the installation instructions say to, and the blue screen pops up like it's trying to install, but then I get a massage stating "Were you trying to run CFScript? the name CFScript appears to be incorrectly spelt."


It sounds like the recovery console may be already installed. Please try double clicking ComboFix.exe and posting the log. If it asks you to install the recovery console again, please tell me.

Also, somehow "Antivirus 2009" managed to get installed on my comp. Windows reocognizes it as an antivirus, but it's not on my start menu, or the"Add/Rmove Programs" list. So that means it's bogus, right?


Yeah, that "AV" is fake!

By the way, do I have to uninstall AVG to get combofix to run? Because I turned all the features off but Combofix still says that there is antivirus software running.


Have you tried this,

Disable AVG

Please open the AVG Control Center program -> double-click on the "AVG Resident Shield" component (looks like this: ) -> deselect the "Turn on AVG Resident Shield" checkmark and save the setting.

When you need to enable the AVG Resident Shield, just open the AVG Control Center program -> double-click on the "AVG Resident Shield" component -> select the "Turn on AVG Resident Shield" checkmark and save the setting.
TimAi
January 2, 2009, 3:53 AM UTC
OK, when i ran combofix, it prompted me to install the recovery console, so i just clicked ok and let it install. Here's the log

ComboFix 08-12-31.01 - Tim 2009-01-01 22:44:23.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2559.1956 [GMT -5:00]
Running from: d:\documents and settings\[removed]\Desktop\ComboFix.exe
AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated)
FW: ActiveArmor Firewall *disabled*
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

d:\docume~1\Tim\LOCALS~1\Temp\tmp2.tmp
d:\documents and settings\Tim\Application Data\Microsoft\Internet Explorer\Quick Launch\Antivirus 2009.lnk
d:\windows\install.exe
d:\windows\kernel32.exe
d:\windows\system32\_004430_.tmp.dll
d:\windows\system32\_004431_.tmp.dll
d:\windows\system32\_004432_.tmp.dll
d:\windows\system32\_004433_.tmp.dll
d:\windows\system32\_004440_.tmp.dll
d:\windows\system32\_004441_.tmp.dll
d:\windows\system32\_004442_.tmp.dll
d:\windows\system32\_004443_.tmp.dll
d:\windows\system32\_004445_.tmp.dll
d:\windows\system32\_004446_.tmp.dll
d:\windows\system32\_004449_.tmp.dll
d:\windows\system32\_004450_.tmp.dll
d:\windows\system32\_004452_.tmp.dll
d:\windows\system32\_004453_.tmp.dll
d:\windows\system32\_004454_.tmp.dll
d:\windows\system32\_004456_.tmp.dll
d:\windows\system32\_004459_.tmp.dll
d:\windows\system32\_004460_.tmp.dll
d:\windows\system32\_004464_.tmp.dll
d:\windows\system32\_004465_.tmp.dll
d:\windows\system32\_004467_.tmp.dll
d:\windows\system32\_004470_.tmp.dll
d:\windows\system32\_004472_.tmp.dll
d:\windows\system32\_004473_.tmp.dll
d:\windows\system32\_004474_.tmp.dll
d:\windows\system32\_004475_.tmp.dll
d:\windows\system32\_004476_.tmp.dll
d:\windows\system32\_004479_.tmp.dll
d:\windows\system32\_004480_.tmp.dll
d:\windows\system32\_004481_.tmp.dll
d:\windows\system32\_004482_.tmp.dll
d:\windows\system32\_004483_.tmp.dll
d:\windows\system32\_004488_.tmp.dll
d:\windows\system32\_004490_.tmp.dll
d:\windows\system32\_004491_.tmp.dll
d:\windows\system32\adysltyi.ini
d:\windows\system32\cbXRLeBt.dll
d:\windows\system32\epeqeg.dll
d:\windows\system32\etvslz.dll
d:\windows\system32\ewhgmtrr.dll
d:\windows\system32\explorer32.exe
d:\windows\system32\fcccyVpN.dll
d:\windows\system32\hndubkxm.dll
d:\windows\system32\ieupdates.exe
d:\windows\system32\iQsrqtwa.ini
d:\windows\system32\iQsrqtwa.ini2
d:\windows\system32\iytlsyda.dll
d:\windows\system32\jfralsod.ini
d:\windows\system32\jthshsnn.dll
d:\windows\system32\kkseqqvi.dll
d:\windows\system32\lejxxq.dll
d:\windows\system32\lqfunh.dll
d:\windows\system32\lvwqob.dll
d:\windows\system32\mxkbudnh.ini
d:\windows\system32\nnshshtj.ini
d:\windows\system32\nqkihivs.dll
d:\windows\system32\omsqhckm.ini
d:\windows\system32\osxqkigb.dll
d:\windows\system32\oxoqlaix.ini
d:\windows\system32\pac.txt
d:\windows\system32\PqrXIkkj.ini
d:\windows\system32\PqrXIkkj.ini2
d:\windows\system32\quqvhwnn.dll
d:\windows\system32\riqbinqe.ini
d:\windows\system32\rjysapvb.ini
d:\windows\system32\ruFilnnn.ini
d:\windows\system32\ruFilnnn.ini2
d:\windows\system32\sxipyqhw.ini
d:\windows\system32\tBeLRXbc.ini
d:\windows\system32\tBeLRXbc.ini2
d:\windows\system32\uvjaospv.ini
d:\windows\system32\uvnikdjd.ini
d:\windows\system32\vhhojiph.ini
d:\windows\system32\vpsoajvu.dll
d:\windows\system32\winsrc.dll
d:\windows\system32\wxgshrsb.ini
d:\windows\system32\xinfhx.dll
d:\windows\system32\xvllsmto.ini
d:\windows\system32\yrnkcxid.dll

.
((((((((((((((((((((((((( Files Created from 2008-12-02 to 2009-01-02 )))))))))))))))))))))))))))))))
.

2009-01-01 13:25 . 2009-01-01 13:25 43,520 --a------ d:\windows\system32\whSLD022328.exe
2008-12-26 23:50 . 2008-12-26 23:50 <DIR> d-------- d:\windows\Sun
2008-12-26 23:49 . 2008-12-26 23:49 410,984 --a------ d:\windows\system32\deploytk.dll
2008-12-26 22:28 . 2008-12-26 22:28 <DIR> d-------- d:\program files\Trend Micro
2008-12-23 10:39 . 2008-12-23 10:39 0 --a------ d:\windows\Vcr32.INI
2008-12-23 10:35 . 2003-08-11 04:30 4,688 --------- d:\windows\system32\drivers\Drwebnet.sys
2008-12-23 10:15 . 2008-12-23 10:16 <DIR> d-------- d:\documents and settings\All Users\Application Data\Lavasoft
2008-12-19 13:12 . 2009-01-01 22:13 <DIR> d--hs---- d:\documents and settings\Tim\Searched
2008-12-19 13:12 . 2008-12-19 13:12 1,519,616 ---hs---- d:\documents and settings\Tim\nview.exe
2008-12-19 13:11 . 2008-12-31 17:40 <DIR> d-------- d:\windows\system32\whSLD02
2008-12-16 18:53 . 2008-12-16 18:53 51,712 ---hs---- d:\documents and settings\Tim\winlogon.exe
2008-12-16 10:50 . 2008-12-16 10:50 0 --ah----- d:\windows\AUTORUN.INI
2008-12-15 23:23 . 2008-12-15 23:23 <DIR> d--hs---- d:\windows\ftpcache
2008-12-15 23:20 . 2008-12-15 23:20 <DIR> d-------- d:\windows\Downloaded Installations
2008-12-15 23:16 . 1996-05-21 18:13 374,784 --ah----- d:\windows\3dg32.dll
2008-12-15 23:14 . 2008-12-15 23:14 <DIR> d-------- d:\documents and settings\All Users\Application Data\Protexis
2008-12-14 09:55 . 2008-04-13 14:45 26,368 --a--c--- d:\windows\system32\dllcache\usbstor.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-12-31 23:25 --------- d-----w d:\program files\Common Files\Real
2008-12-31 23:24 --------- d-----w d:\documents and settings\All Users\Application Data\Apple Computer
2008-12-27 04:48 --------- d-----w d:\program files\Java
2008-12-26 06:46 --------- d-----w d:\program files\Viewpoint
2008-12-26 06:46 --------- d-----w d:\documents and settings\All Users\Application Data\Viewpoint
2008-12-23 15:15 --------- d-----w d:\program files\Common Files\Wise Installation Wizard
2008-11-18 14:44 --------- d-----w d:\documents and settings\All Users\Application Data\AOL
2008-11-07 07:17 --------- d-----w d:\program files\Xvid
2008-11-03 22:49 --------- d-----w d:\documents and settings\Tim\Application Data\Apple Computer
2008-11-03 20:24 --------- d-----w d:\documents and settings\Tim\Application Data\Ashampoo
2008-11-03 02:46 --------- d-----w d:\documents and settings\Tim\Application Data\Viewpoint
2008-10-10 02:40 60,416 ---ha-w d:\windows\ALCFDRTM.EXE
.

------- Sigcheck -------

2008-10-09 22:55 502272 3f5f88baa114124cf9230b8ea84bbce6 d:\windows\$NtServicePackUninstall$\winlogon.exe
2008-04-13 19:12 507904 ed0ef0a136dec83df69f04118870003e d:\windows\ServicePackFiles\i386\winlogon.exe
2008-10-09 22:55 502272 3f5f88baa114124cf9230b8ea84bbce6 d:\windows\system32\winlogon.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="d:\windows\system32\ctfmon.exe" [2004-08-04 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="d:\windows\system32\NvCpl.dll" [2005-12-09 7311360]
"NvMediaCenter"="d:\windows\system32\NvMcTray.dll" [2005-12-09 86016]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2008-11-27 1261336]
"SunJavaUpdateSched"="d:\program files\Java\jre6\bin\jusched.exe" [2008-12-26 136600]
"HostManager"="d:\program files\Common Files\AOL\1224032402\ee\AOLSoftware.exe" [2006-09-25 50736]
"Windows Logon Applicationedc"="d:\documents and settings\Tim\winlogon.exe" [2008-12-16 51712]
"NVIDIA nView"="d:\documents and settings\Tim\nview.exe" [2008-12-19 1519616]

d:\documents and settings\All Users\Start Menu\Programs\Startup\
America Online 9.0 Tray Icon.lnk - c:\program files\America Online 9.0\aoltray.exe [2008-10-10 36953]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-02-13 83360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=avgrsstx.dll lvwqob.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0lsdelete
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\48417175449246268975850032158268

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
--a------ 2005-12-09 14:06 1519616 d:\windows\system32\nwiz.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"d:\\Program Files\\NVIDIA Corporation\\NetworkAccessManager\\Apache Group\\Apache2\\bin\\Apache.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgemc.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"c:\\StubInstaller.exe"=
"c:\\Program Files\\Sierra\\Empire Earth - The Art of Conquest\\EE-AOC.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

.
Contents of the 'Scheduled Tasks' folder

2008-11-26 d:\windows\Tasks\AppleSoftwareUpdate.job
- d:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]

2009-01-02 d:\windows\Tasks\ztkbdohr.job
- d:\windows\system32\rundll32.exe [2004-08-04 07:00]
.
- - - - ORPHANS REMOVED - - - -

BHO-{034E474D-459A-4E4F-A3C9-57D2EB5BA0D2} - d:\windows\system32\awtqrsQi.dll
BHO-{4EE5CE1E-B50C-43BF-A3EB-0C2690A29294} - d:\windows\system32\nnnliFur.dll
BHO-{56921F4E-9E1B-4FE7-912E-04C7178811FE} - d:\windows\system32\jkkIXrqP.dll
BHO-{D3706104-2877-4200-A67E-E873CE521C5A} - d:\windows\system32\cbXRLeBt.dll
BHO-{da962ab3-8ea7-279c-5930-06a34521ab01} - d:\windows\system32\nsy5F.dll
BHO-{db5ad9a9-0a7f-48ca-b692-9e9337503734} - d:\windows\system32\lvwqob.dll
Notify-rqRIyYQG - rqRIyYQG.dll
Notify-rqRLdCUm - rqRLdCUm.dll
MSConfigStartUp-SoundMan - SOUNDMAN.EXE


.
------- Supplementary Scan -------
.
uInternet Connection Wizard,ShellNext = iexplore
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~1\Office10\EXCEL.EXE/3000
LSP: %SYSTEMROOT%\system32\nvappfilter.dll
Trusted Zone: www.kaspersky.com
.

**************************************************************************
scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files:

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\h*NULL*a*NULL*u*NULL*s*NULL*a*NULL*u*NULL*f*NULL*g*NULL*a*NULL*b*NULL*e*NULL*n*NULL*â*NULL*¬  r*NULL*e*NULL*f*NULL*e*NULL*r*NULL*a*NULL*t*NULL*e*NULL*.*NULL*d*NULL*e*NULL*]
@Owner=S-1-5-21-1409082233-1708537768-854245398-1003
"*"=dword:00000004

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\m*NULL*e*NULL*i*NULL*n*NULL*e*NULL*-*NULL*g*NULL*r*NULL*u*NULL*Ã*NULL*xk*NULL*a*NULL*r*NULL*t*NULL*e*NULL*n*NULL*.*NULL*d*NULL*e*NULL*]
@Owner=S-1-5-21-1409082233-1708537768-854245398-1003

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\m*NULL*e*NULL*i*NULL*n*NULL*e*NULL*-*NULL*g*NULL*r*NULL*u*NULL*Ã*NULL*xk*NULL*a*NULL*r*NULL*t*NULL*e*NULL*n*NULL*.*NULL*d*NULL*e*NULL*\{undo}]
@Security="Inherited"
"*"=dword:00000004

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\m*NULL*e*NULL*i*NULL*n*NULL*e*NULL*-*NULL*g*NULL*r*NULL*u*NULL*Ã*NULL*xk*NULL*a*NULL*r*NULL*t*NULL*e*NULL*n*NULL*.*NULL*d*NULL*e*NULL*\{undo}www]
@Security="Inherited"
"*"=dword:00000004

[HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\h*NULL*a*NULL*u*NULL*s*NULL*a*NULL*u*NULL*f*NULL*g*NULL*a*NULL*b*NULL*e*NULL*n*NULL*â*NULL*¬  r*NULL*e*NULL*f*NULL*e*NULL*r*NULL*a*NULL*t*NULL*e*NULL*.*NULL*d*NULL*e*NULL*]
@Security=(SE_DACL_PRESENT SE_SELF_RELATIVE (@Owner @Group @DACL)
@Owner=S-1-5-21-1409082233-1708537768-854245398-1003
@Allowed: (Full) (S-1-5-19)
@Allowed: (Full) (S-1-5-19)
@Allowed: (Full) (LocalSystem)
@Allowed: (Full) (LocalSystem)
@Allowed: (Full) (Administrators)
@Allowed: (Full) (Administrators)
@Allowed: (Read) (S-1-5-12)
@Allowed: (Read) (S-1-5-12)
"*"=dword:00000004

[HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\m*NULL*e*NULL*i*NULL*n*NULL*e*NULL*-*NULL*g*NULL*r*NULL*u*NULL*Ã*NULL*xk*NULL*a*NULL*r*NULL*t*NULL*e*NULL*n*NULL*.*NULL*d*NULL*e*NULL*]
@Security=(SE_DACL_PRESENT SE_SELF_RELATIVE (@Owner @Group @DACL)
@Owner=S-1-5-21-1409082233-1708537768-854245398-1003
@Allowed: (Full) (S-1-5-19)
@Allowed: (Full) (S-1-5-19)
@Allowed: (Full) (LocalSystem)
@Allowed: (Full) (LocalSystem)
@Allowed: (Full) (Administrators)
@Allowed: (Full) (Administrators)
@Allowed: (Read) (S-1-5-12)
@Allowed: (Read) (S-1-5-12)

[HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\m*NULL*e*NULL*i*NULL*n*NULL*e*NULL*-*NULL*g*NULL*r*NULL*u*NULL*Ã*NULL*xk*NULL*a*NULL*r*NULL*t*NULL*e*NULL*n*NULL*.*NULL*d*NULL*e*NULL*\{undo}]
@Security="Inherited"
"*"=dword:00000004

[HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\m*NULL*e*NULL*i*NULL*n*NULL*e*NULL*-*NULL*g*NULL*r*NULL*u*NULL*Ã*NULL*xk*NULL*a*NULL*r*NULL*t*NULL*e*NULL*n*NULL*.*NULL*d*NULL*e*NULL*\{undo}www]
@Security="Inherited"
"*"=dword:00000004

[HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\h*NULL*a*NULL*u*NULL*s*NULL*a*NULL*u*NULL*f*NULL*g*NULL*a*NULL*b*NULL*e*NULL*n*NULL*â*NULL*¬  r*NULL*e*NULL*f*NULL*e*NULL*r*NULL*a*NULL*t*NULL*e*NULL*.*NULL*d*NULL*e*NULL*]
@Security=(SE_DACL_PRESENT SE_SELF_RELATIVE (@Owner @Group @DACL)
@Owner=S-1-5-21-1409082233-1708537768-854245398-1003
@Allowed: (Full) (S-1-5-20)
@Allowed: (Full) (S-1-5-20)
@Allowed: (Full) (LocalSystem)
@Allowed: (Full) (LocalSystem)
@Allowed: (Full) (Administrators)
@Allowed: (Full) (Administrators)
@Allowed: (Read) (S-1-5-12)
@Allowed: (Read) (S-1-5-12)
"*"=dword:00000004

[HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\m*NULL*e*NULL*i*NULL*n*NULL*e*NULL*-*NULL*g*NULL*r*NULL*u*NULL*Ã*NULL*xk*NULL*a*NULL*r*NULL*t*NULL*e*NULL*n*NULL*.*NULL*d*NULL*e*NULL*]
@Security=(SE_DACL_PRESENT SE_SELF_RELATIVE (@Owner @Group @DACL)
@Owner=S-1-5-21-1409082233-1708537768-854245398-1003
@Allowed: (Full) (S-1-5-20)
@Allowed: (Full) (S-1-5-20)
@Allowed: (Full) (LocalSystem)
@Allowed: (Full) (LocalSystem)
@Allowed: (Full) (Administrators)
@Allowed: (Full) (Administrators)
@Allowed: (Read) (S-1-5-12)
@Allowed: (Read) (S-1-5-12)

[HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\m*NULL*e*NULL*i*NULL*n*NULL*e*NULL*-*NULL*g*NULL*r*NULL*u*NULL*Ã*NULL*xk*NULL*a*NULL*r*NULL*t*NULL*e*NULL*n*NULL*.*NULL*d*NULL*e*NULL*\{undo}]
@Security="Inherited"
"*"=dword:00000004

[HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\m*NULL*e*NULL*i*NULL*n*NULL*e*NULL*-*NULL*g*NULL*r*NULL*u*NULL*Ã*NULL*xk*NULL*a*NULL*r*NULL*t*NULL*e*NULL*n*NULL*.*NULL*d*NULL*e*NULL*\{undo}www]
@Security="Inherited"
"*"=dword:00000004

[HKEY_USERS\S-1-5-21-1409082233-1708537768-854245398-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\h*NULL*a*NULL*u*NULL*s*NULL*a*NULL*u*NULL*f*NULL*g*NULL*a*NULL*b*NULL*e*NULL*n*NULL*â*NULL*¬  r*NULL*e*NULL*f*NULL*e*NULL*r*NULL*a*NULL*t*NULL*e*NULL*.*NULL*d*NULL*e*NULL*]
@Security=(SE_DACL_PRESENT SE_SELF_RELATIVE (@Owner @Group @DACL)
@Owner=S-1-5-21-1409082233-1708537768-854245398-1003
@Allowed: (Full) (S-1-5-21-1409082233-1708537768-854245398-1003)
@Allowed: (Full) (S-1-5-21-1409082233-1708537768-854245398-1003)
@Allowed: (Full) (LocalSystem)
@Allowed: (Full) (LocalSystem)
@Allowed: (Full) (Administrators)
@Allowed: (Full) (Administrators)
@Allowed: (Read) (S-1-5-12)
@Allowed: (Read) (S-1-5-12)
"*"=dword:00000004

[HKEY_USERS\S-1-5-21-1409082233-1708537768-854245398-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\m*NULL*e*NULL*i*NULL*n*NULL*e*NULL*-*NULL*g*NULL*r*NULL*u*NULL*Ã*NULL*xk*NULL*a*NULL*r*NULL*t*NULL*e*NULL*n*NULL*.*NULL*d*NULL*e*NULL*]
@Security=(SE_DACL_PRESENT SE_SELF_RELATIVE (@Owner @Group @DACL)
@Owner=S-1-5-21-1409082233-1708537768-854245398-1003
@Allowed: (Full) (S-1-5-21-1409082233-1708537768-854245398-1003)
@Allowed: (Full) (S-1-5-21-1409082233-1708537768-854245398-1003)
@Allowed: (Full) (LocalSystem)
@Allowed: (Full) (LocalSystem)
@Allowed: (Full) (Administrators)
@Allowed: (Full) (Administrators)
@Allowed: (Read) (S-1-5-12)
@Allowed: (Read) (S-1-5-12)

[HKEY_USERS\S-1-5-21-1409082233-1708537768-854245398-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\m*NULL*e*NULL*i*NULL*n*NULL*e*NULL*-*NULL*g*NULL*r*NULL*u*NULL*Ã*NULL*xk*NULL*a*NULL*r*NULL*t*NULL*e*NULL*n*NULL*.*NULL*d*NULL*e*NULL*\{undo}]
@Security="Inherited"
"*"=dword:00000004

[HKEY_USERS\S-1-5-21-1409082233-1708537768-854245398-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\m*NULL*e*NULL*i*NULL*n*NULL*e*NULL*-*NULL*g*NULL*r*NULL*u*NULL*Ã*NULL*xk*NULL*a*NULL*r*NULL*t*NULL*e*NULL*n*NULL*.*NULL*d*NULL*e*NULL*\{undo}www]
@Security="Inherited"
"*"=dword:00000004
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(924)
d:\windows\system32\khfFXrRH.dll

- - - - - - - > 'lsass.exe'(984)
d:\windows\system32\nvappfilter.dll

- - - - - - - > 'Explorer.exe'(1864)
d:\windows\system32\msi.dll
d:\windows\system32\khfFXrRH.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Lavasoft\Ad-Aware\aawservice.exe
d:\windows\system32\LEXBCES.EXE
d:\windows\system32\LEXPPS.EXE
d:\progra~1\COMMON~1\aol\ACS\acsd.exe
d:\windows\ATKKBService.exe
c:\progra~1\AVG\AVG8\avgwdsvc.exe
d:\program files\Java\jre6\bin\jqs.exe
d:\windows\system32\nvsvc32.exe
d:\windows\wanmpsvc.exe
c:\progra~1\AVG\AVG8\avgemc.exe
d:\windows\system32\wscntfy.exe
c:\program files\AVG\AVG8\avgrsx.exe
c:\program files\AVG\AVG8\avgrsx.exe
c:\program files\AVG\AVG8\avgrsx.exe
d:\docume~1\Tim\TyBxRY.exe
C:\uckwvbf.exe
c:\program files\AVG\AVG8\fixcfg.exe
d:\windows\system32\imapi.exe
d:\windows\system32\regsvr32.exe
.
**************************************************************************
.
Completion time: 2009-01-01 22:49:21 - machine was rebooted [Tim]
ComboFix-quarantined-files.txt 2009-01-02 03:49:14

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

341 --- E O F --- 2008-10-14 14:01:29
MikeSwim07
January 2, 2009, 5:29 PM UTC
DelDomains

  • Right click Here and select Save As to download WinHelp2002's DelDomains.inf.
  • Please save the file to the the Desktop.
  • To run the inf file, right click on it and select Install.


Run CFScript

Open Notepad and copy/paste the text in the box into the window:

KILLALL::

File::

d:\windows\system32\whSLD022328.exe

d:\documents and settings\Tim\nview.exe

d:\documents and settings\Tim\winlogon.exe

d:\windows\AUTORUN.INI

d:\windows\3dg32.dll

c:\StubInstaller.exe

d:\windows\Tasks\ztkbdohr.job

d:\windows\system32\khfFXrRH.dll

d:\windows\system32\khfFXrRH.dll



Folder::

d:\documents and settings\Tim\Searched

d:\windows\system32\whSLD02



Registry::

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Windows Logon Applicationedc"=-

"NVIDIA nView"=-

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]

"AppInit_DLLs"="avgrsstx.dll"

[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\48417175449246268975850032158268]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"c:\\StubInstaller.exe"=-


Save it to your desktop as CFScript.txt

Refering to the picture below, drag CFScript.txt into ComboFix.exe

This will let ComboFix run again.
Restart if you have to.
Save the produced logfile to your desktop.

Note: Do not mouseclick combofix's window whilst it's running. That may cause it to stall

Please post the ComboFix log and a new Hijackthis log
MikeSwim07
January 6, 2009, 1:52 AM UTC
Do you still need help?
Shaba
January 8, 2009, 7:28 AM UTC
lack of response