Help... vundo virus

aye aye capitan!!! (smiles)

I was so thrilled to be able to do this WITH your help... here are the logs... and again ty for your patience!!!!

2004-09-13 12:15 53 --a------ C:\Qoobox\Quarantine\D\Autorun.inf.vir
2006-08-01 18:57 14848 --a------ C:\Qoobox\Quarantine\C\Program Files\SurfAccuracy\SAccU.exe.vir
2006-08-01 18:57 206 --a--c--- C:\Qoobox\Quarantine\C\Program Files\SurfAccuracy\License.lnk.vir
2007-04-29 02:01 1986087 --a--c--- C:\Qoobox\Quarantine\C\Program Files\SurfAccuracy\SAcc.cfg.vir
2007-09-23 17:05 279600 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\pac.txt.vir
2008-04-01 11:43 0 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\taskkill.exe.vir
2008-04-01 11:43 1006080 --a------ C:\Qoobox\Quarantine\C\Documents and Settings\Owner\svchost.exe.vir
2008-04-01 11:43 1006080 --a------ C:\Qoobox\Quarantine\C\winlogon.exe.vir
2008-04-03 10:52 86592 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\vjccnqja.dll.vir
2008-04-05 18:27 114 --a------ C:\Qoobox\Quarantine\C\WINDOWS\cookies.ini.vir
2008-04-07 22:51 345376 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\gfOrCMoq.ini2.vir
2008-04-07 22:54 345376 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\gfOrCMoq.ini.vir
2008-04-09 08:20 140287 --a------ C:\Qoobox\Quarantine\C\WINDOWS\BM9f0a0220.xml.vir
2008-04-09 09:05 22 --a------ C:\Qoobox\Quarantine\C\WINDOWS\pskt.ini.vir
2008-04-09 09:05 819267 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\ajqnccjv.ini.vir
2008-04-22 02:58 78 --a------ C:\Qoobox\Quarantine\catchme.log











ComboFix 08-04-20.2 - Owner 2008-04-22 2:25:20.1 - NTFSx86 MINIMAL
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.342 [GMT -7:00]
Running from: C:\Documents and Settings\Owner\Desktop\ComboFix.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Program Files\SurfAccuracy
C:\Program Files\SurfAccuracy\License.lnk
C:\Program Files\SurfAccuracy\SAcc.cfg
C:\Program Files\SurfAccuracy\SAccU.exe
C:\WINDOWS\BM9f0a0220.xml
C:\WINDOWS\cookies.ini
C:\WINDOWS\pskt.ini
C:\WINDOWS\system32\ajqnccjv.ini
C:\WINDOWS\system32\gfOrCMoq.ini
C:\WINDOWS\system32\gfOrCMoq.ini2
C:\WINDOWS\system32\pac.txt
C:\WINDOWS\system32\vjccnqja.dll
C:\winlogon.exe
D:\Autorun.inf

.
((((((((((((((((((((((((( Files Created from 2008-03-22 to 2008-04-22 )))))))))))))))))))))))))))))))
.

2008-04-15 15:43 . 2008-04-15 15:43 <DIR> d-------- C:\Deckard
2008-04-15 15:41 . 2008-04-15 15:41 <DIR> d-------- C:\Program Files\Trend Micro
2008-04-09 18:22 . 2008-04-09 18:22 2,560 --a------ C:\WINDOWS\_MSRSTRT.EXE
2008-04-09 16:44 . 2008-04-22 02:32 <DIR> d-a------ C:\Documents and Settings\All Users\Application Data\TEMP
2008-04-09 16:44 . 2007-12-10 14:53 81,288 --a------ C:\WINDOWS\system32\drivers\iksyssec.sys
2008-04-09 16:44 . 2007-12-10 14:53 66,952 --a------ C:\WINDOWS\system32\drivers\iksysflt.sys
2008-04-09 16:44 . 2008-02-01 12:55 42,376 --a------ C:\WINDOWS\system32\drivers\ikfilesec.sys
2008-04-09 16:44 . 2007-12-10 14:53 29,576 --a------ C:\WINDOWS\system32\drivers\kcom.sys
2008-04-09 16:43 . 2008-04-17 05:32 <DIR> d-------- C:\Program Files\Spyware Doctor
2008-04-09 16:43 . 2008-04-09 16:43 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\PC Tools
2008-04-09 09:41 . 2008-04-09 09:41 <DIR> d-------- C:\Program Files\Panda Security
2008-04-09 09:30 . 2008-04-09 09:30 118 --a------ C:\WINDOWS\system32\MRT.INI
2008-04-09 09:22 . 2008-04-09 16:41 <DIR> d-------- C:\Program Files\CleanUp!
2008-04-07 21:52 . 2008-04-09 18:35 <DIR> d-------- C:\VundoFix Backups
2008-04-02 09:26 . 2008-04-02 09:26 <DIR> d-------- C:\Program Files\Napster
2008-04-02 09:26 . 2008-04-02 09:26 <DIR> d-------- C:\Program Files\Common Files\Roxio Shared
2008-04-02 09:26 . 2008-04-02 09:26 <DIR> d-------- C:\Program Files\Common Files\Napster Shared
2008-04-02 09:26 . 2008-04-02 09:26 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\InstallShield
2008-04-01 16:25 . 2008-04-22 02:19 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\LimeWire
2008-04-01 11:43 . 2008-04-01 11:43 <DIR> d-------- C:\WINDOWS\system32\aqVreo05
2008-04-01 11:43 . 2008-04-09 18:01 <DIR> d--hs---- C:\Documents and Settings\Owner\!
2008-04-01 11:43 . 2008-04-01 11:43 1,006,080 ---hs---- C:\Documents and Settings\Owner\svchost.exe
2008-04-01 11:43 . 2008-04-22 02:19 60,301 --------- C:\Documents and Settings\Owner\zz.dat
2008-04-01 11:43 . 2008-04-01 11:43 0 --a------ C:\WINDOWS\system32\taskkill.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-04-10 01:30 --------- d-----w C:\Program Files\Yahoo!
2008-04-10 01:23 --------- d-----w C:\Program Files\AOL Deskbar
2008-04-08 03:50 --------- d-----w C:\Documents and Settings\All Users\Application Data\AOL
2008-04-04 00:02 --------- d-----w C:\Program Files\McAfee
2008-04-02 16:26 --------- d-----w C:\Documents and Settings\All Users\Application Data\Napster
2008-04-02 03:41 --------- d-----w C:\Documents and Settings\All Users\Application Data\AOL OCP
2008-04-01 22:16 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-03-20 03:24 --------- d-----w C:\Program Files\Safari
2008-03-19 09:47 1,845,248 ----a-w C:\WINDOWS\system32\win32k.sys
2008-03-13 18:51 --------- d-----w C:\Program Files\Java
2008-03-01 13:06 826,368 ----a-w C:\WINDOWS\system32\wininet.dll
2008-02-27 23:56 --------- d-----w C:\Program Files\iTunes
2008-02-27 23:56 --------- d-----w C:\Program Files\iPod
2008-02-27 23:54 --------- d-----w C:\Program Files\QuickTime
2008-02-20 06:51 282,624 ----a-w C:\WINDOWS\system32\gdi32.dll
2008-02-20 05:32 45,568 ----a-w C:\WINDOWS\system32\dnsrslvr.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D03570B7-EEFE-4E92-8C51-EDACE2D7DB9C}]
C:\WINDOWS\system32\qoMCrOfg.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{86227D9C-0EFE-4F8A-AA55-30386A3F5686} "= "C:\Program Files\YourSiteBar\ysb.dll" [2006-08-01 18:57 90624]

[HKEY_CLASSES_ROOT\clsid\{86227d9c-0efe-4f8a-aa55-30386a3f5686}]
[HKEY_CLASSES_ROOT\Ysb.YsbObj.1]
[HKEY_CLASSES_ROOT\TypeLib\{86227D9C-0EFE-4f8a-AA55-30386A3F5686}]
[HKEY_CLASSES_ROOT\Ysb.YsbObj]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
"{86227D9C-0EFE-4F8A-AA55-30386A3F5686} "= C:\Program Files\YourSiteBar\ysb.dll [2006-08-01 18:57 90624]

[HKEY_CLASSES_ROOT\clsid\{86227d9c-0efe-4f8a-aa55-30386a3f5686}]
[HKEY_CLASSES_ROOT\Ysb.YsbObj.1]
[HKEY_CLASSES_ROOT\TypeLib\{86227D9C-0EFE-4f8a-AA55-30386A3F5686}]
[HKEY_CLASSES_ROOT\Ysb.YsbObj]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS "= "C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 09:24 1694208]
"WebCamRT.exe "=" " []
"ctfmon.exe "= "C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 12:00 15360]
"updateMgr "= "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 17:45 313472]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Recguard "= "C:\WINDOWS\SMINST\RECGUARD.EXE" [2002-09-13 13:42 212992]
"SunKistEM "= "C:\Program Files\Digital Media Reader\shwiconem.exe" [2004-11-15 15:04 135168]
"High Definition Audio Property Page Shortcut "= "HDAShCut.exe" [2005-01-07 17:07 61952 C:\WINDOWS\system32\HdAShCut.exe]
"NeroFilterCheck "= "C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50 155648]
"IgfxTray "= "C:\WINDOWS\system32\igfxtray.exe" [2004-08-20 15:55 155648]
"HotKeysCmds "= "C:\WINDOWS\system32\hkcmd.exe" [2004-08-20 15:51 118784]
"CHotkey "= "zHotkey.exe" [2004-05-17 18:30 543232 C:\WINDOWS\zHotkey.exe]
"ShowWnd "= "ShowWnd.exe" [2003-09-19 09:09 36864 C:\WINDOWS\ShowWnd.exe]
"RemoteControl "= "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2003-10-31 19:42 32768]
"HostManager "= "C:\Program Files\Common Files\AOL\1153616573\ee\AOLSoftware.exe" [2007-10-08 14:50 41824]
"AOLDialer "= "C:\Program Files\Common Files\AOL\ACS\AOLDial.exe" [2006-10-23 05:50 71216]
"AlcFDMonitor "= "C:\WINDOWS\ALCFDRTM.EXE" [2006-09-02 21:16 73728]
"SoundMan "= "SOUNDMAN.EXE" [2005-05-12 14:00 90112 C:\WINDOWS\SoundMan.exe]
"AlcWzrd "= "ALCWZRD.EXE" [2005-05-12 14:00 2805248 C:\WINDOWS\ALCWZRD.EXE]
"SunJavaUpdateSched "= "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784]
"LVCOMS "= "C:\Program Files\Common Files\Logitech\QCDriver\LVCOMS.EXE" [2001-09-24 09:39 98304]
"SurfAccuracy "= "C:\Program Files\SurfAccuracy\SAcc.exe" [ ]
"UserFaultCheck "= "C:\WINDOWS\system32\dumprep 0 -u" [ ]
"NapsterShell "= "C:\Program Files\Napster\napster.exe" [2007-10-05 20:04 323216]
"Lexmark 1200 Series "= "C:\Program Files\Lexmark 1200 Series\lxczbmgr.exe" [2006-07-13 14:22 57344]
"QuickTime Task "= "C:\Program Files\QuickTime\qttask.exe" [2008-02-01 00:13 385024]
"iTunesHelper "= "C:\Program Files\iTunes\iTunesHelper.exe" [2008-02-19 14:10 267048]
"ISTray "= "C:\Program Files\Spyware Doctor\pctsTray.exe" [2008-02-01 12:55 1103240]

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify "=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring "=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
"DisableMonitoring "=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall "= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe "=
"C:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe "=
"C:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe "=
"C:\\Program Files\\America Online 9.0\\waol.exe "=
"C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe "=
"C:\\Program Files\\Common Files\\AOL\\TopSpeed\\2.0\\aoltsmon.exe "=
"C:\\Program Files\\Common Files\\AOL\\TopSpeed\\2.0\\aoltpspd.exe "=
"C:\\Program Files\\Common Files\\AOL\\1153616573\\EE\\AOLServiceHost.exe "=
"C:\\Program Files\\Common Files\\AOL\\System Information\\sinf.exe "=
"C:\\Program Files\\Common Files\\AolCoach\\en_en\\player\\AOLNySEV.exe "=
"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe "=
"C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe "=
"C:\\Program Files\\Common Files\\AOL\\TopSpeed\\3.0\\aoltpsd3.exe "=
"%windir%\\Network Diagnostic\\xpnetdiag.exe "=
"C:\\Program Files\\Common Files\\AOL\\1153616573\\EE\\aolsoftware.exe "=
"C:\\Program Files\\AOL 9.1\\waol.exe "=
"C:\\Program Files\\Common Files\\AOL\\1153616573\\EE\\AOLDesktop.exe "=
"C:\\Program Files\\iTunes\\iTunes.exe "=
"C:\\Program Files\\Common Files\\McAfee\\MNA\\McNASvc.exe "=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP "= 3389:TCPxpsp2res.dll,-22009

R2 Viewpoint Manager Service;Viewpoint Manager Service; "C:\Program Files\Viewpoint\Common\ViewpointService.exe" [2007-01-04 14:38]
S3 PhilCam8116;Logitech QuickCam Pro 3000(PID_08B0);C:\WINDOWS\system32\DRIVERS\CamDrL21.sys [2001-08-01 15:36]

.
Contents of the 'Scheduled Tasks' folder
"2008-04-09 19:08:14 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job "
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2008-03-15 08:00:01 C:\WINDOWS\Tasks\McDefragTask.job "
- c:\program files\mcafee\mqc\QcConsol.exe
"2008-04-01 08:00:01 C:\WINDOWS\Tasks\McQcTask.job "
- c:\program files\mcafee\mqc\QcConsol.exe
.
**************************************************************************

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-04-22 02:32:53
Windows 5.1.2600 Service Pack 2 NTFS

detected NTDLL code modification:
ZwClose

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...


**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe
C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
C:\Program Files\Lexmark 1200 Series\lxczbmon.exe
C:\Program Files\Common Files\AOL\Loader\aolload.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltpspd.exe
C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe
C:\Program Files\BigFix\BigFix.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
C:\Program Files\Common Files\AOL\1153616573\EE\AOLDesktop.exe
C:\Program Files\Common Files\McAfee\MNA\McNASvc.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
C:\PROGRA~1\McAfee\MSC\mcpromgr.exe
C:\PROGRA~1\COMMON~1\McAfee\RedirSvc\RedirSvc.exe
C:\PROGRA~1\McAfee\VIRUSS~1\Mcshield.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
C:\Program Files\McAfee\MPF\MpfSrv.exe
C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
C:\Program Files\Spyware Doctor\pctsAuxs.exe
C:\Program Files\Spyware Doctor\pctsSvc.exe
C:\PROGRA~1\McAfee.com\Agent\mcagent.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Spyware Doctor\pctsGui.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
.
**************************************************************************
.
Completion time: 2008-04-22 2:40:36 - machine was rebooted
ComboFix-quarantined-files.txt 2008-04-22 09:38:43

Pre-Run: 175,681,462,272 bytes free
Post-Run: 175,102,935,040 bytes free

204 --- E O F --- 2008-04-09 16:31:40

 

Great! Now we need to check on a few things, one of which is if a command window will process commands correctly. We're also going to search for a couple of files and check the contents of a folder. Highlight and copy the contents of the code box below.

Code:

@echo off
attrib -r -h -s  "C:\Documents and Settings\Owner\! "
dir   "C:\Documents and Settings\Owner\! "> "%userprofile%\desktop\check.txt "
dir %Systemdrive%\zz.dat /a h /s >> "%userprofile%\desktop\check.txt "
dir %Systemdrive%\xx.dat /a h /s >> "%userprofile%\desktop\check.txt "
start notepad  "%userprofile%\desktop\check.txt "
exit
cls

Click Start>Run and type cmd then hit enter to open a command window. Right click in the command window and select paste. The command window will close on it's own when the search is complete, and a log named check.txt will open. The log will be located on your desktop. Please post the contents of that log here.


Did you check the contents of that zz.dat file?

 

found

Volume in drive C has no label.
Volume Serial Number is 9C39-3113

Directory of C:\Documents and Settings\Owner\!

04/09/2008 06:01 PM <DIR> .
04/09/2008 06:01 PM <DIR> ..
04/01/2008 11:43 AM 60,301
hundereds of avi files of same size and date in between
04/01/2008 11:43 AM 60,301

 

continuation 2 (too long for one post)

04/01/2008 11:43 AM 60,301
hundereds of avi files of same size and date in between
04/01/2008 11:43 AM 60,301

 

continuation 3

04/01/2008 11:51 AM 60,301
hundereds of avi files of same size and date in between
04/01/2008 11:43 AM 60,301

 

continuation four (sorry boyfriends computer)

04/01/2008 11:51 AM 60,301
hundereds of avi files of same size and date in between
04/01/2008 11:43 AM 60,301

 

continuation five... again, very sorry...

04/01/2008 11:43 AM 60,301
hundereds of avi files of same size and date in between
04/01/2008 11:51 AM 60,301

 

continuation six...

04/01/2008 11:43 AM 60,301
hundereds of avi files of same size and date in between
04/01/2008 11:43 AM 60,301

 

continuation seven

04/01/2008 11:51 AM 60,301
hundereds of avi files of same size and date in between
04/01/2008 11:51 AM 60,301

 

continuation eight

04/01/2008 11:51 AM 60,301
hundereds of avi files of same size and date in between
04/01/2008 11:43 AM 60,301

 

continuation nine

4/01/2008 11:43 AM 60,301
hundereds of avi files of same size and date in between
04/01/2008 11:43 AM 60,301

 

continuation ten

04/01/2008 11:51 AM 60,301
hundereds of avi files of same size and date in between
04/01/2008 11:43 AM 60,301

 

continuation eleven... ( i really am so very sorry )

04/01/2008 11:51 AM 60,301
hundereds of avi files of same size and date in between
04/01/2008 11:43 AM 60,301

 

continuation twelve

04/01/2008 11:43 AM 60,301
hundereds of avi files of same size and date in between
04/01/2008 11:43 AM 60,301

 

continuation thirteen

04/01/2008 11:43 AM 60,301
hundereds of avi files of same size and date in between
04/01/2008 11:51 AM 60,301

 

continuation 14

04/01/2008 11:51 AM 60,301
hundereds of avi files of same size and date in between
04/01/2008 11:51 AM 60,301

 

continuation 15

4/01/2008 11:51 AM 60,301
hundereds of avi files of same size and date in between
04/01/2008 11:43 AM 60,301

 

continuation 16

04/01/2008 11:51 AM 60,301
hundereds of avi files of same size and date in between
04/01/2008 11:43 AM 60,301

 

cont. 17

04/01/2008 11:51 AM 60,301
hundereds of avi files of same size and date in between
04/01/2008 11:51 AM 60,301

 

cont 18

04/01/2008 11:51 AM 60,301
hundereds of avi files of same size and date in between
04/01/2008 11:43 AM 60,301