Solved browser hijack

[Resolved]browser hijack

Hi There
I have searched these forums for a fix but i do not have the ability to fix this myself. One of kids have managed to pick up the antivirus xp 2008.

I followed some basic instructions and downloaded mbam and combofix (this was an effort in itself considering the virus!)

Here is the mbam log......

Malwarebytes' Anti-Malware 1.25
Database version: 1096
Windows 5.1.2600 Service Pack 2

10:50:29 AM 30/08/2008
mbam-log-08-30-2008 (10-50-29).txt

Scan type: Quick Scan
Objects scanned: 42784
Time elapsed: 4 minute(s), 27 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 4
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 1
Files Infected: 16

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\tdssdata (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\tdss (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Software Notifier (Rogue.Multiple) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\perfmons (Trojan.Downloader) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
C:\WINDOWS\PIF (Trojan.Agent) -> Quarantined and deleted successfully.

Files Infected:
C:\Program Files\Internet Explorer\svchost.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\comsa32.sys (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\tdssadw.dll (Trojan.Agent) -> Delete on reboot.
C:\WINDOWS\system32\tdssl.dll (Trojan.Agent) -> Delete on reboot.
C:\WINDOWS\system32\tdssserf.dll (Trojan.Agent) -> Delete on reboot.
C:\WINDOWS\system32\tdssmain.dll (Trojan.Agent) -> Delete on reboot.
C:\WINDOWS\system32\tdssinit.dll (Trojan.Agent) -> Delete on reboot.
C:\WINDOWS\system32\tdsslog.dll (Trojan.Agent) -> Delete on reboot.
C:\WINDOWS\system32\tdssservers.dat (Trojan.Agent) -> Delete on reboot.
C:\WINDOWS\system32\drivers\tdssserv.sys (Trojan.Agent) -> Delete on reboot.
C:\Documents and Settings\Danny\Local Settings\Temp\.tt2.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\Danny\Local Settings\Temp\.tt4.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\Danny\Local Settings\Temp\.tt5.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\Danny\Local Settings\Temp\.tt7.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\drmgs.sys (Rootkit.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\ndt2.sys (Rootkit.Agent) -> Quarantined and deleted successfully.

 

and here is the combofix log.

ComboFix 08-08-29.02 - Danny 2008-08-30 10:54:01.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.255 [GMT 10:00]
Running from: C:\Documents and Settings\Danny\Desktop\ComboFix.exe
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
The following files were disabled during the run:
C:\Program Files\Enigma Software Group\SpyHunter\SpyHunterMonitor.dll


((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\Danny\Application Data\macromedia\Flash Player\#SharedObjects\HTK7N8KX\bin.clearspring.com
C:\Documents and Settings\Danny\Application Data\macromedia\Flash Player\#SharedObjects\HTK7N8KX\bin.clearspring.com\clearspring.sol
C:\Documents and Settings\Danny\Application Data\macromedia\Flash Player\#SharedObjects\HTK7N8KX\interclick.com
C:\Documents and Settings\Danny\Application Data\macromedia\Flash Player\#SharedObjects\HTK7N8KX\interclick.com\ud.sol
C:\Documents and Settings\Danny\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#bin.clearspring.com
C:\Documents and Settings\Danny\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#bin.clearspring.com\settings.sol
C:\Documents and Settings\Danny\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#interclick.com
C:\Documents and Settings\Danny\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#interclick.com\settings.sol
C:\WINDOWS\system32\actskn43.ocx
C:\WINDOWS\system32\drivers\npf.sys
C:\WINDOWS\system32\packet.dll
C:\WINDOWS\system32\pthreadVC.dll
C:\WINDOWS\system32\rtl60.bpl
C:\WINDOWS\system32\wanpacket.dll
C:\WINDOWS\system32\wpcap.dll

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_NPF
-------\Legacy_PERFMONS
-------\Service_NPF
-------\Service_tdssserv


((((((((((((((((((((((((( Files Created from 2008-07-28 to 2008-08-30 )))))))))))))))))))))))))))))))
.

2008-08-30 10:42 . 2008-08-30 10:42 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-08-30 10:42 . 2008-08-30 10:42 <DIR> d-------- C:\Documents and Settings\Danny\Application Data\Malwarebytes
2008-08-30 10:42 . 2008-08-30 10:42 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-08-30 10:42 . 2008-08-17 15:01 38,472 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-08-30 10:42 . 2008-08-17 15:01 17,144 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-08-30 10:33 . 2008-08-30 10:33 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab
2008-08-30 10:33 . 2008-08-30 10:33 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-08-30 09:29 . 2008-08-30 09:29 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Avg7
2008-08-29 18:15 . 2008-08-29 18:15 268 --ah----- C:\sqmdata03.sqm
2008-08-29 18:15 . 2008-08-29 18:15 244 --ah----- C:\sqmnoopt03.sqm
2008-08-28 13:01 . 2008-08-30 09:29 <DIR> d-------- C:\Program Files\Enigma Software Group
2008-08-28 12:38 . 2008-08-30 09:20 2,184 --a------ C:\WINDOWS\system32\wpa.dbl
2008-08-28 12:38 . 2008-08-30 10:57 0 --a------ C:\WINDOWS\system32\NvApps.xml
2008-08-28 11:24 . 2008-08-28 11:24 <DIR> d-------- C:\Program Files\Trend Micro
2008-08-28 11:17 . 2008-08-28 11:17 <DIR> d-------- C:\Documents and Settings\Danny\Application Data\Talkback
2008-08-28 10:51 . 2008-08-28 10:51 <DIR> d---s---- C:\Documents and Settings\Danny\UserData
2008-08-28 10:35 . 2008-08-30 10:57 86,528 --a------ C:\WINDOWS\system32\drivers\dh1yxftkdwo.sys
2008-08-28 10:35 . 2008-08-28 10:35 3 --a------ C:\temp.tmp
2008-08-27 23:21 . 2008-08-27 23:21 <DIR> d--h----- C:\WINDOWS\system32\GroupPolicy
2008-08-14 11:15 . 2008-08-14 11:15 <DIR> d-------- C:\Program Files\Easy Screen Capture 2
2008-08-14 11:15 . 2008-08-14 11:15 <DIR> d-------- C:\Documents and Settings\Danny\Application Data\Longfine Software
2008-08-04 09:50 . 2008-08-04 09:51 <DIR> d-------- C:\Program Files\iTunes
2008-08-04 09:50 . 2008-08-04 09:50 <DIR> d-------- C:\Program Files\iPod
2008-08-04 09:49 . 2008-08-04 09:49 <DIR> d-------- C:\Program Files\QuickTime
2008-07-21 21:29 . 2008-07-21 21:29 244 --ah----- C:\sqmnoopt02.sqm
2008-07-21 21:29 . 2008-07-21 21:29 232 --ah----- C:\sqmdata02.sqm
2008-07-04 18:43 . 2008-08-17 18:57 24 --a------ C:\Documents and Settings\Danny\jagex_runescape_preferences.dat

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-28 23:29 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-08-28 23:29 --------- d-----w C:\Documents and Settings\All Users\Application Data\BVRP Software
2008-08-27 07:38 --------- d-----w C:\Documents and Settings\Danny\Application Data\BitTorrent
2008-08-18 23:39 --------- d-----w C:\Program Files\VPos
2007-09-03 10:30 18,224 ----a-w C:\Documents and Settings\Danny\Application Data\GDIPFONTCACHEV1.DAT
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon "= "C:\WINDOWS\system32\NvCpl.dll" [2005-12-10 05:06 7311360]
"NvMediaCenter "= "C:\WINDOWS\system32\NvMcTray.dll" [2005-12-10 05:06 86016]
"SunJavaUpdateSched "= "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 03:25 144784]
"NeroFilterCheck "= "C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50 155648]
"Adobe Reader Speed Launcher "= "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 21:16 39792]
"QuickTime Task "= "C:\Program Files\QuickTime\QTTask.exe" [2008-05-27 10:50 413696]
"iTunesHelper "= "C:\Program Files\iTunes\iTunesHelper.exe" [2008-07-30 10:47 289064]
"SpyHunter Security Suite "= "C:\Program Files\Enigma Software Group\SpyHunter\SpyHunter3.exe" [2008-06-19 16:48 851968]
"SoundMan "= "SOUNDMAN.EXE" [2006-11-17 07:42 577536 C:\WINDOWS\soundman.exe]
"nwiz "= "nwiz.exe" [2005-12-10 05:06 1519616 C:\WINDOWS\system32\nwiz.exe]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
" "= "del" [X]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE "= "C:\WINDOWS\System32\CTFMON.EXE" [2004-08-04 00:56 15360]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 01:01:04 83360]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders msapsspc.dllschannel.dlldigest.dllmsnsspc.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\dh1yxftkdwo.sys]
@= "\??\C:\WINDOWS\system32\drivers\dh1yxftkdwo.sys "

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe "=
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe "=
"C:\\Program Files\\MSN Messenger\\livecall.exe "=
"C:\\Program Files\\XBC\\XBC_NS.exe "=
"E:\\Battlefield 1942\\BF1942.exe "=
"C:\\Program Files\\BearShare\\BearShare.exe "=
"E:\\MOH\\MOHAA.EXE "=
"C:\\Program Files\\Mozilla Firefox\\firefox.exe "=
"C:\\Program Files\\Java\\jre1.6.0_02\\bin\\javaw.exe "=
"E:\\MotoGP2\\motogp2.exe "=
"C:\\Program Files\\BitTorrent\\bittorrent.exe "=
"C:\\Program Files\\TVUPlayer\\TVUPlayer.exe "=
"C:\\Program Files\\Java\\jre1.6.0_03\\bin\\javaw.exe "=
"C:\\Program Files\\iTunes\\iTunes.exe "=

R0 videX32;videX32;C:\WINDOWS\system32\DRIVERS\videX32.sys [2006-10-17 22:22]
R2 dh1yxftkdwo.sys;dh1yxftkdwo.sys;C:\WINDOWS\system32\drivers\dh1yxftkdwo.sys [2008-08-30 10:57]
S3 papycpu;papycpu;C:\WINDOWS\system32\drivers\papycpu.sys [1998-09-04 11:32]
.
- - - - ORPHANS REMOVED - - - -

HKLM-Run-Adobe Photo Downloader - D:\backup stuff\Kayla... DONT OPEN OKAY\Exe files\3.2\Apps\apdproxy.exe
HKLM-Run-VTTimer - VTTimer.exe
HKLM-Run-VTTrayp - VTtrayp.exe


.
------- Supplementary Scan -------
.
FireFox -: Profile - C:\Documents and Settings\Danny\Application Data\Mozilla\Firefox\Profiles\ufu1fb9a.default\
FireFox -: prefs.js - STARTUP.HOMEPAGE - file:///D:/backup%20stuff/My%20Webs/startpage.htm
FF -: plugin - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll
FF -: plugin - C:\Program Files\Mozilla Firefox\plugins\npbittorrent.dll
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-30 10:57:25
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2008-08-30 11:00:29 - machine was rebooted
ComboFix-quarantined-files.txt 2008-08-30 01:00:18

Pre-Run: 18,912,624,640 bytes free
Post-Run: 19,712,200,704 bytes free

150

 

Hi DannyG
Welcome to Windowsbbs.

Please do this.

Highlight and copy the contents of the code box below and paste it into a blank notepad, then save it to your desktop as;

Filename: CFScript.txt
Save As Type: All Files (*.*)

Close all other windows and programs. Now drag the CFScript.txt onto ComboFix.exe and drop it, using the left mouse button.
Click here to see how to use CFScript.txt
Combofix should run and may reboot the computer when it's done. A log will open when it's complete. Post the contents of that log and another fresh HijackThis log.

Please do not click on the ComboFix window while it is running a scan. This can cause it to stall.

Code:

File::
C:\WINDOWS\system32\drivers\dh1yxftkdwo.sys

Registry::
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\dh1yxftkdwo.sys]

Driver::
dh1yxftkdwo 

Please post the combofix log and a new HJT log.

Thanks
Geri

 

here are my log files, thank you very much for helping me.

ComboFix 08-08-29.02 - Danny 2008-08-30 14:37:54.3 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.306 [GMT 10:00]
Running from: C:\Documents and Settings\Danny\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Danny\Desktop\CFScript.txt
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::
C:\WINDOWS\system32\drivers\dh1yxftkdwo.sys
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\drivers\dh1yxftkdwo.sys

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_dh1yxftkdwo.sys
-------\Service_dh1yxftkdwo.sys


((((((((((((((((((((((((( Files Created from 2008-07-28 to 2008-08-30 )))))))))))))))))))))))))))))))
.

2008-08-30 10:42 . 2008-08-30 10:42 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-08-30 10:42 . 2008-08-30 10:42 <DIR> d-------- C:\Documents and Settings\Danny\Application Data\Malwarebytes
2008-08-30 10:42 . 2008-08-30 10:42 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-08-30 10:42 . 2008-08-17 15:01 38,472 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-08-30 10:42 . 2008-08-17 15:01 17,144 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-08-30 09:29 . 2008-08-30 09:29 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Avg7
2008-08-29 18:15 . 2008-08-29 18:15 268 --ah----- C:\sqmdata03.sqm
2008-08-29 18:15 . 2008-08-29 18:15 244 --ah----- C:\sqmnoopt03.sqm
2008-08-28 13:01 . 2008-08-30 09:29 <DIR> d-------- C:\Program Files\Enigma Software Group
2008-08-28 12:38 . 2008-08-30 09:20 2,184 --a------ C:\WINDOWS\system32\wpa.dbl
2008-08-28 12:38 . 2008-08-30 14:40 0 --a------ C:\WINDOWS\system32\NvApps.xml
2008-08-28 11:24 . 2008-08-28 11:24 <DIR> d-------- C:\Program Files\Trend Micro
2008-08-28 11:17 . 2008-08-28 11:17 <DIR> d-------- C:\Documents and Settings\Danny\Application Data\Talkback
2008-08-28 10:51 . 2008-08-28 10:51 <DIR> d---s---- C:\Documents and Settings\Danny\UserData
2008-08-28 10:35 . 2008-08-28 10:35 3 --a------ C:\temp.tmp
2008-08-27 23:21 . 2008-08-27 23:21 <DIR> d--h----- C:\WINDOWS\system32\GroupPolicy
2008-08-14 11:15 . 2008-08-14 11:15 <DIR> d-------- C:\Program Files\Easy Screen Capture 2
2008-08-14 11:15 . 2008-08-14 11:15 <DIR> d-------- C:\Documents and Settings\Danny\Application Data\Longfine Software
2008-08-04 09:50 . 2008-08-04 09:51 <DIR> d-------- C:\Program Files\iTunes
2008-08-04 09:50 . 2008-08-04 09:50 <DIR> d-------- C:\Program Files\iPod
2008-08-04 09:49 . 2008-08-04 09:49 <DIR> d-------- C:\Program Files\QuickTime
2008-07-21 21:29 . 2008-07-21 21:29 244 --ah----- C:\sqmnoopt02.sqm
2008-07-21 21:29 . 2008-07-21 21:29 232 --ah----- C:\sqmdata02.sqm
2008-07-04 18:43 . 2008-08-17 18:57 24 --a------ C:\Documents and Settings\Danny\jagex_runescape_preferences.dat

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-30 04:36 --------- d-----w C:\Program Files\Java
2008-08-28 23:29 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-08-28 23:29 --------- d-----w C:\Documents and Settings\All Users\Application Data\BVRP Software
2008-08-27 07:38 --------- d-----w C:\Documents and Settings\Danny\Application Data\BitTorrent
2008-08-18 23:39 --------- d-----w C:\Program Files\VPos
2007-09-03 10:30 18,224 ----a-w C:\Documents and Settings\Danny\Application Data\GDIPFONTCACHEV1.DAT
.

((((((((((((((((((((((((((((( snapshot@2008-08-30_10.59.48.90 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-02-21 14:23:35 135,168 ----a-w C:\WINDOWS\system32\java.exe
+ 2008-06-09 15:21:01 135,168 ----a-w C:\WINDOWS\system32\java.exe
- 2008-02-21 14:23:39 135,168 ----a-w C:\WINDOWS\system32\javaw.exe
+ 2008-06-09 15:21:04 135,168 ----a-w C:\WINDOWS\system32\javaw.exe
- 2008-02-21 15:33:32 139,264 ----a-w C:\WINDOWS\system32\javaws.exe
+ 2008-06-09 16:32:34 139,264 ----a-w C:\WINDOWS\system32\javaws.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon "= "C:\WINDOWS\system32\NvCpl.dll" [2005-12-10 05:06 7311360]
"NvMediaCenter "= "C:\WINDOWS\system32\NvMcTray.dll" [2005-12-10 05:06 86016]
"SunJavaUpdateSched "= "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 04:27 144784]
"NeroFilterCheck "= "C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50 155648]
"Adobe Reader Speed Launcher "= "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 21:16 39792]
"QuickTime Task "= "C:\Program Files\QuickTime\QTTask.exe" [2008-05-27 10:50 413696]
"iTunesHelper "= "C:\Program Files\iTunes\iTunesHelper.exe" [2008-07-30 10:47 289064]
"SpyHunter Security Suite "= "C:\Program Files\Enigma Software Group\SpyHunter\SpyHunter3.exe" [2008-06-19 16:48 851968]
"SoundMan "= "SOUNDMAN.EXE" [2006-11-17 07:42 577536 C:\WINDOWS\soundman.exe]
"nwiz "= "nwiz.exe" [2005-12-10 05:06 1519616 C:\WINDOWS\system32\nwiz.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE "= "C:\WINDOWS\System32\CTFMON.EXE" [2004-08-04 00:56 15360]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 01:01:04 83360]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders msapsspc.dllschannel.dlldigest.dllmsnsspc.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify "=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe "=
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe "=
"C:\\Program Files\\MSN Messenger\\livecall.exe "=
"C:\\Program Files\\XBC\\XBC_NS.exe "=
"E:\\Battlefield 1942\\BF1942.exe "=
"C:\\Program Files\\BearShare\\BearShare.exe "=
"E:\\MOH\\MOHAA.EXE "=
"C:\\Program Files\\Java\\jre1.6.0_02\\bin\\javaw.exe "=
"E:\\MotoGP2\\motogp2.exe "=
"C:\\Program Files\\BitTorrent\\bittorrent.exe "=
"C:\\Program Files\\TVUPlayer\\TVUPlayer.exe "=
"C:\\Program Files\\Java\\jre1.6.0_03\\bin\\javaw.exe "=
"C:\\Program Files\\iTunes\\iTunes.exe "=

R0 videX32;videX32;C:\WINDOWS\system32\DRIVERS\videX32.sys [2006-10-17 22:22]
S3 papycpu;papycpu;C:\WINDOWS\system32\drivers\papycpu.sys [1998-09-04 11:32]
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-30 14:40:56
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2008-08-30 14:44:34 - machine was rebooted
ComboFix-quarantined-files.txt 2008-08-30 04:44:07
ComboFix2.txt 2008-08-30 04:05:20
ComboFix3.txt 2008-08-30 01:00:31

Pre-Run: 19,577,561,088 bytes free
Post-Run: 19,568,480,256 bytes free

128

 

and my hijack this log.....


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2:46:53 PM, on 30/08/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Outlook Express\msimn.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = file:///D:/backup%20stuff/My%20Webs/startpage.htm
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe "
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe "
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe "
O4 - HKLM\..\Run: [SpyHunter Security Suite] "C:\Program Files\Enigma Software Group\SpyHunter\SpyHunter3.exe" -minimized
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe

--
End of file - 3875 bytes

 

Hi
OK looks good.

How are things now?

Lets get a on-line scan. Please do this.


Download ATF Cleaner by Atribune and save it to your Desktop.
This is a good tool to get rid of the temporary garbage you pick up while surfing the net.
Double click ATF-Cleaner.exe to run the program.
Check the boxes to the left of:

Windows Temp
Current User Temp
All Users Temp
Cookies
Temporary Internet Files
Prefetch
Java Cache
Recycle bin

The rest are optional - if you want it to remove everything check "Select All ".
Finally, click Empty Selected. When you get the "Done Cleaning" message, click OK.

Now the scan.

Please do an online scan with Kaspersky WebScanner

Click on "Accept" If your pop "“up blocker blocks any windows from opening.

Click Run on the window that opens.
Windows Vista users you must open the web browser using the Run as Administrator command.

• The program will launch and then begin downloading the latest definition files:
• Under Scan on the left side.Click on My Computer
• This will start the program and scan your system.
• Click the "Scan Report" On the left side.
• The scan will take a while so be patient and let it run.
• Once the scan is complete it will display if your system has been infected.
  • Click the Save Report As button, and in the Browse dialog box, type a name for the scan report file that you want to create and select its type Text file. Click OK to save the file.:
• Save the text file to your desktop.
• Copy and paste that information in your next post.

Please post the Kaspersky results.

Thanks
Geri

 

Geri I can not thank you enough for helping me. This one really had me stumped. The only odd hting happening now, coincedently is when i visit this site it is prompting me to download a page??
Here is my online scan report........

--------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER 7 REPORT
Saturday, August 30, 2008
Operating System: Microsoft Windows XP Professional Service Pack 2 (build 2600)
Kaspersky Online Scanner 7 version: 7.0.25.0
Program database last update: Saturday, August 30, 2008 04:00:44
Records in database: 1166293
--------------------------------------------------------------------------------

Scan settings:
Scan using the following database: extended
Scan archives: yes
Scan mail databases: yes

Scan area - Critical Areas:
C:\Documents and Settings\All Users\Start Menu\Programs\Startup
C:\Documents and Settings\Danny\Start Menu\Programs\Startup
C:\Program Files
C:\WINDOWS

Scan statistics:
Files scanned: 32803
Threat name: 1
Infected objects: 5
Suspicious objects: 0
Duration of the scan: 00:45:46


File name / Threat name / Threats count
C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\2BK9UB69\ac[1].htm Infected: Trojan-Downloader.JS.Agent.cnn 1
C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\4HC9MTY7\ac[1].htm Infected: Trojan-Downloader.JS.Agent.cnn 1
C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\8FYDWH2J\ac[1].htm Infected: Trojan-Downloader.JS.Agent.cnn 1
C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\8FYDWH2J\ac[2].htm Infected: Trojan-Downloader.JS.Agent.cnn 1
C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\8FYDWH2J\ac[3].htm Infected: Trojan-Downloader.JS.Agent.cnn 1

The selected area was scanned.

 

Hi

Does it say what page? any info?

Please do this.

Delete the CFScript you have on your desktop, then do this.

Highlight and copy the contents of the code box below and paste it into a blank notepad, then save it to your desktop as;

Filename: CFScript.txt
Save As Type: All Files (*.*)

Close all other windows and programs. Now drag the CFScript.txt onto ComboFix.exe and drop it, using the left mouse button.
Click here to see how to use CFScript.txt
Combofix should run and may reboot the computer when it's done. A log will open when it's complete. Post the contents of that log and another fresh HijackThis log.

Please do not click on the ComboFix window while it is running a scan. This can cause it to stall.

Code:

File::
C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\2BK9UB69\ac[1].htm 
C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\4HC9MTY7\ac[1].htm
C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\8FYDWH2J\ac[1].htm 
C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\8FYDWH2J\ac[2].htm 
C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\8FYDWH2J\ac[3].htm 

Please post the combofix log and a new Kaspersky scan.

Thanks
Geri

 

I deleted those files manually before I got your post. Should still do those scans and report back??

Here is a link to a screen capture of what pops up when i visit this site, it is an advert html (i checked because i am a sucker for virus's lol)

http://i134.photobucket.com/albums/q86/DannyG13_photos/virforum.jpg

 

Hi
Just the Kaspersky scan.

I'm trying to find out what that download is.

 

Here is the latest scan results, all fixed by the looks of it thank you.

And for the record, that prompt from this site happens on all our computers that have firefox3, the ones that dont are ok.

--------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER 7 REPORT
Sunday, August 31, 2008
Operating System: Microsoft Windows XP Professional Service Pack 2 (build 2600)
Kaspersky Online Scanner 7 version: 7.0.25.0
Program database last update: Saturday, August 30, 2008 22:53:57
Records in database: 1171331
--------------------------------------------------------------------------------

Scan settings:
Scan using the following database: extended
Scan archives: yes
Scan mail databases: yes

Scan area - Critical Areas:
C:\Documents and Settings\All Users\Start Menu\Programs\Startup
C:\Documents and Settings\Danny\Start Menu\Programs\Startup
C:\Program Files
C:\WINDOWS

Scan statistics:
Files scanned: 32808
Threat name: 0
Infected objects: 0
Suspicious objects: 0
Duration of the scan: 00:44:54

No malware has been detected. The scan area is clean.

The selected area was scanned.

 

Hi DannyG

OK, got this on that window.
"It's an IFRAME with an advertisement, that's served as an HTML page from our ad server ".
Seems this is a "firefox thing" and happens on other sites as well as this one.

It seems not to be malware related so you will just have to close the window when it pops up.

Your logs are clean.

So please do this.

Click Start>Run in the run box copy and paste or type ComboFix /u then hit Enter to uninstall ComboFix and remove the files/folders it created. This action will also reset the System Restore points, removing any infected files there as well.

Please look at this link for some preventive recommendations, It could keep you from ending up back here to the Malware and Virus Removal Forums.
http://www.windowsbbs.com/showthread.php?t=67958

Let me know if everything is running OK and I'll mark this one resolved.

Thanks
Geri

 

Thank you all done. Yes this is resolved and I really do appreciate your help.

When I first realised I was unable to get rid of the virus on my own I paid $39.95 to get the full version of a spyware program that claimed it would cure this particular virus. It didnt and the support people are hopeless, so much so I have to wonder if the spyware program is a scam in itself.
Anyway I will report them to my credit card card company and give the refunded proceeds to this web site.

 

Hi DannyG
OK glad to hear things are good, you're welcome.

You do need to be careful on what you buy and make sure it is a reputable program. and even then it may or may not remove the infection. They change quite fast to stay ahead of the malware companies.

I'll mark this resolved.

Surf Safely.
Geri