1. You are viewing our forum as a guest. For full access please Register. WindowsBBS.com is completely free, paid for by advertisers and donations.

Removing BHO and .dlls

Discussion in 'Malware and Virus Removal Archive' started by im14grfx, 2007/08/01.

  1. 2007/08/01
    im14grfx

    im14grfx Inactive Thread Starter

    Joined:
    2007/08/01
    Messages:
    7
    Likes Received:
    0
    Hello.This is my first time posting and I hope I'm doing it right.I keep getting pop-ups in IE7 when I'm using Firefox or IE7.They are coming from Anti-Virus
    web sites mostly.My PC is updated from Microsoft and I'm running Windows Live One Care.I tried removing the .dll's listed below on startup but to no avail.I can not get rid of these or the BHO's.Any ideas?This is just a partial list of my Hijack This log.Will post complete list if necessary,but these objects seem to be the thorn in my side.


    O20 - Winlogon Notify: awvtq - C:\WINDOWS\system32\awvtq.dll
    O20 - Winlogon Notify: byxwvwx - C:\WINDOWS\SYSTEM32\byxwvwx.dll
    O20 - Winlogon Notify: dadccbdfedbface - C:\WINDOWS\system32\dadccbdfedbface.dll
    O2 - BHO: (no name) - {00D0E786-A9E4-4EC5-82BA-E4E57D285B83} - C:\WINDOWS\system32\byxwvwx.dll
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: (no name) - {3C02979C-50AD-4AAB-B49D-3D1E31FAAA7B} - C:\WINDOWS\system32\awvtq.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
    O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
    O2 - BHO: (no name) - {C6039E6C-BDE9-4de5-BB40-768CAA584FDC} - C:\WINDOWS\system32\obiwmerk.dll
     
    im14grfx,
    #1
  2. 2007/08/01
    PeteC

    PeteC SuperGeek Staff

    Joined:
    2002/05/10
    Messages:
    28,896
    Likes Received:
    389
    im14grfx - Welcome to the Board :)

    Please post the full HJT log.
     
    PeteC,
    #2


  3. to hide this advert.

  4. 2007/08/01
    TonyT

    TonyT SuperGeek Staff

    Joined:
    2002/01/18
    Messages:
    9,072
    Likes Received:
    400
    Looks like a Vundo infection.
    ...waiting for full HjT log.
     
    TonyT,
    #3
  5. 2007/08/03
    im14grfx

    im14grfx Inactive Thread Starter

    Joined:
    2007/08/01
    Messages:
    7
    Likes Received:
    0
    Full HJT Log

    Hey,
    Thanx for the quick reply.The BHO's and .dll's in question are no longer in my log...however,I still get pop-ups and the files themselves(dll's)are still in System32 folder.I've run Ad Aware,Spybot andVundoFix but I still have browser(pop-up)issues when using Firefox.All pop-ups show up in IE window.Any ideas?
    Here is my latest HJT log.

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Microsoft Windows OneCare Live\Antivirus\MsMpEng.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
    C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\inetsrv\inetinfo.exe
    C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
    C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
    C:\WINDOWS\system32\HPZipm12.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
    C:\Program Files\Microsoft Windows OneCare Live\Firewall\msfwsvc.exe
    C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
    C:\Program Files\Microsoft Windows OneCare Live\winss.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Microsoft Windows OneCare Live\winssnotify.exe
    C:\WINDOWS\AGRSMMSG.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
    O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
    O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
    O4 - HKLM\..\Run: [Adobe_ID0EYTHM] C:\PROGRA~1\COMMON~1\Adobe\ADOBEV~1\Server\bin\VERSIO~2.EXE
    O4 - HKLM\..\RunServices: [Microsoft Updates] svdhost.exe
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
    O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
    O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
    O8 - Extra context menu item: Append to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
    O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
    O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
    O9 - Extra button: BitComet Search - {461CC20B-FB6E-4f16-8FE8-C29359DB100E} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.7.4.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\WINDOWS\system32\shdocvw.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
    O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~3\Office12\GR99D3~1.DLL
    O23 - Service: Adobe Version Cue CS3 - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\Adobe Version Cue CS3\Server\bin\VersionCueCS3.exe
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
    O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
    O23 - Service: Fast User Switching Compatibility FastUserSwitchingCompatibilitySharedAccess (FastUserSwitchingCompatibilitySharedAccess) - Unknown owner - C:\WINDOWS\system32\accwizh.exe
    O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
    O23 - Service: ForceWare Intelligent Application Manager (IAM) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
    O23 - Service: Forceware Web Interface (ForcewareWebInterface) - Apache Software Foundation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: mental ray 3.5 Satellite (32-bit) (mi-raysat_3dsmax9_32) - Unknown owner - C:\Program Files\Autodesk\3ds Max 9\mentalray\satellite\raysat_3dsmax9_32server.exe
    O23 - Service: ForceWare IP service (nSvcIp) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
    O23 - Service: ForceWare user log service (nSvcLog) - NVIDIA - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
    O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
     
    im14grfx,
    #4
  6. 2007/08/03
    TonyT

    TonyT SuperGeek Staff

    Joined:
    2002/01/18
    Messages:
    9,072
    Likes Received:
    400
    You have a backdoor trojan. (it really is NOT MS updates)
    Use HjT to remove the following:

    O4 - HKLM\..\RunServices: [Microsoft Updates] svdhost.exe

    trojan info here and here

    next, delete these dll files if they exist:

    C:\WINDOWS\system32\awvtq.dll
    C:\WINDOWS\SYSTEM32\byxwvwx.dll
    C:\WINDOWS\system32\dadccbdfedbface.dll
    C:\WINDOWS\system32\byxwvwx.dll
    C:\WINDOWS\system32\awvtq.dll
    C:\WINDOWS\system32\obiwmerk.dll

    below is OK, it's from Adobe Reader
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

    below is OK, it's from Sun Java
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll

    below is OK, it's from Adobe Acrobat or other Adobe program
    O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
     
    Last edited: 2007/08/03
    TonyT,
    #5
  7. 2007/08/04
    im14grfx

    im14grfx Inactive Thread Starter

    Joined:
    2007/08/01
    Messages:
    7
    Likes Received:
    0
    Deleting .dll's

    Thanx Tony for your help...I can not delete:
    C:\WINDOWS\SYSTEM32\byxwvwx.dll
    C:\WINDOWS\system32\dadccbdfedbface.dll
    I've tried to do so on reboot through HJT but it doesn't work.Any suggestions?
     
    im14grfx,
    #6
  8. 2007/08/05
    noahdfear

    noahdfear Inactive

    Joined:
    2003/04/06
    Messages:
    12,178
    Likes Received:
    15
    Hi im14grfx,

    Here are a couple of things to work on till Tony checks back in.

    Download VundoFix.exe, saving it to your desktop.
    • Double-click VundoFix.exe to run it.
    • Click the Scan for Vundo button.
    • Once it's done scanning, click the Remove Vundo button.
    • You will receive a prompt asking if you want to remove the files, click YES
    • Once you click yes, your desktop will go blank as it starts removing Vundo.
    • When completed, it will prompt that it will reboot your computer, click OK.
    Note: It is possible that VundoFix encounters a file it could not remove. In this case, VundoFix will run on reboot. If that happens, follow the above instructions starting from "Click the Scan for Vundo button" when VundoFix appears upon rebooting.

    Download ComboFix from Here or Here, saving the file to your Desktop.
    • Close all open programs and windows
    • Double click combofix.exe and follow the prompts.
    • When finished, it will open a log for you. Post that log and a new HijackThis log, along with the VundoFix log located at C:\vundofix.txt in your next reply.
    Note: Do not mouseclick combofix's window while its running. That may cause it to stall
     
    noahdfear,
    #7
  9. 2007/08/05
    im14grfx

    im14grfx Inactive Thread Starter

    Joined:
    2007/08/01
    Messages:
    7
    Likes Received:
    0
    Vundo Text

    Here is a copy of the VundoFix text but it seems these two:

    C:\WINDOWS\SYSTEM32\byxwvwx.dll
    C:\WINDOWS\system32\dadccbdfedbface.dll

    refuse to DIE!!! Here also is a list of my HJT log.It looks okay to me,
    alot of the BHO's in question are gone,however,I'm still getting pop-ups
    like crazy.


    VundoFix V6.5.6

    Checking Java version...

    Scan started at 12:05:40 PM 8/3/2007

    Listing files found while scanning....

    C:\windows\system32\apjlorcc.exe
    C:\WINDOWS\system32\awvtq.dll
    C:\windows\system32\iotufrcc.exe
    C:\windows\system32\jyfayfsk.exe
    C:\windows\system32\kpmjwxta.exe
    C:\windows\system32\lbejurxd.exe
    C:\windows\system32\myvfoggx.exe
    C:\windows\system32\okdmfexm.exe
    C:\WINDOWS\system32\qtvwa.bak1
    C:\WINDOWS\system32\qtvwa.bak2
    C:\WINDOWS\system32\qtvwa.ini
    C:\WINDOWS\system32\qtvwa.ini2
    C:\WINDOWS\system32\qtvwa.tmp
    C:\windows\system32\vndvvmko.exe
    C:\windows\system32\wbwoivig.exe
    C:\windows\system32\xfpuwsui.exe
    C:\windows\system32\xgmopyfd.exe

    Beginning removal...

    Attempting to delete C:\windows\system32\apjlorcc.exe
    C:\windows\system32\apjlorcc.exe Has been deleted!

    Attempting to delete C:\WINDOWS\system32\awvtq.dll
    C:\WINDOWS\system32\awvtq.dll Has been deleted!

    Attempting to delete C:\windows\system32\iotufrcc.exe
    C:\windows\system32\iotufrcc.exe Has been deleted!

    Attempting to delete C:\windows\system32\jyfayfsk.exe
    C:\windows\system32\jyfayfsk.exe Has been deleted!

    Attempting to delete C:\windows\system32\kpmjwxta.exe
    C:\windows\system32\kpmjwxta.exe Has been deleted!

    Attempting to delete C:\windows\system32\lbejurxd.exe
    C:\windows\system32\lbejurxd.exe Has been deleted!

    Attempting to delete C:\windows\system32\myvfoggx.exe
    C:\windows\system32\myvfoggx.exe Could not be deleted.

    Attempting to delete C:\windows\system32\okdmfexm.exe
    C:\windows\system32\okdmfexm.exe Has been deleted!

    Attempting to delete C:\WINDOWS\system32\qtvwa.bak1
    C:\WINDOWS\system32\qtvwa.bak1 Has been deleted!

    Attempting to delete C:\WINDOWS\system32\qtvwa.bak2
    C:\WINDOWS\system32\qtvwa.bak2 Has been deleted!

    Attempting to delete C:\WINDOWS\system32\qtvwa.ini
    C:\WINDOWS\system32\qtvwa.ini Has been deleted!

    Attempting to delete C:\WINDOWS\system32\qtvwa.ini2
    C:\WINDOWS\system32\qtvwa.ini2 Has been deleted!

    Attempting to delete C:\WINDOWS\system32\qtvwa.tmp
    C:\WINDOWS\system32\qtvwa.tmp Has been deleted!

    Attempting to delete C:\windows\system32\vndvvmko.exe
    C:\windows\system32\vndvvmko.exe Has been deleted!

    Attempting to delete C:\windows\system32\wbwoivig.exe
    C:\windows\system32\wbwoivig.exe Has been deleted!

    Attempting to delete C:\windows\system32\xfpuwsui.exe
    C:\windows\system32\xfpuwsui.exe Has been deleted!

    Attempting to delete C:\windows\system32\xgmopyfd.exe
    C:\windows\system32\xgmopyfd.exe Has been deleted!

    Performing Repairs to the registry.
    Done!

    Beginning removal...

    Attempting to delete C:\windows\system32\myvfoggx.exe
    C:\windows\system32\myvfoggx.exe Has been deleted!

    Performing Repairs to the registry.
    Done!

    VundoFix V6.5.6

    Checking Java version...

    Scan started at 12:22:48 AM 8/5/2007

    Listing files found while scanning....

    C:\WINDOWS\system32\ghhkj.bak1
    C:\WINDOWS\system32\ghhkj.bak2
    C:\WINDOWS\system32\ghhkj.ini
    C:\WINDOWS\system32\jkhhg.dll
    C:\windows\system32\nmwpxlmr.exe

    Beginning removal...

    VundoFix V6.5.6

    Checking Java version...

    Scan started at 1:34:40 AM 8/5/2007

    Listing files found while scanning....

    C:\windows\system32\ggmibcfh.exe
    C:\WINDOWS\system32\ghhkj.bak1
    C:\WINDOWS\system32\ghhkj.bak2
    C:\WINDOWS\system32\ghhkj.ini
    C:\WINDOWS\system32\jkhhg.dll
    C:\windows\system32\nmwpxlmr.exe

    Beginning removal...

    Attempting to delete C:\windows\system32\ggmibcfh.exe
    C:\windows\system32\ggmibcfh.exe Could not be deleted.

    Attempting to delete C:\WINDOWS\system32\ghhkj.bak1
    C:\WINDOWS\system32\ghhkj.bak1 Has been deleted!

    Attempting to delete C:\WINDOWS\system32\ghhkj.bak2
    C:\WINDOWS\system32\ghhkj.bak2 Has been deleted!

    Attempting to delete C:\WINDOWS\system32\ghhkj.ini
    C:\WINDOWS\system32\ghhkj.ini Has been deleted!

    Attempting to delete C:\WINDOWS\system32\jkhhg.dll
    C:\WINDOWS\system32\jkhhg.dll Has been deleted!

    Attempting to delete C:\windows\system32\nmwpxlmr.exe
    C:\windows\system32\nmwpxlmr.exe Has been deleted!

    Performing Repairs to the registry.
    Done!

    Beginning removal...

    Attempting to delete C:\windows\system32\ggmibcfh.exe
    C:\windows\system32\ggmibcfh.exe Has been deleted!

    Performing Repairs to the registry.
    Done!

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 10:51:41 AM, on 8/5/2007
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16473)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Microsoft Windows OneCare Live\Antivirus\MsMpEng.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
    C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\inetsrv\inetinfo.exe
    C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
    C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
    C:\WINDOWS\system32\HPZipm12.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
    C:\Program Files\Microsoft Windows OneCare Live\Firewall\msfwsvc.exe
    C:\Program Files\Microsoft Windows OneCare Live\winss.exe
    C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Microsoft Windows OneCare Live\winssnotify.exe
    C:\WINDOWS\AGRSMMSG.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
    O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
    O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
    O4 - HKLM\..\Run: [Adobe_ID0EYTHM] C:\PROGRA~1\COMMON~1\Adobe\ADOBEV~1\Server\bin\VERSIO~2.EXE
    O4 - HKLM\..\Run: [OneCareUI] "C:\Program Files\Microsoft Windows OneCare Live\winssnotify.exe "
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
    O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
    O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
    O8 - Extra context menu item: Append to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
    O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
    O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
    O9 - Extra button: BitComet Search - {461CC20B-FB6E-4f16-8FE8-C29359DB100E} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.7.4.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\WINDOWS\system32\shdocvw.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
    O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~3\Office12\GR99D3~1.DLL
    O23 - Service: Adobe Version Cue CS3 - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\Adobe Version Cue CS3\Server\bin\VersionCueCS3.exe
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
    O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
    O23 - Service: Fast User Switching Compatibility FastUserSwitchingCompatibilitySharedAccess (FastUserSwitchingCompatibilitySharedAccess) - Unknown owner - C:\WINDOWS\system32\accwizh.exe
    O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
    O23 - Service: ForceWare Intelligent Application Manager (IAM) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
    O23 - Service: Forceware Web Interface (ForcewareWebInterface) - Apache Software Foundation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: mental ray 3.5 Satellite (32-bit) (mi-raysat_3dsmax9_32) - Unknown owner - C:\Program Files\Autodesk\3ds Max 9\mentalray\satellite\raysat_3dsmax9_32server.exe
    O23 - Service: ForceWare IP service (nSvcIp) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
    O23 - Service: ForceWare user log service (nSvcLog) - NVIDIA - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
    O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

    I also tried KillBox to remove the nasties,but with no luck.Is there anyway to remove these objects in the registry?I will not let some schmuck charge me
    $100.00 or so to remove this Trojan.I'd really,really,really hate to have to do a fresh install of Windows(I feel a headache just thinking about it!).Anyway,thanx for the help.:confused:
     
    im14grfx,
    #8
  10. 2007/08/05
    noahdfear

    noahdfear Inactive

    Joined:
    2003/04/06
    Messages:
    12,178
    Likes Received:
    15
    Please run ComboFix as instructed above. ;)
     
    noahdfear,
    #9
  11. 2007/08/05
    im14grfx

    im14grfx Inactive Thread Starter

    Joined:
    2007/08/01
    Messages:
    7
    Likes Received:
    0
    Combo Fix

    Hello...Guess what?I ran Combo Fix as suggested and I don't know if anyone else had this issue,but on reboot Windows wouldn't start due to a missing
    hal.dll file.I could not repair because I forgot my administrator password.DUH!
    Anyhow,I do have a dual boot setup with Windows Vista and was able to copy files onto a 2nd hard drive and do a totally clean install of XP.Like I said...a headache but,Virtumonde.O is gone!!!So far anyway.Anyway a heads up on ComboFix as it corrupted my boot.ini file because I was not able to boot into safe mode on C:(it kept going to Vista on D:)and it would try to repair D:instead of C:.C: drive was not accesible on repair OR safe mode.
    But I was able to access C: drive in Vista.????Very confused,but I like to do a clean install every 9-12 months or so.Well thanx for the help all,everything was flying smoothly until ComboFix,so I guess use caution when using this feature.
     
    im14grfx,
    #10
  12. 2007/08/05
    noahdfear

    noahdfear Inactive

    Joined:
    2003/04/06
    Messages:
    12,178
    Likes Received:
    15
    I'm sorry to hear that. I will certainly let the developer know ASAP. I'm sure he will try to address the issue quickly.
     
    noahdfear,
    #11
  13. 2007/08/05
    noahdfear

    noahdfear Inactive

    Joined:
    2003/04/06
    Messages:
    12,178
    Likes Received:
    15
    Did you by chance take a look at the boot.ini file on C: after booting into Vista?
     
    noahdfear,
    #12
  14. 2007/08/05
    im14grfx

    im14grfx Inactive Thread Starter

    Joined:
    2007/08/01
    Messages:
    7
    Likes Received:
    0
    boot.ini

    You know what...I did not.I didn't even think about it.I go into panic mode and I get in a hurry.I probably could have saved myself a lot of aggravation.I'm still downloading Windows updates!:eek:I guess it was presumptuous of me to assume my boot file was corrupted...that was just the feedback I was getting when I googled hal.dll
     
    Last edited: 2007/08/05
    im14grfx,
    #13
  15. 2007/08/05
    noahdfear

    noahdfear Inactive

    Joined:
    2003/04/06
    Messages:
    12,178
    Likes Received:
    15
    While it's unfortunate that you experienced a problem, it's almost as unfortunate that you have now done a clean installation, thereby preventing any kind of investigation into the cause. After a discussion with the developer of ComboFix, I'm really not much less baffled by your experience. Boot.ini is whitelisted, as well as the path to it, meaning the chances of the tool corrupting it are as near to impossible as can be. In the event that the near impossible became possible and boot.ini was corrupted, a bootcfg /rebuild command from the recovery console should repair it. With XP on the C: partition, it could actually even boot XP without a boot.ini file ..... Windows will search the 1st partition of a drive for the 'system' folder and boot said system.

    At this point, the only imaginable scenario to cause this would be user intervention ........ possibly manually forcing a restart after ComboFix had begun the reboot process, effectively interrupting one of the tasks ComboFix is performing during the reboot process (restoring the registry), leaving the system with a corrupted registry upon reboot. This would also be a recoverable situation. ComboFix makes a backup of the registry before making any changes, which could have been easily restored via the recovery console. Not saying this is what happened, it's just the only scenario we've been able to think of as a cause.

    All of the above is moot now, since you've re-installed. I just wanted to offer a bit of info on the matter, and let you know that the incident has not been swept under a rug without bothering to look into the cause. Again, I offer my apologies for your experience.

    One other thing that I'm curious about. Vista, when installed, writes it's own boot files (boot manager) to the C: partition in a dual boot situation. If you did a clean install of XP on C:, how will Vista boot? Or am I presumptuous in thinking that D: is a partition, and it's really a separate hard drive? If a separate hard drive, and bootable, I would have to conclude that Vista was installed as a stand-alone system on that drive. That would explain why you saw the Vista drive as C: when you booted to it. With Vista drive as the boot drive, it is indeed C: and the XP drive would be D: ...... when the XP drive is the boot drive, Vista will be on D: and XP on C:. The bootable drive can be set in the BIOS, by changing the harddrive boot device to either harddisk 0 or harddisk 1. Also presumptuous ..... if you have (had) the option to boot to either operating system upon startup, then the boot.ini on the XP drive had a line manually added in it to point to Vista on disk(1)partition(1), provided XP is on disk(0)partition(1) and harddisk 0 is the first hard drive boot device.


    edited for typos
     
    Last edited: 2007/08/05
    noahdfear,
    #14
  16. 2007/08/05
    im14grfx

    im14grfx Inactive Thread Starter

    Joined:
    2007/08/01
    Messages:
    7
    Likes Received:
    0
    Hey Dave,
    I wish I could help you guys figure out what went wrong with my boot issues but like you said,it's moot now.I did let ComboFix run by itself and it ran the same way VundoFix did.I could not access the recovery console because my admin password was not valid.Nevertheless,I learned a ton from this little excursion into the world of Trojan's and other nasties that can effect a PC.Very bad stuff.
    I'm very cautious when surfing,downloading,installing etc.I tend to get a sense of immunity from viruses and malware and the like but I guess since I have high speed internet,I'm more prone to them.I don't know what happened,but all is okay now.I know if I have another issue,I will post here as you all have been very helpful and I really appreciate all of your help.And yes,I will have to re-install Vista which I had installed on another drive(D:).Actually,I prefer XP for now,as it runs all of my software without a hitch.
     
    Last edited: 2007/08/05
    im14grfx,
    #15
  17. 2007/08/05
    noahdfear

    noahdfear Inactive

    Joined:
    2003/04/06
    Messages:
    12,178
    Likes Received:
    15
    Thanks im14grfx :)

    Make sure you put a good AV and Firewall on that machine. ;)
     
    noahdfear,
    #16
  18. 2007/08/05
    noahdfear

    noahdfear Inactive

    Joined:
    2003/04/06
    Messages:
    12,178
    Likes Received:
    15
    Whoa ........ hold on there.

    That leads me to believe, as I stated above, that Vista was installed on the D: drive as a standalone system. The boot files required to run Vista would be on the D: drive as well. Is that correct?
     
    noahdfear,
    #17

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...