Tech Support Forum banner
Cancel
Create thread New Forums
Status
Not open for further replies.

nvtpm32.dll Trojan horse Dropper

Jump to Latest
888 views 1 reply 2 participants last post by  ndmmxiaomayi  
H
#1 ·
I was trying to download a file converter from what looked to be a free file converter site. I downloaded 3 files from this website hxxp://xwarezzz.com/multimedia/1049/moyea-flv-to-video-converter-pro-129211-keygen-crack-serial-patch.html. They are located at the bottom of this page. I double clicked each one of them. 2 disappeared off of the desktop and the other just sat there and did nothing. I then realized what just happened and ran a search for those files i downloaded. 3 files came back so i deleted those 3 files and then emptied my trash can. I walked away for about 5 minutes and when i returned my AVG was going nuts. I was showing nvtpm32.dll Trojan horse Dropper repeatedly over and over again and was adding even more by the second. I tried to clean the infection and it said i could not clean the files because another program was using them. I then restarted my computer in safe mode and ran the scan again. The first thing it showed was again the nvtpm32.dll file as a locked file and displayed that no action was yet taken. I again walked away from the computer and came back to see that it seemed like the scan had finished. I restarted the computer and it powered up with no problem. AVG stopped displaying the messages it had previously shown. I ran a AVG complete system scan to only find cookies in my firefox browser to be threats. Everything seems fine. The only problem is that i went into the system32 folder to find the nvtpm32.dll file still there! I play World of Warcraft and i have noticed that over the last hour it has run with severe freezing of the graphics and sound. Something is obviously wrong. Can it be fixed? Here are my logs...



DDS (Ver_09-03-16.01) - NTFSx86
Run by Ben Morrison at 17:15:08.42 on Sun 03/29/2009
Internet Explorer: 7.0.5730.13
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3327.2766 [GMT -5:00]

AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated)

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Creative\Shared Files\CTAudSvc.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\CyberLink\PowerDVD SE\PDVDServ.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\CTHELPER.EXE
C:\Program Files\Creative\Volume Panel\VolPanlu.exe
C:\WINDOWS\system32\CTXFIHLP.EXE
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Logitech\GamePanel Software\LgDevAgt.exe
C:\Program Files\Logitech\GamePanel Software\LCD Manager\LCDMon.exe
C:\Program Files\Logitech\GamePanel Software\G-series Software\LGDCore.exe
C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\SYSTEM32\CTXFISPI.EXE
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Logitech\GamePanel Software\Applets\LCDCountdown.exe
C:\Program Files\Logitech\GamePanel Software\LCD Manager\Applets\LCDClock.exe
C:\Program Files\Logitech\GamePanel Software\Applets\LCDMedia.exe
C:\Program Files\Logitech\GamePanel Software\Applets\LCDPop3.exe
C:\Program Files\Logitech\GamePanel Software\Applets\LCDRSS.exe
C:\FRAPS\FRAPS.EXE
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\IoctlSvc.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\Program Files\AVG\AVG8\avgcsrvx.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Ben Morrison\Desktop\dds.scr
C:\Documents and Settings\Ben Morrison\Ben Morrison.exe

============== Pseudo HJT Report ===============

BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg8\avgssie.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: {604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - No File
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [Ben Morrison] c:\documents and settings\ben morrison\Ben Morrison.exe /i
uRun: [Fraps] c:\fraps\FRAPS.EXE
mRun: [RemoteControl] "c:\program files\cyberlink\powerdvd se\PDVDServ.exe"
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [nwiz] nwiz.exe /install
mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRun: [CTHelper] CTHELPER.EXE
mRun: [UpdReg] c:\windows\UpdReg.EXE
mRun: [VolPanel] "c:\program files\creative\volume panel\VolPanlu.exe" /r
mRun: [CTxfiHlp] CTXFIHLP.EXE
mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
mRun: [AVG8_TRAY] c:\progra~1\avg\avg8\avgtray.exe
mRun: [AudioDrvEmulator] "c:\program files\creative\shared files\module loader\dllml.exe" -1 audiodrvemulator "c:\program files\creative\shared files\module loader\audio emulator\AudDrvEm.dll"
mRun: [NeroFilterCheck] c:\program files\common files\nero\lib\NeroCheck.exe
mRun: [NBKeyScan] "c:\program files\nero\nero8\nero backitup\NBKeyScan.exe"
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
mRun: [Launch LgDevAgt] "c:\program files\logitech\gamepanel software\LgDevAgt.exe"
mRun: [Launch LCDMon] "c:\program files\logitech\gamepanel software\lcd manager\LCDMon.exe"
mRun: [Launch LGDCore] "c:\program files\logitech\gamepanel software\g-series software\LGDCore.exe" /SHOWHIDE
mRun: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\logite~1.lnk - c:\program files\logitech\setpoint\SetPoint.exe
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1233987174233
DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1233987321624
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://dl8-cdn-01.sun.com/s/ESD7/JSCDL/jdk/6u12-b04/jinstall-6u12-windows-i586-jc.cab?e=1234572273077&h=05ceccf8da88041c5d517550c44c9180/&filename=jinstall-6u12-windows-i586-jc.cab
DPF: {CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_12-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_12-windows-i586.cab
DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} - hxxp://wwwimages.adobe.com/www.adobe.com/products/acrobat/nos/gp.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} - hxxp://www.creative.com/softwareupdate/su2/ocx/15106/CTPID.cab
TCP: {BD663903-2881-4BDF-A4FD-27B42E539D5A} = 192.168.1.1
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg8\avgpp.dll
Notify: avgrsstarter - avgrsstx.dll
Notify: LBTWlgn - c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\benmor~1\applic~1\mozilla\firefox\profiles\7gyi65cd.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.msn.com/
FF - plugin: c:\documents and settings\ben morrison\application data\mozilla\firefox\profiles\7gyi65cd.default\extensions\npdyyno@dyyno.com\plugins\npDyyno.dll

============= SERVICES / DRIVERS ===============

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2009-2-7 325128]
R1 AvgMfx86;AVG Free On-access Scanner Minifilter Driver x86;c:\windows\system32\drivers\avgmfx86.sys [2009-2-7 27656]
R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2009-2-7 107272]
R2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\avg\avg8\avgemc.exe [2009-2-7 903960]
R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\avg\avg8\avgwdsvc.exe [2009-2-7 298264]
R2 LBeepKE;LBeepKE;c:\windows\system32\drivers\LBeepKE.sys [2009-2-17 10384]
R3 CT20XUT.SYS;CT20XUT.SYS;c:\windows\system32\drivers\CT20XUT.sys [2008-10-8 171032]
R3 CTEXFIFX.SYS;CTEXFIFX.SYS;c:\windows\system32\drivers\CTEXFIFX.sys [2008-10-8 1324056]
R3 CTHWIUT.SYS;CTHWIUT.SYS;c:\windows\system32\drivers\CTHWIUT.sys [2008-10-8 72728]
R3 L1e;Miniport Driver for Atheros AR8121/AR8113/AR8114 PCI-E Ethernet Controller;c:\windows\system32\drivers\l1e51x86.sys [2008-6-26 36864]
S2 acpi32;acpi32;\??\c:\windows\system32\drivers\acpi32.sys --> c:\windows\system32\drivers\acpi32.sys [?]
S2 amd64si;amd64si;\??\c:\windows\system32\drivers\amd64si.sys --> c:\windows\system32\drivers\amd64si.sys [?]
S2 ati64si;ati64si;c:\windows\system32\drivers\ati64si.sys [2009-3-29 30464]
S2 fips32cup;fips32cup;\??\c:\windows\system32\drivers\fips32cup.sys --> c:\windows\system32\drivers\fips32cup.sys [?]
S2 i386si;i386si;c:\windows\system32\drivers\i386si.sys [2009-3-29 30464]
S2 ksi32sk;ksi32sk;c:\windows\system32\drivers\ksi32sk.sys [2009-3-29 30464]
S2 netsik;netsik;c:\windows\system32\drivers\netsik.sys [2009-3-29 30464]
S2 port135sik;port135sik;c:\windows\system32\drivers\port135sik.sys [2009-3-29 30464]
S2 securentm;securentm;\??\c:\windows\system32\drivers\securentm.sys --> c:\windows\system32\drivers\securentm.sys [?]
S2 systemntmi;systemntmi;c:\windows\system32\drivers\systemntmi.sys [2009-3-29 30464]
S2 ws2_32sik;ws2_32sik;c:\windows\system32\drivers\ws2_32sik.sys [2009-3-29 30464]
S3 Creative Audio Engine Licensing Service;Creative Audio Engine Licensing Service;c:\program files\common files\creative labs shared\service\CTAELicensing.exe [2009-2-7 79360]
S3 CT20XUT;CT20XUT;c:\windows\system32\drivers\CT20XUT.sys [2008-10-8 171032]
S3 CTEXFIFX;CTEXFIFX;c:\windows\system32\drivers\CTEXFIFX.sys [2008-10-8 1324056]
S3 CTHWIUT;CTHWIUT;c:\windows\system32\drivers\CTHWIUT.sys [2008-10-8 72728]
S3 getPlus(R) Helper;getPlus(R) Helper;c:\program files\nos\bin\getPlus_HelperSvc.exe [2009-2-17 33752]
S3 uisp;Motorola USB ICP driver;c:\windows\system32\drivers\usbicp.sys --> c:\windows\system32\drivers\usbicp.sys [?]

=============== Created Last 30 ================

2009-03-29 17:08 <DIR> --d----- c:\windows\system32\NtmsData
2009-03-29 17:01 30,464 a------- c:\windows\system32\drivers\i386si.sys
2009-03-29 16:44 30,464 a------- c:\windows\system32\drivers\ws2_32sik.sys
2009-03-29 16:00 30,464 a------- c:\windows\system32\drivers\netsik.sys
2009-03-29 15:34 30,464 a------- c:\windows\system32\drivers\systemntmi.sys
2009-03-29 15:28 30,464 a------- c:\windows\system32\drivers\port135sik.sys
2009-03-29 15:26 30,464 a------- c:\windows\system32\drivers\ati64si.sys
2009-03-29 15:14 30,464 a------- c:\windows\system32\drivers\ksi32sk.sys
2009-03-29 13:59 64,512 a------- c:\windows\system32\ewf3.pxf
2009-03-29 13:59 32,768 a------- c:\windows\system32\fe3.wa
2009-03-29 12:43 20,450 ----h--- c:\documents and settings\ben morrison\Ben Morrison.exe
2009-03-29 12:43 578,560 ac------ c:\windows\system32\dllcache\user32.dll
2009-03-29 12:43 163,840 a------- c:\windows\system32\nvtpm32.dll
2009-03-29 12:43 97,280 a------- c:\windows\system32\azton.mt
2009-03-29 12:42 10 a------- c:\windows\system32\kr_done1
2009-03-29 12:26 <DIR> --d----- c:\docume~1\benmor~1\applic~1\Moyea
2009-03-28 19:35 765,952 a------- c:\windows\system32\xvidcore.dll
2009-03-28 19:35 <DIR> --d----- C:\Mp3 Output
2009-03-28 19:35 383,238 a------- c:\windows\system32\libmp3lame-0.dll
2009-03-16 15:54 <DIR> --d----- c:\program files\Ventrilo
2009-03-16 15:54 262 a------- c:\windows\{789289CA-F73A-4A16-A331-54D498CE069F}_WiseFW.ini
2009-03-14 18:37 <DIR> --d----- c:\docume~1\benmor~1\applic~1\AVS4YOU
2009-03-14 18:37 <DIR> --d----- c:\docume~1\alluse~1\applic~1\AVS4YOU
2009-03-14 18:36 <DIR> --d----- c:\program files\common files\AVSMedia
2009-03-14 18:36 1,700,352 a------- c:\windows\system32\GdiPlus.dll
2009-03-14 18:36 974,848 a------- c:\windows\system32\mfc70.dll
2009-03-14 18:36 487,424 a------- c:\windows\system32\msvcp70.dll
2009-03-14 18:36 24,576 a------- c:\windows\system32\msxml3a.dll
2009-03-14 18:36 <DIR> --d----- c:\program files\AVS4YOU
2009-03-12 03:07 221,184 a------- c:\windows\system32\wmpns.dll
2009-03-08 20:13 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Creative Labs
2009-03-08 13:35 344,064 a------- c:\windows\system32\msvcr70.dll
2009-03-08 13:35 <DIR> --d----- c:\program files\common files\DVDVideoSoft
2009-03-01 16:26 <DIR> --d----- c:\docume~1\benmor~1\applic~1\dyyno-vlc
2009-03-01 16:22 <DIR> --d----- c:\docume~1\benmor~1\applic~1\Xfire
2009-03-01 16:22 <DIR> --d----- c:\program files\Xfire
2009-03-01 16:21 <DIR> --d----- c:\program files\Dyyno
2009-02-28 22:24 <DIR> --d----- c:\windows\system32\appmgmt

==================== Find3M ====================

2009-03-29 12:43 578,560 a------- c:\windows\system32\user32.DLL
2009-02-26 13:46 42,320 a------- c:\windows\system32\xfcodec.dll
2009-02-17 13:30 0 a---h--- c:\windows\system32\drivers\Msft_Kernel_LMouFilt_01005.Wdf
2009-02-17 13:30 0 a---h--- c:\windows\system32\drivers\Msft_Kernel_LHidFilt_01005.Wdf
2009-02-17 13:30 0 a---h--- c:\windows\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf
2009-02-13 19:43 410,984 a------- c:\windows\system32\deploytk.dll
2009-02-11 22:54 30,520 a------- c:\windows\system32\drivers\PnkBstrK.sys
2009-02-11 22:54 107,832 a------- c:\windows\system32\PnkBstrB.exe
2009-02-11 14:32 107,888 a------- c:\windows\system32\CmdLineExt.dll
2009-02-11 14:31 22,328 a------- c:\docume~1\benmor~1\applic~1\PnkBstrK.sys
2009-02-11 14:31 2,250,024 a------- c:\windows\system32\pbsvc.exe
2009-02-11 14:31 66,872 a------- c:\windows\system32\PnkBstrA.exe
2009-02-09 06:13 1,846,784 a------- c:\windows\system32\win32k.sys
2009-02-07 12:36 21,640 a------- c:\windows\system32\emptyregdb.dat
2009-02-07 08:07 107,272 a------- c:\windows\system32\drivers\avgtdix.sys
2009-02-07 08:07 10,520 a------- c:\windows\system32\avgrsstx.dll
2009-02-07 08:07 325,128 a------- c:\windows\system32\drivers\avgldx86.sys
2009-02-07 02:23 444,952 a------- c:\windows\system32\wrap_oal.dll
2009-02-07 02:23 109,080 a------- c:\windows\system32\OpenAL32.dll
2009-02-07 01:44 53,248 a------- c:\windows\system32\CSVer.dll
2009-02-07 01:26 86,327 a------- c:\windows\pchealth\helpctr\offlinecache\index.dat
2009-01-07 12:28 453,152 a------- c:\windows\system32\NVUNINST.EXE
2009-01-03 03:41 81,920 a------- c:\windows\system32\frapsvid.dll

============= FINISH: 17:15:20.62 ===============
 

Attachments

N
#2 ·
Hi Hollywood5,

Step 1

Please disable AVG Antivirus temporarily as it may interfere with the fixes. Remember to re-enable it back before posting the logs.

Please open the AVG 8 Control Center, by right clicking on the AVG 8 icon on task bar.

  • Click on Tools.
  • Select Advanced Settings.
  • In the left hand pane, scroll down to Resident Shield.
  • In the main pane, deselect the option to Enable Resident Shield.
  • To re-enable AVG 8, please select Enable Resident Shield again.

Step 2

Please visit this page to download and run Combofix - http://www.bleepingcomputer.com/combofix/how-to-use-combofix

Save it to your desktop.

  • Double click on ComboFix.exe & follow the prompts.

  • As part of its process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. You will see the following message if Microsoft Windows Recovery Console is not installed.

    Image


    With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue its malware removal procedures.

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

Image



Click on Yes to continue scanning for malware.

When finished, a log will be produced. Please post this log in your next reply.

Do not mouse click on Combofix while it is running. That may cause it to stall.
 
Save
Like Like
Status
Not open for further replies.
You have insufficient privileges to reply here.
Tech Support Forum
posts
4.8M
members
966K
Since
2002
A forum community dedicated to tech experts and enthusiasts. Come join the discussion about articles, computer security, Mac, Microsoft, Linux, hardware, networking, gaming, reviews, accessories, and more!
Full Forum Listing
Explore Our Forums
Windows 7 , Windows Vista Support Motherboards, Bios|UEFI & CPU Networking Support Hard Drive & SSD Support PC Gaming Support