HJT log mllji.dll found LOTS OF POPUPS

[flyjum]

Ok i keep getting popups i got rid of alot of adware already but this one i cant mllji.dll i may have other virus as well here is the log.


C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe
C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe
C:\Program Files\Softwin\BitDefender10\vsserv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\notepad.exe
C:\WINDOWS\notepad.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

F3 - REG:win.ini: load=C:\WINDOWS\system32\mllji.exe
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig .exe /auto
O4 - HKUS\S-1-5-19\..\RunOnce: [FirstLogon] C:\windows\system32\prefetch32\Rundll.bat (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [FirstLogon] C:\windows\system32\prefetch32\Rundll.bat (User 'NETWORK SERVICE')
O4 - S-1-5-18 Startup: IBM.lnk = C:\WINDOWS\system32\Prefetch32\IBM.bat (User 'SYSTEM')
O4 - .DEFAULT Startup: IBM.lnk = C:\WINDOWS\system32\Prefetch32\IBM.bat (User 'Default user')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim .exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab
O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} (Get_ActiveX Control) - https://h17000.www1.hp.com/ewfrf-JAV...oadManager.ocx
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: BitDefender Desktop Update Service (LIVESRV) - SOFTWIN S.R.L. - C:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - SOFTWIN S.R.L. - C:\Program Files\Softwin\BitDefender10\vsserv.exe
O23 - Service: BitDefender Communicator (XCOMM) - SOFTWIN S.R.L - C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe

--
End of file - 4515 bytes

[flyjum]

Tried to fix the mllji.dll but it morphed to this line. I did the safe mode delete. I think this is the vundo trojan.

F3 - REG:win.ini: load=C:\WINDOWS\system32\jkhhe.exe

[Ried]

Hello flyjum and welcome to TSF,

The log you've posted is not complete. Additionally, we prefer a more comprehensive set of logs to assist us in detecting the extent the malware has infiltrated your system. As noted in our sticky topic (Updated!) IMPORTANT - Read This Before Posting A Log, download Deckard's System Scanner (DSS) to your Desktop.

What DSS will do:

• create a new System Restore point in Windows XP and Vista.
• clean your Temporary Files, Downloaded Program Files, and Internet Cache Files, and also empty the Recycle Bin on all drives.
• check some important areas of your system and produce a report for your analyst to review.
• DSS automatically runs HijackThis for you, but it will also install and place a shortcut to HijackThis on your desktop if you do not already have HijackThis installed.

Note: You must be logged onto an account with administrator privileges.

1. Close all applications and windows.
2. Double-click on dss.exe to run it, and follow the prompts.
3. When the scan is complete, two text files will open - main.txt <- this one will be maximized and extra.txt <-this one will be minimized
4. Copy (Ctrl+A then Ctrl+C) and paste (Ctrl+V) the contents of main.txt in your next reply.
5. Please attach extra.txt to your post.

To attach a file to a new post, simply

1. Click the[Manage Attachments] button under Additional Options > Attach Files on the post composition page, and
2. copy and paste the following into the "Upload File from your Computer" box:

   C:\Deckard\System Scanner\extra.txt
   

3. Click Upload.

Please include the following in your next reply and we'll get started:

main.txt
an attached extra.txt

[flyjum]

DSS did not make extra.txted I tried it 5 times and restarted computer and did it again still no extra.txt but here is the main
also I dont know why it didnt back up a system restore point but i have none saved. I just did one on the 24th of dec to.

Deckard's System Scanner v20071014.68
Run by Home on 2007-12-28 03:35:24
Computer is in Normal Mode.
--------------------------------------------------------------------------------



-- HijackThis (run as Home.exe) ------------------------------------------------

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 3:35:35 AM, on 12/28/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe
C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe
C:\Program Files\Softwin\BitDefender10\vsserv.exe
C:\Program Files\TrojanHunter 5.0\THGuard .exe
C:\Program Files\TrojanHunter 5.0\THGuard .exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Home\Local Settings\Temporary Internet Files\Content.IE5\LZV39NL5\dss[1].exe
C:\PROGRA~1\TRENDM~1\HIJACK~1\Home.exe

F3 - REG:win.ini: load=C:\WINDOWS\system32\jkhhe.exe
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: (no name) - {2D5796A2-44E0-4E50-A5A0-80BF1EE3EA73} - C:\WINDOWS\system32\mljjkhg.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: (no name) - {3B283E7E-1499-46C5-B0D2-75438156DDFC} - C:\WINDOWS\system32\jkhhe.dll
O2 - BHO: (no name) - {4E35B657-BE29-42BD-B69E-9F680FF88C95} - C:\WINDOWS\system32\mllji.dll (file missing)
O2 - BHO: {7b519f24-0ae3-e138-4894-60124b71e6d6} - {6d6e17b4-2106-4984-831e-3ea042f915b7} - C:\WINDOWS\system32\mnvcpjpg.dll
O2 - BHO: (no name) - {702D7173-00A5-481C-9D32-7DB2565F265E} - C:\Program Files\Messenger\sagejyt83122.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O2 - BHO: WebBlock Class - {C6B08E8D-3F9A-4710-9F38-E4BF827C6AC2} - C:\WINDOWS\Prefetch\10544\webblock.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [THGuard] "C:\Program Files\TrojanHunter 5.0\THGuard .exe"
O4 - HKLM\..\Run: [041fb4d4] rundll32.exe "C:\WINDOWS\system32\ymdgkwan.dll",b
O4 - HKUS\S-1-5-19\..\RunOnce: [FirstLogon] C:\windows\system32\prefetch32\Rundll.bat (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [FirstLogon] C:\windows\system32\prefetch32\Rundll.bat (User 'NETWORK SERVICE')
O4 - S-1-5-18 Startup: IBM.lnk = C:\WINDOWS\system32\Prefetch32\IBM.bat (User 'SYSTEM')
O4 - .DEFAULT Startup: IBM.lnk = C:\WINDOWS\system32\Prefetch32\IBM.bat (User 'Default user')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} (Get_ActiveX Control) - https://h17000.www1.hp.com/ewfrf-JAV...oadManager.ocx
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe
O23 - Service: Google Desktop Manager 5.5.709.30344 (GoogleDesktopManager-093007-112848) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: BitDefender Desktop Update Service (LIVESRV) - SOFTWIN S.R.L. - C:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - SOFTWIN S.R.L. - C:\Program Files\Softwin\BitDefender10\vsserv.exe
O23 - Service: BitDefender Communicator (XCOMM) - SOFTWIN S.R.L - C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe

--
End of file - 5551 bytes

-- Files created between 2007-11-28 and 2007-12-28 -----------------------------

2007-12-28 02:54:17 348160 --a------ C:\WINDOWS\system32\jkhhe.exe
2007-12-27 14:47:20 0 d-------- C:\Documents and Settings\Home\Application Data\TrojanHunter
2007-12-27 14:09:40 81984 --a------ C:\WINDOWS\system32\mnvcpjpg.dll
2007-12-27 14:09:35 90176 --a------ C:\WINDOWS\system32\ymdgkwan.dll
2007-12-27 13:52:56 0 d-------- C:\Program Files\TrojanHunter 5.0
2007-12-27 13:33:36 6708 --ahs---- C:\WINDOWS\system32\ehhkj.ini2
2007-12-27 13:33:33 344576 -----n--- C:\WINDOWS\system32\jkhhe.dll
2007-12-27 12:08:25 35840 --a------ C:\WINDOWS\winshow .exe <Not Verified; ; winshow>
2007-12-27 11:38:28 0 d-------- C:\VundoFix Backups
2007-12-27 01:22:23 44928 --a------ C:\WINDOWS\system32\drivers\SDTHOOK.SYS <Not Verified; Panda Software; Panda® Antivirus>
2007-12-27 00:38:03 0 d-------- C:\Program Files\Trend Micro
2007-12-27 00:20:51 0 d-------- C:\Documents and Settings\Home\Application Data\Bitdefender
2007-12-27 00:07:13 81984 --a------ C:\WINDOWS\system32\bdod.bin
2007-12-27 00:02:05 0 d-------- C:\Documents and Settings\All Users\Application Data\BitDefender
2007-12-26 23:47:08 0 d-------- C:\Program Files\WinAble
2007-12-26 23:47:08 0 d-------- C:\Program Files\Temporary
2007-12-26 23:13:08 2 --a------ C:\WINDOWS\system32\wtssvtr.exe
2007-12-26 23:13:07 0 d-------- C:\WINDOWS\?dobe
2007-12-26 23:12:56 0 d-------- C:\WINDOWS\system32\?icrosoft.NET
2007-12-26 23:12:15 39936 -----n--- C:\WINDOWS\system32\mljjkhg.dll
2007-12-26 23:12:08 80640 --a------ C:\WINDOWS\system32\drivers\core.sys
2007-12-26 23:12:07 0 d-------- C:\Program Files\Web Buying
2007-12-26 23:12:06 0 d-------- C:\WINDOWS\system32\to9
2007-12-26 23:12:06 0 d-------- C:\WINDOWS\system32\dj2
2007-12-26 23:12:06 0 d-------- C:\WINDOWS\system32\bbc9
2007-12-26 23:12:06 0 d-------- C:\WINDOWS\system32\b1
2007-12-26 23:12:02 0 d-------- C:\WINDOWS\system32\ardCo02
2007-12-26 23:12:02 0 d-------- C:\Temp
2007-12-25 12:12:14 0 d-------- C:\Documents and Settings\All Users\Application Data\ATI
2007-12-25 12:07:51 0 d-------- C:\WINDOWS\LastGood(2)
2007-12-25 10:10:22 552 --a------ C:\WINDOWS\system32\d3d8caps.dat
2007-12-25 03:55:00 53760 --a------ C:\WINDOWS\b122.exe
2007-12-24 12:30:00 0 d-------- C:\Documents and Settings\Home\Application Data\acccore
2007-12-24 12:29:57 0 d-------- C:\Documents and Settings\All Users\Application Data\AOL OCP
2007-12-24 12:29:45 0 d-------- C:\Documents and Settings\All Users\Application Data\AOL
2007-12-24 12:29:30 0 d-------- C:\Program Files\Common Files\Nullsoft
2007-12-24 12:29:14 0 d-------- C:\Program Files\Common Files\AOL
2007-12-24 12:29:08 0 d-------- C:\Program Files\AIM6
2007-12-24 12:27:36 0 d-------- C:\Documents and Settings\All Users\Application Data\AOL Downloads
2007-12-23 10:59:57 5767168 --a------ C:\Documents and Settings\Home\ntuser.dat
2007-12-21 14:23:33 0 d-------- C:\Program Files\Microsoft Silverlight
2007-12-19 22:38:31 0 d-------- C:\Program Files\MagicISO
2007-12-19 21:03:24 0 d-------- C:\Program Files\epsxe
2007-12-17 04:41:51 0 d-------- C:\Program Files\Majorem
2007-12-10 18:44:19 967 --a------ C:\WINDOWS\ScUnin.pif
2007-12-10 18:44:19 94208 --a------ C:\WINDOWS\ScUnin.exe <Not Verified; Blizzard Entertainment; Starcraft Uninstaller>
2007-12-10 18:44:19 35190 --a------ C:\WINDOWS\scunin.dat
2007-12-10 18:43:36 0 d-------- C:\Program Files\Starcraft
2007-12-09 19:43:37 6338 --a------ C:\WINDOWS\scedunin.dat
2007-12-09 19:43:35 967 --a------ C:\WINDOWS\ScEdUnin.pif
2007-12-09 19:43:34 68608 --a------ C:\WINDOWS\ScEdUnin.exe <Not Verified; Blizzard Entertainment; Starcraft Uninstaller>
2007-12-09 19:43:34 0 d-------- C:\Program Files\Starcraft Shareware(ED)
2007-12-03 18:33:18 802816 --a------ C:\WINDOWS\system32\divx_xx11.dll <Not Verified; DivX, Inc.; DivX?>
2007-12-03 18:33:18 823296 --a------ C:\WINDOWS\system32\divx_xx0c.dll <Not Verified; DivX, Inc.; DivX®>
2007-12-03 18:33:18 823296 --a------ C:\WINDOWS\system32\divx_xx07.dll <Not Verified; DivX, Inc.; DivX®>
2007-12-03 18:33:16 682496 --a------ C:\WINDOWS\system32\DivX.dll <Not Verified; DivX, Inc.; DivX®>
2007-12-03 13:20:35 0 d-------- C:\Program Files\Electronic Arts
2007-11-30 12:00:57 0 d-------- C:\Program Files\Network Stumbler
2007-11-30 08:20:30 0 d-------- C:\Program Files\Common Files\xing shared
2007-11-29 15:30:28 3596288 --a------ C:\WINDOWS\system32\qt-dx331.dll
2007-11-29 15:28:24 196608 --a------ C:\WINDOWS\system32\dtu100.dll <Not Verified; DivX, Inc.; DivX, Inc. dtu100>
2007-11-29 15:28:24 81920 --a------ C:\WINDOWS\system32\dpl100.dll <Not Verified; DivX, Inc.; DivX, Inc. dpl100>
2007-11-28 14:52:32 12288 --a------ C:\WINDOWS\system32\DivXWMPExtType.dll


-- Find3M Report ---------------------------------------------------------------

2007-12-28 03:11:23 0 d-------- C:\Program Files\Steam
2007-12-28 02:41:48 0 d-------- C:\Program Files\Warcraft III
2007-12-27 12:10:56 0 d-------- C:\Documents and Settings\Home\Application Data\Skype
2007-12-27 01:52:01 0 d-------- C:\Program Files\Google
2007-12-27 01:48:19 0 d-------- C:\Program Files\Common Files\LightScribe
2007-12-27 00:28:28 0 d-------- C:\Program Files\WinAce
2007-12-27 00:13:39 0 d-------- C:\Program Files\Save
2007-12-27 00:13:30 0 d-------- C:\Program Files\QuickTime
2007-12-27 00:13:14 0 d-------- C:\Program Files\Messenger
2007-12-27 00:12:27 0 d-------- C:\Program Files\Common Files
2007-12-27 00:11:39 0 d-------- C:\Program Files\AIM
2007-12-26 23:42:39 0 d-------- C:\Program Files\CONEXANT
2007-12-26 23:40:21 0 d-------- C:\Program Files\Gran Paradiso
2007-12-26 23:40:07 0 d-------- C:\Program Files\GameSpy Arcade
2007-12-26 23:38:56 0 d-------- C:\Program Files\Real
2007-12-25 12:12:00 0 d-------- C:\Program Files\ATI Technologies
2007-12-24 12:28:35 335 --a------ C:\WINDOWS\nsreg.dat
2007-12-24 12:28:35 0 d-------- C:\Documents and Settings\Home\Application Data\Mozilla
2007-12-22 19:31:13 0 d-------- C:\Documents and Settings\Home\Application Data\DivX
2007-12-22 17:35:32 0 d-------- C:\Documents and Settings\Home\Application Data\Azureus
2007-12-19 08:08:18 0 d-------- C:\Documents and Settings\Home\Application Data\Adobe
2007-12-17 03:01:29 0 d-------- C:\Program Files\World of Warcraft
2007-12-16 17:08:14 0 d-------- C:\Documents and Settings\Home\Application Data\Aim
2007-12-12 09:18:20 0 d-------- C:\Program Files\DivX
2007-12-08 23:05:38 0 d-------- C:\Program Files\Azureus
2007-12-04 19:55:20 122880 --a------ C:\WINDOWS\system32\ati2evxx(4).dll <Not Verified; ATI Technologies Inc.; ATI External Event Utility for Windows>
2007-12-04 19:55:20 122880 --a------ C:\WINDOWS\system32\ati2evxx(3).dll <Not Verified; ATI Technologies Inc.; ATI External Event Utility for Windows>
2007-12-04 19:33:27 887724 --a------ C:\WINDOWS\system32\ativva6x.dat
2007-11-30 08:20:15 0 d-------- C:\Program Files\Common Files\Real
2007-11-06 07:19:00 158080 --a------ C:\WINDOWS\system32\atiicdxx.dat
2007-11-04 20:02:54 0 d-------- C:\Program Files\Yahoo!
2007-11-01 21:00:43 122880 --a------ C:\WINDOWS\system32\ati2evxx(2).dll <Not Verified; ATI Technologies Inc.; ATI External Event Utility for Windows>
2007-10-28 15:32:57 0 d-------- C:\Program Files\Alcohol Soft


-- Registry Dump ---------------------------------------------------------------

*Note* empty entries & legit default entries are not shown


[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{2D5796A2-44E0-4E50-A5A0-80BF1EE3EA73}]
12/26/2007 11:12 PM 39936 --------- C:\WINDOWS\system32\mljjkhg.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{3B283E7E-1499-46C5-B0D2-75438156DDFC}]
12/27/2007 01:33 PM 344576 --------- C:\WINDOWS\system32\jkhhe.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{4E35B657-BE29-42BD-B69E-9F680FF88C95}]
C:\WINDOWS\system32\mllji.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6d6e17b4-2106-4984-831e-3ea042f915b7}]
12/27/2007 02:09 PM 81984 --a------ C:\WINDOWS\system32\mnvcpjpg.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{702D7173-00A5-481C-9D32-7DB2565F265E}]
C:\Program Files\Messenger\sagejyt83122.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"THGuard"="C:\Program Files\TrojanHunter 5.0\THGuard .exe" [12/28/2007 03:34 AM]
"041fb4d4"="C:\WINDOWS\system32\ymdgkwan.dll" [12/27/2007 02:09 PM]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoRemoteRecursiveEvents"=1 (0x1)
"NoWindowsUpdate"=1 (0x1)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoRecentDocsHistory"=1 (0x1)
"NoRecentDocsMenu"=1 (0x1)
"ForceClassicControlPanel"=1 (0x1)
"NoSaveSettings"=0 (0x0)
"NoWindowsUpdate"=1 (0x1)

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoRecentDocsHistory"=1 (0x1)
"NoRecentDocsMenu"=1 (0x1)
"ForceClassicControlPanel"=1 (0x1)
"NoSaveSettings"=0 (0x0)

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{2D5796A2-44E0-4E50-A5A0-80BF1EE3EA73}"= C:\WINDOWS\system32\mljjkhg.dll [12/26/2007 11:12 PM 39936]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"appinit_dlls"=sockspy.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
"Authentication Packages"= msv1_0 C:\WINDOWS\system32\jkhhe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Home^Start Menu^Programs^Startup^Yahoo! Widget Engine.lnk]
path=C:\Documents and Settings\Home\Start Menu\Programs\Startup\Yahoo! Widget Engine.lnk
backup=C:\WINDOWS\pss\Yahoo! Widget Engine.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
"C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AIM]
C:\Program Files\AIM\aim.exe -cnetwait.odl

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATIPTA]
"C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BDAgent]
"C:\Program Files\Softwin\BitDefender10\bdagent.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BDMCon]
"C:\Program Files\Softwin\BitDefender10\bdmcon.exe" /reg

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\eabconfg.cpl]
C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe /Start

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Desktop Search]
"C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\hpWirelessAssistant]
C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Load]
C:\WINDOWS\system32\jkhhe.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Mouse Suite 98 Daemon]
ICO.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
"C:\Program Files\QuickTime\qttask .exe" -atboottime

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
"C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StartCCC]
"C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
"C:\Program Files\Steam\Steam.exe" -silent

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
"C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
"C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Tray Temperature]
C:\DOCUME~1\Home\LOCALS~1\Temp\MiniBug.exe 1

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WhenUSave]
"C:\Program Files\Save\Save.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinAble]
C:\Program Files\WinAble\winable.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\winshow]
"C:\WINDOWS\winshow .exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"Viewpoint Manager Service"=2 (0x2)
"OneStep Search Service"=2 (0x2)




-- End of Deckard's System Scanner: finished at 2007-12-28 03:36:45 ------------

[Ried]

Of the various infections you have onboard, one of them is a variant of Vundo that has infected legit startup programs. This is going to take a few rounds to clean properly.

Please copy this page to Notepad and save to your desktop for reference as you will not have any browsers open while you are carrying out portions of these instructions.

It's IMPORTANT to carry out the instructions in the sequence listed below.

***************************************************

Download RenV.exe to your desktop. Do not run it yet.

-------------

Download Combofix from any of the links below, and save it to your desktop.

Link 1
Link 2
Link 3

**Note: It is important that it is saved directly to your desktop**

--------------------------------------------------------------------

1. Disconnect from the internet.

2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

--------------------------------------------------------------------

Double click on ComboFix.exe & follow the prompts.

• When finished, it will produce a report for you.
• Please post the C:\ComboFix.txt along with a new HijackThis log so we can continue cleaning the system.

Note:
Do not mouseclick combofix's window while it's running. That may cause it to stall

--------------------------------------------------------------------

Double click RenV.exe to run it.

Post the contents of the Log.txt here, along with the C:\ComboFix.txt

[flyjum]

ok here are the logs

ComboFix 07-12-29.5 - Home 2007-12-29 2:39:24.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1005 [GMT -7:00]
Running from: C:\Documents and Settings\Home\Desktop\ComboFix.exe
* Created a new restore point
.
The following files were disabled during the run:
C:\WINDOWS\system32\sockspy.dll


((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Program Files\Temporary
C:\Program Files\TrojanHunter 5.0\THGuard .exe
C:\Program Files\web buying
C:\Program Files\WinAble
C:\Program Files\WinAble\winable .exe
C:\Temp\1cb
C:\Temp\1cb\syscheck.log
C:\temp\tn3
C:\WINDOWS\b122.exe
C:\WINDOWS\dobe~1
C:\WINDOWS\system32\b1
C:\WINDOWS\system32\drivers\core.cache.dsk
C:\WINDOWS\system32\drivers\core.sys
C:\WINDOWS\system32\ehhkj.ini
C:\WINDOWS\system32\ehhkj.ini2
C:\WINDOWS\system32\icroso~1.net
C:\WINDOWS\system32\jkhhe.dll
C:\WINDOWS\system32\jkhhe.exe
C:\WINDOWS\system32\mljjkhg.dll
C:\WINDOWS\system32\mnvcpjpg.dll
C:\WINDOWS\system32\nawkgdmy.ini
C:\WINDOWS\system32\pac.txt
C:\WINDOWS\system32\wtssvtr.exe
C:\WINDOWS\system32\ymdgkwan.dll

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.
-------\LEGACY_CORE
-------\LEGACY_DOMAINSERVICE
-------\core


((((((((((((((((((((((((( Files Created from 2007-11-28 to 2007-12-29 )))))))))))))))))))))))))))))))
.

2007-12-27 14:47 . 2007-12-27 14:47 <DIR> d-------- C:\Documents and Settings\Home\Application Data\TrojanHunter
2007-12-27 13:52 . 2007-12-29 02:43 <DIR> d-------- C:\Program Files\TrojanHunter 5.0
2007-12-27 12:08 . 2007-12-27 12:08 35,840 --a------ C:\WINDOWS\winshow .exe
2007-12-27 11:38 . 2007-12-27 13:28 <DIR> d-------- C:\VundoFix Backups
2007-12-27 10:56 . 2007-12-27 10:56 348,160 --a------ C:\WINDOWS\system32\RCX4.tmp
2007-12-27 01:22 . 2007-06-05 10:56 44,928 --a------ C:\WINDOWS\system32\drivers\SDTHOOK.SYS
2007-12-27 01:14 . 2007-12-27 01:14 <DIR> d-------- C:\Deckard
2007-12-27 01:00 . 2007-12-27 01:09 2,550 --a------ C:\WINDOWS\system32\Uninstall.ico
2007-12-27 01:00 . 2007-12-27 01:09 1,406 --a------ C:\WINDOWS\system32\Help.ico
2007-12-27 00:38 . 2007-12-27 00:38 <DIR> d-------- C:\Program Files\Trend Micro
2007-12-27 00:20 . 2007-12-27 00:20 <DIR> d-------- C:\Documents and Settings\Home\Application Data\Bitdefender
2007-12-27 00:07 . 2007-12-29 02:44 81,984 --a------ C:\WINDOWS\system32\bdod.bin
2007-12-27 00:02 . 2007-12-27 00:02 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\BitDefender
2007-12-26 23:23 . 2007-12-26 23:23 348,160 --a------ C:\WINDOWS\system32\RCX19.tmp
2007-12-26 23:12 . 2007-12-27 00:11 <DIR> d-------- C:\WINDOWS\system32\to9
2007-12-26 23:12 . 2007-12-27 00:09 <DIR> d-------- C:\WINDOWS\system32\dj2
2007-12-26 23:12 . 2007-12-26 23:22 <DIR> d-------- C:\WINDOWS\system32\bbc9
2007-12-26 23:12 . 2007-12-27 02:02 <DIR> d-------- C:\WINDOWS\system32\ardCo02
2007-12-26 23:12 . 2007-12-26 23:12 <DIR> d-------- C:\Temp\cEeer12
2007-12-26 23:12 . 2007-12-29 02:43 <DIR> d-------- C:\Temp
2007-12-26 23:12 . 2007-12-26 23:47 389,120 --a------ C:\WINDOWS\mrofinu77.exe.tmp
2007-12-25 12:12 . 2007-12-25 12:12 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\ATI
2007-12-25 12:07 . 2007-12-25 12:10 <DIR> d-------- C:\WINDOWS\LastGood(2)
2007-12-25 10:10 . 2007-12-25 10:10 552 --a------ C:\WINDOWS\system32\d3d8caps.dat
2007-12-24 12:30 . 2007-12-24 12:30 <DIR> d-------- C:\Documents and Settings\Home\Application Data\acccore
2007-12-24 12:29 . 2007-12-24 12:29 <DIR> d-------- C:\Program Files\Common Files\Nullsoft
2007-12-24 12:29 . 2007-12-25 12:13 <DIR> d-------- C:\Program Files\Common Files\AOL
2007-12-24 12:29 . 2007-12-25 12:13 <DIR> d-------- C:\Program Files\AIM6
2007-12-24 12:29 . 2007-12-24 12:29 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\AOL OCP
2007-12-24 12:29 . 2007-12-24 12:29 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\AOL
2007-12-24 12:27 . 2007-12-25 12:13 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\AOL Downloads
2007-12-21 14:23 . 2007-12-21 14:23 <DIR> d-------- C:\Program Files\Microsoft Silverlight
2007-12-19 22:38 . 2007-12-19 22:38 <DIR> d-------- C:\Program Files\MagicISO
2007-12-19 21:03 . 2007-12-19 21:42 <DIR> d-------- C:\Program Files\epsxe
2007-12-17 04:41 . 2007-12-17 04:41 <DIR> d-------- C:\Program Files\Majorem
2007-12-11 15:34 . 2007-12-11 15:34 1,044,480 --a------ C:\WINDOWS\system32\libdivx.dll
2007-12-11 15:34 . 2007-12-11 15:34 200,704 --a------ C:\WINDOWS\system32\ssldivx.dll
2007-12-10 18:44 . 2007-12-10 18:46 94,208 --a------ C:\WINDOWS\ScUnin.exe
2007-12-10 18:44 . 2007-12-10 18:46 35,190 --a------ C:\WINDOWS\scunin.dat
2007-12-10 18:44 . 2007-12-10 18:46 967 --a------ C:\WINDOWS\ScUnin.pif
2007-12-10 18:43 . 2007-12-10 21:08 <DIR> d-------- C:\Program Files\Starcraft
2007-12-09 19:43 . 2007-12-09 20:16 <DIR> d-------- C:\Program Files\Starcraft Shareware(ED)
2007-12-09 19:43 . 2007-12-09 19:43 68,608 --a------ C:\WINDOWS\ScEdUnin.exe
2007-12-09 19:43 . 2007-12-09 19:43 6,338 --a------ C:\WINDOWS\scedunin.dat
2007-12-09 19:43 . 2007-12-09 19:43 967 --a------ C:\WINDOWS\ScEdUnin.pif
2007-12-04 19:55 . 2007-12-04 19:55 122,880 --a------ C:\WINDOWS\system32\SET4D.tmp
2007-12-04 19:55 . 2007-12-04 19:55 122,880 --a------ C:\WINDOWS\system32\SET2D.tmp
2007-12-03 18:33 . 2007-12-03 18:33 823,296 --a------ C:\WINDOWS\system32\divx_xx0c.dll
2007-12-03 18:33 . 2007-12-03 18:33 823,296 --a------ C:\WINDOWS\system32\divx_xx07.dll
2007-12-03 18:33 . 2007-12-03 18:33 802,816 --a------ C:\WINDOWS\system32\divx_xx11.dll
2007-12-03 18:33 . 2007-12-03 18:33 682,496 --a------ C:\WINDOWS\system32\DivX.dll
2007-12-03 18:33 . 2007-12-03 18:33 630,784 --a------ C:\WINDOWS\system32\divxdec.ax
2007-12-03 13:25 . 2007-07-19 18:14 3,727,720 --a------ C:\WINDOWS\system32\d3dx9_35.dll
2007-12-03 13:25 . 2007-05-16 16:45 3,497,832 --a------ C:\WINDOWS\system32\d3dx9_34.dll
2007-12-03 13:25 . 2007-07-19 18:14 1,358,192 --a------ C:\WINDOWS\system32\D3DCompiler_35.dll
2007-12-03 13:25 . 2007-05-16 16:45 1,124,720 --a------ C:\WINDOWS\system32\D3DCompiler_34.dll
2007-12-03 13:25 . 2007-07-19 18:14 444,776 --a------ C:\WINDOWS\system32\d3dx10_35.dll
2007-12-03 13:25 . 2007-05-16 16:45 443,752 --a------ C:\WINDOWS\system32\d3dx10_34.dll
2007-12-03 13:25 . 2007-04-04 18:53 81,768 --a------ C:\WINDOWS\system32\xinput1_3.dll
2007-12-03 13:20 . 2007-12-26 23:37 <DIR> d-------- C:\Program Files\Electronic Arts
2007-11-30 15:50 . 2004-08-03 23:08 31,616 --a------ C:\WINDOWS\system32\drivers\usbccgp.sys
2007-11-30 12:00 . 2007-11-30 12:00 <DIR> d-------- C:\Program Files\Network Stumbler
2007-11-30 08:20 . 2007-11-30 08:20 <DIR> d-------- C:\Program Files\Common Files\xing shared
2007-11-29 15:30 . 2007-11-29 15:30 3,596,288 --a------ C:\WINDOWS\system32\qt-dx331.dll
2007-11-29 15:30 . 2007-11-29 15:30 524,288 --a------ C:\WINDOWS\system32\DivXsm.exe
2007-11-29 15:30 . 2007-11-29 15:30 4,816 --a------ C:\WINDOWS\system32\divxsm.tlb
2007-11-29 15:28 . 2007-11-29 15:28 196,608 --a------ C:\WINDOWS\system32\dtu100.dll
2007-11-29 15:28 . 2007-11-29 15:28 81,920 --a------ C:\WINDOWS\system32\dpl100.dll
2007-11-29 15:28 . 2007-11-29 15:28 416 --a------ C:\WINDOWS\system32\dtu100.dll.manifest
2007-11-29 15:28 . 2007-11-29 15:28 416 --a------ C:\WINDOWS\system32\dpl100.dll.manifest

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-12-29 05:38 --------- d-----w C:\Program Files\Warcraft III
2007-12-29 04:42 --------- d-----w C:\Documents and Settings\Home\Application Data\Skype
2007-12-28 10:11 --------- d-----w C:\Program Files\Steam
2007-12-27 08:52 --------- d-----w C:\Program Files\Google
2007-12-27 08:48 --------- d-----w C:\Program Files\Common Files\LightScribe
2007-12-27 07:28 --------- d-----w C:\Program Files\WinAce
2007-12-27 07:13 --------- d-----w C:\Program Files\Save
2007-12-27 07:13 --------- d-----w C:\Program Files\QuickTime
2007-12-27 07:11 --------- d-----w C:\Program Files\AIM
2007-12-27 06:42 --------- d-----w C:\Program Files\CONEXANT
2007-12-27 06:40 --------- d-----w C:\Program Files\Gran Paradiso
2007-12-27 06:40 --------- d-----w C:\Program Files\GameSpy Arcade
2007-12-27 06:38 --------- d-----w C:\Program Files\Real
2007-12-25 19:12 --------- d-----w C:\Program Files\ATI Technologies
2007-12-23 02:31 --------- d-----w C:\Documents and Settings\Home\Application Data\DivX
2007-12-23 00:35 --------- d-----w C:\Documents and Settings\Home\Application Data\Azureus
2007-12-17 10:01 --------- d-----w C:\Program Files\World of Warcraft
2007-12-17 00:08 --------- d-----w C:\Documents and Settings\Home\Application Data\Aim
2007-12-12 16:18 --------- d-----w C:\Program Files\DivX
2007-12-09 06:05 --------- d-----w C:\Program Files\Azureus
2007-11-30 15:20 --------- d-----w C:\Program Files\Common Files\Real
2007-11-05 03:02 --------- d-----w C:\Program Files\Yahoo!
2007-10-28 22:32 223,128 ----a-w C:\WINDOWS\system32\drivers\vaxscsi.sys
2007-10-28 22:32 --------- d-----w C:\Program Files\Alcohol Soft
2007-10-28 22:31 96,256 ----a-w C:\WINDOWS\system32\drivers\sptd7549.sys
2007-10-28 22:31 643,072 ----a-w C:\WINDOWS\system32\drivers\sptd.sys
2007-10-28 20:59 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2006-05-21 03:04 77,824 --sha-r C:\WINDOWS\Prefetch\10544\webblock.dll
2006-09-27 18:03 37,658 --sha-r C:\WINDOWS\system32\Prefetch32\desktop.reg
2006-09-27 04:22 1,452 --sha-r C:\WINDOWS\system32\Prefetch32\disable-au-bt.reg
2006-10-09 14:32 199 --sha-r C:\WINDOWS\system32\Prefetch32\IBM.bat
2006-10-10 03:59 172 --sha-r C:\WINDOWS\system32\Prefetch32\IBMdel.bat
2006-09-17 18:37 559,093 --sha-r C:\WINDOWS\system32\Prefetch32\requiredWSB.exe
2006-10-13 06:01 2,724 --sha-r C:\WINDOWS\system32\Prefetch32\RunDLL.bat
2006-09-27 04:46 907 --sha-r C:\WINDOWS\system32\Prefetch32\sites.bat
2006-09-17 19:50 272 --sha-r C:\WINDOWS\system32\Prefetch32\uninstallremove.reg
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{4E35B657-BE29-42BD-B69E-9F680FF88C95}]
C:\WINDOWS\system32\mllji.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{702D7173-00A5-481C-9D32-7DB2565F265E}]
C:\Program Files\Messenger\sagejyt83122.dll

C:\WINDOWS\system32\config\systemprofile\Start Menu\Programs\Startup\
IBM.lnk - C:\WINDOWS\system32\Prefetch32\IBM.bat [2006-10-09 07:32:38]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoRecentDocsHistory"= 1 (0x1)
"NoRecentDocsMenu"= 1 (0x1)
"ForceClassicControlPanel"= 1 (0x1)

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoRecentDocsHistory"= 1 (0x1)
"NoRecentDocsMenu"= 1 (0x1)
"ForceClassicControlPanel"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=sockspy.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Home^Start Menu^Programs^Startup^Yahoo! Widget Engine.lnk]
path=C:\Documents and Settings\Home\Start Menu\Programs\Startup\Yahoo! Widget Engine.lnk
backup=C:\WINDOWS\pss\Yahoo! Widget Engine.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2007-12-27 11:58 389120 --a------ C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AIM]
C:\Program Files\AIM\aim.exe -cnetwait.odl

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATIPTA]
2007-12-27 12:09 762880 --a------ C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BDAgent]
2007-12-27 11:58 441344 --a------ C:\Program Files\Softwin\BitDefender10\bdagent.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BDMCon]
C:\Program Files\Softwin\BitDefender10\bdmcon.exe /reg

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\eabconfg.cpl]
C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe /Start

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Desktop Search]
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe /startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\hpWirelessAssistant]
C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Load]
C:\WINDOWS\system32\jkhhe.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Mouse Suite 98 Daemon]
ICO.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
C:\Program Files\QuickTime\qttask .exe -atboottime

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
C:\Program Files\Skype\Phone\Skype.exe /nosplash /minimized

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StartCCC]
2007-12-27 12:09 486400 --a------ C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
C:\Program Files\Steam\Steam.exe -silent

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2007-12-27 11:58 484864 --a------ C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
C:\Program Files\Common Files\Real\Update_OB\realsched.exe -osboot

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Tray Temperature]
C:\DOCUME~1\Home\LOCALS~1\Temp\MiniBug.exe 1

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WhenUSave]
C:\Program Files\Save\Save.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinAble]
C:\Program Files\WinAble\winable.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\winshow]
2007-12-27 12:08 35840 --a------ C:\WINDOWS\winshow .exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"Viewpoint Manager Service"=2 (0x2)
"OneStep Search Service"=2 (0x2)

S3 GoogleDesktopManager-093007-112848;Google Desktop Manager 5.5.709.30344;"C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" [2007-12-27 12:09]
S3 NSNDIS5;NSNDIS5 NDIS Protocol Driver;C:\WINDOWS\system32\NSNDIS5.SYS [2004-03-23 19:12]

.
**************************************************************************

catchme 0.3.1333 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-12-29 02:45:58
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

PROCESS: C:\WINDOWS\system32\winlogon.exe
-> C:\WINDOWS\system32\sockspy.dll

PROCESS: C:\WINDOWS\system32\lsass.exe [5.01.2600.2180]
-> C:\WINDOWS\system32\sockspy.dll

PROCESS: C:\WINDOWS\Explorer.EXE [6.00.2900.2180]
-> C:\WINDOWS\system32\sockspy.dll
.
Completion time: 2007-12-29 2:47:17 - machine was rebooted

Ran on 2007-12-29 -  2:49:09.37

----a-w           144,896 2007-12-27 20:33:33  C:\Documents and Settings\Home\Desktop\msconfig .exe
----a-w            39,792 2007-12-27 19:08:33  C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl .exe
----a-w            61,440 2007-12-27 06:50:37  C:\Program Files\AIM\aim .exe
----a-w           344,064 2007-12-27 19:08:33  C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx .exe
----a-w            90,112 2007-12-27 19:08:26  C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart .exe
----a-w           185,896 2007-12-27 06:50:32  C:\Program Files\Common Files\Real\Update_OB\realsched .exe
----a-w            29,744 2007-12-27 19:08:27  C:\Program Files\Google\Google Desktop Search\GoogleDesktop .exe
----a-w            68,856 2007-12-27 06:50:36  C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier .exe
----a-w           507,904 2007-12-27 06:50:33  C:\Program Files\HPQ\HP Wireless Assistant\HP Wireless Assistant .exe
----a-w           405,504 2007-12-27 19:08:32  C:\Program Files\HPQ\Quick Launch Buttons\EabServr .exe
----a-w           132,496 2007-12-27 19:08:27  C:\Program Files\Java\jre1.6.0_03\bin\jusched .exe
----a-w        22,880,040 2007-12-29 02:28:24  C:\Program Files\Skype\Phone\Skype .exe
----a-w            69,632 2007-12-27 19:08:33  C:\Program Files\Softwin\BitDefender10\bdagent .exe
----a-w           290,816 2007-12-27 19:08:32  C:\Program Files\Softwin\BitDefender10\bdmcon .exe
----a-w         1,266,936 2007-12-28 09:56:20  C:\Program Files\Steam\Steam .exe
----a-w         1,399,808 2007-12-29 09:05:20  C:\Program Files\TrojanHunter 5.0\THGuard   .exe
----a-w         1,399,808 2007-12-28 20:29:37  C:\Program Files\TrojanHunter 5.0\THGuard  .exe
----a-w         1,399,808 2007-12-28 10:33:32  C:\Program Files\TrojanHunter 5.0\THGuard .exe
----a-w            35,840 2007-12-27 19:08:25  C:\WINDOWS\winshow    .exe
----a-w           158,208 2007-12-27 18:28:10  C:\WINDOWS\pchealth\helpctr\binaries\MSConfig .exe

 Entries:               20  (20)
 Directories:            0  Files:            20
 Bytes:         30,911,600  Blocks:       60,378

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 02:53, on 2007-12-29
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe
C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe
C:\Program Files\Softwin\BitDefender10\vsserv.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: (no name) - {4E35B657-BE29-42BD-B69E-9F680FF88C95} - C:\WINDOWS\system32\mllji.dll (file missing)
O2 - BHO: (no name) - {702D7173-00A5-481C-9D32-7DB2565F265E} - C:\Program Files\Messenger\sagejyt83122.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O2 - BHO: WebBlock Class - {C6B08E8D-3F9A-4710-9F38-E4BF827C6AC2} - C:\WINDOWS\Prefetch\10544\webblock.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKUS\S-1-5-19\..\RunOnce: [FirstLogon] C:\windows\system32\prefetch32\Rundll.bat (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [FirstLogon] C:\windows\system32\prefetch32\Rundll.bat (User 'NETWORK SERVICE')
O4 - S-1-5-18 Startup: IBM.lnk = C:\WINDOWS\system32\Prefetch32\IBM.bat (User 'SYSTEM')
O4 - .DEFAULT Startup: IBM.lnk = C:\WINDOWS\system32\Prefetch32\IBM.bat (User 'Default user')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} (Get_ActiveX Control) - https://h17000.www1.hp.com/ewfrf-JAV...oadManager.ocx
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe
O23 - Service: Google Desktop Manager 5.5.709.30344 (GoogleDesktopManager-093007-112848) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: BitDefender Desktop Update Service (LIVESRV) - SOFTWIN S.R.L. - C:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - SOFTWIN S.R.L. - C:\Program Files\Softwin\BitDefender10\vsserv.exe
O23 - Service: BitDefender Communicator (XCOMM) - SOFTWIN S.R.L - C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe

--
End of file - 4923 bytes

[Ried]

Hi flyjum,

Please read through these instructions completely and if you have any questions, ask them before proceeding.

Please copy this page to Notepad and save to your desktop for reference as you will not have any browsers open while you are carrying out portions of these instructions.

It's IMPORTANT to carry out the instructions in the sequence listed below.

***************************************************

1. Close any open browsers.

2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

---------------------------------------------------------------------



Refering to the picture above, drag Log.txt into RenV.exe

When finished, it shall produce a new log for you. Post that log in your next reply.

-------------------------------------------------------------

Open notepad and copy/paste the text in the code box below into it:

File::
C:\WINDOWS\system32\RCX4.tmp
C:\WINDOWS\system32\RCX19.tmp
C:\WINDOWS\mrofinu77.exe.tmp
C:\WINDOWS\winshow .exe 
C:\WINDOWS\b122.exe

Folder::
C:\WINDOWS\system32\to9
C:\WINDOWS\system32\dj2
C:\WINDOWS\system32\bbc9
C:\WINDOWS\system32\ardCo02
C:\VundoFix Backups
C:\Temp

Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{4E35B657-BE29-42BD-B69E-9F680FF88C95}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{702D7173-00A5-481C-9D32-7DB2565F265E}]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Load]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WhenUSave]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinAble]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\winshow]

Save this as CFScript.txt, in the same location as ComboFix.exe




Refering to the picture above, drag CFScript into ComboFix.exe

When finished, it shall produce a log for you at C:\ComboFix.txt

Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall

--------------------------------------------------------------------

Please run this online scan to search for any remnants. It can take some time, so please be patient and allow it to run it's full course:

Using Internet Explorer, visit http://www.kaspersky.com/service?chapter=161739400

Answer Yes, when prompted to install an ActiveX component.

• The program will then begin downloading the latest definition files.
• Once the files have been downloaded click on NEXT
• Locate the Scan Settings button & configure to:
  • Scan using the following Anti-Virus database:
    • Extended
  • Scan Options:
    • Scan Archives
    • Scan Mail Bases
• Click OK & have it scan My Computer
• Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
  
  
  
  
• Click the Save as Text button to save the file to your desktop so that you may post it in your next reply

* Turn off the real time scanner of any existing antivirus program while performing the online scan

---------------------------------------------------------------

Run a new scan with HijackThis and save the log.

---------------------------------------------------------------

Please include the following in your next reply:

Log.txt
C:\ComboFix.txt
Kaspersky results
New HijackThis log
Update on system behavior

[flyjum]

Ran on 2007-12-29 - 23:40:47.62

 Entries:                0  (0)
 Directories:            0  Files:             0
 Bytes:                  0  Blocks:            0

That is the log for teh first section tho i dont think is it right. What Log.txt are you talking about the renv.exe log? I dont have a log.txt on my desktop.

[Ried]

What you've posted is what I needed to see. Please continue.