samanderson1

Hi guys, I have a couple of days ago had some weird things start happening on my computer and I fear I have a virus / malware / a trojan! I think it happened after I updated windows xp and some of my other programs, which I had not done in a while, or possibly some files on a USB that I got from another pc.

I now can't see any of my hidden files / folders (when I go into folder options and click the show hidden files and folders radio button, when I hit apply, it reverts back to don't show hidden files and folders), the icons of my USB drives have been changed to folder icons, rather than the normal USB icon, and I now get a DNS error (internet explorer cannot display the web page), or certain websites - notedly microsoft and anti-virus related websites. I am now 99% sure I have a virus, because when I transferred some completely different files via the same USB to my other pc (also windows xp), it has now started to show the same symptoms.

I have done a complete scan with SuperAntiSpyware, and it has found nothing. Any help I can get to remove this virus would be greatly appreciated!

My DDS log is as follows:


DDS (Ver_09-03-16.01) - NTFSx86
Run by Samuel at 17:19:35.48 on Fri 17/04/2009
Internet Explorer: 8.0.6001.18702
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.510.96 [GMT 10:00]


============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\CDBurnerXP\NMSAccessU.exe
C:\WINDOWS\system32\tcpsvcs.exe
C:\WINDOWS\System32\snmp.exe
C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\WINDOWS\system32\dns\bin\named.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\mqsvc.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\QuickTime\QTTask.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\WINDOWS\system32\mqtgsvc.exe
C:\WINDOWS\System32\svchost.exe -k HTTPFilter
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\PROGRA~1\MICROS~2\OFFICE11\OUTLOOK.EXE
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
C:\Program Files\Microsoft\Office Live\OfficeLiveSignIn.exe
c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
C:\Documents and Settings\Samuel\My Documents\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.google.com.au/
uInternet Settings,ProxyOverride = *.local
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: ContributeBHO Class: {074c1dc5-9320-4a9a-947d-c042949c6216} - c:\program files\adobe\/Adobe Contribute CS3/contributeieplugin.dll
BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO: SSVHelper Class: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre1.6.0_05\bin\ssv.dll
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
TB: Contribute Toolbar: {517bdde4-e3a7-4570-b21e-2b52b6139fc7} - c:\program files\adobe\/Adobe Contribute CS3/contributeieplugin.dll
EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File
uRun: [CTFMON.EXE] c:\windows\system32\ctfmon.exe
uRun: [msnmsgr] "c:\program files\windows live\messenger\msnmsgr.exe" /background
mRun: [Adobe_ID0EYTHM] c:\progra~1\common~1\adobe\adobev~1\server\bin\VERSIO~2.EXE
mRun: [SunJavaUpdateSched] "c:\program files\java\jre1.6.0_05\bin\jusched.exe"
mRun: [LogitechVideoRepair] c:\program files\logitech\video\ISStart.exe
mRun: [MsmqIntCert] regsvr32 /s mqrt.dll
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE
uPolicies-explorer: NoViewOnDrive = 0 (0x0)
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBC} - c:\program files\java\jre1.6.0_05\bin\ssv.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1231809595655
DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1231810328269
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab
DPF: {F2A84794-EE6D-447B-8C21-3BA1DC77C5B4} - file://e:\controls\sdkinst.cab
TCP: {27F24D43-F0F2-4E2C-8F8C-B736CA10905E} = 127.0.0.1,10.0.0.138
TCP: {B169190E-B38A-4EF0-ACFD-33FB12CA858F} = 127.0.0.1
TCP: {BD8992E0-82D9-4FA5-AEB7-34E6C2D95311} = 127.0.0.1
Notify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SEH: Windows Desktop Search Namespace Manager: {56f9679e-7826-4c84-81f3-532071a8bcc5} - c:\program files\windows desktop search\MSNLNamespaceMgr.dll
SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLL

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\samuel\applic~1\mozilla\firefox\profiles\h4zu9n96.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com.au/

============= SERVICES / DRIVERS ===============

R1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\sasdifsv.sys [2009-3-23 9968]
R1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2009-3-23 72944]
R1 VBoxDrv;VirtualBox Service;c:\windows\system32\drivers\VBoxDrv.sys [2008-8-24 54896]
R1 VBoxUSBMon;VirtualBox USB Monitor Driver;c:\windows\system32\drivers\VBoxUSBMon.sys [2008-8-24 41616]
R2 Iprip;RIP Listener;c:\windows\system32\svchost.exe -k netsvcs [2004-8-4 14336]
R3 SASENUM;SASENUM;c:\program files\superantispyware\SASENUM.SYS [2009-3-23 7408]
S2 rswhtf;Update Boot;c:\windows\system32\svchost.exe -k netsvcs [2004-8-4 14336]
S3 VBoxTAP;VirtualBox TAP Adapter;c:\windows\system32\drivers\VBoxTAP.sys [2008-8-24 47152]
S4 msvsmon80;Visual Studio 2005 Remote Debugger;"c:\program files\microsoft visual studio 8\common7\ide\remote debugger\x86\msvsmon.exe" /service msvsmon80 --> c:\program files\microsoft visual studio 8\common7\ide\remote debugger\x86\msvsmon.exe [?]
S4 zidxsae;zidxsae;\??\c:\windows\system32\01.tmp --> c:\windows\system32\01.tmp [?]

=============== Created Last 30 ================

2009-04-16 10:47 <DIR> --d----- c:\docume~1\alluse~1\applic~1\SUPERAntiSpyware.com
2009-04-16 10:47 <DIR> --d----- c:\program files\SUPERAntiSpyware
2009-04-16 10:47 <DIR> --d----- c:\docume~1\samuel\applic~1\SUPERAntiSpyware.com
2009-04-16 10:46 <DIR> --d----- c:\program files\common files\Wise Installation Wizard
2009-04-16 10:23 <DIR> --d----- c:\program files\Defraggler
2009-04-16 09:52 <DIR> --dsh--- c:\documents and settings\samuel\IECompatCache
2009-04-16 09:48 <DIR> --dsh--- c:\documents and settings\samuel\PrivacIE
2009-04-16 09:45 <DIR> --dsh--- c:\documents and settings\samuel\IETldCache
2009-04-16 09:39 <DIR> -cd-h--- c:\windows\ie8
2009-04-16 09:31 <DIR> --d----- c:\documents and settings\samuel\Tracing
2009-04-16 09:30 <DIR> --d----- c:\program files\Microsoft Office Outlook Connector
2009-04-16 09:29 <DIR> --d----- c:\program files\Windows Live SkyDrive
2009-04-16 09:12 <DIR> --d----- c:\program files\iTunes
2009-04-16 09:12 <DIR> --d----- c:\docume~1\alluse~1\applic~1\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
2009-04-16 00:16 <DIR> --d----- c:\program files\common files\Windows Live
2009-04-15 23:36 <DIR> --d----- c:\windows\system32\XPSViewer
2009-04-15 23:34 89,088 -c------ c:\windows\system32\dllcache\filterpipelineprintproc.dll
2009-04-15 23:34 117,760 -------- c:\windows\system32\prntvpt.dll
2009-04-15 23:34 1,676,288 -c------ c:\windows\system32\dllcache\xpssvcs.dll
2009-04-15 23:34 597,504 -c------ c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2009-04-15 23:34 575,488 -c------ c:\windows\system32\dllcache\xpsshhdr.dll
2009-04-15 23:34 1,676,288 -------- c:\windows\system32\xpssvcs.dll
2009-04-15 23:34 575,488 -------- c:\windows\system32\xpsshhdr.dll
2009-04-15 23:34 <DIR> --d----- C:\6d7796c019316b7a5f182114a7de
2009-04-15 23:18 <DIR> --d----- c:\program files\Microsoft
2009-04-15 23:15 <DIR> --d----- c:\program files\MSXML 6.0
2009-04-15 23:02 <DIR> --d----- c:\docume~1\samuel\applic~1\Windows Desktop Search
2009-04-15 23:00 <DIR> --d----- c:\windows\system32\GroupPolicy
2009-04-15 23:00 <DIR> --d----- c:\program files\Windows Desktop Search
2009-04-15 22:08 <DIR> --d----- c:\windows\system32\URTTEMP
2009-04-15 21:11 272,128 -c------ c:\windows\system32\dllcache\bthport.sys
2009-04-15 15:01 <DIR> --d----- c:\windows\system32\CatRoot_bak
2009-04-15 14:54 <DIR> --d----- c:\windows\system32\PreInstall
2009-04-15 14:54 <DIR> --d-h--- c:\windows\$hf_mig$
2009-04-15 14:14 268,648 a------- c:\windows\system32\mucltui.dll
2009-04-15 14:14 27,496 a------- c:\windows\system32\mucltui.dll.mui
2009-04-15 14:07 <DIR> --d----- c:\windows\system32\dns
2009-04-15 12:48 <DIR> --d----- c:\program files\CCleaner
2009-04-15 12:47 <DIR> --d----- c:\docume~1\samuel\applic~1\RegistrySmart
2009-04-15 12:44 249,856 -------- c:\windows\Setup1.exe
2009-04-15 12:44 73,216 a------- c:\windows\ST6UNST.EXE

==================== Find3M ====================

2009-03-19 16:32 23,400 a------- c:\windows\system32\drivers\GEARAspiWDM.sys
2009-03-08 04:34 914,944 a------- c:\windows\system32\wininet.dll
2009-03-08 04:34 43,008 a------- c:\windows\system32\licmgr10.dll
2009-03-08 04:33 18,944 a------- c:\windows\system32\corpol.dll
2009-03-08 04:33 420,352 a------- c:\windows\system32\vbscript.dll
2009-03-08 04:32 72,704 a------- c:\windows\system32\admparse.dll
2009-03-08 04:32 71,680 a------- c:\windows\system32\iesetup.dll
2009-03-08 04:31 34,816 a------- c:\windows\system32\imgutil.dll
2009-03-08 04:31 48,128 a------- c:\windows\system32\mshtmler.dll
2009-03-08 04:31 45,568 a------- c:\windows\system32\mshta.exe
2009-03-08 04:22 156,160 a------- c:\windows\system32\msls31.dll
2009-02-09 20:19 1,846,272 a------- c:\windows\system32\win32k.sys
2009-02-06 18:52 49,504 a------- c:\windows\system32\sirenacm.dll
2008-07-19 12:05 94,208 a------- c:\docume~1\samuel\applic~1\ezplay.sys
2008-07-19 12:05 87,608 a------- c:\docume~1\samuel\applic~1\inst.exe
2008-07-19 12:05 47,360 a------- c:\docume~1\samuel\applic~1\pcouffin.sys
2004-08-04 22:00 170,956 a--shr-- c:\windows\system32\hfthahby.dll


Cheers in advance - sam.

chemist

Hello and Welcome to TSF.

We need to see all 3 logs in order to help you.

------------------------------------------------------

Please follow our pre-posting process outlined here:

NEW INSTRUCTIONS - Read This Before Posting For Malware Removal Help

After running through all the steps, you shall have a proper set of logs. Please post them in a new thread, as this one shall be closed.

If you have trouble with one of the steps, simply move on to the next one, and make note of it in your reply.

Please note that the Virus/Trojan/Spyware Help forum is extremely busy, and it may take a while to receive a reply.

------------------------------------------------------