KittyGirl

Hi...can someone tell me if Im still infected...I followed all the steps....finally I could clean up...but unsure if I need any more procedures to be completely clean...here my logs....Thanks...

DDS (Ver_09-07-30.01) - NTFSx86
Run by MT at 17:51:18.51 on Tue 09/22/2009
Internet Explorer: 6.0.2900.2180
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.501.298 [GMT -4:00]

AV: Avira AntiVir PersonalEdition *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
AV: McAfee VirusScan Enterprise *On-access scanning disabled* (Updated) {918A2B0B-2C60-4016-A4AB-E868DEABF7F0}

============== Running Processes ===============

C:\WINDOWS\system32\ibmpmsvc.exe
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\WINDOWS\Explorer.EXE
svchost.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Intel\AMT\LMS.exe
C:\Program Files\McAfee\Common Framework\FrameworkService.exe
C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe
C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files\AOL 9.1\waol.exe
C:\Program Files\Common Files\Lenovo\tvt_reg_monitor_svc.exe
C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe
C:\Program Files\Common Files\Intel\Privacy Icon\UNS\UNS.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\Program Files\ThinkPad\Utilities\PWMDBSVC.EXE
C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe
C:\Program Files\AOL 9.1\shellmon.exe
C:\Program Files\Common Files\AOL\1225952802\ee\aolsoftware.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Common Files\AOL\Topspeed\3.0\aoltpsd3.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Documents and Settings\MT\Desktop\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.aol.com/
BHO: scriptproxy: {7db2d5a0-7241-4e79-b68d-6309f01c5231} - c:\program files\mcafee\virusscan enterprise\scriptcl.dll
TB: AOL Toolbar: {de9c389f-3316-41a7-809b-aa305ed9d922} - c:\program files\aol\aol toolbar 5.0\aoltb.dll
uRun: [AOL Fast Start] "c:\program files\aol 9.1\AOL.EXE" -b
mRun: [Malwarebytes Anti-Malware (reboot)] "c:\program files\malwarebytes' anti-malware\mbam.exe" /runcleanupscript
mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
mRun: [ShStatEXE] "c:\program files\mcafee\virusscan enterprise\SHSTAT.EXE" /STANDALONE
mRun: [avgnt] "c:\program files\avira\antivir personaledition classic\avgnt.exe" /min/nosplash
dRunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe
dRunOnce: [FlashPlayerUpdate] c:\windows\system32\macromed\flash\FlashUtil10a.exe
mPolicies-system: CompatibleRUPSecurity = 1 (0x1)
IE: &AOL Toolbar Search - c:\program files\aol\aol toolbar 5.0\resources\en-us\local\search.html
IE: E&xport to Microsoft Excel - c:\progra~1\micros~1\office11\EXCEL.EXE/3000
IE: {3C3171BC-1025-43d1-8D1D-61CF4B38A28F} - c:\novell\messen~1\NMCL32.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683}
IE: {3369AF0D-62E9-4bda-8103-B4C75499B578} - {DE9C389F-3316-41A7-809B-AA305ED9D922} - c:\program files\aol\aol toolbar 5.0\aoltb.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~1\office11\REFIEBAR.DLL
Trusted Zone: live.com\onecare
Trusted Zone: microsoft.com\*.update
Trusted Zone: microsoft.com\oas.support
Trusted Zone: microsoft.com \support
Trusted Zone: windowsupdate.com\download
DPF: {0742B9EF-8C83-41CA-BFBA-830A59E23533} - hxxps://support.microsoft.com/Dcode/ActiveX/MSDcode.cab
DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} - hxxp://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase6796.cab
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1252038351968
DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1252040264515
DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} - hxxp://ax.emsisoft.com/asquared.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/swflash.cab
TCP: {D976BDBA-796F-4230-AC8E-D178D7A9104C} = 205.188.146.145
Handler: nim - {3D206AE2-3039-413B-B748-3ACC562EC22A} - c:\novell\messenger\nmcg32.dll
Notify: igfxcui - igfxdev.dll
Notify: tpfnf2 - c:\program files\lenovo\hotkey\notifyf2.dll
Notify: tphotkey - c:\program files\lenovo\hotkey\tphklock.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SEH: Windows Desktop Search Namespace Manager: {56f9679e-7826-4c84-81f3-532071a8bcc5} - c:\program files\windows desktop search\MSNLNamespaceMgr.dll

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\mt\applic~1\mozilla\firefox\profiles\agosvuv6.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.aol.com
FF - prefs.js: browser.startup.homepage - hxxp://www.aol.com
FF - prefs.js: browser.search.selectedEngine - AOL Search
FF - prefs.js: keyword.URL - hxxp://aolsearch.aol.com/aol/search?invocationType=client_searchbox&query=FF - component: c:\program files\real\realplayer\browserrecord\components\nprpbrowserrecordplugin.dll

============= SERVICES / DRIVERS ===============

R1 avgio;avgio;c:\program files\avira\antivir personaledition classic\avgio.sys [2009-9-18 11608]
R1 hpcd2k;hpcd2k;c:\windows\system32\drivers\hpcd2K.sys [2008-11-9 4421]
R1 mferkdk;VSCore mferkdk;c:\program files\mcafee\virusscan enterprise\mferkdk.sys [2006-11-30 31944]
R1 pelmouse;Mouse Suite Driver;c:\windows\system32\drivers\PELMouse.SYS [2008-1-9 16384]
R2 AntiVirScheduler;Avira AntiVir Personal - Free Antivirus Scheduler;c:\program files\avira\antivir personaledition classic\sched.exe [2009-9-18 68865]
R2 McAfeeFramework;McAfee Framework Service;c:\program files\mcafee\common framework\FrameworkService.exe [2008-10-24 104000]
R2 McTaskManager;McAfee Task Manager;c:\program files\mcafee\virusscan enterprise\VsTskMgr.exe [2007-2-22 54872]
R2 Power Manager DBC Service;Power Manager DBC Service;c:\program files\thinkpad\utilities\PWMDBSVC.exe [2008-10-10 114688]
R2 TomTomHOMEService;TomTomHOMEService;c:\program files\tomtom home 2\TomTomHOMEService.exe [2009-4-8 92008]
R2 UNS;Intel(R) Active Management Technology User Notification Service;c:\program files\common files\intel\privacy icon\uns\UNS.exe [2008-10-14 2058776]
R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\viewpoint\common\ViewpointService.exe [2009-3-24 45056]
R3 AntiVirService;Avira AntiVir Personal - Free Antivirus Guard;c:\program files\avira\antivir personaledition classic\avguard.exe [2009-9-18 151297]
R3 avgntflt;avgntflt;c:\program files\avira\antivir personaledition classic\avgntflt.sys [2009-9-18 52056]
R3 HPUATA;HP CD Writer Plus Controller Driver;c:\windows\system32\drivers\HPUATA.sys [2000-9-27 75776]
S1 TPPWRIF;TPPWRIF;c:\windows\system32\drivers\TPPWRIF.SYS [2008-10-10 4442]
S2 nfgix;nfgix;c:\windows\system32\drivers\ewpgpnm.sys --> c:\windows\system32\drivers\ewpgpnm.sys [?]
S2 pxsszabi;pxsszabi;c:\windows\system32\drivers\ctxt.sys --> c:\windows\system32\drivers\ctxt.sys [?]
S2 tpacb;tpacb;c:\windows\system32\drivers\qrrwz.sys --> c:\windows\system32\drivers\qrrwz.sys [?]
S2 wasbqno;wasbqno;c:\windows\system32\drivers\ufdq.sys --> c:\windows\system32\drivers\ufdq.sys [?]
S3 ATSwpWDF;AuthenTec TruePrint USB WDF Driver;c:\windows\system32\drivers\ATSwpWDF.sys [2008-10-11 480640]
S3 e1yexpress;Intel(R) Gigabit Network Connections Driver;c:\windows\system32\drivers\e1y5132.sys [2008-10-10 243856]
S3 mfeavfk;McAfee Inc.;c:\windows\system32\drivers\mfeavfk.sys [2008-10-24 72264]
S3 mfebopk;McAfee Inc.;c:\windows\system32\drivers\mfebopk.sys [2008-10-24 34152]
S3 mfehidk;McAfee Inc.;c:\windows\system32\drivers\mfehidk.sys [2008-10-24 170408]
S3 pelps2m;PS/2 Mouse Filter Driver;c:\windows\system32\drivers\pelps2m.sys [2008-10-24 18048]
S3 pelusblf;USB Mouse Low Filter Driver;c:\windows\system32\drivers\pelusblf.sys [2008-1-9 9216]

=============== Created Last 30 ================

2009-09-22 06:39 <DIR> --d----- c:\windows\ServicePackFiles
2009-09-22 05:58 655,872 -c------ c:\windows\system32\dllcache\mstscax.dll
2009-09-22 05:01 153,088 -c------ c:\windows\system32\dllcache\triedit.dll
2009-09-22 03:34 128,512 -c------ c:\windows\system32\dllcache\dhtmled.ocx
2009-09-18 22:35 268,648 a------- c:\windows\system32\mucltui.dll
2009-09-18 22:35 27,496 a------- c:\windows\system32\mucltui.dll.mui
2009-09-18 22:09 <DIR> --d----- c:\program files\Avira
2009-09-18 22:09 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Avira
2009-09-16 17:04 <DIR> --d----- c:\docume~1\mt\applic~1\AVG8
2009-09-15 22:34 229,888 a------- c:\windows\PEV.exe
2009-09-15 22:34 161,792 a------- c:\windows\SWREG.exe
2009-09-15 22:34 98,816 a------- c:\windows\sed.exe
2009-09-11 22:04 <DIR> --d----- c:\program files\RegScrubXP
2009-09-10 22:01 <DIR> --d----- c:\windows\system32\CatRoot_bak
2009-09-09 02:19 526,184 a------- C:\Q329692_WXP_SP2_x86_ENU.exe
2009-09-09 01:56 856,616 a------- C:\WindowsXP-KB955109-x86-ENU.exe
2009-09-08 15:09 <DIR> --d----- c:\program files\ACW
2009-09-08 13:57 577,024 ac------ c:\windows\system32\dllcache\user32.dll
2009-09-08 13:57 577,024 -------- c:\windows\system32\user32.dll
2009-09-04 15:46 <DIR> --d-h--- c:\windows\PIF
2009-09-04 00:32 23,576 a------- c:\windows\system32\wuapi.dll.mui
2009-09-04 00:16 <DIR> --d----- c:\docume~1\mt\applic~1\GlarySoft
2009-09-03 05:04 66,048 ac------ c:\windows\system32\dllcache\s3legacy.dll
2009-09-03 04:47 <DIR> --d----- c:\windows\system32\ntdll
2009-09-03 04:46 330,149 a------- c:\windows\system32\ntdll.zip
2009-09-02 22:12 <DIR> a-dshr-- C:\cmdcons
2009-09-02 17:30 <DIR> --d----- c:\docume~1\mt\applic~1\Malwarebytes
2009-09-02 17:30 38,224 a------- c:\windows\system32\drivers\mbamswissarmy.sys
2009-09-02 17:30 19,160 a------- c:\windows\system32\drivers\mbam.sys
2009-09-02 17:30 <DIR> --d----- c:\program files\Malwarebytes' Anti-Malware
2009-09-02 17:30 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Malwarebytes
2009-09-02 14:58 <DIR> --d----- c:\documents and settings\mt\(null)
2009-08-31 19:28 0 a---h--- c:\windows\system32\BIT6.tmp
2009-08-31 16:32 <DIR> --d----- c:\documents and settings\mt\DoctorWeb
2009-08-31 01:00 <DIR> --d----- c:\windows\system32\NtmsData
2009-08-30 16:13 <DIR> --d----- c:\program files\Trend Micro
2009-08-29 23:08 <DIR> --d----- c:\windows\system32\xircom
2009-08-29 23:08 <DIR> --d----- c:\windows\system32\wbem\snmp
2009-08-28 22:31 52 a------- c:\windows\system32\3E.tmp
2009-08-28 22:05 24,576 a------- c:\windows\sv4.exe
2009-08-28 22:05 16,384 a------- c:\windows\sv3.exe
2009-08-28 21:49 0 a------- c:\windows\system32\3A.tmp
2009-08-28 21:49 360,320 a------- c:\windows\system32\drivers\TCPIP.SYS.ORIGINAL
2009-08-28 21:48 52 a------- c:\windows\system32\37.tmp

==================== Find3M ====================

2009-08-31 18:58 218,112 a------- c:\windows\system32\wbem\wmiprvse.exe
2009-08-31 18:58 16,896 a------- c:\windows\system32\wbem\unsecapp.exe
2009-08-31 18:58 39,424 a------- c:\windows\system32\wbem\scrcons.exe
2009-08-31 18:54 17,408 a------- c:\windows\system32\wpdshextautoplay.exe
2009-08-31 18:53 189,952 a------- c:\windows\system32\WISPTIS.EXE
2009-08-31 18:53 8,192 a------- c:\windows\system32\winhlp32.exe
2009-08-31 18:53 31,232 a------- c:\windows\system32\verclsid.exe
2009-08-31 18:53 16,896 a------- c:\windows\system32\upnpcont.exe
2009-08-31 18:51 167,936 a------- c:\windows\system32\SpoonUninstall.exe
2009-08-31 18:51 56,832 a------- c:\windows\system32\sol.exe
2009-08-31 18:51 138,752 a------- c:\windows\system32\sndvol32.exe
2009-08-31 18:51 80,384 a------- c:\windows\system32\shrpubw.exe
2009-08-31 18:51 14,336 a------- c:\windows\system32\runonce.exe
2009-08-31 18:51 107,520 a------- c:\windows\system32\rsnotify.exe
2009-08-31 18:51 49,152 a------- c:\windows\system32\rsmui.exe
2009-08-31 18:51 24,576 a------- c:\windows\system32\rsmsink.exe
2009-08-31 18:50 65,024 a------- c:\windows\system32\rdpclip.exe
2009-08-31 18:50 35,840 a------- c:\windows\system32\rcimlby.exe
2009-08-31 18:50 109,568 a------- c:\windows\system32\progman.exe
2009-08-31 18:50 35,840 a------- c:\windows\system32\ping6.exe
2009-08-31 18:50 58,368 a------- c:\windows\system32\packager.exe
2009-08-31 18:50 40,448 a------- c:\windows\system32\osuninst.exe
2009-08-31 18:50 32,768 a------- c:\windows\system32\odbcad32.exe
2009-08-31 18:50 422,400 a------- c:\windows\system32\ntvdm.exe
2009-08-31 18:50 1,200,128 a------- c:\windows\system32\ntbackup.exe
2009-08-31 18:50 88,576 a------- c:\windows\system32\netsh.exe
2009-08-31 18:49 29,184 a------- c:\windows\system32\mshta.exe
2009-08-31 18:49 123,392 a------- c:\windows\system32\mplay32.exe
2009-08-31 18:49 143,360 a------- c:\windows\system32\mobsync.exe
2009-08-31 18:48 389,120 a------- c:\windows\system32\igxpun.exe
2009-08-31 18:48 167,936 a------- c:\windows\system32\igfxzoom.exe
2009-08-31 18:48 131,072 a------- c:\windows\system32\igfxtray.exe
2009-08-31 18:48 241,664 a------- c:\windows\system32\igfxsrvc.exe
2009-08-31 18:48 135,168 a------- c:\windows\system32\igfxpers.exe
2009-08-31 18:48 163,840 a------- c:\windows\system32\igfxext.exe
2009-08-31 18:47 117,248 a------- c:\windows\system32\iexpress.exe
2009-08-31 18:47 57,344 a------- c:\windows\system32\ico.exe
2009-08-31 18:47 10,240 a------- c:\windows\system32\hostname.exe
2009-08-31 18:47 163,840 a------- c:\windows\system32\hkcmd.exe
2009-08-31 18:47 39,424 a------- c:\windows\system32\grpconv.exe
2009-08-31 18:47 20,480 a------- c:\windows\system32\FSRremoS.EXE
2009-08-31 18:47 55,296 a------- c:\windows\system32\freecell.exe
2009-08-31 18:47 20,992 a------- c:\windows\system32\fontview.exe
2009-08-31 18:47 29,696 a------- c:\windows\system32\findstr.exe
2009-08-31 18:47 11,776 a------- c:\windows\system32\find.exe
2009-08-31 18:47 80,384 a------- c:\windows\system32\eventtriggers.exe
2009-08-31 18:46 10,752 a------- c:\windows\system32\dumprep.exe
2009-08-31 18:46 60,928 a------- c:\windows\system32\driverquery.exe
2009-08-31 18:46 18,432 a------- c:\windows\system32\dmremote.exe
2009-08-31 18:46 166,400 a------- c:\windows\system32\diskpart.exe
2009-08-31 18:44 82,432 a------- c:\windows\system32\dfrgfat.exe
2009-08-31 18:44 25,088 a------- c:\windows\system32\defrag.exe
2009-08-31 18:44 98,304 a------- c:\windows\system32\cscript.exe
2009-08-31 18:44 66,048 a------- c:\windows\system32\cmstp.exe
2009-08-31 18:44 102,912 a------- c:\windows\system32\clipbrd.exe
2009-08-31 18:44 10,240 a------- c:\windows\system32\ckcnv.exe
2009-08-31 18:44 80,384 a------- c:\windows\system32\charmap.exe
2009-08-31 18:44 13,824 a------- c:\windows\system32\attrib.exe
2009-08-31 18:44 32,768 a------- c:\windows\system32\asr_pfu.exe
2009-08-31 18:44 32,256 a------- c:\windows\system32\asr_ldm.exe
2009-08-31 18:44 30,208 a------- c:\windows\system32\asr_fmt.exe
2009-08-31 18:44 186,368 a------- c:\windows\system32\accwiz.exe
2009-08-31 18:25 286,208 a------- c:\windows\winhlp32.exe
2009-08-31 18:25 25,600 a------- c:\windows\twunk_32.exe
2009-08-31 18:25 74,240 a------- c:\windows\ST5UNST.EXE
2009-08-31 18:24 163,840 a------- c:\windows\sequencer.exe
2009-08-31 18:24 146,432 a------- c:\windows\regedit.exe
2009-08-31 18:24 24,576 a------- c:\windows\PWMBTHLP.EXE
2009-08-31 18:24 306,688 a------- c:\windows\IsUninst.exe
2009-08-31 18:24 94,208 a------- c:\windows\DLA.EXE
2009-08-31 16:34 5,632 a------- c:\windows\system32\cisvc.exe
2009-08-28 21:49 360,320 a------- c:\windows\system32\drivers\TCPIP.SYS
2009-08-05 05:11 204,800 a------- c:\windows\system32\mswebdvd.dll
2009-07-29 00:53 119,808 a------- c:\windows\system32\t2embed.dll
2009-07-29 00:53 82,432 a------- c:\windows\system32\fontsub.dll
2009-07-17 14:55 58,880 a------- c:\windows\system32\atl.dll
2009-06-25 14:36 661,504 a------- c:\windows\system32\mqqm.dll
2009-06-25 14:36 517,120 a------- c:\windows\system32\mqsnap.dll
2009-06-25 14:36 471,552 a------- c:\windows\system32\mqutil.dll
2009-06-25 14:36 225,280 a------- c:\windows\system32\mqoa.dll
2009-06-25 14:36 186,880 a------- c:\windows\system32\mqtrig.dll
2009-06-25 14:36 177,152 a------- c:\windows\system32\mqrt.dll
2009-06-25 14:36 138,240 a------- c:\windows\system32\mqad.dll
2009-06-25 14:36 123,392 a------- c:\windows\system32\mqrtdep.dll
2009-06-25 14:36 95,744 a------- c:\windows\system32\mqsec.dll
2009-06-25 14:36 48,640 a------- c:\windows\system32\mqupgrd.dll
2009-06-25 14:36 47,104 a------- c:\windows\system32\mqdscli.dll
2009-06-25 14:36 16,896 a------- c:\windows\system32\mqise.dll

============= FINISH: 17:51:52.29 ===============

Attached Files

	ark.zip (1.1 KB, 0 views)
	Attach.zip (5.1 KB, 0 views)

Ried

Hi Nancy. In your previous thread, I had advised you that you needed to reformat and reinstall the Operating System due to Virut onboard. It appears you have not done that as I still see the infection onboard.

There are no short cuts here, you must reformat and reinstall Windows. If you need assistance with how to do that, let me know.

KittyGirl

I must done something wrong then....let me try again...thanks Lisa...

Ried

Hi Nancy. :)

Here is a good guide to help walk you through performing a fresh install. http://www.windowsreinstall.com/winx...tallguides.htm

KittyGirl

thanks Lisa.... =)