Smitfraud-C, 888 toolbar help!

filo_romz · 11-22-2006, 05:43 AM

Hey my friend recently caught a heavy virus while browsing through some sites and he has great difficulty in getting access to the internet. Here is his recent logfile:

--------------

Logfile of HijackThis v1.99.1
Scan saved at 11:30:21 PM, on 22/11/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\VirusRescue\vrsvc.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Common Files\??mbols\??rss.exe
C:\PROGRA~1\COMMON~1\WNSXS~1\fast.exe
C:\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - Default URLSearchHook is missing
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: Safety Bar - {052b12f7-86fa-4921-8482-26c42316b522} - C:\Program Files\Safety Bar\SafetyBar.dll
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [RtWLan] C:\Program Files\NETGEAR\WG111v2 Configuration Utility\RtWLan.exe /H
O4 - HKLM\..\Run: [CTDrive] rundll32.exe C:\WINDOWS\system32\drvpah.dll,startup
O4 - HKLM\..\Run: [tnziiib.dll] C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\tnziiib.dll,xeokrvd
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_08\bin\jusched.exe"
O4 - HKLM\..\Run: [VirusRescue] C:\Program Files\VirusRescue\VirusRescue.exe /s
O4 - HKLM\..\Run: [SpywareHeal] C:\Program Files\SpywareHeal\SpywareHeal.exe /h
O4 - HKLM\..\Run: [cqjkpwk.dll] C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\cqjkpwk.dll,kghdbsf
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [vvdkkpe.dll] C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\vvdkkpe.dll,agkxvbc
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Uuir] "C:\PROGRA~1\COMMON~1\WNSXS~1\fast.exe" -vt tzt
O4 - HKCU\..\Run: [Bwcpgrj] C:\Program Files\Common Files\??mbols\??rss.exe
O4 - Startup: .protected
O4 - Startup: LimeWire On Startup.lnk = C:\Program Files\LimeWire\LimeWire.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: WG111v2 Smart Wizard Wireless Setting.lnk = C:\Program Files\NETGEAR\WG111v2 Configuration Utility\RtlWake.exe
O4 - Global Startup: .protected
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~1\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O21 - SSODL: cussers - {ff170564-36c8-43f7-9100-559e166405cf} - (no file)
O21 - SSODL: boucicault - {0bad5052-665d-40d4-a9bd-a2891eaafb42} - C:\WINDOWS\system32\fmrmhc.dll (file missing)
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: vrsvc - Unknown owner - C:\Program Files\VirusRescue\vrsvc.exe

--------------

my friend says that the trojan or virus behind it is Smitfraud-C or some form or another... It seems that the virus makes icons which look like anti-virus program icons or protection icons and keeps returning evreytime he logs on the internet. He keeps disconnecting from the internet and makes his computer extremely slow... He also sees an 888 toolbar on his computer which could also have contributed to the slowing down of his computer.

I hope you can help my dear friend out! Thank you TSF

fredmh · 11-22-2006, 08:33 AM

Hello filo romz, and welcome to TSF.

I am currently reviewing your log. Please note that this is under the supervision of an expert analyst,
and I will be back with a fix for your problem as soon as possible.

You may wish to Subscribe to this thread (Thread Tools) so that you are notified when you receive a reply.

Please be patient with me during this time.

=======================================

The infection you have, a variant of vundo, recognizes HijackThis and prevents HJT from reading the registry locations where it resides as well as
hiding other infections in those locations.

I'd like you to rename HijackThis.exe to filo.exe.

Navigate to C:\HijackThis\HijackThis.exe
Right click on HijackThis.exe
Select 'Rename'
Type in filo.exe
Press Enter.

Please run a scan with the newly renamed filo.exe and post the new log here.

filo_romz · 11-23-2006, 04:13 AM

okay i did what you had asked .. heres the recent logfile:

------------------

Logfile of HijackThis v1.99.1
Scan saved at 3:08:25 PM, on 23/11/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\VirusRescue\vrsvc.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Java\jre1.5.0_08\bin\jusched.exe
C:\Program Files\VirusRescue\VirusRescue.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\VirusRescue\VirusRescue.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Common Files\{44645217-0383-1033-0803-01022403003d}\Update.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\COMMON~1\WNSXS~1\fast.exe
C:\Program Files\Common Files\??mbols\??rss.exe
C:\Program Files\NETGEAR\WG111v2 Configuration Utility\RtlWake.exe
C:\Program Files\LimeWire\LimeWire.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wscntfy.exe
C:\HijackThis\filo.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} -
C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {099D0986-C204-F967-3343-00A64FA96FB9} -
C:\WINDOWS\system32\vorenbj.dll
O2 - BHO: (no name) - {39f25b12-74ff-4079-a51f-1d70f5b08b84} -
C:\WINDOWS\system32\ixt0.dll (file missing)
O2 - BHO: (no name) - {469B21EE-DC21-F8DB-B902-01B048E4C758} -
C:\WINDOWS\system32\ppgglue.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} -
C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {67E50C13-CAF6-E272-828A-B2693EA6DD95} -
C:\WINDOWS\system32\iae.dll (file missing)
O2 - BHO: (no name) - {72AEEBB5-ECD6-0174-0AB3-03DD9B601445} -
C:\WINDOWS\system32\svsahaf.dll
O2 - BHO: (no name) - {755bbd1a-aa59-456c-afeb-b4c42c4dcb6f} -
C:\WINDOWS\system32\ixt1.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program
Files\Java\jre1.5.0_08\bin\ssv.dll
O2 - BHO: (no name) - {CFE9E8A8-38C0-4EF8-AEC2-5035EFE81030} -
C:\WINDOWS\system32\ljjjkhh.dll
O2 - BHO: (no name) - {D7634C49-8AAF-F370-DEDF-A728EA7B67CD} -
C:\WINDOWS\system32\ybtxw.dll
O2 - BHO: (no name) - {E4216140-19DC-41B4-BD11-68817B7CAA4E} -
C:\WINDOWS\system32\ssqqr.dll
O2 - BHO: (no name) - {F18F04B0-9CF1-4b93-B004-77A288BEE28B} -
C:\WINDOWS\system32\ioceuskd.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} -
C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: Safety Bar - {052b12f7-86fa-4921-8482-26c42316b522} - C:\Program
Files\Safety Bar\SafetyBar.dll
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [RtWLan] C:\Program Files\NETGEAR\WG111v2 Configuration
Utility\RtWLan.exe /H
O4 - HKLM\..\Run: [CTDrive] rundll32.exe C:\WINDOWS\system32\drvpah.dll,startup
O4 - HKLM\..\Run: [tnziiib.dll] C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\tnziiib.dll,xeokrvd
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program
Files\Java\jre1.5.0_08\bin\jusched.exe"
O4 - HKLM\..\Run: [VirusRescue] C:\Program Files\VirusRescue\VirusRescue.exe /s
O4 - HKLM\..\Run: [SpywareHeal] C:\Program Files\SpywareHeal\SpywareHeal.exe /h
O4 - HKLM\..\Run: [cqjkpwk.dll] C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\cqjkpwk.dll,kghdbsf
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [vvdkkpe.dll] C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\vvdkkpe.dll,agkxvbc
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Uuir] "C:\PROGRA~1\COMMON~1\WNSXS~1\fast.exe" -vt tzt
O4 - HKCU\..\Run: [Bwcpgrj] C:\Program Files\Common Files\??mbols\??rss.exe
O4 - Startup: .protected
O4 - Startup: LimeWire On Startup.lnk = C:\Program Files\LimeWire\LimeWire.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft
Office\Office10\OSA.EXE
O4 - Global Startup: WG111v2 Smart Wizard Wireless Setting.lnk = C:\Program
Files\NETGEAR\WG111v2 Configuration Utility\RtlWake.exe
O4 - Global Startup: .protected
O8 - Extra context menu item: E&xport to Microsoft Excel -
res://C:\PROGRA~1\MICROS~1\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program
Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program
Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program
Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program
Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} -
C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger -
{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O20 - Winlogon Notify: ljjjkhh - C:\WINDOWS\SYSTEM32\ljjjkhh.dll
O20 - Winlogon Notify: ssqqr - C:\WINDOWS\system32\ssqqr.dll
O20 - Winlogon Notify: winmqx32 - C:\WINDOWS\SYSTEM32\winmqx32.dll
O21 - SSODL: cussers - {ff170564-36c8-43f7-9100-559e166405cf} - (no file)
O21 - SSODL: boucicault - {0bad5052-665d-40d4-a9bd-a2891eaafb42} -
C:\WINDOWS\system32\fmrmhc.dll (file missing)
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner
- C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file
missing)
O23 - Service: vrsvc - Unknown owner - C:\Program Files\VirusRescue\vrsvc.exe

------------

fredmh · 11-23-2006, 05:44 PM

Please subscribe to this thread to get immediate notification of replies as soon as they are posted. To do this click Thread Tools,
then click Subscribe to this Thread. Make sure it is set to Instant Notification, then click Subscribe.

Please read this post completely before begining the fix. If there's anything that you do not understand, kindly ask your questions before proceeding.
Please ensure that there aren't any opened browsers when you are carrying out the procedures below. Save the following instructions in Notepad as this
webpage would not be available when you're carrying out the fix.

IT IS IMPORTANT THAT YOU DON'T MISS A STEP & PERFORM EVERYTHING IN THE RIGHT ORDER.

----------------------------------------

The fixes we will use are specific to your problems and should only be used for this issue on this machine.

Please only use this topic to reply to. Do not start another thread.
If any other issues arise let me know.

The process is not instant. Please continue to review my answers until I tell you your machine is clear.
Absence of symptoms does not mean that everything is clear. So lets do this to the end!

Please make every effort to reply to my posts in a timely manner. Malware breeds malware and the longer an infection remains on a system, the more
likely additional infections will result.

----------------------------------------

This system is heavily infected. Let's get started with the cleaning.

----------------------------------------

P2P - I see you have P2P software installed on your machine. We are not here to pass judgment on file-sharing as a concept.
However, we will warn you that engaging in this activity and having this kind of software installed on your machine will always make you more
susceptible to re-infections. It may be contributing to your current situation. This page will give you further information.

These programs are:

Limewire

----------------------------------------

No AntiVirus Onboard

I see no evidence of an AntiVirus program on your system. This must be resolved. Here are two very good free Antivirus products which are available:

Select one of these, or another of your choice. Download, install, update definitions, and run a full system scan.

----------------------------------------
DOWNLOADS

CLEANUP! version 4.52 – TEMP FILE CLEANING

Please download Cleanup! and install it. You will use this later.

*NOTE* Cleanup deletes EVERYTHING out of temporary folders and does not make backups.

AVG Anti-Spyware 7.5

Please download AVG Anti-Spyware 7.5

Use the link at the bottom of the page under "AVG Anti-Spyware Free for Windows"

Install AVG Anti-Spyware 7.5.
Double-click the icon on Desktop to launch AVG A-S 7.5
On the top of the main screen click Shield
Click the word active to change it to inactive
On the top of the main screen click Update.
Then click on Start Update. The update will start and a progress bar will show the updates being installed.
I also recommend changing the "Update interval" to something more reasonable like 12 hours.

SMITFRAUD FIX

Please download SmitfraudFix (by S!Ri)
Extract the content (a folder named SmitfraudFix) to your Desktop.

ComboFix

1. Download this file - You MUST save it to your desktop

http://download.bleepingcomputer.com/sUBs/combofix.exe

or

http://www.techsupportforum.com/sectools/combofix.exe

2. 2. Go to <<Start>> then <<Run>> then paste in the single line command then click OK

"%userprofile%\desktop\combofix.exe" /v vorenbj ppgglue svsahaf ljjjkhh ybtxw ssqqr ioceuskd tnziiib cqjkpwk vvdkkpe winmqx32

3. When finished, it shall produce a log for you. Post that log in your next reply

Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall

----------------------------------------

DISABLE NT SERVICES

Click Start->Run - type services.msc & then click on the OK button
*Locate the service - vrsvc
*Double-click on it to open the Properties dialog.
*Under the General tab: <--Take note and write down the *Service name given as we will need it shortly.
*Stop the service by using the Stop button.
*Change the Startup type to Disabled & then click on the OK button

Next, start HiJackThis & go to Config>Misc.Tools...> Delete an NT service...
*In the popup box that appears, type in the *Service Name you found in the General Tab for vrsvc.

----------------------------------------

SAFE MODE RE-BOOT

Please reboot your computer in Safe Mode by doing the following:
1) Restart your computer
2) After hearing your computer beep once during startup, but before the Windows icon appears, press F8.
3) Instead of Windows loading as normal, a menu should appear
4) Use the up arrow key to highlight Safe Mode and press Enter.
5) Login with your usual account. Make sure to close any open browsers.

----------------------------------------

FIXES AND DELETIONS

Uninstall the following via the Add/Remove Panel (Start->(Settings)->Control Panel->Add/Remove Programs) if they exist:

VirusRescue
SpywareHeal

These programs are rogueware and we highly recommend that you uninstall them. Rogue or Suspect means that these products
are of unknown,questionable, or dubious value as anti-spyware protection.
See THIS SITE for more information

----------------------------------------

Open HijackThis and click on 'Do a System Scan Only'. Check the following entries (If they still exist, make sure you do not miss any)

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - Default URLSearchHook is missing
O2 - BHO: (no name) - {39f25b12-74ff-4079-a51f-1d70f5b08b84} -C:\WINDOWS\system32\ixt0.dll (file missing)
O2 - BHO: (no name) - {67E50C13-CAF6-E272-828A-B2693EA6DD95} -C:\WINDOWS\system32\iae.dll (file missing)
O2 - BHO: (no name) - {755bbd1a-aa59-456c-afeb-b4c42c4dcb6f} -C:\WINDOWS\system32\ixt1.dll (file missing)
O4 - HKLM\..\Run: [tnziiib.dll] C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\tnziiib.dll,xeokrvd
O4 - HKLM\..\Run: [VirusRescue] C:\Program Files\VirusRescue\VirusRescue.exe /s
O4 - HKLM\..\Run: [SpywareHeal] C:\Program Files\SpywareHeal\SpywareHeal.exe /h
O4 - HKLM\..\Run: [cqjkpwk.dll] C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\cqjkpwk.dll,kghdbsf
O4 - HKLM\..\Run: [vvdkkpe.dll] C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\vvdkkpe.dll,agkxvbc
O4 - HKCU\..\Run: [Bwcpgrj] C:\Program Files\Common Files\??mbols\??rss.exe
23 - Service: vrsvc - Unknown owner - C:\Program Files\VirusRescue\vrsvc.exe

Please remember to close all other windows, including browsers then click Fix checked.

----------------------------------------

UNHIDE HIDDEN FILES

Go to My Computer->Tools->Folder Options->View tab:
* Under the Hidden files and folders heading, select Show hidden files and folders.
* Uncheck the Hide protected operating system files (recommended) option.
* Also make sure there is no checkmark beside Hide file extensions for known file types
* Click Yes to confirm and then click OK.

----------------------------------------
Delete the following Files indicated in RED and Folders indicated in BLUE if they still exist.

C:\Program Files\Common Files\{44645217-0383-1033-0803-01022403003d}\Update.exe

C:\Program Files\VirusRescue
C:\Program Files\SpywareHeal

----------------------------------------

SmitFraud - OPTION 2

Open the SmitfraudFix Folder, then double-click smitfraudfix.cmd file to start the tool.
Select option #2 - Clean by typing 2 and press Enter.
Wait for the tool to complete and disk cleanup to finish.
You will be prompted : " Registry cleaning - Do you want to clean the registry?" answer Yes by typing Y and hit Enter.
The tool will also check if wininet.dll is infected. If a clean version is found, you will be prompted to replace wininet.dll.
Answer Yes to the question " Replace infected file?" by typing Y and hit Enter.

A reboot may be needed to finish the cleaning process, if you computer does not restart automatically please do it yourself manually.
Reboot in Safe Mode.

The tool will create a log named c:\rapport.txt in the root of your drive, eg: Local Disk C: (C:rapport.txt) or partition where your
operating system is installed. Please post that log along with all others requested in your next reply.

----------------------------------------

RUNNING SCANNERS

Cleanup

Open Cleanup! by double-clicking the icon on your desktop (or from the Start > All Programs menu).
Set the program up as follows:

Click "Options..."
Move the arrow down to "Custom CleanUp!"
Put a check next to the following (Make sure nothing else is checked!):

Empty Recycle Bins
Delete Cookies
Delete Prefetch files (if present)
Cleanup! All Users
Click on the Temporary Files tab and uncheck the box for Scan drives for files matching if it’s checked.

Click OK
Press the CleanUp! button to start the program and DO NOT reboot when prompted.

AVG Anti-Spyware 7.5

Run AVG A-s with it's updated definitions: (...it's important that all windows must be closed)
This scan can take quite a while to run, so be prepared.
Click Scanner
Click on the Scan tab
Click Complete System Scan to begin scanning.
When the scan is complete click Recommended Action and change it to Quarantine (1),
If not click Recommended Action and choose Quarantine from the popup menu. (2)
At the bottom of the window click on the Apply all Actions button. (3)

When done, click the Save Scan Report button. (4) then click Save Report As and save it to your desktop.

IMPORTANT : Don't click on the "Save Scan Report" button before you did hit the "Apply all Actions" button.

Note: DO NOT USE the computer while AVG A/S is scanning. If Explorer or the Control Panel are opened some malware types will
reinfect your system or will not be cleaned properly.

----------------------------------------

SECURE DESKTOP

Next go to Control Panel click Display>Desktop>Customize Desktop>Web> Now, Uncheck Everything and delete if present:

"Security Info"

"Warning Message"

"Security Desktop"

"Warning Homepage"

"Desktop Uninstall"

Also make sure the 'Lock desktop items' box is unticked. Click OK, and then Click Apply, then OK.

----------------------------------------

SYSTEM RE-BOOT

Reboot into Normal Mode.

----------------------------------------

SmitFraud - OPTION 3

Open the SmitfraudFix folder and double-click smitfraudfix.cmd
Select option #3 - Delete Trusted zone by typing 3 and press Enter
Answer Yes to the question "Restore Trusted Zone ?" by typing Y and hit Enter.

Note, if you use SpywareBlaster and/or IE-SPYAD, it will be necessary to re-install the protection both afford.
For SpywareBlaster, run the program and re-protect all items. For IE-SPYAD, run the batch file and reinstall the protection.

----------------------------------------

ON-LINE SCANS

Perform an online scan with Internet Explorer with Panda ActiveScan

Click on located at the bottom of the page.
A "pop up" window will appear. * Please ensure that your pop up blocker doesn't block it *
Enter your e-mail address, country, and state & click "Free Online Scan" * The download of the 8 MB Panda's ActiveX control will take place *

Begin the scan by selecting

If it finds any malware, it will offer you a report.
Please ignore any entry it finds and the offer to buy the program to remove the entry, as we will address this later.
Click on then click

* You needn't remain online while it's doing the scan but you have to re-connect after it has finished to see the report.
* Turn off the real time scanner of any existing antivirus program while performing the online scan

----------------------------------------

ComboFix - 2nd Run

2. Double click combofix.exe & follow the prompts.

3. When finished, it shall produce a log for you. Post that log in your next reply

Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall

----------------------------------------

FOLLOW-UP

Please return and post these items:

c:\combofix2.txt first running
AVG A/S scan
c:\rapport.txt from Smitfraud
Panda scan
c:\combofix.txt second running
A new HJT log run in Normal Mode

Please note: In order to properly see what is on your system, all HJT logs must be run in the normal mode

Please turn off Word Wrap when posting logs. It's hard on the eyeballs

Please let me know how your system is behaving.

filo_romz · 11-28-2006, 01:09 AM

hi, thanks for the steps .. the computer seems to behaving wonderful now! Thanks a lot for your help! =D i did all the things you told me.. but i had difficulty finding the vrsvs service when i was trying to do the 'disable NT services' section in your steps.. the rest, i did as normal and everything turned out alright.. here are the reports that you told me to post.

combofix - first running ::

------------------------

My PC - 06-11-28 17:00:21.72 Service Pack 2
ComboFix 06.11.27W - Running from: "C:\Documents and Settings\My PC\desktop"
Command switches used :: /v vorenbj ppgglue svsahaf ljjjkhh ybtxw ssqqr ioceuskd tnziiib cqjkpwk vvdkkpe winmqx32

(((((((((((((((((((((((((((((((((((((((((((((((( Vundo Log )))))))))))))))))))))))))))))))))))))))))))))))))))))

C:\WINDOWS\system32\vorenbj.dll
C:\WINDOWS\system32\ppgglue.dll
C:\WINDOWS\system32\svsahaf.dll
C:\WINDOWS\system32\tnziiib.dll
C:\WINDOWS\system32\cqjkpwk.dll
C:\WINDOWS\system32\vvdkkpe.dll
C:\WINDOWS\system32\rqqss.ini
C:\WINDOWS\system32\rqqss.bak2
C:\WINDOWS\system32\rqqss.bak1

* * * POST RUN FILES/FOLDERS * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *

(((((((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

C:\WINDOWS\system32\ismini.exe
C:\Program Files\Safety Bar
C:\WINDOWS\system32\components
C:\Program Files\Common Files\{44645217-0383-1033-0803-01022403003d}
C:\Program Files\Common Files\{34645217-0383-1033-0803-01022403003d}

~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ Purity ~ ~ ~ ~ ~ ~ ~ ~~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~

Folders Quarantined:

C:\QooBox\Purity\Program Files\Common Files\MBOLS~1
C:\QooBox\Purity\Program Files\Common Files\MBOLS~1\??rss.exe
C:\QooBox\Purity\Documents and Settings\My PC\Application Data\àPPATC~1

((((((((((((((((((((((((((((((( Files Created from 2006-10-28 to 2006-11-28 ))))))))))))))))))))))))))))))))))

2006-11-27 21:27 <DIR> d-------- C:\Program Files\CleanUp!
2006-11-27 21:20 <DIR> dr-h----- C:\$VAULT$.AVG
2006-11-27 21:11 71,168 --a------ C:\WINDOWS\system32\drvsov.dll
2006-11-27 21:11 40,973 ---hs---- C:\WINDOWS\system32\rqroopo.dll
2006-11-27 19:19 <DIR> d-------- C:\Documents and Settings\My PC\Application Data\AVG7
2006-11-27 19:08 816,672 --a------ C:\WINDOWS\system32\drivers\avg7core.sys
2006-11-27 19:08 4,960 --a------ C:\WINDOWS\system32\drivers\avgtdi.sys
2006-11-27 19:08 4,224 --a------ C:\WINDOWS\system32\drivers\avg7rsw.sys
2006-11-27 19:08 3,968 --a------ C:\WINDOWS\system32\drivers\avgclean.sys
2006-11-27 19:08 28,416 --a------ C:\WINDOWS\system32\drivers\avg7rsxp.sys
2006-11-27 19:08 18,240 --a------ C:\WINDOWS\system32\drivers\avgmfx86.sys
2006-11-27 19:08 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
2006-11-27 19:08 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\avg7
2006-11-25 09:18 3,968 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2006-11-25 09:17 <DIR> d-------- C:\Program Files\Grisoft
2006-11-22 23:24 <DIR> d-------- C:\HijackThis
2006-11-22 18:05 40,973 ---hs---- C:\WINDOWS\system32\efcyyab.dll
2006-11-22 00:05 <DIR> d--hs---- C:\FOUND.003
2006-11-21 07:24 40,973 ---hs---- C:\WINDOWS\system32\jkkhfge.dll
2006-11-19 23:56 <DIR> d-------- C:\WINDOWS\Minidump
2006-11-19 23:55 <DIR> d--hs---- C:\FOUND.002
2006-11-19 21:02 40,973 ---hs---- C:\WINDOWS\system32\opnkkjg.dll
2006-11-19 08:58 <DIR> d---s---- C:\WINDOWS\system32\Microsoft
2006-11-19 06:05 <DIR> d-------- C:\WINDOWS\system32\CatRoot2
2006-11-19 06:05 <DIR> d-------- C:\WINDOWS\system32\CatRoot
2006-11-19 05:32 <DIR> d-------- C:\Program Files\SpywareHeal
2006-11-19 04:08 <DIR> d-------- C:\WINDOWS\system32\àdobe
2006-11-19 04:06 40,973 ---hs---- C:\WINDOWS\system32\byxyvvt.dll
2006-11-18 23:19 <DIR> d--hs---- C:\FOUND.001
2006-11-18 22:14 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Symantec
2006-11-18 07:08 12,288 --a------ C:\WINDOWS\system32\impborl.dll
2006-11-18 07:06 <DIR> d---s---- C:\Documents and Settings\My PC\UserData
2006-11-17 21:52 22,752 --a------ C:\WINDOWS\system32\spupdsvc.exe
2006-11-17 21:52 <DIR> d--h----- C:\WINDOWS\$hf_mig$
2006-11-17 21:52 <DIR> d-------- C:\WINDOWS\system32\PreInstall
2006-11-17 21:50 40,973 ---hs---- C:\WINDOWS\system32\yayawvt.dll
2006-11-17 20:53 <DIR> d-------- C:\WINDOWS\system32\SoftwareDistribution
2006-11-17 20:08 221,184 --a------ C:\WINDOWS\system32\wmpns.dll
2006-11-17 19:55 <DIR> d-------- C:\Documents and Settings\My PC\Shared
2006-11-17 19:55 <DIR> d-------- C:\Documents and Settings\My PC\Incomplete
2006-11-17 19:51 <DIR> d-------- C:\Documents and Settings\My PC\Application Data\LimeWire
2006-11-17 19:47 <DIR> d-------- C:\Program Files\Java
2006-11-17 19:46 <DIR> d-------- C:\Program Files\Common Files\Java
2006-11-17 19:45 <DIR> d-------- C:\Program Files\LimeWire
2006-11-17 19:43 <DIR> d-------- C:\My Downloads
2006-11-17 18:59 <DIR> d-------- C:\Documents and Settings\My PC\Application Data\Macromedia
2006-11-17 17:58 <DIR> d-------- C:\Documents and Settings\My PC\Application Data\SearchToolbarCorp
2006-11-17 17:22 196,608 --a------ C:\WINDOWS\system32\RtlLib.dll
2006-11-17 17:22 155,648 --a------ C:\WINDOWS\system32\IpLib.dll
2006-11-17 17:22 13,532 --a------ C:\WINDOWS\system32\drivers\SjyPkt.sys
2006-11-17 17:22 126,976 --a------ C:\WINDOWS\system32\EnumDevLib.dll
2006-11-17 17:22 108,160 --a------ C:\WINDOWS\system32\drivers\wg111v2.sys
2006-11-17 17:22 <DIR> d-------- C:\WINDOWS\OPTIONS
2006-11-17 17:15 59,136 --a------ C:\WINDOWS\system32\drivers\EAPPkt.sys
2006-11-17 17:15 <DIR> d-------- C:\Program Files\NETGEAR
2006-11-17 17:09 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy
2006-11-17 17:09 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2006-11-17 17:07 499,712 --a------ C:\WINDOWS\system32\msvcp71.dll
2006-11-17 17:07 348,160 --a------ C:\WINDOWS\system32\msvcr71.dll
2006-11-17 17:07 1,060,864 --a------ C:\WINDOWS\system32\MFC71.dll
2006-11-17 17:03 86,016 -ra------ C:\WINDOWS\system32\CNMCP6e.exe
2006-11-17 17:03 7,680 --a------ C:\WINDOWS\system32\CNMVS6e.DLL
2006-11-17 17:03 116,736 --------- C:\WINDOWS\system32\CNMLM6e.DLL
2006-11-17 17:03 <DIR> d--hs---- C:\FOUND.000
2006-11-17 17:03 <DIR> d--h----- C:\BJPrinter
2006-11-17 17:02 <DIR> d-------- C:\WINDOWS\StartHtmico
2006-11-17 17:02 <DIR> d-------- C:\WINDOWS\IP1000
2006-11-17 17:01 <DIR> d-------- C:\Program Files\Canon
2006-11-17 16:58 25,856 --a------ C:\WINDOWS\system32\drivers\usbprint.sys
2006-11-17 16:55 110,612 --a------ C:\WINDOWS\system32\assqmddj.exe
2006-11-17 16:54 12,160 --a------ C:\WINDOWS\system32\drivers\mouhid.sys
2006-11-17 16:53 9,600 --a------ C:\WINDOWS\system32\drivers\hidusb.sys
2006-11-17 16:50 <DIR> d--hs---- C:\Recycled
2006-11-17 16:49 40,973 ---hs---- C:\WINDOWS\system32\byxxvtt.dll
2006-11-17 16:49 2 --a------ C:\WINDOWS\system32\wapisvtr.exe
2006-11-16 18:48 <DIR> d-------- C:\WINDOWS\Prefetch
2006-11-16 18:18 7,552 --a------ C:\WINDOWS\system32\drivers\MSKSSRV.sys
2006-11-16 18:18 6,400 --a------ C:\WINDOWS\system32\drivers\splitter.sys
2006-11-16 18:18 52,864 --a------ C:\WINDOWS\system32\drivers\DMusic.sys
2006-11-16 18:18 5,376 --a------ C:\WINDOWS\system32\drivers\MSPCLOCK.sys
2006-11-16 18:18 4,992 --a------ C:\WINDOWS\system32\drivers\MSPQM.sys
2006-11-16 18:17 4,274,816 --a------ C:\WINDOWS\system32\nv4_disp.dll
2006-11-16 18:17 10,624 --a------ C:\WINDOWS\system32\drivers\gameenum.sys
2006-11-16 18:17 1,897,408 --a------ C:\WINDOWS\system32\drivers\nv4_mini.sys
2006-11-16 18:16 84,480 --a------ C:\WINDOWS\system32\drivers\ac97via.sys
2006-11-16 18:16 4,096 --a------ C:\WINDOWS\system32\ksuser.dll
2006-11-16 18:12 24,661 --a------ C:\WINDOWS\system32\spxcoins.dll
2006-11-16 18:12 13,312 --a------ C:\WINDOWS\system32\irclass.dll

(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))

2006-11-20 07:46 17144 --a------ C:\Documents and Settings\My PC\Application Data\GDIPFONTCACHEV1.DAT
2006-10-13 23:35 65536 --a------ C:\WINDOWS\system32\nwwks.dll
2006-10-13 23:35 64000 --a------ C:\WINDOWS\system32\nwapi32.dll
2006-10-13 23:35 142336 --a------ C:\WINDOWS\system32\nwprovau.dll
2006-10-13 21:23 163584 --a------ C:\WINDOWS\system32\drivers\nwrdr.sys
2006-09-13 16:01 1084416 --a------ C:\WINDOWS\system32\msxml3.dll

(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries are not shown

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"MSMSGS"="\"C:\\Program Files\\Messenger\\msmsgs.exe\" /background"
"ctfmon.exe"="C:\\WINDOWS\\system32\\ctfmon.exe"
"Uuir"="\"C:\\PROGRA~1\\COMMON~1\\WNSXS~1\\fast.exe\" -vt tzt"
"Bwcpgrj"="C:\\Program Files\\Common Files\\??mbols\\??rss.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"NeroCheck"="C:\\WINDOWS\\system32\\NeroCheck.exe"
"RtWLan"="C:\\Program Files\\NETGEAR\\WG111v2 Configuration Utility\\RtWLan.exe /H"
"tnziiib.dll"="C:\\WINDOWS\\system32\\rundll32.exe C:\\WINDOWS\\system32\\tnziiib.dll,xeokrvd"
"SunJavaUpdateSched"="\"C:\\Program Files\\Java\\jre1.5.0_08\\bin\\jusched.exe\""
"cqjkpwk.dll"="C:\\WINDOWS\\system32\\rundll32.exe C:\\WINDOWS\\system32\\cqjkpwk.dll,kghdbsf"
"KernelFaultCheck"=hex(2):25,73,79,73,74,65,6d,72,6f,6f,74,25,5c,73,79,73,74,\
65,6d,33,32,5c,64,75,6d,70,72,65,70,20,30,20,2d,6b,00
"vvdkkpe.dll"="C:\\WINDOWS\\system32\\rundll32.exe C:\\WINDOWS\\system32\\vvdkkpe.dll,agkxvbc"
"!AVG Anti-Spyware"="\"C:\\Program Files\\Grisoft\\AVG Anti-Spyware 7.5\\avgas.exe\" /minimized"
"AVG7_CC"="C:\\PROGRA~1\\Grisoft\\AVGFRE~1\\avgcc.exe /STARTUP"
"CTDrive"="rundll32.exe C:\\WINDOWS\\system32\\drvsov.dll,startup"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL]
"Installed"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI]
"Installed"="1"
"NoChange"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS]
"Installed"="1"

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components]
"DeskHtmlVersion"=dword:00000110
"DeskHtmlMinorVersion"=dword:00000005
"Settings"=dword:00000001
"GeneralFlags"=dword:00000001

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="My Current Home Page"
"Flags"=dword:00000002
"Position"=hex:2c,00,00,00,00,01,00,00,00,00,00,00,00,04,00,00,a2,03,00,00,00,\
00,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00
"CurrentState"=hex:04,00,00,40
"OriginalStateInfo"=hex:18,00,00,00,ff,ff,00,00,ff,ff,00,00,ff,ff,ff,ff,ff,ff,\
ff,ff,04,00,00,00
"RestoredStateInfo"=hex:18,00,00,00,6a,02,00,00,23,00,00,00,a4,00,00,00,9a,00,\
00,00,01,00,00,00

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"AVG7_Run"="C:\\PROGRA~1\\Grisoft\\AVGFRE~1\\avgw.exe /RUNONCE"

[HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce]
"tscuninstall"=hex(2):25,73,79,73,74,65,6d,72,6f,6f,74,25,5c,73,79,73,74,65,6d,\
33,32,5c,74,73,63,75,70,67,72,64,2e,65,78,65,00
"nLite"=hex(2):25,73,79,73,74,65,6d,72,6f,6f,74,25,5c,69,6e,66,5c,6e,6c,69,74,\
65,2e,63,6d,64,00

[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\run]
"AVG7_Run"="C:\\PROGRA~1\\Grisoft\\AVGFRE~1\\avgw.exe /RUNONCE"

[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\runonce]
"tscuninstall"=hex(2):25,73,79,73,74,65,6d,72,6f,6f,74,25,5c,73,79,73,74,65,6d,\
33,32,5c,74,73,63,75,70,67,72,64,2e,65,78,65,00
"nLite"=hex(2):25,73,79,73,74,65,6d,72,6f,6f,74,25,5c,69,6e,66,5c,6e,6c,69,74,\
65,2e,63,6d,64,00

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler]
"{0bad5052-665d-40d4-a9bd-a2891eaafb42}"="boucicault"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{AEB6717E-7E19-11d0-97EE-00C04FD91972}"=""
"{CFE9E8A8-38C0-4EF8-AEC2-5035EFE81030}"=""
"{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="AVG Anti-Spyware 7.5"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\Run]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"NoInternetOpenWith"=dword:00000001
"dontdisplaylastusername"=dword:00000000
"legalnoticecaption"=""
"legalnoticetext"=""
"shutdownwithoutlogon"=dword:00000001
"undockwithoutlogon"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"ForceClassicControlPanel"=dword:00000001

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload]
"PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}"
"CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}"
"WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"
"SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}"
"cussers"="{ff170564-36c8-43f7-9100-559e166405cf}"
"boucicault"="{0bad5052-665d-40d4-a9bd-a2891eaafb42}"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll"

Completion time: 06-11-28 17:03:39.38
C:\ComboFix.txt ... 06-11-28 17:03

--------------------

here is the AVG A/S scan::

--------------------

---------------------------------------------------------
AVG Anti-Spyware - Scan Report
---------------------------------------------------------

+ Created at: 6:02:05 PM 28/11/2006

+ Scan result:

C:\System Volume Information\_restore{C4EE6BC2-8580-4263-BB6A-CC8A87B1926A}\RP9\A0003395.dll -> Adware.Agent : Cleaned with backup (quarantined).
HKU\S-1-5-21-790525478-746137067-725345543-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{052B12F7-86FA-4921-8482-26C42316B522} -> Adware.Generic : Cleaned with backup (quarantined).
HKU\S-1-5-21-790525478-746137067-725345543-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{39F25B12-74FF-4079-A51F-1D70F5B08B84} -> Adware.Generic : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{C4EE6BC2-8580-4263-BB6A-CC8A87B1926A}\RP18\A0006970.exe -> Adware.Maxifiles : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{C4EE6BC2-8580-4263-BB6A-CC8A87B1926A}\RP10\A0003406.dll -> Adware.PurityScan : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{C4EE6BC2-8580-4263-BB6A-CC8A87B1926A}\RP11\A0005523.dll -> Adware.PurityScan : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{C4EE6BC2-8580-4263-BB6A-CC8A87B1926A}\RP17\A0006925.dll -> Adware.PurityScan : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{C4EE6BC2-8580-4263-BB6A-CC8A87B1926A}\RP6\A0001249.dll -> Adware.PurityScan : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{C4EE6BC2-8580-4263-BB6A-CC8A87B1926A}\RP7\A0001506.dll -> Adware.PurityScan : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{C4EE6BC2-8580-4263-BB6A-CC8A87B1926A}\RP9\A0001903.DLL -> Adware.PurityScan : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{C4EE6BC2-8580-4263-BB6A-CC8A87B1926A}\RP9\A0003003.dll -> Adware.PurityScan : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{C4EE6BC2-8580-4263-BB6A-CC8A87B1926A}\RP10\A0003420.exe -> Adware.Softomate : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{C4EE6BC2-8580-4263-BB6A-CC8A87B1926A}\RP10\A0003421.exe -> Adware.Softomate : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{C4EE6BC2-8580-4263-BB6A-CC8A87B1926A}\RP11\A0005555.dll -> Adware.Softomate : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{C4EE6BC2-8580-4263-BB6A-CC8A87B1926A}\RP11\A0005556.exe -> Adware.Softomate : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{C4EE6BC2-8580-4263-BB6A-CC8A87B1926A}\RP11\A0005557.exe -> Adware.Softomate : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{C4EE6BC2-8580-4263-BB6A-CC8A87B1926A}\RP11\A0005570.exe -> Adware.Softomate : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{C4EE6BC2-8580-4263-BB6A-CC8A87B1926A}\RP11\A0005571.dll -> Adware.Softomate : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{C4EE6BC2-8580-4263-BB6A-CC8A87B1926A}\RP11\A0005572.exe -> Adware.Softomate : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{C4EE6BC2-8580-4263-BB6A-CC8A87B1926A}\RP11\A0005574.exe -> Adware.Softomate : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{C4EE6BC2-8580-4263-BB6A-CC8A87B1926A}\RP11\A0005575.exe -> Adware.Softomate : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{C4EE6BC2-8580-4263-BB6A-CC8A87B1926A}\RP11\A0005576.dll -> Adware.Softomate : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{C4EE6BC2-8580-4263-BB6A-CC8A87B1926A}\RP17\A0006856.dll -> Adware.Softomate : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{C4EE6BC2-8580-4263-BB6A-CC8A87B1926A}\RP17\A0006857.exe -> Adware.Softomate : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{C4EE6BC2-8580-4263-BB6A-CC8A87B1926A}\RP17\A0006858.exe -> Adware.Softomate : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{C4EE6BC2-8580-4263-BB6A-CC8A87B1926A}\RP17\A0006907.exe -> Adware.Softomate : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{C4EE6BC2-8580-4263-BB6A-CC8A87B1926A}\RP18\A0006959.exe -> Adware.Softomate : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{C4EE6BC2-8580-4263-BB6A-CC8A87B1926A}\RP18\A0006960.dll -> Adware.Softomate : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{C4EE6BC2-8580-4263-BB6A-CC8A87B1926A}\RP6\A0001328.exe -> Adware.Softomate : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{C4EE6BC2-8580-4263-BB6A-CC8A87B1926A}\RP9\A0002925.exe -> Adware.Softomate : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{C4EE6BC2-8580-4263-BB6A-CC8A87B1926A}\RP9\A0003398.exe -> Adware.Softomate : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{C4EE6BC2-8580-4263-BB6A-CC8A87B1926A}\RP9\A0003399.dll -> Adware.Softomate : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{C4EE6BC2-8580-4263-BB6A-CC8A87B1926A}\RP18\A0006950.DLL -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\system32\byxxvtt.dll -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\system32\byxyvvt.dll -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\system32\efcyyab.dll -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\system32\jkkhfge.dll -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\system32\opnkkjg.dll -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\system32\yayawvt.dll -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{C4EE6BC2-8580-4263-BB6A-CC8A87B1926A}\RP9\A0003396.exe -> Adware.VirusBurst.c : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Classes\Interface\{898272CF-3ACE-4A7B-98FA-9EB8DB8B26DC} -> Adware.VirusBursters : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{C4EE6BC2-8580-4263-BB6A-CC8A87B1926A}\RP17\A0006917.ini -> Adware.VirusRescue : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{C4EE6BC2-8580-4263-BB6A-CC8A87B1926A}\RP17\A0006919.tlb -> Adware.VirusRescue : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{C4EE6BC2-8580-4263-BB6A-CC8A87B1926A}\RP17\A0006920.exe -> Adware.VirusRescue : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{C4EE6BC2-8580-4263-BB6A-CC8A87B1926A}\RP17\A0006931.ini -> Adware.VirusRescue : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{C4EE6BC2-8580-4263-BB6A-CC8A87B1926A}\RP18\A0006994.dll -> Adware.VirusRescue : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{C4EE6BC2-8580-4263-BB6A-CC8A87B1926A}\RP18\A0007027.exe -> Downloader.PurityScan.dc : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{C4EE6BC2-8580-4263-BB6A-CC8A87B1926A}\RP6\A0001459.dll -> Downloader.Zlob.akg : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{C4EE6BC2-8580-4263-BB6A-CC8A87B1926A}\RP18\A0007025.dll -> Not-A-Virus.Hoax.Win32.Renos.fa : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{C4EE6BC2-8580-4263-BB6A-CC8A87B1926A}\RP18\A0007026.dll -> Not-A-Virus.Hoax.Win32.Renos.fa : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{C4EE6BC2-8580-4263-BB6A-CC8A87B1926A}\RP18\A0007023.dll -> Not-A-Virus.Hoax.Win32.Renos.fw : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{C4EE6BC2-8580-4263-BB6A-CC8A87B1926A}\RP18\A0007022.dll -> Trojan.Agent.neq : Cleaned with backup (quarantined).

::Report end

----------------------------

here is the rapport.txt from Smitfraud::

---------------------------

SmitFraudFix v2.125

Scan done at 17:21:46.87, Tue 28/11/2006
Run from C:\Documents and Settings\My PC\Desktop\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
Fix run in safe mode

»»»»»»»»»»»»»»»»»»»»»»»» Before SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{0bad5052-665d-40d4-a9bd-a2891eaafb42}"="boucicault"

[HKEY_CLASSES_ROOT\CLSID\{0bad5052-665d-40d4-a9bd-a2891eaafb42}\InProcServer32]
@="C:\WINDOWS\system32\fmrmhc.dll"

[HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{0bad5052-665d-40d4-a9bd-a2891eaafb42}\InProcServer32]
@="C:\WINDOWS\system32\fmrmhc.dll"

»»»»»»»»»»»»»»»»»»»»»»»» Killing process

»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

GenericRenosFix by S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files

C:\WINDOWS\.protected Deleted
C:\DOCUME~1\MYPC~1\FAVORI~1\Antivirus Test Online.url Deleted
C:\DOCUME~1\MYPC~1\STARTM~1\PROGRAMS\STARTUP\.protected Deleted
C:\DOCUME~1\ALLUSE~1\STARTM~1\Online Security Guide.url Deleted
C:\DOCUME~1\ALLUSE~1\STARTM~1\Security Troubleshooting.url Deleted
C:\DOCUME~1\ALLUSE~1\STARTM~1\PROGRAMS\STARTUP\.protected Deleted

»»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files

»»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning

Registry Cleaning done.

»»»»»»»»»»»»»»»»»»»»»»»» After SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» End

-------------------------------

here is the combofix.txt the second time running::

-------------------------------

My PC - 06-11-28 18:55:19.84 Service Pack 2
ComboFix 06.11.27W - Running from: "C:\Documents and Settings\My PC\Desktop"

(((((((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ Purity ~ ~ ~ ~ ~ ~ ~ ~~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~

Folders Quarantined:

C:\QooBox\Purity\Program Files\Common Files\MBOLS~1
C:\QooBox\Purity\Program Files\Common Files\MBOLS~1\??rss_exe.vir
C:\QooBox\Purity\Documents and Settings\My PC\Application Data\àPPATC~1

((((((((((((((((((((((((((((((( Files Created from 2006-10-28 to 2006-11-28 ))))))))))))))))))))))))))))))))))

2006-11-28 18:20 <DIR> d-------- C:\WINDOWS\system32\ActiveScan
2006-11-28 18:20 <DIR> d-------- C:\WINDOWS\LastGood
2006-11-28 17:21 53,248 --a------ C:\WINDOWS\system32\Process.exe
2006-11-28 17:21 40,960 --a------ C:\WINDOWS\system32\swsc.exe
2006-11-28 17:21 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe
2006-11-28 17:21 135,168 --a------ C:\WINDOWS\system32\swreg.exe
2006-11-27 21:27 <DIR> d-------- C:\Program Files\CleanUp!
2006-11-27 21:20 <DIR> dr-h----- C:\$VAULT$.AVG
2006-11-27 21:11 71,168 --a------ C:\WINDOWS\system32\drvsov.dll
2006-11-27 21:11 40,973 ---hs---- C:\WINDOWS\system32\rqroopo.dll
2006-11-27 19:19 <DIR> d-------- C:\Documents and Settings\My PC\Application Data\AVG7
2006-11-27 19:08 816,672 --a------ C:\WINDOWS\system32\drivers\avg7core.sys
2006-11-27 19:08 4,960 --a------ C:\WINDOWS\system32\drivers\avgtdi.sys
2006-11-27 19:08 4,224 --a------ C:\WINDOWS\system32\drivers\avg7rsw.sys
2006-11-27 19:08 3,968 --a------ C:\WINDOWS\system32\drivers\avgclean.sys
2006-11-27 19:08 28,416 --a------ C:\WINDOWS\system32\drivers\avg7rsxp.sys
2006-11-27 19:08 18,240 --a------ C:\WINDOWS\system32\drivers\avgmfx86.sys
2006-11-27 19:08 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
2006-11-27 19:08 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\avg7
2006-11-25 09:18 3,968 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2006-11-25 09:17 <DIR> d-------- C:\Program Files\Grisoft
2006-11-22 23:24 <DIR> d-------- C:\HijackThis
2006-11-22 00:05 <DIR> d--hs---- C:\FOUND.003
2006-11-19 23:56 <DIR> d-------- C:\WINDOWS\Minidump
2006-11-19 23:55 <DIR> d--hs---- C:\FOUND.002
2006-11-19 08:58 <DIR> d---s---- C:\WINDOWS\system32\Microsoft
2006-11-19 06:05 <DIR> d-------- C:\WINDOWS\system32\CatRoot2
2006-11-19 06:05 <DIR> d-------- C:\WINDOWS\system32\CatRoot
2006-11-19 04:08 <DIR> d-------- C:\WINDOWS\system32\àdobe
2006-11-18 23:19 <DIR> d--hs---- C:\FOUND.001
2006-11-18 22:14 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Symantec
2006-11-18 07:08 12,288 --a------ C:\WINDOWS\system32\impborl.dll
2006-11-18 07:06 <DIR> d---s---- C:\Documents and Settings\My PC\UserData
2006-11-17 21:52 22,752 --a------ C:\WINDOWS\system32\spupdsvc.exe
2006-11-17 21:52 <DIR> d--h----- C:\WINDOWS\$hf_mig$
2006-11-17 21:52 <DIR> d-------- C:\WINDOWS\system32\PreInstall
2006-11-17 20:53 <DIR> d-------- C:\WINDOWS\system32\SoftwareDistribution
2006-11-17 20:08 221,184 --a------ C:\WINDOWS\system32\wmpns.dll
2006-11-17 19:55 <DIR> d-------- C:\Documents and Settings\My PC\Shared
2006-11-17 19:55 <DIR> d-------- C:\Documents and Settings\My PC\Incomplete
2006-11-17 19:51 <DIR> d-------- C:\Documents and Settings\My PC\Application Data\LimeWire
2006-11-17 19:47 <DIR> d-------- C:\Program Files\Java
2006-11-17 19:46 <DIR> d-------- C:\Program Files\Common Files\Java
2006-11-17 19:45 <DIR> d-------- C:\Program Files\LimeWire
2006-11-17 19:43 <DIR> d-------- C:\My Downloads
2006-11-17 18:59 <DIR> d-------- C:\Documents and Settings\My PC\Application Data\Macromedia
2006-11-17 17:58 <DIR> d-------- C:\Documents and Settings\My PC\Application Data\SearchToolbarCorp
2006-11-17 17:22 196,608 --a------ C:\WINDOWS\system32\RtlLib.dll
2006-11-17 17:22 155,648 --a------ C:\WINDOWS\system32\IpLib.dll
2006-11-17 17:22 13,532 --a------ C:\WINDOWS\system32\drivers\SjyPkt.sys
2006-11-17 17:22 126,976 --a------ C:\WINDOWS\system32\EnumDevLib.dll
2006-11-17 17:22 108,160 --a------ C:\WINDOWS\system32\drivers\wg111v2.sys
2006-11-17 17:22 <DIR> d-------- C:\WINDOWS\OPTIONS
2006-11-17 17:15 59,136 --a------ C:\WINDOWS\system32\drivers\EAPPkt.sys
2006-11-17 17:15 <DIR> d-------- C:\Program Files\NETGEAR
2006-11-17 17:09 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy
2006-11-17 17:09 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2006-11-17 17:07 499,712 --a------ C:\WINDOWS\system32\msvcp71.dll
2006-11-17 17:07 348,160 --a------ C:\WINDOWS\system32\msvcr71.dll
2006-11-17 17:07 1,060,864 --a------ C:\WINDOWS\system32\MFC71.dll
2006-11-17 17:03 86,016 -ra------ C:\WINDOWS\system32\CNMCP6e.exe
2006-11-17 17:03 7,680 --a------ C:\WINDOWS\system32\CNMVS6e.DLL
2006-11-17 17:03 116,736 --------- C:\WINDOWS\system32\CNMLM6e.DLL
2006-11-17 17:03 <DIR> d--hs---- C:\FOUND.000
2006-11-17 17:03 <DIR> d--h----- C:\BJPrinter
2006-11-17 17:02 <DIR> d-------- C:\WINDOWS\StartHtmico
2006-11-17 17:02 <DIR> d-------- C:\WINDOWS\IP1000
2006-11-17 17:01 <DIR> d-------- C:\Program Files\Canon
2006-11-17 16:58 25,856 --a------ C:\WINDOWS\system32\drivers\usbprint.sys
2006-11-17 16:55 110,612 --a------ C:\WINDOWS\system32\assqmddj.exe
2006-11-17 16:54 12,160 --a------ C:\WINDOWS\system32\drivers\mouhid.sys
2006-11-17 16:53 9,600 --a------ C:\WINDOWS\system32\drivers\hidusb.sys
2006-11-17 16:50 <DIR> d--hs---- C:\Recycled
2006-11-17 16:49 2 --a------ C:\WINDOWS\system32\wapisvtr.exe
2006-11-16 18:48 <DIR> d-------- C:\WINDOWS\Prefetch
2006-11-16 18:18 7,552 --a------ C:\WINDOWS\system32\drivers\MSKSSRV.sys
2006-11-16 18:18 6,400 --a------ C:\WINDOWS\system32\drivers\splitter.sys
2006-11-16 18:18 52,864 --a------ C:\WINDOWS\system32\drivers\DMusic.sys
2006-11-16 18:18 5,376 --a------ C:\WINDOWS\system32\drivers\MSPCLOCK.sys
2006-11-16 18:18 4,992 --a------ C:\WINDOWS\system32\drivers\MSPQM.sys
2006-11-16 18:17 4,274,816 --a------ C:\WINDOWS\system32\nv4_disp.dll
2006-11-16 18:17 10,624 --a------ C:\WINDOWS\system32\drivers\gameenum.sys
2006-11-16 18:17 1,897,408 --a------ C:\WINDOWS\system32\drivers\nv4_mini.sys
2006-11-16 18:16 84,480 --a------ C:\WINDOWS\system32\drivers\ac97via.sys
2006-11-16 18:16 4,096 --a------ C:\WINDOWS\system32\ksuser.dll
2006-11-16 18:12 24,661 --a------ C:\WINDOWS\system32\spxcoins.dll
2006-11-16 18:12 13,312 --a------ C:\WINDOWS\system32\irclass.dll

(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))

2006-11-20 07:46 17144 --a------ C:\Documents and Settings\My PC\Application Data\GDIPFONTCACHEV1.DAT
2006-10-13 23:35 65536 --a------ C:\WINDOWS\system32\nwwks.dll
2006-10-13 23:35 64000 --a------ C:\WINDOWS\system32\nwapi32.dll
2006-10-13 23:35 142336 --a------ C:\WINDOWS\system32\nwprovau.dll
2006-10-13 21:23 163584 --a------ C:\WINDOWS\system32\drivers\nwrdr.sys
2006-09-13 16:01 1084416 --a------ C:\WINDOWS\system32\msxml3.dll

(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries are not shown

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"MSMSGS"="\"C:\\Program Files\\Messenger\\msmsgs.exe\" /background"
"ctfmon.exe"="C:\\WINDOWS\\system32\\ctfmon.exe"
"Uuir"="\"C:\\PROGRA~1\\COMMON~1\\WNSXS~1\\fast.exe\" -vt tzt"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"NeroCheck"="C:\\WINDOWS\\system32\\NeroCheck.exe"
"RtWLan"="C:\\Program Files\\NETGEAR\\WG111v2 Configuration Utility\\RtWLan.exe /H"
"SunJavaUpdateSched"="\"C:\\Program Files\\Java\\jre1.5.0_08\\bin\\jusched.exe\""
"KernelFaultCheck"=hex(2):25,73,79,73,74,65,6d,72,6f,6f,74,25,5c,73,79,73,74,\
65,6d,33,32,5c,64,75,6d,70,72,65,70,20,30,20,2d,6b,00
"!AVG Anti-Spyware"="\"C:\\Program Files\\Grisoft\\AVG Anti-Spyware 7.5\\avgas.exe\" /minimized"
"AVG7_CC"="C:\\PROGRA~1\\Grisoft\\AVGFRE~1\\avgcc.exe /STARTUP"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL]
"Installed"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI]
"Installed"="1"
"NoChange"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS]
"Installed"="1"

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components]
"DeskHtmlVersion"=dword:00000110
"DeskHtmlMinorVersion"=dword:00000005
"Settings"=dword:00000001
"GeneralFlags"=dword:00000000

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"AVG7_Run"="C:\\PROGRA~1\\Grisoft\\AVGFRE~1\\avgw.exe /RUNONCE"

[HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce]
"tscuninstall"=hex(2):25,73,79,73,74,65,6d,72,6f,6f,74,25,5c,73,79,73,74,65,6d,\
33,32,5c,74,73,63,75,70,67,72,64,2e,65,78,65,00
"nLite"=hex(2):25,73,79,73,74,65,6d,72,6f,6f,74,25,5c,69,6e,66,5c,6e,6c,69,74,\
65,2e,63,6d,64,00

[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\run]
"AVG7_Run"="C:\\PROGRA~1\\Grisoft\\AVGFRE~1\\avgw.exe /RUNONCE"

[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\runonce]
"tscuninstall"=hex(2):25,73,79,73,74,65,6d,72,6f,6f,74,25,5c,73,79,73,74,65,6d,\
33,32,5c,74,73,63,75,70,67,72,64,2e,65,78,65,00
"nLite"=hex(2):25,73,79,73,74,65,6d,72,6f,6f,74,25,5c,69,6e,66,5c,6e,6c,69,74,\
65,2e,63,6d,64,00

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{AEB6717E-7E19-11d0-97EE-00C04FD91972}"=""
"{CFE9E8A8-38C0-4EF8-AEC2-5035EFE81030}"=""
"{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="AVG Anti-Spyware 7.5"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\Run]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"NoInternetOpenWith"=dword:00000001
"dontdisplaylastusername"=dword:00000000
"legalnoticecaption"=""
"legalnoticetext"=""
"shutdownwithoutlogon"=dword:00000001
"undockwithoutlogon"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"ForceClassicControlPanel"=dword:00000001

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload]
"PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}"
"CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}"
"WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"
"SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll"

Completion time: 06-11-28 18:56:21.24
C:\ComboFix2.txt ... 06-11-28 17:03
C:\ComboFix.txt ... 06-11-28 18:56

----------------------------

and finally the new HJT log in normal mode::

---------------------------

Logfile of HijackThis v1.99.1
Scan saved at 6:58:35 PM, on 28/11/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\Java\jre1.5.0_08\bin\jusched.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\NETGEAR\WG111v2 Configuration Utility\RtlWake.exe
C:\Program Files\LimeWire\LimeWire.exe
C:\HijackThis\filo.exe

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {2C2CC20D-65BF-46E6-94CA-D2BB81A38D12} - C:\WINDOWS\system32\ssqqr.dll (file missing)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
O2 - BHO: (no name) - {CFE9E8A8-38C0-4EF8-AEC2-5035EFE81030} - C:\WINDOWS\system32\ljjjkhh.dll (file missing)
O2 - BHO: (no name) - {D7634C49-8AAF-F370-DEDF-A728EA7B67CD} - C:\WINDOWS\system32\ybtxw.dll (file missing)
O2 - BHO: (no name) - {F18F04B0-9CF1-4b93-B004-77A288BEE28B} - C:\WINDOWS\system32\ioceuskd.dll (file missing)
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [RtWLan] C:\Program Files\NETGEAR\WG111v2 Configuration Utility\RtWLan.exe /H
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_08\bin\jusched.exe"
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Uuir] "C:\PROGRA~1\COMMON~1\WNSXS~1\fast.exe" -vt tzt
O4 - Startup: LimeWire On Startup.lnk = C:\Program Files\LimeWire\LimeWire.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: WG111v2 Smart Wizard Wireless Setting.lnk = C:\Program Files\NETGEAR\WG111v2 Configuration Utility\RtlWake.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~1\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)

-------------------------

and thats everything you asked me to post ..
the computer is working faster than before and the popups are not coming up anymore! =D But i think there are still some viruses still left inside my computer when i ran the panda scan .. but thanks for everything so far, you've been a great help!

fredmh · 11-28-2006, 07:30 AM

Good. Could you please post the Panda Scan Log

filo_romz · 11-28-2006, 01:22 PM

This is the panda scan log::
--------------------------

Incident
Status Location

Spyware:Spyware/Virtumonde
Not disinfected C:\WINDOWS\system32\rqroopo.dll
Adware:Adware/Adservice
Not disinfected C:\WINDOWS\system32\drvsov.dll
Potentially unwanted tool:Application/Processor
Not disinfected C:\WINDOWS\system32\Process.exe
Potentially unwanted tool:Application/VSToolbar
Not disinfected C:\WINDOWS\system32\assqmddj.exe
Potentially unwanted tool:Application/VirusBursters
Not disinfected C:\FOUND.000\FILE0010.CHK[VirusBursters.exe]
Potentially unwanted tool:Application/VirusBursters
Not disinfected C:\FOUND.000\FILE0012.CHK
Virus:Trj/Disablekey.AP
Disinfected C:\Documents and Settings\My PC\Local
Settings\Application Data\vvdkkpe.dll
Virus:Trj/Disablekey.AP
Disinfected C:\Documents and Settings\My PC\Local
Settings\Application Data\vorenbj.dll
Potentially unwanted tool:Application/Processor
Not disinfected C:\Documents and Settings\My
PC\Desktop\SmitfraudFix.zip[SmitfraudFix/Process.exe]
Potentially unwanted tool:Application/Processor
Not disinfected C:\Documents and Settings\My
PC\Desktop\SmitfraudFix\Process.exe
Spyware:Cookie/Serving-sys
Not disinfected C:\Documents and Settings\My PC\Cookies\my
pc@serving-sys[1].txt
Possible Virus.
Renamed C:\QooBox\Purity\Program Files\Common
Files\MBOLS~1\??rss.exe

----------------
i think the 888 smitfraud toolbar is still there.. ><

fredmh · 11-28-2006, 04:02 PM

What symptoms do you have for the 888 smitfraud toolbar ?

fredmh · 11-28-2006, 09:44 PM

Please read this post completely before begining the fix. If there's anything that you do not understand, kindly ask your questions before proceeding.
Please ensure that there aren't any opened browsers when you are carrying out the procedures below. Save the following instructions in Notepad as this
webpage would not be available when you're carrying out the fix.

IT IS IMPORTANT THAT YOU DON'T MISS A STEP & PERFORM EVERYTHING IN THE RIGHT ORDER.

----------------------------------------

DOWNLOADS

FIXES AND DELETIONS

Open HijackThis and click on 'Do a System Scan Only'. Check the following entries (If they still exist, make sure you do not miss any)

O2 - BHO: (no name) - {2C2CC20D-65BF-46E6-94CA-D2BB81A38D12} - C:\WINDOWS\system32\ssqqr.dll (file missing)
O2 - BHO: (no name) - {CFE9E8A8-38C0-4EF8-AEC2-5035EFE81030} - C:\WINDOWS\system32\ljjjkhh.dll (file missing)
O2 - BHO: (no name) - {D7634C49-8AAF-F370-DEDF-A728EA7B67CD} - C:\WINDOWS\system32\ybtxw.dll (file missing)
O2 - BHO: (no name) - {F18F04B0-9CF1-4b93-B004-77A288BEE28B} - C:\WINDOWS\system32\ioceuskd.dll (file missing)
O4 - HKCU\..\Run: [Uuir] "C:\PROGRA~1\COMMON~1\WNSXS~1\fast.exe" -vt tzt
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)

Please remember to close all other windows, including browsers then click Fix checked.

----------------------------------------

SAFE MODE RE-BOOT

Please reboot your computer in Safe Mode by doing the following:
1) Restart your computer
2) After hearing your computer beep once during startup, but before the Windows icon appears, press F8.
3) Instead of Windows loading as normal, a menu should appear
4) Use the up arrow key to highlight Safe Mode and press Enter.
5) Login with your usual account. Make sure to close any open browsers.

----------------------------------------

UNHIDE HIDDEN FILES

Go to My Computer->Tools->Folder Options->View tab:
* Under the Hidden files and folders heading, select Show hidden files and folders.
* Uncheck the Hide protected operating system files (recommended) option.
* Also make sure there is no checkmark beside Hide file extensions for known file types
* Click Yes to confirm and then click OK.

----------------------------------------
Delete the following Files indicated in RED and Folders indicated in BLUE if they still exist.

C:\WINDOWS\system32\drvsov.dll
C:\WINDOWS\system32\rqroopo.dll
C:\WINDOWS\system32\wapisvtr.exe
C:\WINDOWS\system32\assqmddj.exe

C:\Documents and Settings\My PC\Local Settings\Application Data\vvdkkpe.dll
C:\Documents and Settings\My PC\Local Settings\Application Data\vorenbj.dll

C:\FOUND.003
C:\FOUND.002
C:\FOUND.001
C:\FOUND.000

C:\Documents and Settings\My PC\Application Data\SearchToolbarCorp
C:\QooBox
----------------------------------------

SYSTEM RE-BOOT

Reboot into Normal Mode.

----------------------------------------

ON-LINE SCANS

Kaspersky - Extended

Establish an internet connection & perform an online scan with Internet Explorer at Kaspersky Online Scanner

Answer Yes, when prompted to install an ActiveX component.

The program will then begin downloading the latest definition files.
Once the files have been downloaded click on NEXT
Locate the Scan Settings button & configure to:
- Scan using the following Anti-Virus database:
  - Extended
- Scan Options:
  - Scan Archives
  - Scan Mail Bases
Click OK & have it scan My Computer
Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect.
We only require a report from it.
Click the Save as Text button to save the file to your desktop so that you may post it in your next reply

* Turn off the real time scanner of any existing antivirus program while performing the online scan
----------------------------------------

FOLLOW-UP

Please return and post these items:

Kaspersky scan
A new HJT log run in Normal Mode

Please note: In order to properly see what is on your system, all HJT logs must be run in the normal mode

Please let me know how your system is behaving.

filo_romz · 12-01-2006, 02:58 AM

here is the recent log file::

----------------------------------

Logfile of HijackThis v1.99.1
Scan saved at 8:02:34 PM, on 1/12/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\Java\jre1.5.0_08\bin\jusched.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\NETGEAR\WG111v2 Configuration Utility\RtlWake.exe
C:\HijackThis\filo.exe

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} -
C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} -
C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program
Files\Java\jre1.5.0_08\bin\ssv.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} -
C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [RtWLan] C:\Program Files\NETGEAR\WG111v2 Configuration
Utility\RtWLan.exe /H
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program
Files\Java\jre1.5.0_08\bin\jusched.exe"
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware
7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: LimeWire On Startup.lnk = C:\Program Files\LimeWire\LimeWire.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft
Office\Office10\OSA.EXE
O4 - Global Startup: WG111v2 Smart Wizard Wireless Setting.lnk = C:\Program
Files\NETGEAR\WG111v2 Configuration Utility\RtlWake.exe
O8 - Extra context menu item: E&xport to Microsoft Excel -
res://C:\PROGRA~1\MICROS~1\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program
Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program
Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program
Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program
Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} -
C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger -
{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) -
http://www.kaspersky.com/kos/eng/par...an_unicode.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) -
http://acs.pandasoftware.com/actives...ree/asinst.cab
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. -
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. -
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. -
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. -
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner
- C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file
missing)

-------------------------------

and here is the kaspersky scan::

-------------------------------

KASPERSKY ONLINE SCANNER REPORT
Friday, December 01, 2006 8:01:34 PM
Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.83.0
Kaspersky Anti-Virus database last update: 1/12/2006
Kaspersky Anti-Virus database records: 247075

Scan Settings
Scan using the following antivirus database extended
Scan Archives false
Scan Mail Bases true

Scan Target My Computer
A:\
C:\
D:\
E:\
F:\

Scan Statistics
Total number of scanned objects 18205
Number of viruses found 6
Number of infected objects 11 / 0
Number of suspicious objects 0
Duration of the scan process 00:16:39

Infected Object Name Virus Name Last Action
C:\WINDOWS\system32\config\system.LOG Object is locked skipped

C:\WINDOWS\system32\config\software.LOG Object is locked skipped

C:\WINDOWS\system32\config\default.LOG Object is locked skipped

C:\WINDOWS\system32\config\SECURITY Object is locked skipped

C:\WINDOWS\system32\config\SAM Object is locked skipped

C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped

C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped

C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped

C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped

C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped

C:\WINDOWS\system32\config\SYSTEM Object is locked skipped

C:\WINDOWS\system32\config\SOFTWARE Object is locked skipped

C:\WINDOWS\system32\config\DEFAULT Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped

C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped

C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped

C:\WINDOWS\system32\h323log.txt Object is locked skipped

C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped

C:\WINDOWS\WindowsUpdate.log Object is locked skipped

C:\WINDOWS\SchedLgU.Txt Object is locked skipped

C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped

C:\Documents and Settings\All Users\Application Data\avg7\Log\emc.log Object is locked skipped

C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log.lck Object is locked skipped

C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log Object is locked skipped

C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped

C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped

C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped

C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped

C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped

C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped

C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped

C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped

C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped

C:\Documents and Settings\My PC\NTUSER.DAT Object is locked skipped

C:\Documents and Settings\My PC\Local Settings\History\History.IE5\index.dat Object is locked skipped

C:\Documents and Settings\My PC\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped

C:\Documents and Settings\My PC\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped

C:\Documents and Settings\My PC\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

C:\Documents and Settings\My PC\Desktop\anti virus campaign\SmitfraudFix\Reboot.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped

C:\Documents and Settings\My PC\Cookies\index.dat Object is locked skipped

C:\Documents and Settings\My PC\ntuser.dat.LOG Object is locked skipped

C:\System Volume Information\_restore{C4EE6BC2-8580-4263-BB6A-CC8A87B1926A}\RP16\A0006781.dll Object is locked skipped

C:\System Volume Information\_restore{C4EE6BC2-8580-4263-BB6A-CC8A87B1926A}\RP17\A0006876.dll Object is locked skipped

C:\System Volume Information\_restore{C4EE6BC2-8580-4263-BB6A-CC8A87B1926A}\RP17\A0006877.exe Object is locked skipped

C:\System Volume Information\_restore{C4EE6BC2-8580-4263-BB6A-CC8A87B1926A}\RP18\A0006947.dll Object is locked skipped

C:\System Volume Information\_restore{C4EE6BC2-8580-4263-BB6A-CC8A87B1926A}\RP18\A0006948.dll Object is locked skipped

C:\System Volume Information\_restore{C4EE6BC2-8580-4263-BB6A-CC8A87B1926A}\RP18\A0006973.exe Object is locked skipped

C:\System Volume Information\_restore{C4EE6BC2-8580-4263-BB6A-CC8A87B1926A}\RP18\A0007021.dll Object is locked skipped

C:\System Volume Information\_restore{C4EE6BC2-8580-4263-BB6A-CC8A87B1926A}\RP18\A0007024.dll Object is locked skipped

C:\System Volume Information\_restore{C4EE6BC2-8580-4263-BB6A-CC8A87B1926A}\RP18\A0007029.exe Object is locked skipped

C:\System Volume Information\_restore{C4EE6BC2-8580-4263-BB6A-CC8A87B1926A}\RP19\A0007044.exe Object is locked skipped

C:\System Volume Information\_restore{C4EE6BC2-8580-4263-BB6A-CC8A87B1926A}\RP19\A0007049.DLL Infected: not-a-virus:AdWare.Win32.Softomate.u skipped

C:\System Volume Information\_restore{C4EE6BC2-8580-4263-BB6A-CC8A87B1926A}\RP19\A0007059.dll Object is locked skipped

C:\System Volume Information\_restore{C4EE6BC2-8580-4263-BB6A-CC8A87B1926A}\RP19\A0007064.dll Object is locked skipped

C:\System Volume Information\_restore{C4EE6BC2-8580-4263-BB6A-CC8A87B1926A}\RP19\A0007168.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.dr skipped

C:\System Volume Information\_restore{C4EE6BC2-8580-4263-BB6A-CC8A87B1926A}\RP19\A0007169.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.dr skipped

C:\System Volume Information\_restore{C4EE6BC2-8580-4263-BB6A-CC8A87B1926A}\RP19\A0007170.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.dr skipped

C:\System Volume Information\_restore{C4EE6BC2-8580-4263-BB6A-CC8A87B1926A}\RP19\A0007171.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.dr skipped

C:\System Volume Information\_restore{C4EE6BC2-8580-4263-BB6A-CC8A87B1926A}\RP19\A0007172.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.dr skipped

C:\System Volume Information\_restore{C4EE6BC2-8580-4263-BB6A-CC8A87B1926A}\RP19\A0007173.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.dr skipped

C:\System Volume Information\_restore{C4EE6BC2-8580-4263-BB6A-CC8A87B1926A}\RP19\A0007180.dll Object is locked skipped

C:\System Volume Information\_restore{C4EE6BC2-8580-4263-BB6A-CC8A87B1926A}\RP19\A0007181.dll Object is locked skipped

C:\System Volume Information\_restore{C4EE6BC2-8580-4263-BB6A-CC8A87B1926A}\RP20\A0007287.exe Infected: not-a-virus:AdWare.Win32.Agent.at skipped

C:\System Volume Information\_restore{C4EE6BC2-8580-4263-BB6A-CC8A87B1926A}\RP20\A0007288.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.de skipped

C:\System Volume Information\_restore{C4EE6BC2-8580-4263-BB6A-CC8A87B1926A}\RP20\change.log Object is locked skipped

D:\System Volume Information\_restore{C4EE6BC2-8580-4263-BB6A-CC8A87B1926A}\RP11\A0005502.exe Infected: not-a-virus:Client-IRC.Win32.mIRC.591 skipped

Scan process completed.
਍

---------------------------------

i tried to delete all the files you wanted me to, but there was still one that kept returning back everytime i tried to delete it.. it was::

O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)

I ran a system scan, i ticked that and then clicked 'fix checked', and when i ran another scan again, it was still there.. so im not sure how to get rid of that...

i also cudn't find these two files::

C:\Documents and Settings\My PC\Local Settings\Application Data\vvdkkpe.dll
C:\Documents and Settings\My PC\Local Settings\Application Data\vorenbj.dll

but the other files you told me to delete i found and got them all... the computer is running a little faster than before... but the smitfraud toolbar is gone from the IE which is a relief .. thank you

fredmh · 12-01-2006, 07:18 AM

Your logs are looking much better. Let's go after that 023 another way. It is a leftover from Symantic/Norton.

DISABLE NT SERVICES

Click Start->Run - type services.msc & then click on the OK button
*Locate the service - Symantec Lic NetConnect
*Double-click on it to open the Properties dialog.

*Stop the service by using the Stop button.
*Change the Startup type to Disabled & then click on the OK button

Next, start HiJackThis & go to Config>Misc.Tools...> Delete an NT service...
*In the popup box that appears, type in CLTNetCnService.
If prompted, please allow a reboot yet.

----------------------------------------

Open HijackThis and click on 'Do a System Scan Only'. Check the following entries (If they still exist, make sure you do not miss any)

O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)

Please remember to close all other windows, including browsers then click Fix checked.

----------------------------------------

FOLLOW-UP

Please return and post these items:

A new HJT log run in Normal Mode

Please note: In order to properly see what is on your system, all HJT logs must be run in the normal mode

Please let me know how your system is behaving.

filo_romz · 12-01-2006, 10:19 PM

i followed ur steps and the symantec/norton code is now gone! Thank you.. here's the recent HJT log file::

--------------

Logfile of HijackThis v1.99.1
Scan saved at 9:31:43 AM, on 2/12/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\Java\jre1.5.0_08\bin\jusched.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\NETGEAR\WG111v2 Configuration Utility\RtlWake.exe
C:\WINDOWS\system32\wuauclt.exe
C:\HijackThis\filo.exe

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} -
C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} -
C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program
Files\Java\jre1.5.0_08\bin\ssv.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} -
C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [RtWLan] C:\Program Files\NETGEAR\WG111v2 Configuration
Utility\RtWLan.exe /H
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program
Files\Java\jre1.5.0_08\bin\jusched.exe"
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware
7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: LimeWire On Startup.lnk = C:\Program Files\LimeWire\LimeWire.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft
Office\Office10\OSA.EXE
O4 - Global Startup: WG111v2 Smart Wizard Wireless Setting.lnk = C:\Program
Files\NETGEAR\WG111v2 Configuration Utility\RtlWake.exe
O8 - Extra context menu item: E&xport to Microsoft Excel -
res://C:\PROGRA~1\MICROS~1\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program
Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program
Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program
Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program
Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} -
C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger -
{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) -
http://www.kaspersky.com/kos/eng/par...an_unicode.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) -
http://acs.pandasoftware.com/actives...ree/asinst.cab
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. -
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. -
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. -
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. -
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe

-------------------
there's still some viruses that kaspersky picked up, im running the avg anti-virus, and avg-anti-spyware programs now .. thank you so much for helping!! =)

fredmh · 12-01-2006, 10:53 PM

Congratulations. Your logs are now clean. Please complete the next "housekeeping" steps and read through the
information below

The Smitfraud you see in Kaspersky is merely the tool we used. You may delete it if you wish as it is updated frequently and might even be out of
date. The other files will be addressed below.

----------------------------------------

Windows XP - Reset Hidden Files

Click Start.
Open My Computer.
Select the Tools menu and click Folder Options.
Select the View tab.
Deselect the Show hidden files and folders option.
Select the Hide file extensions for known types option.
Select the Hide protected operating system files option.
Click Yes to confirm.
Click OK.

----------------------------------------

Clean-out and Reset System Restore

This will clean out any junk or malicious files left behind in System Restore including what you see in Kaspersky.

To turn off System Restore click Start > Right Click My Computer > Properties.
Click the System Restore tab and Check
"Turn off System Restore" or "Turn off System Restore on all drives" Click Apply.
When turning off System Restore, the existing restore points will be deleted. Click Yes to do this then Click OK.
Turn on System Restore by Clicking Start. Right-click My Computer, and then click Properties.
Click the System Restore tab. Uncheck "Turn off System Restore" or "Turn off System Restore on all drives."
Click Apply, and then OK.

This will create a new Restore Point.

----------------------------------------

RE-ENABLE ANTI-SPYWARE APPLICATIONS

If you were instructed to dis-able Anti-spyware applications during this fix, you may re-enable them

----------------------------------------

Please read through the following information to help protect your computer in the future.

KEEP YOUR OPERATING SYSTEM UPDATED

Please ensure that you have already patched your system against the recent WMF exploit. Go to this page to get the KB912919 patch

MICROSOFT UPDATES

It is very important that you get all of the critical updates for your Operating System and Internet Explorer. Keeping your OS and browser
up to date will help make you less susceptible to attacks by Trojans and viruses. Please go to Microsoft
and download all the critical updates to help prevent possible re-infection.

ENABLE WINDOWS AUTO UPDATE

Go to Start>Run - type wuaucpl.cpl
tick on the checkbox - "Keep my computer up to date"
Under settings, choose "Automatically download the updates, and install them on the schedule that I specify".
Click on "OK".

TOOLS TO HELP KEEP YOUR SYSTEM CLEAN

Now that you are clean, to help protect your computer in the future I recommend that you get the following free programs:

SpywareBlaster to help prevent spyware from installing in the first place.

Install & update SpywareBlaster with the latest definitions.
After you have updated, click the button - enable protection for all unprotected items

SpywareGuard to catch and block spyware before it can execute.

SPYBOT - SEARCH & DESTROY Download and install Spybot - Search & Destroy with its
TeaTimer option.
This will provide realtime spyware & hijacker protection on your computer alongside your virus protection. You should also scan your computer with
the program on a regular basis just as you would an antivirus software. A tutorial on installing & using this product can be found here

AD-AWARE Download and install Ad-Aware. You should use this program to scan
your computer on a regular basis just as you would an antivirus software in conjunction with Spybot. A tutorial on installing & using this product
can be found here

IE-SPYAD IE/Spyad places more than 4000 dubious websites and domains in the IE Restricted list. This severely impair attempts to infect your system. It basically prevents any downloads (Cookies etc) from the sites listed, although you will still be able to connect to the sites.

Download IE-SpyAD - Extract the contents to a new folder
From within the folder, double-click install.bat
Select Option #2 - Install the new IE-SPYAD list.
Then return to the main menu.
Select option #4 - Add the old porn sites domain

A tutorial for IE-SPYAD can be found here

MVPS HOST FILE The MVPS Hosts file replaces your current HOSTS file
with one that will restrict known ad sites form serving you unsolicited advertisements. Basically, this prevents your computer from connecting to
those sites by redirecting them to 127.0.0.1 which is the IP of your local computer.

Download Host.zip to your desktop.
From your Desktop right-click (hosts.zip) and select:
Extract All from the menu.
Click Next, click Next, select the option:
"Show Extracted files"
Click Finish

This will open the newly created hosts folder on your Desktop.

Double-click on the included mvps.bat file, this will rename the existing HOSTS file to HOSTS.MVP, then it will copy the included updated
HOSTS file to the correct location on your machine.

MCAFEE SITE ADVISOR SITE ADVISOR is a free IE plug-in (also suport for Firefox browser)
which is used in conjunction with the Google search engine. It advises which web sites are considered safe and which sites could pose a problem.
It also shows what problems were encountered with each site, such as malicious downloads, spam, and related links.

ANTI-VIRUS AND FIREWALL PROGRAMS

ANTIVIRUS SOFTWARE It is very important that you have anti-virus software running on your machine.
This alone can save you a lot of trouble with malware in the future.
See this link for a listing of some online antivirus scanners: Anti-Spyware Tutorial

Here are some very good free Antivirus products which are available:

Avast!
AVG

If you do not have a firewall, here are 4 free ones available for personal use:

Understanding and Using Firewalls

INFORMATIONAL READING

In light of your recent troubles, I'm sure you'll like to avoid any future infections. Please take a look at these well written articles:

PC SAFETY AND SECURITY
HOW DID I GET INFECTED IN THE FIRST PLACE?
THE ANTI-SPYWARE TUTORIAL
MAKING INTERNET EXPLORER SAFER
INVASION OF THE COMPUTER SNATCHERS
The Cookie Concept

Please respond one more time and let me know you received this post so it can be marked resolved

If you feel that we have helped you, please help us keep this site free for all. Please visit our DONATION PAGE.

filo_romz · 12-02-2006, 03:25 PM

hey, i followed ur instructions and the viruses are gone! Thank you very much for helping me fredmh! I appreciate it!

fredmh · 12-02-2006, 04:24 PM

My pleasure. Glad I could help.

11-22-2006, 05:43 AM	#1 (permalink)
filo_romz Registered User Join Date: Dec 2005 Posts: 20 OS: WinXP	Smitfraud-C, 888 toolbar help! Hey my friend recently caught a heavy virus while browsing through some sites and he has great difficulty in getting access to the internet. Here is his recent logfile: -------------- Logfile of HijackThis v1.99.1 Scan saved at 11:30:21 PM, on 22/11/2006 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\VirusRescue\vrsvc.exe C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\explorer.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\Common Files\??mbols\??rss.exe C:\PROGRA~1\COMMON~1\WNSXS~1\fast.exe C:\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = R3 - Default URLSearchHook is missing O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll O3 - Toolbar: Safety Bar - {052b12f7-86fa-4921-8482-26c42316b522} - C:\Program Files\Safety Bar\SafetyBar.dll O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [RtWLan] C:\Program Files\NETGEAR\WG111v2 Configuration Utility\RtWLan.exe /H O4 - HKLM\..\Run: [CTDrive] rundll32.exe C:\WINDOWS\system32\drvpah.dll,startup O4 - HKLM\..\Run: [tnziiib.dll] C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\tnziiib.dll,xeokrvd O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_08\bin\jusched.exe" O4 - HKLM\..\Run: [VirusRescue] C:\Program Files\VirusRescue\VirusRescue.exe /s O4 - HKLM\..\Run: [SpywareHeal] C:\Program Files\SpywareHeal\SpywareHeal.exe /h O4 - HKLM\..\Run: [cqjkpwk.dll] C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\cqjkpwk.dll,kghdbsf O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKLM\..\Run: [vvdkkpe.dll] C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\vvdkkpe.dll,agkxvbc O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Uuir] "C:\PROGRA~1\COMMON~1\WNSXS~1\fast.exe" -vt tzt O4 - HKCU\..\Run: [Bwcpgrj] C:\Program Files\Common Files\??mbols\??rss.exe O4 - Startup: .protected O4 - Startup: LimeWire On Startup.lnk = C:\Program Files\LimeWire\LimeWire.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O4 - Global Startup: WG111v2 Smart Wizard Wireless Setting.lnk = C:\Program Files\NETGEAR\WG111v2 Configuration Utility\RtlWake.exe O4 - Global Startup: .protected O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~1\Office10\EXCEL.EXE/3000 O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O21 - SSODL: cussers - {ff170564-36c8-43f7-9100-559e166405cf} - (no file) O21 - SSODL: boucicault - {0bad5052-665d-40d4-a9bd-a2891eaafb42} - C:\WINDOWS\system32\fmrmhc.dll (file missing) O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing) O23 - Service: vrsvc - Unknown owner - C:\Program Files\VirusRescue\vrsvc.exe -------------- my friend says that the trojan or virus behind it is Smitfraud-C or some form or another... It seems that the virus makes icons which look like anti-virus program icons or protection icons and keeps returning evreytime he logs on the internet. He keeps disconnecting from the internet and makes his computer extremely slow... He also sees an 888 toolbar on his computer which could also have contributed to the slowing down of his computer. I hope you can help my dear friend out! Thank you TSF

11-22-2006, 08:33 AM	#2 (permalink)
fredmh Analyst, Security Team ; TSF Supporter Join Date: May 2006 Location: Phila,Pa Posts: 2,335 OS: XP	Hello filo romz, and welcome to TSF. I am currently reviewing your log. Please note that this is under the supervision of an expert analyst, and I will be back with a fix for your problem as soon as possible. You may wish to Subscribe to this thread (Thread Tools) so that you are notified when you receive a reply. Please be patient with me during this time. ======================================= The infection you have, a variant of vundo, recognizes HijackThis and prevents HJT from reading the registry locations where it resides as well as hiding other infections in those locations. I'd like you to rename HijackThis.exe to filo.exe. Navigate to C:\HijackThis\HijackThis.exe Right click on HijackThis.exe Select 'Rename' Type in filo.exe Press Enter. Please run a scan with the newly renamed filo.exe and post the new log here. Last edited by fredmh; 11-22-2006 at 08:35 AM.

11-23-2006, 05:44 PM	#4 (permalink)
fredmh Analyst, Security Team ; TSF Supporter Join Date: May 2006 Location: Phila,Pa Posts: 2,335 OS: XP	Please subscribe to this thread to get immediate notification of replies as soon as they are posted. To do this click Thread Tools, then click Subscribe to this Thread. Make sure it is set to Instant Notification, then click Subscribe. Please read this post completely before begining the fix. If there's anything that you do not understand, kindly ask your questions before proceeding. Please ensure that there aren't any opened browsers when you are carrying out the procedures below. Save the following instructions in Notepad as this webpage would not be available when you're carrying out the fix. IT IS IMPORTANT THAT YOU DON'T MISS A STEP & PERFORM EVERYTHING IN THE RIGHT ORDER. ---------------------------------------- The fixes we will use are specific to your problems and should only be used for this issue on this machine. Please only use this topic to reply to. Do not start another thread. If any other issues arise let me know. The process is not instant. Please continue to review my answers until I tell you your machine is clear. Absence of symptoms does not mean that everything is clear. So lets do this to the end! Please make every effort to reply to my posts in a timely manner. Malware breeds malware and the longer an infection remains on a system, the more likely additional infections will result. ---------------------------------------- This system is heavily infected. Let's get started with the cleaning. ---------------------------------------- P2P - I see you have P2P software installed on your machine. We are not here to pass judgment on file-sharing as a concept. However, we will warn you that engaging in this activity and having this kind of software installed on your machine will always make you more susceptible to re-infections. It may be contributing to your current situation. This page will give you further information. These programs are: Limewire ---------------------------------------- No AntiVirus Onboard I see no evidence of an AntiVirus program on your system. This must be resolved. Here are two very good free Antivirus products which are available: Avast! AVG Select one of these, or another of your choice. Download, install, update definitions, and run a full system scan. ---------------------------------------- DOWNLOADS CLEANUP! version 4.52 – TEMP FILE CLEANING Please download Cleanup! and install it. You will use this later. NOTE Cleanup deletes EVERYTHING out of temporary folders and does not make backups. AVG Anti-Spyware 7.5 Please download AVG Anti-Spyware 7.5 Use the link at the bottom of the page under "AVG Anti-Spyware Free for Windows" Install AVG Anti-Spyware 7.5. Double-click the icon on Desktop to launch AVG A-S 7.5 On the top of the main screen click Shield Click the word active to change it to inactive On the top of the main screen click Update. Then click on Start Update. The update will start and a progress bar will show the updates being installed. I also recommend changing the "Update interval" to something more reasonable like 12 hours. SMITFRAUD FIX Please download SmitfraudFix (by S!Ri) Extract the content (a folder named SmitfraudFix) to your Desktop. ComboFix 1. Download this file - You MUST save it to your desktop http://download.bleepingcomputer.com/sUBs/combofix.exe or http://www.techsupportforum.com/sectools/combofix.exe 2. 2. Go to <<Start>> then <<Run>> then paste in the single line command then click OK "%userprofile%\desktop\combofix.exe" /v vorenbj ppgglue svsahaf ljjjkhh ybtxw ssqqr ioceuskd tnziiib cqjkpwk vvdkkpe winmqx32 3. When finished, it shall produce a log for you. Post that log in your next reply Note: Do not mouseclick combofix's window whilst it's running. That may cause it to stall ---------------------------------------- DISABLE NT SERVICES Click Start->Run - type services.msc & then click on the OK button Locate the service - vrsvc* Double-click on it to open the Properties dialog. Under the General tab: <--*Take note and write down the Service name given as we will need it shortly.** Stop the service by using the Stop* button. Change the Startup type to Disabled* & then click on the OK button Next, start HiJackThis & go to Config>Misc.Tools...> Delete an NT service... In the popup box that appears, type in the Service Name you found in the General Tab for vrsvc. ---------------------------------------- SAFE MODE RE-BOOT Please reboot your computer in Safe Mode by doing the following: 1) Restart your computer 2) After hearing your computer beep once during startup, but before the Windows icon appears, press F8. 3) Instead of Windows loading as normal, a menu should appear 4) Use the up arrow key to highlight Safe Mode and press Enter. 5) Login with your usual account. Make sure to close any open browsers. ---------------------------------------- FIXES AND DELETIONS Uninstall the following via the Add/Remove Panel (Start->(Settings)->Control Panel->Add/Remove Programs) if they exist: VirusRescue SpywareHeal These programs are rogueware and we highly recommend that you uninstall them. Rogue or Suspect means that these products are of unknown,questionable, or dubious value as anti-spyware protection. See THIS SITE for more information ---------------------------------------- Open HijackThis and click on 'Do a System Scan Only'. Check the following entries (If they still exist, make sure you do not miss any) R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = R3 - Default URLSearchHook is missing O2 - BHO: (no name) - {39f25b12-74ff-4079-a51f-1d70f5b08b84} -C:\WINDOWS\system32\ixt0.dll (file missing) O2 - BHO: (no name) - {67E50C13-CAF6-E272-828A-B2693EA6DD95} -C:\WINDOWS\system32\iae.dll (file missing) O2 - BHO: (no name) - {755bbd1a-aa59-456c-afeb-b4c42c4dcb6f} -C:\WINDOWS\system32\ixt1.dll (file missing) O4 - HKLM\..\Run: [tnziiib.dll] C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\tnziiib.dll,xeokrvd O4 - HKLM\..\Run: [VirusRescue] C:\Program Files\VirusRescue\VirusRescue.exe /s O4 - HKLM\..\Run: [SpywareHeal] C:\Program Files\SpywareHeal\SpywareHeal.exe /h O4 - HKLM\..\Run: [cqjkpwk.dll] C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\cqjkpwk.dll,kghdbsf O4 - HKLM\..\Run: [vvdkkpe.dll] C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\vvdkkpe.dll,agkxvbc O4 - HKCU\..\Run: [Bwcpgrj] C:\Program Files\Common Files\??mbols\??rss.exe 23 - Service: vrsvc - Unknown owner - C:\Program Files\VirusRescue\vrsvc.exe *Please remember to close all other windows, including browsers then click Fix checked.* ---------------------------------------- UNHIDE HIDDEN FILES Go to My Computer->Tools->Folder Options->View tab: * Under the Hidden files and folders heading, select Show hidden files and folders. * Uncheck the Hide protected operating system files (recommended) option. * Also make sure there is no checkmark beside Hide file extensions for known file types * Click Yes to confirm and then click OK. ---------------------------------------- Delete the following Files indicated in RED and Folders indicated in BLUE if they still exist. C:\Program Files\Common Files\{44645217-0383-1033-0803-01022403003d}\Update.exe C:\Program Files\VirusRescue C:\Program Files\SpywareHeal ---------------------------------------- SmitFraud - OPTION 2 Open the SmitfraudFix Folder, then double-click smitfraudfix.cmd file to start the tool. Select option #2 - Clean by typing 2 and press Enter. Wait for the tool to complete and disk cleanup to finish. You will be prompted : " Registry cleaning - Do you want to clean the registry?" answer Yes by typing Y and hit Enter. The tool will also check if wininet.dll is infected. If a clean version is found, you will be prompted to replace wininet.dll. Answer Yes to the question " Replace infected file?" by typing Y and hit Enter. A reboot may be needed to finish the cleaning process, if you computer does not restart automatically please do it yourself manually. Reboot in Safe Mode. The tool will create a log named c:\rapport.txt in the root of your drive, eg: Local Disk C: (C:rapport.txt) or partition where your operating system is installed. Please post that log along with all others requested in your next reply. ---------------------------------------- RUNNING SCANNERS Cleanup Open Cleanup! by double-clicking the icon on your desktop (or from the Start > All Programs menu). Set the program up as follows: Click "Options..." Move the arrow down to "Custom CleanUp!" Put a check next to the following (Make sure nothing else is checked!): Empty Recycle Bins Delete Cookies Delete Prefetch files (if present) Cleanup! All Users Click on the Temporary Files tab and uncheck the box for Scan drives for files matching if it’s checked. Click OK Press the CleanUp! button to start the program and DO NOT reboot when prompted. AVG Anti-Spyware 7.5 Run AVG A-s with it's updated definitions: (...it's important that all windows must be closed) This scan can take quite a while to run, so be prepared. Click Scanner Click on the Scan tab Click Complete System Scan to begin scanning. When the scan is complete click Recommended Action and change it to Quarantine (1), If not click Recommended Action and choose Quarantine from the popup menu. (2) At the bottom of the window click on the Apply all Actions button. (3) When done, click the Save Scan Report button. (4) then click Save Report As and save it to your desktop. IMPORTANT : Don't click on the "Save Scan Report" button before you did hit the "Apply all Actions" button. Note: DO NOT USE the computer while AVG A/S is scanning. If Explorer or the Control Panel are opened some malware types will reinfect your system or will not be cleaned properly. ---------------------------------------- SECURE DESKTOP Next go to Control Panel click Display>Desktop>Customize Desktop>Web> Now, Uncheck Everything and delete if present: "Security Info" "Warning Message" "Security Desktop" "Warning Homepage" "Desktop Uninstall" Also make sure the 'Lock desktop items' box is unticked. Click OK, and then Click Apply, then OK. ---------------------------------------- SYSTEM RE-BOOT Reboot into Normal Mode. ---------------------------------------- SmitFraud - OPTION 3 Open the SmitfraudFix folder and double-click smitfraudfix.cmd Select option #3 - Delete Trusted zone by typing 3 and press Enter Answer Yes to the question "Restore Trusted Zone ?" by typing Y and hit Enter. Note, if you use SpywareBlaster and/or IE-SPYAD, it will be necessary to re-install the protection both afford. For SpywareBlaster, run the program and re-protect all items. For IE-SPYAD, run the batch file and reinstall the protection. ---------------------------------------- ON-LINE SCANS Perform an online scan with Internet Explorer with Panda ActiveScan Click on located at the bottom of the page. A "pop up" window will appear. * Please ensure that your pop up blocker doesn't block it * Enter your e-mail address, country, and state & click "Free Online Scan" * The download of the 8 MB Panda's ActiveX control will take place * Begin the scan by selecting If it finds any malware, it will offer you a report. Please ignore any entry it finds and the offer to buy the program to remove the entry, as we will address this later. Click on then click * You needn't remain online while it's doing the scan but you have to re-connect after it has finished to see the report. * Turn off the real time scanner of any existing antivirus program while performing the online scan ---------------------------------------- ComboFix - 2nd Run 2. Double click combofix.exe & follow the prompts. 3. When finished, it shall produce a log for you. Post that log in your next reply Note: Do not mouseclick combofix's window whilst it's running. That may cause it to stall ---------------------------------------- FOLLOW-UP Please return and post these items: c:\combofix2.txt first running AVG A/S scan c:\rapport.txt from Smitfraud Panda scan c:\combofix.txt second running A new HJT log run in Normal Mode Please note: In order to properly see what is on your system, all HJT logs must be run in the normal mode Please turn off Word Wrap when posting logs. It's hard on the eyeballs Please let me know how your system is behaving.

11-28-2006, 09:44 PM	#9 (permalink)
fredmh Analyst, Security Team ; TSF Supporter Join Date: May 2006 Location: Phila,Pa Posts: 2,335 OS: XP	Please read this post completely before begining the fix. If there's anything that you do not understand, kindly ask your questions before proceeding. Please ensure that there aren't any opened browsers when you are carrying out the procedures below. Save the following instructions in Notepad as this webpage would not be available when you're carrying out the fix. IT IS IMPORTANT THAT YOU DON'T MISS A STEP & PERFORM EVERYTHING IN THE RIGHT ORDER. ---------------------------------------- DOWNLOADS FIXES AND DELETIONS Open HijackThis and click on 'Do a System Scan Only'. Check the following entries (If they still exist, make sure you do not miss any) O2 - BHO: (no name) - {2C2CC20D-65BF-46E6-94CA-D2BB81A38D12} - C:\WINDOWS\system32\ssqqr.dll (file missing) O2 - BHO: (no name) - {CFE9E8A8-38C0-4EF8-AEC2-5035EFE81030} - C:\WINDOWS\system32\ljjjkhh.dll (file missing) O2 - BHO: (no name) - {D7634C49-8AAF-F370-DEDF-A728EA7B67CD} - C:\WINDOWS\system32\ybtxw.dll (file missing) O2 - BHO: (no name) - {F18F04B0-9CF1-4b93-B004-77A288BEE28B} - C:\WINDOWS\system32\ioceuskd.dll (file missing) O4 - HKCU\..\Run: [Uuir] "C:\PROGRA~1\COMMON~1\WNSXS~1\fast.exe" -vt tzt O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing) *Please remember to close all other windows, including browsers then click Fix checked.* ---------------------------------------- SAFE MODE RE-BOOT Please reboot your computer in Safe Mode by doing the following: 1) Restart your computer 2) After hearing your computer beep once during startup, but before the Windows icon appears, press F8. 3) Instead of Windows loading as normal, a menu should appear 4) Use the up arrow key to highlight Safe Mode and press Enter. 5) Login with your usual account. Make sure to close any open browsers. ---------------------------------------- UNHIDE HIDDEN FILES Go to My Computer->Tools->Folder Options->View tab: * Under the Hidden files and folders heading, select Show hidden files and folders. * Uncheck the Hide protected operating system files (recommended) option. * Also make sure there is no checkmark beside Hide file extensions for known file types * Click Yes to confirm and then click OK. ---------------------------------------- Delete the following Files indicated in RED and Folders indicated in BLUE if they still exist. C:\WINDOWS\system32\drvsov.dll C:\WINDOWS\system32\rqroopo.dll C:\WINDOWS\system32\wapisvtr.exe C:\WINDOWS\system32\assqmddj.exe C:\Documents and Settings\My PC\Local Settings\Application Data\vvdkkpe.dll C:\Documents and Settings\My PC\Local Settings\Application Data\vorenbj.dll C:\FOUND.003 C:\FOUND.002 C:\FOUND.001 C:\FOUND.000 C:\Documents and Settings\My PC\Application Data\SearchToolbarCorp C:\QooBox ---------------------------------------- SYSTEM RE-BOOT Reboot into Normal Mode. ---------------------------------------- ON-LINE SCANS Kaspersky - Extended Establish an internet connection & perform an online scan with Internet Explorer at Kaspersky Online Scanner Answer Yes, when prompted to install an ActiveX component. The program will then begin downloading the latest definition files. Once the files have been downloaded click on NEXT Locate the Scan Settings button & configure to: Scan using the following Anti-Virus database: Extended Scan Options: Scan Archives Scan Mail Bases Click OK & have it scan My Computer Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it. Click the Save as Text button to save the file to your desktop so that you may post it in your next reply * Turn off the real time scanner of any existing antivirus program while performing the online scan ---------------------------------------- FOLLOW-UP Please return and post these items: Kaspersky scan A new HJT log run in Normal Mode Please note: In order to properly see what is on your system, all HJT logs must be run in the normal mode Please let me know how your system is behaving.

12-01-2006, 07:18 AM	#11 (permalink)
fredmh Analyst, Security Team ; TSF Supporter Join Date: May 2006 Location: Phila,Pa Posts: 2,335 OS: XP	Your logs are looking much better. Let's go after that 023 another way. It is a leftover from Symantic/Norton. DISABLE NT SERVICES Click Start->Run - type services.msc & then click on the OK button Locate the service - Symantec Lic NetConnect* Double-click on it to open the Properties dialog. Stop the service by using the Stop button. Change the Startup type to Disabled* & then click on the OK button Next, start HiJackThis & go to Config>Misc.Tools...> Delete an NT service... In the popup box that appears, type in CLTNetCnService. If prompted, please allow a reboot yet. ---------------------------------------- Open HijackThis and click on 'Do a System Scan Only'. Check the following entries (If they still exist, make sure you do not miss any)* O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing) *Please remember to close all other windows, including browsers then click Fix checked.* ---------------------------------------- FOLLOW-UP Please return and post these items: A new HJT log run in Normal Mode Please note: In order to properly see what is on your system, all HJT logs must be run in the normal mode Please let me know how your system is behaving. __________________

11-23-2006, 04:13 AM	#3 (permalink)
filo_romz Registered User Join Date: Dec 2005 Posts: 20 OS: WinXP	okay i did what you had asked .. heres the recent logfile: ------------------ Logfile of HijackThis v1.99.1 Scan saved at 3:08:25 PM, on 23/11/2006 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\VirusRescue\vrsvc.exe C:\WINDOWS\system32\rundll32.exe C:\Program Files\Java\jre1.5.0_08\bin\jusched.exe C:\Program Files\VirusRescue\VirusRescue.exe C:\WINDOWS\system32\rundll32.exe C:\Program Files\VirusRescue\VirusRescue.exe C:\WINDOWS\system32\rundll32.exe C:\Program Files\Common Files\{44645217-0383-1033-0803-01022403003d}\Update.exe C:\Program Files\Messenger\msmsgs.exe C:\WINDOWS\system32\ctfmon.exe C:\PROGRA~1\COMMON~1\WNSXS~1\fast.exe C:\Program Files\Common Files\??mbols\??rss.exe C:\Program Files\NETGEAR\WG111v2 Configuration Utility\RtlWake.exe C:\Program Files\LimeWire\LimeWire.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\system32\wscntfy.exe C:\HijackThis\filo.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = R3 - Default URLSearchHook is missing O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: (no name) - {099D0986-C204-F967-3343-00A64FA96FB9} - C:\WINDOWS\system32\vorenbj.dll O2 - BHO: (no name) - {39f25b12-74ff-4079-a51f-1d70f5b08b84} - C:\WINDOWS\system32\ixt0.dll (file missing) O2 - BHO: (no name) - {469B21EE-DC21-F8DB-B902-01B048E4C758} - C:\WINDOWS\system32\ppgglue.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: (no name) - {67E50C13-CAF6-E272-828A-B2693EA6DD95} - C:\WINDOWS\system32\iae.dll (file missing) O2 - BHO: (no name) - {72AEEBB5-ECD6-0174-0AB3-03DD9B601445} - C:\WINDOWS\system32\svsahaf.dll O2 - BHO: (no name) - {755bbd1a-aa59-456c-afeb-b4c42c4dcb6f} - C:\WINDOWS\system32\ixt1.dll (file missing) O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll O2 - BHO: (no name) - {CFE9E8A8-38C0-4EF8-AEC2-5035EFE81030} - C:\WINDOWS\system32\ljjjkhh.dll O2 - BHO: (no name) - {D7634C49-8AAF-F370-DEDF-A728EA7B67CD} - C:\WINDOWS\system32\ybtxw.dll O2 - BHO: (no name) - {E4216140-19DC-41B4-BD11-68817B7CAA4E} - C:\WINDOWS\system32\ssqqr.dll O2 - BHO: (no name) - {F18F04B0-9CF1-4b93-B004-77A288BEE28B} - C:\WINDOWS\system32\ioceuskd.dll O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll O3 - Toolbar: Safety Bar - {052b12f7-86fa-4921-8482-26c42316b522} - C:\Program Files\Safety Bar\SafetyBar.dll O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [RtWLan] C:\Program Files\NETGEAR\WG111v2 Configuration Utility\RtWLan.exe /H O4 - HKLM\..\Run: [CTDrive] rundll32.exe C:\WINDOWS\system32\drvpah.dll,startup O4 - HKLM\..\Run: [tnziiib.dll] C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\tnziiib.dll,xeokrvd O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_08\bin\jusched.exe" O4 - HKLM\..\Run: [VirusRescue] C:\Program Files\VirusRescue\VirusRescue.exe /s O4 - HKLM\..\Run: [SpywareHeal] C:\Program Files\SpywareHeal\SpywareHeal.exe /h O4 - HKLM\..\Run: [cqjkpwk.dll] C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\cqjkpwk.dll,kghdbsf O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKLM\..\Run: [vvdkkpe.dll] C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\vvdkkpe.dll,agkxvbc O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Uuir] "C:\PROGRA~1\COMMON~1\WNSXS~1\fast.exe" -vt tzt O4 - HKCU\..\Run: [Bwcpgrj] C:\Program Files\Common Files\??mbols\??rss.exe O4 - Startup: .protected O4 - Startup: LimeWire On Startup.lnk = C:\Program Files\LimeWire\LimeWire.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O4 - Global Startup: WG111v2 Smart Wizard Wireless Setting.lnk = C:\Program Files\NETGEAR\WG111v2 Configuration Utility\RtlWake.exe O4 - Global Startup: .protected O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~1\Office10\EXCEL.EXE/3000 O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O20 - Winlogon Notify: ljjjkhh - C:\WINDOWS\SYSTEM32\ljjjkhh.dll O20 - Winlogon Notify: ssqqr - C:\WINDOWS\system32\ssqqr.dll O20 - Winlogon Notify: winmqx32 - C:\WINDOWS\SYSTEM32\winmqx32.dll O21 - SSODL: cussers - {ff170564-36c8-43f7-9100-559e166405cf} - (no file) O21 - SSODL: boucicault - {0bad5052-665d-40d4-a9bd-a2891eaafb42} - C:\WINDOWS\system32\fmrmhc.dll (file missing) O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing) O23 - Service: vrsvc - Unknown owner - C:\Program Files\VirusRescue\vrsvc.exe ------------

11-28-2006, 07:30 AM	#6 (permalink)
fredmh Analyst, Security Team ; TSF Supporter Join Date: May 2006 Location: Phila,Pa Posts: 2,335 OS: XP	Good. Could you please post the Panda Scan Log

11-28-2006, 01:22 PM	#7 (permalink)
filo_romz Registered User Join Date: Dec 2005 Posts: 20 OS: WinXP	This is the panda scan log:: -------------------------- Incident Status Location Spyware:Spyware/Virtumonde Not disinfected C:\WINDOWS\system32\rqroopo.dll Adware:Adware/Adservice Not disinfected C:\WINDOWS\system32\drvsov.dll Potentially unwanted tool:Application/Processor Not disinfected C:\WINDOWS\system32\Process.exe Potentially unwanted tool:Application/VSToolbar Not disinfected C:\WINDOWS\system32\assqmddj.exe Potentially unwanted tool:Application/VirusBursters Not disinfected C:\FOUND.000\FILE0010.CHK[VirusBursters.exe] Potentially unwanted tool:Application/VirusBursters Not disinfected C:\FOUND.000\FILE0012.CHK Virus:Trj/Disablekey.AP Disinfected C:\Documents and Settings\My PC\Local Settings\Application Data\vvdkkpe.dll Virus:Trj/Disablekey.AP Disinfected C:\Documents and Settings\My PC\Local Settings\Application Data\vorenbj.dll Potentially unwanted tool:Application/Processor Not disinfected C:\Documents and Settings\My PC\Desktop\SmitfraudFix.zip[SmitfraudFix/Process.exe] Potentially unwanted tool:Application/Processor Not disinfected C:\Documents and Settings\My PC\Desktop\SmitfraudFix\Process.exe Spyware:Cookie/Serving-sys Not disinfected C:\Documents and Settings\My PC\Cookies\my pc@serving-sys[1].txt Possible Virus. Renamed C:\QooBox\Purity\Program Files\Common Files\MBOLS~1\??rss.exe ---------------- i think the 888 smitfraud toolbar is still there.. ><

11-28-2006, 04:02 PM	#8 (permalink)
fredmh Analyst, Security Team ; TSF Supporter Join Date: May 2006 Location: Phila,Pa Posts: 2,335 OS: XP	What symptoms do you have for the 888 smitfraud toolbar ?

12-01-2006, 02:58 AM	#10 (permalink)
filo_romz Registered User Join Date: Dec 2005 Posts: 20 OS: WinXP	here is the recent log file:: ---------------------------------- Logfile of HijackThis v1.99.1 Scan saved at 8:02:34 PM, on 1/12/2006 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe C:\Program Files\Java\jre1.5.0_08\bin\jusched.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe C:\Program Files\Messenger\msmsgs.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\NETGEAR\WG111v2 Configuration Utility\RtlWake.exe C:\HijackThis\filo.exe O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [RtWLan] C:\Program Files\NETGEAR\WG111v2 Configuration Utility\RtWLan.exe /H O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_08\bin\jusched.exe" O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - Startup: LimeWire On Startup.lnk = C:\Program Files\LimeWire\LimeWire.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O4 - Global Startup: WG111v2 Smart Wizard Wireless Setting.lnk = C:\Program Files\NETGEAR\WG111v2 Configuration Utility\RtlWake.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~1\Office10\EXCEL.EXE/3000 O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/par...an_unicode.cab O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing) ------------------------------- and here is the kaspersky scan:: ------------------------------- KASPERSKY ONLINE SCANNER REPORT Friday, December 01, 2006 8:01:34 PM Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600) Kaspersky Online Scanner version: 5.0.83.0 Kaspersky Anti-Virus database last update: 1/12/2006 Kaspersky Anti-Virus database records: 247075 Scan Settings Scan using the following antivirus database extended Scan Archives false Scan Mail Bases true Scan Target My Computer A:\ C:\ D:\ E:\ F:\ Scan Statistics Total number of scanned objects 18205 Number of viruses found 6 Number of infected objects 11 / 0 Number of suspicious objects 0 Duration of the scan process 00:16:39 Infected Object Name Virus Name Last Action C:\WINDOWS\system32\config\system.LOG Object is locked skipped C:\WINDOWS\system32\config\software.LOG Object is locked skipped C:\WINDOWS\system32\config\default.LOG Object is locked skipped C:\WINDOWS\system32\config\SECURITY Object is locked skipped C:\WINDOWS\system32\config\SAM Object is locked skipped C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\SYSTEM Object is locked skipped C:\WINDOWS\system32\config\SOFTWARE Object is locked skipped C:\WINDOWS\system32\config\DEFAULT Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped C:\WINDOWS\system32\h323log.txt Object is locked skipped C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped C:\WINDOWS\WindowsUpdate.log Object is locked skipped C:\WINDOWS\SchedLgU.Txt Object is locked skipped C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\avg7\Log\emc.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log.lck Object is locked skipped C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log Object is locked skipped C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\My PC\NTUSER.DAT Object is locked skipped C:\Documents and Settings\My PC\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\My PC\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\My PC\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\My PC\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\My PC\Desktop\anti virus campaign\SmitfraudFix\Reboot.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped C:\Documents and Settings\My PC\Cookies\index.dat Object is locked skipped C:\Documents and Settings\My PC\ntuser.dat.LOG Object is locked skipped C:\System Volume Information\_restore{C4EE6BC2-8580-4263-BB6A-CC8A87B1926A}\RP16\A0006781.dll Object is locked skipped C:\System Volume Information\_restore{C4EE6BC2-8580-4263-BB6A-CC8A87B1926A}\RP17\A0006876.dll Object is locked skipped C:\System Volume Information\_restore{C4EE6BC2-8580-4263-BB6A-CC8A87B1926A}\RP17\A0006877.exe Object is locked skipped C:\System Volume Information\_restore{C4EE6BC2-8580-4263-BB6A-CC8A87B1926A}\RP18\A0006947.dll Object is locked skipped C:\System Volume Information\_restore{C4EE6BC2-8580-4263-BB6A-CC8A87B1926A}\RP18\A0006948.dll Object is locked skipped C:\System Volume Information\_restore{C4EE6BC2-8580-4263-BB6A-CC8A87B1926A}\RP18\A0006973.exe Object is locked skipped C:\System Volume Information\_restore{C4EE6BC2-8580-4263-BB6A-CC8A87B1926A}\RP18\A0007021.dll Object is locked skipped C:\System Volume Information\_restore{C4EE6BC2-8580-4263-BB6A-CC8A87B1926A}\RP18\A0007024.dll Object is locked skipped C:\System Volume Information\_restore{C4EE6BC2-8580-4263-BB6A-CC8A87B1926A}\RP18\A0007029.exe Object is locked skipped C:\System Volume Information\_restore{C4EE6BC2-8580-4263-BB6A-CC8A87B1926A}\RP19\A0007044.exe Object is locked skipped C:\System Volume Information\_restore{C4EE6BC2-8580-4263-BB6A-CC8A87B1926A}\RP19\A0007049.DLL Infected: not-a-virus:AdWare.Win32.Softomate.u skipped C:\System Volume Information\_restore{C4EE6BC2-8580-4263-BB6A-CC8A87B1926A}\RP19\A0007059.dll Object is locked skipped C:\System Volume Information\_restore{C4EE6BC2-8580-4263-BB6A-CC8A87B1926A}\RP19\A0007064.dll Object is locked skipped C:\System Volume Information\_restore{C4EE6BC2-8580-4263-BB6A-CC8A87B1926A}\RP19\A0007168.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.dr skipped C:\System Volume Information\_restore{C4EE6BC2-8580-4263-BB6A-CC8A87B1926A}\RP19\A0007169.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.dr skipped C:\System Volume Information\_restore{C4EE6BC2-8580-4263-BB6A-CC8A87B1926A}\RP19\A0007170.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.dr skipped C:\System Volume Information\_restore{C4EE6BC2-8580-4263-BB6A-CC8A87B1926A}\RP19\A0007171.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.dr skipped C:\System Volume Information\_restore{C4EE6BC2-8580-4263-BB6A-CC8A87B1926A}\RP19\A0007172.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.dr skipped C:\System Volume Information\_restore{C4EE6BC2-8580-4263-BB6A-CC8A87B1926A}\RP19\A0007173.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.dr skipped C:\System Volume Information\_restore{C4EE6BC2-8580-4263-BB6A-CC8A87B1926A}\RP19\A0007180.dll Object is locked skipped C:\System Volume Information\_restore{C4EE6BC2-8580-4263-BB6A-CC8A87B1926A}\RP19\A0007181.dll Object is locked skipped C:\System Volume Information\_restore{C4EE6BC2-8580-4263-BB6A-CC8A87B1926A}\RP20\A0007287.exe Infected: not-a-virus:AdWare.Win32.Agent.at skipped C:\System Volume Information\_restore{C4EE6BC2-8580-4263-BB6A-CC8A87B1926A}\RP20\A0007288.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.de skipped C:\System Volume Information\_restore{C4EE6BC2-8580-4263-BB6A-CC8A87B1926A}\RP20\change.log Object is locked skipped D:\System Volume Information\_restore{C4EE6BC2-8580-4263-BB6A-CC8A87B1926A}\RP11\A0005502.exe Infected: not-a-virus:Client-IRC.Win32.mIRC.591 skipped Scan process completed. ਍ --------------------------------- i tried to delete all the files you wanted me to, but there was still one that kept returning back everytime i tried to delete it.. it was:: O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing) I ran a system scan, i ticked that and then clicked 'fix checked', and when i ran another scan again, it was still there.. so im not sure how to get rid of that... i also cudn't find these two files:: C:\Documents and Settings\My PC\Local Settings\Application Data\vvdkkpe.dll C:\Documents and Settings\My PC\Local Settings\Application Data\vorenbj.dll but the other files you told me to delete i found and got them all... the computer is running a little faster than before... but the smitfraud toolbar is gone from the IE which is a relief .. thank you

12-01-2006, 10:19 PM	#12 (permalink)
filo_romz Registered User Join Date: Dec 2005 Posts: 20 OS: WinXP	i followed ur steps and the symantec/norton code is now gone! Thank you.. here's the recent HJT log file:: -------------- Logfile of HijackThis v1.99.1 Scan saved at 9:31:43 AM, on 2/12/2006 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe C:\Program Files\Java\jre1.5.0_08\bin\jusched.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe C:\Program Files\Messenger\msmsgs.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\NETGEAR\WG111v2 Configuration Utility\RtlWake.exe C:\WINDOWS\system32\wuauclt.exe C:\HijackThis\filo.exe O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [RtWLan] C:\Program Files\NETGEAR\WG111v2 Configuration Utility\RtWLan.exe /H O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_08\bin\jusched.exe" O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - Startup: LimeWire On Startup.lnk = C:\Program Files\LimeWire\LimeWire.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O4 - Global Startup: WG111v2 Smart Wizard Wireless Setting.lnk = C:\Program Files\NETGEAR\WG111v2 Configuration Utility\RtlWake.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~1\Office10\EXCEL.EXE/3000 O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/par...an_unicode.cab O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe ------------------- there's still some viruses that kaspersky picked up, im running the avg anti-virus, and avg-anti-spyware programs now .. thank you so much for helping!! =)

12-01-2006, 10:53 PM	#13 (permalink)
fredmh Analyst, Security Team ; TSF Supporter Join Date: May 2006 Location: Phila,Pa Posts: 2,335 OS: XP	Congratulations. Your logs are now clean. Please complete the next "housekeeping" steps and read through the information below The Smitfraud you see in Kaspersky is merely the tool we used. You may delete it if you wish as it is updated frequently and might even be out of date. The other files will be addressed below. ---------------------------------------- Windows XP - Reset Hidden Files Click Start. Open My Computer. Select the Tools menu and click Folder Options. Select the View tab. Deselect the Show hidden files and folders option. Select the Hide file extensions for known types option. Select the Hide protected operating system files option. Click Yes to confirm. Click OK. ---------------------------------------- Clean-out and Reset System Restore This will clean out any junk or malicious files left behind in System Restore including what you see in Kaspersky. To turn off System Restore click Start > Right Click My Computer > Properties. Click the System Restore tab and Check "Turn off System Restore" or "Turn off System Restore on all drives" Click Apply. When turning off System Restore, the existing restore points will be deleted. Click Yes to do this then Click OK. Turn on System Restore by Clicking Start. Right-click My Computer, and then click Properties. Click the System Restore tab. Uncheck "Turn off System Restore" or "Turn off System Restore on all drives." Click Apply, and then OK. This will create a new Restore Point. ---------------------------------------- RE-ENABLE ANTI-SPYWARE APPLICATIONS If you were instructed to dis-able Anti-spyware applications during this fix, you may re-enable them ---------------------------------------- Please read through the following information to help protect your computer in the future. KEEP YOUR OPERATING SYSTEM UPDATED Please ensure that you have already patched your system against the recent WMF exploit. Go to this page to get the KB912919 patch MICROSOFT UPDATES It is very important that you get all of the critical updates for your Operating System and Internet Explorer. Keeping your OS and browser up to date will help make you less susceptible to attacks by Trojans and viruses. Please go to Microsoft and download all the critical updates to help prevent possible re-infection. ENABLE WINDOWS AUTO UPDATE Go to Start>Run - type wuaucpl.cpl tick on the checkbox - "Keep my computer up to date" Under settings, choose "Automatically download the updates, and install them on the schedule that I specify". Click on "OK". TOOLS TO HELP KEEP YOUR SYSTEM CLEAN Now that you are clean, to help protect your computer in the future I recommend that you get the following free programs: SpywareBlaster to help prevent spyware from installing in the first place. Install & update SpywareBlaster with the latest definitions. After you have updated, click the button - enable protection for all unprotected items SpywareGuard to catch and block spyware before it can execute. SPYBOT - SEARCH & DESTROY Download and install Spybot - Search & Destroy with its TeaTimer option. This will provide realtime spyware & hijacker protection on your computer alongside your virus protection. You should also scan your computer with the program on a regular basis just as you would an antivirus software. A tutorial on installing & using this product can be found here AD-AWARE Download and install Ad-Aware. You should use this program to scan your computer on a regular basis just as you would an antivirus software in conjunction with Spybot. A tutorial on installing & using this product can be found here IE-SPYAD IE/Spyad places more than 4000 dubious websites and domains in the IE Restricted list. This severely impair attempts to infect your system. It basically prevents any downloads (Cookies etc) from the sites listed, although you will still be able to connect to the sites. Download IE-SpyAD - Extract the contents to a new folder From within the folder, double-click install.bat Select Option #2 - Install the new IE-SPYAD list. Then return to the main menu. Select option #4 - Add the old porn sites domain A tutorial for IE-SPYAD can be found here MVPS HOST FILE The MVPS Hosts file replaces your current HOSTS file with one that will restrict known ad sites form serving you unsolicited advertisements. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is the IP of your local computer. Download Host.zip to your desktop. From your Desktop right-click (hosts.zip) and select: Extract All from the menu. Click Next, click Next, select the option: "Show Extracted files" Click Finish This will open the newly created hosts folder on your Desktop. Double-click on the included mvps.bat file, this will rename the existing HOSTS file to HOSTS.MVP, then it will copy the included updated HOSTS file to the correct location on your machine. MCAFEE SITE ADVISOR SITE ADVISOR is a free IE plug-in (also suport for Firefox browser) which is used in conjunction with the Google search engine. It advises which web sites are considered safe and which sites could pose a problem. It also shows what problems were encountered with each site, such as malicious downloads, spam, and related links. ANTI-VIRUS AND FIREWALL PROGRAMS ANTIVIRUS SOFTWARE It is very important that you have anti-virus software running on your machine. This alone can save you a lot of trouble with malware in the future. See this link for a listing of some online antivirus scanners: Anti-Spyware Tutorial Here are some very good free Antivirus products which are available: Avast! AVG If you do not have a firewall, here are 4 free ones available for personal use: Understanding and Using Firewalls ZoneAlarm Avast Antivirus/Firewall Tiny Personal Firewall OutPost Firewall INFORMATIONAL READING In light of your recent troubles, I'm sure you'll like to avoid any future infections. Please take a look at these well written articles: PC SAFETY AND SECURITY HOW DID I GET INFECTED IN THE FIRST PLACE? THE ANTI-SPYWARE TUTORIAL MAKING INTERNET EXPLORER SAFER INVASION OF THE COMPUTER SNATCHERS The Cookie Concept Please respond one more time and let me know you received this post so it can be marked resolved If you feel that we have helped you, please help us keep this site free for all. Please visit our DONATION PAGE. __________________

12-02-2006, 03:25 PM	#14 (permalink)
filo_romz Registered User Join Date: Dec 2005 Posts: 20 OS: WinXP	hey, i followed ur instructions and the viruses are gone! Thank you very much for helping me fredmh! I appreciate it!

12-02-2006, 04:24 PM	#15 (permalink)
fredmh Analyst, Security Team ; TSF Supporter Join Date: May 2006 Location: Phila,Pa Posts: 2,335 OS: XP	My pleasure. Glad I could help. __________________