virus keeps renaming itself in zonealarm

monssef · 06-06-2007, 01:29 PM

hi everyone, this my wifes computer, she got hit by the virus and I cannot get rid of it, I followed all the steps recommended, zeonalarm doesnt stop from popping up with the renamed virus, I included 2 screenshots from zonealarm popping window, please help me clean up my wifes computer.

Deckard's System Scanner v20070603.47
Run by TT on 2007-06-06 at 14:05:03
Computer is in Normal Mode.
--------------------------------------------------------------------------------

-- System Restore --------------------------------------------------------------

System Restore is disabled; attempting to re-enable...success.

-- Last 1 Restore Point(s) --
1: 2007-06-06 19:05:07 UTC - RP144 - System Checkpoint

Backed up registry hives.

Performed disk cleanup.

-- HijackThis (run as TT.exe) --------------------------------------------------

Logfile of HijackThis v1.99.1
Scan saved at 2:07:31 PM, on 6/6/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe
c:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wwSecure.exe
C:\WINDOWS\system32\dllhost.exe
D:\Program Files\SlySoft\AnyDVD\AnyDVD.exe
C:\Acer\Empowering Technology\Acer.Empowering.Framework.Launcher.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\ZoneLabs\avsys\ScanningProcess.exe
C:\PROGRA~1\ZONELA~1\ZONEAL~1\MAILFR~1\mantispm.exe
C:\WINDOWS\system32\ZoneLabs\avsys\ScanningProcess.exe
C:\Program Files\Lavasoft\Ad-Aware SE Professional\Ad-Watch.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\TT\Desktop\dss.exe
C:\PROGRA~1\HIJACK~1\TT.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://global.acer.com
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - c:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {51A39D43-CB2D-4735-A82F-ECCBA6ED1319} - C:\WINDOWS\system32\byxxwww.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\WINDOWS\system32\eDStoolbar.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKCU\..\Run: [AnyDVD] "D:\Program Files\SlySoft\AnyDVD\AnyDVD.exe"
O4 - Global Startup: Acer Empowering Technology.lnk = ?
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab
O20 - Winlogon Notify: awtqr - C:\WINDOWS\system32\awtqr.dll (file missing)
O20 - Winlogon Notify: byxxwww - C:\WINDOWS\SYSTEM32\byxxwww.dll
O20 - Winlogon Notify: pmnllij - pmnllij.dll (file missing)
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Memory Check Service (AcerMemUsageCheckService) - Acer Inc. - C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - c:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: Washer Security Access (wwSecSvc) - Webroot Software, Inc. - C:\WINDOWS\system32\wwSecure.exe

-- File Associations -----------------------------------------------------------

All associations okay.

-- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ---------------------

R0 UBHelper - c:\windows\system32\drivers\ubhelper.sys
R1 SCDEmu - c:\windows\system32\drivers\scdemu.sys <Not Verified; PowerISO Computing, Inc.; scdemu>
R2 SVKP - c:\windows\system32\svkp.sys <Not Verified; AntiCracking; SVKP driver for NT>
R3 NTIDrvr (Upper Class Filter Driver) - c:\windows\system32\drivers\ntidrvr.sys <Not Verified; NewTech Infosystems, Inc.; >
R3 Pcouffin (Low level access layer for CD devices) - c:\windows\system32\drivers\pcouffin.sys <Not Verified; VSO Software; Patin couffin engine>

S0 kl1 - c:\windows\system32\drivers\kl1.sys (file missing)
S3 int15.sys - c:\acer\empowering technology\erecovery\int15.sys
S3 psdfilter - c:\windows\system32\drivers\psdfilter.sys <Not Verified; HiTRUST; >
S3 psdvdisk - c:\windows\system32\drivers\psdvdisk.sys <Not Verified; HiTRUST; >
S3 ZDPSp50 (ZDPSp50 NDIS Protocol Driver) - c:\windows\system32\drivers\zdpsp50.sys <Not Verified; Printing Communications Assoc., Inc. (PCAUSA); PCAUSA Rawether for Windows>

-- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------

R2 AcerMemUsageCheckService (Memory Check Service) - c:\acer\empowering technology\eperformance\memcheck.exe <Not Verified; Acer Inc.; >

S3 NBService - c:\program files\nero\nero 7\nero backitup\nbservice.exe

-- Files created between 2007-05-06 and 2007-06-06 -----------------------------

2007-06-06 14:07:04 262708 --a------ C:\WINDOWS\system32\ddabx.dll
2007-06-06 13:26:29 21312 --a------ C:\WINDOWS\choice.exe
2007-06-06 13:26:01 0 d-------- C:\ie-spyad
2007-06-06 13:11:31 118784 --a------ C:\WINDOWS\system32\MSSTDFMT.DLL <Not Verified; Microsoft Corporation; MSSTDFMT Object Library>
2007-06-06 13:11:30 0 d-------- C:\Program Files\SpywareBlaster
2007-06-06 13:07:03 262708 --a------ C:\WINDOWS\system32\ddcya.dll
2007-06-06 11:07:01 262708 --a------ C:\WINDOWS\system32\gebyx.dll
2007-06-06 10:07:00 262708 --a------ C:\WINDOWS\system32\sstqo.dll
2007-06-06 09

59 262708 --a------ C:\WINDOWS\system32\jkhhe.dll
2007-06-06 08

59 262708 --a------ C:\WINDOWS\system32\mllmj.dll
2007-06-06 07

59 262708 --a------ C:\WINDOWS\system32\awvvs.dll
2007-06-06 06

56 262708 --a------ C:\WINDOWS\system32\sstts.dll
2007-06-06 05

55 262708 --a------ C:\WINDOWS\system32\awtsq.dll
2007-06-06 04

57 262708 --a------ C:\WINDOWS\system32\pmnlk.dll
2007-06-06 03:10:09 0 d-------- C:\WINDOWS\system32\ActiveScan
2007-06-06 03:10:08 0 d-------- C:\WINDOWS\LastGood
2007-06-06 03

53 262708 --a------ C:\WINDOWS\system32\awtst.dll
2007-06-06 01:15:45 0 d-------- C:\Documents and Settings\TT\Application Data\Lavasoft
2007-06-06 01:14:29 0 d-------- C:\Program Files\Lavasoft
2007-06-05 12:46:46 0 d-a------ C:\Documents and Settings\All Users\Application Data\TEMP
2007-06-02 23:25:03 285273 --ahs---- C:\WINDOWS\system32\ssttu.dll
2007-06-01 16:12:52 1618113 --ahs---- C:\WINDOWS\system32\bdeeg.bak2
2007-05-31 16:12:44 1569337 --ahs---- C:\WINDOWS\system32\bdeeg.bak1
2007-05-31 16:00:57 26166 --a------ C:\WINDOWS\system32\byxxwww.dll
2007-05-31 15:41:25 0 d-------- C:\Documents and Settings\TT\Application Data\Apple Computer
2007-05-31 15:41:07 1759 --a------ C:\Documents and Settings\All Users\Application Data\QTSBandwidthCache
2007-05-31 01:44:55 823296 --a------ C:\WINDOWS\system32\divx_xx07.dll <Not Verified; DivX, Inc.; DivX®>
2007-05-31 01:44:54 802816 --a------ C:\WINDOWS\system32\divx_xx11.dll <Not Verified; DivX, Inc.; DivX?>
2007-05-31 01:44:54 823296 --a------ C:\WINDOWS\system32\divx_xx0c.dll <Not Verified; DivX, Inc.; DivX®>
2007-05-31 01:44:54 740442 --a------ C:\WINDOWS\system32\DivX.dll <Not Verified; DivX, Inc.; DivX®>
2007-05-16 19:01:43 0 d-------- C:\Documents and Settings\TT\Application Data\vlc
2007-05-16 19:00:40 0 d-------- C:\Program Files\VideoLAN
2007-05-15 21:05:55 0 d-------- C:\Documents and Settings\TT\Application Data\AccurateRip
2007-05-15 20:53:51 2145 --a------ C:\WINDOWS\system32\SpoonUninstall-dMC Generic CLI Encoder.dat
2007-05-15 20:26:02 3365 --a------ C:\WINDOWS\system32\SpoonUninstall-dBpoweramp Windows Media Audio 10 Codec.dat
2007-05-15 20:25:42 3007 --a------ C:\WINDOWS\system32\SpoonUninstall-dBpoweramp WavPack Codec.dat
2007-05-15 20:24:10 2649 --a------ C:\WINDOWS\system32\SpoonUninstall-dBpoweramp Midi Decoder.dat
2007-05-15 20:23:55 3590 --a------ C:\WINDOWS\system32\SpoonUninstall-dBpoweramp m4a Codec.dat
2007-05-15 20:23:12 2951 --a------ C:\WINDOWS\system32\SpoonUninstall-dBpoweramp CLI Encoder.dat
2007-05-15 20:19:14 2234 --a------ C:\WINDOWS\system32\SpoonUninstall-dBpowerAMP VQF Codec.dat
2007-05-15 20:18:33 2995 --a------ C:\WINDOWS\system32\SpoonUninstall-dBPowerAMP Real Audio Encoder R3.dat
2007-05-15 20:17:23 1928 --a------ C:\WINDOWS\system32\SpoonUninstall-dBpowerAMP Real Audio Codec.dat
2007-05-15 20:17:09 2999 --a------ C:\WINDOWS\system32\SpoonUninstall-dBpoweramp Ogg Vorbis Codec.dat
2007-05-15 20:16:53 3283 --a------ C:\WINDOWS\system32\SpoonUninstall-dBpoweramp Musepack Codec.dat
2007-05-15 20:16:41 620 --a------ C:\WINDOWS\system32\SpoonUninstall-dBpowerAMP FAAC Mp4 Codec.dat
2007-05-15 20:16:28 2218 --a------ C:\WINDOWS\system32\SpoonUninstall-dBpowerAMP Mp4 & AAC Decode Codec.dat
2007-05-15 20:12:56 3107 --a------ C:\WINDOWS\system32\SpoonUninstall-dBpoweramp Monkeys Audio Codec.dat
2007-05-15 20:12:41 2920 --a------ C:\WINDOWS\system32\SpoonUninstall-dBpoweramp FLAC Codec.dat
2007-05-15 20:12:20 739 --a------ C:\WINDOWS\system32\SpoonUninstall-dBPowerAMP AIFF codec r4.dat
2007-05-15 20:12:16 516 --a------ C:\WINDOWS\system32\SpoonUninstall-dBpowerAMP AAC to Mp4 Codec.dat
2007-05-15 20:12:06 1122 --a------ C:\WINDOWS\system32\SpoonUninstall-dBpowerAMP AAC Codec.dat
2007-05-15 20:09:49 167424 --a------ C:\WINDOWS\system32\SpoonUninstall.exe
2007-05-15 19:49:29 0 d-------- C:\Program Files\Common Files\xing shared
2007-05-15 19:43:14 0 d-------- C:\Program Files\XVid;-)
2007-05-15 16:26:21 0 d-------- C:\Program Files\Winamp
2007-05-15 16:15:56 57061 --a------ C:\WINDOWS\system32\SpoonUninstall-dBpowerAMP.dat
2007-05-15 16:09:46 2074 --a------ C:\WINDOWS\system32\SpoonUninstall-dBpowerAMP mp3PRO Input Codec.dat
2007-05-15 16:08:38 2467 --a------ C:\WINDOWS\system32\SpoonUninstall-dMC mp3PRO (CLI) Encoder.dat
2007-05-15 16:05:45 9220 --a------ C:\WINDOWS\system32\SpoonUninstall-dMC Power Pack.dat
2007-05-15 14:55:47 8650752 --a------ C:\Documents and Settings\TT\ntuser.dat
2007-05-13 15:31:49 240 --a------ C:\WINDOWS\system32\RfmDat2.dat
2007-05-13 02:07:05 0 d-------- C:\Documents and Settings\TT\Application Data\AdobeUM
2007-05-11 22:56:20 73216 --a------ C:\WINDOWS\ST6UNST.EXE <Not Verified; Microsoft Corporation; Microsoft® Visual Basic for Windows>
2007-05-11 15:53:36 0 d-------- C:\Documents and Settings\TT\Application Data\EFSoftware
2007-05-10 20:19:45 0 d-------- C:\Program Files\AC3Filter
2007-05-10 20:19:32 180224 --a------ C:\WINDOWS\system32\xvidvfw.dll
2007-05-10 20:19:32 765952 --a------ C:\WINDOWS\system32\xvidcore.dll
2007-05-10 20:19:32 0 d-------- C:\Program Files\Xvid
2007-05-10 19:59:28 0 d-------- C:\Program Files\GSpot270a
2007-05-10 19:29:33 0 d-------- C:\Documents and Settings\TT\Application Data\DivX
2007-05-10 19:21:31 0 d-------- C:\Program Files\DivX

-- Find3M Report ---------------------------------------------------------------

2007-06-06 03:30:30 0 d-------- C:\Program Files\Common Files\Webroot Shared
2007-06-06 03:30:00 0 d-------- C:\Program Files\Common Files\LightScribe
2007-06-05 19:31:22 512 --a------ C:\ScanSectorLog.dat
2007-06-05 13:43:57 0 d-------- C:\Program Files\Webroot
2007-06-05 13:43:55 0 d-------- C:\Documents and Settings\TT\Application Data\Webroot
2007-06-03 22:00:02 0 d-------- C:\Documents and Settings\TT\Application Data\uTorrent
2007-06-01 18:43:25 0 d-------- C:\Documents and Settings\TT\Application Data\dvdcss
2007-05-31 15:47:02 0 d--h----- C:\Program Files\InstallShield Installation Information
2007-05-31 15:38:15 0 d-------- C:\Program Files\QuickTime
2007-05-24 01:48:41 0 d-------- C:\Program Files\Java
2007-05-15 19:49:26 0 d-------- C:\Program Files\Common Files\Real
2007-05-06 18:48:45 16 --a------ C:\WINDOWS\popcinfo.dat
2007-04-26 19:20:13 0 d-------- C:\Program Files\Common Files\AC3ACM_1.31
2007-04-26 19:19:51 0 d-------- C:\Program Files\Common Files\vorbisacm_20020708
2007-04-26 19:10:05 232592 --a------ C:\Program Files\Common Files\l3codecx.exe <Not Verified; Microsoft Corporation; Microsoft(R) Windows NT(R) Operating System>
2007-04-26 00:05:10 0 d-------- C:\Documents and Settings\TT\Application Data\GameHouse
2007-04-26 00:04:15 0 d-------- C:\Program Files\GameHouse
2007-04-24 03:47:37 4212 --ah----- C:\WINDOWS\system32\zllictbl.dat
2007-04-22 19:15:29 3596288 --a------ C:\WINDOWS\system32\qt-dx331.dll
2007-04-22 19:02:34 196608 --a------ C:\WINDOWS\system32\dtu100.dll <Not Verified; DivX, Inc.; DivX, Inc. dtu100>
2007-04-22 19:02:34 73728 --a------ C:\WINDOWS\system32\dpl100.dll <Not Verified; DivX, Inc.; DivX, Inc. dpl100>
2007-04-22 19:01:47 12288 --a------ C:\WINDOWS\system32\DivXWMPExtType.dll
2007-03-26 02:52:14 2368 --a------ C:\WINDOWS\system32\SVKP.sys <Not Verified; AntiCracking; SVKP driver for NT>
2007-03-25 23:42:09 112968 --a------ C:\WINDOWS\hpoins07.dat
2007-03-06 22:15:20 188 --a------ C:\WINDOWS\system32\eDataSecurity.dat

-- Registry Dump ---------------------------------------------------------------

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} c:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
{51A39D43-CB2D-4735-A82F-ECCBA6ED1319} C:\WINDOWS\system32\byxxwww.dll
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"NvCplDaemon"="RUNDLL32.EXE C:\\WINDOWS\\system32\\NvCpl.dll,NvStartup"
"ZoneAlarm Client"="\"C:\\Program Files\\Zone Labs\\ZoneAlarm\\zlclient.exe\""

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"AnyDVD"="\"D:\\Program Files\\SlySoft\\AnyDVD\\AnyDVD.exe\""

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"InstallVisualStyle"=hex(2):43,3a,5c,57,49,4e,44,4f,57,53,5c,52,65,73,6f,75,72,\
63,65,73,5c,54,68,65,6d,65,73,5c,52,6f,79,61,6c,65,5c,52,6f,79,61,6c,65,2e,\
6d,73,73,74,79,6c,65,73,00
"InstallTheme"=hex(2):43,3a,5c,57,49,4e,44,4f,57,53,5c,52,65,73,6f,75,72,63,65,\
73,5c,54,68,65,6d,65,73,5c,52,6f,79,61,6c,65,2e,74,68,65,6d,65,00

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{51A39D43-CB2D-4735-A82F-ECCBA6ED1319}"=""

HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\awtqr
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\byxxwww
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\pmnllij

HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa
Authentication Packages REG_MULTI_SZ msv1_0\0\0
Security Packages REG_MULTI_SZ kerberos\0msv1_0\0schannel\0wdigest\0\0
Notification Packages REG_MULTI_SZ scecli\0\0

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Acer WLAN 11g USB Dongle.lnk]
"path"="C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Startup\\Acer WLAN 11g USB Dongle.lnk"
"backup"="C:\\WINDOWS\\pss\\Acer WLAN 11g USB Dongle.lnkCommon Startup"
"location"="Common Startup"
"command"="C:\\PROGRA~1\\ACERWL~1\\ZDWlan.exe "
"item"="Acer WLAN 11g USB Dongle"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
"path"="C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Startup\\Adobe Reader Speed Launch.lnk"
"backup"="C:\\WINDOWS\\pss\\Adobe Reader Speed Launch.lnkCommon Startup"
"location"="Common Startup"
"command"="C:\\PROGRA~1\\Adobe\\ACROBA~1.0\\Reader\\READER~1.EXE "
"item"="Adobe Reader Speed Launch"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
"path"="C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Startup\\HP Digital Imaging Monitor.lnk"
"backup"="C:\\WINDOWS\\pss\\HP Digital Imaging Monitor.lnkCommon Startup"
"location"="Common Startup"
"command"="C:\\PROGRA~1\\HP\\DIGITA~1\\bin\\hpqtra08.exe "
"item"="HP Digital Imaging Monitor"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"=""
"hkey"="HKLM"
"command"=""
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acer Empowering Technology Monitor]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="SysMonitor"
"hkey"="HKLM"
"command"="C:\\WINDOWS\\system32\\SysMonitor.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="ALCMTR"
"hkey"="HKLM"
"command"="ALCMTR.EXE"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="NMBgMonitor"
"hkey"="HKCU"
"command"="\"C:\\Program Files\\Common Files\\Ahead\\Lib\\NMBgMonitor.exe\""
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\eDataSecurity Loader]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="eDSloader"
"hkey"="HKLM"
"command"="C:\\Acer\\Empowering Technology\\eDataSecurity\\eDSloader.exe 0"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ehTray]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="ehtray"
"hkey"="HKLM"
"command"="C:\\WINDOWS\\ehome\\ehtray.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\eRecoveryService]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="eRAgent"
"hkey"="HKLM"
"command"="C:\\Acer\\Empowering Technology\\eRecovery\\eRAgent.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="HPWuSchd2"
"hkey"="HKLM"
"command"="C:\\Program Files\\HP\\HP Software Update\\HPWuSchd2.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IMEKRMIG6.1]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="IMEKRMIG"
"hkey"="HKLM"
"command"="C:\\WINDOWS\\ime\\imkr6_1\\IMEKRMIG.EXE"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IMJPMIG8.1]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="IMJPMIG"
"hkey"="HKLM"
"command"="\"C:\\WINDOWS\\IME\\imjp8_1\\IMJPMIG.EXE\" /Spoil /RemAdvDef /Migration32"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InCD]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="InCD"
"hkey"="HKLM"
"command"="C:\\Program Files\\Nero\\Nero 7\\InCD\\InCD.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LaunchApp]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="Alaunch"
"hkey"="HKLM"
"command"="Alaunch"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="msmsgs"
"hkey"="HKCU"
"command"="\"C:\\Program Files\\Messenger\\msmsgs.exe\" /background"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSPY2002]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="ImScInst"
"hkey"="HKLM"
"command"="C:\\WINDOWS\\system32\\IME\\PINTLGNT\\ImScInst.exe /SYNC"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="NeroCheck"
"hkey"="HKLM"
"command"="C:\\Program Files\\Common Files\\Ahead\\Lib\\NeroCheck.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ntiMUI]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="ntiMUI"
"hkey"="HKLM"
"command"="c:\\Program Files\\NewTech Infosystems\\NTI CD & DVD-Maker 7\\ntiMUI.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="NvCpl"
"hkey"="HKLM"
"command"="\"RUNDLL32.EXE\" C:\\WINDOWS\\system32\\NvCpl.dll,NvStartup"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="NvMcTray"
"hkey"="HKLM"
"command"="RUNDLL32.EXE C:\\WINDOWS\\system32\\NvMcTray.dll,NvTaskbarInit"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="nwiz"
"hkey"="HKLM"
"command"="nwiz.exe /install"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002A]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="TINTSETP"
"hkey"="HKLM"
"command"="C:\\WINDOWS\\system32\\IME\\TINTLGNT\\TINTSETP.EXE /IMEName"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002ASync]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="TINTSETP"
"hkey"="HKLM"
"command"="C:\\WINDOWS\\system32\\IME\\TINTLGNT\\TINTSETP.EXE /SYNC"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="qttask"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="RTHDCPL"
"hkey"="HKLM"
"command"="RTHDCPL.EXE"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SDTray]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="SDTrayApp"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\Spyware Doctor\\SDTrayApp.exe\""
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SkyTel]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="SkyTel"
"hkey"="HKLM"
"command"="SkyTel.EXE"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SMSERIAL]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="sm56hlpr"
"hkey"="HKLM"
"command"="sm56hlpr.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="jusched"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\Java\\jre1.6.0_01\\bin\\jusched.exe\""
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="realsched"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\" -osboot"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Window Washer]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="wwDisp"
"hkey"="HKCU"
"command"="C:\\Program Files\\Webroot\\Washer\\wwDisp.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost]
HTTPFilter REG_MULTI_SZ HTTPFilter\0\0
LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0
NetworkService REG_MULTI_SZ DnsCache\0\0
DcomLaunch REG_MULTI_SZ DcomLaunch\0TermService\0\0
rpcss REG_MULTI_SZ RpcSs\0\0
imgsvc REG_MULTI_SZ StiSvc\0\0
termsvcs REG_MULTI_SZ TermService\0\0
WudfServiceGroup REG_MULTI_SZ WUDFSvc\0\0

-- End of Deckard's System Scanner: finished at 2007-06-06 at 14:08:44 ---------

monssef · 06-08-2007, 12:41 PM

bump!

monssef · 06-08-2007, 08:27 PM

Please, what Im doing wrong not to get help, I checked some threads and they posted after me my post was at 2:00pm 50 hours ago and they posted at 6:00pm and they already got help, my wifes cannot use her computer because zonealarm keeps popping trying to clean that virus and instead it says renamed, renamed.....
the virues called virtumonde I believe, look at the screenshot, thank you and sorry to bump the thread.

tetonbob · 06-08-2007, 09:12 PM

Download combofix.exe to your desktop.
Double click on combofix.exe & follow the prompts.
When finished, it shall produce a log for you, C:\ComboFix.txt. Post that log in your next reply, along with a new HijackThis log.

Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall

---------------------------------------------------------------------------------------------

monssef · 06-08-2007, 09:58 PM

thank you so much for your reply, here is the log from combofix.exe

ComboFix 07-06-09.1 - C:\Documents and Settings\TT\Desktop\ComboFix.exe
"TT" - 2007-06-08 22:44:57 - Service Pack 2 NTFS

(((((((((((((((((((((((((((((((((((((((((((( V Log )))))))))))))))))))))))))))))))))))))))))))))))))))))))

C:\WINDOWS\system32\awtqo.dll
C:\WINDOWS\system32\awtst.dll
C:\WINDOWS\system32\awvvs.dll
C:\WINDOWS\system32\ddayy.dll
C:\WINDOWS\system32\gebcy.dll
C:\WINDOWS\system32\gebyy.dll
C:\WINDOWS\system32\geebx.dll
C:\WINDOWS\system32\jkhhe.dll
C:\WINDOWS\system32\jkhhi.dll
C:\WINDOWS\system32\jkkjj.dll
C:\WINDOWS\system32\mljjj.dll
C:\WINDOWS\system32\mllmm.dll
C:\WINDOWS\system32\pmkhe.dll
C:\WINDOWS\system32\pmkjh.dll
C:\WINDOWS\system32\sstqo.dll
C:\WINDOWS\system32\ssttu.dll
C:\WINDOWS\system32\vtsts.dll
C:\WINDOWS\system32\vturq.dll
C:\WINDOWS\system32\vtutq.dll
C:\WINDOWS\system32\pmnno.dll
C:\WINDOWS\system32\awtqp.dll
C:\WINDOWS\system32\awtsq.dll
C:\WINDOWS\system32\awvvu.dll
C:\WINDOWS\system32\ddabc.dll
C:\WINDOWS\system32\ddabx.dll
C:\WINDOWS\system32\ddayw.dll
C:\WINDOWS\system32\ddcca.dll
C:\WINDOWS\system32\ddcya.dll
C:\WINDOWS\system32\ddcyv.dll
C:\WINDOWS\system32\ddcyw.dll
C:\WINDOWS\system32\gebcb.dll
C:\WINDOWS\system32\gebyw.dll
C:\WINDOWS\system32\gebyx.dll
C:\WINDOWS\system32\geeba.dll
C:\WINDOWS\system32\jkhfd.dll
C:\WINDOWS\system32\jkkjk.dll
C:\WINDOWS\system32\jkkli.dll
C:\WINDOWS\system32\jkklj.dll
C:\WINDOWS\system32\mljgf.dll
C:\WINDOWS\system32\mljgg.dll
C:\WINDOWS\system32\mllmj.dll
C:\WINDOWS\system32\pmkhg.dll
C:\WINDOWS\system32\pmkhi.dll
C:\WINDOWS\system32\pmnlk.dll
C:\WINDOWS\system32\pmnnk.dll
C:\WINDOWS\system32\pmnnm.dll
C:\WINDOWS\system32\ssqpn.dll
C:\WINDOWS\system32\ssqpp.dll
C:\WINDOWS\system32\ssqro.dll
C:\WINDOWS\system32\sstqr.dll
C:\WINDOWS\system32\sstts.dll
C:\WINDOWS\system32\vtsqr.dll
C:\WINDOWS\system32\vturr.dll
C:\WINDOWS\system32\vtutr.dll
C:\WINDOWS\system32\uttss.ini
C:\WINDOWS\system32\bdeeg.bak1
C:\WINDOWS\system32\bdeeg.bak2
C:\WINDOWS\system32\bdeeg.ini
C:\WINDOWS\system32\byxxwww.dll

* * * POST RUN FILES/FOLDERS * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

C:\DOCUME~1\TT\Desktop.\internet explorer.lnk

((((((((((((((((((((((((( Files Created from 2007-05-09 to 2007-06-09 )))))))))))))))))))))))))))))))

2007-06-08 22:44 49,152 --a------ C:\WINDOWS\nircmd.exe
2007-06-08 18:23 87,608 --a------ C:\DOCUME~1\TT\APPLIC~1\ezpinst.exe
2007-06-08 18:23 47,360 --a------ C:\DOCUME~1\TT\APPLIC~1\pcouffin.sys
2007-06-08 18:23 <DIR> d-------- C:\DOCUME~1\TT\APPLIC~1\Vso
2007-06-06 14:04 <DIR> d-------- C:\Deckard
2007-06-06 13:26 21,312 --a------ C:\WINDOWS\choice.exe
2007-06-06 13:26 <DIR> d-------- C:\ie-spyad
2007-06-06 13:11 118,784 --a------ C:\WINDOWS\system32\MSSTDFMT.DLL
2007-06-06 13:11 <DIR> d-------- C:\Program Files\SpywareBlaster
2007-06-06 03:10 <DIR> d-------- C:\WINDOWS\system32\ActiveScan
2007-06-06 03:10 <DIR> d-------- C:\WINDOWS\LastGood.Tmp
2007-06-06 01:15 <DIR> d-------- C:\DOCUME~1\TT\APPLIC~1\Lavasoft
2007-06-06 01:14 <DIR> d-------- C:\Program Files\Lavasoft
2007-06-05 13:27 626,688 --a------ C:\WINDOWS\system32\msvcr80.dll
2007-06-05 12:46 <DIR> d-a------ C:\DOCUME~1\ALLUSE~1\APPLIC~1\TEMP
2007-05-31 15:41 <DIR> d-------- C:\DOCUME~1\TT\APPLIC~1\Apple Computer
2007-05-31 01:45 524,288 --a------ C:\WINDOWS\system32\DivXsm.exe
2007-05-31 01:44 823,296 --a------ C:\WINDOWS\system32\divx_xx0c.dll
2007-05-31 01:44 823,296 --a------ C:\WINDOWS\system32\divx_xx07.dll
2007-05-31 01:44 802,816 --a------ C:\WINDOWS\system32\divx_xx11.dll
2007-05-31 01:44 740,442 --a------ C:\WINDOWS\system32\DivX.dll
2007-05-16 19:01 <DIR> d-------- C:\DOCUME~1\TT\APPLIC~1\vlc
2007-05-16 19:00 <DIR> d-------- C:\Program Files\VideoLAN
2007-05-15 21:05 <DIR> d-------- C:\DOCUME~1\TT\APPLIC~1\AccurateRip
2007-05-15 20:53 2,145 --a------ C:\WINDOWS\system32\SpoonUninstall-dMC Generic CLI Encoder.dat
2007-05-15 20:26 3,365 --a------ C:\WINDOWS\system32\SpoonUninstall-dBpoweramp Windows Media Audio 10 Codec.dat
2007-05-15 20:25 3,007 --a------ C:\WINDOWS\system32\SpoonUninstall-dBpoweramp WavPack Codec.dat
2007-05-15 20:24 2,649 --a------ C:\WINDOWS\system32\SpoonUninstall-dBpoweramp Midi Decoder.dat
2007-05-15 20:23 3,590 --a------ C:\WINDOWS\system32\SpoonUninstall-dBpoweramp m4a Codec.dat
2007-05-15 20:23 2,951 --a------ C:\WINDOWS\system32\SpoonUninstall-dBpoweramp CLI Encoder.dat
2007-05-15 20:19 2,234 --a------ C:\WINDOWS\system32\SpoonUninstall-dBpowerAMP VQF Codec.dat
2007-05-15 20:18 2,995 --a------ C:\WINDOWS\system32\SpoonUninstall-dBPowerAMP Real Audio Encoder R3.dat
2007-05-15 20:17 2,999 --a------ C:\WINDOWS\system32\SpoonUninstall-dBpoweramp Ogg Vorbis Codec.dat
2007-05-15 20:17 1,928 --a------ C:\WINDOWS\system32\SpoonUninstall-dBpowerAMP Real Audio Codec.dat
2007-05-15 20:16 620 --a------ C:\WINDOWS\system32\SpoonUninstall-dBpowerAMP FAAC Mp4 Codec.dat
2007-05-15 20:16 3,283 --a------ C:\WINDOWS\system32\SpoonUninstall-dBpoweramp Musepack Codec.dat
2007-05-15 20:16 2,218 --a------ C:\WINDOWS\system32\SpoonUninstall-dBpowerAMP Mp4 & AAC Decode Codec.dat
2007-05-15 20:12 739 --a------ C:\WINDOWS\system32\SpoonUninstall-dBPowerAMP AIFF codec r4.dat
2007-05-15 20:12 516 --a------ C:\WINDOWS\system32\SpoonUninstall-dBpowerAMP AAC to Mp4 Codec.dat
2007-05-15 20:12 3,107 --a------ C:\WINDOWS\system32\SpoonUninstall-dBpoweramp Monkeys Audio Codec.dat
2007-05-15 20:12 2,920 --a------ C:\WINDOWS\system32\SpoonUninstall-dBpoweramp FLAC Codec.dat
2007-05-15 20:12 1,122 --a------ C:\WINDOWS\system32\SpoonUninstall-dBpowerAMP AAC Codec.dat
2007-05-15 20:09 167,424 --a------ C:\WINDOWS\system32\SpoonUninstall.exe
2007-05-15 19:49 <DIR> d-------- C:\Program Files\Common Files\xing shared
2007-05-15 19:43 <DIR> d-------- C:\Program Files\XVid;-)
2007-05-15 16:26 <DIR> d-------- C:\Program Files\Winamp
2007-05-15 16:15 57,061 --a------ C:\WINDOWS\system32\SpoonUninstall-dBpowerAMP.dat
2007-05-15 16:09 2,074 --a------ C:\WINDOWS\system32\SpoonUninstall-dBpowerAMP mp3PRO Input Codec.dat
2007-05-15 16:08 2,467 --a------ C:\WINDOWS\system32\SpoonUninstall-dMC mp3PRO (CLI) Encoder.dat
2007-05-15 16:05 9,220 --a------ C:\WINDOWS\system32\SpoonUninstall-dMC Power Pack.dat
2007-05-15 14:55 8,650,752 --a------ C:\DOCUME~1\TT\ntuser.dat
2007-05-13 15:31 240 --a------ C:\WINDOWS\system32\RfmDat2.dat
2007-05-13 02:07 <DIR> d-------- C:\DOCUME~1\TT\APPLIC~1\AdobeUM
2007-05-11 22:56 73,216 --a------ C:\WINDOWS\ST6UNST.EXE
2007-05-11 22:56 249,856 --------- C:\WINDOWS\Setup1.exe
2007-05-11 15:53 <DIR> d-------- C:\DOCUME~1\TT\APPLIC~1\EFSoftware
2007-05-10 20:19 765,952 --a------ C:\WINDOWS\system32\xvidcore.dll
2007-05-10 20:19 180,224 --a------ C:\WINDOWS\system32\xvidvfw.dll
2007-05-10 20:19 <DIR> d-------- C:\Program Files\Xvid
2007-05-10 20:19 <DIR> d-------- C:\Program Files\AC3Filter
2007-05-10 19:59 <DIR> d-------- C:\Program Files\GSpot270a
2007-05-10 19:29 <DIR> d-------- C:\DOCUME~1\TT\APPLIC~1\DivX
2007-05-10 19:21 2,560 --a------ C:\WINDOWS\system32\drivers\cdralw2k.sys
2007-05-10 19:21 2,432 --a------ C:\WINDOWS\system32\drivers\cdr4_xp.sys
2007-05-10 19:21 129,784 --a------ C:\WINDOWS\system32\pxafs.dll
2007-05-10 19:21 118,520 --a------ C:\WINDOWS\system32\pxinsi64.exe
2007-05-10 19:21 116,472 --a------ C:\WINDOWS\system32\pxcpyi64.exe
2007-05-10 19:21 <DIR> d-------- C:\Program Files\DivX

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-06-08 23:23:47 47,360 ----a-w C:\WINDOWS\system32\drivers\pcouffin.sys
2007-06-06 08:30:30 -------- d-----w C:\Program Files\Common Files\Webroot Shared
2007-06-06 08:30:00 -------- d-----w C:\Program Files\Common Files\LightScribe
2007-06-06 00:31:22 512 ----a-w C:\ScanSectorLog.dat
2007-06-05 18:43:57 -------- d-----w C:\Program Files\Webroot
2007-06-05 18:43:55 -------- d-----w C:\DOCUME~1\TT\APPLIC~1\Webroot
2007-06-04 03:00:02 -------- d-----w C:\DOCUME~1\TT\APPLIC~1\uTorrent
2007-06-01 23:43:25 -------- d-----w C:\DOCUME~1\TT\APPLIC~1\dvdcss
2007-05-31 20:47:02 -------- d--h--w C:\Program Files\InstallShield Installation Information
2007-05-31 20:38:15 -------- d-----w C:\Program Files\QuickTime
2007-05-16 00:49:26 -------- d-----w C:\Program Files\Common Files\Real
2007-05-06 23:48:45 16 ----a-w C:\WINDOWS\popcinfo.dat
2007-04-27 00:20:13 -------- d-----w C:\Program Files\Common Files\AC3ACM_1.31
2007-04-27 00:19:51 -------- d-----w C:\Program Files\Common Files\vorbisacm_20020708
2007-04-27 00:10:05 232,592 ----a-w C:\Program Files\Common Files\l3codecx.exe
2007-04-26 05:05:10 -------- d-----w C:\DOCUME~1\TT\APPLIC~1\GameHouse
2007-04-26 05:04:15 -------- d-----w C:\Program Files\GameHouse
2007-04-24 08:47:37 4,212 ---ha-w C:\WINDOWS\system32\zllictbl.dat
2007-04-23 00:15:29 3,596,288 ----a-w C:\WINDOWS\system32\qt-dx331.dll
2007-04-23 00:15:18 200,704 ----a-w C:\WINDOWS\system32\ssldivx.dll
2007-04-23 00:15:18 1,044,480 ----a-w C:\WINDOWS\system32\libdivx.dll
2007-04-23 00:02:34 73,728 ----a-w C:\WINDOWS\system32\dpl100.dll
2007-04-23 00:02:34 196,608 ----a-w C:\WINDOWS\system32\dtu100.dll
2007-04-23 00:02:33 53,248 ----a-w C:\WINDOWS\system32\dpuGUI10.dll
2007-04-23 00:02:31 593,920 ----a-w C:\WINDOWS\system32\dpuGUI11.dll
2007-04-23 00:02:31 57,344 ----a-w C:\WINDOWS\system32\dpv11.dll
2007-04-23 00:02:31 344,064 ----a-w C:\WINDOWS\system32\dpus11.dll
2007-04-23 00:02:31 294,912 ----a-w C:\WINDOWS\system32\dpu11.dll
2007-04-23 00:02:31 294,912 ----a-w C:\WINDOWS\system32\dpu10.dll
2007-04-23 00:01:47 12,288 ----a-w C:\WINDOWS\system32\DivXWMPExtType.dll
2007-04-23 00:01:46 124,472 ----a-w C:\WINDOWS\system32\DivXCodecUpdateChecker.exe
2007-03-26 07:52:14 2,368 ----a-w C:\WINDOWS\system32\SVKP.sys
2007-03-26 04:42:09 112,968 ----a-w C:\WINDOWS\hpoins07.dat
2007-03-09 05:02:00 75,512 ----a-w C:\WINDOWS\zllsputility.exe
2007-03-09 05:01:42 1,087,216 ----a-w C:\WINDOWS\system32\zpeng24.dll
2007-03-05 10:29:51 1,682 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}=c:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll [2004-12-14 03:56]
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}=C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll [2007-03-14 03:43]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2007-03-09 00:02]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-07-11 17:19]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AnyDVD"="D:\Program Files\SlySoft\AnyDVD\AnyDVD.exe" [2007-02-17 23:36]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"InstallVisualStyle"=C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
"InstallTheme"=C:\WINDOWS\Resources\Themes\Royale.theme

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\awtqr]
C:\WINDOWS\system32\awtqr.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\pmnllij]
pmnllij.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Acer WLAN 11g USB Dongle.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Acer WLAN 11g USB Dongle.lnk
backup=C:\WINDOWS\pss\Acer WLAN 11g USB Dongle.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
backup=C:\WINDOWS\pss\HP Digital Imaging Monitor.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acer Empowering Technology Monitor]
C:\WINDOWS\system32\SysMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr]
ALCMTR.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
"C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\eDataSecurity Loader]
C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe 0

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ehTray]
C:\WINDOWS\ehome\ehtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\eRecoveryService]
C:\Acer\Empowering Technology\eRecovery\eRAgent.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IMEKRMIG6.1]
C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IMJPMIG8.1]
"C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InCD]
C:\Program Files\Nero\Nero 7\InCD\InCD.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LaunchApp]
Alaunch

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
"C:\Program Files\Messenger\msmsgs.exe" /background

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSPY2002]
C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ntiMUI]
c:\Program Files\NewTech Infosystems\NTI CD & DVD-Maker 7\ntiMUI.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
"RUNDLL32.EXE" C:\WINDOWS\system32\NvCpl.dll,NvStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
nwiz.exe /install

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002A]
C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002ASync]
C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
"C:\Program Files\QuickTime\qttask.exe" -atboottime

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL]
RTHDCPL.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SDTray]
"C:\Program Files\Spyware Doctor\SDTrayApp.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SkyTel]
SkyTel.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SMSERIAL]
sm56hlpr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
"C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
"C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Window Washer]
C:\Program Files\Webroot\Washer\wwDisp.exe

HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost *netsvcs*

**************************************************************************

catchme 0.3.721 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2007-06-08 22:53:52
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-06-08 22:54:59 - machine was rebooted
C:\ComboFix-quarantined-files.txt ... 2007-06-08 22:54

--- E O F ---

tetonbob · 06-08-2007, 10:27 PM

Hello, please don't place quote tags around the logs, it makes them more difficult for me to read.

Please post a new HijackThis log as requested.

Open Hijack This and click on 'Do a System Scan and save a Logfile'. Save the log file and post it here.

---------------------------------------------------------------------------------------------

monssef · 06-08-2007, 10:46 PM

Im so sorry about the quote, the reason I quote cuz I thought its necessary rule in this forum. Here is the hijackthis log and thank you so much for your time and effort.

Logfile of HijackThis v1.99.1
Scan saved at 11:44:32 PM, on 6/8/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe
c:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wwSecure.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
D:\Program Files\SlySoft\AnyDVD\AnyDVD.exe
C:\Acer\Empowering Technology\Acer.Empowering.Framework.Launcher.exe
C:\PROGRA~1\ZONELA~1\ZONEAL~1\MAILFR~1\mantispm.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\system32\ZoneLabs\avsys\ScanningProcess.exe
C:\WINDOWS\system32\ZoneLabs\avsys\ScanningProcess.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://global.acer.com
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - c:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\WINDOWS\system32\eDStoolbar.dll
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKCU\..\Run: [AnyDVD] "D:\Program Files\SlySoft\AnyDVD\AnyDVD.exe"
O4 - Global Startup: Acer Empowering Technology.lnk = ?
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O20 - Winlogon Notify: awtqr - C:\WINDOWS\system32\awtqr.dll (file missing)
O20 - Winlogon Notify: pmnllij - pmnllij.dll (file missing)
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Memory Check Service (AcerMemUsageCheckService) - Acer Inc. - C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - c:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: Washer Security Access (wwSecSvc) - Webroot Software, Inc. - C:\WINDOWS\system32\wwSecure.exe

tetonbob · 06-08-2007, 10:50 PM

Thanks, that's much better

Open HijackThis and click on 'Do a System Scan Only'. Check the following entries if they exist (make sure you do not miss any) and click Fix Checked

O20 - Winlogon Notify: awtqr - C:\WINDOWS\system32\awtqr.dll (file missing)
O20 - Winlogon Notify: pmnllij - pmnllij.dll (file missing)

Close HijackThis now.

---------------------------------------------------------------------------------------------

Establish an internet connection & perform an online scan with Internet Explorer at Kaspersky Online Scanner

Answer Yes, when prompted to install an ActiveX component.

The program will then begin downloading the latest definition files.
Once the files have been downloaded click on NEXT
Locate the Scan Settings button & configure to:
- Scan using the following Anti-Virus database:
  - Extended
- Scan Options:
  - Scan Archives
  - Scan Mail Bases
Click OK & have it scan My Computer
Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
Click the Save as Text button to save the file to your desktop so that you may post it in your next reply

* Turn off the real time scanner of any existing antivirus program while performing the online scan

Note for Internet Explorer 7 users: If at any time you have trouble viewing the accept button of the licence, click on the Zoom tool located at the bottom right of the IE window and set the zoom to 75 %. Once the license accepted, reset to 100%.

---------------------------------------------------------------------------------------------

Open Hijack This and click on 'Do a System Scan and save a Logfile'. Save the log file and post it here.

---------------------------------------------------------------------------------------------

monssef · 06-09-2007, 12:56 AM

I did the scan with kaspersky and here is the report Im infected all over the place

-------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER REPORT
Saturday, June 09, 2007 1:53:00 AM
Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.93.0
Kaspersky Anti-Virus database last update: 9/06/2007
Kaspersky Anti-Virus database records: 341545
-------------------------------------------------------------------------------

Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: false

Scan Target - My Computer:
C:\
D:\
E:\
F:\
G:\
H:\
I:\
J:\
K:\
L:\

Scan Statistics:
Total number of scanned objects: 80726
Number of viruses found: 2
Number of infected objects: 66
Number of suspicious objects: 0
Duration of the scan process: 00:56:47

Infected Object Name / Virus Name / Last Action
C:\Documents and Settings\All Users\Application Data\Microsoft\eHome\logs\ehRecvr.log Object is locked skipped
C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temp\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temp\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temp\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\TT\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\TT\Local Settings\Application Data\ApplicationHistory\Acer.Empowering.Framework.Launcher.exe.7c55249b.ini.inuse Object is locked skipped
C:\Documents and Settings\TT\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\TT\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\TT\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\TT\Local Settings\Temp\~DFB1F7.tmp Object is locked skipped
C:\Documents and Settings\TT\Local Settings\Temp\~DFF4D4.tmp Object is locked skipped
C:\Documents and Settings\TT\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\TT\ntuser.dat Object is locked skipped
C:\Documents and Settings\TT\ntuser.dat.LOG Object is locked skipped
C:\Program Files\Zone Labs\ZoneAlarm\MailFrontier\MailBuddy.log Object is locked skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\awtqo.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.fp skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\awtqp.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.fp skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\awtsq.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.fp skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\awtst.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.fp skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\awvvs.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.fp skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\awvvu.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.fp skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\byxxwww.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.jp skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\ddabc.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.fp skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\ddabx.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.fp skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\ddayw.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.fp skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\ddayy.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.fp skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\ddcca.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.fp skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\ddcya.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.fp skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\ddcyv.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.fp skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\ddcyw.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.fp skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\gebcb.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.fp skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\gebcy.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.fp skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\gebyw.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.fp skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\gebyx.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.fp skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\gebyy.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.fp skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\geeba.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.fp skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\geebx.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.fp skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\jkhfd.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.fp skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\jkhhe.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.fp skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\jkhhi.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.fp skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\jkkjj.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.fp skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\jkkjk.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.fp skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\jkkli.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.fp skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\jkklj.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.fp skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\mljgf.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.fp skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\mljgg.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.fp skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\mljjj.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.fp skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\mllmj.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.fp skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\mllmm.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.fp skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\pmkhe.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.fp skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\pmkhg.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.fp skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\pmkhi.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.fp skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\pmkjh.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.fp skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\pmnlk.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.fp skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\pmnnk.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.fp skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\pmnnm.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.fp skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\pmnno.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.fp skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\ssqpn.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.fp skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\ssqpp.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.fp skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\ssqro.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.fp skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\sstqo.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.fp skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\sstqr.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.fp skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\sstts.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.fp skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\vtsqr.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.fp skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\vtsts.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.fp skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\vturq.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.fp skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\vturr.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.fp skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\vtutq.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.fp skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\vtutr.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.fp skipped
C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
C:\System Volume Information\tracking.log Object is locked skipped
C:\System Volume Information\_restore{56686BB7-17B2-473F-821C-EB36BA31F9DE}\RP144\A0029819.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.fp skipped
C:\System Volume Information\_restore{56686BB7-17B2-473F-821C-EB36BA31F9DE}\RP144\A0029820.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.fp skipped
C:\System Volume Information\_restore{56686BB7-17B2-473F-821C-EB36BA31F9DE}\RP144\A0029857.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.fp skipped
C:\System Volume Information\_restore{56686BB7-17B2-473F-821C-EB36BA31F9DE}\RP144\A0029872.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.fp skipped
C:\System Volume Information\_restore{56686BB7-17B2-473F-821C-EB36BA31F9DE}\RP144\A0029873.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.fp skipped
C:\System Volume Information\_restore{56686BB7-17B2-473F-821C-EB36BA31F9DE}\RP144\A0029874.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.fp skipped
C:\System Volume Information\_restore{56686BB7-17B2-473F-821C-EB36BA31F9DE}\RP144\A0029876.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.fp skipped
C:\System Volume Information\_restore{56686BB7-17B2-473F-821C-EB36BA31F9DE}\RP144\A0029877.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.fp skipped
C:\System Volume Information\_restore{56686BB7-17B2-473F-821C-EB36BA31F9DE}\RP144\A0029878.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.fp skipped
C:\System Volume Information\_restore{56686BB7-17B2-473F-821C-EB36BA31F9DE}\RP144\A0029879.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.fp skipped
C:\System Volume Information\_restore{56686BB7-17B2-473F-821C-EB36BA31F9DE}\RP144\A0029883.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.jp skipped
C:\System Volume Information\_restore{56686BB7-17B2-473F-821C-EB36BA31F9DE}\RP145\change.log Object is locked skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\Internet Logs\fwdbglog.txt Object is locked skipped
C:\WINDOWS\Internet Logs\fwpktlog.txt Object is locked skipped
C:\WINDOWS\Internet Logs\IAMDB.RDB Object is locked skipped
C:\WINDOWS\Internet Logs\TERRI.ldb Object is locked skipped
C:\WINDOWS\Internet Logs\tvDebug.log Object is locked skipped
C:\WINDOWS\ModemLog_Motorola SM56 Speakerphone Modem.txt Object is locked skipped
C:\WINDOWS\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{22700E92-83E3-4B2D-A090-370682EFA4E6}.crmlog Object is locked skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINDOWS\Sti_Trace.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\default Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\Media Ce.evt Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\software Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\system Object is locked skipped
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\drivers\fidbox.dat Object is locked skipped
C:\WINDOWS\system32\drivers\fidbox.idx Object is locked skipped
C:\WINDOWS\system32\drivers\fidbox2.dat Object is locked skipped
C:\WINDOWS\system32\drivers\fidbox2.idx Object is locked skipped
C:\WINDOWS\system32\h323log.txt Object is locked skipped
C:\WINDOWS\system32\pmnllij.dll.vzr Infected: not-a-virus:AdWare.Win32.Virtumonde.jp skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\temp\ZLT04b70.TMP Object is locked skipped
C:\WINDOWS\temp\ZLT04b80.TMP Object is locked skipped
C:\WINDOWS\wiadebug.log Object is locked skipped
C:\WINDOWS\wiaservc.log Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped
J:\RECYCLER\NPROTECT\00000080.windo Object is locked skipped
J:\RECYCLER\NPROTECT\00000081.windo Object is locked skipped
J:\RECYCLER\NPROTECT\00000082.windo Object is locked skipped
J:\RECYCLER\NPROTECT\00000086.servi Object is locked skipped
J:\RECYCLER\NPROTECT\00000087.secur Object is locked skipped
J:\RECYCLER\NPROTECT\00000088.runti Object is locked skipped
J:\RECYCLER\NPROTECT\00000089.runti Object is locked skipped
J:\RECYCLER\NPROTECT\00000090.messa Object is locked skipped
J:\RECYCLER\NPROTECT\00000091.manag Object is locked skipped
J:\RECYCLER\NPROTECT\00000093.enter Object is locked skipped
J:\RECYCLER\NPROTECT\00000094.enter Object is locked skipped
J:\RECYCLER\NPROTECT\00000095.drawi Object is locked skipped
J:\RECYCLER\NPROTECT\00000096.drawi Object is locked skipped
J:\RECYCLER\NPROTECT\00000097.drawi Object is locked skipped
J:\RECYCLER\NPROTECT\00000098.direc Object is locked skipped
J:\RECYCLER\NPROTECT\00000099.desig Object is locked skipped
J:\RECYCLER\NPROTECT\00000100.desig Object is locked skipped
J:\RECYCLER\NPROTECT\00000102.confi Object is locked skipped
J:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped

Scan process completed.

tetonbob · 06-09-2007, 08:24 AM

Hello, once again, I had requested a new HijackThis log. Please post one now. The items found by Kaspersky are not as bad as you think. I'll address them as soon as I see a new HijackThis log.

monssef · 06-09-2007, 03:23 PM

Im sorry once again

I was falling asleep last night

here is the hijackthis log:

Logfile of HijackThis v1.99.1
Scan saved at 4:22:20 PM, on 6/9/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe
c:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wwSecure.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
D:\Program Files\SlySoft\AnyDVD\AnyDVD.exe
C:\Acer\Empowering Technology\Acer.Empowering.Framework.Launcher.exe
C:\PROGRA~1\ZONELA~1\ZONEAL~1\MAILFR~1\mantispm.exe
C:\WINDOWS\system32\ZoneLabs\avsys\ScanningProcess.exe
C:\WINDOWS\system32\ZoneLabs\avsys\ScanningProcess.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://global.acer.com
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - c:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\WINDOWS\system32\eDStoolbar.dll
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKCU\..\Run: [AnyDVD] "D:\Program Files\SlySoft\AnyDVD\AnyDVD.exe"
O4 - Global Startup: Acer Empowering Technology.lnk = ?
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english...an_unicode.cab
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Memory Check Service (AcerMemUsageCheckService) - Acer Inc. - C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - c:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: Washer Security Access (wwSecSvc) - Webroot Software, Inc. - C:\WINDOWS\system32\wwSecure.exe

monssef · 06-09-2007, 08:21 PM

here is the new hijackthis log, thank you.

Logfile of HijackThis v1.99.1
Scan saved at 9:20:10 PM, on 6/9/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe
c:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wwSecure.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
D:\Program Files\SlySoft\AnyDVD\AnyDVD.exe
C:\Acer\Empowering Technology\Acer.Empowering.Framework.Launcher.exe
C:\PROGRA~1\ZONELA~1\ZONEAL~1\MAILFR~1\mantispm.exe
C:\WINDOWS\system32\ZoneLabs\avsys\ScanningProcess.exe
C:\WINDOWS\system32\ZoneLabs\avsys\ScanningProcess.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://global.acer.com
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - c:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\WINDOWS\system32\eDStoolbar.dll
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKCU\..\Run: [AnyDVD] "D:\Program Files\SlySoft\AnyDVD\AnyDVD.exe"
O4 - Global Startup: Acer Empowering Technology.lnk = ?
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english...an_unicode.cab
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Memory Check Service (AcerMemUsageCheckService) - Acer Inc. - C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - c:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: Washer Security Access (wwSecSvc) - Webroot Software, Inc. - C:\WINDOWS\system32\wwSecure.exe

tetonbob · 06-09-2007, 09:05 PM

Thanks for the new log.

Delete this file:

C:\WINDOWS\system32\pmnllij.dll.vzr

C:\QooBox is ComboFix's quarantine folder. You can safely delete it

C:\System Volume Information is where System Restore's cache is stored. Whatever is in there can't harm you unless you choose to perform a manual restore. Nevertheless, we shall be reseting/clearing the cache in a little while.

Other than that, your logs appear clean.You should be good to go. We still have a few items to address.

Reset hidden/system files and folders

Click Start.
Open My Computer.
Select the Tools menu and click Folder Options.
Select the View tab.
Deselect the Show hidden files and folders option.
Select the Hide file extensions for known types option.
Select the Hide protected operating system files option.
Click Yes to confirm.
Click OK.

Clear & Reset System Restore's Cache

click Start >> Run - type SYSDM.CPL & press Enter
select the System Restore Tab
tick on the checkbox - "Turn off System Restore on all drives"
click Apply
then untick the same checkbox & click OK

Enable Windows Auto Update

Go to Start>Run - type wuaucpl.cpl
tick on the checkbox - "Automatically download the updates, and install them on the schedule that I specify".
Click on "OK".

Now that you are clean, to help protect your computer in the future I recommend that you get the following free programs if you don't have them already:

SpywareBlaster to help prevent spyware from installing in the first place.
- Install & update SpywareBlaster with the latest definitions.
  After you have updated, click the button - enable protection for all unprotected items
SpywareGuard to catch and block spyware before it can execute.
SPYBOT - SEARCH & DESTROY
Download and install Spybot - Search & Destroy with its TeaTimer option. This will provide realtime spyware & hijacker protection on your computer alongside your virus protection. You should also scan your computer with the program on a regular basis just as you would an antivirus software. A tutorial on installing & using this product can be found here
AD-AWARE
Download and install Ad-Aware. You should use this program to scan your computer on a regular basis just as you would an antivirus software in conjunction with Spybot. A tutorial on installing & using this product can be found here
IE-SPYAD - IE/Spyad places more than 4000 dubious websites and domains in the IE Restricted list. This severely impair attempts to infect your system. It basically prevents any downloads (Cookies etc) from the sites listed, although you will still be able to connect to the sites.
- Download IE-SpyAD - Extract the contents to a new folder
  From within the folder, double-click install.bat
  Select Option #2 - Install the new IE-SPYAD list.
  Then return to the main menu.
  Select option #4 - Add the old porn sites domain
MVPS HOST FILE
The MVPS Hosts file replaces your current HOSTS file with one that will restrict known ad sites form serving you unsolicited advertisements. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is the IP of your local computer.
- Download Host.zip to your desktop.
- From your Desktop right-click (hosts.zip) and select:
  Extract All from the menu.
- Click Next, click Next, select the option:
  "Show Extracted files", click Finish
- This will open the newly created hosts folder on your Desktop.
- Double-click on the included mvps.bat file, this will rename the existing HOSTS file to HOSTS.MVP, then it will copy the included updated HOSTS file to the correct location on your machine.
ANTIVIRUS SOFTWARE
It is very important that you have anti-virus software running on your machine. This alone can save you a lot of trouble with malware in the future.

Here are a few very good free Antivirus products which are available:
- AOL Active Virus Shield (powered by Kaspersky Antivirus)
- Avast!
- AVG
- Avira PersonalEdition Classic
Select one of these, or another of your choice. Do not install more than one antivirus program because they will conflict with each other. It is imperative that you update your antivirus software at least once a week (even more if you wish). If you do not update your antivirus software then it will not be able to catch new malware that may have come out.

See this link for a listing of some online antivirus scanners:

Anti-Spyware Tutorial
FIREWALL
If you do not have a firewall, here are a couple of great free ones available for personal use. Using a third-party firewall will allow you to give/deny access for applications that want to go online. Select one of these, or another of your choice:

Do not install more than one firewall program because they will conflict with each other.

In light of your recent troubles, I'm sure you'll like to avoid any future infections. Please take a look at these well written articles

If you want to fight back the Malware Writers that have made your life a misery, please take a look here and read what you can do against it.

Please respond to this thread one more time so we can mark this thread as resolved.

monssef · 06-09-2007, 10:22 PM

I followed the last step your provided and here is the last hijackthis log

Logfile of HijackThis v1.99.1
Scan saved at 11:20:59 PM, on 6/9/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe
c:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wwSecure.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
D:\Program Files\SlySoft\AnyDVD\AnyDVD.exe
C:\Acer\Empowering Technology\Acer.Empowering.Framework.Launcher.exe
C:\PROGRA~1\ZONELA~1\ZONEAL~1\MAILFR~1\mantispm.exe
C:\WINDOWS\system32\ZoneLabs\avsys\ScanningProcess.exe
C:\WINDOWS\system32\ZoneLabs\avsys\ScanningProcess.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\SpywareGuard\sgmain.exe
C:\Program Files\SpywareGuard\sgbhp.exe
C:\Program Files\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://global.acer.com
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - c:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\WINDOWS\system32\eDStoolbar.dll
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKCU\..\Run: [AnyDVD] "D:\Program Files\SlySoft\AnyDVD\AnyDVD.exe"
O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O4 - Global Startup: Acer Empowering Technology.lnk = ?
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english...an_unicode.cab
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Memory Check Service (AcerMemUsageCheckService) - Acer Inc. - C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - c:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: Washer Security Access (wwSecSvc) - Webroot Software, Inc. - C:\WINDOWS\system32\wwSecure.exe

tetonbob · 06-09-2007, 10:30 PM

All seems well to me.

monssef · 06-10-2007, 06:54 AM

Quote:

Originally Posted by tetonbob

All seems well to me.

thank you so much for your help

tetonbob · 06-10-2007, 08:54 AM

You're quite welcome.

Happy computing, and Safe Surfing to you!

06-08-2007, 12:41 PM	#2 (permalink)
monssef Registered User Join Date: May 2007 Posts: 26 OS: xp	Re: virus keeps renaming itself in zonealarm bump!

06-08-2007, 08:27 PM	#3 (permalink)
monssef Registered User Join Date: May 2007 Posts: 26 OS: xp	Re: virus keeps renaming itself in zonealarm Please, what Im doing wrong not to get help, I checked some threads and they posted after me my post was at 2:00pm 50 hours ago and they posted at 6:00pm and they already got help, my wifes cannot use her computer because zonealarm keeps popping trying to clean that virus and instead it says renamed, renamed..... the virues called virtumonde I believe, look at the screenshot, thank you and sorry to bump the thread.

06-08-2007, 09:12 PM	#4 (permalink)
tetonbob Manager, Security Center, TSF Academy; Analyst, Security Team Join Date: Jan 2005 Location: Transylvania County, North Carolina, USA Posts: 35,620 OS: 2000 Pro; XP Pro; XP Home	Re: virus keeps renaming itself in zonealarm Download combofix.exe to your desktop. Double click on combofix.exe & follow the prompts. When finished, it shall produce a log for you, C:\ComboFix.txt. Post that log in your next reply, along with a new HijackThis log. Note: Do not mouseclick combofix's window whilst it's running. That may cause it to stall --------------------------------------------------------------------------------------------- __________________ Practice Safe Surfing PC Safety and Security--What Do I Need? Because what you don't know, CAN hurt you. Proud Member of ASAP since 2005 Proud Member of UNITE since 2006 Microsoft MVP - Consumer Security 2009

06-08-2007, 09:58 PM	#5 (permalink)
monssef Registered User Join Date: May 2007 Posts: 26 OS: xp	Re: virus keeps renaming itself in zonealarm thank you so much for your reply, here is the log from combofix.exe ComboFix 07-06-09.1 - C:\Documents and Settings\TT\Desktop\ComboFix.exe "TT" - 2007-06-08 22:44:57 - Service Pack 2 NTFS (((((((((((((((((((((((((((((((((((((((((((( V Log ))))))))))))))))))))))))))))))))))))))))))))))))))))))) C:\WINDOWS\system32\awtqo.dll C:\WINDOWS\system32\awtst.dll C:\WINDOWS\system32\awvvs.dll C:\WINDOWS\system32\ddayy.dll C:\WINDOWS\system32\gebcy.dll C:\WINDOWS\system32\gebyy.dll C:\WINDOWS\system32\geebx.dll C:\WINDOWS\system32\jkhhe.dll C:\WINDOWS\system32\jkhhi.dll C:\WINDOWS\system32\jkkjj.dll C:\WINDOWS\system32\mljjj.dll C:\WINDOWS\system32\mllmm.dll C:\WINDOWS\system32\pmkhe.dll C:\WINDOWS\system32\pmkjh.dll C:\WINDOWS\system32\sstqo.dll C:\WINDOWS\system32\ssttu.dll C:\WINDOWS\system32\vtsts.dll C:\WINDOWS\system32\vturq.dll C:\WINDOWS\system32\vtutq.dll C:\WINDOWS\system32\pmnno.dll C:\WINDOWS\system32\awtqp.dll C:\WINDOWS\system32\awtsq.dll C:\WINDOWS\system32\awvvu.dll C:\WINDOWS\system32\ddabc.dll C:\WINDOWS\system32\ddabx.dll C:\WINDOWS\system32\ddayw.dll C:\WINDOWS\system32\ddcca.dll C:\WINDOWS\system32\ddcya.dll C:\WINDOWS\system32\ddcyv.dll C:\WINDOWS\system32\ddcyw.dll C:\WINDOWS\system32\gebcb.dll C:\WINDOWS\system32\gebyw.dll C:\WINDOWS\system32\gebyx.dll C:\WINDOWS\system32\geeba.dll C:\WINDOWS\system32\jkhfd.dll C:\WINDOWS\system32\jkkjk.dll C:\WINDOWS\system32\jkkli.dll C:\WINDOWS\system32\jkklj.dll C:\WINDOWS\system32\mljgf.dll C:\WINDOWS\system32\mljgg.dll C:\WINDOWS\system32\mllmj.dll C:\WINDOWS\system32\pmkhg.dll C:\WINDOWS\system32\pmkhi.dll C:\WINDOWS\system32\pmnlk.dll C:\WINDOWS\system32\pmnnk.dll C:\WINDOWS\system32\pmnnm.dll C:\WINDOWS\system32\ssqpn.dll C:\WINDOWS\system32\ssqpp.dll C:\WINDOWS\system32\ssqro.dll C:\WINDOWS\system32\sstqr.dll C:\WINDOWS\system32\sstts.dll C:\WINDOWS\system32\vtsqr.dll C:\WINDOWS\system32\vturr.dll C:\WINDOWS\system32\vtutr.dll C:\WINDOWS\system32\uttss.ini C:\WINDOWS\system32\bdeeg.bak1 C:\WINDOWS\system32\bdeeg.bak2 C:\WINDOWS\system32\bdeeg.ini C:\WINDOWS\system32\byxxwww.dll * * * POST RUN FILES/FOLDERS * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) C:\DOCUME~1\TT\Desktop.\internet explorer.lnk ((((((((((((((((((((((((( Files Created from 2007-05-09 to 2007-06-09 ))))))))))))))))))))))))))))))) 2007-06-08 22:44 49,152 --a------ C:\WINDOWS\nircmd.exe 2007-06-08 18:23 87,608 --a------ C:\DOCUME~1\TT\APPLIC~1\ezpinst.exe 2007-06-08 18:23 47,360 --a------ C:\DOCUME~1\TT\APPLIC~1\pcouffin.sys 2007-06-08 18:23 <DIR> d-------- C:\DOCUME~1\TT\APPLIC~1\Vso 2007-06-06 14:04 <DIR> d-------- C:\Deckard 2007-06-06 13:26 21,312 --a------ C:\WINDOWS\choice.exe 2007-06-06 13:26 <DIR> d-------- C:\ie-spyad 2007-06-06 13:11 118,784 --a------ C:\WINDOWS\system32\MSSTDFMT.DLL 2007-06-06 13:11 <DIR> d-------- C:\Program Files\SpywareBlaster 2007-06-06 03:10 <DIR> d-------- C:\WINDOWS\system32\ActiveScan 2007-06-06 03:10 <DIR> d-------- C:\WINDOWS\LastGood.Tmp 2007-06-06 01:15 <DIR> d-------- C:\DOCUME~1\TT\APPLIC~1\Lavasoft 2007-06-06 01:14 <DIR> d-------- C:\Program Files\Lavasoft 2007-06-05 13:27 626,688 --a------ C:\WINDOWS\system32\msvcr80.dll 2007-06-05 12:46 <DIR> d-a------ C:\DOCUME~1\ALLUSE~1\APPLIC~1\TEMP 2007-05-31 15:41 <DIR> d-------- C:\DOCUME~1\TT\APPLIC~1\Apple Computer 2007-05-31 01:45 524,288 --a------ C:\WINDOWS\system32\DivXsm.exe 2007-05-31 01:44 823,296 --a------ C:\WINDOWS\system32\divx_xx0c.dll 2007-05-31 01:44 823,296 --a------ C:\WINDOWS\system32\divx_xx07.dll 2007-05-31 01:44 802,816 --a------ C:\WINDOWS\system32\divx_xx11.dll 2007-05-31 01:44 740,442 --a------ C:\WINDOWS\system32\DivX.dll 2007-05-16 19:01 <DIR> d-------- C:\DOCUME~1\TT\APPLIC~1\vlc 2007-05-16 19:00 <DIR> d-------- C:\Program Files\VideoLAN 2007-05-15 21:05 <DIR> d-------- C:\DOCUME~1\TT\APPLIC~1\AccurateRip 2007-05-15 20:53 2,145 --a------ C:\WINDOWS\system32\SpoonUninstall-dMC Generic CLI Encoder.dat 2007-05-15 20:26 3,365 --a------ C:\WINDOWS\system32\SpoonUninstall-dBpoweramp Windows Media Audio 10 Codec.dat 2007-05-15 20:25 3,007 --a------ C:\WINDOWS\system32\SpoonUninstall-dBpoweramp WavPack Codec.dat 2007-05-15 20:24 2,649 --a------ C:\WINDOWS\system32\SpoonUninstall-dBpoweramp Midi Decoder.dat 2007-05-15 20:23 3,590 --a------ C:\WINDOWS\system32\SpoonUninstall-dBpoweramp m4a Codec.dat 2007-05-15 20:23 2,951 --a------ C:\WINDOWS\system32\SpoonUninstall-dBpoweramp CLI Encoder.dat 2007-05-15 20:19 2,234 --a------ C:\WINDOWS\system32\SpoonUninstall-dBpowerAMP VQF Codec.dat 2007-05-15 20:18 2,995 --a------ C:\WINDOWS\system32\SpoonUninstall-dBPowerAMP Real Audio Encoder R3.dat 2007-05-15 20:17 2,999 --a------ C:\WINDOWS\system32\SpoonUninstall-dBpoweramp Ogg Vorbis Codec.dat 2007-05-15 20:17 1,928 --a------ C:\WINDOWS\system32\SpoonUninstall-dBpowerAMP Real Audio Codec.dat 2007-05-15 20:16 620 --a------ C:\WINDOWS\system32\SpoonUninstall-dBpowerAMP FAAC Mp4 Codec.dat 2007-05-15 20:16 3,283 --a------ C:\WINDOWS\system32\SpoonUninstall-dBpoweramp Musepack Codec.dat 2007-05-15 20:16 2,218 --a------ C:\WINDOWS\system32\SpoonUninstall-dBpowerAMP Mp4 & AAC Decode Codec.dat 2007-05-15 20:12 739 --a------ C:\WINDOWS\system32\SpoonUninstall-dBPowerAMP AIFF codec r4.dat 2007-05-15 20:12 516 --a------ C:\WINDOWS\system32\SpoonUninstall-dBpowerAMP AAC to Mp4 Codec.dat 2007-05-15 20:12 3,107 --a------ C:\WINDOWS\system32\SpoonUninstall-dBpoweramp Monkeys Audio Codec.dat 2007-05-15 20:12 2,920 --a------ C:\WINDOWS\system32\SpoonUninstall-dBpoweramp FLAC Codec.dat 2007-05-15 20:12 1,122 --a------ C:\WINDOWS\system32\SpoonUninstall-dBpowerAMP AAC Codec.dat 2007-05-15 20:09 167,424 --a------ C:\WINDOWS\system32\SpoonUninstall.exe 2007-05-15 19:49 <DIR> d-------- C:\Program Files\Common Files\xing shared 2007-05-15 19:43 <DIR> d-------- C:\Program Files\XVid;-) 2007-05-15 16:26 <DIR> d-------- C:\Program Files\Winamp 2007-05-15 16:15 57,061 --a------ C:\WINDOWS\system32\SpoonUninstall-dBpowerAMP.dat 2007-05-15 16:09 2,074 --a------ C:\WINDOWS\system32\SpoonUninstall-dBpowerAMP mp3PRO Input Codec.dat 2007-05-15 16:08 2,467 --a------ C:\WINDOWS\system32\SpoonUninstall-dMC mp3PRO (CLI) Encoder.dat 2007-05-15 16:05 9,220 --a------ C:\WINDOWS\system32\SpoonUninstall-dMC Power Pack.dat 2007-05-15 14:55 8,650,752 --a------ C:\DOCUME~1\TT\ntuser.dat 2007-05-13 15:31 240 --a------ C:\WINDOWS\system32\RfmDat2.dat 2007-05-13 02:07 <DIR> d-------- C:\DOCUME~1\TT\APPLIC~1\AdobeUM 2007-05-11 22:56 73,216 --a------ C:\WINDOWS\ST6UNST.EXE 2007-05-11 22:56 249,856 --------- C:\WINDOWS\Setup1.exe 2007-05-11 15:53 <DIR> d-------- C:\DOCUME~1\TT\APPLIC~1\EFSoftware 2007-05-10 20:19 765,952 --a------ C:\WINDOWS\system32\xvidcore.dll 2007-05-10 20:19 180,224 --a------ C:\WINDOWS\system32\xvidvfw.dll 2007-05-10 20:19 <DIR> d-------- C:\Program Files\Xvid 2007-05-10 20:19 <DIR> d-------- C:\Program Files\AC3Filter 2007-05-10 19:59 <DIR> d-------- C:\Program Files\GSpot270a 2007-05-10 19:29 <DIR> d-------- C:\DOCUME~1\TT\APPLIC~1\DivX 2007-05-10 19:21 2,560 --a------ C:\WINDOWS\system32\drivers\cdralw2k.sys 2007-05-10 19:21 2,432 --a------ C:\WINDOWS\system32\drivers\cdr4_xp.sys 2007-05-10 19:21 129,784 --a------ C:\WINDOWS\system32\pxafs.dll 2007-05-10 19:21 118,520 --a------ C:\WINDOWS\system32\pxinsi64.exe 2007-05-10 19:21 116,472 --a------ C:\WINDOWS\system32\pxcpyi64.exe 2007-05-10 19:21 <DIR> d-------- C:\Program Files\DivX (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-06-08 23:23:47 47,360 ----a-w C:\WINDOWS\system32\drivers\pcouffin.sys 2007-06-06 08:30:30 -------- d-----w C:\Program Files\Common Files\Webroot Shared 2007-06-06 08:30:00 -------- d-----w C:\Program Files\Common Files\LightScribe 2007-06-06 00:31:22 512 ----a-w C:\ScanSectorLog.dat 2007-06-05 18:43:57 -------- d-----w C:\Program Files\Webroot 2007-06-05 18:43:55 -------- d-----w C:\DOCUME~1\TT\APPLIC~1\Webroot 2007-06-04 03:00:02 -------- d-----w C:\DOCUME~1\TT\APPLIC~1\uTorrent 2007-06-01 23:43:25 -------- d-----w C:\DOCUME~1\TT\APPLIC~1\dvdcss 2007-05-31 20:47:02 -------- d--h--w C:\Program Files\InstallShield Installation Information 2007-05-31 20:38:15 -------- d-----w C:\Program Files\QuickTime 2007-05-16 00:49:26 -------- d-----w C:\Program Files\Common Files\Real 2007-05-06 23:48:45 16 ----a-w C:\WINDOWS\popcinfo.dat 2007-04-27 00:20:13 -------- d-----w C:\Program Files\Common Files\AC3ACM_1.31 2007-04-27 00:19:51 -------- d-----w C:\Program Files\Common Files\vorbisacm_20020708 2007-04-27 00:10:05 232,592 ----a-w C:\Program Files\Common Files\l3codecx.exe 2007-04-26 05:05:10 -------- d-----w C:\DOCUME~1\TT\APPLIC~1\GameHouse 2007-04-26 05:04:15 -------- d-----w C:\Program Files\GameHouse 2007-04-24 08:47:37 4,212 ---ha-w C:\WINDOWS\system32\zllictbl.dat 2007-04-23 00:15:29 3,596,288 ----a-w C:\WINDOWS\system32\qt-dx331.dll 2007-04-23 00:15:18 200,704 ----a-w C:\WINDOWS\system32\ssldivx.dll 2007-04-23 00:15:18 1,044,480 ----a-w C:\WINDOWS\system32\libdivx.dll 2007-04-23 00:02:34 73,728 ----a-w C:\WINDOWS\system32\dpl100.dll 2007-04-23 00:02:34 196,608 ----a-w C:\WINDOWS\system32\dtu100.dll 2007-04-23 00:02:33 53,248 ----a-w C:\WINDOWS\system32\dpuGUI10.dll 2007-04-23 00:02:31 593,920 ----a-w C:\WINDOWS\system32\dpuGUI11.dll 2007-04-23 00:02:31 57,344 ----a-w C:\WINDOWS\system32\dpv11.dll 2007-04-23 00:02:31 344,064 ----a-w C:\WINDOWS\system32\dpus11.dll 2007-04-23 00:02:31 294,912 ----a-w C:\WINDOWS\system32\dpu11.dll 2007-04-23 00:02:31 294,912 ----a-w C:\WINDOWS\system32\dpu10.dll 2007-04-23 00:01:47 12,288 ----a-w C:\WINDOWS\system32\DivXWMPExtType.dll 2007-04-23 00:01:46 124,472 ----a-w C:\WINDOWS\system32\DivXCodecUpdateChecker.exe 2007-03-26 07:52:14 2,368 ----a-w C:\WINDOWS\system32\SVKP.sys 2007-03-26 04:42:09 112,968 ----a-w C:\WINDOWS\hpoins07.dat 2007-03-09 05:02:00 75,512 ----a-w C:\WINDOWS\zllsputility.exe 2007-03-09 05:01:42 1,087,216 ----a-w C:\WINDOWS\system32\zpeng24.dll 2007-03-05 10:29:51 1,682 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) Note empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects] {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}=c:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll [2004-12-14 03:56] {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}=C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll [2007-03-14 03:43] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2007-03-09 00:02] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-07-11 17:19] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "AnyDVD"="D:\Program Files\SlySoft\AnyDVD\AnyDVD.exe" [2007-02-17 23:36] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "InstallVisualStyle"=C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles "InstallTheme"=C:\WINDOWS\Resources\Themes\Royale.theme [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\awtqr] C:\WINDOWS\system32\awtqr.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\pmnllij] pmnllij.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Acer WLAN 11g USB Dongle.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Acer WLAN 11g USB Dongle.lnk backup=C:\WINDOWS\pss\Acer WLAN 11g USB Dongle.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk backup=C:\WINDOWS\pss\HP Digital Imaging Monitor.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acer Empowering Technology Monitor] C:\WINDOWS\system32\SysMonitor.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr] ALCMTR.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe 0 [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ehTray] C:\WINDOWS\ehome\ehtray.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\eRecoveryService] C:\Acer\Empowering Technology\eRecovery\eRAgent.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IMEKRMIG6.1] C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32 [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InCD] C:\Program Files\Nero\Nero 7\InCD\InCD.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LaunchApp] Alaunch [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ntiMUI] c:\Program Files\NewTech Infosystems\NTI CD & DVD-Maker 7\ntiMUI.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon] "RUNDLL32.EXE" C:\WINDOWS\system32\NvCpl.dll,NvStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz] nwiz.exe /install [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL] RTHDCPL.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SDTray] "C:\Program Files\Spyware Doctor\SDTrayApp.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SkyTel] SkyTel.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SMSERIAL] sm56hlpr.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Window Washer] C:\Program Files\Webroot\Washer\wwDisp.exe HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost netsvcs ************************************************************************ catchme 0.3.721 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net Rootkit scan 2007-06-08 22:53:52 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************ Completion time: 2007-06-08 22:54:59 - machine was rebooted C:\ComboFix-quarantined-files.txt ... 2007-06-08 22:54 --- E O F --- Last edited by tetonbob; 06-08-2007 at 10:25 PM. Reason: removed quote tags; makes logs harder to read.

06-08-2007, 10:27 PM	#6 (permalink)
tetonbob Manager, Security Center, TSF Academy; Analyst, Security Team Join Date: Jan 2005 Location: Transylvania County, North Carolina, USA Posts: 35,620 OS: 2000 Pro; XP Pro; XP Home	Re: virus keeps renaming itself in zonealarm Hello, please don't place quote tags around the logs, it makes them more difficult for me to read. Please post a new HijackThis log as requested. Open Hijack This and click on 'Do a System Scan and save a Logfile'. Save the log file and post it here. --------------------------------------------------------------------------------------------- __________________ Practice Safe Surfing PC Safety and Security--What Do I Need? Because what you don't know, CAN hurt you. Proud Member of ASAP since 2005 Proud Member of UNITE since 2006 Microsoft MVP - Consumer Security 2009

06-08-2007, 10:46 PM	#7 (permalink)
monssef Registered User Join Date: May 2007 Posts: 26 OS: xp	Re: virus keeps renaming itself in zonealarm Im so sorry about the quote, the reason I quote cuz I thought its necessary rule in this forum. Here is the hijackthis log and thank you so much for your time and effort. Logfile of HijackThis v1.99.1 Scan saved at 11:44:32 PM, on 6/8/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\ZoneLabs\vsmon.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\Acer\Empowering Technology\ePerformance\MemCheck.exe C:\WINDOWS\eHome\ehRecvr.exe C:\WINDOWS\eHome\ehSched.exe C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe c:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\HPZipm12.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\wwSecure.exe C:\WINDOWS\system32\dllhost.exe C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe D:\Program Files\SlySoft\AnyDVD\AnyDVD.exe C:\Acer\Empowering Technology\Acer.Empowering.Framework.Launcher.exe C:\PROGRA~1\ZONELA~1\ZONEAL~1\MAILFR~1\mantispm.exe C:\WINDOWS\system32\notepad.exe C:\WINDOWS\system32\ZoneLabs\avsys\ScanningProcess.exe C:\WINDOWS\system32\ZoneLabs\avsys\ScanningProcess.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\HijackThis\HijackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://global.acer.com O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - c:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\WINDOWS\system32\eDStoolbar.dll O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" O4 - HKCU\..\Run: [AnyDVD] "D:\Program Files\SlySoft\AnyDVD\AnyDVD.exe" O4 - Global Startup: Acer Empowering Technology.lnk = ? O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing) O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing) O20 - Winlogon Notify: awtqr - C:\WINDOWS\system32\awtqr.dll (file missing) O20 - Winlogon Notify: pmnllij - pmnllij.dll (file missing) O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll O23 - Service: Memory Check Service (AcerMemUsageCheckService) - Acer Inc. - C:\Acer\Empowering Technology\ePerformance\MemCheck.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - c:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe O23 - Service: Washer Security Access (wwSecSvc) - Webroot Software, Inc. - C:\WINDOWS\system32\wwSecure.exe

06-08-2007, 10:50 PM	#8 (permalink)
tetonbob Manager, Security Center, TSF Academy; Analyst, Security Team Join Date: Jan 2005 Location: Transylvania County, North Carolina, USA Posts: 35,620 OS: 2000 Pro; XP Pro; XP Home	Re: virus keeps renaming itself in zonealarm Thanks, that's much better Open HijackThis and click on 'Do a System Scan Only'. Check the following entries if they exist (make sure you do not miss any) and click Fix Checked O20 - Winlogon Notify: awtqr - C:\WINDOWS\system32\awtqr.dll (file missing) O20 - Winlogon Notify: pmnllij - pmnllij.dll (file missing) Close HijackThis now. --------------------------------------------------------------------------------------------- Establish an internet connection & perform an online scan with Internet Explorer at Kaspersky Online Scanner Answer Yes, when prompted to install an ActiveX component. The program will then begin downloading the latest definition files. Once the files have been downloaded click on NEXT Locate the Scan Settings button & configure to: Scan using the following Anti-Virus database: Extended Scan Options: Scan Archives Scan Mail Bases Click OK & have it scan My Computer Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it. Click the Save as Text button to save the file to your desktop so that you may post it in your next reply * Turn off the real time scanner of any existing antivirus program while performing the online scan Note for Internet Explorer 7 users: If at any time you have trouble viewing the accept button of the licence, click on the Zoom tool located at the bottom right of the IE window and set the zoom to 75 %. Once the license accepted, reset to 100%. --------------------------------------------------------------------------------------------- Open Hijack This and click on 'Do a System Scan and save a Logfile'. Save the log file and post it here. --------------------------------------------------------------------------------------------- __________________ Practice Safe Surfing PC Safety and Security--What Do I Need? Because what you don't know, CAN hurt you. Proud Member of ASAP since 2005 Proud Member of UNITE since 2006 Microsoft MVP - Consumer Security 2009

06-09-2007, 12:56 AM	#9 (permalink)
monssef Registered User Join Date: May 2007 Posts: 26 OS: xp	Re: virus keeps renaming itself in zonealarm I did the scan with kaspersky and here is the report Im infected all over the place ------------------------------------------------------------------------------- KASPERSKY ONLINE SCANNER REPORT Saturday, June 09, 2007 1:53:00 AM Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600) Kaspersky Online Scanner version: 5.0.93.0 Kaspersky Anti-Virus database last update: 9/06/2007 Kaspersky Anti-Virus database records: 341545 ------------------------------------------------------------------------------- Scan Settings: Scan using the following antivirus database: extended Scan Archives: true Scan Mail Bases: false Scan Target - My Computer: C:\ D:\ E:\ F:\ G:\ H:\ I:\ J:\ K:\ L:\ Scan Statistics: Total number of scanned objects: 80726 Number of viruses found: 2 Number of infected objects: 66 Number of suspicious objects: 0 Duration of the scan process: 00:56:47 Infected Object Name / Virus Name / Last Action C:\Documents and Settings\All Users\Application Data\Microsoft\eHome\logs\ehRecvr.log Object is locked skipped C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Temp\Cookies\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Temp\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Temp\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\TT\Cookies\index.dat Object is locked skipped C:\Documents and Settings\TT\Local Settings\Application Data\ApplicationHistory\Acer.Empowering.Framework.Launcher.exe.7c55249b.ini.inuse Object is locked skipped C:\Documents and Settings\TT\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\TT\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\TT\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\TT\Local Settings\Temp\~DFB1F7.tmp Object is locked skipped C:\Documents and Settings\TT\Local Settings\Temp\~DFF4D4.tmp Object is locked skipped C:\Documents and Settings\TT\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\TT\ntuser.dat Object is locked skipped C:\Documents and Settings\TT\ntuser.dat.LOG Object is locked skipped C:\Program Files\Zone Labs\ZoneAlarm\MailFrontier\MailBuddy.log Object is locked skipped C:\QooBox\Quarantine\C\WINDOWS\system32\awtqo.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.fp skipped C:\QooBox\Quarantine\C\WINDOWS\system32\awtqp.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.fp skipped C:\QooBox\Quarantine\C\WINDOWS\system32\awtsq.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.fp skipped C:\QooBox\Quarantine\C\WINDOWS\system32\awtst.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.fp skipped C:\QooBox\Quarantine\C\WINDOWS\system32\awvvs.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.fp skipped C:\QooBox\Quarantine\C\WINDOWS\system32\awvvu.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.fp skipped C:\QooBox\Quarantine\C\WINDOWS\system32\byxxwww.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.jp skipped C:\QooBox\Quarantine\C\WINDOWS\system32\ddabc.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.fp skipped C:\QooBox\Quarantine\C\WINDOWS\system32\ddabx.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.fp skipped C:\QooBox\Quarantine\C\WINDOWS\system32\ddayw.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.fp skipped C:\QooBox\Quarantine\C\WINDOWS\system32\ddayy.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.fp skipped C:\QooBox\Quarantine\C\WINDOWS\system32\ddcca.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.fp skipped C:\QooBox\Quarantine\C\WINDOWS\system32\ddcya.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.fp skipped C:\QooBox\Quarantine\C\WINDOWS\system32\ddcyv.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.fp skipped C:\QooBox\Quarantine\C\WINDOWS\system32\ddcyw.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.fp skipped C:\QooBox\Quarantine\C\WINDOWS\system32\gebcb.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.fp skipped C:\QooBox\Quarantine\C\WINDOWS\system32\gebcy.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.fp skipped C:\QooBox\Quarantine\C\WINDOWS\system32\gebyw.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.fp skipped C:\QooBox\Quarantine\C\WINDOWS\system32\gebyx.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.fp skipped C:\QooBox\Quarantine\C\WINDOWS\system32\gebyy.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.fp skipped C:\QooBox\Quarantine\C\WINDOWS\system32\geeba.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.fp skipped C:\QooBox\Quarantine\C\WINDOWS\system32\geebx.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.fp skipped C:\QooBox\Quarantine\C\WINDOWS\system32\jkhfd.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.fp skipped C:\QooBox\Quarantine\C\WINDOWS\system32\jkhhe.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.fp skipped C:\QooBox\Quarantine\C\WINDOWS\system32\jkhhi.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.fp skipped C:\QooBox\Quarantine\C\WINDOWS\system32\jkkjj.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.fp skipped C:\QooBox\Quarantine\C\WINDOWS\system32\jkkjk.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.fp skipped C:\QooBox\Quarantine\C\WINDOWS\system32\jkkli.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.fp skipped C:\QooBox\Quarantine\C\WINDOWS\system32\jkklj.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.fp skipped C:\QooBox\Quarantine\C\WINDOWS\system32\mljgf.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.fp skipped C:\QooBox\Quarantine\C\WINDOWS\system32\mljgg.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.fp skipped C:\QooBox\Quarantine\C\WINDOWS\system32\mljjj.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.fp skipped C:\QooBox\Quarantine\C\WINDOWS\system32\mllmj.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.fp skipped C:\QooBox\Quarantine\C\WINDOWS\system32\mllmm.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.fp skipped C:\QooBox\Quarantine\C\WINDOWS\system32\pmkhe.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.fp skipped C:\QooBox\Quarantine\C\WINDOWS\system32\pmkhg.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.fp skipped C:\QooBox\Quarantine\C\WINDOWS\system32\pmkhi.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.fp skipped C:\QooBox\Quarantine\C\WINDOWS\system32\pmkjh.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.fp skipped C:\QooBox\Quarantine\C\WINDOWS\system32\pmnlk.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.fp skipped C:\QooBox\Quarantine\C\WINDOWS\system32\pmnnk.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.fp skipped C:\QooBox\Quarantine\C\WINDOWS\system32\pmnnm.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.fp skipped C:\QooBox\Quarantine\C\WINDOWS\system32\pmnno.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.fp skipped C:\QooBox\Quarantine\C\WINDOWS\system32\ssqpn.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.fp skipped C:\QooBox\Quarantine\C\WINDOWS\system32\ssqpp.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.fp skipped C:\QooBox\Quarantine\C\WINDOWS\system32\ssqro.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.fp skipped C:\QooBox\Quarantine\C\WINDOWS\system32\sstqo.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.fp skipped C:\QooBox\Quarantine\C\WINDOWS\system32\sstqr.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.fp skipped C:\QooBox\Quarantine\C\WINDOWS\system32\sstts.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.fp skipped C:\QooBox\Quarantine\C\WINDOWS\system32\vtsqr.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.fp skipped C:\QooBox\Quarantine\C\WINDOWS\system32\vtsts.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.fp skipped C:\QooBox\Quarantine\C\WINDOWS\system32\vturq.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.fp skipped C:\QooBox\Quarantine\C\WINDOWS\system32\vturr.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.fp skipped C:\QooBox\Quarantine\C\WINDOWS\system32\vtutq.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.fp skipped C:\QooBox\Quarantine\C\WINDOWS\system32\vtutr.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.fp skipped C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped C:\System Volume Information\tracking.log Object is locked skipped C:\System Volume Information\_restore{56686BB7-17B2-473F-821C-EB36BA31F9DE}\RP144\A0029819.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.fp skipped C:\System Volume Information\_restore{56686BB7-17B2-473F-821C-EB36BA31F9DE}\RP144\A0029820.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.fp skipped C:\System Volume Information\_restore{56686BB7-17B2-473F-821C-EB36BA31F9DE}\RP144\A0029857.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.fp skipped C:\System Volume Information\_restore{56686BB7-17B2-473F-821C-EB36BA31F9DE}\RP144\A0029872.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.fp skipped C:\System Volume Information\_restore{56686BB7-17B2-473F-821C-EB36BA31F9DE}\RP144\A0029873.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.fp skipped C:\System Volume Information\_restore{56686BB7-17B2-473F-821C-EB36BA31F9DE}\RP144\A0029874.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.fp skipped C:\System Volume Information\_restore{56686BB7-17B2-473F-821C-EB36BA31F9DE}\RP144\A0029876.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.fp skipped C:\System Volume Information\_restore{56686BB7-17B2-473F-821C-EB36BA31F9DE}\RP144\A0029877.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.fp skipped C:\System Volume Information\_restore{56686BB7-17B2-473F-821C-EB36BA31F9DE}\RP144\A0029878.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.fp skipped C:\System Volume Information\_restore{56686BB7-17B2-473F-821C-EB36BA31F9DE}\RP144\A0029879.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.fp skipped C:\System Volume Information\_restore{56686BB7-17B2-473F-821C-EB36BA31F9DE}\RP144\A0029883.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.jp skipped C:\System Volume Information\_restore{56686BB7-17B2-473F-821C-EB36BA31F9DE}\RP145\change.log Object is locked skipped C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped C:\WINDOWS\Internet Logs\fwdbglog.txt Object is locked skipped C:\WINDOWS\Internet Logs\fwpktlog.txt Object is locked skipped C:\WINDOWS\Internet Logs\IAMDB.RDB Object is locked skipped C:\WINDOWS\Internet Logs\TERRI.ldb Object is locked skipped C:\WINDOWS\Internet Logs\tvDebug.log Object is locked skipped C:\WINDOWS\ModemLog_Motorola SM56 Speakerphone Modem.txt Object is locked skipped C:\WINDOWS\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{22700E92-83E3-4B2D-A090-370682EFA4E6}.crmlog Object is locked skipped C:\WINDOWS\SchedLgU.Txt Object is locked skipped C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped C:\WINDOWS\Sti_Trace.log Object is locked skipped C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\default Object is locked skipped C:\WINDOWS\system32\config\default.LOG Object is locked skipped C:\WINDOWS\system32\config\Media Ce.evt Object is locked skipped C:\WINDOWS\system32\config\SAM Object is locked skipped C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\SECURITY Object is locked skipped C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped C:\WINDOWS\system32\config\software Object is locked skipped C:\WINDOWS\system32\config\software.LOG Object is locked skipped C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\system Object is locked skipped C:\WINDOWS\system32\config\system.LOG Object is locked skipped C:\WINDOWS\system32\drivers\fidbox.dat Object is locked skipped C:\WINDOWS\system32\drivers\fidbox.idx Object is locked skipped C:\WINDOWS\system32\drivers\fidbox2.dat Object is locked skipped C:\WINDOWS\system32\drivers\fidbox2.idx Object is locked skipped C:\WINDOWS\system32\h323log.txt Object is locked skipped C:\WINDOWS\system32\pmnllij.dll.vzr Infected: not-a-virus:AdWare.Win32.Virtumonde.jp skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped C:\WINDOWS\temp\ZLT04b70.TMP Object is locked skipped C:\WINDOWS\temp\ZLT04b80.TMP Object is locked skipped C:\WINDOWS\wiadebug.log Object is locked skipped C:\WINDOWS\wiaservc.log Object is locked skipped C:\WINDOWS\WindowsUpdate.log Object is locked skipped J:\RECYCLER\NPROTECT\00000080.windo Object is locked skipped J:\RECYCLER\NPROTECT\00000081.windo Object is locked skipped J:\RECYCLER\NPROTECT\00000082.windo Object is locked skipped J:\RECYCLER\NPROTECT\00000086.servi Object is locked skipped J:\RECYCLER\NPROTECT\00000087.secur Object is locked skipped J:\RECYCLER\NPROTECT\00000088.runti Object is locked skipped J:\RECYCLER\NPROTECT\00000089.runti Object is locked skipped J:\RECYCLER\NPROTECT\00000090.messa Object is locked skipped J:\RECYCLER\NPROTECT\00000091.manag Object is locked skipped J:\RECYCLER\NPROTECT\00000093.enter Object is locked skipped J:\RECYCLER\NPROTECT\00000094.enter Object is locked skipped J:\RECYCLER\NPROTECT\00000095.drawi Object is locked skipped J:\RECYCLER\NPROTECT\00000096.drawi Object is locked skipped J:\RECYCLER\NPROTECT\00000097.drawi Object is locked skipped J:\RECYCLER\NPROTECT\00000098.direc Object is locked skipped J:\RECYCLER\NPROTECT\00000099.desig Object is locked skipped J:\RECYCLER\NPROTECT\00000100.desig Object is locked skipped J:\RECYCLER\NPROTECT\00000102.confi Object is locked skipped J:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped Scan process completed.

06-09-2007, 08:24 AM	#10 (permalink)
tetonbob Manager, Security Center, TSF Academy; Analyst, Security Team Join Date: Jan 2005 Location: Transylvania County, North Carolina, USA Posts: 35,620 OS: 2000 Pro; XP Pro; XP Home	Re: virus keeps renaming itself in zonealarm Hello, once again, I had requested a new HijackThis log. Please post one now. The items found by Kaspersky are not as bad as you think. I'll address them as soon as I see a new HijackThis log. __________________ Practice Safe Surfing PC Safety and Security--What Do I Need? Because what you don't know, CAN hurt you. Proud Member of ASAP since 2005 Proud Member of UNITE since 2006 Microsoft MVP - Consumer Security 2009

06-09-2007, 03:23 PM	#11 (permalink)
monssef Registered User Join Date: May 2007 Posts: 26 OS: xp	Re: virus keeps renaming itself in zonealarm Im sorry once again I was falling asleep last night here is the hijackthis log: Logfile of HijackThis v1.99.1 Scan saved at 4:22:20 PM, on 6/9/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\ZoneLabs\vsmon.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\Acer\Empowering Technology\ePerformance\MemCheck.exe C:\WINDOWS\eHome\ehRecvr.exe C:\WINDOWS\eHome\ehSched.exe C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe c:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\HPZipm12.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\wwSecure.exe C:\WINDOWS\system32\dllhost.exe C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe D:\Program Files\SlySoft\AnyDVD\AnyDVD.exe C:\Acer\Empowering Technology\Acer.Empowering.Framework.Launcher.exe C:\PROGRA~1\ZONELA~1\ZONEAL~1\MAILFR~1\mantispm.exe C:\WINDOWS\system32\ZoneLabs\avsys\ScanningProcess.exe C:\WINDOWS\system32\ZoneLabs\avsys\ScanningProcess.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\WINDOWS\system32\NOTEPAD.EXE C:\Program Files\HijackThis\HijackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://global.acer.com O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - c:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\WINDOWS\system32\eDStoolbar.dll O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" O4 - HKCU\..\Run: [AnyDVD] "D:\Program Files\SlySoft\AnyDVD\AnyDVD.exe" O4 - Global Startup: Acer Empowering Technology.lnk = ? O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing) O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing) O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english...an_unicode.cab O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll O23 - Service: Memory Check Service (AcerMemUsageCheckService) - Acer Inc. - C:\Acer\Empowering Technology\ePerformance\MemCheck.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - c:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe O23 - Service: Washer Security Access (wwSecSvc) - Webroot Software, Inc. - C:\WINDOWS\system32\wwSecure.exe

06-09-2007, 08:21 PM	#12 (permalink)
monssef Registered User Join Date: May 2007 Posts: 26 OS: xp	Re: virus keeps renaming itself in zonealarm here is the new hijackthis log, thank you. Logfile of HijackThis v1.99.1 Scan saved at 9:20:10 PM, on 6/9/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\ZoneLabs\vsmon.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\Acer\Empowering Technology\ePerformance\MemCheck.exe C:\WINDOWS\eHome\ehRecvr.exe C:\WINDOWS\eHome\ehSched.exe C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe c:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\HPZipm12.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\wwSecure.exe C:\WINDOWS\system32\dllhost.exe C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe D:\Program Files\SlySoft\AnyDVD\AnyDVD.exe C:\Acer\Empowering Technology\Acer.Empowering.Framework.Launcher.exe C:\PROGRA~1\ZONELA~1\ZONEAL~1\MAILFR~1\mantispm.exe C:\WINDOWS\system32\ZoneLabs\avsys\ScanningProcess.exe C:\WINDOWS\system32\ZoneLabs\avsys\ScanningProcess.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\WINDOWS\system32\NOTEPAD.EXE C:\Program Files\HijackThis\HijackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://global.acer.com O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - c:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\WINDOWS\system32\eDStoolbar.dll O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" O4 - HKCU\..\Run: [AnyDVD] "D:\Program Files\SlySoft\AnyDVD\AnyDVD.exe" O4 - Global Startup: Acer Empowering Technology.lnk = ? O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing) O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing) O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english...an_unicode.cab O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll O23 - Service: Memory Check Service (AcerMemUsageCheckService) - Acer Inc. - C:\Acer\Empowering Technology\ePerformance\MemCheck.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - c:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe O23 - Service: Washer Security Access (wwSecSvc) - Webroot Software, Inc. - C:\WINDOWS\system32\wwSecure.exe

06-09-2007, 09:05 PM	#13 (permalink)
tetonbob Manager, Security Center, TSF Academy; Analyst, Security Team Join Date: Jan 2005 Location: Transylvania County, North Carolina, USA Posts: 35,620 OS: 2000 Pro; XP Pro; XP Home	Re: virus keeps renaming itself in zonealarm Thanks for the new log. Delete this file: C:\WINDOWS\system32\pmnllij.dll.vzr C:\QooBox is ComboFix's quarantine folder. You can safely delete it C:\System Volume Information is where System Restore's cache is stored. Whatever is in there can't harm you unless you choose to perform a manual restore. Nevertheless, we shall be reseting/clearing the cache in a little while. Other than that, your logs appear clean.You should be good to go. We still have a few items to address. Reset hidden/system files and folders Click Start. Open My Computer. Select the Tools menu and click Folder Options. Select the View tab. Deselect the Show hidden files and folders option. Select the Hide file extensions for known types option. Select the Hide protected operating system files option. Click Yes to confirm. Click OK. Clear & Reset System Restore's Cache click Start >> Run - type SYSDM.CPL & press Enter select the System Restore Tab tick on the checkbox - "Turn off System Restore on all drives" click Apply then untick the same checkbox & click OK Enable Windows Auto Update Go to Start>Run - type wuaucpl.cpl tick on the checkbox - "Automatically download the updates, and install them on the schedule that I specify". Click on "OK". Now that you are clean, to help protect your computer in the future I recommend that you get the following free programs if you don't have them already: SpywareBlaster to help prevent spyware from installing in the first place. Install & update SpywareBlaster with the latest definitions. After you have updated, click the button - enable protection for all unprotected items SpywareGuard to catch and block spyware before it can execute. SPYBOT - SEARCH & DESTROY Download and install Spybot - Search & Destroy with its TeaTimer option. This will provide realtime spyware & hijacker protection on your computer alongside your virus protection. You should also scan your computer with the program on a regular basis just as you would an antivirus software. A tutorial on installing & using this product can be found here AD-AWARE Download and install Ad-Aware. You should use this program to scan your computer on a regular basis just as you would an antivirus software in conjunction with Spybot. A tutorial on installing & using this product can be found here IE-SPYAD - IE/Spyad places more than 4000 dubious websites and domains in the IE Restricted list. This severely impair attempts to infect your system. It basically prevents any downloads (Cookies etc) from the sites listed, although you will still be able to connect to the sites. Download IE-SpyAD - Extract the contents to a new folder From within the folder, double-click install.bat Select Option #2 - Install the new IE-SPYAD list. Then return to the main menu. Select option #4 - Add the old porn sites domain MVPS HOST FILE The MVPS Hosts file replaces your current HOSTS file with one that will restrict known ad sites form serving you unsolicited advertisements. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is the IP of your local computer. Download Host.zip to your desktop. From your Desktop right-click (hosts.zip) and select: Extract All from the menu. Click Next, click Next, select the option: "Show Extracted files", click Finish This will open the newly created hosts folder on your Desktop. Double-click on the included mvps.bat file, this will rename the existing HOSTS file to HOSTS.MVP, then it will copy the included updated HOSTS file to the correct location on your machine. ANTIVIRUS SOFTWARE It is very important that you have anti-virus software running on your machine. This alone can save you a lot of trouble with malware in the future. Here are a few very good free Antivirus products which are available: AOL Active Virus Shield (powered by Kaspersky Antivirus) Avast! AVG Avira PersonalEdition Classic Select one of these, or another of your choice. Do not install more than one antivirus program because they will conflict with each other. It is imperative that you update your antivirus software at least once a week (even more if you wish). If you do not update your antivirus software then it will not be able to catch new malware that may have come out. See this link for a listing of some online antivirus scanners: Anti-Spyware Tutorial FIREWALL If you do not have a firewall, here are a couple of great free ones available for personal use. Using a third-party firewall will allow you to give/deny access for applications that want to go online. Select one of these, or another of your choice: Do not install more than one firewall program because they will conflict with each other. Comodo Personal Firewall ZoneAlarm In light of your recent troubles, I'm sure you'll like to avoid any future infections. Please take a look at these well written articles HOW DID I GET INFECTED IN THE FIRST PLACE? THE ANTI-SPYWARE TUTORIAL MAKING INTERNET EXPLORER SAFER If you want to fight back the Malware Writers that have made your life a misery, please take a look here and read what you can do against it. Please respond to this thread one more time so we can mark this thread as resolved. __________________ Practice Safe Surfing PC Safety and Security--What Do I Need? Because what you don't know, CAN hurt you. Proud Member of ASAP since 2005 Proud Member of UNITE since 2006 Microsoft MVP - Consumer Security 2009

06-09-2007, 10:22 PM	#14 (permalink)
monssef Registered User Join Date: May 2007 Posts: 26 OS: xp	Re: virus keeps renaming itself in zonealarm I followed the last step your provided and here is the last hijackthis log Logfile of HijackThis v1.99.1 Scan saved at 11:20:59 PM, on 6/9/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\ZoneLabs\vsmon.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\Acer\Empowering Technology\ePerformance\MemCheck.exe C:\WINDOWS\eHome\ehRecvr.exe C:\WINDOWS\eHome\ehSched.exe C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe c:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\HPZipm12.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\wwSecure.exe C:\WINDOWS\system32\dllhost.exe C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe D:\Program Files\SlySoft\AnyDVD\AnyDVD.exe C:\Acer\Empowering Technology\Acer.Empowering.Framework.Launcher.exe C:\PROGRA~1\ZONELA~1\ZONEAL~1\MAILFR~1\mantispm.exe C:\WINDOWS\system32\ZoneLabs\avsys\ScanningProcess.exe C:\WINDOWS\system32\ZoneLabs\avsys\ScanningProcess.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\WINDOWS\system32\wuauclt.exe C:\Program Files\SpywareGuard\sgmain.exe C:\Program Files\SpywareGuard\sgbhp.exe C:\Program Files\HijackThis\HijackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://global.acer.com O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - c:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\WINDOWS\system32\eDStoolbar.dll O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" O4 - HKCU\..\Run: [AnyDVD] "D:\Program Files\SlySoft\AnyDVD\AnyDVD.exe" O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe O4 - Global Startup: Acer Empowering Technology.lnk = ? O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing) O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing) O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english...an_unicode.cab O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll O23 - Service: Memory Check Service (AcerMemUsageCheckService) - Acer Inc. - C:\Acer\Empowering Technology\ePerformance\MemCheck.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - c:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe O23 - Service: Washer Security Access (wwSecSvc) - Webroot Software, Inc. - C:\WINDOWS\system32\wwSecure.exe

06-09-2007, 10:30 PM	#15 (permalink)
tetonbob Manager, Security Center, TSF Academy; Analyst, Security Team Join Date: Jan 2005 Location: Transylvania County, North Carolina, USA Posts: 35,620 OS: 2000 Pro; XP Pro; XP Home	Re: virus keeps renaming itself in zonealarm All seems well to me. __________________ Practice Safe Surfing PC Safety and Security--What Do I Need? Because what you don't know, CAN hurt you. Proud Member of ASAP since 2005 Proud Member of UNITE since 2006 Microsoft MVP - Consumer Security 2009

06-10-2007, 08:54 AM	#17 (permalink)
tetonbob Manager, Security Center, TSF Academy; Analyst, Security Team Join Date: Jan 2005 Location: Transylvania County, North Carolina, USA Posts: 35,620 OS: 2000 Pro; XP Pro; XP Home	Re: virus keeps renaming itself in zonealarm You're quite welcome. Happy computing, and Safe Surfing to you! __________________ Practice Safe Surfing PC Safety and Security--What Do I Need? Because what you don't know, CAN hurt you. Proud Member of ASAP since 2005 Proud Member of UNITE since 2006 Microsoft MVP - Consumer Security 2009