HELP needed please! - Possibly Perfect Defender??

[alabomb]

Hi

Thanks in advance for any help. I recently downloaded the latest version of VLC media player and since then I have had a popup every 5 minutes,
Name: Win32.Zafi.B
Risk Level: High
Description: Zafi.B is a worm trojan program that records keystrokes and takes screen shots of the computer, stealing personal financial information.


and my home page has been re-set to :

Insecure Internet activity. Threat of virus attack
Due to insecure Internet browsing your PC can easily get infected with viruses, worms and trojans without your knowledge, and that can lead to system slowdown, freezes and crashes.
Also insecure Internet activity can result in revealing your personal information.
To get full advanced real-time protection for PC and Internet activity, register your antivirus software.
We recommend you to protect your PC now and continue safe Internet browsing.
Click here to get full advanced real-time protection and continue browsing.
Continue to this website unprotected (not recommended).

Im sure you've probably come across this a few times before but I cannot find a way to get rid!

I have an ACER 3023WLMi Laptop running XP

DDS.txt below:


DDS (Version 1.1.0) - NTFSx86
Run by All at 19:28:48.43 on 28/12/2008
Internet Explorer: 7.0.5730.13
Microsoft Windows XP Home Edition 5.1.2600.3.1252.44.1033.18.2046.1570 [GMT 0:00]

AV: Norton Internet Security *On-access scanning enabled* (Updated)
FW: Norton Internet Security *enabled*

============== Running Processes ===============

C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Acer\eManager\anbmServ.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\WINDOWS\System32\svchost.exe -k HTTPFilter
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files\Launch Manager\LaunchAp.exe
C:\Program Files\Launch Manager\PowerKey.exe
C:\Program Files\Launch Manager\HotkeyApp.exe
C:\Program Files\Launch Manager\CtrlVol.exe
C:\Program Files\Launch Manager\OSDCtrl.exe
C:\Program Files\Launch Manager\Wbutton.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Arcade\PCMService.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Documents and Settings\All\Application Data\Google\pzpsp23511834.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe
C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe
C:\Program Files\DNA\btdna.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\All\Desktop\dds.com

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.google.com/
uInternet Connection Wizard,ShellNext = hxxp://global.acer.com/
uInternet Settings,ProxyOverride = *.local
BHO: AcroIEHlprObj Class: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 6.0\reader\activex\AcroIEHelper.dll
BHO: NCO 2.0 IE BHO: {602adb0e-4aff-4217-8aa1-95dac4dfa408} - c:\program files\common files\symantec shared\coshared\browser\2.0\coIEPlg.dll
BHO: Symantec Intrusion Prevention: {6d53ec84-6aae-4787-aeee-f4628f01010c} - c:\progra~1\common~1\symant~1\ids\IPSBHO.dll
BHO: Java(tm) Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre6\bin\ssv.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: Show Norton Toolbar: {7febefe3-6b19-4349-98d2-ffb09d4b49ca} - c:\program files\common files\symantec shared\coshared\browser\2.0\CoIEPlg.dll
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [MSMSGS] "c:\program files\messenger\msmsgs.exe" /background
uRun: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "c:\program files\common files\ahead\lib\NMBgMonitor.exe"
uRun: [CTSyncU.exe] "c:\program files\creative\sync manager unicode\CTSyncU.exe"
uRun: [BitTorrent DNA] "c:\program files\dna\btdna.exe"
mRun: [preload] c:\windows\RUNXMLPL.exe
mRun: [LaunchAp] c:\program files\launch manager\LaunchAp.exe
mRun: [PowerKey] "c:\program files\launch manager\PowerKey.exe"
mRun: [LManager] c:\program files\launch manager\HotkeyApp.exe
mRun: [CtrlVol] c:\program files\launch manager\CtrlVol.exe
mRun: [LMgrOSD] c:\program files\launch manager\OSDCtrl.exe
mRun: [Wbutton] "c:\program files\launch manager\Wbutton.exe"
mRun: [SynTPLpr] c:\program files\synaptics\syntp\SynTPLpr.exe
mRun: [SynTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe
mRun: [SoundMan] SOUNDMAN.EXE
mRun: [ATIPTA] c:\program files\ati technologies\ati control panel\atiptaxx.exe
mRun: [PCMService] "c:\program files\arcade\PCMService.exe"
mRun: [ccApp] "c:\program files\common files\symantec shared\ccApp.exe"
mRun: [osCheck] "c:\program files\norton internet security\osCheck.exe"
mRun: [LogMeIn GUI] "c:\program files\logmein\x86\LogMeInSystray.exe"
mRun: [NeroFilterCheck] c:\windows\system32\NeroCheck.exe
mRun: [AppleSyncNotifier] c:\program files\common files\apple\mobile device support\bin\AppleSyncNotifier.exe
mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
mRun: [winssvc] "c:\documents and settings\all\application data\google\pzpsp23511834.exe" 2
dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL
Notify: AtiExtEvent - Ati2evxx.dll
Notify: LMIinit - LMIinit.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

============= SERVICES / DRIVERS ===============

R1 Hotkey;Hotkey;c:\windows\system32\drivers\Hotkey.sys [2005-4-2 9867]
R2 ccEvtMgr;Symantec Event Manager;"c:\program files\common files\symantec shared\ccSvcHst.exe" /h ccCommon [2007-8-25 149352]
R2 ccSetMgr;Symantec Settings Manager;"c:\program files\common files\symantec shared\ccSvcHst.exe" /h ccCommon [2007-8-25 149352]
R2 LiveUpdate Notice;LiveUpdate Notice;"c:\program files\common files\symantec shared\ccSvcHst.exe" /h ccCommon [2007-8-25 149352]
R2 LMIRfsDriver;LogMeIn Remote File System Driver;\??\c:\windows\system32\drivers\LMIRfsDriver.sys [2008-1-15 47640]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;\??\c:\program files\common files\symantec shared\eengine\EraserUtilRebootDrv.sys [2008-9-4 99376]
R3 HSFHWATI;HSFHWATI;c:\windows\system32\drivers\HSFHWATI.sys [1980-1-1 200192]
R3 NAVENG;NAVENG;\??\c:\progra~1\common~1\symant~1\virusd~1\20081223.020\NAVENG.SYS [2008-12-23 89104]
R3 NAVEX15;NAVEX15;\??\c:\progra~1\common~1\symant~1\virusd~1\20081223.020\NAVEX15.SYS [2008-12-23 876112]
R3 POWERKEY;POWERKEY;\??\c:\program files\launch manager\POWERKEY.sys [2005-4-2 2343]
S1 mailKmd;mailKmd; []
S1 Wbutton;Wbutton;c:\windows\system32\drivers\Wbutton.sys []
S2 LMIInfo;LogMeIn Kernel Information Provider;\??\c:\program files\logmein\x86\RaInfo.sys [2007-8-3 12856]
S3 COH_Mon;COH_Mon;\??\c:\windows\system32\drivers\COH_Mon.sys [2007-5-29 23888]
S3 ggflt;SEMC USB Flash Driver Filter;c:\windows\system32\drivers\ggflt.sys [2008-2-27 13352]
S3 Symantec Core LC;Symantec Core LC;c:\progra~1\common~1\symant~1\ccpd-lc\symlcsvc.exe [2008-1-13 1251720]
S4 LMIRfsClientNP;LMIRfsClientNP; []

=============== Created Last 30 ================

2008-12-28 18:35 241 a------- C:\!HJT.BAT
2008-12-28 18:35 218 a------- C:\Temp.reg
2008-12-28 18:21 <DIR> --d----- c:\windows\pss
2008-12-28 13:52 <DIR> --d----- c:\program files\Spybot - Search & Destroy
2008-12-28 13:52 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Spybot - Search & Destroy
2008-12-28 12:28 <DIR> --d----- c:\docume~1\alluse~1\applic~1\SUPERAntiSpyware.com
2008-12-20 20:26 7,062 a------- c:\windows\system32\audiopid.vxd
2008-12-10 20:16 455,296 -------- c:\windows\system32\dllcache\mrxsmb.sys
2008-12-10 18:23 1,106,944 -------- c:\windows\system32\dllcache\msxml3.dll
2008-12-01 21:18 <DIR> --d----- c:\program files\PacificPoker4
2008-11-28 21:14 221,184 a------- c:\windows\system32\wmpns.dll
2008-11-28 21:00 <DIR> --d----- c:\windows\system32\scripting
2008-11-28 21:00 <DIR> --d----- c:\windows\l2schemas
2008-11-28 21:00 <DIR> --d----- c:\windows\system32\en
2008-11-28 21:00 <DIR> --d----- c:\windows\system32\bits
2008-11-28 20:57 <DIR> --d----- c:\windows\ServicePackFiles
2008-11-28 20:54 <DIR> --d----- c:\windows\network diagnostic
2008-11-28 20:48 <DIR> --d----- c:\windows\EHome

==================== Find3M ====================

2008-12-13 06:40 3,593,216 a------- c:\windows\system32\dllcache\mshtml.dll
2008-11-28 21:03 76,487 a------- c:\windows\pchealth\helpctr\offlinecache\index.dat
2008-11-10 05:43 410,984 a------- c:\windows\system32\deploytk.dll
2008-10-23 12:36 286,720 a------- c:\windows\system32\gdi32.dll
2008-10-23 12:36 286,720 -------- c:\windows\system32\dllcache\gdi32.dll
2008-10-17 19:17 83,288 a------- c:\windows\system32\LMIRfsClientNP.dll
2008-10-17 19:17 28,984 a------- c:\windows\system32\LMIport.dll
2008-10-17 19:17 87,352 a------- c:\windows\system32\LMIinit.dll
2008-10-17 19:17 23,736 a------- c:\windows\system32\lmimirr.dll
2008-10-17 19:17 10,040 a------- c:\windows\system32\lmimirr2.dll
2008-10-16 14:13 1,809,944 a------- c:\windows\system32\dllcache\wuaueng.dll
2008-10-16 14:13 202,776 a------- c:\windows\system32\dllcache\wuweb.dll
2008-10-16 14:12 323,608 a------- c:\windows\system32\dllcache\wucltui.dll
2008-10-16 14:12 561,688 a------- c:\windows\system32\dllcache\wuapi.dll
2008-10-16 14:09 92,696 a------- c:\windows\system32\dllcache\cdm.dll
2008-10-16 14:09 51,224 a------- c:\windows\system32\dllcache\wuauclt.exe
2008-10-16 14:08 34,328 a------- c:\windows\system32\dllcache\wups.dll
2008-10-16 14:06 268,648 a------- c:\windows\system32\mucltui.dll
2008-10-16 14:06 208,744 a------- c:\windows\system32\muweb.dll
2008-10-16 13:11 70,656 a------- c:\windows\system32\dllcache\ie4uinit.exe
2008-10-16 13:11 13,824 a------- c:\windows\system32\dllcache\ieudinit.exe
2008-10-15 16:34 337,408 -------- c:\windows\system32\dllcache\netapi32.dll
2008-10-15 07:06 633,632 a------- c:\windows\system32\dllcache\iexplore.exe
2008-10-15 07:04 161,792 a------- c:\windows\system32\dllcache\ieakui.dll
2008-10-03 10:02 247,326 a------- c:\windows\system32\strmdll.dll
2008-10-03 10:02 247,326 a------- c:\windows\system32\dllcache\strmdll.dll
2008-09-30 16:43 1,286,152 a------- c:\windows\system32\msxml4.dll

============= FINISH: 19:29:20.28 ===============

If you need anything else, please let me know. Any suggestions?

Thanks again.
Dave

[chemist]

Hello and Welcome to TSF.

Please Subscribe to this Thread to get immediate notification of replies as soon as they are posted. To do this click Thread Tools, then click Subscribe to this Thread. Make sure it is set to Instant notification by email, then click Add Subscription.

Please note that the forum is very busy and if I don't hear from you within three days this thread will be closed.

------------------------------------------------------

Please visit this webpage for download links, and instructions for running ComboFix:

http://www.bleepingcomputer.com/comb...o-use-combofix

* Ensure you have disabled all antivirus and antimalware programs so they do not interfere with the running of ComboFix.

Please post the C:\ComboFix.txt in your next reply for further review.

------------------------------------------------------

[alabomb]

thanks for your reply. In between my original post and your reply, I ran an anti-malware program which seems have resolved my initial problem but here is the combofix log as I know there is often leftovers that should be sorted.

Do I need to do anything else?
-----------------------------------------------------------

ComboFix 08-12-30.02 - All 2008-12-31 23:44:04.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.2046.1488 [GMT 0:00]
Running from: c:\documents and settings\All\Desktop\ComboFix.exe
AV: Norton Internet Security *On-access scanning disabled* (Updated)
FW: Norton Internet Security *disabled*
.

((((((((((((((((((((((((( Files Created from 2008-11-28 to 2008-12-31 )))))))))))))))))))))))))))))))
.

2009-01-04 21:43 . 2009-01-04 21:43 <DIR> d-------- c:\program files\RealMedia
2009-01-04 21:43 . 2009-01-04 21:43 <DIR> d-------- c:\program files\OpenSource Flash Video Splitter
2009-01-04 21:43 . 2009-01-04 21:43 <DIR> d-------- c:\program files\MONOGRAM AMR SplitterDecoder
2009-01-04 21:43 . 2009-01-04 21:43 <DIR> d-------- c:\program files\CD Audio Reader Filter
2009-01-04 21:41 . 2009-01-04 21:41 <DIR> d-------- c:\program files\SHOUTcast Source
2009-01-04 21:41 . 2009-01-04 21:41 <DIR> d-------- c:\program files\Haali
2009-01-04 21:41 . 2009-01-04 21:41 <DIR> d-------- c:\program files\ffdshow
2009-01-04 21:41 . 2009-01-04 21:41 <DIR> d-------- c:\program files\DSP-worx
2009-01-04 21:41 . 2007-11-29 12:52 60,273 --a------ c:\windows\system32\pthreadGC2.dll
2009-01-04 21:41 . 2007-12-03 16:34 7,680 --a------ c:\windows\system32\ff_vfw.dll
2009-01-04 21:41 . 2007-11-29 12:52 547 --a------ c:\windows\system32\ff_vfw.dll.manifest
2009-01-04 21:40 . 2009-01-04 21:40 <DIR> d-------- c:\program files\DirectVobSub
2009-01-04 21:38 . 2008-12-30 17:04 <DIR> d-------- c:\program files\Zoom Player
2008-12-31 21:16 . 2008-12-31 21:17 <DIR> d-------- c:\program files\iTunes
2008-12-31 21:16 . 2008-12-31 21:16 <DIR> d-------- c:\program files\iPod
2008-12-31 21:16 . 2008-12-31 21:17 <DIR> d-------- c:\documents and settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2008-12-31 21:10 . 2008-12-31 21:12 <DIR> d-------- c:\program files\QuickTime
2008-12-30 16:49 . 2008-12-30 16:49 112 --a------ c:\windows\ChkMail.Ini
2008-12-30 15:09 . 2008-12-31 23:22 <DIR> d-------- c:\documents and settings\All\Application Data\BitTorrent
2008-12-30 12:54 . 2008-12-30 12:54 <DIR> d-------- c:\documents and settings\All\Application Data\Malwarebytes
2008-12-30 12:54 . 2008-12-30 12:54 <DIR> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes
2008-12-29 19:29 . 2008-11-10 05:43 410,984 --a------ c:\windows\system32\deploytk.dll
2008-12-28 19:33 . 2008-12-28 19:33 250 --a------ c:\windows\gmer.ini
2008-12-28 18:35 . 2008-12-28 18:38 241 --a------ C:\!HJT.BAT
2008-12-28 18:35 . 2008-12-28 18:38 218 --a------ C:\Temp.reg
2008-12-28 18:15 . 2008-12-28 18:18 <DIR> d-------- c:\program files\Windows Live Safety Center
2008-12-28 13:52 . 2008-12-30 17:02 <DIR> d-------- c:\program files\Spybot - Search & Destroy
2008-12-28 13:52 . 2008-12-30 17:02 <DIR> d-------- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2008-12-28 12:28 . 2008-12-28 12:28 <DIR> d-------- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2008-12-22 20:16 . 2008-12-22 20:16 <DIR> d-------- c:\documents and settings\All\Application Data\vlc
2008-12-20 20:26 . 2003-06-12 23:25 7,062 --a------ c:\windows\system32\audiopid.vxd
2008-12-10 20:16 . 2008-10-24 11:21 455,296 --------- c:\windows\system32\dllcache\mrxsmb.sys
2008-12-10 18:23 . 2008-09-04 17:15 1,106,944 --------- c:\windows\system32\dllcache\msxml3.dll
2008-12-01 21:18 . 2008-12-03 21:50 <DIR> d-------- c:\program files\PacificPoker4
2008-11-28 21:14 . 2004-08-04 05:00 221,184 --a------ c:\windows\system32\wmpns.dll
2008-11-28 21:00 . 2008-11-28 21:00 <DIR> d-------- c:\windows\system32\scripting
2008-11-28 21:00 . 2008-11-28 21:00 <DIR> d-------- c:\windows\system32\en
2008-11-28 21:00 . 2008-11-28 21:00 <DIR> d-------- c:\windows\system32\bits
2008-11-28 21:00 . 2008-11-28 21:00 <DIR> d-------- c:\windows\l2schemas
2008-11-28 20:57 . 2008-11-28 21:00 <DIR> d-------- c:\windows\ServicePackFiles
2008-11-28 20:48 . 2008-11-28 20:48 <DIR> d-------- c:\windows\EHome
2008-11-04 10:30 . 2008-11-04 10:30 90,112 --a------ c:\windows\system32\QuickTimeVR.qtx
2008-11-04 10:30 . 2008-11-04 10:30 57,344 --a------ c:\windows\system32\QuickTime.qts

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-12-31 23:43 --------- d-----w c:\documents and settings\All Users\Application Data\Symantec
2008-12-31 23:41 --------- d-----w c:\documents and settings\All\Application Data\DNA
2008-12-31 23:37 --------- d-----w c:\program files\Common Files\Symantec Shared
2008-12-31 21:16 --------- d-----w c:\program files\Common Files\Apple
2008-12-31 07:40 --------- d--h--w c:\program files\InstallShield Installation Information
2008-12-30 17:23 --------- d-----w c:\documents and settings\All\Application Data\Apple Computer
2008-12-30 17:22 --------- d-----w c:\documents and settings\All\Application Data\AdobeUM
2008-12-30 17:13 --------- d-----w c:\program files\NewTech Infosystems
2008-12-30 17:09 --------- d-----w c:\program files\CyberLink
2008-12-30 17:05 --------- d-----w c:\program files\PeckJoin
2008-12-30 16:59 --------- d-----w c:\program files\Sony Ericsson
2008-12-30 16:59 --------- d-----w c:\documents and settings\All\Application Data\Samsung
2008-12-30 16:07 --------- d-----w c:\documents and settings\All\Application Data\U3
2008-12-30 15:08 --------- d-----w c:\program files\BitTorrent
2008-12-30 13:37 --------- d-----w c:\program files\Java
2008-12-29 16:10 --------- d-----w c:\program files\LogMeIn
2008-12-28 19:07 --------- d-----w c:\program files\Kontiki
2008-12-24 19:08 --------- d-----w c:\documents and settings\All\Application Data\Creative
2008-12-24 19:08 --------- d-----w c:\documents and settings\All\Application Data\Ahead
2008-12-20 20:25 --------- d-----w c:\program files\Creative
2008-12-13 06:40 3,593,216 ----a-w c:\windows\system32\dllcache\mshtml.dll
2008-11-26 21:46 --------- d-----w c:\documents and settings\All\Application Data\PacificPoker4
2008-10-23 12:36 286,720 ----a-w c:\windows\system32\gdi32.dll
2008-10-23 12:36 286,720 ------w c:\windows\system32\dllcache\gdi32.dll
2008-10-17 19:17 87,352 ----a-w c:\windows\system32\LMIinit.dll
2008-10-17 19:17 83,288 ----a-w c:\windows\system32\LMIRfsClientNP.dll
2008-10-17 19:17 28,984 ----a-w c:\windows\system32\LMIport.dll
2008-10-17 19:17 23,736 ----a-w c:\windows\system32\lmimirr.dll
2008-10-17 19:17 10,040 ----a-w c:\windows\system32\lmimirr2.dll
2008-10-16 14:13 202,776 ----a-w c:\windows\system32\wuweb.dll
2008-10-16 14:13 202,776 ----a-w c:\windows\system32\dllcache\wuweb.dll
2008-10-16 14:13 1,809,944 ----a-w c:\windows\system32\wuaueng.dll
2008-10-16 14:13 1,809,944 ----a-w c:\windows\system32\dllcache\wuaueng.dll
2008-10-16 14:12 561,688 ----a-w c:\windows\system32\wuapi.dll
2008-10-16 14:12 561,688 ----a-w c:\windows\system32\dllcache\wuapi.dll
2008-10-16 14:12 323,608 ----a-w c:\windows\system32\wucltui.dll
2008-10-16 14:12 323,608 ----a-w c:\windows\system32\dllcache\wucltui.dll
2008-10-16 14:09 92,696 ----a-w c:\windows\system32\dllcache\cdm.dll
2008-10-16 14:09 92,696 ----a-w c:\windows\system32\cdm.dll
2008-10-16 14:09 51,224 ----a-w c:\windows\system32\wuauclt.exe
2008-10-16 14:09 51,224 ----a-w c:\windows\system32\dllcache\wuauclt.exe
2008-10-16 14:09 43,544 ----a-w c:\windows\system32\wups2.dll
2008-10-16 14:08 34,328 ----a-w c:\windows\system32\wups.dll
2008-10-16 14:08 34,328 ----a-w c:\windows\system32\dllcache\wups.dll
2008-10-16 14:06 268,648 ----a-w c:\windows\system32\mucltui.dll
2008-10-16 14:06 208,744 ----a-w c:\windows\system32\muweb.dll
2008-10-16 13:11 70,656 ----a-w c:\windows\system32\dllcache\ie4uinit.exe
2008-10-16 13:11 13,824 ----a-w c:\windows\system32\dllcache\ieudinit.exe
2008-10-15 16:34 337,408 ------w c:\windows\system32\dllcache\netapi32.dll
2008-10-15 07:06 633,632 ----a-w c:\windows\system32\dllcache\iexplore.exe
2008-10-15 07:04 161,792 ----a-w c:\windows\system32\dllcache\ieakui.dll
2008-10-03 10:02 247,326 ----a-w c:\windows\system32\strmdll.dll
2008-10-03 10:02 247,326 ----a-w c:\windows\system32\dllcache\strmdll.dll
2008-09-30 16:43 1,286,152 ----a-w c:\windows\system32\msxml4.dll
2008-09-15 12:12 1,846,400 ----a-w c:\windows\system32\win32k.sys
2008-09-15 12:12 1,846,400 ------w c:\windows\system32\dllcache\win32k.sys
2008-09-10 01:14 1,307,648 ------w c:\windows\system32\msxml6.dll
2008-09-10 01:14 1,307,648 ------w c:\windows\system32\dllcache\msxml6.dll
2008-09-08 10:41 333,824 ------w c:\windows\system32\dllcache\srv.sys
2008-09-04 17:15 1,106,944 ----a-w c:\windows\system32\msxml3.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\lib\NMBgMonitor.exe" [2005-10-28 94208]
"BitTorrent DNA"="c:\program files\DNA\btdna.exe" [2008-10-11 289088]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"preload"="c:\windows\RUNXMLPL.exe" [2004-04-20 40960]
"LaunchAp"="c:\program files\Launch Manager\LaunchAp.exe" [2005-03-02 32768]
"PowerKey"="c:\program files\Launch Manager\PowerKey.exe" [2002-08-30 94208]
"LManager"="c:\program files\Launch Manager\HotkeyApp.exe" [2005-03-29 61440]
"CtrlVol"="c:\program files\Launch Manager\CtrlVol.exe" [2004-01-28 184320]
"LMgrOSD"="c:\program files\Launch Manager\OSDCtrl.exe" [2004-10-11 245760]
"Wbutton"="c:\program files\Launch Manager\Wbutton.exe" [2005-03-03 77824]
"SynTPLpr"="c:\program files\Synaptics\SynTP\SynTPLpr.exe" [2004-10-05 98394]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2004-10-05 688218]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-02-08 339968]
"ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2008-10-17 51048]
"osCheck"="c:\program files\Norton Internet Security\osCheck.exe" [2007-08-25 714608]
"LogMeIn GUI"="c:\program files\LogMeIn\x86\LogMeInSystray.exe" [2007-08-03 63048]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-09-03 111936]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-11-04 413696]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-11-10 136600]
"SoundMan"="SOUNDMAN.EXE" [2005-02-23 c:\windows\SOUNDMAN.EXE]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 29696]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LMIinit]
2008-10-17 19:17 87352 c:\windows\system32\LMIinit.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.xvid"= xvid.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTSyncU.exe]
--------- 2006-06-12 14:32 700416 c:\program files\Creative\Sync Manager Unicode\CTSyncU.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
--a------ 2008-11-20 13:20 290088 c:\program files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
--a------ 2008-04-14 00:12 1695232 c:\program files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\DNA\\btdna.exe"=
"c:\\Program Files\\BitTorrent\\bittorrent.exe"=
"c:\\Program Files\\Messenger\\MSMSGS.EXE"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=

R1 Hotkey;Hotkey;c:\windows\system32\drivers\Hotkey.sys [2005-04-02 9867]
R2 LiveUpdate Notice;LiveUpdate Notice;"c:\program files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon [2007-08-25 149352]
R2 LMIInfo;LogMeIn Kernel Information Provider;\??\c:\program files\LogMeIn\x86\RaInfo.sys [2007-08-03 12856]
R2 LMIRfsDriver;LogMeIn Remote File System Driver;\??\c:\windows\system32\drivers\LMIRfsDriver.sys [2008-01-15 47640]
R3 COH_Mon;COH_Mon;\??\c:\windows\system32\Drivers\COH_Mon.sys [2007-05-29 23888]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;\??\c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2008-09-04 99376]
R3 HSFHWATI;HSFHWATI;c:\windows\system32\DRIVERS\HSFHWATI.sys [1980-01-01 200192]
R3 POWERKEY;POWERKEY;\??\c:\program files\Launch Manager\POWERKEY.sys [2005-04-02 2343]
S1 mailKmd;mailKmd; []
S1 Wbutton;Wbutton;c:\windows\system32\drivers\Wbutton.sys []
S3 ggflt;SEMC USB Flash Driver Filter;c:\windows\system32\DRIVERS\ggflt.sys [2008-02-27 13352]
S4 LMIRfsClientNP;LMIRfsClientNP; []

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\F]
\Shell\AutoRun\command - F:\LaunchU3.exe -a

*Newly Created Service* - COMHOST
*Newly Created Service* - PROCEXP90
.
Contents of the 'Scheduled Tasks' folder

2008-12-31 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]

2008-12-29 c:\windows\Tasks\Norton Internet Security - Run Full System Scan - All.job
- c:\program files\Norton Internet Security\Norton AntiVirus\Navw32.exe [2007-08-27 01:19]
.
- - - - ORPHANS REMOVED - - - -

HKLM-Run-winssvc - c:\documents and settings\All\Application Data\Google\pzpsp23511834.exe


.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
uInternet Connection Wizard,ShellNext = hxxp://global.acer.com/
uInternet Settings,ProxyOverride = *.local
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

c:\windows\Downloaded Program Files\TraderMediaX.ocx - O16 -: {2A493D5F-8914-4D3E-8BF3-767F281862F4}
hxxp://sell.autotrader.co.uk/uk-ola/common/TraderMediaX.cab

c:\windows\Downloaded Program Files\accounttracking.dll - O16 -: {4E62C4DE-627D-4604-B157-4B7D6B09F02E}
hxxps://moneymanager.egg.com/Pinsafe/accounttracking.cab

c:\windows\Downloaded Program Files\CTSUEng.ocx - c:\windows\Downloaded Program Files\CTSUEngn.ocx
O16 -: {6C269571-C6D7-4818-BCA4-32A035E8C884}
hxxp://www.creative.com/softwareupdate/su/ocx/15101/CTSUEng.cab
c:\windows\Downloaded Program Files\CTSUEng.inf
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-12-31 23:45:47
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(1280)
c:\windows\system32\Ati2evxx.dll
c:\windows\system32\LMIinit.dll
c:\windows\system32\LMIRfsClientNP.dll
.
Completion time: 2008-12-31 23:47:36
ComboFix-quarantined-files.txt 2008-12-31 23:46:58

Pre-Run: 41,477,005,312 bytes free
Post-Run: 41,732,337,664 bytes free

235 --- E O F --- 2008-12-17 21:30:24

[chemist]

Hello alabomb.

Please copy this page to Notepad and Save it to your Desktop in order to assist you when carrying out the following instructions.

Before beginning the fix, read this post completely. If there's anything that you do not understand, kindly ask your questions before proceeding.
Ensure that there aren't any opened browsers when you are carrying out the procedures below.

It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence.

------------------------------------------------------

Go Start > Run and copy/paste the following single-line command into the Run box and click OK:

sc delete mailKmd

A DOS window will open and close again, this is normal.

Repeat for this command:

sc delete LMIRfsClientNP

------------------------------------------------------

You are using an outdated version of HijackThis. Please uninstall HijackThis 1.99.1 in the Add or Remove Programs section of your Control Panel and delete your current version.

------------------------------------------------------

You have old versions of Java still installed. Older versions have vulnerabilities that malware can use to infect your system.
Please follow these steps to remove older version Java components.

• Close any programs you may have running - especially your web browser.
• Go to Start(or My Computer) > Control Panel and click on Add or Remove Programs
• Click (highlight) any item with Java Runtime Environment (JRE, J2SE, Java(TM) SE or Java(TM) 6) in the name except Java(TM) 6 Update 11 which is the current version.
• Click the Remove or Change/Remove button.
• Repeat as many times as necessary to remove each Java version.
• Keep Java(TM) 6 Update 11 as it is the current version.
• Reboot your computer once all Java components are removed.

------------------------------------------------------

Please run this online scan to help look for remnants.

Establish an internet connection & perform an online scan at Kaspersky Online Scanner

Ensure your external and/or USB drives are inserted during the scan.

Click Accept, when prompted to download and install the program files and database of malware definitions.

• Click Run at any Security prompt.
• The program will then begin downloading and installing and will also update the database.
• Please be patient as this can take several minutes.
• Once the update is complete, click on My Computer under the green Scan bar to the left to start the scan.
• Once the scan is complete, it will display if your system has been infected.
• It does not provide an option to clean/disinfect. We only require a report from it.
• Do NOT be alarmed by what you see in the report. Many of the finds have likely been quarantined.
• Click View scan report at the bottom.
• Click the Save Report As... button.
• Click the Save as Text button to save the file to your desktop so that you may post it in your next reply.

**Note**

To optimize scanning time and produce a more sensible report for review:

• Close any open programs.
• Turn off the real-time scanner of all antivirus or antispyware programs while performing the online scan.

Note for Internet Explorer 7 users: If at any time you have trouble viewing the accept button of the license, click on the Zoom tool located at the bottom right of the IE window and set the zoom to 75%. Once the license is accepted, reset to 100%.

------------------------------------------------------

Did you save the log from MBAM? If you did, please post it. If you didn't, please run gmer again and attach its log to your next reply.

------------------------------------------------------

[alabomb]

Here is the report from the online scan:

--------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER 7 REPORT
Thursday, January 1, 2009
Operating System: Microsoft Windows XP Home Edition Service Pack 3 (build 2600)
Kaspersky Online Scanner 7 version: 7.0.25.0
Program database last update: Thursday, January 01, 2009 08:47:23
Records in database: 1541939
--------------------------------------------------------------------------------

Scan settings:
Scan using the following database: extended
Scan archives: yes
Scan mail databases: yes

Scan area - My Computer:
C:\
D:\

Scan statistics:
Files scanned: 67714
Threat name: 0
Infected objects: 0
Suspicious objects: 0
Duration of the scan: 01:40:17

No malware has been detected. The scan area is clean.

The selected area was scanned.

------------------------------------------------------

Did you save the log from MBAM? If you did, please post it. If you didn't, please run gmer again and attach its log to your next reply.

------------------------------------------------------

I'm not sure what you mean, the original log from gmer was attached as ark.txt in the original post. I've re-run gmer and attached the log, is this what you mean?

Thanks for you help.

[chemist]

Your logs appear clean. You should be good to go.

Go to Start >> Run and Copy/Paste the following single-line command into the Run box and click OK:

combofix /u

This will uninstall ComboFix and delete ComboFix's quarantine folder. It will also implement some cleanup procedures, remove old System Restore Points which contain previous infections, and create a fresh, clean System Restore Point.

Please re-enable your antivirus program and any other antispyware programs disabled earlier if you haven't already.

You can safely delete any tools downloaded or any logs, files, and any shortcuts on your desktop that were created during this fix.

------------------------------------------------------

MICROSOFT UPDATES
It is very important that you get all of the critical updates for your Operating System and Internet Explorer. Keeping your OS and browser up to date will help make you less susceptible to attacks by Trojans and viruses. Please go to Microsoft and download all the critical updates to help prevent possible re-infection.

SPYWARE PREVENTION
This is a good time to set up protection against further attacks. In light of your recent problem, I'm sure you'd like to avoid any future infections. Please read these well written articles:

• How Did I Get Infected In The First Place? by TonyKlein
• PC Safety and Security--What Do I Need?

To help protect your computer in the future I recommend that you get the following free programs if you do not already have them:

• SpywareBlaster prevents the installation of ActiveX-based malware, blocks cookies, and restricts the actions of "bad" sites in Internet Explorer. See tutorial here
  
• IE-Spyad is another excellent program that places over 5000 dubious websites and domains in the IE Restricted list, which will help prevent attempts to infect your system. It basically prevents any downloads from the sites listed, although you will still be able to connect to the site. See tutorial here
  
• MVPS HOSTS FILE replaces your current HOSTS file with one that will restrict known ad sites from serving you unsolicited advertisements. It basically prevents your computer from connecting to those sites by redirecting them to 127.0.0.1, which is the IP of your local computer. See guide here and for Windows Vista here

Keep your antivirus program and antispyware programs updated and scan with them on a regular basis.

Please respond to this thread one more time so we can mark this thread as resolved.

[alabomb]

Thanks very much, I've downloaded SpywareBlaster but couldn't understand the other 2. I have Norton so hopefully this wll cover it.

Thanks again.