Really nasty Malware, need help removing

[Bewdy]

Hi, I realize that this is such a common problem, but I am at my last resort now trying to fix this issue with my PC before I re-install. I have acquired some malware/spyware which has been a real pain to track down, and I'm almost there with it, but there a few stubborn files which are still in the system, and I was hoping for some help removing them. The result is that when I browse a pop up appears, which while not offensive, is extremely annoying, and concerns me that other data is being logged without my knowledge. Fortunately this is my 'work' PC so i don't tend to use it much for browsing or accessing sensitive data, hence the reason why I've had poorer security than I should have and probably why I have got the virus so easily. (this will of course change now I've picked one up hind sight is a wonderful thing).

Prior to coming on this forum I had used 'Trojan Remover' to try and delete the files which it has done in the most part, however it is still highlighting some dlls which appear to be really hidden files which I can't access of even display in the Dos prompt.

hodisuto.dll / wotupogo.dll / fidofepu.dll / hgGwVPHB.dll

Anyway, I have run the DDS log, and sure enough I can see these files in there, but the gmer program takes my computer to the blue screen every time I run it. So I can't access that data.

I'd be very appreciative if someone could shed some light on how to remove these nasty little critters, before I hit the windows disk and re-install a fresh, ugh!!

Many Thanks in advance.

----------------------------------------


DDS (Ver_09-01-07.01) - NTFSx86
Run by Matt at 8:10:47.03 on 16/01/2009
Internet Explorer: 7.0.5730.13
Microsoft Windows XP Professional 5.1.2600.3.1252.44.1033.18.3071.2313 [GMT 0:00]

AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated)
AV: ZoneAlarm Security Suite Antivirus *On-access scanning enabled* (Updated)
FW: ZoneAlarm Security Suite Firewall *enabled*

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\WINDOWS\system32\drivers\CDAC11BA.EXE
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Autodesk\3dsMax8\mentalray\satellite\raysat_3dsmax8server.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\WINDOWS\System32\StkASv2K.exe
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\Program Files\RealVNC\VNC4\WinVNC4.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Canon\Memory Card Utility\iP6700D\PDUiP6700DMon.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\CTHELPER.EXE
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\AlphaTrackApplet.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Program Files\Creative Professional\E-MU PatchMix DSP\EmuPatchMixDSP.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Autodesk\backburner\manager.exe
C:\Program Files\Autodesk\backburner\server.exe
C:\Program Files\Autodesk\3dsMax8\VRLServer.exe
C:\PROGRA~1\ZONELA~1\ZONEAL~1\MAILFR~1\mantispm.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Matt\Desktop\dds.com

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.google.com/
uSearch Page = hxxp://www.google.com
uSearch Bar = hxxp://www.google.com/ie
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uInternet Settings,ProxyOverride = *.local
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
mSearchAssistant = hxxp://www.google.com/ie
BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\googletoolbar1.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\4.1.805.4472\swg.dll
TB: &Google: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\googletoolbar1.dll
uRun: [CTFMON.EXE] c:\windows\system32\ctfmon.exe

uRun: [SetDefaultMIDI] MIDIDef.exe
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [nwiz] nwiz.exe /install
mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRun: [PDUiP6700DMon] c:\program files\canon\memory card utility\ip6700d\PDUiP6700DMon.exe
mRun: [RTHDCPL] RTHDCPL.EXE
mRun: [SkyTel] SkyTel.EXE
mRun: [Alcmtr] ALCMTR.EXE
mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
mRun: [UVS10 Preload] c:\program files\ulead systems\ulead videostudio se dvd\uvPL.exe
mRun: [CTHelper] CTHELPER.EXE
mRun: [ZoneAlarm Client] "c:\program files\zone labs\zonealarm\zlclient.exe"
mRun: [StartAlphaTrackApplet] AlphaTrackApplet.exe
mRun: [AVG8_TRAY] c:\progra~1\avg\avg8\avgtray.exe
mRun: [TrojanScanner] c:\program files\trojan remover\Trjscan.exe /boot
dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE
StartupFolder: c:\docume~1\matt\startm~1\programs\startup\shortc~1.lnk - c:\program files\autodesk\3dsmax8\VRLServer.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\manager.lnk - c:\program files\autodesk\backburner\manager.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\server.lnk - c:\program files\autodesk\backburner\server.exe
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
AppInit_DLLs: c:\windows\system32\hodisuto.dll c:\windows\system32\wotupogo.dll,c:\windows\system32\fidofepu.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SSODL: SSODL - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - No File
LSA: Authentication Packages = msv1_0 c:\windows\system32\fccyaWmM
LSA: Notification Packages = scecli c:\windows\system32\fidofepu.dll

============= SERVICES / DRIVERS ===============

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2009-1-8 97928]
R1 AvgMfx86;AVG Free On-access Scanner Minifilter Driver x86;c:\windows\system32\drivers\avgmfx86.sys [2009-1-8 26824]
R1 KLIF;KLIF;c:\windows\system32\drivers\klif.sys [2008-11-17 127768]
R1 vsdatant;vsdatant;c:\windows\system32\vsdatant.sys [2008-8-5 394952]
R3 AlphaTrack;AlphaTrack Driver;c:\windows\system32\drivers\AlphaTrack.sys [2008-12-26 78848]
R3 AlphaTrackWdmService;AlphaTrack Wdm Audio;c:\windows\system32\drivers\AlphaTrackWdm.sys [2008-12-26 34816]
R3 hypaudio;hypaudio;c:\windows\system32\drivers\hypaudio.sys [2006-4-28 1162424]
R3 hypkern;hypkern;c:\windows\system32\drivers\hypkern.sys [2006-4-28 260553]
R4 avg8wd;AVG Free8 WatchDog;c:\progra~1\avg\avg8\avgwdsvc.exe [2009-1-8 231704]
R4 vsmon;TrueVector Internet Monitor;c:\windows\system32\zonelabs\vsmon.exe -service --> c:\windows\system32\zonelabs\vsmon.exe -service [?]
S3 IKFileSec;File Security Driver;c:\windows\system32\drivers\ikfilesec.sys [2008-8-5 42376]
S3 IKSysFlt;System Filter Driver;c:\windows\system32\drivers\iksysflt.sys [2008-8-5 66952]
S3 IKSysSec;System Security Driver;c:\windows\system32\drivers\iksyssec.sys [2008-8-5 81288]
S3 MSSQL$SONY_MEDIAMGR2;SQL Server (SONY_MEDIAMGR2);c:\program files\microsoft sql server\mssql.1\mssql\binn\sqlservr.exe [2007-2-10 29178224]
S3 RDID1045;Roland FANTOM-X;c:\windows\system32\drivers\RDWM1045.SYS [2004-1-20 59642]
S3 sdAuxService;PC Tools Auxiliary Service;c:\program files\spyware doctor\pctsAuxs.exe [2008-8-5 747912]
S3 sdCoreService;PC Tools Security Service;c:\program files\spyware doctor\pctsSvc.exe [2008-8-5 948616]

=============== Created Last 30 ================

2009-01-09 09:27 162,304 a------- c:\windows\system32\ztvunrar36.dll
2009-01-09 09:27 153,088 a------- c:\windows\system32\UNRAR3.dll
2009-01-09 09:27 77,312 a------- c:\windows\system32\ztvunace26.dll
2009-01-09 09:27 75,264 a------- c:\windows\system32\unacev2.dll
2009-01-09 09:27 69,632 a------- c:\windows\system32\ztvcabinet.dll
2009-01-09 09:27 <DIR> --d----- c:\program files\Trojan Remover
2009-01-09 09:27 <DIR> --d----- c:\docume~1\matt\applic~1\Simply Super Software
2009-01-09 09:27 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Simply Super Software
2009-01-09 09:10 459,264 -c------ c:\windows\system32\dllcache\msfeeds.dll
2009-01-09 09:10 383,488 -c------ c:\windows\system32\dllcache\ieapfltr.dll
2009-01-09 09:10 267,776 -c------ c:\windows\system32\dllcache\iertutil.dll
2009-01-09 09:10 63,488 -c------ c:\windows\system32\dllcache\icardie.dll
2009-01-09 09:10 52,224 -c------ c:\windows\system32\dllcache\msfeedsbs.dll
2009-01-09 09:10 13,824 -c------ c:\windows\system32\dllcache\ieudinit.exe
2009-01-09 09:10 2,455,488 -c------ c:\windows\system32\dllcache\ieapfltr.dat
2009-01-09 09:10 991,232 -c------ c:\windows\system32\dllcache\ieframe.dll.mui
2009-01-09 09:10 6,066,176 -c------ c:\windows\system32\dllcache\ieframe.dll
2009-01-08 08:45 <DIR> --d-h--- C:\$AVG8.VAULT$
2009-01-08 08:41 10,520 a------- c:\windows\system32\avgrsstx.dll
2009-01-08 08:41 97,928 a------- c:\windows\system32\drivers\avgldx86.sys
2009-01-08 08:41 <DIR> --d----- c:\windows\system32\drivers\Avg
2009-01-08 08:41 <DIR> --d----- c:\program files\AVG
2009-01-08 08:41 <DIR> --d----- c:\docume~1\alluse~1\applic~1\avg8
2009-01-07 20:50 1,279,243 -------- c:\windows\system32\uzewasuk.ini
2009-01-07 08:49 1,279,243 -------- c:\windows\system32\uwajahok.ini
2009-01-06 20:49 1,279,243 -------- c:\windows\system32\awovilod.ini
2009-01-06 07:49 1,265,232 -------- c:\windows\system32\azezefub.ini
2009-01-05 19:39 1,266,245 -------- c:\windows\system32\ijovijey.ini
2009-01-05 07:39 1,266,209 -------- c:\windows\system32\apovorif.ini
2008-12-29 10:05 1,265,578 -------- c:\windows\system32\aduvowap.ini
2008-12-26 10:17 413,696 a------- c:\windows\system32\AlphaTrackApplet.exe
2008-12-26 10:17 78,848 a------- c:\windows\system32\drivers\AlphaTrack.sys
2008-12-26 10:17 49,152 a------- c:\windows\system32\StartAlphaTrackApplet.exe
2008-12-26 10:17 34,816 a------- c:\windows\system32\drivers\AlphaTrackWdm.sys
2008-12-26 10:17 <DIR> --d----- c:\program files\AlphaTrack
2008-12-23 14:40 22,528 a------- c:\windows\system32\wsock32.dlb
2008-12-23 14:40 205,560 a------- c:\windows\UNBOC.EXE
2008-12-23 14:40 212,728 a------- c:\windows\CMDLIC.DLL
2008-12-23 14:40 <DIR> --d----- c:\program files\Comodo
2008-12-23 10:23 1,639,241 -------- c:\windows\system32\fcoebewr.ini
2008-12-23 10:15 41,472 a------- c:\windows\system32\ismdxlsa.dll.vir
2008-12-23 10:15 789,946 a------- c:\windows\system32\MmWayccf.ini2
2008-12-23 10:15 789,946 a------- c:\windows\system32\MmWayccf.ini

==================== Find3M ====================

2009-01-16 08:10 15,448,864 a--sh--- c:\windows\system32\drivers\fidbox.dat
2009-01-16 07:59 212,840 a--sh--- c:\windows\system32\drivers\fidbox.idx
2008-12-18 08:41 4,212 -------- c:\windows\system32\zllictbl.dat
2008-12-11 10:57 333,952 a------- c:\windows\system32\drivers\srv.sys
2008-10-23 12:36 286,720 a------- c:\windows\system32\gdi32.dll
2008-09-20 10:11 139 a------- c:\program files\INSTALL.LOG

============= FINISH: 8:11:24.03 ===============

[Bewdy]

Anyone any ideas? Thanks

[Bewdy]

I appreciate that this is a really busy board, but just wondered if someone maybe able to help me out with this?

Thanks.

[TheBruce1]

Hello,

Apologises for the delay getting to your log. The helpers here are all volunteers and we have been very busy lately. If you are still having malware problems, follow instructions below.


Please subscribe to this thread to get immediate notification of replies as soon as they are posted. To do this click Thread Tools, then click Subscribe to this Thread. Make sure it is set to Instant Notification, then click Subscribe.

========

Please follow all instructions and in which order they come, if you have any questions, please ask before proceeding. Its important that you follow this through until i give you the all clear.

Please DO NOT Attach logs to your posts unless you are advised to do so.

==========

Please visit this webpage for download links, and instructions for running combofix:

http://www.bleepingcomputer.com/comb...o-use-combofix

* Ensure you have disabled all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Please include the C:\ComboFix.txt in your next reply for further review.

Please note that the forum is very busy and if I don't hear from you within three days this thread will be closed.

[Bewdy]

Thanks for you reply, I am extremely grateful for any help with this problem. I have run combofix and this is the results of my log.

--------------------------------------

ComboFix 09-01-21.04 - Matt 2009-01-26 12:32:18.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3071.2595 [GMT 0:00]
Running from: c:\documents and settings\Matt\Desktop\ComboFix.exe
AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated)
AV: ZoneAlarm Security Suite Antivirus *On-access scanning disabled* (Updated)
FW: ZoneAlarm Security Suite Firewall *disabled*
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\INSTALL.LOG
c:\windows\system32\aduvowap.ini
c:\windows\system32\apovorif.ini
c:\windows\system32\awovilod.ini
c:\windows\system32\azezefub.ini
c:\windows\system32\fcoebewr.ini
c:\windows\system32\ijovijey.ini
c:\windows\system32\MmWayccf.ini
c:\windows\system32\MmWayccf.ini2
c:\windows\system32\uwajahok.ini
c:\windows\system32\uzewasuk.ini
c:\windows\Temp\tmp3.tmp

.
((((((((((((((((((((((((( Files Created from 2008-12-26 to 2009-01-26 )))))))))))))))))))))))))))))))
.

2009-01-19 13:21 . 2009-01-19 13:21 <DIR> d-------- c:\windows\Sun
2009-01-19 13:21 . 2009-01-19 13:21 <DIR> d-------- c:\program files\Java
2009-01-19 13:21 . 2009-01-19 13:21 410,984 --a------ c:\windows\system32\deploytk.dll
2009-01-19 13:21 . 2009-01-19 13:21 73,728 --a------ c:\windows\system32\javacpl.cpl
2009-01-18 08:45 . 2009-01-18 08:46 <DIR> d-------- c:\documents and settings\Matt\Application Data\Sibelius Software
2009-01-18 08:45 . 2009-01-18 08:45 <DIR> d-------- c:\documents and settings\All Users\Application Data\Sibelius Software
2009-01-18 08:45 . 2009-01-18 08:45 604 --ah----- c:\windows\T4
2009-01-18 08:45 . 2009-01-18 08:45 604 --ah----- c:\windows\system32\T3
2009-01-18 08:43 . 2009-01-18 08:43 <DIR> d-------- c:\program files\Sibelius Software
2009-01-16 08:12 . 2009-01-16 08:17 250 --a------ c:\windows\gmer.ini
2009-01-09 09:27 . 2009-01-09 09:28 <DIR> d-------- c:\program files\Trojan Remover
2009-01-09 09:27 . 2009-01-09 09:27 <DIR> d-------- c:\documents and settings\Matt\Application Data\Simply Super Software
2009-01-09 09:27 . 2009-01-09 09:27 <DIR> d-------- c:\documents and settings\All Users\Application Data\Simply Super Software
2009-01-09 09:27 . 2006-05-25 14:52 162,304 --a------ c:\windows\system32\ztvunrar36.dll
2009-01-09 09:27 . 2003-02-02 19:06 153,088 --a------ c:\windows\system32\UNRAR3.dll
2009-01-09 09:27 . 2005-08-26 00:50 77,312 --a------ c:\windows\system32\ztvunace26.dll
2009-01-09 09:27 . 2002-03-06 00:00 75,264 --a------ c:\windows\system32\unacev2.dll
2009-01-09 09:27 . 2006-06-19 12:01 69,632 --a------ c:\windows\system32\ztvcabinet.dll
2009-01-09 09:10 . 2008-10-16 20:38 6,066,176 -----c--- c:\windows\system32\dllcache\ieframe.dll
2009-01-09 09:10 . 2007-04-17 09:32 2,455,488 -----c--- c:\windows\system32\dllcache\ieapfltr.dat
2009-01-09 09:10 . 2007-03-08 05:10 991,232 -----c--- c:\windows\system32\dllcache\ieframe.dll.mui
2009-01-09 09:10 . 2008-10-16 20:38 459,264 -----c--- c:\windows\system32\dllcache\msfeeds.dll
2009-01-09 09:10 . 2008-10-16 20:38 383,488 -----c--- c:\windows\system32\dllcache\ieapfltr.dll
2009-01-09 09:10 . 2008-10-16 20:38 267,776 -----c--- c:\windows\system32\dllcache\iertutil.dll
2009-01-09 09:10 . 2008-10-16 20:38 63,488 -----c--- c:\windows\system32\dllcache\icardie.dll
2009-01-09 09:10 . 2008-10-16 20:38 52,224 -----c--- c:\windows\system32\dllcache\msfeedsbs.dll
2009-01-09 09:10 . 2008-10-16 13:11 13,824 -----c--- c:\windows\system32\dllcache\ieudinit.exe
2009-01-08 08:45 . 2009-01-16 22:29 <DIR> d--h----- C:\$AVG8.VAULT$
2009-01-08 08:41 . 2009-01-26 08:05 <DIR> d-------- c:\windows\system32\drivers\Avg
2009-01-08 08:41 . 2009-01-08 08:41 <DIR> d-------- c:\program files\AVG
2009-01-08 08:41 . 2009-01-08 08:41 <DIR> d-------- c:\documents and settings\All Users\Application Data\avg8
2009-01-08 08:41 . 2009-01-08 08:41 97,928 --a------ c:\windows\system32\drivers\avgldx86.sys
2009-01-08 08:41 . 2009-01-08 08:41 10,520 --a------ c:\windows\system32\avgrsstx.dll
2008-12-26 10:17 . 2008-12-26 10:17 <DIR> d-------- c:\program files\AlphaTrack
2008-12-26 10:17 . 2006-12-18 20:35 413,696 --a------ c:\windows\system32\AlphaTrackApplet.exe
2008-12-26 10:17 . 2007-02-21 11:00 78,848 --a------ c:\windows\system32\drivers\AlphaTrack.sys
2008-12-26 10:17 . 2006-12-18 17:40 49,152 --a------ c:\windows\system32\StartAlphaTrackApplet.exe
2008-12-26 10:17 . 2006-12-18 16:15 34,816 --a------ c:\windows\system32\drivers\AlphaTrackWdm.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-01-26 12:36 20,609,824 --sha-w c:\windows\system32\drivers\fidbox.dat
2009-01-26 12:34 282,272 --sha-w c:\windows\system32\drivers\fidbox.idx
2009-01-26 12:11 --------- d-----w c:\documents and settings\All Users\Application Data\Google Updater
2009-01-23 15:00 --------- d-----w c:\program files\Norton Security Scan
2009-01-22 11:30 --------- d-----w c:\program files\Google
2009-01-18 08:45 604 ---ha-w c:\program files\STLL Notifier
2009-01-16 15:01 --------- d-----w c:\program files\Common Files\Symantec Shared
2009-01-13 17:07 --------- d---a-w c:\documents and settings\All Users\Application Data\TEMP
2009-01-09 08:43 --------- d-----w c:\program files\Spyware Doctor
2008-12-23 15:33 --------- d-----w c:\program files\Comodo
2008-12-11 10:57 333,952 ----a-w c:\windows\system32\drivers\srv.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"SetDefaultMIDI"="MIDIDef.exe" [2005-10-22 c:\windows\MIDIDEF.EXE]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-09-17 8491008]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-09-17 81920]
"PDUiP6700DMon"="c:\program files\Canon\Memory Card Utility\iP6700D\PDUiP6700DMon.exe" [2006-10-03 75376]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-09-06 413696]
"UVS10 Preload"="c:\program files\Ulead Systems\Ulead VideoStudio SE DVD\uvPL.exe" [2006-08-09 36864]
"H2O"="c:\program files\SyncroSoft\Pos\H2O\cledx.exe" [2005-10-22 385024]
"ZoneAlarm Client"="c:\program files\Zone Labs\ZoneAlarm\zlclient.exe" [2008-07-09 919016]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-01-08 1261336]
"TrojanScanner"="c:\program files\Trojan Remover\Trjscan.exe" [2008-12-10 1230728]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-01-19 136600]
"nwiz"="nwiz.exe" [2007-09-17 c:\windows\system32\nwiz.exe]
"RTHDCPL"="RTHDCPL.EXE" [2006-12-19 c:\windows\RTHDCPL.EXE]
"SkyTel"="SkyTel.EXE" [2006-05-16 c:\windows\SkyTel.exe]
"CTHelper"="CTHELPER.EXE" [2005-10-22 c:\windows\CTHELPER.EXE]
"StartAlphaTrackApplet"="AlphaTrackApplet.exe" [2006-12-18 c:\windows\system32\AlphaTrackApplet.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\Matt\Start Menu\Programs\Startup\
Shortcut to VRLServer.exe.lnk - c:\program files\Autodesk\3dsMax8\VRLServer.exe [2008-08-06 245760]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
manager.lnk - c:\program files\Autodesk\backburner\manager.exe [2006-03-16 110592]
server.lnk - c:\program files\Autodesk\backburner\server.exe [2006-03-16 110592]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.dvacm"= c:\progra~1\COMMON~1\ULEADS~1\Vio\Dvacm.acm
"msacm.MPEGacm"= c:\progra~1\COMMON~1\ULEADS~1\MPEG\MPEGacm.acm
"msacm.ulmp3acm"= c:\progra~1\COMMON~1\ULEADS~1\MPEG\ulmp3acm.acm
"midi2"= RDDV1045.DLL

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"Bonjour Service"=2 (0x2)

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify"=dword:00000001
"AntiVirusOverride"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Autodesk\\3dsMax8\\3dsmax.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Autodesk\\backburner\\monitor.exe"=
"c:\\Program Files\\Autodesk\\backburner\\manager.exe"=
"c:\\Program Files\\Autodesk\\backburner\\server.exe"=
"c:\\WINDOWS\\system32\\wscntfy.exe"=
"c:\\Program Files\\Autodesk\\3dsMax8\\VRLServer.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"c:\\WINDOWS\\system32\\ZoneLabs\\avsys\\ScanningProcess.exe"=

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2009-01-08 97928]
R3 CLEDX;Team H2O CLEDX service;c:\windows\system32\drivers\cledx.sys [2008-09-20 33792]
R3 hypaudio;hypaudio;c:\windows\system32\drivers\hypaudio.sys [2006-04-28 1162424]
R3 hypkern;hypkern;c:\windows\system32\drivers\hypkern.sys [2006-04-28 260553]
R4 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2009-01-08 231704]
S3 AlphaTrack;AlphaTrack Driver;c:\windows\system32\drivers\AlphaTrack.sys [2008-12-26 78848]
S3 AlphaTrackWdmService;AlphaTrack Wdm Audio;c:\windows\system32\drivers\AlphaTrackWdm.sys [2008-12-26 34816]
S3 MSSQL$SONY_MEDIAMGR2;SQL Server (SONY_MEDIAMGR2);c:\program files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2007-02-10 29178224]
S3 RDID1045;Roland FANTOM-X;c:\windows\system32\drivers\RDWM1045.SYS [2004-01-20 59642]
S3 sdAuxService;PC Tools Auxiliary Service;c:\program files\Spyware Doctor\pctsAuxs.exe [2008-08-05 747912]
.
Contents of the 'Scheduled Tasks' folder

2009-01-23 c:\windows\Tasks\Norton Security Scan.job
- c:\program files\Norton Security Scan\Nss.exe [2007-09-18 22:42]

2009-01-26 c:\windows\Tasks\vtuwtczi.job
- c:\windows\system32\hgGwVPHB.dll []
.
- - - - ORPHANS REMOVED - - - -

MSConfigStartUp-80d2366c - c:\windows\system32\kusawezu.dll
MSConfigStartUp-CPM83e105f0 - c:\windows\system32\tifiganu.dll
MSConfigStartUp-jajemezate - c:\windows\system32\sedutodo.dll


.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-01-26 12:37:26
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'lsass.exe'(808)
c:\windows\system32\RDDV1045.DLL
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
c:\windows\system32\drivers\CDAC11BA.EXE
c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Autodesk\3dsMax8\mentalray\satellite\raysat_3dsmax8server.exe
c:\windows\system32\nvsvc32.exe
c:\program files\Microsoft SQL Server\90\Shared\sqlwriter.exe
c:\program files\AVG\AVG8\avgrsx.exe
c:\windows\system32\StkASv2K.exe
c:\program files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
c:\program files\RealVNC\VNC4\winvnc4.exe
c:\windows\system32\rundll32.exe
c:\program files\Creative Professional\E-MU PatchMix DSP\EmuPatchMixDSP.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2009-01-26 12:40:14 - machine was rebooted [Matt]
ComboFix-quarantined-files.txt 2009-01-26 12:40:12

Pre-Run: 207,655,583,744 bytes free
Post-Run: 208,105,148,416 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

209 --- E O F --- 2009-01-14 11:26:26

[Bewdy]

as an addition to the last post it would seem that troja fastscan is still detecting a hidden file:

hgGwVPHB.dll in my system32 directory.

hope this info helps.

[TheBruce1]

Hello again Matt

AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated)
AV: ZoneAlarm Security Suite Antivirus *On-access scanning disabled* (Updated)

You have two antivirus programs installed, having two such programs installed on the same machine can cause problems.

Don’t install more than one anti-virus. They may conflict, and will provide less protection, not more.

The longer, technically correct answer. Yes, it is possible in most cases to install more than one anti-virus. Provided that only one real-time scanner is active at a time, and the others are used only to scan on demand. However, pre-Windows Vista, all anti-virus programs made changes to the Windows kernel. Or, the very core of the operating system. One application doesn’t know what changes the other has made, and they are likely trying to affect the same code. This can lead to system slow-downs, instability, and crashes. Or even the loss of all anti-virus protection.

Keep it simple. Chose one anti-virus that you like, and stick with it.

http://www.whatthetech.com/2007/10/2...ne-anti-virus/

========

Open notepad and copy/paste the text in the quotebox below into it:

File::
c:\windows\Tasks\Norton Security Scan.job
c:\windows\Tasks\vtuwtczi.job
c:\windows\system32\hgGwVPHB.dll

Folder::
c:\program files\Norton Security Scan

Save this as CFscript







Refering to the picture above, drag CFscript into ComboFix.exe

Follow the prompts, and post the resulting log, C:\ComboFix.txt

Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.


Warning:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall

=========

Download ATF-Cleaner by Atribune to your desktop.

Double-click ATF Cleaner.exe to open it

Under Main choose:
Windows Temp
Current User Temp
All Users Temp
Cookies
Temporary Internet Files
Prefetch
Java Cache
*The other boxes are optional*
Then click the Empty Selected button.

If you have Firefox installed:
Click Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click NO at the prompt.

If you have Opera installed:
Click Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click NO at the prompt.

Click Exit on the Main menu to close the program.

========

Establish an internet connection & perform an online scan with Internet Explorer at Kaspersky Online Scanner

Click Accept, when prompted to download and install the program files and database of malware definitions.

• Click Run at the Security prompt.
• The program will then begin downloading and installing and will also update the database.
• Please be patient as this can take several minutes.
• Once the update is complete, click on My Computer under the green Scan bar to the left to start the scan.
• Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
• Do NOT be alarmed by what you see in the report. Many of the finds have likely been quarantined.
• Click View scan report at the bottom.
• Click the Save Report As... button.
• Click the Save as Text button to save the file to your desktop so that you may post it in your next reply.

**Note**

This animation will guide you through the process:




To optimize scanning time and produce a more sensible report for review:

• Close any open programs.
• Turn off the real-time scanner of all antivirus or antispyware programs while performing the online scan.

Note for Internet Explorer 7 users: If at any time you have trouble viewing the accept button of the license, click on the Zoom tool located at the bottom right of the IE window and set the zoom to 75%. Once the license is accepted, reset to 100%.

==========
Logs Required
C:\Combofix.txt
Kaspersky Scan Report

How is your system running now.

[Bewdy]

Hi Bruce, I've run the commands you suggested. I've stopped Zone Alarm being a secondary anti virus also as you have suggested, so just AVG doing that job now.

I've run the Trojan FastScan and all seems clean now, so that's an enormous relief. I've attached the logs of the Combofix and Kasperky in case you think that they still need reviewing.

But I'm hoping that is it. So many thanks for your help and guidance, I'm extremely grateful, you've saved me from a reformat.

Matt


--------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER 7 REPORT
Monday, January 26, 2009
Operating System: Microsoft Windows XP Professional Service Pack 3 (build 2600)
Kaspersky Online Scanner 7 version: 7.0.25.0
Program database last update: Monday, January 26, 2009 11:29:58
Records in database: 1698001
--------------------------------------------------------------------------------

Scan settings:
Scan using the following database: extended
Scan archives: yes
Scan mail databases: yes

Scan area - My Computer:
A:\
C:\
D:\
F:\
L:\
M:\

Scan statistics:
Files scanned: 219711
Threat name: 1
Infected objects: 7
Suspicious objects: 0
Duration of the scan: 05:07:17


File name / Threat name / Threats count
C:\Program Files\RealVNC\VNC4\WinVNC4.exe/C:\Program Files\RealVNC\VNC4\WinVNC4.exe Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.4 1
C:\Program Files\RealVNC\VNC4\vncconfig.exe Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.4 1
C:\Program Files\RealVNC\VNC4\vncviewer.exe Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.4 1
C:\Program Files\RealVNC\VNC4\winvnc4.exe Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.4 1
L:\Drivers\System\vnc-4_1_2-x86_win32.exe Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.4 3

The selected area was scanned.


----------------------------------------------
ComboFix 09-01-21.04 - Matt 2009-01-26 13:27:47.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3071.2600 [GMT 0:00]
Running from: c:\documents and settings\Matt\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Matt\Desktop\CFscript.txt
AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated)
AV: ZoneAlarm Security Suite Antivirus *On-access scanning disabled* (Updated)
FW: ZoneAlarm Security Suite Firewall *disabled*
* Created a new restore point

FILE ::
c:\windows\system32\hgGwVPHB.dll
c:\windows\Tasks\Norton Security Scan.job
c:\windows\Tasks\vtuwtczi.job
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\Norton Security Scan
c:\program files\Norton Security Scan\ccL70U.dll
c:\program files\Norton Security Scan\ccScanw.dll
c:\program files\Norton Security Scan\ccVrTrst.dll
c:\program files\Norton Security Scan\dec_abi.dll
c:\program files\Norton Security Scan\DefUtDCD.dll
c:\program files\Norton Security Scan\ecmldr32.dll
c:\program files\Norton Security Scan\help.htm
c:\program files\Norton Security Scan\Microsoft.VC80.CRT.manifest
c:\program files\Norton Security Scan\msl.dll
c:\program files\Norton Security Scan\msvcp80.dll
c:\program files\Norton Security Scan\msvcr80.dll
c:\program files\Norton Security Scan\Nss.exe
c:\program files\Norton Security Scan\patch25d.dll
c:\program files\Norton Security Scan\SAUpdt.dll
c:\program files\Norton Security Scan\ScanCore.dll
c:\program files\Norton Security Scan\ScanRes.dll
c:\program files\Norton Security Scan\SKURes.dll
c:\windows\Tasks\Norton Security Scan.job
c:\windows\Tasks\vtuwtczi.job

.
((((((((((((((((((((((((( Files Created from 2008-12-26 to 2009-01-26 )))))))))))))))))))))))))))))))
.

2009-01-19 13:21 . 2009-01-19 13:21 <DIR> d-------- c:\windows\Sun
2009-01-19 13:21 . 2009-01-19 13:21 <DIR> d-------- c:\program files\Java
2009-01-19 13:21 . 2009-01-19 13:21 410,984 --a------ c:\windows\system32\deploytk.dll
2009-01-19 13:21 . 2009-01-19 13:21 73,728 --a------ c:\windows\system32\javacpl.cpl
2009-01-18 08:45 . 2009-01-18 08:46 <DIR> d-------- c:\documents and settings\Matt\Application Data\Sibelius Software
2009-01-18 08:45 . 2009-01-18 08:45 <DIR> d-------- c:\documents and settings\All Users\Application Data\Sibelius Software
2009-01-18 08:45 . 2009-01-18 08:45 604 --ah----- c:\windows\T4
2009-01-18 08:45 . 2009-01-18 08:45 604 --ah----- c:\windows\system32\T3
2009-01-18 08:43 . 2009-01-18 08:43 <DIR> d-------- c:\program files\Sibelius Software
2009-01-16 08:12 . 2009-01-16 08:17 250 --a------ c:\windows\gmer.ini
2009-01-09 09:27 . 2009-01-09 09:28 <DIR> d-------- c:\program files\Trojan Remover
2009-01-09 09:27 . 2009-01-09 09:27 <DIR> d-------- c:\documents and settings\Matt\Application Data\Simply Super Software
2009-01-09 09:27 . 2009-01-09 09:27 <DIR> d-------- c:\documents and settings\All Users\Application Data\Simply Super Software
2009-01-09 09:27 . 2006-05-25 14:52 162,304 --a------ c:\windows\system32\ztvunrar36.dll
2009-01-09 09:27 . 2003-02-02 19:06 153,088 --a------ c:\windows\system32\UNRAR3.dll
2009-01-09 09:27 . 2005-08-26 00:50 77,312 --a------ c:\windows\system32\ztvunace26.dll
2009-01-09 09:27 . 2002-03-06 00:00 75,264 --a------ c:\windows\system32\unacev2.dll
2009-01-09 09:27 . 2006-06-19 12:01 69,632 --a------ c:\windows\system32\ztvcabinet.dll
2009-01-09 09:10 . 2008-10-16 20:38 6,066,176 -----c--- c:\windows\system32\dllcache\ieframe.dll
2009-01-09 09:10 . 2007-04-17 09:32 2,455,488 -----c--- c:\windows\system32\dllcache\ieapfltr.dat
2009-01-09 09:10 . 2007-03-08 05:10 991,232 -----c--- c:\windows\system32\dllcache\ieframe.dll.mui
2009-01-09 09:10 . 2008-10-16 20:38 459,264 -----c--- c:\windows\system32\dllcache\msfeeds.dll
2009-01-09 09:10 . 2008-10-16 20:38 383,488 -----c--- c:\windows\system32\dllcache\ieapfltr.dll
2009-01-09 09:10 . 2008-10-16 20:38 267,776 -----c--- c:\windows\system32\dllcache\iertutil.dll
2009-01-09 09:10 . 2008-10-16 20:38 63,488 -----c--- c:\windows\system32\dllcache\icardie.dll
2009-01-09 09:10 . 2008-10-16 20:38 52,224 -----c--- c:\windows\system32\dllcache\msfeedsbs.dll
2009-01-09 09:10 . 2008-10-16 13:11 13,824 -----c--- c:\windows\system32\dllcache\ieudinit.exe
2009-01-08 08:45 . 2009-01-16 22:29 <DIR> d--h----- C:\$AVG8.VAULT$
2009-01-08 08:41 . 2009-01-26 12:45 <DIR> d-------- c:\windows\system32\drivers\Avg
2009-01-08 08:41 . 2009-01-08 08:41 <DIR> d-------- c:\program files\AVG
2009-01-08 08:41 . 2009-01-08 08:41 <DIR> d-------- c:\documents and settings\All Users\Application Data\avg8
2009-01-08 08:41 . 2009-01-08 08:41 97,928 --a------ c:\windows\system32\drivers\avgldx86.sys
2009-01-08 08:41 . 2009-01-08 08:41 10,520 --a------ c:\windows\system32\avgrsstx.dll
2008-12-26 10:17 . 2008-12-26 10:17 <DIR> d-------- c:\program files\AlphaTrack
2008-12-26 10:17 . 2006-12-18 20:35 413,696 --a------ c:\windows\system32\AlphaTrackApplet.exe
2008-12-26 10:17 . 2007-02-21 11:00 78,848 --a------ c:\windows\system32\drivers\AlphaTrack.sys
2008-12-26 10:17 . 2006-12-18 17:40 49,152 --a------ c:\windows\system32\StartAlphaTrackApplet.exe
2008-12-26 10:17 . 2006-12-18 16:15 34,816 --a------ c:\windows\system32\drivers\AlphaTrackWdm.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-01-26 13:28 20,699,424 --sha-w c:\windows\system32\drivers\fidbox.dat
2009-01-26 12:34 282,272 --sha-w c:\windows\system32\drivers\fidbox.idx
2009-01-26 12:11 --------- d-----w c:\documents and settings\All Users\Application Data\Google Updater
2009-01-22 11:30 --------- d-----w c:\program files\Google
2009-01-20 07:25 5,151,121 ----a-w c:\windows\Internet Logs\tvDebug.zip
2009-01-18 08:45 604 ---ha-w c:\program files\STLL Notifier
2009-01-16 15:01 --------- d-----w c:\program files\Common Files\Symantec Shared
2009-01-16 08:13 1,668,608 ----a-w c:\windows\Internet Logs\xDB1.tmp
2009-01-13 17:07 --------- d---a-w c:\documents and settings\All Users\Application Data\TEMP
2009-01-09 08:43 --------- d-----w c:\program files\Spyware Doctor
2008-12-23 15:33 --------- d-----w c:\program files\Comodo
2008-12-11 10:57 333,952 ----a-w c:\windows\system32\drivers\srv.sys
2008-12-09 18:52 188,416 ----a-w c:\windows\Internet Logs\xDBE.tmp
2008-12-02 18:52 1,489,408 ----a-w c:\windows\Internet Logs\xDBBD.tmp
.

((((((((((((((((((((((((((((( snapshot@2009-01-26_12.39.44.41 )))))))))))))))))))))))))))))))))))))))))
.
- 2009-01-26 12:37:02 853,928 ----a-w c:\windows\system32\ZoneLabs\avsys\bases\sfdb.dat
+ 2009-01-26 13:26:30 854,320 ----a-w c:\windows\system32\ZoneLabs\avsys\bases\sfdb.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"SetDefaultMIDI"="MIDIDef.exe" [2005-10-22 c:\windows\MIDIDEF.EXE]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-09-17 8491008]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-09-17 81920]
"PDUiP6700DMon"="c:\program files\Canon\Memory Card Utility\iP6700D\PDUiP6700DMon.exe" [2006-10-03 75376]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-09-06 413696]
"UVS10 Preload"="c:\program files\Ulead Systems\Ulead VideoStudio SE DVD\uvPL.exe" [2006-08-09 36864]
"H2O"="c:\program files\SyncroSoft\Pos\H2O\cledx.exe" [2005-10-22 385024]
"ZoneAlarm Client"="c:\program files\Zone Labs\ZoneAlarm\zlclient.exe" [2008-07-09 919016]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-01-08 1261336]
"TrojanScanner"="c:\program files\Trojan Remover\Trjscan.exe" [2008-12-10 1230728]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-01-19 136600]
"nwiz"="nwiz.exe" [2007-09-17 c:\windows\system32\nwiz.exe]
"RTHDCPL"="RTHDCPL.EXE" [2006-12-19 c:\windows\RTHDCPL.EXE]
"SkyTel"="SkyTel.EXE" [2006-05-16 c:\windows\SkyTel.exe]
"CTHelper"="CTHELPER.EXE" [2005-10-22 c:\windows\CTHELPER.EXE]
"StartAlphaTrackApplet"="AlphaTrackApplet.exe" [2006-12-18 c:\windows\system32\AlphaTrackApplet.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\Matt\Start Menu\Programs\Startup\
Shortcut to VRLServer.exe.lnk - c:\program files\Autodesk\3dsMax8\VRLServer.exe [2008-08-06 245760]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
manager.lnk - c:\program files\Autodesk\backburner\manager.exe [2006-03-16 110592]
server.lnk - c:\program files\Autodesk\backburner\server.exe [2006-03-16 110592]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.dvacm"= c:\progra~1\COMMON~1\ULEADS~1\Vio\Dvacm.acm
"msacm.MPEGacm"= c:\progra~1\COMMON~1\ULEADS~1\MPEG\MPEGacm.acm
"msacm.ulmp3acm"= c:\progra~1\COMMON~1\ULEADS~1\MPEG\ulmp3acm.acm
"midi2"= RDDV1045.DLL

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"Bonjour Service"=2 (0x2)

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify"=dword:00000001
"AntiVirusOverride"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Autodesk\\3dsMax8\\3dsmax.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Autodesk\\backburner\\monitor.exe"=
"c:\\Program Files\\Autodesk\\backburner\\manager.exe"=
"c:\\Program Files\\Autodesk\\backburner\\server.exe"=
"c:\\WINDOWS\\system32\\wscntfy.exe"=
"c:\\Program Files\\Autodesk\\3dsMax8\\VRLServer.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"c:\\WINDOWS\\system32\\ZoneLabs\\avsys\\ScanningProcess.exe"=

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2009-01-08 97928]
R3 CLEDX;Team H2O CLEDX service;c:\windows\system32\drivers\cledx.sys [2008-09-20 33792]
R3 hypaudio;hypaudio;c:\windows\system32\drivers\hypaudio.sys [2006-04-28 1162424]
R3 hypkern;hypkern;c:\windows\system32\drivers\hypkern.sys [2006-04-28 260553]
R4 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2009-01-08 231704]
S3 AlphaTrack;AlphaTrack Driver;c:\windows\system32\drivers\AlphaTrack.sys [2008-12-26 78848]
S3 AlphaTrackWdmService;AlphaTrack Wdm Audio;c:\windows\system32\drivers\AlphaTrackWdm.sys [2008-12-26 34816]
S3 MSSQL$SONY_MEDIAMGR2;SQL Server (SONY_MEDIAMGR2);c:\program files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2007-02-10 29178224]
S3 RDID1045;Roland FANTOM-X;c:\windows\system32\drivers\RDWM1045.SYS [2004-01-20 59642]
S3 sdAuxService;PC Tools Auxiliary Service;c:\program files\Spyware Doctor\pctsAuxs.exe [2008-08-05 747912]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-01-26 13:28:48
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'lsass.exe'(808)
c:\windows\system32\RDDV1045.DLL
.
Completion time: 2009-01-26 13:30:03
ComboFix-quarantined-files.txt 2009-01-26 13:29:59

Pre-Run: 208,121,786,368 bytes free
Post-Run: 208,099,581,952 bytes free

194 --- E O F --- 2009-01-14 11:26:26

------------------------------------------------------

[TheBruce1]

Hi Matt

I would recommend that you only have one antivirus installed, as you have already seen, two antivirus programs installed does not offer double the protection.

If there are no further issues, continue below.

=========

Delete DDS from your desktop.

Click Start>Run and type or copy/paste the following command then hit enter to uninstall gmer.

%systemroot%\gmer_uninstall.cmd

You can keep ATF-Cleaner if you wish, otherwise delete from desktop.

============

Well done, your logs are clean.

Click start>run>type(or copy/paste command into run box):

ComboFix /u

Click ok.

=============

Clear IE7 cookies

*On the Internet Explorer 7 Tools menu, click Internet Options. The Internet Options box should open to the General tab.
*On the General tab, in the Browsing History, click the Delete button. This will delete all the files that are currently stored in your cache [that includes cookies too].
*Click OK, and then click OK again.


Clear Firefox cookies/cache

• Select "Tools"
• Select "Options".
• Select "Privacy".
• In "Settings" window put the check mark for Cookies,Cache,Browsing history and any others you want.
• Click OK.
• In Private area click "Clear Now".

-------------------------------------------------------------------------------------------

MICROSOFT UPDATES

1.Click Start,Run, type sysdm.cpl, and then press OK.
2.Click the Automatic Updates tab, and then click to select one of the following options. We recommend that you select the Automatic (recommended).

Microsoft updates are released every second Tuesday of each month,what is called "Patch Tuesday".

------------------------------------------------------------------------------------------

Useful Information and Programs to keep you safe.

TrendProtect is a FREE browser plug-in that helps you avoid Web pages with unwanted content and hidden threats. TrendProtect rates the current page and pages listed in Google, MSN, and Yahoo search results. You can use the rating to decide if you want to visit or avoid a given Web page. To rate Web pages, TrendProtect refers to an extensive database that covers the following information for billions of Web pages:

* Content category
* Phishing scam detection
* Site reputation
* Page reputation

WOT Free helps you avoid disingenuous Internet content by allowing you to learn from others' experiences. WOT shows you website reputations on your browser, telling you how much other users trust a website. This helps you make better decisions while browsing and avoid phishing, malware, and other types of fraud. Reputations can also be added to web search results, Gmail, Wikipedia, and other selected sites.

WOT reputations are computed mainly from user testimonies. Sharing your knowledge with others is just a click away, without ever having to leave the site. We also collect data from hundreds of other sources (including PhishTank) to quickly warn you of emerging threats. Currently, WOT knows over 12 million websites.
Note:Only compatible with Firefox 1.5 and higher.

--------------------------------------------------------------------------------------

Alternate Browsers
Try the following free alternate browsers rather than Internet Explorer
Avant
Firefox
Opera
K-Meleon

------------------------------------------------------------------------------------------

Free Antispyware Products
SuperAntiSpyware
Malwarebytes ' Anti-Malware

SpywareBlaster to help prevent spyware from installing in the first place.

• Install & update SpywareBlaster with the latest definitions.
  After you have updated, click the button - enable protection for all unprotected items

------------------------------------------------------------------

The MVPS Hosts file replaces your current HOSTS file with one that will restrict known ad sites from serving you unsolicited advertisements. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is the IP of your local computer. Note that if you use a company provided HOSTS file you should not use the MVPS HOSTS file.

If your having trouble downloading & extracting,see link below for guidance:
http://www.mvps.org/winhelp2002/hosts2.htm

Once you have extracted the host file,double click on it and a new window will open.

Double-click on mvps.batand follow the prompts

---------------------------------------------------------------

Winpatrol - Download and install the free version of Winpatrol. A tutorial for this product is located here:
Using Winpatrol to protect your computer.

----------------------------------------

SnoopFree is a programme that informs you when another programme is wanting to log your keystrokes or read your screen.Only for XP users.

Update all these programs regularly. Without regular updates you will not be protected when new malicious programs are released.

==============================================

Secunia PSI is a programme that will alert you to vulnerabilities and outdated programs you have installed, such as Java, Flash Player and many more.

It can also alert you if you have not installed the latest patches from Microsoft.

==============================================

Also, please take a look at this well written article:

PC Safety and Security--What Do I Need?

**Be very wary with any security software that is advertised in popups or in other ways. They are not only usually of no use, but often have malware in them.

Please reply to this thread once more, as we may mark this as resolved, thanks.

[Bewdy]

This issue looks like it's resolved now.

Thanks again for all you help.

Kind Regards

Matt

[TheBruce1]

You`re welcome Matt, surf safely