"warning: Spyware detected…" 'ahtn.html' is now my background

[JustBiteMe2k]

I was recently the victim of a virus/spyware/trojan (probably all 3!) programme which did a number of obvious things:

1. Changed my background to a black screen with "warning: Spyware detected…" 'ahtn.html' is now my background.
2. Caused me to receive warning messages every few minutes, pretending to have run a scan on the computer (little red "X" next to the clock)
3. Took me to an internet page to download some virus fixing software (don't worry I didn't do anything [else] stupid like downloading it).
4. Disabled Task Manager
5. Keeps disabling resident scan on Avast
6. Probably much more...

Since the malicious software installed itself I have disabled my network card; rebooted the machine to 'safe mode without networking' and performed a quick and (now doing) thorough scan of all hard drives using Avast (should be up to date since it's always telling me it's done a database update). Although it claims to have found a series of Trojans I am not convinced it's on top of things and haven't ventured back into 'Normal Windows' or onto the www yet.

Also; I have a number of hard drives installed into this system... the avast scan is taking an age since it goes through them all... am I best going inside the box and disconnecting them before starting this? I suppose the query is if the malicious software moves between drives or just stays on my main C-drive.


Thank you in advance for your advice; I've read a number of posts from this board and everybody seems very helpful... I'm hoping to tap into this helpful knowledge and fix my PC (then kill my son for infecting! )



Anyway; here is the DDS file.. GMER didn't find anything apparently so the log file was empty... i have attched the attach.txt file still though.


DDS (Ver_09-03-16.01) - NTFSx86 MINIMAL
Run by craig at 16:41:14.85 on 27/03/2009
Internet Explorer: 7.0.5730.13 BrowserJavaVersion: 1.6.0_12
Microsoft Windows XP Professional 5.1.2600.3.1252.44.1033.18.2943.2598 [GMT 0:00]

AV: avast! antivirus 4.8.1335 [VPS 090325-0] *On-access scanning enabled* (Updated)

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\system32\svchost.exe -k netsvcs
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Documents and Settings\craig\Desktop\Virus USB\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.google.co.uk/
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [PC Suite Tray] "c:\program files\nokia\nokia pc suite 7\PCSuite.exe" -onlytray
uRun: [BitTorrent DNA] "c:\program files\dna\btdna.exe"
uRun: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "c:\program files\common files\ahead\lib\NMBgMonitor.exe"
uRun: [kdx] c:\program files\kontiki\KHost.exe -all
uRun: [12ZFG94-F641-2SF-K31P-5N1ER6H6L2] c:\recycler\s-1-5-21-7346886814-5297849556-539086520-4767\service.exe
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [nwiz] nwiz.exe /install
mRun: [HDAudDeck] c:\program files\via\viaudioi\hdadeck\HDeck.exe 1
mRun: [avast!] c:\progra~1\alwils~1\avast4\ashDisp.exe
mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [NeroFilterCheck] c:\program files\common files\ahead\lib\NeroCheck.exe
mRun: [4oD] "c:\program files\kontiki\KHost.exe" -all
mRun: [GrooveMonitor] "c:\program files\microsoft office\office12\GrooveMonitor.exe"
mRun: [nmctxth] "c:\program files\common files\pure networks shared\platform\nmctxth.exe"
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
mRun: [boinctray] "c:\program files\boinc\boinctray.exe"
mRun: [boincmgr] "c:\program files\boinc\boincmgr.exe" /a /s
mRun: [Jrutateb] rundll32.exe "c:\windows\Ghehe.dll",e
mRun: [Framework Windows] frmwrk32.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\micron~1.lnk - c:\program files\micronet wireless network utility\RtWLan.exe
uPolicies-explorer: NoSetActiveDesktop = 1 (0x1)
uPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)
uPolicies-system: DisableTaskMgr = 1 (0x1)
mPolicies-explorer: NoSetActiveDesktop = 1 (0x1)
mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)
IE: E&xport to Microsoft Excel - c:\progra~1\micros~3\office12\EXCEL.EXE/3000
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~3\office12\ONBttnIE.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~3\office12\REFIEBAR.DLL
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1231616323030
DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1231616415108
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_12-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
DPF: {CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_12-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_12-windows-i586.cab
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\program files\microsoft office\office12\GrooveSystemServices.dll
Handler: pure-go - {4746C79A-2042-4332-8650-48966E44ABA8} - c:\program files\common files\pure networks shared\platform\puresp4.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\craig\applic~1\mozilla\firefox\profiles\eycnb79y.default\
FF - prefs.js: browser.search.selectedEngine - Wikipedia (en)
FF - prefs.js: browser.startup.homepage - hxxp://www.google.co.uk/
FF - component: c:\documents and settings\craig\application data\mozilla\firefox\profiles\eycnb79y.default\extensions\{a7c6cf7f-112c-4500-a7ea-39801a327e5f}\platform\winnt_x86-msvc\components\ipc.dll
FF - component: c:\program files\nokia\nokia pc suite 7\bkmrksync\components\BkMrkExt.dll
FF - plugin: c:\program files\microsoft\office live\npOLW.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npbittorrent.dll

============= SERVICES / DRIVERS ===============

S1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2009-1-10 114768]
S2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2009-1-10 20560]
S2 avast! Antivirus;avast! Antivirus;c:\program files\alwil software\avast4\ashServ.exe [2009-1-10 138680]
S2 BOINC;BOINC;c:\program files\boinc\boinc.exe [2008-11-17 443136]
S2 pnpcap;Pure Networks Packet Capture Driver;c:\windows\system32\drivers\pnpcap.sys [2009-2-26 23352]
S2 spupdsvc;Windows Service Pack Installer update service;c:\windows\system32\spupdsvc.exe [2009-1-10 26488]
S3 avast! Mail Scanner;avast! Mail Scanner;c:\program files\alwil software\avast4\ashMaiSv.exe [2009-1-10 254040]
S3 avast! Web Scanner;avast! Web Scanner;c:\program files\alwil software\avast4\ashWebSv.exe [2009-1-10 352920]
S3 SjyPkt;SjyPkt;c:\windows\system32\drivers\SjyPkt.sys [2009-1-10 13532]
S3 VIAHdAudAddService;VIA High Definition Audio Driver Service;c:\windows\system32\drivers\viahduaa.sys [2009-1-10 238080]

=============== Created Last 30 ================

2009-03-26 22:47 664 a------- c:\windows\system32\d3d9caps.dat
2009-03-26 21:27 4,785 a------- c:\windows\system32\warning.gif
2009-03-26 21:27 446 a------- c:\windows\system32\win32hlp.cnf
2009-03-26 21:26 88,428 a------- c:\windows\system32\drivers\609c547c.sys
2009-03-26 21:26 43,008 a------- C:\incsuuu.exe
2009-03-26 21:26 104,960 a------- c:\windows\system32\ntdll64.exe
2009-03-26 21:26 1 a------- c:\windows\system32\uniq.tll
2009-03-26 21:26 27,136 a------- c:\windows\system32\frmwrk32.exe
2009-03-26 21:26 27,136 a------- C:\ltpj.exe
2009-03-26 21:26 2 a------- C:\1285403231
2009-03-26 21:25 41,472 a------- c:\windows\Ghehe.dll
2009-03-26 21:25 41,472 a------- C:\sibqphb.exe
2009-03-26 21:23 9,216 a------- C:\dwm.exe
2009-03-25 19:23 142 a------- c:\windows\system32\spupdsvc.inf
2009-03-25 19:22 <DIR> --d----- c:\windows\LastGood.Tmp
2009-03-22 17:04 <DIR> --d----- c:\program files\QuickPar
2009-03-21 09:39 148,776 a------- c:\windows\system32\ImageDrive.cpl
2009-03-16 19:15 <DIR> --d----- c:\program files\BOINC
2009-03-16 19:15 <DIR> --d----- c:\docume~1\alluse~1\applic~1\BOINC
2009-03-10 21:20 73,728 a------- c:\windows\system32\javacpl.cpl
2009-02-26 20:30 23,352 a------- c:\windows\system32\drivers\pnpcap.sys
2009-02-26 20:29 <DIR> --d----- c:\program files\Pure Networks
2009-02-26 20:29 23,992 a------- c:\windows\system32\drivers\pnarp.sys
2009-02-26 20:29 25,272 a------- c:\windows\system32\drivers\purendis.sys
2009-02-26 20:29 <DIR> --d----- c:\program files\common files\Pure Networks Shared
2009-02-26 20:28 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Pure Networks
2009-02-26 14:19 221,184 a------- c:\windows\system32\wmpns.dll

==================== Find3M ====================

2009-03-26 21:26 104,960 a------- c:\windows\system32\userinit.exe
2009-03-10 21:20 410,984 a------- c:\windows\system32\deploytk.dll
2009-02-09 11:13 1,846,784 a------- c:\windows\system32\win32k.sys
2009-01-24 16:08 87,608 a------- c:\docume~1\craig\applic~1\inst.exe
2009-01-24 16:08 47,360 a------- c:\docume~1\craig\applic~1\pcouffin.sys
2009-01-10 18:58 86,327 a------- c:\windows\pchealth\helpctr\offlinecache\index.dat
2009-01-10 15:18 21,640 a------- c:\windows\system32\emptyregdb.dat
2009-01-09 17:46 1,614,848 a------- c:\windows\system32\sfcfiles.dll
2009-01-09 17:46 990,208 a------- c:\windows\system32\syssetup.dll

============= FINISH: 16:41:27.84 ===============

[JustBiteMe2k]

By the way; this is all being run from within 'Safe Mode without Networking'.
I have not read anywhere that this isn't ok so I hope it is.

Thanks for reading.

[JustBiteMe2k]

BUMP, please.

[TheBruce1]

Hello and welcome to TSF

Please subscribe to this thread to get immediate notification of replies as soon as they are posted. To do this click Thread Tools, then click Subscribe to this Thread. Make sure it is set to Instant Notification, then click Subscribe.

========

Please follow all instructions and in which order they come, if you have any questions, please ask before proceeding. Its important that you follow this through until i give you the all clear.

Please DO NOT Attach logs to your posts unless you are advised to do so.

=========

Please visit this webpage for download links, and instructions for running combofix:

http://www.bleepingcomputer.com/comb...o-use-combofix

* Ensure you have disabled all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Please include the C:\ComboFix.txt in your next reply for further review.

Please note that the forum is very busy and if I don't hear from you within three days this thread will be closed.

[JustBiteMe2k]

Firstly let me thank you in taking the time to reply.
Here is ComboFix log file as requested... I am still running in safe mode without networking but downloaded the Recovery Console... not installed it yet though.. should I still do this as described within the link you provided for ComboFix?
Also, as stated previously; I have additional hard drives... should I need to check or do anything with these as well?

---------------------------------------------------------------

ComboFix 09-03-26.03 - craig 2009-03-31 16:41:35.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2943.2287 [GMT 1:00]
Running from: c:\documents and settings\craig\Desktop\ComboFix.exe
AV: avast! antivirus 4.8.1335 [VPS 090325-0] *On-access scanning disabled* (Updated)
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat
C:\test.txt
c:\windows\system32\frmwrk32.exe
c:\windows\system32\ntdll64.exe
c:\windows\system32\uniq.tll
c:\windows\system32\warning.gif
c:\windows\system32\win32hlp.cnf

----- BITS: Possible infected sites -----

hxxp://stealingthemblind.com
.
((((((((((((((((((((((((( Files Created from 2009-02-28 to 2009-03-31 )))))))))))))))))))))))))))))))
.

2009-03-26 23:47 . 2009-03-26 23:49 664 --a------ c:\windows\system32\d3d9caps.dat
2009-03-26 22:26 . 2009-03-26 22:34 88,428 --a------ c:\windows\system32\drivers\609c547c.sys
2009-03-26 22:26 . 2009-03-26 22:26 43,008 --a------ C:\incsuuu.exe
2009-03-26 22:26 . 2009-03-26 22:26 27,136 --a------ C:\ltpj.exe
2009-03-26 22:26 . 2009-03-26 22:26 2 --a------ C:\1285403231
2009-03-26 22:25 . 2009-03-26 22:25 41,472 --a------ c:\windows\Ghehe.dll
2009-03-26 22:25 . 2009-03-26 22:25 41,472 --a------ C:\sibqphb.exe
2009-03-26 22:23 . 2009-03-26 22:24 9,216 --a------ C:\dwm.exe
2009-03-22 18:04 . 2009-03-23 00:12 <DIR> d-------- c:\program files\QuickPar
2009-03-21 10:39 . 2008-01-22 14:28 148,776 --a------ c:\windows\system32\ImageDrive.cpl
2009-03-16 20:17 . 2009-03-16 20:17 <DIR> d-------- c:\documents and settings\boinc_master
2009-03-16 20:15 . 2009-03-16 20:16 <DIR> d-------- c:\program files\BOINC
2009-03-16 20:15 . 2009-03-31 16:41 <DIR> d-------- c:\documents and settings\All Users\Application Data\BOINC
2009-03-10 22:20 . 2009-03-10 22:20 <DIR> d-------- c:\program files\Java
2009-03-10 22:20 . 2009-03-10 22:20 73,728 --a------ c:\windows\system32\javacpl.cpl
2009-02-26 21:30 . 2008-09-14 19:40 23,352 --a------ c:\windows\system32\drivers\pnpcap.sys
2009-02-26 21:29 . 2009-02-26 21:29 <DIR> d-------- c:\program files\Pure Networks
2009-02-26 21:29 . 2009-02-26 21:29 <DIR> d-------- c:\program files\Common Files\Pure Networks Shared
2009-02-26 21:29 . 2008-09-14 19:36 25,272 --a------ c:\windows\system32\drivers\purendis.sys
2009-02-26 21:29 . 2008-09-14 19:36 23,992 --a------ c:\windows\system32\drivers\pnarp.sys
2009-02-26 21:28 . 2009-02-26 21:30 <DIR> d-------- c:\documents and settings\All Users\Application Data\Pure Networks
2009-02-26 15:19 . 2008-04-14 04:42 221,184 --a------ c:\windows\system32\wmpns.dll
2009-02-15 21:02 . 2009-02-15 21:02 <DIR> d-------- c:\documents and settings\All Users\Application Data\vsosdk
2009-02-13 15:57 . 2009-02-13 15:57 <DIR> d-------- c:\windows\system32\XPSViewer
2009-02-13 15:57 . 2009-02-13 15:57 <DIR> d-------- c:\program files\Reference Assemblies
2009-02-13 15:57 . 2009-02-13 15:57 <DIR> d-------- C:\471263cc1180428f82fc6076e8d6b033
2009-02-13 15:57 . 2008-07-06 13:06 1,676,288 --------- c:\windows\system32\xpssvcs.dll
2009-02-13 15:57 . 2008-07-06 13:06 1,676,288 -----c--- c:\windows\system32\dllcache\xpssvcs.dll
2009-02-13 15:57 . 2008-07-06 11:50 597,504 -----c--- c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2009-02-13 15:57 . 2008-07-06 13:06 575,488 --------- c:\windows\system32\xpsshhdr.dll
2009-02-13 15:57 . 2008-07-06 13:06 575,488 -----c--- c:\windows\system32\dllcache\xpsshhdr.dll
2009-02-13 15:57 . 2008-07-06 13:06 117,760 --------- c:\windows\system32\prntvpt.dll
2009-02-13 15:57 . 2008-07-06 13:06 89,088 -----c--- c:\windows\system32\dllcache\filterpipelineprintproc.dll
2009-02-13 15:56 . 2009-02-14 16:19 <DIR> d-------- c:\windows\SxsCaPendDel
2009-02-13 15:53 . 2009-02-13 15:53 <DIR> d-------- c:\program files\Microsoft
2009-02-13 14:56 . 2006-10-26 20:56 32,592 --a------ c:\windows\system32\msonpmon.dll
2009-02-13 14:55 . 2009-02-13 14:55 <DIR> d-------- c:\program files\MSBuild
2009-02-13 14:55 . 2009-02-13 14:55 <DIR> d-------- c:\program files\Microsoft Works
2009-02-13 14:54 . 2009-02-13 14:54 <DIR> d-------- c:\program files\Microsoft.NET
2009-02-13 14:53 . 2009-02-13 14:53 <DIR> d-------- c:\program files\Microsoft Visual Studio 8
2009-02-13 14:52 . 2009-02-13 14:55 <DIR> d-------- c:\windows\SHELLNEW
2009-02-13 14:52 . 2009-02-13 14:52 <DIR> dr-h----- C:\MSOCache
2009-02-13 14:52 . 2009-03-11 09:39 <DIR> d-------- c:\documents and settings\All Users\Application Data\Microsoft Help

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-03-31 15:42 --------- d-----w c:\documents and settings\All Users\Application Data\Kontiki
2009-03-31 06:49 --------- d-----w c:\program files\DNA
2009-03-26 21:26 104,960 ----a-w c:\windows\system32\userinit.exe
2009-03-10 21:20 410,984 ----a-w c:\windows\system32\deploytk.dll
2009-02-26 12:27 --------- d-----w c:\program files\Microsoft Silverlight
2009-02-09 11:13 1,846,784 ----a-w c:\windows\system32\win32k.sys
2009-02-05 21:01 --------- d-----w c:\program files\eMule
2009-01-31 11:04 --------- d-----w c:\program files\QuickTime
2009-01-31 11:04 --------- d-----w c:\program files\DVD Ripper Platinum 5
2009-01-09 17:46 990,208 ----a-w c:\windows\system32\syssetup.dll
2009-01-09 17:46 1,614,848 ----a-w c:\windows\system32\sfcfiles.dll
2008-12-20 23:15 826,368 ----a-w c:\windows\system32\wininet.dll
2008-12-07 18:08 795,648 ----a-w c:\windows\system32\xvidcore.dll
2008-12-07 18:08 130,048 ----a-w c:\windows\system32\xvidvfw.dll
2008-12-05 06:54 144,896 ----a-w c:\windows\system32\schannel.dll
.

------- Sigcheck -------

2009-03-26 22:26 104960 2e1acb5bdfb74aa2fd04546802b76b5f c:\windows\system32\userinit.exe
2009-03-26 22:26 104960 2e1acb5bdfb74aa2fd04546802b76b5f c:\windows\system32\dllcache\userinit.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"PC Suite Tray"="c:\program files\Nokia\Nokia PC Suite 7\PCSuite.exe" [2008-12-03 1205760]
"BitTorrent DNA"="c:\program files\DNA\btdna.exe" [2009-01-12 342848]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2008-01-22 152872]
"kdx"="c:\program files\Kontiki\KHost.exe" [2007-04-23 1032640]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-09-18 13574144]
"HDAudDeck"="c:\program files\VIA\VIAudioi\HDADeck\HDeck.exe" [2008-05-14 29831168]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-02-05 81000]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-09-18 86016]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2008-05-28 570664]
"4oD"="c:\program files\Kontiki\KHost.exe" [2007-04-23 1032640]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2007-08-24 33648]
"nmctxth"="c:\program files\Common Files\Pure Networks Shared\Platform\nmctxth.exe" [2008-09-14 648488]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-10 148888]
"boinctray"="c:\program files\BOINC\boinctray.exe" [2008-11-17 58112]
"boincmgr"="c:\program files\BOINC\boincmgr.exe" [2008-11-17 3916544]
"Jrutateb"="c:\windows\Ghehe.dll" [2009-03-26 41472]
"nwiz"="nwiz.exe" [2008-09-18 c:\windows\system32\nwiz.exe]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Micronet Wireless Network Utility.lnk - c:\program files\Micronet Wireless Network Utility\RtWLan.exe [2009-01-10 675840]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\eMule\\emule.exe"=
"c:\\Program Files\\DNA\\btdna.exe"=
"c:\\Program Files\\BitTorrent\\bittorrent.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\java.exe"=
"c:\\Program Files\\TVersity\\Media Server\\MediaServer.exe"=
"c:\\Program Files\\Kontiki\\KService.exe"=
"c:\\Program Files\\Logitech\\Logitech Harmony Remote Software 7\\HarmonyRemote.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"67:UDP"= 67:UDP:DHCP Discovery Service

R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2009-01-10 114768]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2009-01-10 20560]
R2 BOINC;BOINC;c:\program files\BOINC\boinc.exe [2008-11-17 443136]
R2 pnpcap;Pure Networks Packet Capture Driver;c:\windows\system32\drivers\pnpcap.sys [2009-02-26 23352]
R3 SjyPkt;SjyPkt;c:\windows\system32\drivers\SjyPkt.sys [2009-01-10 13532]
R3 VIAHdAudAddService;VIA High Definition Audio Driver Service;c:\windows\system32\drivers\viahduaa.sys [2009-01-10 238080]
.
- - - - ORPHANS REMOVED - - - -

HKCU-Run-12ZFG94-F641-2SF-K31P-5N1ER6H6L2 - c:\recycler\S-1-5-21-7346886814-5297849556-539086520-4767\service.exe


.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.co.uk/
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\craig\Application Data\Mozilla\Firefox\Profiles\eycnb79y.default\
FF - prefs.js: browser.search.selectedEngine - Wikipedia (en)
FF - prefs.js: browser.startup.homepage - hxxp://www.google.co.uk/
FF - component: c:\documents and settings\craig\Application Data\Mozilla\Firefox\Profiles\eycnb79y.default\extensions\{a7c6cf7f-112c-4500-a7ea-39801a327e5f}\platform\WINNT_x86-msvc\components\ipc.dll
FF - component: c:\program files\Nokia\Nokia PC Suite 7\bkmrksync\components\BkMrkExt.dll
FF - plugin: c:\program files\Microsoft\Office Live\npOLW.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npbittorrent.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-03-31 16:42:28
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
HDAudDeck = c:\program files\VIA\VIAudioi\HDADeck\HDeck.exe 1????????????????????????????????????????????????

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2009-03-31 16:43:12
ComboFix-quarantined-files.txt 2009-03-31 15:43:10

Pre-Run: 484,212,658,176 bytes free
Post-Run: 484,395,487,232 bytes free

172 --- E O F --- 2009-03-25 18:22:13


Thank you!

[TheBruce1]

Hello again

I am still running in safe mode without networking but downloaded the Recovery Console... not installed it yet though.. should I still do this as described within the link you provided for ComboFix?

You should be able to run in normal mode. Please install the Recovery Console and when Combofix has finished installing the Recovery Console it will ask you if you wish to scan for malware, select No

Also, as stated previously; I have additional hard drives... should I need to check or do anything with these as well?

Are these external hard drives connected to the machine or are they partitions. If external hard drive please disconnect from machine, we can check them later.

Please run these instruction in normal mode.

========

P2P

P2P - I see you have P2P software (BitTorrent, DNA and eMule) installed on your machine. We are not here to pass judgment on file-sharing as a concept. However, we will warn you that engaging in this activity and having this kind of software installed on your machine will always make you more susceptible to re-infections. It may be contributing to your current situation. This page will give you further information.

Please note: Even if you are using a "safe" P2P program, it is only the program that is safe. You will be sharing files from uncertified sources, and these are often infected. The bad guys use P2P filesharing as a major conduit to spread their wares and their infections.

References for the risk of these programs are Here,
Here and Here.

==========

Open notepad and copy/paste the text in the quotebox below into it:

http://www.techsupportforum.com/security-center/virus-trojan-spyware-help/360622-warning-spyware-detected-ahtn-html-now-my-background.html

Collect::
C:\incsuuu.exe
C:\ltpj.exe
C:\1285403231
c:\windows\Ghehe.dll
C:\sibqphb.exe
C:\dwm.exe

File::
C:\1285403231

DirLook::
C:\471263cc1180428f82fc6076e8d6b033

Registry::
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Jrutateb"=-

Save this as CFscript







Refering to the picture above, drag CFscript into ComboFix.exe

Follow the prompts, and post the resulting log, C:\ComboFix.txt

Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.


Warning:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall


When CF finishes running, the ComboFix log will open along with a message box--do not be alarmed. With the above script, ComboFix will capture a file to submit for analysis.

Ensure you are connected to the internet and click OK. A browser will open. Simply follow the instructions to copy/paste/send the requested file(s).

=========

JAVA OUTDATED


Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update.

• Download the latest version of Java Runtime Environment (JRE) 6 and save it to your desktop.
• Scroll down to where it says "Java Runtime Environment (JRE) 6 Update 13. The Java SE Runtime Environment (JRE) allows end-users to run Java applications."
• Click the "Download" button to the right.
• Select the Windows platform from the dropdown menu.
• Read the License Agreement and then check the box that says: "Accept License Agreement". Click on Continue.The page will refresh.
• Click on the link to download Windows Offline Installation and save the file to your desktop.
• Close any programs you may have running - especially your web browser.
• Go to Start > Settings > Control Panel, double-click on Add/Remove Programs and remove all older versions of Java.
• Check (highlight) any item with Java Runtime Environment (JRE or J2SE) in the name.
• Click the Remove or Change/Remove button.
• Repeat as many times as necessary to remove each Java versions.
• Reboot your computer once all Java components are removed.
• Then from your desktop double-click on jre-6u13-windows-i586-p.exe to install the newest version.

• After the install is complete, go into the Control Panel (using Classic View) and double-click the Java Icon. (looks like a coffee cup)
  • On the General tab, under Temporary Internet Files, click the Settings button.
  • Next, click on the Delete Files button
  • There are two options in the window to clear the cache - Leave BOTH Checked
    • Applications and Applets
      Trace and Log Files
  • Click OK on Delete Temporary Files Window
    Note: This deletes ALL the Downloaded Applications and Applets from the CACHE.
  • Click OK to leave the Temporary Files Window
  • Click OK to leave the Java Control Panel.

==========

Download ATF-Cleaner by Atribune to your desktop.

Double-click ATF Cleaner.exe to open it

Under Main choose:
Windows Temp
Current User Temp
All Users Temp
Cookies
Temporary Internet Files
Prefetch
Java Cache
*The other boxes are optional*
Then click the Empty Selected button.

If you have Firefox installed:
Click Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click NO at the prompt.

If you have Opera installed:
Click Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click NO at the prompt.

Click Exit on the Main menu to close the program.

==========

Establish an internet connection & perform an online scan with Internet Explorer at Kaspersky Online Scanner

Click Accept, when prompted to download and install the program files and database of malware definitions.

• Click Run at the Security prompt.
• The program will then begin downloading and installing and will also update the database.
• Please be patient as this can take several minutes.
• Once the update is complete, click on My Computer under the green Scan bar to the left to start the scan.
• Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
• Do NOT be alarmed by what you see in the report. Many of the finds have likely been quarantined.
• Click View scan report at the bottom.
• Click the Save Report As... button.
• Click the Save as Text button to save the file to your desktop so that you may post it in your next reply.

**Note**

This animation will guide you through the process:




To optimize scanning time and produce a more sensible report for review:

• Close any open programs.
• Turn off the real-time scanner of all antivirus or antispyware programs while performing the online scan.

Note for Internet Explorer 7 users: If at any time you have trouble viewing the accept button of the license, click on the Zoom tool located at the bottom right of the IE window and set the zoom to 75%. Once the license is accepted, reset to 100%.

=========
Logs Required
C:\Combofix.txt
Kaspersky Scan Report

An update on how your system is running.

[JustBiteMe2k]

Edit... sorry, contrary to previous post; I am not running in Safe Mode... it's normal windows with the network adaptor disabled.

[TheBruce1]

Ok, make sure you are connected to the internet once Combofix finishes as it will be uploading some files.

[JustBiteMe2k]

Hi again Bruce,

Here are the logs you required.

COMBOFIX
-----------------------------------------------------------------------------
ComboFix 09-03-26.03 - craig 2009-03-31 19:39:23.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2943.2272 [GMT 1:00]
Running from: c:\documents and settings\craig\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\craig\Desktop\CFscript.txt
AV: avast! antivirus 4.8.1335 [VPS 090325-0] *On-access scanning disabled* (Updated)
* Created a new restore point

FILE ::
C:\1285403231
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\1285403231
C:\dwm.exe
C:\incsuuu.exe
C:\ltpj.exe
C:\sibqphb.exe
c:\windows\Ghehe.dll

Infected copy of c:\windows\system32\userinit.exe was found and disinfected
Restored copy from - c:\system volume information\_restore{D9F0983A-8F41-4AE4-90F7-4F0919EBAB15}\RP89\A0009506.exe

.
((((((((((((((((((((((((( Files Created from 2009-02-28 to 2009-03-31 )))))))))))))))))))))))))))))))
.

2009-03-26 23:47 . 2009-03-26 23:49 664 --a------ c:\windows\system32\d3d9caps.dat
2009-03-26 22:26 . 2009-03-26 22:34 88,428 --a------ c:\windows\system32\drivers\609c547c.sys
2009-03-22 18:04 . 2009-03-23 00:12 <DIR> d-------- c:\program files\QuickPar
2009-03-21 10:39 . 2008-01-22 14:28 148,776 --a------ c:\windows\system32\ImageDrive.cpl
2009-03-16 20:17 . 2009-03-16 20:17 <DIR> d-------- c:\documents and settings\boinc_master
2009-03-16 20:15 . 2009-03-16 20:16 <DIR> d-------- c:\program files\BOINC
2009-03-16 20:15 . 2009-03-31 19:45 <DIR> d-------- c:\documents and settings\All Users\Application Data\BOINC
2009-03-10 22:20 . 2009-03-10 22:20 <DIR> d-------- c:\program files\Java
2009-03-10 22:20 . 2009-03-10 22:20 73,728 --a------ c:\windows\system32\javacpl.cpl
2009-02-26 21:30 . 2008-09-14 19:40 23,352 --a------ c:\windows\system32\drivers\pnpcap.sys
2009-02-26 21:29 . 2009-02-26 21:29 <DIR> d-------- c:\program files\Pure Networks
2009-02-26 21:29 . 2009-02-26 21:29 <DIR> d-------- c:\program files\Common Files\Pure Networks Shared
2009-02-26 21:29 . 2008-09-14 19:36 25,272 --a------ c:\windows\system32\drivers\purendis.sys
2009-02-26 21:29 . 2008-09-14 19:36 23,992 --a------ c:\windows\system32\drivers\pnarp.sys
2009-02-26 21:28 . 2009-02-26 21:30 <DIR> d-------- c:\documents and settings\All Users\Application Data\Pure Networks
2009-02-26 15:19 . 2008-04-14 04:42 221,184 --a------ c:\windows\system32\wmpns.dll
2009-02-15 21:02 . 2009-02-15 21:02 <DIR> d-------- c:\documents and settings\All Users\Application Data\vsosdk
2009-02-13 15:57 . 2009-02-13 15:57 <DIR> d-------- c:\windows\system32\XPSViewer
2009-02-13 15:57 . 2009-02-13 15:57 <DIR> d-------- c:\program files\Reference Assemblies
2009-02-13 15:57 . 2009-02-13 15:57 <DIR> d-------- C:\471263cc1180428f82fc6076e8d6b033
2009-02-13 15:57 . 2008-07-06 13:06 1,676,288 --------- c:\windows\system32\xpssvcs.dll
2009-02-13 15:57 . 2008-07-06 13:06 1,676,288 -----c--- c:\windows\system32\dllcache\xpssvcs.dll
2009-02-13 15:57 . 2008-07-06 11:50 597,504 -----c--- c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2009-02-13 15:57 . 2008-07-06 13:06 575,488 --------- c:\windows\system32\xpsshhdr.dll
2009-02-13 15:57 . 2008-07-06 13:06 575,488 -----c--- c:\windows\system32\dllcache\xpsshhdr.dll
2009-02-13 15:57 . 2008-07-06 13:06 117,760 --------- c:\windows\system32\prntvpt.dll
2009-02-13 15:57 . 2008-07-06 13:06 89,088 -----c--- c:\windows\system32\dllcache\filterpipelineprintproc.dll
2009-02-13 15:56 . 2009-02-14 16:19 <DIR> d-------- c:\windows\SxsCaPendDel
2009-02-13 15:53 . 2009-02-13 15:53 <DIR> d-------- c:\program files\Microsoft
2009-02-13 14:56 . 2006-10-26 20:56 32,592 --a------ c:\windows\system32\msonpmon.dll
2009-02-13 14:55 . 2009-02-13 14:55 <DIR> d-------- c:\program files\MSBuild
2009-02-13 14:55 . 2009-02-13 14:55 <DIR> d-------- c:\program files\Microsoft Works
2009-02-13 14:54 . 2009-02-13 14:54 <DIR> d-------- c:\program files\Microsoft.NET
2009-02-13 14:53 . 2009-02-13 14:53 <DIR> d-------- c:\program files\Microsoft Visual Studio 8
2009-02-13 14:52 . 2009-02-13 14:55 <DIR> d-------- c:\windows\SHELLNEW
2009-02-13 14:52 . 2009-02-13 14:52 <DIR> dr-h----- C:\MSOCache
2009-02-13 14:52 . 2009-03-11 09:39 <DIR> d-------- c:\documents and settings\All Users\Application Data\Microsoft Help

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-03-31 18:45 --------- d-----w c:\documents and settings\All Users\Application Data\Kontiki
2009-03-31 18:43 --------- d-----w c:\program files\DNA
2009-02-26 12:27 --------- d-----w c:\program files\Microsoft Silverlight
2009-02-05 21:01 --------- d-----w c:\program files\eMule
2009-01-31 11:04 --------- d-----w c:\program files\QuickTime
2009-01-31 11:04 --------- d-----w c:\program files\DVD Ripper Platinum 5
.

(((((((((((((((((((((((((((((((((((((((((((( Look )))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.

---- Directory of C:\471263cc1180428f82fc6076e8d6b033 ----

2008-07-06 18:36 2936832 --------- c:\471263cc1180428f82fc6076e8d6b033\amd64\xpssvcs.dll
2008-07-06 13:06 89088 --------- c:\471263cc1180428f82fc6076e8d6b033\i386\filterpipelineprintproc.dll
2008-07-06 13:06 765440 --------- c:\471263cc1180428f82fc6076e8d6b033\i386\mxdwdrv.dll
2008-07-06 13:06 748032 --------- c:\471263cc1180428f82fc6076e8d6b033\amd64\mxdwdrv.dll
2008-07-06 13:06 1676288 --------- c:\471263cc1180428f82fc6076e8d6b033\i386\xpssvcs.dll
2008-07-06 13:06 147456 --------- c:\471263cc1180428f82fc6076e8d6b033\amd64\filterpipelineprintproc.dll
2008-07-06 13:06 10929 --------- c:\471263cc1180428f82fc6076e8d6b033\i386\msxpsdrv.cat
2008-07-06 13:06 10929 --------- c:\471263cc1180428f82fc6076e8d6b033\amd64\msxpsdrv.cat
2008-06-19 12:03 73 --------- c:\471263cc1180428f82fc6076e8d6b033\i386\msxpsinc.gpd
2008-06-19 12:03 73 --------- c:\471263cc1180428f82fc6076e8d6b033\amd64\msxpsinc.gpd
2008-06-19 06:33 72 --------- c:\471263cc1180428f82fc6076e8d6b033\i386\msxpsinc.ppd
2008-06-19 06:33 72 --------- c:\471263cc1180428f82fc6076e8d6b033\amd64\msxpsinc.ppd
2008-06-19 06:33 2204 --------- c:\471263cc1180428f82fc6076e8d6b033\i386\msxpsdrv.inf
2008-06-19 06:33 2204 --------- c:\471263cc1180428f82fc6076e8d6b033\amd64\msxpsdrv.inf


((((((((((((((((((((((((((((( SnapShot@2009-03-31_16.42.41.50 )))))))))))))))))))))))))))))))))))))))))
.
- 2009-03-26 21:26:51 104,960 ----a-w c:\windows\system32\userinit.exe
+ 2008-04-14 03:42:40 26,112 ----a-w c:\windows\system32\userinit.exe
+ 2009-03-31 18:43:14 16,384 ----atw c:\windows\Temp\Perflib_Perfdata_614.dat
+ 2009-03-31 18:43:24 16,384 ----atw c:\windows\Temp\Perflib_Perfdata_664.dat
+ 2009-03-31 18:43:35 16,384 ----atw c:\windows\Temp\Perflib_Perfdata_6ec.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"PC Suite Tray"="c:\program files\Nokia\Nokia PC Suite 7\PCSuite.exe" [2008-12-03 1205760]
"BitTorrent DNA"="c:\program files\DNA\btdna.exe" [2009-01-12 342848]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2008-01-22 152872]
"kdx"="c:\program files\Kontiki\KHost.exe" [2007-04-23 1032640]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-09-18 13574144]
"HDAudDeck"="c:\program files\VIA\VIAudioi\HDADeck\HDeck.exe" [2008-05-14 29831168]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-02-05 81000]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-09-18 86016]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2008-05-28 570664]
"4oD"="c:\program files\Kontiki\KHost.exe" [2007-04-23 1032640]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2007-08-24 33648]
"nmctxth"="c:\program files\Common Files\Pure Networks Shared\Platform\nmctxth.exe" [2008-09-14 648488]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-10 148888]
"boinctray"="c:\program files\BOINC\boinctray.exe" [2008-11-17 58112]
"boincmgr"="c:\program files\BOINC\boincmgr.exe" [2008-11-17 3916544]
"nwiz"="nwiz.exe" [2008-09-18 c:\windows\system32\nwiz.exe]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Micronet Wireless Network Utility.lnk - c:\program files\Micronet Wireless Network Utility\RtWLan.exe [2009-01-10 675840]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\eMule\\emule.exe"=
"c:\\Program Files\\DNA\\btdna.exe"=
"c:\\Program Files\\BitTorrent\\bittorrent.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\java.exe"=
"c:\\Program Files\\TVersity\\Media Server\\MediaServer.exe"=
"c:\\Program Files\\Kontiki\\KService.exe"=
"c:\\Program Files\\Logitech\\Logitech Harmony Remote Software 7\\HarmonyRemote.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"67:UDP"= 67:UDP:DHCP Discovery Service

R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2009-01-10 114768]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2009-01-10 20560]
R2 BOINC;BOINC;c:\program files\BOINC\boinc.exe [2008-11-17 443136]
R2 pnpcap;Pure Networks Packet Capture Driver;c:\windows\system32\drivers\pnpcap.sys [2009-02-26 23352]
R3 SjyPkt;SjyPkt;c:\windows\system32\drivers\SjyPkt.sys [2009-01-10 13532]
R3 VIAHdAudAddService;VIA High Definition Audio Driver Service;c:\windows\system32\drivers\viahduaa.sys [2009-01-10 238080]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.co.uk/
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\craig\Application Data\Mozilla\Firefox\Profiles\eycnb79y.default\
FF - prefs.js: browser.search.selectedEngine - Wikipedia (en)
FF - prefs.js: browser.startup.homepage - hxxp://www.google.co.uk/
FF - component: c:\documents and settings\craig\Application Data\Mozilla\Firefox\Profiles\eycnb79y.default\extensions\{a7c6cf7f-112c-4500-a7ea-39801a327e5f}\platform\WINNT_x86-msvc\components\ipc.dll
FF - component: c:\program files\Nokia\Nokia PC Suite 7\bkmrksync\components\BkMrkExt.dll
FF - plugin: c:\program files\Microsoft\Office Live\npOLW.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npbittorrent.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-03-31 19:45:37
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
HDAudDeck = c:\program files\VIA\VIAudioi\HDADeck\HDeck.exe 1????????????????????????????????????????????????

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Alwil Software\Avast4\aswUpdSv.exe
c:\program files\Alwil Software\Avast4\ashServ.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Kontiki\KService.exe
c:\windows\system32\nvsvc32.exe
c:\windows\system32\IoctlSvc.exe
c:\program files\TVersity\Media Server\MediaServer.exe
c:\program files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe
c:\windows\system32\rundll32.exe
c:\documents and settings\All Users\Application Data\BOINC\projects\http://www.worldcommunitygrid.org\wc...ndows_intelx86
c:\program files\Alwil Software\Avast4\ashMaiSv.exe
c:\program files\Alwil Software\Avast4\ashWebSv.exe
c:\program files\Common Files\Ahead\Lib\NMIndexingService.exe
c:\program files\PC Connectivity Solution\ServiceLayer.exe
c:\program files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
c:\program files\PC Connectivity Solution\Transports\NclUSBSrv.exe
c:\program files\PC Connectivity Solution\Transports\NclRSSrv.exe
c:\program files\Alwil Software\Avast4\Setup\avast.setup
.
**************************************************************************
.
Completion time: 2009-03-31 19:46:51 - machine was rebooted [craig]
ComboFix-quarantined-files.txt 2009-03-31 18:46:49
ComboFix2.txt 2009-03-31 15:43:13

Pre-Run: 484,375,711,744 bytes free
Post-Run: 484,364,398,592 bytes free

199 --- E O F --- 2009-03-25 18:22:13


KASPERSKY SCAN REPORT
----------------------------------------------------------------------------------
--------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER 7 REPORT
Wednesday, April 1, 2009
Operating System: Microsoft Windows XP Professional Service Pack 3 (build 2600)
Kaspersky Online Scanner 7 version: 7.0.25.0
Program database last update: Tuesday, March 31, 2009 20:43:33
Records in database: 1990208
--------------------------------------------------------------------------------

Scan settings:
Scan using the following database: extended
Scan archives: yes
Scan mail databases: yes

Scan area - My Computer:
C:\
D:\
E:\
F:\
G:\
H:\
I:\
J:\
K:\
L:\
M:\

Scan statistics:
Files scanned: 285856
Threat name: 4
Infected objects: 6
Suspicious objects: 0
Duration of the scan: 05:18:24


File name / Threat name / Threats count
C:\Qoobox\Quarantine\C\WINDOWS\system32\ntdll64.exe.vir Infected: Trojan-Dropper.Win32.Agent.akxv 1
C:\Qoobox\Quarantine\C\WINDOWS\system32\userinit.exe.vir Infected: Trojan-Dropper.Win32.Agent.akxv 1
C:\Qoobox\Quarantine\[4]-Submit_2009-03-31@19.39.zip Infected: Worm.Win32.AutoRun.fjo 1
C:\Qoobox\Quarantine\[4]-Submit_2009-03-31@19.39.zip Infected: Trojan.Win32.Agent.bxfd 1
C:\Qoobox\Quarantine\[4]-Submit_2009-03-31@19.39.zip Infected: Trojan.Win32.Agent.bxfu 1
C:\WINDOWS\system32\dllcache\userinit.exe Infected: Trojan-Dropper.Win32.Agent.akxv 1

The selected area was scanned.
-----------------------------------------------------------------------------------

It looks like I has loads of drives; but in reality there is a multi-card reader built into my monitor which accounts for most of them. I also followed through your other instructions... when going to Control Panel, Java, Update, Update Now it reports i have the latest version.

Thanks again for your help!

[TheBruce1]

Hello again

Please go to this website:

http://www.bleepingcomputer.com/subm....php?channel=4

Using the browse button- locate and upload this file:

C:\Qoobox\Quarantine\[4]-Submit_2009-03-31@19.39.zip

Include this link into your submission:

http://www.techsupportforum.com/security-center/virus-trojan-spyware-help/360622-warning-spyware-detected-ahtn-html-now-my-background.html

Let me know when you have uploaded the file.

[JustBiteMe2k]

Hi again,

File sent...

Thank you!

[TheBruce1]

Hello again

File uploaded, thank you.

=======

Open notepad and copy/paste the text in the quotebox below into it:

FCopy::
c:\windows\system32\userinit.exe | C:\WINDOWS\system32\dllcache\userinit.exe

Save this as CFscript







Refering to the picture above, drag CFscript into ComboFix.exe

Follow the prompts, and post the resulting log, C:\ComboFix.txt

Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.


Warning:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall

===========

Go to My Computer >Tools >Folder Options >View tab and select Show hidden files and folders. Uncheck the Hide protected operating system files (recommended) option. Also make sure there is no checkmark beside Hide file extensions for known file types. Click OK.

============

Please go to: VirusTotal

• In the middle of the page you'll find a "Browse" button.
  
  
  
  Click the "Browse" button and browse to this file in RED:
  
  C:\WINDOWS\system32\dllcache\userinit.exe
  
  
• Click "Open".
• Then click the "Send File" button at the bottom of the VirusTotal page.
• This will scan the file. Please be patient.
• Once scanned, copy and paste the results in your next reply.

========

Re-hide your hidden files once the Virustotal scan is completed.

=========
Logs Required
C:\Combofix.txt
VirusTotal Scan Results

[JustBiteMe2k]

Here is Combofix log 3
ComboFix 09-04-01.01 - craig 2009-04-01 21:39:46.3 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2943.2135 [GMT 1:00]
Running from: c:\documents and settings\craig\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\craig\Desktop\CFscript.txt
AV: avast! antivirus 4.8.1335 [VPS 090331-0] *On-access scanning disabled* (Updated)
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\craig\Application Data\inst.exe

.
--------------- FCopy ---------------

c:\windows\system32\userinit.exe --> c:\windows\system32\dllcache\userinit.exe
.
((((((((((((((((((((((((( Files Created from 2009-03-01 to 2009-04-01 )))))))))))))))))))))))))))))))
.

2009-03-26 23:47 . 2009-03-26 23:49 664 --a------ c:\windows\system32\d3d9caps.dat
2009-03-26 22:26 . 2009-03-26 22:34 88,428 --a------ c:\windows\system32\drivers\609c547c.sys
2009-03-22 18:04 . 2009-03-23 00:12 <DIR> d-------- c:\program files\QuickPar
2009-03-21 10:39 . 2008-01-22 14:28 148,776 --a------ c:\windows\system32\ImageDrive.cpl
2009-03-16 20:17 . 2009-03-16 20:17 <DIR> d-------- c:\documents and settings\boinc_master
2009-03-16 20:15 . 2009-03-16 20:16 <DIR> d-------- c:\program files\BOINC
2009-03-16 20:15 . 2009-04-01 21:40 <DIR> d-------- c:\documents and settings\All Users\Application Data\BOINC
2009-03-10 22:20 . 2009-03-31 19:50 <DIR> d-------- c:\program files\Java
2009-03-10 22:20 . 2009-03-09 02:53 73,728 --a------ c:\windows\system32\javacpl.cpl

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-04-01 20:40 --------- d-----w c:\documents and settings\All Users\Application Data\Kontiki
2009-04-01 20:36 --------- d-----w c:\documents and settings\craig\Application Data\DNA
2009-03-31 18:43 --------- d-----w c:\program files\DNA
2009-03-26 21:28 --------- d-----w c:\documents and settings\craig\Application Data\NewsBin
2009-03-24 23:09 --------- d-----w c:\documents and settings\craig\Application Data\Vso
2009-03-21 17:15 --------- d-----w c:\documents and settings\craig\Application Data\Ahead
2009-03-21 14:42 --------- d-----w c:\documents and settings\craig\Application Data\BitTorrent
2009-03-21 09:50 --------- d-----w c:\documents and settings\craig\Application Data\dvdcss
2009-03-11 08:39 --------- d-----w c:\documents and settings\All Users\Application Data\Microsoft Help
2009-03-09 04:19 410,984 ----a-w c:\windows\system32\deploytk.dll
2009-02-26 20:30 --------- d-----w c:\documents and settings\All Users\Application Data\Pure Networks
2009-02-26 20:29 --------- d-----w c:\program files\Pure Networks
2009-02-26 20:29 --------- d-----w c:\program files\Common Files\Pure Networks Shared
2009-02-26 12:27 --------- d-----w c:\program files\Microsoft Silverlight
2009-02-15 20:02 --------- d-----w c:\documents and settings\All Users\Application Data\vsosdk
2009-02-13 14:57 --------- d-----w c:\program files\Reference Assemblies
2009-02-13 14:53 --------- d-----w c:\program files\Microsoft
2009-02-13 13:55 --------- d-----w c:\program files\MSBuild
2009-02-13 13:55 --------- d-----w c:\program files\Microsoft Works
2009-02-13 13:54 --------- d-----w c:\program files\Microsoft.NET
2009-02-13 13:53 --------- d-----w c:\program files\Microsoft Visual Studio 8
2009-02-09 11:13 1,846,784 ----a-w c:\windows\system32\win32k.sys
2009-02-05 21:01 --------- d-----w c:\program files\eMule
2009-01-24 16:08 47,360 ----a-w c:\documents and settings\craig\Application Data\pcouffin.sys
2009-01-09 17:46 990,208 ----a-w c:\windows\system32\syssetup.dll
2009-01-09 17:46 1,614,848 ----a-w c:\windows\system32\sfcfiles.dll
.

((((((((((((((((((((((((((((( SnapShot@2009-03-31_16.42.41.50 )))))))))))))))))))))))))))))))))))))))))
.
- 2009-03-10 21:20:22 144,792 ----a-w c:\windows\system32\java.exe
+ 2009-03-09 04:19:11 144,792 ----a-w c:\windows\system32\java.exe
- 2009-03-10 21:20:22 144,792 ----a-w c:\windows\system32\javaw.exe
+ 2009-03-09 04:19:13 144,792 ----a-w c:\windows\system32\javaw.exe
- 2009-03-10 21:20:22 148,888 ----a-w c:\windows\system32\javaws.exe
+ 2009-03-09 04:19:13 148,888 ----a-w c:\windows\system32\javaws.exe
- 2009-03-31 06:53:42 72,020 ----a-w c:\windows\system32\perfc009.dat
+ 2009-03-31 18:47:45 72,020 ----a-w c:\windows\system32\perfc009.dat
- 2009-03-31 06:53:42 444,336 ----a-w c:\windows\system32\perfh009.dat
+ 2009-03-31 18:47:45 444,336 ----a-w c:\windows\system32\perfh009.dat
- 2009-03-26 21:26:51 104,960 ----a-w c:\windows\system32\userinit.exe
+ 2008-04-14 03:42:40 26,112 ------w c:\windows\system32\userinit.exe
+ 2009-03-31 18:43:14 16,384 ----atw c:\windows\Temp\Perflib_Perfdata_614.dat
+ 2009-03-31 18:43:35 16,384 ----atw c:\windows\Temp\Perflib_Perfdata_6ec.dat
+ 2009-03-31 18:50:52 16,384 ----atw c:\windows\Temp\Perflib_Perfdata_da8.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"PC Suite Tray"="c:\program files\Nokia\Nokia PC Suite 7\PCSuite.exe" [2008-12-03 1205760]
"BitTorrent DNA"="c:\program files\DNA\btdna.exe" [2009-01-12 342848]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2008-01-22 152872]
"kdx"="c:\program files\Kontiki\KHost.exe" [2007-04-23 1032640]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-09-18 13574144]
"HDAudDeck"="c:\program files\VIA\VIAudioi\HDADeck\HDeck.exe" [2008-05-14 29831168]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-02-05 81000]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-09-18 86016]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2008-05-28 570664]
"4oD"="c:\program files\Kontiki\KHost.exe" [2007-04-23 1032640]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2007-08-24 33648]
"nmctxth"="c:\program files\Common Files\Pure Networks Shared\Platform\nmctxth.exe" [2008-09-14 648488]
"boinctray"="c:\program files\BOINC\boinctray.exe" [2008-11-17 58112]
"boincmgr"="c:\program files\BOINC\boincmgr.exe" [2008-11-17 3916544]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-09 148888]
"nwiz"="nwiz.exe" [2008-09-18 c:\windows\system32\nwiz.exe]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Micronet Wireless Network Utility.lnk - c:\program files\Micronet Wireless Network Utility\RtWLan.exe [2009-01-10 675840]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\eMule\\emule.exe"=
"c:\\Program Files\\DNA\\btdna.exe"=
"c:\\Program Files\\BitTorrent\\bittorrent.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\java.exe"=
"c:\\Program Files\\TVersity\\Media Server\\MediaServer.exe"=
"c:\\Program Files\\Kontiki\\KService.exe"=
"c:\\Program Files\\Logitech\\Logitech Harmony Remote Software 7\\HarmonyRemote.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"67:UDP"= 67:UDP:DHCP Discovery Service

R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2009-01-10 114768]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2009-01-10 20560]
R2 BOINC;BOINC;c:\program files\BOINC\boinc.exe [2008-11-17 443136]
R2 pnpcap;Pure Networks Packet Capture Driver;c:\windows\system32\drivers\pnpcap.sys [2009-02-26 23352]
R3 SjyPkt;SjyPkt;c:\windows\system32\drivers\SjyPkt.sys [2009-01-10 13532]
R3 VIAHdAudAddService;VIA High Definition Audio Driver Service;c:\windows\system32\drivers\viahduaa.sys [2009-01-10 238080]

--- Other Services/Drivers In Memory ---

*NewlyCreated* - JAVAQUICKSTARTERSERVICE
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.co.uk/
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\craig\Application Data\Mozilla\Firefox\Profiles\eycnb79y.default\
FF - prefs.js: browser.search.selectedEngine - Wikipedia (en)
FF - prefs.js: browser.startup.homepage - hxxp://www.google.co.uk/
FF - component: c:\documents and settings\craig\Application Data\Mozilla\Firefox\Profiles\eycnb79y.default\extensions\{a7c6cf7f-112c-4500-a7ea-39801a327e5f}\platform\WINNT_x86-msvc\components\ipc.dll
FF - component: c:\program files\Nokia\Nokia PC Suite 7\bkmrksync\components\BkMrkExt.dll
FF - plugin: c:\program files\Microsoft\Office Live\npOLW.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npbittorrent.dll
.

**************************************************************************

catchme 0.3.1375 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-04-01 21:41:01
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
HDAudDeck = c:\program files\VIA\VIAudioi\HDADeck\HDeck.exe 1????????????????????????????????????????????????

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2009-04-01 21:41:48
ComboFix-quarantined-files.txt 2009-04-01 20:41:46
ComboFix2.txt 2009-03-31 18:46:52
ComboFix3.txt 2009-03-31 15:43:13

Pre-Run: 484,263,510,016 bytes free
Post-Run: 484,318,887,936 bytes free

158 --- E O F --- 2009-03-25 18:22:13



-------------------------------------------------------------------------
First time i tried to send userinit.exe to virus total i realise avast was still running and it picked it up as a trojan... i disabled on-access protection and analysed the file again... here is results..

File userinit.exe received on 04.01.2009 22:44:33 (CET)Antivirus Version Last Update Result
a-squared 4.0.0.101 2009.04.01 -
AhnLab-V3 5.0.0.2 2009.04.01 -
AntiVir 7.9.0.129 2009.04.01 -
Antiy-AVL 2.0.3.1 2009.04.01 -
Authentium 5.1.2.4 2009.04.01 -
Avast 4.8.1335.0 2009.03.31 -
AVG 8.5.0.285 2009.04.01 -
BitDefender 7.2 2009.04.01 -
CAT-QuickHeal 10.00 2009.04.01 -
ClamAV 0.94.1 2009.04.01 -
Comodo 1093 2009.04.01 -
DrWeb 4.44.0.09170 2009.04.01 -
eSafe 7.0.17.0 2009.04.01 -
eTrust-Vet 31.6.6429 2009.04.01 -
F-Prot 4.4.4.56 2009.04.01 -
F-Secure 8.0.14470.0 2009.04.01 -
Fortinet 3.117.0.0 2009.04.01 -
GData 19 2009.04.01 -
Ikarus T3.1.1.49.0 2009.04.01 -
K7AntiVirus 7.10.690 2009.04.01 -
Kaspersky 7.0.0.125 2009.04.01 -
McAfee 5571 2009.04.01 -
McAfee+Artemis 5571 2009.04.01 -
McAfee-GW-Edition 6.7.6 2009.04.01 -
Microsoft 1.4502 2009.04.01 -
NOD32 3981 2009.04.01 -
Norman 6.00.06 2009.04.01 -
nProtect 2009.1.8.0 2009.04.01 -
Panda 10.0.0.14 2009.04.01 -
PCTools 4.4.2.0 2009.04.01 -
Prevx1 V2 2009.04.01 -
Rising 21.23.22.00 2009.04.01 -
Sophos 4.40.0 2009.04.01 -
Sunbelt 3.2.1858.2 2009.04.01 -
Symantec 1.4.4.12 2009.04.01 -
TheHacker 6.3.4.0.298 2009.04.01 -
TrendMicro 8.700.0.1004 2009.04.01 -
VBA32 3.12.10.1 2009.03.31 -
ViRobot 2009.4.1.1671 2009.04.01 -
VirusBuster 4.6.5.0 2009.04.01 -

Additional information
File size: 26112 bytes
MD5...: a93aee1928a9d7ce3e16d24ec7380f89
SHA1..: 513f8bdf67a5a9e09803cfb61f590b39f2683853
SHA256: 944cd2135e171af338352568aa7fe1b8004733a4281395ad6723e0cf43d5f53f
SHA512: b4df088a96dda785b1a2edb32ef72554fb8000d01a29668f0da0614f6100c8ea<BR>59c31790d5248e551543efd36684b12b687df55cbeaa36b8c31decf686980f42
ssdeep: 768:0RMJi8jDLIDSAaQFxfftjaLacmkLGKOq:0RMJbDMDSA7FxffJaLaSLG9q<BR>
PEiD..: -
TrID..: File type identification<BR>Win32 Executable MS Visual C++ (generic) (65.2%)<BR>Win32 Executable Generic (14.7%)<BR>Win32 Dynamic Link Library (generic) (13.1%)<BR>Generic Win/DOS Executable (3.4%)<BR>DOS Executable Generic (3.4%)
PEInfo: PE Structure information<BR><BR>( base data )<BR>entrypointaddress.: 0x54ad<BR>timedatestamp.....: 0x480251a8 (Sun Apr 13 18:32:08 2008)<BR>machinetype.......: 0x14c (I386)<BR><BR>( 3 sections )<BR>name viradd virsiz rawdsiz ntrpy md5<BR>.text 0x1000 0x520e 0x5400 5.95 099b53205ad3f1c3b853a5310d08a9b1<BR>.data 0x7000 0x14c 0x200 1.86 0bb948f267e82975313a03d8c0e8a1cf<BR>.rsrc 0x8000 0xb50 0xc00 3.27 bac832e39f87c4f5f640e5d5c6a1c2fc<BR><BR>( 9 imports ) <BR>&gt; USER32.dll: CreateWindowExW, DestroyWindow, RegisterClassExW, DefWindowProcW, LoadRemoteFonts, wsprintfW, GetSystemMetrics, GetKeyboardLayout, SystemParametersInfoW, GetDesktopWindow, LoadStringW, MessageBoxW, ExitWindowsEx, CharNextW<BR>&gt; ADVAPI32.dll: RegOpenKeyExA, ReportEventW, RegisterEventSourceW, DeregisterEventSource, OpenProcessToken, RegCreateKeyExW, RegSetValueExW, GetUserNameW, RegQueryValueExW, RegOpenKeyExW, RegQueryInfoKeyW, RegCloseKey, RegQueryValueExA<BR>&gt; CRYPT32.dll: CryptProtectData<BR>&gt; WINSPOOL.DRV: SpoolerInit<BR>&gt; ntdll.dll: RtlLengthSid, RtlCopySid, _itow, RtlFreeUnicodeString, DbgPrint, wcslen, wcscpy, wcscat, wcscmp, RtlInitUnicodeString, NtOpenKey, NtClose, _wcsicmp, memmove, RtlConvertSidToUnicodeString, NtQueryInformationToken<BR>&gt; NETAPI32.dll: DsGetDcNameW, NetApiBufferFree<BR>&gt; WLDAP32.dll: -, -, -, -, -, -<BR>&gt; msvcrt.dll: __setusermatherr, _initterm, __getmainargs, _acmdln, _adjust_fdiv, _XcptFilter, _exit, _c_exit, __p__commode, __p__fmode, __set_app_type, _except_handler3, _controlfp, _cexit, exit<BR>&gt; KERNEL32.dll: CompareFileTime, LoadLibraryW, GetProcAddress, FreeLibrary, lstrcpyW, CreateProcessW, lstrlenW, GetVersionExW, LocalFree, LocalAlloc, GetEnvironmentVariableW, CloseHandle, lstrcatW, WaitForSingleObject, DelayLoadFailureHook, GetStartupInfoA, GetModuleHandleA, SetUnhandledExceptionFilter, UnhandledExceptionFilter, TerminateProcess, GetSystemTimeAsFileTime, GetCurrentThreadId, GetTickCount, QueryPerformanceCounter, LoadLibraryA, InterlockedCompareExchange, LocalReAlloc, GetSystemTime, lstrcmpW, GetCurrentThread, SetThreadPriority, ExpandEnvironmentStringsW, SearchPathW, GetLastError, CreateThread, GetFileAttributesExW, GetSystemDirectoryW, SetCurrentDirectoryW, FormatMessageW, lstrcmpiW, GetCurrentProcess, GetUserDefaultLangID, GetCurrentProcessId, SetEvent, OpenEventW, Sleep, SetEnvironmentVariableW<BR><BR>( 0 exports ) <BR>
RDS...: NSRL Reference Data Set<BR>-
ThreatExpert info: &lt;a href='http://www.threatexpert.com/report.aspx?md5=a93aee1928a9d7ce3e16d24ec7380f89' target='_blank'&gt;http://www.threatexpert.com/report.a...0f89&lt;/a&gt;




Hope this helps.... thanks again

[TheBruce1]

Hello again

You don't seem to have a firewall program installed. Using a firewall will allow you to give/deny access for applications that want to go online. Select one of these, or another of your choice:

• ZoneAlarm
• Online Armor Free
• PC Tools Firewall Plus Free

======

Run another scan with Kaspersky. Also run DDS again and post the DDS.txt along with the Kaspersky scan report.

[JustBiteMe2k]

Hi Bruce,
I was under the impression that i was behind the Windows XP firewall (?)
Should i get ZoneAlarm as well?


Hers is the Kaspersky report
----------------------------------------------------------------------------------
--------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER 7 REPORT
Thursday, April 2, 2009
Operating System: Microsoft Windows XP Professional Service Pack 3 (build 2600)
Kaspersky Online Scanner 7 version: 7.0.25.0
Program database last update: Thursday, April 02, 2009 00:13:53
Records in database: 1994982
--------------------------------------------------------------------------------

Scan settings:
Scan using the following database: extended
Scan archives: yes
Scan mail databases: yes

Scan area - My Computer:
C:\
D:\
E:\
F:\
G:\
H:\
I:\
J:\
K:\
L:\
M:\

Scan statistics:
Files scanned: 285949
Threat name: 4
Infected objects: 6
Suspicious objects: 0
Duration of the scan: 05:16:55


File name / Threat name / Threats count
C:\Qoobox\Quarantine\C\WINDOWS\system32\dllcache\userinit.exe.vir Infected: Trojan-Dropper.Win32.Agent.akxv 1
C:\Qoobox\Quarantine\C\WINDOWS\system32\ntdll64.exe.vir Infected: Trojan-Dropper.Win32.Agent.akxv 1
C:\Qoobox\Quarantine\C\WINDOWS\system32\userinit.exe.vir Infected: Trojan-Dropper.Win32.Agent.akxv 1
C:\Qoobox\Quarantine\[4]-Submit_2009-03-31@19.39.zip Infected: Worm.Win32.AutoRun.fjo 1
C:\Qoobox\Quarantine\[4]-Submit_2009-03-31@19.39.zip Infected: Trojan.Win32.Agent.bxfd 1
C:\Qoobox\Quarantine\[4]-Submit_2009-03-31@19.39.zip Infected: Trojan.Win32.Agent.bxfu 1

The selected area was scanned.


----------------------------------------------------------------------------------
here is thd dds stuff


DDS (Ver_09-03-16.01) - NTFSx86
Run by craig at 7:47:58.76 on 02/04/2009
Internet Explorer: 7.0.5730.13 BrowserJavaVersion: 1.6.0_13
Microsoft Windows XP Professional 5.1.2600.3.1252.44.1033.18.2943.2069 [GMT 1:00]

AV: avast! antivirus 4.8.1335 [VPS 090401-0] *On-access scanning disabled* (Updated)

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
svchost.exe
svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Kontiki\KService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\IoctlSvc.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files\TVersity\Media Server\MediaServer.exe
C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe
C:\Program Files\VIA\VIAudioi\HDADeck\HDeck.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Kontiki\KHost.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxth.exe
C:\Program Files\BOINC\boinctray.exe
C:\Program Files\BOINC\boincmgr.exe
C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe
C:\Program Files\DNA\btdna.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\Micronet Wireless Network Utility\RtWLan.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe
C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe
C:\WINDOWS\System32\svchost.exe -k HTTPFilter
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Java\jre6\bin\java.exe
C:\Documents and Settings\craig\Desktop\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.google.co.uk/
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [PC Suite Tray] "c:\program files\nokia\nokia pc suite 7\PCSuite.exe" -onlytray
uRun: [BitTorrent DNA] "c:\program files\dna\btdna.exe"
uRun: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "c:\program files\common files\ahead\lib\NMBgMonitor.exe"
uRun: [kdx] c:\program files\kontiki\KHost.exe -all
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [nwiz] nwiz.exe /install
mRun: [HDAudDeck] c:\program files\via\viaudioi\hdadeck\HDeck.exe 1
mRun: [avast!] c:\progra~1\alwils~1\avast4\ashDisp.exe
mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [NeroFilterCheck] c:\program files\common files\ahead\lib\NeroCheck.exe
mRun: [4oD] "c:\program files\kontiki\KHost.exe" -all
mRun: [GrooveMonitor] "c:\program files\microsoft office\office12\GrooveMonitor.exe"
mRun: [nmctxth] "c:\program files\common files\pure networks shared\platform\nmctxth.exe"
mRun: [boinctray] "c:\program files\boinc\boinctray.exe"
mRun: [boincmgr] "c:\program files\boinc\boincmgr.exe" /a /s
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\micron~1.lnk - c:\program files\micronet wireless network utility\RtWLan.exe
IE: E&xport to Microsoft Excel - c:\progra~1\micros~3\office12\EXCEL.EXE/3000
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~3\office12\ONBttnIE.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~3\office12\REFIEBAR.DLL
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1231616323030
DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1231616415108
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\program files\microsoft office\office12\GrooveSystemServices.dll
Handler: pure-go - {4746C79A-2042-4332-8650-48966E44ABA8} - c:\program files\common files\pure networks shared\platform\puresp4.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\craig\applic~1\mozilla\firefox\profiles\eycnb79y.default\
FF - prefs.js: browser.search.selectedEngine - Wikipedia (en)
FF - prefs.js: browser.startup.homepage - hxxp://www.google.co.uk/
FF - component: c:\documents and settings\craig\application data\mozilla\firefox\profiles\eycnb79y.default\extensions\{a7c6cf7f-112c-4500-a7ea-39801a327e5f}\platform\winnt_x86-msvc\components\ipc.dll
FF - component: c:\program files\nokia\nokia pc suite 7\bkmrksync\components\BkMrkExt.dll
FF - plugin: c:\program files\microsoft\office live\npOLW.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npbittorrent.dll

============= SERVICES / DRIVERS ===============

R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2009-1-10 114768]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2009-1-10 20560]
R2 avast! Antivirus;avast! Antivirus;c:\program files\alwil software\avast4\ashServ.exe [2009-1-10 138680]
R2 BOINC;BOINC;c:\program files\boinc\boinc.exe [2008-11-17 443136]
R2 pnpcap;Pure Networks Packet Capture Driver;c:\windows\system32\drivers\pnpcap.sys [2009-2-26 23352]
R3 SjyPkt;SjyPkt;c:\windows\system32\drivers\SjyPkt.sys [2009-1-10 13532]
R3 VIAHdAudAddService;VIA High Definition Audio Driver Service;c:\windows\system32\drivers\viahduaa.sys [2009-1-10 238080]
S3 avast! Mail Scanner;avast! Mail Scanner;c:\program files\alwil software\avast4\ashMaiSv.exe [2009-1-10 254040]
S3 avast! Web Scanner;avast! Web Scanner;c:\program files\alwil software\avast4\ashWebSv.exe [2009-1-10 352920]

=============== Created Last 30 ================

2009-04-01 21:39 <DIR> --d----- C:\ComboFix
2009-03-31 19:34 <DIR> a-dshr-- C:\cmdcons
2009-03-31 07:52 161,792 a------- c:\windows\SWREG.exe
2009-03-31 07:52 98,816 a------- c:\windows\sed.exe
2009-03-27 19:40 <DIR> --d----- c:\windows\pss
2009-03-26 23:47 664 a------- c:\windows\system32\d3d9caps.dat
2009-03-26 22:26 88,428 a------- c:\windows\system32\drivers\609c547c.sys
2009-03-22 18:04 <DIR> --d----- c:\program files\QuickPar
2009-03-21 10:39 148,776 a------- c:\windows\system32\ImageDrive.cpl
2009-03-16 20:15 <DIR> --d----- c:\program files\BOINC
2009-03-16 20:15 <DIR> --d----- c:\docume~1\alluse~1\applic~1\BOINC
2009-03-10 22:20 73,728 a------- c:\windows\system32\javacpl.cpl

==================== Find3M ====================

2009-03-09 05:19 410,984 a------- c:\windows\system32\deploytk.dll
2009-02-09 12:13 1,846,784 a------- c:\windows\system32\win32k.sys
2009-01-24 17:08 47,360 a------- c:\docume~1\craig\applic~1\pcouffin.sys
2009-01-10 19:58 86,327 a------- c:\windows\pchealth\helpctr\offlinecache\index.dat
2009-01-10 16:18 21,640 a------- c:\windows\system32\emptyregdb.dat
2009-01-09 18:46 1,614,848 a------- c:\windows\system32\sfcfiles.dll
2009-01-09 18:46 990,208 a------- c:\windows\system32\syssetup.dll

============= FINISH: 7:48:14.39 ===============

[TheBruce1]

Hello again

Windows firewall only offers inbound protection, if does not protect outbound connections, so if a malicious file wishes to connect to their server for instructions there is nothing stopping them from doing so, a two-way firewall may block that connection.

=======

If there are no further issues, continue below.

========

Delete DDS from your desktop. You can keep ATF-Cleaner if you wish, otherwise delete from desktop.

=========

Well done, your logs are clean.

Click start>run>type(or copy/paste command into run box):

ComboFix /u

Click ok.

==========

Clear IE7 cookies

*On the Internet Explorer 7 Tools menu, click Internet Options. The Internet Options box should open to the General tab.
*On the General tab, in the Browsing History, click the Delete button. This will delete all the files that are currently stored in your cache [that includes cookies too].
*Click OK, and then click OK again.


Clear Firefox cookies/cache

• Select "Tools"
• Select "Options".
• Select "Privacy".
• In "Settings" window put the check mark for Cookies,Cache,Browsing history and any others you want.
• Click OK.
• In Private area click "Clear Now".

-------------------------------------------------------------------------------------------

MICROSOFT UPDATES

1.Click Start,Run, type sysdm.cpl, and then press OK.
2.Click the Automatic Updates tab, and then click to select one of the following options. We recommend that you select the Automatic (recommended).

Microsoft updates are released every second Tuesday of each month,what is called "Patch Tuesday".

------------------------------------------------------------------------------------------

Useful Information and Programs to keep you safe.

WOT Free helps you avoid disingenuous Internet content by allowing you to learn from others' experiences. WOT shows you website reputations on your browser, telling you how much other users trust a website. This helps you make better decisions while browsing and avoid phishing, malware, and other types of fraud. Reputations can also be added to web search results, Gmail, Wikipedia, and other selected sites.

WOT reputations are computed mainly from user testimonies. Sharing your knowledge with others is just a click away, without ever having to leave the site. We also collect data from hundreds of other sources (including PhishTank) to quickly warn you of emerging threats. Currently, WOT knows over 12 million websites.


For Internet Explorer users:
WOT for IE

--------------------------------------------------------------------------------------

Alternate Browsers
Try the following free alternate browsers rather than Internet Explorer
Avant
Firefox
Opera
K-Meleon

------------------------------------------------------------------------------------------

Free Antispyware Products
SuperAntiSpyware
Malwarebytes ' Anti-Malware

SpywareBlaster to help prevent spyware from installing in the first place.

• Install & update SpywareBlaster with the latest definitions.
  After you have updated, click the button - enable protection for all unprotected items

------------------------------------------------------------------

The MVPS Hosts file replaces your current HOSTS file with one that will restrict known ad sites from serving you unsolicited advertisements. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is the IP of your local computer. Note that if you use a company provided HOSTS file you should not use the MVPS HOSTS file.

If your having trouble downloading & extracting,see link below for guidance:
http://www.mvps.org/winhelp2002/hosts2.htm

Once you have extracted the host file,double click on it and a new window will open.

Double-click on mvps.batand follow the prompts

---------------------------------------------------------------

Winpatrol - Download and install the free version of Winpatrol. A tutorial for this product is located here:
Using Winpatrol to protect your computer.

----------------------------------------

SnoopFree is a programme that informs you when another programme is wanting to log your keystrokes or read your screen.Only for XP users.

Update all these programs regularly. Without regular updates you will not be protected when new malicious programs are released.

==============================================

Secunia PSI is a programme that will alert you to vulnerabilities and outdated programs you have installed, such as Java, Flash Player and many more.

It can also alert you if you have not installed the latest patches from Microsoft.

==============================================

Also, please take a look at this well written article:

PC Safety and Security--What Do I Need?

**Be very wary with any security software that is advertised in popups or in other ways. They are not only usually of no use, but often have malware in them.

Please reply to this thread once more, as we may mark this as resolved, thanks.

[JustBiteMe2k]

Thank you for all your assistance Bruce.
I have now installed ZoneAlarm, MalwareBytes and Secunia PSI.
Re-activated on-access scanning in Avast and ensured the Windows Firewall is enabled still... hopefully i'll be a bit better protected in future.

[TheBruce1]

Hello again

Windows Firewall is enabled still

Please disable windows firewall, Zonealarm is all you need, having two firewall`s active may cause problems

When you installed Zonealarm it would have asked you if you wanted to disable windows firewall, you should have answered yes.

To disable windows firewall click start then run- type:

Firewall.cpl

Change to Off(Not Recommended)

Click ok.

[TheBruce1]

As the issues are resolved this thread is closed.