[Dink]

Good morning,

I am having a big problem with my PC.
Its preventing some programs from launching and generally running slow.
I've used Cleanup.exe then run Hijackthis.

Here is my logfile. Please help as this is preventing me from using my PC.

---------------------------------
Logfile of HijackThis v1.99.1
Scan saved at 10:27:11, on 26/01/2007
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\hidserv.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINNT\System32\nvsvc32.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\msasvc.exe
C:\WINNT\system32\ctpmon.exe
C:\WINNT\system32\ctpmon.exe
c:\rbugr.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
C:\WINNT\system32\wuauclt.exe
C:\WINNT\system32\eclientn.exe
C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe
C:\winnt\system32\nldsrego.exe
C:\WINNT\system32\ctfmon.exe
C:\WINNT\system32\qwinmoeb.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\WINNT\TEMP\idd3E.tmp.exe
C:\Program Files\Common Files\{3E6B13D4-04B2-1033-0531-010321010161}\Update.exe
C:\WINNT\system32\v6.exe
C:\WINNT\TEMP\idd51.tmp.exe
C:\WINNT\TEMP\idd5D.tmp.exe
C:\WINNT\System32\SCardSvr.exe
C:\WINNT\TEMP\idd5F.tmp.exe
C:\WINNT\explorer.exe
C:\WINNT\TEMP\idd62.tmp.exe
C:\WINNT\TEMP\win63.tmp.exe
C:\WINNT\TEMP\idd64.tmp.exe
C:\Broadband programs\Programs\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ie/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http://WBCSVR01:8080
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: (no name) - {A8BD6820-6ED7-423E-9558-2D1486B0FEEA} - C:\Program Files\DeluxeCommunications\DxcBho.dll
O3 - Toolbar: @msdxmLC.dll,[email protected],&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O3 - Toolbar: Bar888 - {C1B4DEC2-2623-438e-9CA2-C9043AB28508} - C:\PROGRA~1\COMMON~1\{3E6B1~2\Bar888.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINNT\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [ETapiSt] "C:\Program Files\ESTOS\ProCall\etapist.exe" -autostart
O4 - HKLM\..\Run: [ETapiNotify] eclientn.exe
O4 - HKLM\..\Run: [DllRunning] rundll32.exe "C:\WINNT\system32\uvbdkdvo.dll",setvm
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe"
O4 - HKLM\..\Run: [{B1-13-3D-D4-ZN}] C:\winnt\system32\nldsrego.exe SKY001
O4 - HKLM\..\Run: [DeluxeCommunications] C:\Program Files\DeluxeCommunications\Dxc.exe
O4 - HKLM\..\Run: [IpWins] C:\Program Files\Ipwindows\ipwins.exe
O4 - HKLM\..\Run: [ExploreUpdSched] C:\WINNT\system32\qwinmoeb.exe SKY001
O4 - HKLM\..\Run: [kslvgdm.dll] C:\WINNT\system32\rundll32.exe "C:\Documents and Settings\Administrator\Local Settings\Application Data\kslvgdm.dll",rmlptx
O4 - HKLM\..\Run: [syswin] C:\WINNT\system32\v6.exe
O4 - HKCU\..\Run: [ctfmon.exe] ctfmon.exe
O4 - HKCU\..\Run: [DeluxeCommunications] C:\Program Files\DeluxeCommunications\Dxc.exe
O4 - Startup: Z_Start.lnk = C:\WINNT\system32\dwdsregt.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: AutoCAD Startup Accelerator.lnk = C:\Program Files\Common Files\Autodesk Shared\acstart16.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~1\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = WalshBrothers.local
O17 - HKLM\System\CCS\Services\Tcpip\..\{185FE940-6A20-4A13-94F4-C72A17C6085A}: NameServer = 62.231.32.10,62.231.32.11
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = WalshBrothers.local
O17 - HKLM\System\CS1\Services\Tcpip\..\{185FE940-6A20-4A13-94F4-C72A17C6085A}: NameServer = 62.231.32.10,62.231.32.11
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = WalshBrothers.local
O17 - HKLM\System\CS2\Services\Tcpip\..\{185FE940-6A20-4A13-94F4-C72A17C6085A}: NameServer = 62.231.32.10,62.231.32.11
O20 - AppInit_DLLs: dxclib303562752.dll
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: Client IP-IPX - Unknown owner - C:\WINNT\system32\svchosts.exe" -e mc-110-12-0000272 (file missing)
O23 - Service: directx9.exe - Unknown owner - C:\WINNT\directx9.exe (file missing)
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: Microsoft authenticate service (MsaSvc) - Unknown owner - C:\WINNT\system32\msasvc.exe
O23 - Service: Network helper Service (MSDisk) - Unknown owner - C:\WINNT\system32\irdvxc.exe" /service (file missing)
O23 - Service: msvccc.exe - Unknown owner - C:\WINNT\msvccc.exe (file missing)
O23 - Service: Network Windows Service (MSWindows) - Unknown owner - C:\WINNT\system32\urdvxc.exe" /service (file missing)
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINNT\System32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINNT\system32\HPZipm12.exe
O23 - Service: Windows NT Logon Application (WINLOGON) - Unknown owner - C:\WINNT\system\winlogon.exe (file missing)

 

[fredmh]

Hello Dink, and welcome to TSF


Please subscribe to this thread to get immediate notification of replies as soon as they are posted. To do this click Thread Tools,
then click Subscribe to this Thread. Make sure it is set to Instant Notification, then click Subscribe.


Please read this post completely before begining the fix. If there's anything that you do not understand, kindly ask your questions before proceeding.
Please ensure that there aren't any opened browsers when you are carrying out the procedures below. Save the following instructions in Notepad as this
webpage would not be available when you're carrying out the fix.


IT IS IMPORTANT THAT YOU DON'T MISS A STEP & PERFORM EVERYTHING IN THE RIGHT ORDER.

----------------------------------------

The fixes we will use are specific to your problems and should only be used for this issue on this machine.

Please only use this topic to reply to. Do not start another thread.
If any other issues arise let me know.

The process is not instant. Please continue to review my answers until I tell you your machine is clear.
Absence of symptoms does not mean that everything is clear. So lets do this to the end!

Please make every effort to reply to my posts in a timely manner. Malware breeds malware and the longer an infection remains on a system, the more
likely additional infections will result.

----------------------------------------

You have a severely infected system. This will take multiple posts to clean. In this first round, we will use specialized tools to
clean out the more serious infections.Please stick with me on this.


----------------------------------------

DOWNLOADS



SDFix

Download SDFix and save it to your desktop.

We will use this later.



SMITFRAUD FIX

Please download SmitfraudFix (by S!Ri)
Extract the content (a folder named SmitfraudFix) to your Desktop.


Brute Force Uninstaller


Please download Brute Force Uninstaller to your desktop.

• Right click the BFU folder on your desktop, and choose Extract All
• Click "Next"
• In the box to choose where to extract the files to,
• Click "Browse"
• Click on the + sign next to "My Computer"
• Click on "Local Disk (C or whatever your primary drive is
• Click "Make New Folder"
• Type in BFU
• Click "Next", and Uncheck the "Show Extracted Files" box and then click "Finish".

RIGHT-CLICK HERE
and choose "Save As" (in IE it's "Save Target As") in order to download Alcra PLUS Remover.

Save it in the same folder you made earlier (c:BFU).

Do not do anything with these yet



ComboFix



1. Download this file - You MUST save it to your desktop

COMBOFIX

2. 2. Go to <<Start>> then <<Run>> then paste in the single line command then click OK

"%userprofile%\desktop\combofix.exe" /v uvbdkdvo dxclib303562752




3. When finished, it shall produce a log for you. Post that log in your next reply

Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall

----------------------------------------

SAFE MODE RE-BOOT

Please reboot your computer in Safe Mode by doing the following:
1) Restart your computer
2) After hearing your computer beep once during startup, but before the Windows icon appears, press F8.
3) Instead of Windows loading as normal, a menu should appear
4) Use the up arrow key to highlight Safe Mode and press Enter.
5) Login with your usual account. Make sure to close any open browsers.

----------------------------------------

FIXES AND DELETIONS

Uninstall the following via the Add/Remove Panel (Start->(Settings)->Control Panel->Add/Remove Programs) if they exist:

DeluxeCommunications>>>This is a program which installs malware on your system

----------------------------------------

Open HijackThis and click on 'Do a System Scan Only'. Check the following entries (If they still exist, make sure you do not miss any)

O4 - HKLM\..\Run: [kslvgdm.dll] C:\WINNT\system32\rundll32.exe "C:\Documents and Settings\Administrator\Local Settings\Application Data\kslvgdm.dll",rmlptx
O4 - HKCU\..\Run: [DeluxeCommunications] C:\Program Files\DeluxeCommunications\Dxc.exe
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm



Please remember to close all other windows, including browsers then click Fix checked.

----------------------------------------

UNHIDE HIDDEN FILES

Go to My Computer->Tools->Folder Options->View tab:
* Under the Hidden files and folders heading, select Show hidden files and folders.
* Uncheck the Hide protected operating system files (recommended) option.
* Also make sure there is no checkmark beside Hide file extensions for known file types
* Click Yes to confirm and then click OK.

----------------------------------------
Delete the following Files indicated in RED and Folders indicated in BLUE if they still exist.

C:\Program Files\DeluxeCommunications

C:\Documents and Settings\Administrator\Local Settings\Application Data\kslvgdm.dll

----------------------------------------

RUNNING SCANNERS


SmitFraud - OPTION 2

Double-click on SmitfraudFix.exe to start the tool.
Select option #2 - Clean by typing 2 and press Enter.
Wait for the tool to complete and disk cleanup to finish.
You will be prompted : "Registry cleaning - Do you want to clean the registry?" answer Yes by typing Y and hit Enter.
The tool will also check if wininet.dll is infected. If a clean version is found, you will be prompted to replace wininet.dll. Answer Yes to the question "Replace infected file?" by typing Y and hit Enter.

The tool will create a log named c:\rapport.txt in the root of your drive, eg: Local Disk C: (C:rapport.txt) or partition where your
operating system is installed. Please post that log along with all others requested in your next reply.



SDFix

• Right click the SDFix.zip folder and choose Extract All,
• Open the extracted folder and double click RunThis.bat to start the script.
• Type Y to begin the script.
• It will remove the Trojan Services then make some repairs to the registry and prompt you to press any key to Reboot.
• Press any Key and it will restart the PC.
• Your system will take longer that normal to restart as the fixtool will be running and removing files.
• When the desktop loads the Fixtool will complete the removal and display Finished, then press any key to end the script and load your desktop icons.
• Finally open the SDFix folder on your desktop and copy and paste the contents of the results file
  Report.txt back onto the forum with a new HijackThis log

Brute Force Uninstaller

Please go to Start > My Computer and navigate to the C:BFU folder.

• Start the Brute Force Uninstaller by doubleclicking BFU.exe
• Beside the scriptline to execute field click the folder icon
  and select alcanshorty.bfu by double clicking on it.
• Press Execute and let it do it’s job. (You ought to see a blue progress bar if you did this correctly.)
• Wait for the complete script execution box to pop up and press OK.
• Press exit to terminate the BFU program.

Use this URL to copy into the address bar of the Download script window:
http://metallica.geekstogo.com/alcanshorty.bfu

Execute the script by clicking the Execute button.



SECURE DESKTOP


Next go to Control Panel click Display>Desktop>Customize Desktop>Web> Now, Uncheck Everything and delete if present:

• "Security Info"
• "Warning Message"
• "Security Desktop"
• "Warning Homepage"
• "Desktop Uninstall"

Also make sure the 'Lock desktop items' box is unticked. Click OK, and then Click Apply, then OK.

----------------------------------------

SYSTEM RE-BOOT

Reboot into Normal Mode.

----------------------------------------

SmitFraud - OPTION 3

Double-click on SmitfraudFix.exe to start the tool.
Select option #3 - Delete Trusted zone by typing 3 and press Enter
Answer Yes to the question "Restore Trusted Zone ?" by typing Y and hit Enter.



Note, if you use SpywareBlaster and/or IE-SPYAD, it will be necessary to re-install the protection both afford.
For SpywareBlaster, run the program and re-protect all items. For IE-SPYAD, run the batch file and reinstall the protection.

----------------------------------------

ON-LINE SCANS

Perform an online scan with Internet Explorer with Panda ActiveScan

1. Click on
   located at the bottom of the page.
2. A "pop up" window will appear. * Please ensure that your pop up blocker doesn't block it *
3. Enter your e-mail address, country, and state & click "Free Online Scan" * The download of the 8 MB Panda's ActiveX control will take place *

Begin the scan by selecting

• If it finds any malware, it will offer you a report.
• Please ignore any entry it finds and the offer to buy the program to remove the entry, as we will address this later.
• Click on
  then click

* You needn't remain online while it's doing the scan but you have to re-connect after it has finished to see the report.
* Turn off the real time scanner of any existing antivirus program while performing the online scan

----------------------------------------

FOLLOW-UP

Please return and post these items in the order listed:

SDFix log
c:\rapport.txt from SmitFraud
c:\combofix.txt
Panda scan
A new HJT log run in Normal Mode

Please note: In order to properly see what is on your system, all HJT logs must be run in the normal mode

Please let me know how your system is behaving.

 

[Dink]

Good morning Fredmh,

My 1st problem is that I can't download SmitfraudFix or COMBOFIX files.

When I click on the links or right click save as, I get redirected to a search page.

Is this part of the malware problem?
Is there someplace else I can download these files?

Regards,

Dink

 

[fredmh]

OK. Let's try and work around this problem. It culd very well be caused by malware:



SAFE MODE RE-BOOT

Please reboot your computer in Safe Mode by doing the following:
1) Restart your computer
2) After hearing your computer beep once during startup, but before the Windows icon appears, press F8.
3) Instead of Windows loading as normal, a menu should appear
4) Use the up arrow key to highlight Safe Mode and press Enter.
5) Login with your usual account. Make sure to close any open browsers.

----------------------------------------

FIXES AND DELETIONS

Uninstall the following via the Add/Remove Panel (Start->(Settings)->Control Panel->Add/Remove Programs) if they exist:

DeluxeCommunications>>>This is a program which installs malware on your system

----------------------------------------

Open HijackThis and click on 'Do a System Scan Only'. Check the following entries (If they still exist, make sure you do not miss any)

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ie/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http://WBCSVR01:8080
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: (no name) - {A8BD6820-6ED7-423E-9558-2D1486B0FEEA} - C:\Program Files\DeluxeCommunications\DxcBho.dll
O4 - HKLM\..\Run: [kslvgdm.dll] C:\WINNT\system32\rundll32.exe "C:\Documents and Settings\Administrator\Local Settings\Application Data\kslvgdm.dll",rmlptx
O4 - HKCU\..\Run: [DeluxeCommunications] C:\Program Files\DeluxeCommunications\Dxc.exe
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm



Please remember to close all other windows, including browsers then click Fix checked.

----------------------------------------

UNHIDE HIDDEN FILES

Go to My Computer->Tools->Folder Options->View tab:
* Under the Hidden files and folders heading, select Show hidden files and folders.
* Uncheck the Hide protected operating system files (recommended) option.
* Also make sure there is no checkmark beside Hide file extensions for known file types
* Click Yes to confirm and then click OK.

----------------------------------------
Delete the following Files indicated in RED and Folders indicated in BLUE if they still exist.

C:\Program Files\DeluxeCommunications

C:\Documents and Settings\Administrator\Local Settings\Application Data\kslvgdm.dll

----------------------------------------

SYSTEM RE-BOOT

Reboot into Normal Mode.

----------------------------------------


SYSTEM REPAIR ENGINEER

Please download this tool >http://www.kztechs.com/sreng/sreng2.zip]System Repair Engineer

• Extract it to it's own folder & double click SREng.exe to run it
  
  
• Select 'Smart Scan' & tick "Verify Digital Signatures"
  
  
• Click on the [Scan] button
  
  
• When finished, click on the [Save Reports] button & save the log to Desktop
  
  
• Attach the log in your next reply. Dont post it

Note: You may have to rename SREngLog.log to SREngLog.txt before attaching

 

[Dink]

Good morning,

I have done what you listed above.

Please find attached SREngLOG.txt


Regards

Dink

 

[fredmh]

We are ging to use System Repair Engineer (SREng) to get rid of some nasty stuff in your system



Launch SREng (System Repair Engineer)

Select 'Boot Items'
- Click on 'Registry'
-- Select each of the following entries listed below & click the [Delete Seleted] button


[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<IpWins><C:\Program Files\Ipwindows\ipwins.exe> [N/A]
<ExploreUpdSched><C:\WINNT\system32\qwinmoea.exe SKY001> [N/A]
<syswin><C:\WINNT\system32\v6.exe> [N/A]
<System><C:\WINNT\system32\kernels1118.exe>
<ChkDisk><C:\WINNT\system32\chk_disk.exe>
<sysinter><C:\WINNT\system32\adirss.exe> [N/A]
<lnwin.exe><C:\WINNT\system32\lnwin.exe> [N/A]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
<{6E4B23EE-D412-48BD-B133-60574061E429}><C:\WINNT\system32\ssqpqpm.dll> [N/A]
<System Registry Hook><{309C96FA-8C40-4bce-879C-989DC33DCD25}> [N/A]



http://img.photobucket.com/albums/v666/sUBs/BootItems_Folders.gif[/img


- Click on [b]'Folders'[/b]
-- Select each of the following entries listed below & click the [b][Delete Seleted][/b] button

[Z_Start]
<C:\Documents and Settings\Administrator\Start Menu\Programs\Startup\Z_Start.lnk --> C:\WINNT\system32\dwdsregt.exe []><N>
[Think-Adz]
<C:\Documents and Settings\Administrator\Start Menu\Programs\Startup\Think-Adz.lnk --> C:\WINNT\system32\qwinmoea.exe []><N>





[img]http://img.photobucket.com/albums/v666/sUBs/Service32.gif



- Click on 'Services'
-- Click 'Win32Services' which shall bring up a new window
--- Select each of the following entries listed below & click the [Delete Service] + the [Set] button


[msvccc.exe / msvccc.exe][Stopped/Auto Start]
<"C:\WINNT\msvccc.exe"><N/A>



- Click on 'Services'
-- Click 'Drivers' which shall bring up a new window
--- Select each of the following entries listed below & click the [Delete Service] + the [Set] button


[ntldr.sys / ntldr.sys][Stopped/Manual Start]
<\??\C:\ntldr.sys><N/A>
[wincom32 / wincom32][Stopped/Auto Start]
<\??\C:\WINNT\system32\wincom32.sys><N/A>

Select 'System Repair' from the left pane
- Click on 'Browser Add-ons'
-- Select each of the following entries listed below & click the [Delete Seleted] button


[]
{6E4B23EE-D412-48BD-B133-60574061E429} <C:\WINNT\system32\ssqpqpm.dll, N/A>
[]
{72C44AF8-D65E-2EAC-B11A-0BD643404C2D} <C:\WINNT\system32\gfmlql.dll, N/A>
[]
{7DA39570-5FD2-4f18-94B4-20730CB3F727} <C:\WINNT\system32\okmgoriy.dll, N/A>
[]
{8D3F1D13-72C0-446F-BDBE-DE02D08336FE} <C:\WINNT\system32\ljheb.dll, N/A>
[Bar888]
{C1B4DEC2-2623-438e-9CA2-C9043AB28508} <C:\PROGRA~1\COMMON~1\{3E6B1~2\Bar888.dll, N/A>
[Bar888]
{C1B4DEC2-2623-438e-9CA2-C9043AB28508} <C:\PROGRA~1\COMMON~1\{3E6B1~2\Bar888.dll, N/A>



Please post a new HJT log.

 

[Dink]

Good morning,

Here is my latest HijackThis log:

Logfile of HijackThis v1.99.1
Scan saved at 09:51:01, on 31/01/2007
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\savedump.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\hidserv.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINNT\system32\irdvxc.exe
C:\WINNT\system32\urdvxc.exe
C:\WINNT\System32\nvsvc32.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.EXE
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
C:\WINNT\system32\eclientn.exe
C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe
C:\winnt\system32\nldsrego.exe
C:\WINNT\system32\rundll32.exe
C:\WINNT\system32\ctfmon.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\WINNT\system32\qwinmoea.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\PROGRA~1\WinZip\winzip32.exe
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ie/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: OwlforceB - {3E1500AC-87A5-416b-A211-82E848649DA9} - C:\PROGRA~1\OfB\OWLFOR~1.DLL
O2 - BHO: (no name) - {40A2988E-C954-4DDE-BD08-453191805BB9} - C:\WINNT\system32\durvilz.dll
O2 - BHO: URLLink - {4A2AACF3-ADF6-11D5-98A9-00E018981B9E} - C:\Program Files\NewDotNet\newdotnet7_48.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: (no name) - {54698A2F-2247-4538-82FC-2B5443D66945} - C:\WINNT\system32\drivera.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O3 - Toolbar: @msdxmLC.dll,[email protected],&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINNT\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [ETapiSt] "C:\Program Files\ESTOS\ProCall\etapist.exe" -autostart
O4 - HKLM\..\Run: [ETapiNotify] eclientn.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe"
O4 - HKLM\..\Run: [{B1-13-3D-D4-ZN}] C:\winnt\system32\nldsrego.exe SKY001
O4 - HKLM\..\Run: [New.net Startup] rundll32 C:\PROGRA~1\NEWDOT~1\NEWDOT~2.DLL,ClientStartup -s
O4 - HKLM\..\Run: [ExploreUpdSched] C:\WINNT\system32\qwinmoea.exe SKY001
O4 - HKCU\..\Run: [ctfmon.exe] ctfmon.exe
O4 - Startup: Think-Adz.lnk = C:\WINNT\system32\qwinmoea.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: AutoCAD Startup Accelerator.lnk = C:\Program Files\Common Files\Autodesk Shared\acstart16.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~1\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = WalshBrothers.local
O17 - HKLM\System\CCS\Services\Tcpip\..\{185FE940-6A20-4A13-94F4-C72A17C6085A}: NameServer = 62.231.32.10,62.231.32.11
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = WalshBrothers.local
O17 - HKLM\System\CS1\Services\Tcpip\..\{185FE940-6A20-4A13-94F4-C72A17C6085A}: NameServer = 62.231.32.10,62.231.32.11
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = WalshBrothers.local
O17 - HKLM\System\CS2\Services\Tcpip\..\{185FE940-6A20-4A13-94F4-C72A17C6085A}: NameServer = 62.231.32.10,62.231.32.11
O20 - AppInit_DLLs: c:\winnt\system32\ldcore.dll
O20 - Winlogon Notify: instcat - C:\WINNT\SYSTEM32\instcat.dll
O20 - Winlogon Notify: NavLogon - C:\WINNT\
O20 - Winlogon Notify: Winmsc - C:\WINNT\SYSTEM32\ms3d2a43d1.dll
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: Client IP-IPX - Unknown owner - C:\WINNT\system32\svchosts.exe" -e mc-110-12-0000272 (file missing)
O23 - Service: directx9.exe - Unknown owner - C:\WINNT\directx9.exe (file missing)
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: Microsoft authenticate service (MsaSvc) - Unknown owner - C:\WINNT\system32\msasvc.exe
O23 - Service: Network helper Service (MSDisk) - Unknown owner - C:\WINNT\system32\irdvxc.exe" /service (file missing)
O23 - Service: Network Windows Service (MSWindows) - Unknown owner - C:\WINNT\system32\urdvxc.exe" /service (file missing)
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINNT\System32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINNT\system32\HPZipm12.exe
O23 - Service: Windows NT Logon Application (WINLOGON) - Unknown owner - C:\WINNT\system\winlogon.exe (file missing)

 

[fredmh]

Please read this post completely before begining the fix. If there's anything that you do not understand, kindly ask your questions before proceeding.
Please ensure that there aren't any opened browsers when you are carrying out the procedures below. Save the following instructions in Notepad as this
webpage would not be available when you're carrying out the fix.


IT IS IMPORTANT THAT YOU DON'T MISS A STEP & PERFORM EVERYTHING IN THE RIGHT ORDER.

----------------------------------------

The fixes we will use are specific to your problems and should only be used for this issue on this machine.

Please only use this topic to reply to. Do not start another thread.
If any other issues arise let me know.

The process is not instant. Please continue to review my answers until I tell you your machine is clear.
Absence of symptoms does not mean that everything is clear. So lets do this to the end!

Please make every effort to reply to my posts in a timely manner. Malware breeds malware and the longer an infection remains on a system, the more
likely additional infections will result.

----------------------------------------

We still have a lot of work to do. Let's go to the next round.


----------------------------------------

DOWNLOADS


AVG Anti-Spyware 7.5



Please download AVG Anti Spyware

Use the link at the bottom of the page under "AVG Anti-Spyware Free for Windows"

1. Install AVG Anti-Spyware 7.5.
2. Double-click the icon on Desktop to launch AVG A-S 7.5
3. On the top of the main screen click Shield
4. Click the word active to change it to inactive
5. On the top of the main screen click Update.
6. Then click on Start Update. The update will start and a progress bar will show the updates being installed.
7. I also recommend changing the "Update interval" to something more reasonable like 12 hours.

SDFix

Download SDFix and save it to your desktop.

We will use this later.





ComboFix

Let's try this again.

1. Download this file - You MUST save it to your desktop

COMBOFIX

2. 2. Go to <<Start>> then <<Run>> then paste in the single line command then click OK

"%userprofile%\desktop\combofix.exe" /v durvilz drivera ldcore instcat ms3d2a43d1



3. When finished, it shall produce a log for you. Post that log in your next reply

Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall

----------------------------------------

SAFE MODE RE-BOOT

Please reboot your computer in Safe Mode by doing the following:
1) Restart your computer
2) After hearing your computer beep once during startup, but before the Windows icon appears, press F8.
3) Instead of Windows loading as normal, a menu should appear
4) Use the up arrow key to highlight Safe Mode and press Enter.
5) Login with your usual account. Make sure to close any open browsers.

----------------------------------------

FIXES AND DELETIONS


Uninstall the following via the Add/Remove Panel (Start->(Settings)->Control Panel->Add/Remove Programs) if they exist:

New Net and/or New Dot Net

----------------------------------------

Open HijackThis and click on 'Do a System Scan Only'. Check the following entries (If they still exist, make sure you do not miss any)


O2 - BHO: URLLink - {4A2AACF3-ADF6-11D5-98A9-00E018981B9E} - C:\Program Files\NewDotNet\newdotnet7_48.dll
O4 - HKLM\..\Run: [{B1-13-3D-D4-ZN}] C:\winnt\system32\nldsrego.exe SKY001
O4 - HKLM\..\Run: [New.net Startup] rundll32 C:\PROGRA~1\NEWDOT~1\NEWDOT~2.DLL,ClientStartup -s
O4 - HKLM\..\Run: [ExploreUpdSched] C:\WINNT\system32\qwinmoea.exe SKY001
O4 - Startup: Think-Adz.lnk = C:\WINNT\system32\qwinmoea.exe



Please remember to close all other windows, including browsers then click Fix checked.

----------------------------------------

UNHIDE HIDDEN FILES

Go to My Computer->Tools->Folder Options->View tab:
* Under the Hidden files and folders heading, select Show hidden files and folders.
* Uncheck the Hide protected operating system files (recommended) option.
* Also make sure there is no checkmark beside Hide file extensions for known file types
* Click Yes to confirm and then click OK.

----------------------------------------
Delete the following Files indicated in RED and Folders indicated in BLUE if they still exist.

C:\Program Files\NewDotNet

C:\WINNT\system32\qwinmoea.exe

----------------------------------------

SDFix

• Right click the SDFix.zip folder and choose Extract All,
• Open the extracted folder and double click RunThis.bat to start the script.
• Type Y to begin the script.
• It will remove the Trojan Services then make some repairs to the registry and prompt you to press any key to Reboot.
• Press any Key and it will restart the PC.
• Your system will take longer that normal to restart as the fixtool will be running and removing files.
• When the desktop loads the Fixtool will complete the removal and display Finished, then press any key to end the script and load your desktop icons.
• Finally open the SDFix folder on your desktop and copy and paste the contents of the results file
  Report.txt back onto the forum with a new HijackThis log

----------------------------------------

RUNNING SCANNERS



AVG Anti-Spyware 7.5

• Run AVG A-s with it's updated definitions: (...it's important that all windows must be closed)
  This scan can take quite a while to run, so be prepared.
• Click Scanner
• Click on the Scan tab
• Click Complete System Scan to begin scanning.
  
  
  
  
  
• When the scan is complete click Recommended Action and change it to Quarantine (1),
• If not click Recommended Action and choose Quarantine from the popup menu. (2)
• At the bottom of the window click on the Apply all Actions button. (3)

When done, click the Save Scan Report button. (4) then click Save Report As and save it to your desktop.

IMPORTANT : Don't click on the "Save Scan Report" button before you did hit the "Apply all Actions" button.



Note: DO NOT USE the computer while AVG A/S is scanning. If Explorer or the Control Panel are opened some malware types will
reinfect your system or will not be cleaned properly.

----------------------------------------

SYSTEM RE-BOOT

Reboot into Normal Mode.

----------------------------------------


ON-LINE SCANS

Perform an online scan with Internet Explorer with Panda ActiveScan

1. Click on
   located at the bottom of the page.
2. A "pop up" window will appear. * Please ensure that your pop up blocker doesn't block it *
3. Enter your e-mail address, country, and state & click "Free Online Scan" * The download of the 8 MB Panda's ActiveX control will take place *

Begin the scan by selecting

• If it finds any malware, it will offer you a report.
• Please ignore any entry it finds and the offer to buy the program to remove the entry, as we will address this later.
• Click on
  then click

* You needn't remain online while it's doing the scan but you have to re-connect after it has finished to see the report.
* Turn off the real time scanner of any existing antivirus program while performing the online scan

----------------------------------------

FOLLOW-UP

Please return and post these items in the order listed:

c:\combofix.txt
SDFix log
AVG A/S
Panda scan
A new HJT log run in Normal Mode

Please note: In order to properly see what is on your system, all HJT logs must be run in the normal mode

Please let me know how your system is behaving.