Welcome to MalwareRemoval.com,
What if we told you that you could get malware removal help from experts, and that it was 100% free? MalwareRemoval.com provides free support for people with infected computers. Our help, and the tools we use are always 100% free. No hidden catch. We simply enjoy helping others. You enjoy a clean, safe computer.

Malware Removal Instructions

Smitfraud

MalwareRemoval.com provides free support for people with infected computers. Using plain language that anyone can understand, our community of volunteer experts will walk you through each step.

Smitfraud

Unread postby Fonzieboy » May 22nd, 2007, 5:54 am

Hello everyone,

My computer running Windows XP SP2 has been infected with Smitfraud :(

I scanned my whole drive in SafeMode with SmitRem, Ad-aware and AVG Anti-spyware.

Then I rebooted and scanned with Panda ActiveScan.

I still get popups surfing the net... :evil:

These are my reports:

smitRem © log file
version 3.2

by noahdfear



Microsoft Windows XP [versie 5.1.2600]
"IE"="7.0000"

Running from
E:\download\beheer\SmitRem\smitRem

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Pre-run SharedTask Export

(GetSTS.exe) SharedTaskScheduler exporter by Lawrence Abrams (Grinler)
Copyright(C) 2006 BleepingComputer.com

Registry Pseudo-Format Mode (Not a valid reg file):

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Preloader van browseui"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Cache-daemon voor onderdeelcategorieën"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{438755C2-A8BA-11D1-B96B-00A0C90312E1}\InProcServer32]
@="%SystemRoot%\System32\browseui.dll"


[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8C7461EF-2B13-11d2-BE35-3078302C2030}\InProcServer32]
@="%SystemRoot%\System32\browseui.dll"


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Appinitdll check ........ Thank you Grinler!

dumphive.exe (C)2000-2004 Markus Stephany
REGEDIT4

[Windows]
"AppInit_DLLs"=" AMINIT.dll"
"DeviceNotSelectedTimeout"="15"
"GDIProcessHandleQuota"=dword:00002710
"Spooler"="yes"
"swapdisk"=""
"TransmissionRetryTimeout"="90"
"USERProcessHandleQuota"=dword:00002710

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

XP Firewall allowed access

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\WINDOWS\\system32\\dpmw32.exe"="C:\\WINDOWS\\system32\\dpmw32.exe:*:Enabled:dpmw32"
"C:\\Program Files\\Ceterm\\warftpd\\warftpd.exe"="C:\\Program Files\\Ceterm\\warftpd\\warftpd.exe:*:Enabled:War FTP Daemon for Windows 95 / NT"
"C:\\Program Files\\Microsoft Office\\Office10\\FRONTPG.EXE"="C:\\Program Files\\Microsoft Office\\Office10\\FRONTPG.EXE:*:Enabled:FRONTPG.EXE"
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.0"
"C:\\Program Files\\MSN Messenger\\msncall.exe"="C:\\Program Files\\MSN Messenger\\msncall.exe:*:Enabled:Windows Live Messenger 8.0 (Phone)"
"C:\\Program Files\\Altiris\\AClient\\AClntUsr.EXE"="C:\\Program Files\\Altiris\\AClient\\AClntUsr.EXE:*:Enabled:AClntUsr - AClient Interactive User Service"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\\DOCUME~1\\BEHEER~1\\LOCALS~1\\Temp\\win29D.tmp.exe"="C:\\DOCUME~1\\BEHEER~1\\LOCALS~1\\Temp\\win29D.tmp.exe:*:Enabled:win29D.tmp"
"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE"="C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE:*:Enabled:Internet Explorer"
"C:\\WINDOWS\\TEMP\\winAF.tmp.exe"="C:\\WINDOWS\\TEMP\\winAF.tmp.exe:*:Enabled:winAF.tmp"

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~


checking for ShudderLTD key

ShudderLTD key not present!

checking for PSGuard.com key


PSGuard.com key not present!


checking for WinHound.com key


WinHound.com key not present!


checking for drsmartload2 key


drsmartload2 key not present!

spyaxe uninstaller NOT present
Winhound uninstaller NOT present
SpywareStrike uninstaller NOT present
AlfaCleaner uninstaller NOT present
SpyFalcon uninstaller NOT present
SpywareQuake uninstaller NOT present
SpywareSheriff uninstaller NOT present
Trust Cleaner uninstaller NOT present
SpyHeal uninstaller NOT present
VirusBurst uninstaller NOT present
BraveSentry uninstaller NOT present
AntiVermins uninstaller NOT present
VirusBursters uninstaller NOT present

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Existing Pre-run Files


~~~ Program Files ~~~



~~~ Shortcuts ~~~



~~~ Favorites ~~~



~~~ system32 folder ~~~

amcompat.tlb
nscompat.tlb


~~~ Icons in System32 ~~~



~~~ Windows directory ~~~



~~~ Drive root ~~~


~~~ Miscellaneous Files/folders ~~~




~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright(C) 2002-2003 Craig.Peacock@beyondlogic.org
Killing PID 1004 'explorer.exe'
Killing PID 1004 'explorer.exe'

Starting registry repairs

Registry repairs complete

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

SharedTask Export after registry fix

(GetSTS.exe) SharedTaskScheduler exporter by Lawrence Abrams (Grinler)
Copyright(C) 2006 BleepingComputer.com

Registry Pseudo-Format Mode (Not a valid reg file):

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Preloader van browseui"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Cache-daemon voor onderdeelcategorieën"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{438755C2-A8BA-11D1-B96B-00A0C90312E1}\InProcServer32]
@="%SystemRoot%\System32\browseui.dll"


[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8C7461EF-2B13-11d2-BE35-3078302C2030}\InProcServer32]
@="%SystemRoot%\System32\browseui.dll"


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Deleting files

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Remaining Post-run Files


~~~ Program Files ~~~



~~~ Shortcuts ~~~



~~~ Favorites ~~~



~~~ system32 folder ~~~

amcompat.tlb
nscompat.tlb


~~~ Icons in System32 ~~~



~~~ Windows directory ~~~



~~~ Drive root ~~~


~~~ Miscellaneous Files/folders ~~~



~~~ Wininet.dll ~~~

wininet.dll is missing!!


---------------------------------------------------------
AVG Anti-Spyware - Scan Report
---------------------------------------------------------

+ Created at: 9:12:12 22/05/2007

+ Scan result:



C:\Program Files\Bug Doctor -> Adware.BugDoctor : Cleaned with backup (quarantined).
C:\Program Files\Bug Doctor\BugDoctor.exe -> Adware.BugDoctor : Cleaned with backup (quarantined).
C:\Program Files\Bug Doctor\BugDoctorLiveUpdate.exe -> Adware.BugDoctor : Cleaned with backup (quarantined).
C:\Program Files\Bug Doctor\FixedOnThursdayMay042006103713.xml -> Adware.BugDoctor : Cleaned with backup (quarantined).
C:\Program Files\Bug Doctor\FixedOnWednesdayNovember302005140132.xml -> Adware.BugDoctor : Cleaned with backup (quarantined).
C:\Program Files\Bug Doctor\PC Power Suite.url -> Adware.BugDoctor : Cleaned with backup (quarantined).
C:\Program Files\Bug Doctor\skin -> Adware.BugDoctor : Cleaned with backup (quarantined).
C:\Program Files\Bug Doctor\skin.ini -> Adware.BugDoctor : Cleaned with backup (quarantined).
C:\Program Files\Bug Doctor\skin\LiveUpdate_disable.gif -> Adware.BugDoctor : Cleaned with backup (quarantined).
C:\Program Files\Bug Doctor\skin\LiveUpdate_normal.gif -> Adware.BugDoctor : Cleaned with backup (quarantined).
C:\Program Files\Bug Doctor\skin\LiveUpdate_pressed.gif -> Adware.BugDoctor : Cleaned with backup (quarantined).
C:\Program Files\Bug Doctor\skin\LiveUpdate_rollover.gif -> Adware.BugDoctor : Cleaned with backup (quarantined).
C:\Program Files\Bug Doctor\skin\SubMainDisable.gif -> Adware.BugDoctor : Cleaned with backup (quarantined).
C:\Program Files\Bug Doctor\skin\SubMainNormal.gif -> Adware.BugDoctor : Cleaned with backup (quarantined).
C:\Program Files\Bug Doctor\skin\SubMainPressed.gif -> Adware.BugDoctor : Cleaned with backup (quarantined).
C:\Program Files\Bug Doctor\skin\SubMainRollOver.gif -> Adware.BugDoctor : Cleaned with backup (quarantined).
C:\Program Files\Bug Doctor\skin\bug.swf -> Adware.BugDoctor : Cleaned with backup (quarantined).
C:\Program Files\Bug Doctor\skin\fix_complete-disable.gif -> Adware.BugDoctor : Cleaned with backup (quarantined).
C:\Program Files\Bug Doctor\skin\fix_complete-normal.gif -> Adware.BugDoctor : Cleaned with backup (quarantined).
C:\Program Files\Bug Doctor\skin\fix_complete-pressed.gif -> Adware.BugDoctor : Cleaned with backup (quarantined).
C:\Program Files\Bug Doctor\skin\fix_complete-roll_over.gif -> Adware.BugDoctor : Cleaned with backup (quarantined).
C:\Program Files\Bug Doctor\skin\fixing_error-disable.gif -> Adware.BugDoctor : Cleaned with backup (quarantined).
C:\Program Files\Bug Doctor\skin\fixing_error-normal.gif -> Adware.BugDoctor : Cleaned with backup (quarantined).
C:\Program Files\Bug Doctor\skin\fixing_error-pressed.gif -> Adware.BugDoctor : Cleaned with backup (quarantined).
C:\Program Files\Bug Doctor\skin\fixing_error-rollover.gif -> Adware.BugDoctor : Cleaned with backup (quarantined).
C:\Program Files\Bug Doctor\skin\main_disable.jpg -> Adware.BugDoctor : Cleaned with backup (quarantined).
C:\Program Files\Bug Doctor\skin\main_enable.jpg -> Adware.BugDoctor : Cleaned with backup (quarantined).
C:\Program Files\Bug Doctor\skin\main_pressed.jpg -> Adware.BugDoctor : Cleaned with backup (quarantined).
C:\Program Files\Bug Doctor\skin\main_roll_over.jpg -> Adware.BugDoctor : Cleaned with backup (quarantined).
C:\Program Files\Bug Doctor\skin\mask.bmp -> Adware.BugDoctor : Cleaned with backup (quarantined).
C:\Program Files\Bug Doctor\skin\mask1.bmp -> Adware.BugDoctor : Cleaned with backup (quarantined).
C:\Program Files\Bug Doctor\skin\scan.swf -> Adware.BugDoctor : Cleaned with backup (quarantined).
C:\Program Files\Bug Doctor\skin\scan_complete-disable.gif -> Adware.BugDoctor : Cleaned with backup (quarantined).
C:\Program Files\Bug Doctor\skin\scan_complete-normal.gif -> Adware.BugDoctor : Cleaned with backup (quarantined).
C:\Program Files\Bug Doctor\skin\scan_complete-pressed.gif -> Adware.BugDoctor : Cleaned with backup (quarantined).
C:\Program Files\Bug Doctor\skin\scan_complete-roll_over.gif -> Adware.BugDoctor : Cleaned with backup (quarantined).
C:\Program Files\Bug Doctor\skin\scancomplete.gif -> Adware.BugDoctor : Cleaned with backup (quarantined).
C:\Program Files\Bug Doctor\skin\scanning_error-disable.gif -> Adware.BugDoctor : Cleaned with backup (quarantined).
C:\Program Files\Bug Doctor\skin\scanning_error-normal.gif -> Adware.BugDoctor : Cleaned with backup (quarantined).
C:\Program Files\Bug Doctor\skin\scanning_error-pressed.gif -> Adware.BugDoctor : Cleaned with backup (quarantined).
C:\Program Files\Bug Doctor\skin\scanning_error-rollover.gif -> Adware.BugDoctor : Cleaned with backup (quarantined).
C:\Program Files\Bug Doctor\skin\schedule_disable.gif -> Adware.BugDoctor : Cleaned with backup (quarantined).
C:\Program Files\Bug Doctor\skin\schedule_normal.gif -> Adware.BugDoctor : Cleaned with backup (quarantined).
C:\Program Files\Bug Doctor\skin\schedule_pressed.gif -> Adware.BugDoctor : Cleaned with backup (quarantined).
C:\Program Files\Bug Doctor\skin\schedule_rollover.gif -> Adware.BugDoctor : Cleaned with backup (quarantined).
C:\Program Files\Bug Doctor\skin\skin.ini -> Adware.BugDoctor : Cleaned with backup (quarantined).
C:\Program Files\Bug Doctor\skin\support_disable.gif -> Adware.BugDoctor : Cleaned with backup (quarantined).
C:\Program Files\Bug Doctor\skin\support_normal.gif -> Adware.BugDoctor : Cleaned with backup (quarantined).
C:\Program Files\Bug Doctor\skin\support_pressed.gif -> Adware.BugDoctor : Cleaned with backup (quarantined).
C:\Program Files\Bug Doctor\skin\support_rollover.gif -> Adware.BugDoctor : Cleaned with backup (quarantined).
C:\Program Files\Bug Doctor\skin\unlock_key-disable.gif -> Adware.BugDoctor : Cleaned with backup (quarantined).
C:\Program Files\Bug Doctor\skin\unlock_key-normal.gif -> Adware.BugDoctor : Cleaned with backup (quarantined).
C:\Program Files\Bug Doctor\skin\unlock_key-pressed.gif -> Adware.BugDoctor : Cleaned with backup (quarantined).
C:\Program Files\Bug Doctor\skin\unlock_key-roll_over.gif -> Adware.BugDoctor : Cleaned with backup (quarantined).
C:\Program Files\Bug Doctor\unins000.dat -> Adware.BugDoctor : Cleaned with backup (quarantined).
C:\Program Files\Bug Doctor\unins000.exe -> Adware.BugDoctor : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Bug Doctor_is1 -> Adware.BugDoctor : Cleaned with backup (quarantined).
C:\WINDOWS\b136.exe -> Adware.Softomate : Cleaned with backup (quarantined).
E:\download\labels\avery\averylabelprov3.02.exe/keygen.exe -> Adware.Virtumonde : Cleaned with backup (quarantined).
E:\download\labels\avery\patch\install.exe -> Downloader.Agent.bls : Cleaned with backup (quarantined).
E:\download\labels\avery\patch\crack.exe -> Downloader.Nurech.ak : Cleaned with backup (quarantined).
E:\Mijn ontvangen bestanden\lithium15_en.zip/Lithium 1.5.exe -> Not-A-Virus.HackTool.Win32.VB.at : Ignored.
C:\fslrdr\5\[_B_]PROGRAMFILES[_E_]\Mail PassView\mailpv.exe -> Not-A-Virus.PSWTool.Win32.MailPassView.130 : Ignored.
E:\download\paswoorden\paswoorden.zip/pspv.zip/pspv.exe -> Not-A-Virus.PSWTool.Win32.PassView.162 : Ignored.
E:\download\paswoorden\pspv.zip/pspv.exe -> Not-A-Virus.PSWTool.Win32.PassView.162 : Ignored.
E:\download\systeem\netwerk\security\pwdump2-orig.zip/pwdump2.exe -> Not-A-Virus.PSWTool.Win32.PWDump.2 : Ignored.
E:\download\systeem\netwerk\security\pwdump2-orig.zip/samdump.dll -> Not-A-Virus.PSWTool.Win32.PWDump.2 : Ignored.
E:\download\systeem\netwerk\security\pwdump2.zip/pwdump2/samdump.dll -> Not-A-Virus.PSWTool.Win32.PWDump2 : Ignored.
C:\Program Files\LogMeIn\LMIinit.dll -> Not-A-Virus.RemoteAdmin.Win32.RemotelyAnywhere.a : Ignored.
C:\Program Files\LogMeIn\update\2-30-547.bak\LMIinit.dll -> Not-A-Virus.RemoteAdmin.Win32.RemotelyAnywhere.a : Ignored.
C:\WINDOWS\system32\LMIinit.dll -> Not-A-Virus.RemoteAdmin.Win32.RemotelyAnywhere.a : Ignored.
C:\WINDOWS\system32\LMIinit.dll.000.bak -> Not-A-Virus.RemoteAdmin.Win32.RemotelyAnywhere.a : Ignored.
[272] C:\WINDOWS\system32\LMIinit.dll -> Not-A-Virus.RemoteAdmin.Win32.RemotelyAnywhere.a : Ignored.
C:\WINDOWS\system32\drivers\core.sys -> Rootkit.Agent.eq : Cleaned with backup (quarantined).
C:\Documents and Settings\cdrom\Cookies\cdrom@burstnet[1].txt -> TrackingCookie.Burstnet : Cleaned.
C:\Documents and Settings\cdrom\Cookies\cdrom@ads.gamershell[1].txt -> TrackingCookie.Gamershell : Cleaned.
C:\Documents and Settings\cdrom\Cookies\cdrom@gamershell[1].txt -> TrackingCookie.Gamershell : Cleaned.
C:\Documents and Settings\BIB\Cookies\bib@intelli-direct[1].txt -> TrackingCookie.Intelli-direct : Cleaned.
C:\Documents and Settings\BIB\Cookies\bib@search.live[2].txt -> TrackingCookie.Live : Cleaned.
C:\Documents and Settings\BIB\Cookies\bib@search.msn[1].txt -> TrackingCookie.Msn : Cleaned.
C:\Documents and Settings\cdrom\Cookies\cdrom@search.msn[1].txt -> TrackingCookie.Msn : Cleaned.
C:\Documents and Settings\BIB\Cookies\bib@navrcholu[2].txt -> TrackingCookie.Navrcholu : Cleaned.
C:\Documents and Settings\BIB\Cookies\bib@ads.planetactive[1].txt -> TrackingCookie.Planetactive : Cleaned.
C:\Documents and Settings\BIB\Cookies\bib@m.webtrends[1].txt -> TrackingCookie.Webtrends : Cleaned.
C:\Documents and Settings\BIB\Local Settings\Temporary Internet Files\Content.IE5\EZAZ292V\q3q99[1].exe -> Trojan.Dialer.pz : Cleaned with backup (quarantined).
C:\fslrdr\B\S-1-5-21-1292428093-725345543-1801674531-1007\[_B_]CACHE[_E_]\Content.IE5\DB0D5ISW\q3q99[1].exe -> Trojan.Dialer.pz : Cleaned with backup (quarantined).
C:\fslrdr\B\[_B_]WINDIR[_E_]\TEMP\win49E.tmp -> Trojan.Dialer.pz : Cleaned with backup (quarantined).
C:\fslrdr\B\[_B_]WINDIR[_E_]\TEMP\win49F.tmp -> Trojan.Dialer.pz : Cleaned with backup (quarantined).
C:\fslrdr\B\[_B_]WINDIR[_E_]\TEMP\win4A0.tmp -> Trojan.Dialer.pz : Cleaned with backup (quarantined).
C:\fslrdr\B\[_B_]WINDIR[_E_]\TEMP\win4A1.tmp -> Trojan.Dialer.pz : Cleaned with backup (quarantined).


::Report end


Panda Activescan

Incident Status Location

Spyware:Spyware/Virtumonde Not disinfected C:\WINDOWS\system32\qipuibrj.dll
Spyware:Cookie/Advertising Not disinfected C:\Documents and Settings\beheerder\Cookies\beheerder@advertising[1].txt
Spyware:Cookie/Doubleclick Not disinfected C:\Documents and Settings\beheerder\Cookies\beheerder@doubleclick[1].txt
Spyware:Cookie/Mediaplex Not disinfected C:\Documents and Settings\beheerder\Cookies\beheerder@mediaplex[1].txt
Spyware:Cookie/Atwola Not disinfected C:\Documents and Settings\BIB\Cookies\bib@atwola[1].txt
Spyware:Cookie/Xiti Not disinfected C:\Documents and Settings\BIB\Cookies\bib@xiti[1].txt
Spyware:Spyware/Virtumonde Not disinfected C:\Documents and Settings\BIB\Local Settings\Temporary Internet Files\Content.IE5\KLC1EF01\fill[1]
Spyware:Cookie/Beweb Not disinfected C:\Documents and Settings\cdrom\Cookies\cdrom@beweb[2].txt
Spyware:Cookie/Cd Freaks Not disinfected C:\Documents and Settings\cdrom\Cookies\cdrom@cdfreaks[2].txt
Spyware:Cookie/Cd Freaks Not disinfected C:\Documents and Settings\cdrom\Cookies\cdrom@club.cdfreaks[2].txt
Potentially unwanted tool:Application/MailPassView Not disinfected C:\fslrdr\5\[_B_]PROGRAMFILES[_E_]\Mail PassView\mailpv.exe
Security Risk:HackTool/Gendel.A Not disinfected C:\gendel32.exe
Adware:Adware/WinAntivirus2006 Not disinfected C:\WINDOWS\system32\dxvxjtod.dll
Potentially unwanted tool:Application/Processor Not disinfected E:\download\beheer\SmitRem\smitRem\Process.exe
Potentially unwanted tool:Application/Processor Not disinfected E:\download\beheer\smitRem.exe[smitRem/Process.exe]
Potentially unwanted tool:Application/Pskill.E Not disinfected E:\download\beheer\win2k\Pstools.zip[pskill.exe]
Potentially unwanted tool:Application/MailPassView Not disinfected E:\download\paswoorden\mailpv_setup.exe[mailpv.exe]
Hacktool:Hacktool/Passview.E Not disinfected E:\download\paswoorden\paswoorden.zip[pspv.zip][pspv.exe]
Potentially unwanted tool:Application/MailPassView Not disinfected E:\download\paswoorden\paswoorden.zip[mailpv_setup.exe][mailpv.exe]
Hacktool:Hacktool/MSNPass.F Not disinfected E:\download\paswoorden\paswoorden.zip[mspass_setup.exe][mspass.exe]
Hacktool:Hacktool/Passview.E Not disinfected E:\download\paswoorden\pspv.zip[pspv.exe]
Hacktool:HackTool/Samdump Not disinfected E:\download\systeem\netwerk\security\pwdump2.zip[pwdump2/pwdump2.exe]
Hacktool:HackTool/Samdump Not disinfected E:\download\systeem\netwerk\security\pwdump2.zip[pwdump2/samdump.dll]
Hacktool:HackTool Program.VA Not disinfected E:\Mijn ontvangen bestanden\lithium15_en.zip[Lithium 1.5.exe]
Hacktool:Exploit/iFrame Not disinfected Lokale mappen\Archief\2003\Reactie vanop website
Hacktool:Hacktool/RegPatch.A Not disinfected Lokale mappen\Verzonden items\2003\Alcohol Software is DVD - CD burning software. CD & DVD burner, recorder and ri\Alcohol_120%_v1[1].4.6_build_711.zip[REGPATCH.EXE]


Logfile of HijackThis v1.99.1
Scan saved at 11:33:33, on 22/05/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16441)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Altiris\AClient\AClient.exe
C:\Program Files\Altiris\Altiris Agent\AeXNSAgent.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\system32\ccsrvc.exe
C:\Program Files\Altiris\Carbon Copy\shellker.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\PROGRA~1\Symantec\NORTON~1\GHOSTS~2.EXE
C:\Program Files\LogMeIn\RaMaint.exe
C:\Program Files\LogMeIn\LogMeIn.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Novell\ZENworks\nalntsrv.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Novell\ZENworks\RemoteManagement\RMAgent\WolSerNT.exe
C:\Program Files\Novell\ZENworks\RemoteManagement\RMAgent\ZenRem32.exe
C:\Program Files\Symantec AntiVirus\SavRoam.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\Novell\ZENworks\wm.exe
C:\Program Files\Novell\ZENworks\WMRUNDLL.EXE
C:\PROGRA~1\Altiris\CARBON~1\client.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\dpmw32.exe
C:\WINDOWS\system32\NWTRAY.EXE
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\eBay\eBay Toolbar2\eBayTBDaemon.exe
C:\Program Files\LogMeIn\LogMeInSystray.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~2\VPTray.exe
C:\Program Files\Altiris\AClient\AClntUsr.EXE
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\AWS\WeatherBug\WeatherBug.exe
C:\Program Files\Ashampoo\Ashampoo UnInstaller Platinum Suite\UIWatcher.exe
C:\Program Files\Copernic Desktop Search 2\DesktopSearchService.exe
C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe
C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
C:\Program Files\Ceterm\warftpd\warftpd.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\RoboForm.dll
O3 - Toolbar: eBay Toolbar - {92085AD4-F48A-450D-BD93-B28CC7DF67CE} - C:\Program Files\eBay\eBay Toolbar2\eBayTB.dll
O3 - Toolbar: Ultra Recall - {C501607C-4A98-4f5e-B9AF-425E6BBD5186} - C:\Program Files\UltraRecall\Integration\IEToolbar.dll
O3 - Toolbar: del.icio.us - {981FE6A8-260C-4930-960F-C3BC82746CB0} - C:\Program Files\del.icio.us\Internet Explorer Buttons\dlcsIE.dll
O3 - Toolbar: Google Kladblok - {CCCCCCDB-4DDB-4703-95D4-DD2C526397BF} - C:\Program Files\Google\Google Notebook\gnotes1.0.2.19-998656871.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NDPS] C:\WINDOWS\system32\dpmw32.exe
O4 - HKLM\..\Run: [NWTRAY] NWTRAY.EXE
O4 - HKLM\..\Run: [ZENRC Tray Icon] C:\WINDOWS\System32\zentray.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Synchronization Manager] %SystemRoot%\system32\mobsync.exe /logon
O4 - HKLM\..\Run: [eBayToolbar] C:\Program Files\eBay\eBay Toolbar2\eBayTBDaemon.exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [LogMeIn GUI] "C:\Program Files\LogMeIn\LogMeInSystray.exe"
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [AeXAgentLogon] C:\Program Files\Altiris\Altiris Agent\AeXAgentActivate.exe /logon
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~2\VPTray.exe
O4 - HKLM\..\Run: [AClntUsr] C:\Program Files\Altiris\AClient\AClntUsr.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [setup] rundll32.exe "C:\WINDOWS\system32\qipuibrj.dll",realset
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [WeatherBug] C:\Program Files\AWS\WeatherBug\WeatherBug.exe
O4 - HKCU\..\Run: [C:\Program Files\qliner\quotes\quotes.exe] C:\Program Files\qliner\quotes\quotes.exe
O4 - HKCU\..\Run: [UIWatcher] C:\Program Files\Ashampoo\Ashampoo UnInstaller Platinum Suite\UIWatcher.exe
O4 - HKCU\..\Run: [Copernic Desktop Search 2] "C:\Program Files\Copernic Desktop Search 2\DesktopSearchService.exe" /tray
O4 - HKCU\..\Run: [RoboForm] "C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe"
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: warftpd.lnk = C:\Program Files\Ceterm\warftpd\warftpd.exe
O8 - Extra context menu item: &eBay Search - res://C:\Program Files\eBay\eBay Toolbar2\eBayTb.dll/RCSearch.html
O8 - Extra context menu item: Deze pagina noteren (Google Kladblok) - res://C:\Program Files\Google\Google Notebook\gnotes1.0.2.19-998656871.dll/gn_menu1.html
O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Formulieren opslaan - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O8 - Extra context menu item: Invul Formulieren - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O8 - Extra context menu item: Menu aanpassen - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
O8 - Extra context menu item: Noteren (Google Kladblok) - res://C:\Program Files\Google\Google Notebook\gnotes1.0.2.19-998656871.dll/gn_menu2.html
O8 - Extra context menu item: RoboForm Werkbalk - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O8 - Extra context menu item: Send To &Ultra Recall (copy) - C:\Program Files\UltraRecall\Integration\StoreFromIE.html
O8 - Extra context menu item: Send To Ultra &Recall (link) - C:\Program Files\UltraRecall\Integration\LinkFromIE.html
O8 - Extra context menu item: TypePad QuickPost - https://www.typepad.com/t/app?__mode=re ... height=540
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Copy to Ultra Recall - {24187A0F-0FDD-411b-80C6-F1F22F2ED10E} - C:\Program Files\UltraRecall\Integration\IEToolbar.dll
O9 - Extra button: Formulier Invullen - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra 'Tools' menuitem: Invul Formulieren - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra button: Opslaan - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra 'Tools' menuitem: Formulieren opslaan - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra 'Tools' menuitem: RoboForm Werkbalk - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra button: Onderzoekscentrum - {9455301C-CF6B-11D3-A266-00C04F689C50} - C:\Program Files\Common Files\Microsoft Shared\Encarta Researcher\EROPROJ.DLL
O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Common Files\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: Novell delivered applications - {C1994287-422F-47aa-8E5E-6323E210A125} - C:\Program Files\Novell\ZENworks\AxNalServer.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Link to Ultra Recall - {FD1FF307-68BC-462f-8718-AAEDB6DB7EA2} - C:\Program Files\UltraRecall\Integration\IEToolbar.dll
O9 - Extra button: Copy to Ultra Recall - {24187A0F-0FDD-411b-80C6-F1F22F2ED10E} - C:\Program Files\UltraRecall\Integration\IEToolbar.dll (HKCU)
O9 - Extra button: Link to Ultra Recall - {FD1FF307-68BC-462f-8718-AAEDB6DB7EA2} - C:\Program Files\UltraRecall\Integration\IEToolbar.dll (HKCU)
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.mail.live.com/mail/w1/resou ... NPUpld.cab
O16 - DPF: {88D969C0-F192-11D4-A65F-0040963251E5} (XML DOM Document 4.0) - file://C:\WINDOWS\msxml4.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan ... asinst.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = brugge.be
O17 - HKLM\Software\..\Telephony: DomainName = brugge.be
O17 - HKLM\System\CCS\Services\Tcpip\..\{56EC7780-E6FA-4632-8F52-F5CFB7877831}: NameServer = 10.132.69.51,10.132.69.52
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = brugge.be
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = brugge.be
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - AppInit_DLLs: AMINIT.dll
O23 - Service: Altiris Client Service (AClient) - Altiris, Inc. - C:\Program Files\Altiris\AClient\AClient.exe
O23 - Service: Altiris Agent (AeXNSClient) - Altiris, Inc. - C:\Program Files\Altiris\Altiris Agent\AeXNSAgent.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Altiris Carbon Copy (CarbonCopy32) - Altiris - C:\WINDOWS\system32\ccsrvc.exe
O23 - Service: Carbon Copy Scheduler (CarbonCopyScheduler) - Altiris - C:\WINDOWS\system32\schdsrvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Client Update Service for Novell (cusrvc) - Novell, Inc. - C:\WINDOWS\System32\cusrvc.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: GhostStartService - Symantec Corporation - C:\PROGRA~1\Symantec\NORTON~1\GHOSTS~2.EXE
O23 - Service: LogMeIn Maintenance Service (LMIMaint) - LogMeIn, Inc. - C:\Program Files\LogMeIn\RaMaint.exe
O23 - Service: LogMeIn - LogMeIn, Inc. - C:\Program Files\LogMeIn\LogMeIn.exe
O23 - Service: Novell Application Launcher (NALNTSERVICE) - Novell, Inc. - C:\Program Files\Novell\ZENworks\nalntsrv.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Novell ZfD Wake on LAN Status Agent (Prometheus Wake-On-LAN Status Agent) - Novell Inc. - C:\Program Files\Novell\ZENworks\RemoteManagement\RMAgent\WolSerNT.exe
O23 - Service: Novell ZfD Remote Management (Remote Management Agent) - Novell Inc. - C:\Program Files\Novell\ZENworks\RemoteManagement\RMAgent\ZenRem32.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
O23 - Service: Workstation Manager (ZFDWM) - Novell, INC. - C:\Program Files\Novell\ZENworks\wm.exe

Thanks for your help!
Fonzieboy
Active Member
 
Posts: 2
Joined: May 22nd, 2007, 5:41 am
Advertisement
Register to Remove

Unread postby Blade81 » May 22nd, 2007, 10:38 am

Hi and welcome to the Board

I'm Blade and I am going to try to help you with your problem. Please take a note of five things.

  1. I will start working on your Malware issues, this may or may not, solve other issues you have with your machine.
  2. The fixes are specific to your problem and should only be used for this issue on this machine
  3. The process is not instant. Please continue to review my answers until I tell you your machine is clear. Absence of symptoms does not mean that everything is clear.
  4. If you don't know, stop and ask! Don't keep going on.
  5. Please reply to this thread. Do not start a new topic.


First rename your HijackThis.exe file -> scanner.exe to make hiding malware entries visible.


After that please download
VundoFix.exe
to your desktop.
  • Double-click VundoFix.exe to run it.
  • Click the Scan for Vundo button.
  • Once it's done scanning, click the Remove Vundo button.
  • You will receive a prompt asking if you want to remove the files,
    click YES
  • Once you click yes, your desktop will go blank as it starts removing
    Vundo.
  • When completed, it will prompt that it will reboot your computer,
    click OK.
  • Please post the contents of C:\vundofix.txt and a new
    HiJackThis log.

Note: It is possible that VundoFix encountered a file it could not remove.
In this case, VundoFix will run on reboot, simply follow the above
instructions starting from
Click the Scan for Vundo button when VundoFix appears at reboot.
User avatar
Blade81
Admin/Teacher
Admin/Teacher
 
Posts: 5245
Joined: July 17th, 2006, 3:36 am
Location: Finland

Log Vundo and Hijack

Unread postby Fonzieboy » May 24th, 2007, 5:48 am

Hi there,

Thanks for your help.

I had to run Vundofix 3 times but still all the files could not be deleted. Should I run it again?

These are the reports:


VundoFix V6.4.1

Checking Java version...

Scan started at 11:12:02 23/05/2007

Listing files found while scanning....

C:\WINDOWS\system32\awtqp.dll
C:\WINDOWS\system32\dxvxjtod.dll
C:\WINDOWS\system32\ehkmp.bak1
C:\WINDOWS\system32\ehkmp.bak2
C:\WINDOWS\system32\ehkmp.ini
C:\WINDOWS\system32\ehkmp.ini2
C:\WINDOWS\system32\ehkmp.tmp
C:\WINDOWS\system32\fcccdcd.dll
C:\WINDOWS\system32\fgnmsrqq.dll
C:\WINDOWS\system32\jrbiupiq.ini
C:\WINDOWS\system32\nchrqodb.dll
C:\WINDOWS\system32\oqtss.bak1
C:\WINDOWS\system32\oqtss.ini
C:\WINDOWS\system32\oqtss.tmp
C:\WINDOWS\system32\pmkhe.dll
C:\WINDOWS\system32\pqtwa.ini
C:\WINDOWS\system32\qipuibrj.dll
C:\WINDOWS\system32\sstqo.dll

Beginning removal...

Attempting to delete C:\WINDOWS\system32\awtqp.dll
C:\WINDOWS\system32\awtqp.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\dxvxjtod.dll
C:\WINDOWS\system32\dxvxjtod.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\ehkmp.bak1
C:\WINDOWS\system32\ehkmp.bak1 Has been deleted!

Attempting to delete C:\WINDOWS\system32\ehkmp.bak2
C:\WINDOWS\system32\ehkmp.bak2 Has been deleted!

Attempting to delete C:\WINDOWS\system32\ehkmp.ini
C:\WINDOWS\system32\ehkmp.ini Has been deleted!

Attempting to delete C:\WINDOWS\system32\ehkmp.ini2
C:\WINDOWS\system32\ehkmp.ini2 Has been deleted!

Attempting to delete C:\WINDOWS\system32\ehkmp.tmp
C:\WINDOWS\system32\ehkmp.tmp Has been deleted!

Attempting to delete C:\WINDOWS\system32\fcccdcd.dll
C:\WINDOWS\system32\fcccdcd.dll Could not be deleted.

Attempting to delete C:\WINDOWS\system32\fgnmsrqq.dll
C:\WINDOWS\system32\fgnmsrqq.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\jrbiupiq.ini
C:\WINDOWS\system32\jrbiupiq.ini Has been deleted!

Attempting to delete C:\WINDOWS\system32\nchrqodb.dll
C:\WINDOWS\system32\nchrqodb.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\oqtss.bak1
C:\WINDOWS\system32\oqtss.bak1 Has been deleted!

Attempting to delete C:\WINDOWS\system32\oqtss.ini
C:\WINDOWS\system32\oqtss.ini Has been deleted!

Attempting to delete C:\WINDOWS\system32\oqtss.tmp
C:\WINDOWS\system32\oqtss.tmp Has been deleted!

Attempting to delete C:\WINDOWS\system32\pmkhe.dll
C:\WINDOWS\system32\pmkhe.dll Could not be deleted.

Attempting to delete C:\WINDOWS\system32\pqtwa.ini
C:\WINDOWS\system32\pqtwa.ini Has been deleted!

Attempting to delete C:\WINDOWS\system32\qipuibrj.dll
C:\WINDOWS\system32\qipuibrj.dll Could not be deleted.

Attempting to delete C:\WINDOWS\system32\sstqo.dll
C:\WINDOWS\system32\sstqo.dll Has been deleted!

Performing Repairs to the registry.
Done!

VundoFix V6.4.1

Checking Java version...

Scan started at 13:25:23 23/05/2007

Listing files found while scanning....

C:\WINDOWS\system32\ehkmp.ini
C:\WINDOWS\system32\ehkmp.ini2
C:\WINDOWS\system32\fcccdcd.dll
C:\WINDOWS\system32\fidijjqu.dll
C:\WINDOWS\system32\jrbiupiq.ini
C:\WINDOWS\system32\pmkhe.dll
C:\WINDOWS\system32\qipuibrj.dll
C:\WINDOWS\system32\tkqgrcpd.dll
C:\WINDOWS\system32\uqjjidif.ini

Beginning removal...

Attempting to delete C:\WINDOWS\system32\ehkmp.ini
C:\WINDOWS\system32\ehkmp.ini Has been deleted!

Attempting to delete C:\WINDOWS\system32\ehkmp.ini2
C:\WINDOWS\system32\ehkmp.ini2 Has been deleted!

Attempting to delete C:\WINDOWS\system32\fcccdcd.dll
C:\WINDOWS\system32\fcccdcd.dll Could not be deleted.

Attempting to delete C:\WINDOWS\system32\fidijjqu.dll
C:\WINDOWS\system32\fidijjqu.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\jrbiupiq.ini
C:\WINDOWS\system32\jrbiupiq.ini Has been deleted!

Attempting to delete C:\WINDOWS\system32\pmkhe.dll
C:\WINDOWS\system32\pmkhe.dll Could not be deleted.

Attempting to delete C:\WINDOWS\system32\qipuibrj.dll
C:\WINDOWS\system32\qipuibrj.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\tkqgrcpd.dll
C:\WINDOWS\system32\tkqgrcpd.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\uqjjidif.ini
C:\WINDOWS\system32\uqjjidif.ini Has been deleted!

Performing Repairs to the registry.
Done!


Logfile of HijackThis v1.99.1
Scan saved at 11:44:31, on 24/05/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16441)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Altiris\AClient\AClient.exe
C:\Program Files\Altiris\Altiris Agent\AeXNSAgent.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\system32\ccsrvc.exe
C:\Program Files\Altiris\Carbon Copy\shellker.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\PROGRA~1\Symantec\NORTON~1\GHOSTS~2.EXE
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Novell\ZENworks\nalntsrv.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Novell\ZENworks\RemoteManagement\RMAgent\WolSerNT.exe
C:\Program Files\Novell\ZENworks\RemoteManagement\RMAgent\ZenRem32.exe
C:\Program Files\Symantec AntiVirus\SavRoam.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\Novell\ZENworks\wm.exe
C:\Program Files\Novell\ZENworks\WMRUNDLL.EXE
C:\PROGRA~1\Altiris\CARBON~1\client.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\dpmw32.exe
C:\WINDOWS\system32\NWTRAY.EXE
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\eBay\eBay Toolbar2\eBayTBDaemon.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~2\VPTray.exe
C:\Program Files\Altiris\AClient\AClntUsr.EXE
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\AWS\WeatherBug\WeatherBug.exe
C:\Program Files\Ashampoo\Ashampoo UnInstaller Platinum Suite\UIWatcher.exe
C:\Program Files\Copernic Desktop Search 2\DesktopSearchService.exe
C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe
C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
C:\Program Files\Ceterm\warftpd\warftpd.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE
C:\Program Files\EssentialPIM\EssentialPIM.exe
C:\Program Files\Outlook Express\msimn.exe
C:\PROGRA~1\VUBISS~1\v4w.exe
C:\Program Files\Microsoft Office\Office10\MSACCESS.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\HijackThis\scanner.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {162D8675-9403-4727-AA79-F00C2B9C187E} - C:\WINDOWS\system32\fcccdcd.dll
O2 - BHO: eBay Toolbar Helper - {22D8E815-4A5E-4DFB-845E-AAB64207F5BD} - C:\Program Files\eBay\eBay Toolbar2\eBayTB.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {55DB983C-BDBF-426f-86F0-187B02DDA39B} - C:\WINDOWS\system32\wokxfvkg.dll
O2 - BHO: (no name) - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\RoboForm.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: del.icio.us Toolbar Helper - {7AA07AE6-01EF-44EC-93CA-9D7CD41CCDB6} - C:\Program Files\del.icio.us\Internet Explorer Buttons\dlcsIE.dll
O2 - BHO: (no name) - {8CEC54B7-54B0-444E-82A7-80B10DB8AC77} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {AA108736-910A-4801-B933-FFB6B97E3214} - C:\WINDOWS\system32\pmkhe.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: &Google Notebook - {CCCCCCD3-666F-4F81-8B69-745DE9F6D897} - C:\Program Files\Google\Google Notebook\gnotes1.0.2.19-998656871.dll
O2 - BHO: (no name) - {D1159422-16E3-462F-A93D-FB718E100407} - C:\WINDOWS\system32\d4xofa.dll (file missing)
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\RoboForm.dll
O3 - Toolbar: eBay Toolbar - {92085AD4-F48A-450D-BD93-B28CC7DF67CE} - C:\Program Files\eBay\eBay Toolbar2\eBayTB.dll
O3 - Toolbar: Ultra Recall - {C501607C-4A98-4f5e-B9AF-425E6BBD5186} - C:\Program Files\UltraRecall\Integration\IEToolbar.dll
O3 - Toolbar: del.icio.us - {981FE6A8-260C-4930-960F-C3BC82746CB0} - C:\Program Files\del.icio.us\Internet Explorer Buttons\dlcsIE.dll
O3 - Toolbar: Google Kladblok - {CCCCCCDB-4DDB-4703-95D4-DD2C526397BF} - C:\Program Files\Google\Google Notebook\gnotes1.0.2.19-998656871.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NDPS] C:\WINDOWS\system32\dpmw32.exe
O4 - HKLM\..\Run: [NWTRAY] NWTRAY.EXE
O4 - HKLM\..\Run: [ZENRC Tray Icon] C:\WINDOWS\System32\zentray.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Synchronization Manager] %SystemRoot%\system32\mobsync.exe /logon
O4 - HKLM\..\Run: [eBayToolbar] C:\Program Files\eBay\eBay Toolbar2\eBayTBDaemon.exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [AeXAgentLogon] C:\Program Files\Altiris\Altiris Agent\AeXAgentActivate.exe /logon
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~2\VPTray.exe
O4 - HKLM\..\Run: [AClntUsr] C:\Program Files\Altiris\AClient\AClntUsr.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [setup] rundll32.exe "C:\WINDOWS\system32\eimxaeds.dll",realset
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [WeatherBug] C:\Program Files\AWS\WeatherBug\WeatherBug.exe
O4 - HKCU\..\Run: [C:\Program Files\qliner\quotes\quotes.exe] C:\Program Files\qliner\quotes\quotes.exe
O4 - HKCU\..\Run: [UIWatcher] C:\Program Files\Ashampoo\Ashampoo UnInstaller Platinum Suite\UIWatcher.exe
O4 - HKCU\..\Run: [Copernic Desktop Search 2] "C:\Program Files\Copernic Desktop Search 2\DesktopSearchService.exe" /tray
O4 - HKCU\..\Run: [RoboForm] "C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe"
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: warftpd.lnk = C:\Program Files\Ceterm\warftpd\warftpd.exe
O8 - Extra context menu item: &eBay Search - res://C:\Program Files\eBay\eBay Toolbar2\eBayTb.dll/RCSearch.html
O8 - Extra context menu item: Deze pagina noteren (Google Kladblok) - res://C:\Program Files\Google\Google Notebook\gnotes1.0.2.19-998656871.dll/gn_menu1.html
O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Formulieren opslaan - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O8 - Extra context menu item: Invul Formulieren - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O8 - Extra context menu item: Menu aanpassen - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
O8 - Extra context menu item: Noteren (Google Kladblok) - res://C:\Program Files\Google\Google Notebook\gnotes1.0.2.19-998656871.dll/gn_menu2.html
O8 - Extra context menu item: RoboForm Werkbalk - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O8 - Extra context menu item: Send To &Ultra Recall (copy) - C:\Program Files\UltraRecall\Integration\StoreFromIE.html
O8 - Extra context menu item: Send To Ultra &Recall (link) - C:\Program Files\UltraRecall\Integration\LinkFromIE.html
O8 - Extra context menu item: TypePad QuickPost - https://www.typepad.com/t/app?__mode=re ... height=540
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Copy to Ultra Recall - {24187A0F-0FDD-411b-80C6-F1F22F2ED10E} - C:\Program Files\UltraRecall\Integration\IEToolbar.dll
O9 - Extra button: Formulier Invullen - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra 'Tools' menuitem: Invul Formulieren - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra button: Opslaan - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra 'Tools' menuitem: Formulieren opslaan - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra 'Tools' menuitem: RoboForm Werkbalk - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra button: Onderzoekscentrum - {9455301C-CF6B-11D3-A266-00C04F689C50} - C:\Program Files\Common Files\Microsoft Shared\Encarta Researcher\EROPROJ.DLL
O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Common Files\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: Novell delivered applications - {C1994287-422F-47aa-8E5E-6323E210A125} - C:\Program Files\Novell\ZENworks\AxNalServer.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Link to Ultra Recall - {FD1FF307-68BC-462f-8718-AAEDB6DB7EA2} - C:\Program Files\UltraRecall\Integration\IEToolbar.dll
O9 - Extra button: Copy to Ultra Recall - {24187A0F-0FDD-411b-80C6-F1F22F2ED10E} - C:\Program Files\UltraRecall\Integration\IEToolbar.dll (HKCU)
O9 - Extra button: Link to Ultra Recall - {FD1FF307-68BC-462f-8718-AAEDB6DB7EA2} - C:\Program Files\UltraRecall\Integration\IEToolbar.dll (HKCU)
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.mail.live.com/mail/w1/resou ... NPUpld.cab
O16 - DPF: {88D969C0-F192-11D4-A65F-0040963251E5} (XML DOM Document 4.0) - file://C:\WINDOWS\msxml4.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan ... asinst.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = brugge.be
O17 - HKLM\Software\..\Telephony: DomainName = brugge.be
O17 - HKLM\System\CCS\Services\Tcpip\..\{56EC7780-E6FA-4632-8F52-F5CFB7877831}: NameServer = 10.132.69.51,10.132.69.52
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = brugge.be
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = brugge.be
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - AppInit_DLLs: AMINIT.dll
O20 - Winlogon Notify: fcccdcd - C:\WINDOWS\SYSTEM32\fcccdcd.dll
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\system32\NavLogon.dll
O20 - Winlogon Notify: pmkhe - C:\WINDOWS\system32\pmkhe.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O20 - Winlogon Notify: winjvd32 - winjvd32.dll (file missing)
O20 - Winlogon Notify: wudb - C:\WINDOWS\system32\wudb.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Altiris Client Service (AClient) - Altiris, Inc. - C:\Program Files\Altiris\AClient\AClient.exe
O23 - Service: Altiris Agent (AeXNSClient) - Altiris, Inc. - C:\Program Files\Altiris\Altiris Agent\AeXNSAgent.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Altiris Carbon Copy (CarbonCopy32) - Altiris - C:\WINDOWS\system32\ccsrvc.exe
O23 - Service: Carbon Copy Scheduler (CarbonCopyScheduler) - Altiris - C:\WINDOWS\system32\schdsrvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Client Update Service for Novell (cusrvc) - Novell, Inc. - C:\WINDOWS\System32\cusrvc.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: GhostStartService - Symantec Corporation - C:\PROGRA~1\Symantec\NORTON~1\GHOSTS~2.EXE
O23 - Service: Novell Application Launcher (NALNTSERVICE) - Novell, Inc. - C:\Program Files\Novell\ZENworks\nalntsrv.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Novell ZfD Wake on LAN Status Agent (Prometheus Wake-On-LAN Status Agent) - Novell Inc. - C:\Program Files\Novell\ZENworks\RemoteManagement\RMAgent\WolSerNT.exe
O23 - Service: Novell ZfD Remote Management (Remote Management Agent) - Novell Inc. - C:\Program Files\Novell\ZENworks\RemoteManagement\RMAgent\ZenRem32.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
O23 - Service: Workstation Manager (ZFDWM) - Novell, INC. - C:\Program Files\Novell\ZENworks\wm.exe
Fonzieboy
Active Member
 
Posts: 2
Joined: May 22nd, 2007, 5:41 am

Unread postby Blade81 » May 24th, 2007, 10:42 am

  • Launch AVG Anti-Spyware.
  • On the main screen under Your Computer's security.
    • Click on Change state next to Resident shield. It should now change to inactive.
    • Click on Change state next to Automatic updates. It should now change to inactive.
    • Next to Last Update, click on Update now. (You will need an active internet connection to perform this)
    • Wait until you see the Update succesfull message.
  • Right-click the AVG Anti-Spyware Tray Icon and uncheck Start with Windows.
  • Right-click the AVG Anti-Spyware Tray Icon and select Exit. Confirm by clicking Yes.
If you are having problems with the updater, you can use this link to manually update ewido.
AVG Anti-Spyware manual updates.
Download the Full database to your Desktop or to your usual Download Folder and install it by double clicking the file. Make sure that AVG Anti-Spyware is closed before installing the update. Don't run AVG yet. Will do it a bit later.


Download ATF (Atribune Temp File) Cleaner© by Atribune to your desktop. Don't run ATF yet. Will do it a bit later.



  • Double-click VundoFix.exe to run it.
  • Click the Scan for Vundo button.
  • Once the scan is complete, Right Click inside the listbox (white box) and click add more files
  • Copy&Paste the 2 entries below into the top 2 boxes
  • C:\WINDOWS\system32\fcccdcd.dll
  • C:\WINDOWS\system32\dcdcccf.*
  • Click Add Files and Click Close Window
  • Repeat with these entries
  • C:\WINDOWS\system32\pmkhe.dll
  • C:\WINDOWS\system32\ehkmp.*
  • C:\WINDOWS\system32\qipuibrj.dll
  • C:\WINDOWS\system32\jrbiupiq.*
  • C:\WINDOWS\system32\wokxfvkg.dll
  • C:\WINDOWS\system32\gkvfxkow.*
  • Click the Remove Vundo button.
  • You will receive a prompt asking if you want to remove the files, click YES
  • Once you click yes, your desktop will go blank as it starts removing Vundo.
  • When completed, it will prompt that it will reboot your computer, click OK.
  • Please post the contents of C:\vundofix.txt.
Note: It is possible that VundoFix encountered a file it could not remove.
In this case, VundoFix will run on reboot, simply follow the above instructions starting from
Click the Scan for Vundo button when VundoFix appears at reboot.

Start hjt, click do a system scan only, check (if found):
O2 - BHO: (no name) - {162D8675-9403-4727-AA79-F00C2B9C187E} - C:\WINDOWS\system32\fcccdcd.dll
O2 - BHO: (no name) - {55DB983C-BDBF-426f-86F0-187B02DDA39B} - C:\WINDOWS\system32\wokxfvkg.dll
O2 - BHO: (no name) - {8CEC54B7-54B0-444E-82A7-80B10DB8AC77} - (no file)
O2 - BHO: (no name) - {AA108736-910A-4801-B933-FFB6B97E3214} - C:\WINDOWS\system32\pmkhe.dll
O2 - BHO: (no name) - {D1159422-16E3-462F-A93D-FB718E100407} - C:\WINDOWS\system32\d4xofa.dll (file missing)
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [setup] rundll32.exe "C:\WINDOWS\system32\eimxaeds.dll",realset
O20 - Winlogon Notify: fcccdcd - C:\WINDOWS\SYSTEM32\fcccdcd.dll
O20 - Winlogon Notify: pmkhe - C:\WINDOWS\system32\pmkhe.dll
O20 - Winlogon Notify: winjvd32 - winjvd32.dll (file missing)
O20 - Winlogon Notify: wudb - C:\WINDOWS\system32\wudb.dll

Close all browsers and other windows. Click fix checked.



==============================

Reboot into safe mode (press F8 before Windows' loading screen and select safe mode)


Show hidden files
-----------------
* Click Start.
* Open My Computer.
* Select the Tools menu and click Folder Options.
* Select the View Tab.
* Under the Hidden files and folders heading select Show hidden files and folders.
* Uncheck the Hide protected operating system files (recommended) option.
* Click Yes to confirm.
* Click OK.


Deleting files
------------------------

Delete following files (if found):
C:\WINDOWS\SYSTEM32\fcccdcd.dll
C:\WINDOWS\SYSTEM32\wokxfvkg.dll
C:\WINDOWS\SYSTEM32\pmkhe.dll
C:\WINDOWS\SYSTEM32\eimxaeds.dll
C:\WINDOWS\SYSTEM32\wudb.dll




Running temp cleaner & AVG Anti-Spyware
---------------------------------------



Double-click ATF Cleaner.exe to open it

Under Main choose:
Windows Temp
Current User Temp
All Users Temp
Cookies
Temporary Internet Files
Prefetch
Java Cache

*The other boxes are optional*
Then click the Empty Selected button.

Firefox:
Click Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click NO at the prompt.

Opera:
Click Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click NO at the prompt.

Click Exit on the Main menu to close the program.



Close ALL open Windows / Programs / Folders. Please start AVG Anti-Spyware and run a full scan.
  • Click on Scanner on the toolbar.
  • Click on the Settings tab.
    • Under How to act?
      • Click on Recommended Action and choose Quarantine from the popup menu.
    • Under How to scan?
      • All checkboxes should be ticked.
    • Under Possibly unwanted software:
      • All checkboxes should be ticked.
    • Under Reports:
      • Select Automatically generate report after every scan and uncheck Only if threats were found.
    • Under What to scan?
      • Select Scan every file.
  • Click on the Scan tab.
  • Click on Complete System Scan to start the scan process.
  • Let the program scan the machine.
  • When the scan has finished, follow the instructions below.
    IMPORTANT : Don't click on the
    Save Scan Report
    button before you did hit the
    Apply all Actions
    button.

    • Make sure that Set all elements to: shows Quarantine (1), if not click on the link and choose Quarantine from the popup menu. (2)
    • At the bottom of the window click on the Apply all Actions button. (3)
      Image
  • When done, click the Save Scan Report button. (4)
    • Click the Save Report as button.
    • Save the report to your Desktop.
  • Right-click the AVG Anti-Spyware Tray Icon and select Exit. Confirm by clicking Yes.
Reboot in Normal Mode.


Post contents of C:\vundofix.txt, AVG Anti-Spyware log & a fresh HJT log.
User avatar
Blade81
Admin/Teacher
Admin/Teacher
 
Posts: 5245
Joined: July 17th, 2006, 3:36 am
Location: Finland

Unread postby NonSuch » June 4th, 2007, 12:52 pm

This topic is now closed due to inactivity. If you wish it reopened, please send us an email to 'admin at malwareremoval.com' with a link to your thread.

You can help support this site from this link :
Donations For Malware Removal

Please do not contact us if you are not the topic starter. A valid, working link to the closed topic is required along with the user name used. If the user name does not match the one in the thread linked, the email will be deleted.
User avatar
NonSuch
Administrator
Administrator
 
Posts: 28747
Joined: February 23rd, 2005, 7:08 am
Location: California
Advertisement
Register to Remove


Return to Infected? Virus, malware, adware, ransomware, oh my!



Who is online

Users browsing this forum: No registered users and 478 guests

Contact us:

Advertisements do not imply our endorsement of that product or service. Register to remove all ads. The forum is run by volunteers who donate their time and expertise. We make every attempt to ensure that the help and advice posted is accurate and will not cause harm to your computer. However, we do not guarantee that they are accurate and they are to be used at your own risk. All trademarks are the property of their respective owners.

Member site: UNITE Against Malware