Infected-shyam.com.np malware

[GeniusMagic]

Hi - My dad's computer seems to be infected with some malware.
Whenever I start internet explorer, it defaults to some "shyam.com.np" website. I do not recognise this website. I downoaded hijcak this and I found some entries pertaining to "shyam.com " and I fixed them and restarted the machine. But to my horror as soon as I started IE again- it went to the same malicious website. This computer has been acting slow and I am not sure if it has any more malware besides the one above. Pls find a fresh Hijack this log. Look forward to your help :

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:10:28 PM, on 9/9/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
C:\WINDOWS\system32\wscript.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\VM303_STI.EXE
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/def ... earch.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/def ... .yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://shyam.com.np/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/def ... earch.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/def ... .yahoo.com
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://google.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = shyam.com.np
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\wscript.exe C:\WINDOWS\system32\VirusRemoval.vbs
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O4 - HKLM\..\Run: [BigDog303] C:\WINDOWS\VM303_STI.EXE QHM500LM USB PC Camera
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Messenger (Yahoo!)] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [Search Protection] C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{974F08AD-B91F-409C-971B-97D63C745665}: NameServer = 203.94.243.70,203.94.227.70
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Yahoo! Updater (YahooAUService) - Yahoo! Inc. - C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe

--
End of file - 3777 bytes

[MWR 3 day Mod]

Hi,

We are sorry to see your topic is over three days old and no one has yet been able to respond and offer help.

If you still require assistance, please post a link to your topic in our Waiting for help with malware removal? forum, and our staff will make an effort to assist you as promptly as possible. Only post a LINK to this topic, DO NOT post your DDS log!

Please do not reply to this topic.

If you haven't posted within two days in the "Waiting for help with malware removal?" forum, we will assume you have been able to get assistance in other ways and this topic will be closed.

[Wingman]

Hello... Welcome to the forum.
My name is Wingman, and I'll be helping you with any malware problems.
HijackThis logs can take a while to research, so please be patient.

I am currently under the guidance of the MRU teachers, everything I post to you, has been reviewed by them.
This additional review process can add some extra time to my responses...but not too much.

Before we begin...please note the following important guidelines.

1. The instructions being given are for YOUR computer and system only!
   Using these instructions on a different computer can cause damage to that computer and possibly render it inoperable!
2. DO NOT run any other fix or removal tools unless instructed to do so!
3. DO NOT install any other software (or hardware) during the cleaning process. This adds more items to be researched.
4. Please, if you have questions about something...ASK, don't guess or assume.
5. Only- post your problem at (1) one help site. Applying fixes from multiple help sites can cause problems.
6. Print each set of instructions...if possible...your Internet connection will not be available during some fix processes.
7. Only- reply to this thread, do not start another ... Please, continue responding, until I give you the "All Clean"

If you follow these guidelines, things should proceed smoothly.
I am currently reviewing your log and will return, as soon as possible, with additional instructions.
In the meantime... please perform the following steps.

Please read these instructions carefully before executing and perform the steps, in the order given.
lf, you have any questions about or problems with, executing these instructions, <STOP> do not proceed, post back with the question or problem.

Step 1.
HJT - Uninstall Manager Log

Please run HijackThis

If you are on the "scan & fix stuff" page... Press the "Main Menu"...button.
1. From the Main Menu...Press the "Open the Misc Tools"...button.
2. Press the "Open Uninstall Manager... button.
3. Press only the Save List...button.
4. Press the "Save" button. The file "uninstall_list.txt" will be saved in your HJT folder.
5. Copy and paste the contents of "uninstall_list.txt' in your next reply.

Step 2.
Please include in your next reply:

1. HJT uninstall_list.txt file contents

Thanks,
Wingman

[GeniusMagic]

Please see blow the contents of uninstall_list :

Adobe Acrobat 5.0
Adobe Flash Player 10 ActiveX
HijackThis 2.0.2
HP PSC & OfficeJet 6.1.A
Microsoft Office XP Professional with FrontPage
Microsoft Visual C++ 2005 Redistributable
QHM500-8LM (S) USB PC Camera
Windows Internet Explorer 8
WinZip
Yahoo! Messenger
Yahoo! Software Update

[Wingman]

Hello GeniusMagic,
Sorry for the delay in responding, the forum is very busy!

Please do not run any "fix" programs and/or remove any files unless instructed to do so, by me. I need to see what's present in order to properly
diagnose the problem(s) and recommend corrective actions. Thanks.

Please read these instructions carefully before executing and perform the steps, in the order given.
lf, you have any questions about or problems with, executing these instructions, <STOP> do not proceed, post back with the question or problem.

Step 1.
No Anti-virus Software Installed!
Looking over your log ... there is NO evidence of anti-virus software installed.. This puts you at serious risk.
Anti-virus software will help detect, cleanse, and erase harmful virus files on a computer, Web server, or network. Unchecked, virus files can unintentionally be forwarded to others,
including trading partners and thereby spreading infection. Anti-virus software can scan the computer memory and disk drives for malicious code.
They can alert the user if a virus is present, and will clean, delete (or quarantine) infected files or directories.
To protect your computer from infection...download a (free for personal use) anti-virus program from one these reliable vendors NOW!

1) Antivir PersonalEdition Classic- Free anti-virus software for Windows. Detects and removes more than 50,000 viruses. Free support.
2) avast! 4 Home Edition - Anti-virus program for Windows. The home edition is freeware for noncommercial users.
3) AVG Anti-Virus Free Edition - Free edition of the AVG anti-virus program for Windows.

It is strongly recommended that you run only one antivirus program at a time.
Having more than one antivirus program active in memory uses additional resources and can result in program conflicts and false virus alerts.

Please make sure you follow this sequence of actions when dealing with installing / uninstalling AV programs:

1. Download the new AV program.. while old AV is still functioning.
2. Disconnect from the Internet.
3. Uninstall the old AV program... either using Add/Remove Programs in Control Panel or if the AV program has an uninstall entry in the Start Menu.
   Follow all uninstall steps.
4. Reboot... the uninstall process may ask you to do this... if NOT, please do it before installing the new AV product.
5. Install the new AV program.
6. Perform an update of the new AV program, to obtain the latest protection databases available.
7. Run a full scan with the new AV product.
8. After the scan, please copy/paste the scan results in your next reply.

Step 2.
MGA Diagnostics
I need you to run a tool... that will aid in determining what additional steps we'll need to perform.

• Please download this tool from Microsoft.
• Click "Run" to execute MGADiag.exe.
• Click "Run" again...then Click "Continue".
• The program will run. It takes a while to finish the diagnosis, please be patient.
• Once done, click on Copy.
• Open Notepad and paste the contents in. Save this file and post it in your next reply.

Step 3.
RSIT (Random's System Information Tool)
Please download RSIT by random/random... save it to your desktop.

1. Double click on RSIT.exe to run it... read the disclaimer... click on Continue.
2. RSIT will start running. When done... 2 logs files...will be produced.
   The first one, "log.txt", will be maximized ... the second one, "info.txt", will be minimized.
3. Please post both... "log.txt" and "info.txt", file contents in your next reply.

(These logs can be lengthy, so post 1 log per reply please.)

Step 4.
Please include in your next reply:

1. Any problem executing the instructions?
2. New AV program scan results
3. MGADiag results
4. RSIT log and info.txt file contents
5. How is the computer behaving?

Thanks,
Wingman

[Wingman]

3 Day Response
Hello...
It has been more than 2 days since my last post to you.

• Do you still need help with this problem?
• Do you need more time?
• Are you having problems understanding or following my instructions?

Just let me know what's going on otherwise...
After 24 hrs., if you have not replied to this thread... it will be closed!

[silver]

Due to a Lack of Response this topic is now closed.

If you still require help, please open a new thread in the Malware Removal forum.

If you have been helped and wish to donate to help with the costs of this volunteer site,
please read Donations For Malware Removal