popups in firefox

Question

jazzyjaj 0 Junior Poster

16 Years Ago

Recently i have been having these popups with ips like.
http://89.188.16.43/go//?cmp=nm_firefox_rn&uid=00C2C7DAA3F911DDB0A9150044CFFFFF&rid=zdez&guid=18F0032549E7424087A87FF6D789E65C&affid=150044&lid=http&url=%7Bhttp:%2F%2F%5B0-9a-zA-Z%5C+%5C%%5C.%5C;%5C,%5C-%5C_%5C%3F%5C%23%26%5C=%5C%7B%5C%7D%5C%5B%5C%5D%5C%2F%5C%5C%5C$%5C:%5C@%5C%5E%5C~%5C%60%5D+%7D&v=1156&m=irq4
http://82.98.235.35/go//?cmp=nm_firefox_rn&uid=00C2C7DAA3F911DDB0A9150044CFFFFF&rid=zdez&guid=18F0032549E7424087A87FF6D789E65C&affid=150044&lid=http&url=http:%2F%2F192.168.100.1%2F&v=1156&m=irq4
after which they redirect to a antispyware website.
I have tried varies things but nothing seems to sort it out.
I have tried AVG, antispyware, combofix, smitfraud, antimalware etc...
they have found many things but not solve this issue.
Here is a copy of hijackthis log i do not see anything wrong there.
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:33:46, on 11/7/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\spoolsv.exe
D:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
D:\WINDOWS\Explorer.EXE
D:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
d:\program files\common files\mcafee\mna\mcnasvc.exe
d:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
D:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
D:\Program Files\McAfee\MPF\MPFSrv.exe
D:\WINDOWS\system32\nvsvc32.exe
D:\Program Files\Common Files\Real\Update_OB\realsched.exe
D:\WINDOWS\system32\svchost.exe
D:\PROGRA~1\McAfee.com\Agent\mcagent.exe
D:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\Program Files\Real\RealPlayer\realplay.exe
D:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
D:\WINDOWS\system32\wscntfy.exe
d:\PROGRA~1\mcafee\msc\mcuimgr.exe
D:\WINDOWS\system32\rundll32.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
D:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [TkBellExe] "D:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE D:\WINDOWS\system32\NvCpl.dll,NvStartup
O8 - Extra context menu item: &Download all by Orbit - res://D:\Program Files\Orbitdownloader\orbitmxt.dll/202
O8 - Extra context menu item: &Download by Orbit - res://D:\Program Files\Orbitdownloader\orbitmxt.dll/201
O8 - Extra context menu item: &Download selected by Orbit - res://D:\Program Files\Orbitdownloader\orbitmxt.dll/203
O8 - Extra context menu item: &Grab video by Orbit - res://D:\Program Files\Orbitdownloader\orbitmxt.dll/204
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - D:\Program Files\AIM\aim.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - D:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - D:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - D:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - D:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - D:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - d:\program files\common files\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - d:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - D:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - D:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - D:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - D:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - D:\Program Files\Viewpoint\Common\ViewpointService.exe

--
End of file - 3793 bytes

Also the computer has become slow to start and the browsers are taking a lot of mem usage like firefox 70000k and explorer 40000k.
here is a list of process
Process list saved on 13:47:16, on 11/7/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)

[pid] [full path to filename] [file version] [company name]
564 D:\WINDOWS\System32\smss.exe 5.1.2600.2180 Microsoft Corporation
660 D:\WINDOWS\system32\winlogon.exe 5.1.2600.2180 Microsoft Corporation
704 D:\WINDOWS\system32\services.exe 5.1.2600.2180 Microsoft Corporation
716 D:\WINDOWS\system32\lsass.exe 5.1.2600.2180 Microsoft Corporation
900 D:\WINDOWS\system32\svchost.exe 5.1.2600.2180 Microsoft Corporation
1092 D:\WINDOWS\System32\svchost.exe 5.1.2600.2180 Microsoft Corporation
1320 D:\WINDOWS\system32\spoolsv.exe 5.1.2600.2180 Microsoft Corporation
1604 D:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe 7.5.1.36 GRISOFT s.r.o.
1612 D:\WINDOWS\Explorer.EXE 6.0.2900.2180 Microsoft Corporation
1792 D:\PROGRA~1\McAfee\MSC\mcmscsvc.exe 8.1.159.0 McAfee, Inc.
1812 d:\program files\common files\mcafee\mna\mcnasvc.exe 2.1.143.0 McAfee, Inc.
1872 d:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe 2.0.150.0 McAfee, Inc.
1928 D:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe 14.0.0.349 McAfee, Inc.
220 D:\Program Files\McAfee\MPF\MPFSrv.exe 9.0.136.0 McAfee, Inc.
408 D:\WINDOWS\system32\nvsvc32.exe 6.14.10.6693 NVIDIA Corporation
428 D:\Program Files\Common Files\Real\Update_OB\realsched.exe 0.1.1.45 RealNetworks, Inc.
916 D:\WINDOWS\system32\svchost.exe 5.1.2600.2180 Microsoft Corporation
1424 D:\PROGRA~1\McAfee.com\Agent\mcagent.exe 8.0.237.0 McAfee, Inc.
1772 D:\Program Files\Viewpoint\Common\ViewpointService.exe 2.0.0.54 Viewpoint Corporation
2728 D:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe 12.1.111.0 McAfee, Inc.
2824 D:\WINDOWS\system32\wscntfy.exe 5.1.2600.2180 Microsoft Corporation
3440 d:\PROGRA~1\mcafee\msc\mcuimgr.exe 8.0.226.0 McAfee, Inc.
3748 D:\WINDOWS\system32\rundll32.exe 5.1.2600.2180 Microsoft Corporation
2356 C:\PROGRA~1\MOZILL~1\FIREFOX.EXE 1.8.20080.17373 Mozilla Corporation
2700 D:\Program Files\Trend Micro\HijackThis\HijackThis.exe 2.0.0.2 Trend Micro Inc.

windows-virus

2 Contributors
29 Replies
301 Views
1 Week Discussion Span
Latest Post 16 Years Ago Latest Post by jholland1964

jholland1964 650 Posting Expert

16 Years Ago

Hi and welcome to daniweb.
First of all I must caution all who may be reading this that several of the programs you have said that you ran should NOT have been run without FIRST being told to do so by a helper or somebody assisting you with problems. The main one I am concerned about is combofix. This is a very powerful tool which produces a very long and complicated log after doing it's work. It takes quite awhile to read and interpret one of these logs. Since you didn't post any of the logs from the programs you ran and you say "they have found many things but not solve this issue" we have absolutely no idea what was found or what was removed OR where they were located on the system. We really are not certain what programs you did run really except for combofix, smitfraud and AVG Anti-Spyware 7.5, which is no longer available as a stand alone product so it cannot be counted on as doing the work anymore, and than you say "antimalware etc..." What "antimalware"?
Your auto starting program and auto starting services list is extremely small showing only graphics card software, realplayer update, your McAfee program and Viewpoint Manager Service (which is actually considered to be malware and should be removed). The running processes list you posted shows exactly the same thing as the Running Processes list from the HiJackThis log so there is nothing different or unusual there. We don't know what version of Firefox you are running. What version is it?
I would like to see both the combofix log and the smitfraud log and any other logs from all the other programs that you ran. Post those here first.
THEN;
Did you follow the steps given in Read me before posting a request for assistance thread at the top of this page?
Ignore the Deckard Scanner program as it is not available but I would like you to follow ALL of the other steps, including ATF-Cleaner, Malwarebytes' Anti-Malware, ESET online scanner. Be sure to reboot the computer AFTER running MBA-M. Once you have done those steps then post back here with those NEW logs and a new HJT scan log completed AFTER you have followed the steps given in the "Read Me Before" sticky.
Judy

jholland1964 650 Posting Expert

16 Years Ago

i can try any other software from eset like the nod32, if you want.

You have done this, that was the ESET Scanner.

You need to go in and UNINSTALL all those extra programs you used; Combofix, vundofix, Avenger, SmitFraudFix. KEEP Malwarebytes Anti-Malware and Spybot. Also keep the ATF-Cleaner. Don't worry about the Microsoft® Windows® Malicious Software Removal Tool, for whatever reasons many cannot run this tool.
To uninstall combofix do the following;
Click START then RUN
Now type Combofix /u in the runbox and click OK. Note the space between the X and the U, it needs to be there.
When shown the disclaimer, Select "2"
I cannot stress enough here again for others who may be reading this that Combofix is a powerful tool intended to be used under the guidance and supervision of an expert, not for private use. Using this tool incorrectly could adversely impact your system and prevent it from ever starting again.
One of the things that shouldn't be done is use this tool over and over, it should be used one time unless directed to do it again. When that is done it is usually recommended that the original be removed and a new copy downloaded if needed again.
Please remove it from your system.
VundoFix and SmitfraudFix are also infection specific tools, indicated when these two infections are present but not to be used for general cleaning of the computer.

These days Malwarebytes' Anti-Malware is the tool most often recommended as a FIRST step because it updates frequently (often times DAILY) AND it does remove many, many infections including Vundo infections.

Now since the problem only happens with Firefox AND you could not use the ATF Firefox option then this says to me that your copy of Firefox is probably infected and very likely corrupted. You said you are using Firefox 2 so it is out of date. Current version is version 3.0.3.
I hate to have you download a new copy before getting that infection out of there and risk having that one infected too so let's try to see if we can get that cleaned out.

Update the MBA-M program, then download CCleaner.

Shut down completely, disconnect the internet cable from the computer this way the computer cannot go online.
Then reboot to Safe Mode
1. Restart your computer.
2. When the machine first starts again it will generally list some equipment that is installed in your machine, amount of memory, hard drives installed etc. At this point you should gently tap the F8 key repeatedly until you are presented with a Windows XP Advanced Options menu.
3. Select the option for Safe Mode using the arrow keys.
4. Then press enter on your keyboard to boot into Safe Mode.

Once the computer is in Safe Mode then first run the ATF-Cleaner, again do both clean up options, first IE and then Firefox.

Next run the CCleaner on the default cleaning options, which is exactly how it will be when you open the program. It will scan the computer, list files which can be removed. Let it remove all it finds.

Next run a Full system scan with MBA-M and allow it to clean all it finds.

Shut down the computer.
Re-attach the internet cable to the computer and reboot to normal mode.
Run a new HJT scan and post back here with the MBA-M log and the HJT log.
Judy

jholland1964 650 Posting Expert

16 Years Ago

What happened when you tried to remove combofix?
Yes, you can just delete it though it will not remove any backups these multiple runnings have done.

jholland1964 650 Posting Expert

16 Years Ago

You need to do the following;
Download SmitFraudFix and save it to your desktop.
Confirm that the file SmitfraudFix.exe now resides on your desktop, but do not double-click on the icon as of yet. We will use it in later steps.
Next, please reboot your computer into Safe Mode by doing the following:

1. Restart your computer

2. After hearing your computer beep once during startup, but before the Windows icon appears, press F8.

3. Instead of Windows loading as normal, a menu should appear

4. Select the first option, to run Windows in Safe Mode.

5. When you are at the logon prompt, log in as the same user that you had performed the previous steps as.

When your computer has started in safe mode, and you see the desktop, close all open Windows.

Now, double-click on the SmitFraudfix icon that should be residing on your desktop.

When the tool first starts you will see a credits screen. Simply press any key on your keyboard to get to the next screen.

You will now see a menu. Press the number 2 on your keyboard and the press the enter key to choose the option Clean (safe mode recommended).
The program will start cleaning your computer and go through a series of cleanup processes. When SmitFraudFix is done, it will automatically start the Disk Cleanup program

This program will remove all Temp, Temporary Internet Files, and other files that may be leftover files from this infection. This process can take up to a few hours depending on your computer, so please be patient. When it is complete, it will close automatically and you will should continue with the next step.

When Disk Cleanup is finished, you will be presented with an option asking Do you want to clean the registry ? (y/n). At this screen you should press the Y button on your keyboard and then press the enter key.

When this last routine is finished, you will be presented with a red screen stating Computer will reboot now. Close all applications. You should now press the spacebar on your computer. A counter will appear stating that the computer will reboot in 15 seconds. Do not cancel this countdown and allow your computer to reboot.
Once the computer has rebooted, you will be presented with a Notepad screen containing a log of all the files removed from your computer. Examine this log, and when you are done, close the Notepad screen.
Reboot the computer and run a new HJT scan. Post back here with that log and the Smitfraudfix log.
We will deal with the Firefox problems shortly.
Judy

jholland1964 650 Posting Expert

16 Years Ago

Please recommend what to do withe the Firefox do i install the new version(I have downloaded it already).
Since the previous Firefox was actually not installed from the OS i am running now, what do i need to do to remove it completely (i.e registry,cookies etc...) as it is my default browser and IE is uninstall from the Add/Remove windows components

Firefox HAS to be installed or it would not be running. Looking at your logs it is running from "C" drive, in fact it is the only program I see running from "C" drive. This is why you cannot get anything to scan it, because you are not telling it to scan "C" drive.
Run that MBA-M again, updating it first and this time also have it scan "C" drive.
When you choose Full Scan you should get a box which allows you to tell the program which drives to scan. Be sure to put a check mark in BOTH "C" and "D" drives. Obviously Firefox cannot be the only thing on "C" drive so there are probably a lot of files never scanned with the MBA-M program. Run that and of course have it fix everything found. Post back here with that log before running any other program I have told you to run.
Judy

Reply to this topic

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.

jazzyjaj 0 Junior Poster · Answer 1 · 2008-11-08T13:59:03+00:00

i am using a pentium 3 863MHz with Winxp sp2
I use firefox 2, and use this computer mainly for browsing purposes.
the anitmalware i mentioned is the same malwarebytes anitmalware mentioned in the read me before request. However i had performed a quick scan previously, but will perform a full scan later.
here is the log of the earlier scan:
Malwarebytes' Anti-Malware 1.30
Database version: 1343
Windows 5.1.2600 Service Pack 2

2008-10-31 20:51:16
mbam-log-2008-10-31 (20-51-16).txt

Scan type: Quick Scan
Objects scanned: 47052
Time elapsed: 9 minute(s), 9 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 2
Registry Keys Infected: 17
Registry Values Infected: 1
Registry Data Items Infected: 7
Folders Infected: 1
Files Infected: 29

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
D:\WINDOWS\system32\mstbvgpb.dll (Trojan.Vundo.H) -> Delete on reboot.
D:\WINDOWS\system32\urqRHaWQ.dll (Trojan.Vundo.H) -> Delete on reboot.

Registry Keys Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{b9997de8-1685-47d1-903f-f2a862fef950} (Trojan.Vundo.H) -> Delete on reboot.
HKEY_CLASSES_ROOT\CLSID\{b9997de8-1685-47d1-903f-f2a862fef950} (Trojan.Vundo.H) -> Delete on reboot.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{b9997de8-1685-47d1-903f-f2a862fef950} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\minibugtransporter.minibugtransporterx (Adware.Minibug) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{2b96d5cc-c5b5-49a5-a69d-cc0a30f9028c} (Adware.Minibug) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\TypeLib\{3c2d2a1e-031f-4397-9614-87c932a848e0} (Adware.Minibug) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{04a38f6b-006f-4247-ba4c-02a139d5531c} (Adware.Minibug) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\minibugtransporter.minibugtransporterx.1 (Adware.Minibug) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\z444.z444mgr (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\z444.z444mgr.1 (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{030a0f33-5b99-482e-83f5-2eeb8457878b} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{030a0f33-5b99-482e-83f5-2eeb8457878b} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{500bca15-57a7-4eaf-8143-8c619470b13d} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\contim (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\rdfa (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\e0ff4138 (Trojan.Vundo.H) -> Quarantined and deleted successfully.

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Notification Packages (Trojan.Vundo.H) -> Data: d:\windows\system32\urqrhawq -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\System (Rootkit.DNSChanger.H) -> Data: kdptp.exe -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Authentication Packages (Trojan.Vundo) -> Data: d:\windows\system32\urqrhawq -> Delete on reboot.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\SearchMigratedDefaultURL (Hijack.Search) -> Bad: (http://windiwsfsearch.com/search?q={searchTerms}) Good: (http://www.google.com/) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchUrl\w\ (Hijack.Search) -> Bad: (http://windiwsfsearch.com/search?q=%s) Good: (http://www.google.com/) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{92d437af-0b8a-4735-975e-2d5679051dba}\DhcpNameServer (Trojan.DNSChanger) -> Data: 85.255.116.164,85.255.112.81 -> Delete on reboot.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Tcpip\Parameters\Interfaces\{92d437af-0b8a-4735-975e-2d5679051dba}\DhcpNameServer (Trojan.DNSChanger) -> Data: 85.255.116.164,85.255.112.81 -> Delete on reboot.

Folders Infected:
D:\WINDOWS\system32\675873 (Trojan.BHO) -> Quarantined and deleted successfully.

Files Infected:
D:\WINDOWS\system32\urqRHaWQ.dll (Trojan.Vundo.H) -> Delete on reboot.
D:\WINDOWS\system32\QWaHRqru.ini (Trojan.Vundo.H) -> Delete on reboot.
D:\WINDOWS\system32\QWaHRqru.ini2 (Trojan.Vundo.H) -> Quarantined and deleted successfully.
D:\WINDOWS\system32\iekwwjgj.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
D:\WINDOWS\system32\jgjwwkei.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
D:\WINDOWS\system32\mstbvgpb.dll (Trojan.Vundo.H) -> Delete on reboot.
D:\WINDOWS\system32\bpgvbtsm.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
D:\WINDOWS\system32\mtggixei.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
D:\WINDOWS\system32\iexiggtm.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
D:\WINDOWS\system32\rkrwacpk.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
D:\WINDOWS\system32\kpcawrkr.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
D:\WINDOWS\system32\xrfvadoh.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
D:\WINDOWS\system32\hodavfrx.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
D:\WINDOWS\system32\xymnejph.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
D:\WINDOWS\system32\hpjenmyx.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
D:\WINDOWS\system32\kdptp.exe (Rootkit.DNSChanger.H) -> Delete on reboot.
D:\Program Files\AWS\WeatherBug\MiniBugTransporter.dll (Adware.Minibug) -> Quarantined and deleted successfully.
D:\WINDOWS\system32\fxddodac.exe (Trojan.LowZones) -> Quarantined and deleted successfully.
D:\WINDOWS\system32\kgblktnm.exe (Trojan.LowZones) -> Quarantined and deleted successfully.
D:\WINDOWS\system32\rpcnyufi.exe (Trojan.LowZones) -> Quarantined and deleted successfully.
D:\WINDOWS\system32\ufvfcshx.exe (Trojan.LowZones) -> Quarantined and deleted successfully.
D:\WINDOWS\system32\ypcumgog.exe (Trojan.LowZones) -> Quarantined and deleted successfully.
D:\Documents and Settings\Other\Local Settings\Temporary Internet Files\Content.IE5\8DUZ05YV\kb20010911[1] (Trojan.LowZones) -> Quarantined and deleted successfully.
D:\Documents and Settings\Other\Local Settings\Temporary Internet Files\Content.IE5\ENW8807K\upd105320[1] (Trojan.Vundo.H) -> Quarantined and deleted successfully.
D:\Documents and Settings\Jahanzeb\Local Settings\Temporary Internet Files\Content.IE5\GHUBSHYV\upd105320[1] (Trojan.Vundo.H) -> Quarantined and deleted successfully.
D:\Documents and Settings\Jahanzeb\Local Settings\Temporary Internet Files\Content.IE5\GXMJ0TEV\kb20010911[1] (Trojan.LowZones) -> Quarantined and deleted successfully.
D:\WINDOWS\system32\675873\675873.dll (Trojan.BHO) -> Quarantined and deleted successfully.
D:\WINDOWS\system32\mcrh.tmp (Malware.Trace) -> Quarantined and deleted successfully.
D:\USM2Trial.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.

jazzyjaj 0 Junior Poster · Answer 2 · 2008-11-08T14:05:40+00:00

This post will have the logs of all the other scans i had performed:

VundoFix V7.0.6

Scan started at 17:20:42 2008-10-28

Listing files found while scanning....

D:\Windows\system32\NCTAudioCDGrabber2.dll
D:\Windows\system32\NCTAudioFile2.dll
D:\Windows\system32\NCTAudioPlayer2.dll
D:\Windows\system32\NCTAudioRecord2.dll
D:\Windows\system32\NCTAVIFile.dll
D:\Windows\system32\NCTQuickTimeFile.dll
D:\Windows\system32\NCTVideoCoreM.dll
D:\Windows\system32\NCTWMAFile2.dll

Beginning removal...

Attempting to delete D:\Windows\system32\NCTAudioCDGrabber2.dll
D:\Windows\system32\NCTAudioCDGrabber2.dll Has been deleted!

Attempting to delete D:\Windows\system32\NCTAudioFile2.dll
D:\Windows\system32\NCTAudioFile2.dll Has been deleted!

Attempting to delete D:\Windows\system32\NCTAudioPlayer2.dll
D:\Windows\system32\NCTAudioPlayer2.dll Has been deleted!

Attempting to delete D:\Windows\system32\NCTAudioRecord2.dll
D:\Windows\system32\NCTAudioRecord2.dll Has been deleted!

Attempting to delete D:\Windows\system32\NCTAVIFile.dll
D:\Windows\system32\NCTAVIFile.dll Has been deleted!

Attempting to delete D:\Windows\system32\NCTQuickTimeFile.dll
D:\Windows\system32\NCTQuickTimeFile.dll Has been deleted!

Attempting to delete D:\Windows\system32\NCTVideoCoreM.dll
D:\Windows\system32\NCTVideoCoreM.dll Has been deleted!

Attempting to delete D:\Windows\system32\NCTWMAFile2.dll
D:\Windows\system32\NCTWMAFile2.dll Has been deleted!

Performing Repairs to the registry.
Done!

VundoFix V7.0.6

Scan started at 1:32:48 PM 11/2/2008

Listing files found while scanning....

No infected files were found.

Combofix: I used this application i think three times:
"Other" - 2008-11-04 19:56:32 Service Pack 2 [SAFE MODE]
ComboFix 07-05.27.BV - Running from: "D:\"

((((((((((((((((((((((((((((((( Files Created from 2008-10-04 to 2008-11-04 ))))))))))))))))))))))))))))))))))

2008-11-04 18:55 72,192 --a------ D:\WINDOWS\system32\lpqewhng.dll
2008-11-03 16:22 72,192 --a------ D:\WINDOWS\system32\sgincsoh.dll
2008-11-02 11:12 72,192 --a------ D:\WINDOWS\system32\mkecmtiy.dll
2008-11-02 10:39 71,680 --a------ D:\WINDOWS\system32\udcrfrup.dll
2008-11-01 10:36 311,667 --ahs---- D:\WINDOWS\system32\edeLRqru.ini2
2008-11-01 10:35 282,112 --a------ D:\WINDOWS\system32\urqRLede.dll
2008-10-31 20:38 <DIR> d-------- D:\DOCUME~1\Jahanzeb\APPLIC~1\Malwarebytes
2008-10-31 20:03 <DIR> d-------- D:\DOCUME~1\Other\APPLIC~1\Malwarebytes
2008-10-31 20:02 38,496 --a------ D:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-10-31 20:02 15,504 --a------ D:\WINDOWS\system32\drivers\mbam.sys
2008-10-31 20:02 <DIR> d-------- D:\Program Files\Malwarebytes' Anti-Malware
2008-10-31 20:02 <DIR> d-------- D:\DOCUME~1\ALLUSE~1\APPLIC~1\Malwarebytes
2008-10-28 19:04 7,507,296 --a------ D:\rminstall.exe
2008-10-28 18:41 812,344 --a------ D:\HJTInstall.exe
2008-10-28 18:41 15,083,520 --a------ D:\spybotsd160.exe
2008-10-28 17:20 <DIR> d-------- D:\VundoFix Backups
2008-10-28 12:53 880 --a------ D:\WINDOWS\system32\tmp.reg
2008-10-28 12:50 <DIR> d-------- D:\SmitfraudFix
2008-10-28 12:49 262,144 --ah----- D:\DOCUME~1\ADMINI~1\NTUSER.DAT
2008-10-28 12:33 1,088,512 --a------ D:\ComboFix.exe
2008-10-28 12:17 119,808 --a------ D:\VundoFix.exe
2008-10-28 12:17 1,663,634 --a------ D:\SmitfraudFix.exe
2008-10-27 22:23 <DIR> d-------- D:\Program Files\Avenger
2008-10-27 21:40 49,152 --a------ D:\WINDOWS\nircmd.exe
2008-10-27 20:25 388,608 --a------ D:\WINDOWS\system32\CF19354.exe
2008-10-27 14:35 <DIR> d-------- D:\Program Files\Exterminate It!
2008-10-27 14:02 <DIR> d-------- D:\Program Files\Trend Micro
2008-10-27 12:25 27,904 --a------ D:\WINDOWS\system32\drivers\ndisprot.sys
2008-10-27 12:24 32,256 --a------ D:\WINDOWS\system32\fccbBSkk.dll
2008-10-27 12:24 32,256 --a------ D:\WINDOWS\system32\awtqrqpp.dll
2008-10-14 14:38 <DIR> d-------- D:\DOCUME~1\Other\APPLIC~1\AdobeUM
2008-10-10 16:36 <DIR> d-------- D:\DOCUME~1\ALLUSE~1\APPLIC~1\Messenger Plus!
2008-10-10 13:53 <DIR> d-------- D:\Program Files\Messenger Plus! Live
2008-10-09 13:57 <DIR> d-------- D:\Documents and Settings\Other\Contacts
2008-10-09 13:57 <DIR> d-------- D:\DOCUME~1\Other\Contacts
2008-10-09 13:49 <DIR> d-------- D:\Program Files\Windows Live

(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))

2008-11-04 13:58:33 -------- d-----w D:\DOCUME~1\Other\APPLIC~1\Skype
2008-11-04 13:31:25 -------- d-----w D:\DOCUME~1\Other\APPLIC~1\skypePM
2008-11-04 08:15:44 -------- d-----w D:\Program Files\DC++
2008-10-31 12:23:46 -------- d-----w D:\DOCUME~1\Other\APPLIC~1\uTorrent
2008-10-30 11:23:37 1,427 ----a-w D:\WINDOWS\mozver.dat
2008-10-15 04:30:07 359,040 ----a-w D:\WINDOWS\system32\drivers\tcpip.sys
2008-09-29 17:32:30 -------- d-----w D:\DOCUME~1\Other\APPLIC~1\dvdcss
2008-09-19 16:00:50 -------- d-----w D:\DOCUME~1\Other\APPLIC~1\Creative
2008-09-16 13:55:48 -------- d-----w D:\Program Files\McAfee

(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]
{000123B4-9B42-4900-B3F7-F4B073EFC214}=D:\Program Files\Orbitdownloader\orbitcth.dll [2007-02-05 13:34]
{53707962-6F74-2D53-2644-206D7942484F}=D:\Program Files\Spybot - Search & Destroy\SDHelper.dll [2008-09-15 14:25]
{7DB2D5A0-7241-4E79-B68D-6309F01C5231}=D:\Program Files\McAfee\VirusScan\scriptsn.dll [2007-10-24 05:51]
{8FBC6088-3303-4856-9992-EE901F543755}=D:\WINDOWS\system32\urqRLede.dll [2008-11-01 10:36]
{A177C1C1-EF04-4FCC-8A4B-FE956DC0A099}=D:\WINDOWS\system32\fccbBSkk.dll [2008-10-27 12:24]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"nwiz"="nwiz.exe" [2004-10-29 13:50 D:\WINDOWS\system32\nwiz.exe]
"TkBellExe"="D:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2008-06-12 10:57]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Aim6"="" []
"MsnMsgr"="D:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [2007-10-18 11:34]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{A177C1C1-EF04-4FCC-8A4B-FE956DC0A099}"="D:\WINDOWS\system32\fccbBSkk.dll" [2008-10-27 12:24]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\fccbBSkk]
fccbBSkk.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages msv1_0 D:\WINDOWS\system32\urqRLede

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\mcmscsvc]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\D:^Documents and Settings^All Users^Start Menu^Programs^Startup^InterVideo WinCinema Manager.lnk]
backup=D:\WINDOWS\pss\InterVideo WinCinema Manager.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Aim6]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
"D:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\mcagent_exe]
D:\Program Files\McAfee.com\Agent\mcagent.exe /runkey

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NBKeyScan]
"D:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
D:\Program Files\Common Files\Nero\Lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
RUNDLL32.EXE D:\WINDOWS\system32\NvCpl.dll,NvStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
RUNDLL32.EXE D:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
nwiz.exe /install

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]
D:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
"D:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"xmlprov"=3 (0x3)
"WZCSVC"=3 (0x3)
"WmiApSrv"=3 (0x3)
"Wmi"=3 (0x3)
"WmdmPmSN"=3 (0x3)
"VSS"=3 (0x3)
"UPS"=3 (0x3)
"upnphost"=3 (0x3)
"SysmonLog"=3 (0x3)
"SwPrv"=3 (0x3)
"srservice"=2 (0x2)
"SCardSvr"=3 (0x3)
"RSVP"=3 (0x3)
"RemoteRegistry"=3 (0x3)
"RDSessMgr"=3 (0x3)
"RasAuto"=3 (0x3)
"NtmsSvc"=3 (0x3)
"NtLmSsp"=3 (0x3)
"NMIndexingService"=3 (0x3)
"Netlogon"=3 (0x3)
"MSIServer"=3 (0x3)
"MSDTC"=3 (0x3)
"mnmsrvc"=3 (0x3)
"McODS"=3 (0x3)
"LmHosts"=3 (0x3)
"lanmanworkstation"=3 (0x3)
"lanmanserver"=3 (0x3)
"ImapiService"=3 (0x3)
"HTTPFilter"=3 (0x3)
"dmadmin"=3 (0x3)
"COMSysApp"=3 (0x3)
"CiSvc"=3 (0x3)
"Browser"=3 (0x3)
"BITS"=3 (0x3)
"AppMgmt"=3 (0x3)
"Nero BackItUp Scheduler 3"=2 (0x2)

HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost *netsvcs*

Contents of the 'Scheduled Tasks' folder
2007-10-30 06:46:45 D:\WINDOWS\tasks\McDefragTask.job
2007-10-30 06:46:42 D:\WINDOWS\tasks\McQcTask.job

********************************************************************

catchme 0.3.692 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2008-11-04 20:00:27
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

********************************************************************

Completion time: 2008-11-04 20:02:45
D:\ComboFix-quarantined-files.txt ... 2008-11-04 20:02
D:\ComboFix2.txt ... 2008-11-02 13:29
D:\ComboFix3.txt ... 2008-10-28 15:54

--- E O F ---

"Jahanzeb" - 2008-11-02 13:23:41 Service Pack 2 [SAFE MODE]
ComboFix 07-05.27.BV - Running from: "D:\"

((((((((((((((((((((((((((((((( Files Created from 2008-10-02 to 2008-11-02 ))))))))))))))))))))))))))))))))))

2008-11-02 11:12 72,192 --a------ D:\WINDOWS\system32\mkecmtiy.dll
2008-11-02 10:39 71,680 --a------ D:\WINDOWS\system32\udcrfrup.dll
2008-11-01 10:36 328,688 --ahs---- D:\WINDOWS\system32\edeLRqru.ini2
2008-11-01 10:35 282,112 --a------ D:\WINDOWS\system32\urqRLede.dll
2008-10-31 20:38 <DIR> d-------- D:\DOCUME~1\Jahanzeb\APPLIC~1\Malwarebytes
2008-10-31 20:03 <DIR> d-------- D:\DOCUME~1\Other\APPLIC~1\Malwarebytes
2008-10-31 20:02 38,496 --a------ D:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-10-31 20:02 15,504 --a------ D:\WINDOWS\system32\drivers\mbam.sys
2008-10-31 20:02 <DIR> d-------- D:\Program Files\Malwarebytes' Anti-Malware
2008-10-31 20:02 <DIR> d-------- D:\DOCUME~1\ALLUSE~1\APPLIC~1\Malwarebytes
2008-10-28 19:04 7,507,296 --a------ D:\rminstall.exe
2008-10-28 18:41 812,344 --a------ D:\HJTInstall.exe
2008-10-28 18:41 15,083,520 --a------ D:\spybotsd160.exe
2008-10-28 17:20 <DIR> d-------- D:\VundoFix Backups
2008-10-28 12:53 880 --a------ D:\WINDOWS\system32\tmp.reg
2008-10-28 12:50 <DIR> d-------- D:\SmitfraudFix
2008-10-28 12:49 262,144 --ah----- D:\DOCUME~1\ADMINI~1\NTUSER.DAT
2008-10-28 12:33 1,088,512 --a------ D:\ComboFix.exe
2008-10-28 12:17 119,808 --a------ D:\VundoFix.exe
2008-10-28 12:17 1,663,634 --a------ D:\SmitfraudFix.exe
2008-10-27 22:23 <DIR> d-------- D:\Program Files\Avenger
2008-10-27 21:40 49,152 --a------ D:\WINDOWS\nircmd.exe
2008-10-27 20:25 388,608 --a------ D:\WINDOWS\system32\CF19354.exe
2008-10-27 14:35 <DIR> d-------- D:\Program Files\Exterminate It!
2008-10-27 14:02 <DIR> d-------- D:\Program Files\Trend Micro
2008-10-27 12:25 27,904 --a------ D:\WINDOWS\system32\drivers\ndisprot.sys
2008-10-27 12:24 32,256 --a------ D:\WINDOWS\system32\fccbBSkk.dll
2008-10-27 12:24 32,256 --a------ D:\WINDOWS\system32\awtqrqpp.dll
2008-10-14 14:38 <DIR> d-------- D:\DOCUME~1\Other\APPLIC~1\AdobeUM
2008-10-10 16:36 <DIR> d-------- D:\DOCUME~1\ALLUSE~1\APPLIC~1\Messenger Plus!
2008-10-10 13:53 <DIR> d-------- D:\Program Files\Messenger Plus! Live
2008-10-09 13:57 <DIR> d-------- D:\DOCUME~1\Other\Contacts
2008-10-09 13:49 <DIR> d-------- D:\Program Files\Windows Live

(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))

2008-11-01 17:22:48 -------- d-----w D:\Program Files\DC++
2008-10-30 11:23:37 1,427 ----a-w D:\WINDOWS\mozver.dat
2008-10-28 14:35:52 -------- d-----w D:\DOCUME~1\Jahanzeb\APPLIC~1\uTorrent
2008-10-28 12:55:54 -------- d-----w D:\DOCUME~1\Jahanzeb\APPLIC~1\Orbit
2008-10-15 04:30:07 359,040 ----a-w D:\WINDOWS\system32\drivers\tcpip.sys
2008-09-16 13:55:48 -------- d-----w D:\Program Files\McAfee

(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]
{000123B4-9B42-4900-B3F7-F4B073EFC214}=D:\Program Files\Orbitdownloader\orbitcth.dll [2007-02-05 13:34]
{53707962-6F74-2D53-2644-206D7942484F}=D:\Program Files\Spybot - Search & Destroy\SDHelper.dll [2008-09-15 14:25]
{61C44C25-C3DA-4DE4-B568-BB010772382A}=D:\WINDOWS\system32\urqRLede.dll [2008-11-01 10:36]
{7DB2D5A0-7241-4E79-B68D-6309F01C5231}=D:\Program Files\McAfee\VirusScan\scriptsn.dll [2007-10-24 05:51]
{A177C1C1-EF04-4FCC-8A4B-FE956DC0A099}=D:\WINDOWS\system32\fccbBSkk.dll [2008-10-27 12:24]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"nwiz"="nwiz.exe" [2004-10-29 13:50 D:\WINDOWS\system32\nwiz.exe]
"TkBellExe"="D:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2008-06-12 10:57]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Pop-Up-Blocker"="" []
"TransparentIcons"="" []
"BlockAds"="" []
"Tweak-XP"="" []