Trojano 3233

[HadYourPhil]

Avast! keeps stopping this, but nothing seems to make it go away. I have run AdAware, NoAdware, Microsoft Antispyware and CCleaner, all in Safe mode to no avail.
The exact message on the Avast! alarm screen is: Win32.Trojano-3233
http://85.255.115.186 users/fill/web/images/idemlog.exe
I also have msblank as the attached HijackThis log will show.
Any ideas?? The attack occurs about every three minutes for three attempts each time.

Logfile of HijackThis v1.99.1
Scan saved at 2:54:19 PM, on 12/30/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\PROGRA~1\MAILFR~1\mantispm.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\OpenOffice.org 2.0\program\soffice.exe
C:\Documents and Settings\Phil\Start Menu\Programs\HotKeyPlus.exe
C:\Program Files\OpenOffice.org 2.0\program\soffice.BIN
C:\Program Files\Voyetra\AudioSurgeon 5\asurscsi.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\My Downloads\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://www.cjb.net/proxy.pac
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /startintray
O4 - HKLM\..\Run: [dflnl.exe] C:\WINDOWS\system32\dflnl.exe
O4 - HKCU\..\Run: [Matador] "C:\PROGRA~1\MAILFR~1\mantispm.exe" -quiet
O4 - HKCU\..\Run: [a-squared] "C:\Program Files\a2\a2guard.exe"
O4 - Startup: OpenOffice.org 2.0.lnk = C:\Program Files\OpenOffice.org 2.0\program\quickstart.exe
O4 - Startup: Shortcut to HotKeyPlus.exe.lnk = C:\Documents and Settings\Phil\Start Menu\Programs\HotKeyPlus.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O15 - Trusted Zone: http://mailcenter.comcast.net
O15 - Trusted Zone: http://mailcenter2.comcast.net
O15 - Trusted Zone: http://www.comcast.net
O15 - Trusted Zone: http://webmail.pas.earthlink.net
O15 - Trusted Zone: http://my.ebay.com
O15 - Trusted Zone: http://www.wrovhistory.com
O16 - DPF: {01010E00-5E80-11D8-9E86-0007E96C65AE} (SupportSoft SmartIssue) - http://www.symantec.com/techsupp/asa/ctrl/tgctlsi.cab
O16 - DPF: {01012101-5E80-11D8-9E86-0007E96C65AE} (SupportSoft Script Runner Class) - http://www.symantec.com/techsupp/asa/ctrl/tgctlsr.cab
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) - http://www.symantec.com/techsupp/asa/LSSupCtl.cab
O16 - DPF: {31E68DE2-5548-4B23-88F0-C51E6A0F695E} (Microsoft PID Sniffer) - https://support.microsoft.com/OAS/ActiveX/odc.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1132683822312
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1132683806203
O16 - DPF: {6E5A37BF-FD42-463A-877C-4EB7002E68AE} (Housecall ActiveX 6.5) - http://housecall65.trendmicro.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (ASquaredScanForm Element) - http://www.windowsecurity.com/trojanscan/axscan.cab
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - https://www-secure.symantec.com/techsupp/asa/ctrl/SymAData.cab
O16 - DPF: {EF58E341-49C3-4156-A3C4-5FFCA7C1EAB7} (EURAS_Portal.Gateway) - http://www.euras.com/euras/activex2/euras.CAB
O17 - HKLM\System\CCS\Services\Tcpip\..\{25498AD6-6C7D-4F67-A6A4-29D3A6035D42}: NameServer = 85.255.114.104,85.255.112.90
O17 - HKLM\System\CCS\Services\Tcpip\..\{C1BF8D51-3BCA-4882-9CCD-06FC871275D2}: NameServer = 85.255.114.104,85.255.112.90
O17 - HKLM\System\CS2\Services\Tcpip\..\{25498AD6-6C7D-4F67-A6A4-29D3A6035D42}: NameServer = 85.255.114.104,85.255.112.90
O17 - HKLM\System\CS3\Services\Tcpip\..\{25498AD6-6C7D-4F67-A6A4-29D3A6035D42}: NameServer = 85.255.114.104,85.255.112.90
O23 - Service: asurscsi - Voyetra Turtle Beach, Inc. - C:\Program Files\Voyetra\AudioSurgeon 5\asurscsi.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe

[DMR]

Hi HadYourPhil,

I've edited your above post to include the HijackThis log in the body of the post. In the future, please paste your logs directly into your posts as opposed to attaching them; it makes it easier to follow the troubleshoot that way.

As for the infection, please do the following:

- Download F-Secure's BlackLight into its own separate folder.
- Open Blacklight and have it run a scan.
- Once the scan is complete, click the "Next" button a couple of times (until it isn't an option anymore), and then click "Close"
- The scan will have created a logfile, which will be in the same folder that you saved the BlackLight program; post the contents of that log here.

[HadYourPhil]

I don't know about your "blacklight" program. As soon as I downloaded it, I was beset with some program called "raze spyware" which took over my desktop with a red screen containing a black box. Inside the black box blinks the words "Danger Spyware" along with a supposed list of things
it has found and an offer to sell me the downloadable cure for
$49.95. So now I REALLY have problems!
Here's the log you requested...

12/31/05 15:35:42 [Info]: BlackLight Engine 1.0.30 initialized
12/31/05 15:35:42 [Info]: OS: 5.1 build 2600 (Service Pack 2)
12/31/05 15:35:43 [Note]: 7019 4
12/31/05 15:35:43 [Note]: 7005 0
12/31/05 15:35:50 [Note]: 7006 0
12/31/05 15:35:50 [Note]: 7011 1712
12/31/05 15:35:50 [Note]: FSRAW library version 1.7.1014
12/31/05 15:36:22 [Info]: Hidden file: C:\WINDOWS\system32\wbem\wbemtest.exe
12/31/05 15:36:22 [Note]: 10002 1
12/31/05 15:36:24 [Info]: Hidden file: C:\WINDOWS\system32\csdsk.exe
12/31/05 15:36:24 [Note]: 7002 32
12/31/05 15:36:24 [Note]: 7003 1
12/31/05 15:36:24 [Note]: 10002 1
12/31/05 15:36:24 [Info]: Hidden file: C:\WINDOWS\system32\dmsrt.exe
12/31/05 15:36:24 [Note]: 10002 1
12/31/05 15:36:24 [Info]: Hidden file: C:\WINDOWS\system32\favset.exe
12/31/05 15:36:24 [Note]: 10002 1
12/31/05 15:36:24 [Info]: Hidden file: C:\WINDOWS\system32\filesafer23.exe
12/31/05 15:36:24 [Note]: 10002 1
12/31/05 15:37:24 [Note]: 7007 0

[DMR]

I don't know about your "blacklight" program. As soon as I downloaded it, I was beset with some program called "raze spyware"

That was definitely not from the BlackLight download; F-Secure is a very reputable company, and I've used that download link myself with no issues whatsoever.

Run another scan with Blacklight, but this time, in the list of found items, have it rename (use the Rename button) all of the files except
wbemtest.exe. Reboot when BlackLight prompts you to do so.

Once the system has rebooted, there will be a new log in the BL folder. Post that log, along with a new HijackThis scan log.