Add-, Mal- And Spyware Infested? Please Help!

Apocalypse_666 · May 25, 2007

Well, I think my computer is infected with one or more different spy/add/malwares and I was wondering if someone could just look at my Hijackthis!-log and see if I am, and if so, what I should do to remove it!

I've tried several things concerning Vundo recently, but my programmes (Spybot Search & Destroy, Add-Aware) keep coming up with the same problems. Also, whenever I run Vundofix.exe, it says every time I still have the awtqq.dll, but it can't seem to remove it...

Any Help will be greatly appreciated!

Logfile of HijackThis v1.99.1

Scan saved at 9:12:03 PM, on 5/25/2007

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16441)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\ZoneLabs\vsmon.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Network Associates\Common Framework\FrameworkService.exe

C:\Program Files\Network Associates\VirusScan\Mcshield.exe

C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\NetDrive\wdservice.exe

C:\WINDOWS\System32\MsPMSPSv.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe

C:\Program Files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanel.exe

C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE

C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe

C:\WINDOWS\SYSTEM32\CTXFISPI.EXE

C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe

C:\WINDOWS\system32\CTXFIHLP.EXE

C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe

C:\Program Files\Logitech\MouseWare\system\em_exec.exe

C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe

F:\Program Files\iTunes\iTunesHelper.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\Program Files\Creative\Sound Blaster X-Fi\Entertainment Center\EAXLoadr.exe

C:\Program Files\MSN Messenger\msnmsgr.exe

C:\Program Files\MSN Messenger\usnsvc.exe

F:\Program Files\iTunes\iTunes.exe

F:\Program Files\Mozilla Firefox\firefox.exe

C:\Program Files\Windows Defender\MsMpEng.exe

C:\Program Files\Windows Defender\MSASCui.exe

C:\WINDOWS\system32\wuauclt.exe

C:\Patches\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll

O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll

O4 - HKLM\..\Run: [AudioDrvEmulator] "C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe" -1 AudioDrvEmulator "C:\Program Files\Creative\Shared Files\Module Loader\Audio Emulator\AudDrvEm.dll"

O4 - HKLM\..\Run: [VolPanel] "C:\Program Files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanel.exe" /r

O4 - HKLM\..\Run: [shStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE

O4 - HKLM\..\Run: [RCSystem] "C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe" RCSystem * -Startup

O4 - HKLM\..\Run: [Network Associates Error Reporting Service] "C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe"

O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey

O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe

O4 - HKLM\..\Run: [CTxfiHlp] CTXFIHLP.EXE

O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"

O4 - HKLM\..\Run: [setup] rundll32.exe "C:\WINDOWS\system32\pkjvomxk.dll",realset

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [iTunesHelper] "F:\Program Files\iTunes\iTunesHelper.exe"

O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide

O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html

O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html

O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

O8 - Extra context menu item: Save Flash - res://F:\Program Files\UnH Solutions\Flash Saving Plugin\FlashSButton.dll/210

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra button: Flash - {43CF38F3-5AEC-45a3-AD31-04EB06E9C6CA} - F:\Program Files\UnH Solutions\Flash Saving Plugin\FlashSButton.dll (HKCU)

O11 - Options group: [iNTERNATIONAL] International*

O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/su/ocx/15026/CTSUEng.cab

O16 - DPF: {15589FA1-C456-11CE-BF01-00AA0055595A} - http://w4s2.work4sure.com/c/ge/w4sgeen9.exe

O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204

O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/...b?1155824468609

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1155828944875

O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab

O16 - DPF: {BE833F39-1E0C-468C-BA70-25AAEE55775E} (System Requirements Lab) - http://www.systemrequirementslab.com/sysreqlab.cab

O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su/ocx/15026/CTPID.cab

O17 - HKLM\System\CCS\Services\Tcpip\..\{3CC89CA4-3FAB-4F1B-B72B-44A26E8A8596}: NameServer = 192.168.1.1

O17 - HKLM\System\CS1\Services\Tcpip\..\{3CC89CA4-3FAB-4F1B-B72B-44A26E8A8596}: NameServer = 192.168.1.1

O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL

O20 - Winlogon Notify: awtqq - C:\WINDOWS\system32\awtqq.dll (file missing)

O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll

O20 - Winlogon Notify: wingsa32 - C:\WINDOWS\SYSTEM32\wingsa32.dll

O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll

O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe

O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe

O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe

O23 - Service: Creative Service for CDROM Access - Unknown owner - C:\WINDOWS\system32\CTsvcCDA.exe (file missing)

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe

O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: McAfee Framework Service (McAfeeFramework) - Network Associates, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe

O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\Mcshield.exe

O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe

O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

O23 - Service: WebDrive Service (WebDriveService) - Unknown owner - C:\Program Files\NetDrive\wdservice.exe

Edited May 25, 2007 by Apoc

therock247uk · May 25, 2007

Can you please post the log Vundofix made? c:\vundofix.txt.

Apocalypse_666 · May 25, 2007

Can you please post the log Vundofix made? c:\vundofix.txt.

Yeah, here:

VundoFix V6.3.23

Checking Java version...

Java version is 1.5.0.8

Old versions of java are exploitable and should be removed.

Java version is 1.5.0.9

Old versions of java are exploitable and should be removed.

Java version is 1.5.0.10

Java version is 1.5.0.11

Scan started at 5:14:56 PM 5/19/2007

Listing files found while scanning....

C:\WINDOWS\system32\awtqq.dll

C:\WINDOWS\system32\fyagbonm.dll

C:\WINDOWS\system32\hjjlm.ini

C:\WINDOWS\system32\kxmovjkp.ini

C:\WINDOWS\system32\mljjh.dll

C:\WINDOWS\system32\mnobgayf.ini

C:\WINDOWS\system32\pkjvomxk.dll

C:\WINDOWS\system32\wvustqo.dll

Beginning removal...

Attempting to delete C:\WINDOWS\system32\fyagbonm.dll

C:\WINDOWS\system32\fyagbonm.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\hjjlm.ini

C:\WINDOWS\system32\hjjlm.ini Has been deleted!

Attempting to delete C:\WINDOWS\system32\kxmovjkp.ini

C:\WINDOWS\system32\kxmovjkp.ini Has been deleted!

Attempting to delete C:\WINDOWS\system32\mljjh.dll

C:\WINDOWS\system32\mljjh.dll Could not be deleted.

Attempting to delete C:\WINDOWS\system32\mnobgayf.ini

C:\WINDOWS\system32\mnobgayf.ini Has been deleted!

Attempting to delete C:\WINDOWS\system32\pkjvomxk.dll

C:\WINDOWS\system32\pkjvomxk.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\wvustqo.dll

C:\WINDOWS\system32\wvustqo.dll Could not be deleted.

Performing Repairs to the registry.

Done!

Beginning removal...

Attempting to delete C:\WINDOWS\system32\mljjh.dll

C:\WINDOWS\system32\mljjh.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\wvustqo.dll

C:\WINDOWS\system32\wvustqo.dll Has been deleted!

Performing Repairs to the registry.

Done!

VundoFix V6.3.23

Checking Java version...

Java version is 1.5.0.8

Old versions of java are exploitable and should be removed.

Java version is 1.5.0.9

Old versions of java are exploitable and should be removed.

Java version is 1.5.0.10

Java version is 1.5.0.11

Scan started at 5:42:26 PM 5/19/2007

Listing files found while scanning....

C:\WINDOWS\system32\awtqq.dll

Beginning removal...

Performing Repairs to the registry.

Done!

VundoFix V6.3.23

Checking Java version...

Java version is 1.5.0.8

Old versions of java are exploitable and should be removed.

Java version is 1.5.0.9

Old versions of java are exploitable and should be removed.

Java version is 1.5.0.10

Java version is 1.5.0.11

Scan started at 9:41:34 AM 5/20/2007

Listing files found while scanning....

C:\WINDOWS\system32\awtqq.dll

Beginning removal...

Performing Repairs to the registry.

Done!

VundoFix V6.3.23

Checking Java version...

Java version is 1.5.0.8

Old versions of java are exploitable and should be removed.

Java version is 1.5.0.9

Old versions of java are exploitable and should be removed.

Java version is 1.5.0.10

Java version is 1.5.0.11

Scan started at 12:35:14 PM 5/20/2007

Listing files found while scanning....

C:\WINDOWS\system32\awtqq.dll

Beginning removal...

Performing Repairs to the registry.

Done!

VundoFix V6.4.1

Checking Java version...

Java version is 1.5.0.8

Old versions of java are exploitable and should be removed.

Java version is 1.5.0.9

Old versions of java are exploitable and should be removed.

Java version is 1.5.0.10

Java version is 1.5.0.11

Scan started at 10:12:39 PM 5/25/2007

Listing files found while scanning....

C:\WINDOWS\system32\awtqq.dll

C:\WINDOWS\system32\ilnmp.ini

C:\WINDOWS\system32\nsnechfv.dll

C:\WINDOWS\system32\pkjvomxk.dll

C:\WINDOWS\system32\pmnli.dll

C:\WINDOWS\system32\qtstv.ini

C:\WINDOWS\system32\ssttt.dll

C:\WINDOWS\system32\tttss.ini

C:\WINDOWS\system32\vtstq.dll

C:\WINDOWS\system32\wvustqo.dll

Beginning removal...

therock247uk · May 26, 2007

Can you please give me a list of files that are in the root of the c drive? While showing hidden files? Please make sure your PC is set to show all hidden files and folders go here for instructions on how to do this. http://pchowtos.co.uk/index.php?page=tutor...=view&id=34

Apocalypse_666 · May 26, 2007

Can you please give me a list of files that are in the root of the c drive? While showing hidden files? Please make sure your PC is set to show all hidden files and folders go here for instructions on how to do this. http://pchowtos.co.uk/index.php?page=tutor...=view&id=34

Yeah. I didn't include my folders in this, cos I didn't think you'd need them. If you do, just tell me....

All the files in c:/

AUTOEXEC.BAT

boot.ini

CONFIG.SYS

devicetable.log

INSTALL.LOG

IO.SYS

Log.txt

MSDOS.SYS

NTDETECT.COM

ntldr

pagefile.sys

sqmdata00.sqm

sqmdata01.sqm

sqmdata02.sqm

sqmdata03.sqm

sqmdata04.sqm

sqmdata05.sqm

sqmdata06.sqm

sqmdata07.sqm

sqmdata08.sqm

sqmdata09.sqm

sqmdata10.sqm

sqmdata11.sqm

sqmdata12.sqm

sqmdata13.sqm

sqmdata14.sqm

sqmdata15.sqm

sqmdata16.sqm

sqmdata17.sqm

sqmdata18.sqm

sqmdata19.sqm

sqmnoopt01.sqm

sqmnoopt02.sqm

sqmnoopt03.sqm

sqmnoopt04.sqm

sqmnoopt05.sqm

sqmnoopt06.sqm

sqmnoopt07.sqm

sqmnoopt08.sqm

sqmnoopt09.sqm

sqmnoopt10.sqm

sqmnoopt11.sqm

sqmnoopt12.sqm

sqmnoopt13.sqm

sqmnoopt14.sqm

sqmnoopt15.sqm

sqmnoopt16.sqm

sqmnoopt17.sqm

sqmnoopt18.sqm

sqmnoopt19.sqm

StubInstaller.exe

totnp233.dll

UNWISE.EXE

VundoFix.txt

WinZipErrorReportLog.txt

Thanks for the help and the fast response!

therock247uk · May 27, 2007

Download ComboFix from Here or Here to your Desktop.

Double click combofix.exe and follow the prompts.
When finished, it shall produce a log for you. Post that log and a HiJackthis log in your next reply

Note: Do not mouseclick combofix's window while its running. That may cause it to stall

Can you also try running Vundofix in safemode?

Boot into safemode to do this keep tapping F8 on your keyboard while your PC is starting up you will get a menu select safemode.

Apocalypse_666 · May 28, 2007

Okay, I first downloaded and ran combofix.exe. Here's the log file:

2006-09-30 10:32	  1120	--a------	C:\Qoobox\Quarantine\C\INSTALL.LOG.vir
2007-05-17 15:38	  18944	--a------	C:\Qoobox\Quarantine\C\WINDOWS\system32\wingsa32.dll.vir


Folder PATH listing
Volume serial number is 60E8-403A
C:\QOOBOX
\---Quarantine
	+---C
	|   |   INSTALL.LOG.vir
	|   |   
	|   \---WINDOWS
	|	   \---system32
	|			   wingsa32.dll.vir
	|			   
	\---Registry_backups

Then I ran Vundofix in safemode:

VundoFix V6.4.1

Checking Java version...

Java version is 1.5.0.8

Old versions of java are exploitable and should be removed.

Java version is 1.5.0.9

Old versions of java are exploitable and should be removed.

Java version is 1.5.0.10

Java version is 1.5.0.11

Scan started at 3:53:47 PM 5/28/2007

Listing files found while scanning....

C:\WINDOWS\system32\awtqq.dll

Beginning removal...

Performing Repairs to the registry.

Done!

And I made a HijackThis!-log:

Logfile of HijackThis v1.99.1

Scan saved at 4:14:42 PM, on 5/28/2007