July 23, 2008 01:54pm pdt

1. rpggamer... 15,964
2. IndiGenus 8,400
3. briancassin 3,600
4. Moorelock 1,600
5. ranhell 1,500
6. b0lsc0tt 1,000
6. steedBmaher 1,000
8. orangutang 900
9. unassass... 672
10. jimtech 664
11. Admin3k 400

1. rpggamer... 24,314
2. IndiGenus 9,525
3. briancassin 3,600
4. Moorelock 1,600
5. pjasnos 1,500
5. ranhell 1,500
7. Sheharya... 1,275
8. phototropic 1,100
9. johnb6767 1,000
9. b0lsc0tt 1,000
9. steedBmaher 1,000
9. younghv 1,000
13. orangutang 980
14. souseran 850
15. nog_lorp 800

04.25.2008 at 12:39PM PDT, ID: 23354720

	[x] Attachment Details

[x]

The Solution Rating System

With so many solutions, how can you tell which solutions are most likely to help you and which ones are not? To provide you with a tool to use, we rate our solutions based on various elements that most accurately determine if a solution is a quality solution. To explain what factors affect the solution rating, here are the elements we take into consideration when formulating our solution rating.

The Grade of the Solution
The Zone Rank of the Expert Providing the Solution
The Number of Author and Expert Comments
The Number of Experts Contributing
The Feedback of the Community

Your Input Matters
Because of the way the system is set up, the most important variable in this equation is you. As a member of Experts Exchange, you are able to cast your vote on the quality of the solutions in regard to how complete, accurate, helpful and easy to understand each solution is. When you provide your feedback, each rating is adjusted accordingly. So, if you see a solution that has a poor rating that you think is a good solution, let us know by rating it. As you do, the rating will be adjusted and will become more accurate for other members of our site.

If you have any suggestions that you would like to make for our rating system, please ask a question in the Suggestions Zone of Community Support.

Thank you!

8.5

Corrupted/possible virus with explorer.exe, unable to search or Google

Zones: SpyBot Search and Destroy, Spyware / Ad Blockers, Anti-Virus

Tags: Microsoft, Windows, XP SP2, Virus/spyware with explorer.exe

My computer has somehow been contracted with a virus or spyware of some sort and it's becoming a large issue. What happens is that off a fresh restart, and opening Firefox or IE, I am spammed with popup ads and I am also unable to search or connect to various websites. The status bar at the bottom will hang and say 'Waiting for www.google.ca....' and will never load the page. I'm sure it's not a connection problem or any network settings, and I'm sure the webserver is not down because I can connect to it on a separate computer.
I found a really weird trick that bypasses this error and I think is the ultimate cause of my problem. If I CTRL ALT DEL and end my 'explorer.exe' process, all of my connection problems are fixed and I am able to connect to webpages such as EE, Google, etc. However, as soon as I open a new explorer (done by CTRL ALT DEL, File New Task (Run...), type in 'explorer' I get these barrage of quick loading ms-dos type windows that fly by really quickly and the problem appears again. I'm currently typing this having cancelled explorer.exe
I've had Norton Antivirus installed for a long time now, and I've also had Adaware/adwatch but those seem to be useless and ineffective. I've tried Spybot Search & Destroy and that detected some minor problems but didn't change a single thing. I'm not sure what I can do, any suggestions?

Start your free trial to view this solution

Question Stats

Zone: Software

Question Asked By: cosecant

Solution Provided By: IndiGenus

Participating Experts: 1

Solution Grade: A

Translate:

Loading Advertisement...

Microsoft

Internet Protocols
Applications

Development
OS

Hardware
Windows Security

Apple

Operating Systems
Hardware

Programming
Networking

Software

Internet

Search Engines
File Sharing
WebTrends / Stats
Spy / Ad Blockers

Web Browsers
New Net Users
Web Development
Chat / IM

Anti Spam
Web Servers
Anti-Virus
Email Clients

Gamers

Tips
Online / MMORPG
Puzzle
Emulators

Action / Adventure
Role Playing
Consoles
Game Programming

Strategy
Sports
Misc
Computer Games

Digital Living

Hardware
Automotive
New Net Users
New Users

Software
Digital Music
Gaming World
Home Security

Apple
Networking Hardware

Virus & Spyware

Vulnerabilities
IDS
Encryption
Anti-Virus

Operating Systems Security
Software Firewalls
WebApplications
Cell Phones

Operating Systems
Internet
Hardware Firewalls

Hardware

Displays / Monitors
Handhelds / PDAs
Components
Peripherals
Laptops/Notebooks

Servers
Misc
Apple
Embedded Hardware
Networking Hardware

Storage
Desktops
New Users

Software

System Utilities
Industry Specific
Network Management
Photos / Graphics
Page Layout
VMware
Misc
Web Development

OS
CYGWIN
Voice Recognition
Virtualization
Message Queue
Quality Assurance
Security
Firewalls

MultiMedia Applications
Development
Database
Office / Productivity
Business Management
OS/2 Apps
Server Software
Internet / Email

ITPro

OS
Storage
Encryption
Operating Systems Security
Apple Hardware
Laptops & Notebooks
Servers
Networking Hardware
Peripherals
Devices

Displays / Monitors
WebTrends / Stats
Search Engines
Firewalls
Web Computing
WebApplications
IDS
Vulnerabilities
Email Clients
File Sharing

Spy / Ad Blockers
Web Browsers
Web Servers
Networking
Anti-Virus
Consulting
Chat / IM
Anti Spam

Developer

Web Servers
Web Browsers
Game Programming
Dev Tools
Industry Specific
Office / Productivity

Database
CYGWIN
Web Development
Search Engines
File Sharing
WebTrends / Stats

Programming
Content Management
Application Servers
Protocols

Storage

Removable Backup Media
Storage Technology
Servers

Grid
Remote Access
Backup / Restore

Misc
Hard Drives

Miscellaneous
Security
Development
Linux
VMware

MainFrame OS
Unix
Apple
OS / 2
AS / 400

BeOS
Microsoft
VMS / OpenVMS

Database

Oracle
Miscellaneous
MySQL
Software
Sybase
Contact Management
PostgreSQL
Data Manipulation
Clarion
InterSystems Cache

Siebel
MUMPS
OLAP
SQLBase
SAS
GIS & GPS
4GL
Berkeley DB
DB2
Informix

Interbase / Firebird
FoxPro
Reporting
LDAP
Filemaker Pro
MS SQL Server
dBase
MS Access

Security

Misc
Web Browsers
Software Firewalls
Operating Systems Security
File Sharing

Spy / Ad Blockers
Vulnerabilities
WebApplications
IDS
Anti-Virus

Encryption
Anti Spam
Email Clients
VPN
Chat / IM

Programming

Editors IDEs
Installation
Handhelds / PDAs
Multimedia Programming
System / Kernel
Automation

Algorithms
Game
Signal Processing
Project Management
Open Source
Database

Misc
Languages
Processor Platforms
Theory

Web Development

Scripting
Blogs
Web Servers
Software
Search Engines
Web Graphics
Web Services

Images
Internet Marketing
Images and Photos
Components
Document Imaging
Web Languages/Standards
Illustration

WebApplications
Fonts
WebTrends / Stats
Authoring
Digital Camera Software
Miscellaneous

Networking

Protocols
Apple Networking
Network Management
Message Queue
Application Servers
Content Management
File Servers
Email Servers
Misc
Java Editors & IDEs

Wireless
Networking Hardware
Backup / Restore
System Utilities
ISPs & Hosting
Web Servers
Storage Technology
Removable Backup Media
Servers
Web Computing

Broadband
Grid
OS / 2
Novell Netware
Unix Networking
Windows Networking
Security
Telecommunications
Operating Systems
Linux Networking

Other

Lounge
Business Travel
Community Support
New Net Users

Philosophy / Religion
Math / Science
Miscellaneous
URLs

Expert Lounge
Politics
Puzzles / Riddles
Automotive

Community Support

Suggestions
New to EE
New Topics
CleanUp

Announcements
General
Feedback

Input
EE Bugs

04.25.2008 at 12:48PM PDT, ID: 21442706

Rank: Guru

IndiGenus:

Hi and sorry to hear of your troubles. Hopefully we can help here.

It would help us if we could see what was going on with your computer. I suggest that you download, run, and upload a HijackThis log from the link below.

http://www.trendsecure.com/portal/en-US/_download/HJTInstall.exe

Click on "Do a system scan and save a log file" button. Post the text from the log file. Do not have HJT fix anything at this point.

Please do not post the log into the comment window. Use "Attach File" under the comment window to post the log.

04.25.2008 at 12:55PM PDT, ID: 21442759

cosecant:

Ran it off of a fresh restart, here's the file

                       
         
           
             1:
2:
3:
4:
5:
6:
7:
8:
9:
10:
11:
12:
13:
14:
15:
16:
17:
18:
19:
20:
21:
22:
23:
24:
25:
26:
27:
28:
29:
30:
31:
32:
33:
34:
35:
36:
37:
38:
39:
40:
41:
42:
43:
44:
45:
46:
47:
48:
49:
50:
51:
52:
53:
54:
55:
56:
57:
58:
59:
60:
61:
62:
63:
64:
65:
66:
67:
68:
69:
70:
71:
72:
73:
74:
75:
76:
77:
78:
79:
80:
81:
82:
83:
84:
85:
86:
87:
88:
89:
90:
91:
92:
93:
94:
95:
96:
97:
98:
99:
100:
101:
102:
103:
104:
105:

           
           
             Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:52:48 PM, on 4/25/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.20733)
Boot mode: Normal
 
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\tcpsvcs.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\Winamp\Winampa.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\WINDOWS\system32\Rundll32.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Symantec AntiVirus\DoScan.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\wuauclt.exe
 
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=74005
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\Winampa.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [BM7b475bc0] Rundll32.exe "C:\WINDOWS\system32\peapwocc.dll",s
O4 - HKLM\..\RunOnce: [SpybotDeletingA5138] command /c del "C:\WINDOWS\system32\icuvwidi.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingC5598] cmd /c del "C:\WINDOWS\system32\icuvwidi.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingA1297] command /c del "C:\WINDOWS\system32\iifecyaY.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingC5449] cmd /c del "C:\WINDOWS\system32\iifecyaY.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingA3493] command /c del "C:\WINDOWS\system32\vtxyxvqa.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingC5357] cmd /c del "C:\WINDOWS\system32\vtxyxvqa.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingA211] command /c del "C:\WINDOWS\system32\icuvwidi.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingC3181] cmd /c del "C:\WINDOWS\system32\icuvwidi.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingA1979] command /c del "C:\WINDOWS\system32\iifecyaY.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingC9877] cmd /c del "C:\WINDOWS\system32\iifecyaY.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingA3088] command /c del "C:\WINDOWS\system32\vtxyxvqa.dll_old"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\RunOnce: [SpybotDeletingD4861] cmd /c del "C:\WINDOWS\system32\icuvwidi.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingB3573] command /c del "C:\WINDOWS\system32\iifecyaY.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingD9758] cmd /c del "C:\WINDOWS\system32\iifecyaY.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingB8954] command /c del "C:\WINDOWS\system32\vtxyxvqa.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingD1865] cmd /c del "C:\WINDOWS\system32\vtxyxvqa.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingB2107] command /c del "C:\WINDOWS\system32\icuvwidi.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingD6] cmd /c del "C:\WINDOWS\system32\icuvwidi.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingB4874] command /c del "C:\WINDOWS\system32\iifecyaY.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingD6413] cmd /c del "C:\WINDOWS\system32\iifecyaY.dll_old"
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
 
--
End of file - 8240 bytes

           
         

Open in New Window

04.25.2008 at 01:03PM PDT, ID: 21442802

Rank: Guru

IndiGenus:

Looks like Vundo Trojan to me....let's get to work.

Download and Run ComboFix (by sUBs) You must run it directly from your Desktop.

http://download.bleepingcomputer.com/sUBs/ComboFix.exe

Disable your Anti-virus and any real-time Anti-spyware monitors that are running.
Then double click Combofix.exe & follow the prompts.
When finished, it will produce a log for you. Upload that log in your next reply with a new HijackThis log.

Please do not post the log into the comment window. Use "Attach File" under the comment window to post the log.

Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall.
Note 2: Remember to re-enable your Anti-virus and Anti-spyware.

NOTE: If you have issues connecting to your network or internet after running combofix you can either simply reboot, or do the following:
* Going to Control Panel > Network Connections.
* Right click on their Network icons & select "Repair"
or
Alternately, if the Network icon appears in the notification area in the lower right corner of Desktop, right-click it, and then click Repair from the shortcut menu.

PLEASE ALSO NOTE: Combofix will typically fix most and sometimes all Malware entries but many times a script is also needed to finish cleaning up. So please keep CF until advised whether you need the script or not.

Accepted Solution

04.25.2008 at 01:46PM PDT, ID: 21443091

cosecant:

Ran ComboFix, and here's the attached HJT log:

Also, when I start up my computer I have this Spybot S&D thing that keeps popping up in my corner notifying me of all of these registry changes and 'allowed' or 'denied'. Should I uninstall this or is this a good thing to have? It looks like something is constantly trying to change registry values?

hijackthis.log (8 KB) (File Type Details)

HJT Log

04.25.2008 at 02:05PM PDT, ID: 21443198

cosecant:

Also, to prevent future infection, what precautions should I take? What antivirus program is best? I really don't like Norton and I'm really against programs that are resource hogs. Can you offer any suggestions?

04.25.2008 at 02:32PM PDT, ID: 21443347

Rank: Guru

IndiGenus:

Hi,
Please post the combofix log also. Spybot is detecting changes (both good and bad) to the registry. While we're doing the fix here you want to disable Tea Timer. This is a quote from my combofix instructions. It includes Spybots Tea Timer. You may need to run cf again, making sure all is disabled.

>""Disable your Anti-virus and any real-time Anti-spyware monitors that are running.""<

Let's first see the combofix log.

04.25.2008 at 02:35PM PDT, ID: 21443368

Rank: Guru

IndiGenus:

For future, if this is a home/personal PC you can go with one of the free AV's such as AVG or Avast. Then either use the Windows Firewall (at a minimum) or even better one of the free firewalls such as Comodo or Outpost.

04.25.2008 at 02:41PM PDT, ID: 21443400

cosecant:

Ok I must have missed that part about turning off TeaTimer. This is the current log from ComboFix. I haven't re-ran it or anything. If you think I should turn off teatimer then re-apply combofix, let me know. Thanks so much for your help and patience as well.

log.txt (18 KB) (File Type Details)

ComboFix Log

04.25.2008 at 02:58PM PDT, ID: 21443489

Rank: Guru

IndiGenus:

Hi,

Good job so far. We are going to run combofix again, initiating it in a different manner. Yes, make sure Spybot's Tea Timer is off:
http://www.malwarehelp.org/how-to-enabledisable-spybot-teatimer.html
Also disable any other security software that's running such as your AV.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

1. Open Notepad.

2. Now copy/paste the text between the lines below into the Notepad window:

------------------------------------------------------------------------

File::
C:\WINDOWS\system32\lqsoxcsy.ini
C:\WINDOWS\system32\powehpeo.ini
C:\WINDOWS\system32\eedhbshh.ini
C:\WINDOWS\system32\nebrqhmb.ini
C:\WINDOWS\system32\ddcYppoM.dll
C:\WINDOWS\system32\iifecyaY.dll

Folder::

Driver::

Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{4020100D-29D7-4392-AFD5-5AD713FF4B88}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{41DDC6E4-C3F4-4A4A-813D-E57DE1F74D2D}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{713170B0-362F-4858-B28F-956893F732A6}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{BC676082-F500-4DA5-94B7-0325DD594723}]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"SpybotDeletingD4861"=-
"SpybotDeletingB3573"=-
"SpybotDeletingD9758"=-
"SpybotDeletingB8954"=-
"SpybotDeletingD1865"=-
"SpybotDeletingB2107"=-
"SpybotDeletingD6"=-
"SpybotDeletingB4874"=-
"SpybotDeletingD6413"=-
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\awtsSLfF]
------------------------------------------------------------------------

3. Save the above as CFScript.txt on your desktop.

4. Then drag the CFScript.txt into ComboFix.exe. This will start ComboFix again.

5. After reboot, (in case it asks to reboot), please upload the following reports/logs.

-Combofix.txt
-A new HijackThis log

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Also, you asked about preventing future problems, and good security software is only one part of it. You also need to watch your use. In your case I'm guessing you were infected from playing around with the Torrents. They have their uses (yes legal) but you need to be very careful what you download with them....you asked :)

04.25.2008 at 07:49PM PDT, ID: 21444306

cosecant:

I did as you asked, here's the logs of both ComboFix and HJT:

It didn't ask me to restart or anything, but I'm still getting a lot of TeaTime popups telling me about some registry changes. Is this normal?

Thanks again so much for your help, it's very appreciated.

log-NEW.txt (15 KB) (File Type Details)

ComboFix new

hijackthis-NEW.log (8 KB) (File Type Details)

HJT new

04.26.2008 at 06:59AM PDT, ID: 21445536

Rank: Guru

IndiGenus:

Hi,
Spybot is trying to delete the renamed malware files. Let it do so and those should clear up. These are the entries in HJT.
4 - HKCU\..\RunOnce: [SpybotDeletingD4861] cmd /c del "C:\WINDOWS\system32\icuvwidi.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingB3573] command /c del "C:\WINDOWS\system32\iifecyaY.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingD9758] cmd /c del "C:\WINDOWS\system32\iifecyaY.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingB8954] command /c del "C:\WINDOWS\system32\vtxyxvqa.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingD1865] cmd /c del "C:\WINDOWS\system32\vtxyxvqa.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingB2107] command /c del "C:\WINDOWS\system32\icuvwidi.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingD6] cmd /c del "C:\WINDOWS\system32\icuvwidi.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingB4874] command /c del "C:\WINDOWS\system32\iifecyaY.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingD6413] cmd /c del "C:\WINDOWS\system32\iifecyaY.dll_old"

Also, some cleanup to be done with HJT> again, make sure Tea Timer is disabled before running the fix with HJT.

Run HijackThis. Hit None of the above, Click Do a System Scan Only. Put a Check in the box on the left side on these:

---------------------------------

O2 - BHO: (no name) - {713170B0-362F-4858-B28F-956893F732A6} - (no file)
O2 - BHO: (no name) - {BC676082-F500-4DA5-94B7-0325DD594723} - (no file)
O4 - HKLM\..\Run: [BM7b475bc0] Rundll32.exe "C:\WINDOWS\system32\peapwocc.dll",s

---------------------------------

Then close all windows except HijackThis and press Fix checked.

04.27.2008 at 02:02AM PDT, ID: 21448554

cosecant:

I can't find those 3 lines you listed in the the HJT list, maybe they've disappeared after I uninstalled TeaTimer? I'm not sure what to do, here are my most current logs for both ComboFix and HJT, hope this helps.

hijackthis2.log (5 KB) (File Type Details)

HJT Log

ComboFix.txt (13 KB) (File Type Details)

CF log

04.27.2008 at 04:53AM PDT, ID: 21448848

Rank: Guru

IndiGenus:

Looks good. Lines were probably removed on cf second run. If all is running well you can remove cf.

Click START then Run...
Now type Combofix /u in the runbox and click OK. Note the space between the X and the U, it needs to be there.

The above procedure will:

Delete the following:
ComboFix and its associated files and folders.
VundoFix backups, if present
The C:\Deckard folder, if present
The C:_OtMoveIt folder, if present

Reset the clock settings.
Hide file extensions, if required.
Hide System/Hidden files, if required.
Reset System Restore.

04.27.2008 at 08:53PM PDT, ID: 21451509

cosecant:

Done and done, looks like problem solved. Thanks so much IndiGenus!

20080236-EE-VQP-29 / EE_QW_2_20070628