Can't change desktop's background

SDFix as IndiGenus suggested will remove all SDBot related nasties in the system,
IF problem persists after running SDFix, you might like to run Combofix as well or other scanners in addition to SDFix, in case SDFix won't remove some of the trojans below.

Troj/DllLoad-C
O23 - Service: Application that interactively manages NT services (svcmngr) - Unknown owner - C:\WINDOWS\config\config.exe
O23 - Service: MsSecurity (MsSecurity1.203.2) - Unknown owner - C:\WINDOWS\wllv.exe
O23 - Service: Universal Serial Bus Control Control (UniSerialControlCNT) - Unknown owner - C:\WINDOWS\restore\host\explorer.exe


Please download ComboFix by sUBs:
http://download.bleepingcomputer.com/sUBs/ComboFix.exe


You must download it to and run it from your Desktop
Now STOP all your monitoring programs (Antivirus/Antispyware, Guards and Shields) as they could easily interfere with ComboFix.
Double click combofix.exe & follow the prompts.
When finished, it will produce a log. Please save that log and attach it in your next reply along with a fresh HJT log
Re-enable all the programs that were disabled during the running of ComboFix..


Note:
Do not mouse-click combofix's window while it is running. That may cause it to stall.

CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

hmmm... something is going on..... SDFix is supposed to delete this file as well but it didn't --> C:\WINDOWS\system32\mbti.exe

Lots of trojans that still needs to be deleted under the "firewallpolicy" list.

Not to worry, we should be able to(try) get rid them.

That is strange, something probably regenerated it. Definitely need to go with combofix here too as rpg had advised.

I would like to suggest that you install Recovery Console before we will continue with the cleanup.

How to install and use the Windows XP Recovery Console (for users with Windows CD)
http://www.bleepingcomputer.com/tutorials/tutorial117.html


The link below shows you how to install Recovery Console using Combofix (for users who don't have Windows CD)
http://www.bleepingcomputer.com/combofix/how-to-use-combofix



IndiGenus,
If we proceed.............  see part of the log below?
What do you think?


[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager\subsystems]
"Windows"= basejxk32.dll


--------------------- DLLs Loaded Under Running Processes ---------------------

-> C:\WINDOWS\restore\host\explorer.exe
-> C:\WINDOWS\restore\host\ADMDLL.dll
PROCESS: C:\WINDOWS\explorer.exe

PROCESS: C:\WINDOWS\system32\csrss.exe
-> C:\WINDOWS\system32\basejxk32.dll
.
------------------------ Other Running Processes ------------------------

@rpg: [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager\subsystems]
"Windows"= basejxk32.dll
I have to think that file is bad. Cannot find anything on it. Probably have them upload for analysis.

@cmsarkiss: Please go to http://virusscan.jotti.org, click on Browse, and upload the following file for analysis:

C:\WINDOWS\system32\basejxk32.dll

Then click Submit. Allow the file to be scanned, and then please copy and paste the results here for us to see.

If Jotti is too busy you can try these.

http://www.kaspersky.com/scanforvirus.html
http://www.virustotal.com/en/indexf.html

This one: C:\WINDOWS\restore\host\ADMDLL.dll
From google search: ""Programs that let you remotely control another computer use the ADMDLL.DLL file. The ADMDLL.DLL file is often associated with several Trojan horses as well.""

The location of it makes me think that it's definitely bad.

basejxk32.dll
Yes, it is bad, but I'm not sure Combofix will delete it without an RC installed. Combofix won't delete files that could render pc unbootable unless RC is installed.
The semi-random name file that can render the pc unbootable if we delete it without deleting the reg entry. Same or similar to an infection that patched user32.dll or other system files.

See the semi-random "basengt32.dll" below? that looks like the same nasty as we have here in cmsarkiss case.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager\subsystems]
"Windows"= basengt32.dll

.
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

PROCESS: C:\WINDOWS\system32\csrss.exe
-> C:\WINDOWS\system32\basengt32.dll
.
Completion time: 2008-02-11 9:01:10 - machine was rebooted
.
2008-02-04 21:02:24 --- E O F ---

OK here is what I have. rpg if you see anything missing please advise. There's some strange things going on here. I believe at least one rootkit is present too.

1. Open Notepad.

2. Now copy/paste the text between the lines below into the Notepad window:

------------------------------------------------------------------------

File::
C:\WINDOWS\autoexe.exe
C:\WINDOWS\SYSTEM32\winsconf32.dll
C:\WINDOWS\swinsecur.exe
C:\WINDOWS\SYSTEM32\winsconfg.dll
C:\Program Files\setupxv.exe
C:\wllv.exe
C:\WINDOWS\wllv.exe
C:\WINDOWS\mscon.vga
C:\WINDOWS\conlex.eom
C:\WINDOWS\winxd.xc
C:\WINDOWS\_detmp.1
C:\WINDOWS\_detmp.2

Folder::
C:\WINDOWS\SYSTEM32\1374

Driver::
MsSecurity1.203.2
DMSKSSRh

Registry::
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ddcyaby]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\__c001742B]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\__c007A024]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\__c00FAF49]

------------------------------------------------------------------------

3. Save the above as CFScript.txt on your desktop.

4. Then drag the CFScript.txt into ComboFix.exe. This will start ComboFix again.

5. After reboot, (in case it asks to reboot), please upload the following reports/logs.

-Combofix.txt
-A new HijackThis log

Excellent job as always IndiGenus, I couldn't have done better than that.

cmsarkiss,
Good job with the RC install.

It certainly has something suspicious there.
the registry is calling for a file that is not found in the CF log.
The host folder where explorer.exe is running from is very suspicious. Though it's dated 2003? It certainly worth looking for rootkits as well.

It's also showing in the Hijackthis log. He has 2 explorer.exe running. why is that? We should kill it I think. Or is that for some reason legit?
O23 - Service: Universal Serial Bus Control Control (UniSerialControlCNT) - Unknown owner - C:\WINDOWS\restore\host\explorer.exe

Can you please run this script and let's see what else is in that folder?

DirLook::
C:\WINDOWS\restore\host

Sorry, same thing you did as IndiGenus instructed before, but only this time the script just contain 2 lines, we just want combofix to check the contents of the "host" folder.
Alternatively, you can manually check it yourself via windows explorer and give us the list of the contents of that folder.

Open notepad and copy/paste the text inside the lines below into it.
--------------------------------------------------------------
DirLook::
C:\WINDOWS\restore\host

--------------------------------------------------------------
Save this as CFScript in the same location as ComboFix.exe
Then drag CFScript.txt into ComboFix.exe

This will start ComboFix again. Follow the prompts. After reboot, (in case it asks to reboot), attach the contents of Combofix.txt in your next reply.

@indiGenus,
that's the best canned speech I've seen, very clear and clean layout, mind if I used that?

1. Open Notepad.

2. Now copy/paste the text between the lines below into the Notepad window:

------------------------------------------------------------------------

File::
C:\WINDOWS\config\config.exe

DirLook::
C:\WINDOWS\config

Folder::
C:\WINDOWS\restore\host

Driver::
UniSerialControlCNT
svcmngr

------------------------------------------------------------------------

3. Save the above as CFScript.txt on your desktop.

4. Then drag the CFScript.txt into ComboFix.exe. This will start ComboFix again.

5. After reboot, (in case it asks to reboot), please upload the following reports/logs.

-Combofix.txt
-A new HijackThis log

Beat me to it, I think that "config" folder is bad, likely Backdoor.Ranky

C:\WINDOWS\zjxn <-- is it related to zjxn.com which is a bad site?

C:\WINDOWS\SYSTEM32\runtime <-- I'm suspicious on this one too.

what do you think?

Getting there I think. As rpg said I think we can delete that folder:

C:\WINDOWS\config

You can doing it manually using Windows Explorer. If problems let us know and we can advise a tool for removal, or try in Safe Mode.

I think both of those other folders you pointed out are bad too.
C:\WINDOWS\zjxn  
C:\WINDOWS\SYSTEM32\runtime

Other than that I would advise next a rootkit scan or 2. This was a nasty one. How's it running now?

There are several different scanners. Here is one we can try:

Download Rootkit Revealer here (bottom of page):

http://www.microsoft.com/technet/sysinternals/utilities/RootkitRevealer.mspx

Unzip the files and run RootkitRevealer.exe.

Press the scan button. Try to leave the system idle while running.

When done select File-->Save...and post the contents of the log.

Well I don't see anything too bad in there...

The System Volume Information folder is your restore points. Those can and should be cleaned out. Simply turn off system restore, then back on again. Described here...

http://www.sophos.com/support/knowledgebase/article/10386.html

On the Potentially harmful program I'm not sure. It may be part of RKR. Did it give you a file name? What did you select to do with it?

Yes, you should have no old restore points. You didn't want them anyway as they were probably infected. You should have a new restore point now (clean) if you followed the instructions.