Hijackthis Problems

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: error reading MBR
kernel: error reading MBR

V-Tool by DragonMaster Jay

Microsoft Windows Vista Home Premium 6.0.6002.2.1252.1.1033.18.3838.1677 [GMT -4:00]

Username: Broadcast - Date: 03/20/2010 - Time: 12:29:14 - Number of processors: 2 - Arch.: AMD64 SF:


((((( Security Software information )))))

SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}

((((( System File Verify )))))

c:\windows\system32\eventlog.dll is missing! (If XP or lower)
c:\windows\system32\drivers\beep.sys is missing!

((((( System File Enumeration )))))

Volume in drive C is Partition_1
Volume Serial Number is 3CBD-EA70

Directory of C:\WINDOWS\System32

scecli.dll netlogon.dll cngaudit.dll
3 File(s) 967,680 bytes

Directory of C:\WINDOWS\System32\drivers

atapi.sys
1 File(s) 20,952 bytes

Directory of C:\WINDOWS\System32\DriverStore\FileRepository\mshdc.inf_1d87dda2

atapi.sys
1 File(s) 22,584 bytes

Directory of C:\WINDOWS\System32\DriverStore\FileRepository\mshdc.inf_b6d20d6f

atapi.sys
1 File(s) 20,952 bytes

Directory of C:\WINDOWS\System32\DriverStore\FileRepository\mshdc.inf_f8cccc79

atapi.sys
1 File(s) 20,072 bytes

Directory of C:\WINDOWS\SysWOW64

scecli.dll netlogon.dll cngaudit.dll
3 File(s) 781,824 bytes

Directory of C:\WINDOWS\winsxs\amd64_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.0.6000.16386_none_424bc4aceb06de1c

cngaudit.dll
1 File(s) 14,848 bytes

Directory of C:\WINDOWS\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6001.18000_none_942c7ddf9178e048

scecli.dll
1 File(s) 235,520 bytes

Directory of C:\WINDOWS\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6002.18005_none_9617f6eb8e9aab94

scecli.dll
1 File(s) 235,520 bytes

Directory of C:\WINDOWS\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6001.18000_none_59d652c6f057598d

netlogon.dll
1 File(s) 716,800 bytes

Directory of C:\WINDOWS\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6002.18005_none_5bc1cbd2ed7924d9

netlogon.dll
1 File(s) 717,312 bytes

Directory of C:\WINDOWS\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.0.6001.18000_none_3956c39dd9e73fd2

atapi.sys
1 File(s) 22,584 bytes

Directory of C:\WINDOWS\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.0.6002.18005_none_3b423ca9d7090b1e

atapi.sys
1 File(s) 20,952 bytes

Directory of C:\WINDOWS\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6001.18000_none_9e812831c5d9a243

scecli.dll
1 File(s) 177,152 bytes

Directory of C:\WINDOWS\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6002.18005_none_a06ca13dc2fb6d8f

scecli.dll
1 File(s) 177,152 bytes

Directory of C:\WINDOWS\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6001.18000_none_642afd1924b81b88

netlogon.dll
1 File(s) 592,384 bytes

Directory of C:\WINDOWS\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6002.18005_none_6616762521d9e6d4

netlogon.dll
1 File(s) 592,896 bytes

Directory of C:\WINDOWS\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.0.6000.16386_none_e62d292932a96ce6

cngaudit.dll
1 File(s) 11,776 bytes

Total Files Listed:
22 File(s) 5,348,960 bytes
0 Dir(s) 283,042,242,560 bytes free

-----------------------------

+++ End-of-file +++

• Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
  
• Under the Custom Scan box paste this in
  
  netsvcs
  msconfig
  safebootminimal
  safebootnetwork
  activex
  drivers32
  %SYSTEMDRIVE%\*.exe
  %systemroot%\*. /mp /s
  c:\$recycle.bin\*.* /s
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs
  /md5start
  eventlog.dll
  scecli.dll
  netlogon.dll
  cngaudit.dll
  sceclt.dll
  ntelogon.dll
  logevent.dll
  iaStor.sys
  nvstor.sys
  nvstor32.sys
  atapi.sys
  IdeChnDr.sys
  viasraid.sys
  AGP440.sys
  vaxscsi.sys
  nvatabus.sys
  viamraid.sys
  nvata.sys
  nvgts.sys
  iastorv.sys
  ViPrt.sys
  eNetHook.dll
  explorer.exe
  svchost.exe
  userinit.exe
  qmgr.dll
  ws2_32.dll
  proquota.exe
  imm32.dll
  kernel32.dll
  ndis.sys
  autochk.exe
  spoolsv.exe
  xmlprov.dll
  ntmssvc.dll
  mswsock.dll
  Beep.SYS
  ntfs.sys
  termsrv.dll
  sfcfiles.dll
  st3shark.sys
  ahcix86.sys
  srsvc.dll
  nvrd32.sys
  /md5stop
  %systemroot%\system32\*.dll /lockedfiles
  %systemroot%\Tasks\*.job /lockedfiles
  
• Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
  
  
  
  • When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
    
  • Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time
    
  
  

• Copy the commands with file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):
  
  
  :files
  C:\Users\Broadcast\AppData\Local\23755159.dll
  
  :folders
  C:\Users\Broadcast\AppData\Local\QJyrk5wvCU1
  C:\ProgramData\QJyrk5wvCU1
  
  :commands
  [purity]
  [emptytemp]
  [reboot]
  
  
  
• Return to OTL.exe, right click in the "Custom Scans/Fixes" window (under the light green bar) and choose Paste.
  
  
• Click the red Run Fix button.
  
• A fix log in Notepad will appear. Copy the contents of the fix log to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
  
• Close OTL.exe
  

• Copy the commands with file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):
  
  
  :otl
  FF - prefs.js..browser.search.selectedEngine: "Kiwee Live Search"
  FF - prefs.js..extensions.enabledItems: toolbar@kiwee.com:1.0
  FF - prefs.js..keyword.URL: "http://kwtb.search.imgag.com/?c=GNKIW29193&sbs=1&sc=2&f=web&vernum=1.0&uid=&did=f8d4a70c-98e2-4081-901d-01bf93043ede&q="
  FF - HKLM\software\mozilla\Firefox\Extensions\\toolbar@kiwee.com: C:\Program Files (x86)\Kiwee Toolbar\2.9.201\firefox [2009/07/07 12:55:45 | 000,000,000 | ---D | M]
  O2 - BHO: (Kiwee Toolbar) - {6638A9DE-0745-4292-8A2E-AE530E7B9B3F} - C:\Program Files (x86)\Kiwee Toolbar\2.9.201\KiweeIEToolbar.dll (AG Interactive)
  O3 - HKLM\..\Toolbar: (Kiwee Toolbar) - {6638A9DE-0745-4292-8A2E-AE530E7B9B3F} - C:\Program Files (x86)\Kiwee Toolbar\2.9.201\KiweeIEToolbar.dll (AG Interactive)
  O3 - HKCU\..\Toolbar\WebBrowser: (Kiwee Toolbar) - {6638A9DE-0745-4292-8A2E-AE530E7B9B3F} - C:\Program Files (x86)\Kiwee Toolbar\2.9.201\KiweeIEToolbar.dll (AG Interactive)
  
  :files
  C:\Users\Broadcast\AppData\Roaming\Mozilla\FireFox\Profiles\07vm14rp.default\searchplugins\kiwee-live-search.xml
  
  :commands
  [emptytemp]
  [reboot]
  
  
  
• Return to OTL.exe, right click in the "Custom Scans/Fixes" window (under the light green bar) and choose Paste.
  
  
• Click the red Run Fix button.
  
• A fix log in Notepad will appear. Copy the contents of the fix log to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
  
• Close OTL.exe
  

@echo off
echo Now doing DLL cleanup. If you do not want this, exit now...
pause
echo DLL Cleanup > dllcleanup.txt
regsvr32 /u wuapi.dll >> dllcleanup.txt
regsvr32 /u wuaueng.dll >> dllcleanup.txt
regsvr32 /u wucltui.dll >> dllcleanup.txt
regsvr32 /u wups.dll >> dllcleanup.txt
regsvr32 /u wuweb.dll >> dllcleanup.txt
regsvr32 /u atl.dll >> dllcleanup.txt
regsvr32 /u softpub.dll >> dllcleanup.txt
regsvr32 /u wintrust.dll >> dllcleanup.txt
regsvr32 /u initpki.dll >> dllcleanup.txt
regsvr32 /u mssip32.dll >> dllcleanup.txt
pause
regsvr32 /s wuapi.dll >> dllcleanup.txt
regsvr32 /s wuaueng.dll >> dllcleanup.txt
regsvr32 /s wucltui.dll >> dllcleanup.txt
regsvr32 /s wups.dll >> dllcleanup.txt
regsvr32 /s wuweb.dll >> dllcleanup.txt
regsvr32 /s atl.dll >> dllcleanup.txt
regsvr32 /s softpub.dll >> dllcleanup.txt
regsvr32 /s wintrust.dll >> dllcleanup.txt
regsvr32 /s initpki.dll >> dllcleanup.txt
regsvr32 /s mssip32.dll >> dllcleanup.txt
echo (((((( EOF )))))) >> dllcleanup.txt
start dllcleanup.txt
pause
delete dllcleanup.bat

• Extract it to your Desktop.
  
• Then, double-click on the program and click the Fix Windows Update button.
  
• Reboot your computer and see if it will work now.

DLL Cleanup
(((((( EOF ))))))

• Tick the box next to YES, I accept the Terms of Use
  
• Click Start
  
• When asked, allow the ActiveX control to install
  
• Click Start
  
• Make sure that the options Remove found threats and the option Scan unwanted applications is checked
  
• Click Scan (This scan can take several hours, so please be patient)
  
• Once the scan is completed, you may close the window
  
• Use Notepad to open the logfile located at C:\Program Files\EsetOnlineScanner\log.txt
  
• Copy and paste that log as a reply to this topic
  

• Go to Control Panel and select System and Maintenance
  
• Select System
  
• On the left select Advance System Settings and accept the warning if you get one
  
• Select System Protection Tab
  
• Select Create at the bottom
  
• Type in a name i.e. Clean
  
• Select Create

• Go back to the System and Maintenance page
  
• Select Performance Information and Tools
  
• On the left select Open Disk Cleanup
  
• Select Files from all users and accept the warning if you get one
  
• In the drop down box select your main drive i.e. C
  
• For a few moments the system will make some calculations
  
• Select the More Options tab
  
• In the System Restore and Shadow Backups select Clean up
  
• Select Delete on the pop up
  
• Select OK
  
• Select Delete

• Save it to your Desktop.
  
• Double click OTC.exe.
  
• Click the CleanUp! button.
  
• If you are prompted to Reboot during the cleanup, select Yes.
  
• The tool will delete itself once it finishes.
  

• Please double-click TFC.exe to run it. (Note: If you are running on Vista, right-click on the file and choose Run As Administrator).
  
• It will close all programs when run, so make sure you have saved all your work before you begin.
  
• Click the Start
  button to begin the process. Depending on how often you clean temp
  files, execution time should be anywhere from a few seconds to a minute
  or two. Let it run uninterrupted to completion.
  
• Once it's finished it should reboot your machine. If it does not, please manually reboot the machine yourself to ensure a complete clean.

• Save it to your Desktop.
• Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
• A Notepad document should open automatically called checkup.txt; please post the contents of that document.

• Tallemu Online Armor: the free version is just as good as the premium. I have linked you to the free version.
  
• Comodo Firewall: the free version is just as good as the premium. I have linked you to the free version. The optional security suite enhances the firewall by 40% increase. If you would like to install the suite that includes antivirus, then remove your old antivirus first.
  
• PC Tools Firewall Plus: free and excellent firewall.

• SpywareBlaster
  SpywareBlaster is a program that prevents spyware from installing on your computer. A tutorial on using SpywareBlaster may be found here.
  
• Spybot - Search & Destroy.
  Spybot - Search & Destroy is a spyware and adware removal program. It also has realtime protection, TeaTimer to help safeguard your computer against spyware. (The link for Spybot - Search & Destroy contains a tutorial that will help you download, install, and begin using Spybot).
  

• Windows Updates - It is very important to make sure that both Internet Explorer and Windows are kept current with the latest critical security patches from Microsoft. To do this just start Internet Explorer and select Tools > Windows Update, and follow the online instructions from there.
  
• hpHosts file replaces your current HOSTS file with one containing well known ad sites and other bad sites. This prevents your computer from connecting to those sites by redirecting them to 127.0.0.1, which is your local computer's loopback address, meaning it will be difficult to infect your computer in the future.
  

• Firefox may be downloaded from here: http://www.getfirefox.com
  
• Opera is available here: http://www.opera.com/download/