Trojan Vundo

Dear Milton or Belahzur,

My Computer apparently has a Trojan Vundo and I scanned it with MBAM, and it said it removed it, but I think It's recreating itself, another factor is that ComboFix will not work on my computer. Please help me out until it's solved.

Please read here and post a Hijack This log.
http://www.geekpolice.net/malware-removal-hijackthis-logs-f11/read-this-before-posting-t3821.htm

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:07:47 PM, on 12/29/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Novell\XTAgent.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
C:\Program Files\Novell\ZENworks\nalntsrv.exe
C:\Program Files\Novell\ZENworks\RemoteManagement\RMAgent\ZenRem32.exe
C:\WINDOWS\system32\StacSV.exe
C:\Program Files\Novell\ZENworks\wm.exe
C:\Program Files\Novell\ZENworks\WMRUNDLL.EXE
C:\WINDOWS\system32\dpmw32.exe
C:\WINDOWS\system32\NWTRAY.EXE
C:\program files\novell\zenworks\nalwin.exe
C:\Program Files\Novell\ZENworks\NalAgent.exe
C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\SigmaTel\C-Major Audio\WDM\stsystra.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\iprntlgn.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
C:\Program Files\RocketDock\RocketDock.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\MSN\Toolbar\3.0.0983.0\msntask.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Documents and Settings\TXS6696\Local Settings\Temporary Internet Files\Content.IE5\9V1XGUXG\hijackgpthis[1].exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.coppellisd.com/newtech
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 10.0.0.6:8080
O2 - BHO: (no name) - {5C7C99DA-3C4B-4C5E-AFBA-4A861B499F0E} - C:\WINDOWS\system32\byXNddaB.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: {4f62126c-4fdf-1768-0484-0c2e8cee5248} - {8425eec8-e2c0-4840-8671-fdf4c62126f4} - C:\WINDOWS\system32\benjsg.dll
O2 - BHO: GrandBar IE Helper - {84BA8988-33E1-4c89-A150-BF428E8D3213} - C:\Program Files\GrandPack\GrandPack.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Contribute Toolbar - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - C:\Program Files\Adobe\/Adobe Contribute CS3/contributeieplugin.dll
O3 - Toolbar: MSN Toolbar - {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - C:\Program Files\MSN\Toolbar\3.0.0983.0\msneshellx.dll
O4 - HKLM\..\Run: [NDPS] C:\WINDOWS\system32\dpmw32.exe
O4 - HKLM\..\Run: [NWTRAY] NWTRAY.EXE
O4 - HKLM\..\Run: [VMware Tools] C:\Program Files\VMware\VMware Tools\VMwareTray.exe
O4 - HKLM\..\Run: [VMware User Process] C:\Program Files\VMware\VMware Tools\VMwareUser.exe
O4 - HKLM\..\Run: [NAL] c:\program files\novell\zenworks\nalwin.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Startup] c:\windows\system32\startup.exe
O4 - HKLM\..\Run: [ZENRC Tray Icon] C:\WINDOWS\system32\zentray.exe
O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe"
O4 - HKLM\..\Run: [Adobe_ID0EYTHM] C:\PROGRA~1\COMMON~1\Adobe\ADOBEV~1\Server\bin\VERSIO~2.EXE
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [SigmatelSysTrayApp] %ProgramFiles%\SigmaTel\C-Major Audio\WDM\stsystra.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [iPrint Tray] C:\WINDOWS\system32\iprntctl.exe TRAY_ICON
O4 - HKLM\..\Run: [iPrint Event Monitor] C:\WINDOWS\system32\iprntlgn.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\RunOnce: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [RocketDock] "C:\Program Files\RocketDock\RocketDock.exe"
O4 - Startup: OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
O8 - Extra context menu item: Append to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: Novell delivered applications - {C1994287-422F-47aa-8E5E-6323E210A125} - C:\Program Files\Novell\ZENworks\AxNalServer.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: *.antimalwareguard.com
O15 - Trusted Zone: *.gomyhit.com
O15 - Trusted Zone: *.antimalwareguard.com (HKLM)
O15 - Trusted Zone: *.gomyhit.com (HKLM)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1214236219078
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1214256982953
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: TPSvc - C:\WINDOWS\SYSTEM32\TPSvc.dll
O23 - Service: Adobe Version Cue CS3 - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\Adobe Version Cue CS3\Server\bin\VersionCueCS3.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Client Update Service for Novell (cusrvc) - Novell, Inc. - C:\WINDOWS\system32\cusrvc.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Novell Application Launcher (NALNTSERVICE) - Novell, Inc. - C:\Program Files\Novell\ZENworks\nalntsrv.exe
O23 - Service: Novell ZENworks Remote Management Agent (Remote Management Agent) - Novell, Inc. - C:\Program Files\Novell\ZENworks\RemoteManagement\RMAgent\ZenRem32.exe
O23 - Service: SigmaTel Audio Service (STacSV) - SigmaTel, Inc. - C:\WINDOWS\system32\StacSV.exe
O23 - Service: TP AutoConnect Service (TPAutoConnSvc) - ThinPrint GmbH - C:\Program Files\VMware\VMware Tools\TPAutoConnSvc.exe
O23 - Service: VMware Tools Service (VMTools) - VMware, Inc. - C:\Program Files\VMware\VMware Tools\VMwareService.exe
O23 - Service: Novell XTier Agent Services (XTAgent) - Novell, Inc. - C:\WINDOWS\System32\Novell\XTAgent.exe
O23 - Service: Workstation Manager (ZFDWM) - Novell, Inc. - C:\Program Files\Novell\ZENworks\wm.exe

--
End of file - 10841 bytes

Hello.

• Open HijackThis
  
• Choose "Do a system scan only"
  
• Check the boxes in front of these lines:
  
  
  O2 - BHO: (no name) - {5C7C99DA-3C4B-4C5E-AFBA-4A861B499F0E} - C:\WINDOWS\system32\byXNddaB.dll
  O2 - BHO: {4f62126c-4fdf-1768-0484-0c2e8cee5248} - {8425eec8-e2c0-4840-8671-fdf4c62126f4} - C:\WINDOWS\system32\benjsg.dll
  O2 - BHO: GrandBar IE Helper - {84BA8988-33E1-4c89-A150-BF428E8D3213} - C:\Program Files\GrandPack\GrandPack.dll
  O4 - HKLM\..\Run: [Startup] c:\windows\system32\startup.exe
  O15 - Trusted Zone: *.antimalwareguard.com
  O15 - Trusted Zone: *.gomyhit.com
  O15 - Trusted Zone: *.antimalwareguard.com (HKLM)
  O15 - Trusted Zone: *.gomyhit.com (HKLM)
  
  
  
  
• Press "Fix Checked"
  
• Close Hijack This.
  

• Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  
• If an update is found, it will download and install the latest version.
  
• Once the program has loaded, select "Perform Quick Scan", then click Scan.
  
• The scan may take some time to finish,so please be patient.
  
• When the scan is complete, click OK, then Show Results to view the results.
  
• Make sure that everything is checked, and click Remove Selected.
  
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Note)
  
• The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  

Note:
If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts.
Click OK to either and let MBAM proceed with the disinfection process.
If asked to restart the computer, please do so immediately.

Post the contents of the MBAM Log.

Alright dude the only one's that I found on the list were the following,

O4 - HKLM\..\Run: [Startup] c:\windows\system32\startup.exe
O15 - Trusted Zone: *.antimalwareguard.com
O15 - Trusted Zone: *.gomyhit.com
O15 - Trusted Zone: *.antimalwareguard.com (HKLM)
O15 - Trusted Zone: *.gomyhit.com (HKLM)

Okay, do what you can in HJT and move onto MBAM.

Holy Crap dude..

1 Malware Trace
2 Trojan Vundo's
13 Trojan Vundo H's

God.. What do I do

Malwarebytes' Anti-Malware 1.31
Database version: 1475
Windows 5.1.2600 Service Pack 3

12/29/2008 8:33:13 PM
mbam-log-2008-12-29 (20-33-13).txt

Scan type: Quick Scan
Objects scanned: 78216
Time elapsed: 2 minute(s), 44 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 2
Registry Keys Infected: 6
Registry Values Infected: 0
Registry Data Items Infected: 2
Folders Infected: 0
Files Infected: 6

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
C:\WINDOWS\system32\byXNddaB.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\ufsyuajb.dll (Trojan.Vundo.H) -> Delete on reboot.

Registry Keys Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5c7c99da-3c4b-4c5e-afba-4a861b499f0e} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{5c7c99da-3c4b-4c5e-afba-4a861b499f0e} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{5c7c99da-3c4b-4c5e-afba-4a861b499f0e} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\contim (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Track System (Trojan.Vundo) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Security Packages (Trojan.Vundo.H) -> Data: c:\windows\system32\byxnddab -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Authentication Packages (Trojan.Vundo.H) -> Data: c:\windows\system32\byxnddab -> Quarantined and deleted successfully.

Folders Infected:
(No malicious items detected)

Files Infected:
C:\WINDOWS\system32\byXNddaB.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\BaddNXyb.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\BaddNXyb.ini2 (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\ufsyuajb.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\bjauysfu.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\Documents and Settings\TXS6696\Local Settings\Temporary Internet Files\Content.IE5\WSK4PQ5R\upd105320[1] (Trojan.Vundo.H) -> Quarantined and deleted successfully.

Don't Vundo's recreate themselves?

Yes, but MBAM has disable the run value for it so the main file cannot recreate themself.

• Download combofix from here, use the top links - combofix.exe
  
• Please disable your local AV (Anti-virus) by right clicking it's icon in the tray, and exit it.
  
• Double click on ComboFix.exe.
  
• Follow the prompts. NOTE:
  
• ComboFix will check to see if the Microsoft Windows Recovery Console is installed.
  ***It's strongly recommended to have the Recovery Console installed before doing any malware removal.***
  
  **Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will automatically proceed with its scan.
  
  
  
• The Recovery Console provides a recovery/repair mode should a problem occur during a Combofix run.
  
  
  
  
• Allow ComboFix to download the Recovery Console.
  
• Accept the End-User License Agreement.
  
• The Recovery Console will be installed.
  
• You will then get this next prompt that asks if you want to continue the malware scan, select yes
  
  
  
  
• Allow combofix to run
  
• Post C:\combofix.txt back here.
  
  Note:
  Do not mouseclick combofix's window whilst it's running. That may cause it to stall.
  

ComboFix Doesn't work on this computer.

Okay, lets use this.

• Download random's system information tool (RSIT) by random/random from here and save it to your desktop.
  
• Double click on RSIT.exe to run RSIT.
  
• Click Continue at the disclaimer screen.
  
• Once it has finished, two logs will open. Please post the contents of both log.txt (<< will be maximized) and info.txt (<< will be minimized)
  

Doesn't working either, says error parrsing function cell.

Please download DDS (by sUBs) to your Desktop from one of these locations:
http://www.techsupportforum.com/sectools/sUBs/dds
http://download.bleepingcomputer.com/sUBs/dds.scr
http://www.forospyware.com/sUBs/dds

Double click DDS.scr to run
When complete, DDS.txt will open.

Click No for Optional Scan.
Save the report to your Desktop.

Post DDS.txt back here.

C:\WINDOWS\system32\NWTRAY.EXE
C:\Program Files\Novell\ZENworks\nalntsrv.exe
C:\program files\novell\zenworks\nalwin.exe
C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\SigmaTel\C-Major Audio\WDM\stsystra.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Novell\ZENworks\NalAgent.exe
C:\Program Files\Novell\ZENworks\RemoteManagement\RMAgent\ZenRem32.exe
C:\WINDOWS\system32\iprntlgn.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\RocketDock\RocketDock.exe
C:\WINDOWS\system32\StacSV.exe
C:\Program Files\Novell\ZENworks\wm.exe
C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
C:\Program Files\Novell\ZENworks\WMRUNDLL.EXE
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\MSN\Toolbar\3.0.0983.0\msntask.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Java\jre6\bin\java.exe
C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrobat.exe
C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe
C:\Program Files\IObit\IObit SmartDefrag\IObit SmartDefrag.exe
C:\Documents and Settings\TXS6696\Local Settings\Temporary Internet Files\Content.IE5\WSK4PQ5R\dds[1].com

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.coppellisd.com/newtech
uInternet Settings,ProxyOverride = ;reef000s288.cert.mobiledomain.net;mobile.domain;10.1.0.51;*.coppellisd.com
uInternet Settings,ProxyServer = 10.0.0.6:8080
mWinlogon: System=ziswin.exe
BHO: Java(tm) Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre6\bin\ssv.dll
BHO: {4f62126c-4fdf-1768-0484-0c2e8cee5248}: {8425eec8-e2c0-4840-8671-fdf4c62126f4} - c:\windows\system32\benjsg.dll
BHO: GrandBar IE Helper: {84ba8988-33e1-4c89-a150-bf428e8d3213} - c:\program files\grandpack\GrandPack.dll
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
TB: Adobe PDF: {47833539-d0c5-4125-9fa8-0819e2eaac93} - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll
TB: Contribute Toolbar: {517bdde4-e3a7-4570-b21e-2b52b6139fc7} - c:\program files\adobe\/Adobe Contribute CS3/contributeieplugin.dll
TB: MSN Toolbar: {1e61ed7c-7cb8-49d6-b9e9-ab4c880c8414} - c:\program files\msn\toolbar\3.0.0983.0\msneshellx.dll
TB: {604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - No File
EB: Internet Speed Monitor: {17bfcf1a-b579-48a7-9849-719ddd11d340} - c:\program files\grandpack\GrandPack.dll
EB: Adobe PDF: {182ec0be-5110-49c8-a062-beb1d02a220b} - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [Skype] "c:\program files\skype\phone\Skype.exe" /nosplash /minimized
uRun: [MsnMsgr] "c:\program files\windows live\messenger\MsnMsgr.Exe" /background
uRun: [RocketDock] "c:\program files\rocketdock\RocketDock.exe"
mRun: [NDPS] c:\windows\system32\dpmw32.exe
mRun: [NWTRAY] NWTRAY.EXE
mRun: [VMware Tools] c:\program files\vmware\vmware tools\VMwareTray.exe
mRun: [VMware User Process] c:\program files\vmware\vmware tools\VMwareUser.exe
mRun: [NAL] c:\program files\novell\zenworks\nalwin.exe
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 8.0\reader\Reader_sl.exe"
mRun: [ZENRC Tray Icon] c:\windows\system32\zentray.exe
mRun: [Acrobat Assistant 8.0] "c:\program files\adobe\acrobat 8.0\acrobat\Acrotray.exe"
mRun: []
mRun: [Adobe_ID0EYTHM] c:\progra~1\common~1\adobe\adobev~1\server\bin\VERSIO~2.EXE
mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
mRun: [Persistence] c:\windows\system32\igfxpers.exe
mRun: [SigmatelSysTrayApp] %ProgramFiles%\SigmaTel\C-Major Audio\WDM\stsystra.exe
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
mRun: [iPrint Tray] c:\windows\system32\iprntctl.exe TRAY_ICON
mRun: [iPrint Event Monitor] c:\windows\system32\iprntlgn.exe
mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
StartupFolder: c:\docume~1\txs6696\startm~1\programs\startup\onenot~1.lnk - c:\program files\microsoft office\office12\ONENOTEM.EXE
mPolicies-system: CompatibleRUPSecurity = 1 (0x1)
IE: Append to existing PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert link target to Adobe PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert link target to existing PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert selected links to Adobe PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert selected links to existing PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Convert selection to Adobe PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert selection to existing PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert to Adobe PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: E&xport to Microsoft Excel - c:\progra~1\micros~3\office12\EXCEL.EXE/3000
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~3\office12\ONBttnIE.dll
IE: {77BF5300-1474-4EC7-9980-D32B190E9B07} - {77BF5300-1474-4EC7-9980-D32B190E9B07} - c:\program files\skype\toolbars\internet explorer\SkypeIEPlugin.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~3\office12\REFIEBAR.DLL
IE: {C1994287-422F-47aa-8E5E-6323E210A125} - {4B5F7606-8666-4D5A-9780-DB92A9D8812B} - c:\program files\novell\zenworks\AxNalServer.dll
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
Notify: igfxcui - igfxdev.dll
Notify: NetIdentity Notification - c:\windows\system32\novell\XtNotify.dll
Notify: TPSvc - TPSvc.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SEH: {763370c4-268e-4308-a60c-d8da0342be32} - c:\program files\novell\zenworks\NalShell.dll
SecurityProviders: msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll, digeste.dll
LSA: Authentication Packages = msv1_0 nwv1_0

============= SERVICES / DRIVERS ===============

R0 vmscsi;vmscsi;c:\windows\system32\drivers\vmscsi.sys [2008-6-23 17968]
R1 nipplpt2;Novell iCapture Lpt Redirector 2;c:\windows\system32\drivers\nipplpt.sys [2008-6-23 34671]
R2 BlankScr;HBDevice;c:\windows\system32\drivers\BlankScr.sys [2005-5-23 6899]
R2 hgfs;hgfs;c:\windows\system32\drivers\hgfs.sys [2008-6-23 92592]
R2 LGTO_Sync;Sync Driver;\??\c:\windows\system32\drivers\lgtosync.sys [2008-6-23 36400]
R2 Remote Management Agent;Novell ZENworks Remote Management Agent;c:\program files\novell\zenworks\remotemanagement\rmagent\ZenRem32.exe [2006-5-9 167936]
R2 VMMEMCTL;VMware server memory controller;\??\c:\program files\vmware\vmware tools\drivers\memctl\vmmemctl.sys [2008-5-15 15408]
R2 XTAgent;Novell XTier Agent Services;c:\windows\system32\novell\XTAgent.exe [2007-12-24 61440]
R3 Darpan;Darpan;c:\windows\system32\drivers\Darpan.sys [2005-5-23 2773]
S2 VMTools;VMware Tools Service;"c:\program files\vmware\vmware tools\VMwareService.exe" [2008-5-15 264752]
S3 TPAutoConnSvc;TP AutoConnect Service;"c:\program files\vmware\vmware tools\TPAutoConnSvc.exe" [2008-5-15 294912]
S3 vmmouse;VMware Pointing Device;c:\windows\system32\drivers\vmmouse.sys [2008-6-23 11696]
S3 vmx_svga;vmx_svga;c:\windows\system32\drivers\vmx_svga.sys [2008-6-23 62768]
S3 vmxnet;VMware Ethernet Adapter Driver;c:\windows\system32\drivers\vmxnet.sys [2008-6-23 34992]

=============== Created Last 30 ================

2008-12-30 13:44 389,120 a------- c:\windows\system32\CF6956.exe
2008-12-29 18:52 131,584 a------- c:\windows\system32\benjsg.dll
2008-12-29 18:52 131,584 a------- c:\windows\system32\mvclwmtr.dll
2008-12-29 18:49 52,224 a------- c:\windows\system32\ssqpQGaY.dll
2008-12-21 21:29 133,632 a------- C:\New Virtual Machine Hard Disk.vhd
2008-12-21 21:29 12,576 a------- C:\New Virtual Machine.vmc
2008-12-21 21:21 --d----- c:\program files\Microsoft Virtual PC
2008-12-21 15:59 110 a------- c:\windows\GMouse.ini
2008-12-21 11:15 --d----- C:\GMouse20
2008-12-21 11:15 283,648 a------- c:\windows\uninst.exe
2008-12-21 11:15 11 a------- c:\windows\NetWare.INI
2008-12-18 19:33 --d----- c:\program files\common files\SWF Studio
2008-12-17 19:34 --d----- c:\docume~1\alluse~1\applic~1\PMB Files
2008-12-17 19:34 204 a------- C:\Plugins
2008-12-17 19:34 --d----- c:\program files\Pando Networks
2008-12-16 10:53 --d----- C:\.jagex_cache_32
2008-12-15 21:25 25,280 a------- c:\windows\system32\drivers\hamachi.sys
2008-12-13 22:01 --d----- c:\windows\.silabclient_store_32
2008-12-13 20:33 --d----- c:\program files\trend micro
2008-12-11 20:08 --d----- c:\windows\.mpr_file_store_32
2008-12-10 14:47 389,120 a------- c:\windows\system32\CF12413.exe
2008-12-10 14:47 389,120 a------- c:\windows\system32\CF12328.exe
2008-12-10 13:33 --d-h--- c:\windows\PIF
2008-12-10 10:38 --d----- C:\My Documents
2008-12-08 13:27 --d----- c:\program files\IObit
2008-12-08 11:08 --d----- c:\docume~1\txs6696\applic~1\Malwarebytes
2008-12-08 11:08 15,504 a------- c:\windows\system32\drivers\mbam.sys
2008-12-08 11:08 38,496 a------- c:\windows\system32\drivers\mbamswissarmy.sys
2008-12-08 11:08 --d----- c:\program files\Malwarebytes' Anti-Malware
2008-12-08 11:08 --d----- c:\docume~1\alluse~1\applic~1\Malwarebytes
2008-12-07 20:03 --d----- c:\program files\GrandPack
2008-12-07 15:53 --d----- c:\windows\system32\appmgmt
2008-12-06 20:11 1,479,822 a--sh--- c:\windows\system32\chvubxei.ini
2008-12-05 11:26 --d----- C:\One Note
2008-12-04 07:32 --d----- c:\program files\RocketDock
2008-12-03 21:51 --d----- c:\docume~1\alluse~1\applic~1\SwiftKit
2008-12-03 21:51 --d----- c:\program files\SwiftKit
2008-12-02 17:42 410,984 a------- c:\windows\system32\deploytk.dll
2008-12-02 14:51 86,016 a------- c:\windows\unvise32.exe
2008-12-02 14:50 --d----- C:\ExamView
2008-12-02 07:28 --d----- c:\program files\MSXML 4.0
2008-12-01 19:03 31 a------- c:\documents and settings\txs6696\jagex_runescape_preferences.dat
2008-12-01 19:03 --d----- c:\windows\.jagex_cache_32
2008-12-01 16:51 56 a---h--- c:\windows\system32\ezsidmv.dat
2008-12-01 16:49 138,496 -c------ c:\windows\system32\dllcache\afd.sys
2008-12-01 16:48 1,846,400 -c------ c:\windows\system32\dllcache\win32k.sys
2008-12-01 16:46 455,296 -c------ c:\windows\system32\dllcache\mrxsmb.sys
2008-12-01 16:46 1,106,944 -c------ c:\windows\system32\dllcache\msxml3.dll
2008-12-01 16:44 --d----- c:\documents and settings\txs6696\Contacts
2008-12-01 16:40 --d----- c:\program files\Skype
2008-12-01 16:40 2,189,184 -c------ c:\windows\system32\dllcache\ntoskrnl.exe
2008-12-01 16:40 2,145,280 -c------ c:\windows\system32\dllcache\ntkrnlmp.exe
2008-12-01 16:40 2,023,936 -c------ c:\windows\system32\dllcache\ntkrpamp.exe
2008-12-01 16:40 2,066,048 -c------ c:\windows\system32\dllcache\ntkrnlpa.exe
2008-12-01 16:40 337,408 -c------ c:\windows\system32\dllcache\netapi32.dll
2008-12-01 16:35 -cdsh--- c:\program files\common files\WindowsLiveInstaller
2008-12-01 16:21 12,160 ac------ c:\windows\system32\dllcache\mouhid.sys
2008-12-01 16:21 12,160 a------- c:\windows\system32\drivers\mouhid.sys
2008-12-01 16:21 10,368 ac------ c:\windows\system32\dllcache\hidusb.sys
2008-12-01 16:21 10,368 a------- c:\windows\system32\drivers\hidusb.sys
2008-12-01 15:14 --d----- c:\docume~1\alluse~1\applic~1\Commvault Systems
2008-12-01 15:14 --d----- C:\AddInLM
2008-12-01 15:14 --d----- c:\program files\CommVault Systems
2008-12-01 15:11 691,712 -c------ c:\windows\system32\dllcache\inetcomm.dll
2008-12-01 15:09 --d----- c:\documents and settings\txs6696\.gimp-2.4
2008-12-01 15:09 --d----- c:\docume~1\txs6696\applic~1\Inkscape
2008-12-01 15:09 --dsh--- c:\documents and settings\txs6696\UserData
2008-12-01 15:09 --d----- c:\documents and settings\TXS6696
2008-12-01 13:49 --d----- c:\docume~1\alluse~1\applic~1\Sophos
2008-12-01 13:49 --d----- c:\windows\SchCache
2008-12-01 13:49 82,432 a------- c:\windows\system32\msxml4r.dll
2008-12-01 13:48 32,768 a------- c:\windows\Regme.exe
2008-12-01 13:45 --d----- c:\windows\system32\GroupPolicy.UserCache
2008-12-01 13:45 --d-h--- c:\windows\system32\GroupPolicy.WMOriginal2
2008-12-01 12:22 --d----- C:\Zenworks
2008-12-01 12:18 --d-h--- C:\NALCache
2008-12-01 12:18 172,032 a------- c:\windows\system32\igfxres.dll
2008-12-01 12:16 4,444 a------- c:\windows\system32\pid.PNF
2008-12-01 12:15 --d----- c:\program files\CONEXANT
2008-12-01 12:15 --d----- c:\program files\Sigmatel
2008-12-01 12:15 4,952,064 a------- c:\windows\system32\stacgui.cpl
2008-12-01 12:15 1,601,536 a------- c:\windows\system32\stlang.dll
2008-12-01 12:15 405,504 a------- c:\windows\stsystra.exe
2008-12-01 12:15 94,208 a------- c:\windows\system32\stacsv.exe
2008-12-01 12:15 920,088 a------- c:\windows\system32\igxpun.exe
2008-12-01 12:15 --d----- c:\windows\system32\x64
2008-12-01 12:15 319,456 a------- c:\windows\system32\difxapi.dll
2008-12-01 12:14 61,696 a------- c:\windows\system32\drivers\ohci1394.sys
2008-12-01 12:14 53,376 a------- c:\windows\system32\drivers\1394bus.sys
2008-12-01 12:14 6,400 a------- c:\windows\system32\drivers\enum1394.sys
2008-12-01 12:14 8,832 a------- c:\windows\system32\drivers\wmiacpi.sys

==================== Find3M ====================

2008-12-01 13:51 30,208 a------- c:\windows\system32\wifi_config.exe
2008-10-16 14:06 268,648 a------- c:\windows\system32\mucltui.dll
2008-10-16 14:06 208,744 a------- c:\windows\system32\muweb.dll

============= FINISH: 15:11:32.07 ===============

Please download the OTMoveIt3 by OldTimer.

• Save it to your desktop.
  
• Please double-click OTMoveIt3.exe to run it.
  
• Copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):
  
  
  :processes
  explorer.exe
  
  :files
  c:\windows\system32\benjsg.dll
  c:\windows\system32\mvclwmtr.dll
  c:\windows\system32\ssqpQGaY.dll
  c:\windows\system32\chvubxei.ini
  c:\program files\GrandPack
  
  :commands
  [purity]
  [emptytemp]
  [start explorer]
  [reboot]
  
  
  
  
• Return to OTMoveIt3, right click in the "Paste instructions for items to be Moved" window (under the light blue bar) and choose Paste.
  
• Click the red Moveit! button.
  
• Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
  
• Close OTMoveIt3
  

If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes.

Please post the OTMoveIt log.

========== PROCESSES ==========
Process explorer.exe killed successfully.
========== FILES ==========
DllUnregisterServer procedure not found in c:\windows\system32\benjsg.dll
c:\windows\system32\benjsg.dll NOT unregistered.
c:\windows\system32\benjsg.dll moved successfully.
DllUnregisterServer procedure not found in c:\windows\system32\mvclwmtr.dll
c:\windows\system32\mvclwmtr.dll NOT unregistered.
c:\windows\system32\mvclwmtr.dll moved successfully.
DllUnregisterServer procedure not found in c:\windows\system32\ssqpQGaY.dll
c:\windows\system32\ssqpQGaY.dll NOT unregistered.
c:\windows\system32\ssqpQGaY.dll moved successfully.
c:\windows\system32\chvubxei.ini moved successfully.
c:\program files\GrandPack moved successfully.
========== COMMANDS ==========
File delete failed. C:\DOCUME~1\TXS6696\LOCALS~1\Temp\hsperfdata_TXS6696\3196 scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\TXS6696\LOCALS~1\Temp\hsperfdata_TXS6696\3748 scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\TXS6696\LOCALS~1\Temp\fla3F.tmp scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\TXS6696\LOCALS~1\Temp\Perflib_Perfdata_470.dat scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\TXS6696\LOCALS~1\Temp\Perflib_Perfdata_5dc.dat scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\TXS6696\LOCALS~1\Temp\~DF7CC6.tmp scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\TXS6696\LOCALS~1\Temp\~DF7CF8.tmp scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\TXS6696\LOCALS~1\Temp\~DF8903.tmp scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\TXS6696\LOCALS~1\Temp\~DF8934.tmp scheduled to be deleted on reboot.
User's Temp folder emptied.
User's Temporary Internet Files folder emptied.
User's Internet Explorer cache folder emptied.
Local Service Temp folder emptied.
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
Local Service Temporary Internet Files folder emptied.
File delete failed. C:\WINDOWS\temp\Perflib_Perfdata_218.dat scheduled to be deleted on reboot.
Windows Temp folder emptied.
File delete failed. C:\Documents and Settings\TXS6696\Application Data\Sun\Java\Deployment\cache\6.0\39\334876a7-5ed792b2 scheduled to be deleted on reboot.
Java cache emptied.
FireFox cache emptied.
Temp folders emptied.
Explorer started successfully

OTMoveIt3 by OldTimer - Version 1.0.7.2 log created on 12302008_171026

Hello.
What problems remain?

I scanned again with MBAM I still have 5 infections, 4 of them vundos...

It may have picked the Qoobox folder _OTMoveIt.
Does it say where the vundo is?

Let MBAM clean it and see if it returns, maybe just a leftover.

Since this issue is resolved, this topic is closed.

If you need this topic reopened, please contact a staff member. This applies only to the original topic starter.

Everyone else, please open a new topic for your questions.