Need help with a trojan/Rustok-N infection

So I've got this annoying trojan that certain video sites tell me is called Rustok-N. Every attempt I've made at removing it has only left me with less hair, and I would greatly appreciate the help of the GP.

Here's my hijackthis log:

Hello.

• Open HijackThis
  
• Choose "Do a system scan only"
  
• Check the boxes in front of these lines:
  
  
  O2 - BHO: (no name) - MRI_DISABLED - (no file)
  O4 - HKLM\..\Run: [MSServer] rundll32.exe C:\Windows\system32\yayyXPih.dll,#1
  O4 - Global Startup: MRI_DISABLED
  
  
  
• Press "Fix Checked"
  
• Close Hijack This.
  

Lets run a rootkit scan.

1. Please download The Avenger by Swandog46 to your Desktop
Link: HERE or HERE.

• Click on Avenger.zip to open the file
  
• Extract avenger.exe to your desktop
  

2. Copy all the text contained in the code box below to your Clipboard by highlighting it and pressing (Ctrl+C):

Files to delete:
C:\Windows\system32\yayyXPih.dll

Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.

3. Now, start The Avenger program by clicking on its icon on your desktop.

• Under "Input script here:", paste in the script from the quote box above.
  
• Leave the ticked box "Scan for rootkit" ticked.
  
• Then tick "Disable any rootkits found"
  
• Now click on the Execute to begin execution of the script.
  
• Answer "Yes" twice when prompted.
  
  The Avenger will automatically do the following:
  
  
• It will Restart your computer.
  
• On reboot, it will briefly open a black command window on your desktop, this is normal.
  
• After the restart, it creates a log file that should open with the results of Avenger’s actions. This log file will be located at C:\avenger.txt
  
• The Avenger will also have backed up all the files, etc., that you asked it to delete, and will have zipped them and moved the zip archives to C:\avenger\backup.zip.
  

4. Please copy/paste the content of c:\avenger.txt into your reply.

Hi! I will definitely do all of this, but before I do I wanted to mention that yayyXPih.dll has been on my computer for a few months before I noticed there was a problem. I hadn't even bothered with finding it and removing it, because everytime I would turn the computer I would get a pop-up saying that it couldn't be loaded, because it couldn't be found.

Hello.
It is present, otherwise Hijack This would of told us (file missing) on the line. The malware saying can't find it is just the malware saying that so you won't go hunting after it, but it is there.

Here's avenger's results:



Also, when avenger tried to restart my computer, my computer got to the windows loading screen and shut off. It turned back on a second later, and before I got to the same screen a screen titled "Windows Error Recovery" came up saying windows had failed to start properly. It gave me the option of either running the computer in repair mode or starting normally, and i picked the latter.

Hello.
Nice choice, but it won't happen this time. It happened because the avenger fought with the rootkit to disable it and the rootkit tries to protect itself, but we won in the end. Now we just have to delete it.

2. Copy all the text contained in the code box below to your Clipboard by highlighting it and pressing (Ctrl+C):

Drivers to delete:
msqpdxserv.sys

Files to delete:
C:\Windows\system32\drivers\msqpdxbqfvqnbs.sys

Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.

3. Now, start The Avenger program by clicking on its icon on your desktop.

• Under "Input script here:", paste in the script from the quote box above.
  
• Leave the ticked box "Scan for rootkit" ticked.
  
• Then tick "Disable any rootkits found"
  
• Now click on the Execute to begin execution of the script.
  
• Answer "Yes" twice when prompted.
  
  The Avenger will automatically do the following:
  
  
• It will Restart your computer.
  
• On reboot, it will briefly open a black command window on your desktop, this is normal.
  
• After the restart, it creates a log file that should open with the results of Avenger’s actions. This log file will be located at C:\avenger.txt
  
• The Avenger will also have backed up all the files, etc., that you asked it to delete, and will have zipped them and moved the zip archives to C:\avenger\backup.zip.
  

4. Please copy/paste the content of c:\avenger.txt into your reply.

Well, it did happen again. I chose to run windows normally again. Here's the report:

Oh, well the rootkit is gone now.

• Please download DDS by sUBs to your Desktop (Important!!) from one of these locations:
  Link 1
  Link 2
  Link 3
  
• Double click DDS.scr to run
  
• When complete, DDS.txt will open.
  
• Click No for Optional Scan.
  
• Save the report to your Desktop.
  
• Copy and paste the report back here.
  

I'm glad to hear it's gone. Thank you very much!

Hello.
We need to use the avenger just one more time to take care of leftovers now, then I think we can call this a rap.

2. Copy all the text contained in the code box below to your Clipboard by highlighting it and pressing (Ctrl+C):

Files to delete:
c:\windows\system32\msqpdxmjtbxtev.dll
c:\windows\system32\drivers\msqpdxhcuqnuwj.sys
c:\program files\mozilla firefox\components\iamfamous.dll

Folders to delete:
C:\resycled

Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.

3. Now, start The Avenger program by clicking on its icon on your desktop.

• Under "Input script here:", paste in the script from the quote box above.
  
• Leave the ticked box "Scan for rootkit" ticked.
  
• Then tick "Disable any rootkits found"
  
• Now click on the Execute to begin execution of the script.
  
• Answer "Yes" twice when prompted.
  
  The Avenger will automatically do the following:
  
  
• It will Restart your computer.
  
• On reboot, it will briefly open a black command window on your desktop, this is normal.
  
• After the restart, it creates a log file that should open with the results of Avenger’s actions. This log file will be located at C:\avenger.txt
  
• The Avenger will also have backed up all the files, etc., that you asked it to delete, and will have zipped them and moved the zip archives to C:\avenger\backup.zip.
  

4. Please copy/paste the content of c:\avenger.txt into your reply.

Cool, no problem loading windows this time.

Glad to hear it.
The malware is gone, but there's still some work to do to make sure this doesn't happen again.

I see you have Viewpoint Manager, this is considered as foistware instead of malware since it is installed without users approval but doesn't spy or do anything "bad". Read this article: http://www.clickz.com/news/article.php/3561546

Additional info: http://vil.nai.com/vil/content/v_137262.htm

I suggest you remove the program now.

Go to Start > Control Panel > Add/Remove Programs and remove the following programs if present.

• Viewpoint
  
• Viewpoint Manager
  
• Viewpoint Media Player
  
• Viewpoint Toolbar
  
• Vongo
  

Now lets make sure that Viewpoint is fully gone from the system.

• Next, please download ViewpointKiller by Prm753 from here.
  
• Save it to a permanent folder (such as C:/ViewpointKiller) and unzip it there.
  
• Open ViewpointKiller, and press the Start button.
  
• A log will be produced in the same folder where you unzipped it to. Please post the contents of that log in your reply.
  

I uninstalled Vongo and Viewpoint Media player, and I ran Viewpointkiller. The log file was never made though. I've searched my computer for it and can't find it anywhere. The program is reporting that there aren't any components of viewpoint left.

Doesn't matter, I forgot about the UAC in Vista, that's why it wasn't made.

Your version of Java is outdated and needs to be updated to take advantage of fixes that have eliminated security vulnerabilities.
Updating Java:

• Download the latest version of Java SE Runtime Environment (JRE) 6 Update 11.
  
• Select the first option where it says "Java SE Runtime Environment (JRE) 6 Update 11".
  
• Click the "Download" button to the right.
  
• In the Window that opens, select your platform and language, check the "agree" box, and click Continue.
  
• Click on the link to download Windows Offline Installation and save to your desktop.
  
• Close any programs you may have running - especially your web browser.
  
• Go to Start > Control Panel double-click on Add or Remove Programs and remove all older versions of Java.
  
• Check any item with Java Runtime Environment (JRE or J2SE) in the name.
  - Examples of older versions in Add or Remove Programs:
  - Java 2 Runtime Environment, SE v1.4.2
  - J2SE Runtime Environment 5.0
  - J2SE Runtime Environment 5.0 Update 2
  
• Click the Remove or Change/Remove button.
  
• Repeat as many times as necessary to remove each Java versions.
  
• Reboot your computer once all Java components are removed.
  
• Then from your desktop double-click on jre-6u11-windows-i586-p.exe that you downloaded to install the newest version.
  

Please make sure the new version of Java is installed before you run JavaRa.

Please download JavaRa from here

• First, unzip it.
  
• Then run JavaRa.
  
• Select English from the drop down menu and press Select.
  
• This will open JavaRa.
  
• Press Remove older versions
  
• Press yes to the prompt.
  
• It will make a log file of what it's removed.
  
• Copy and paste the log back here.
  

Since this issue is resolved, this topic is closed.

If you need this topic reopened, please contact a staff member. This applies only to the original topic starter.

Everyone else, please open a new topic for your questions.

Since this issue is resolved, this topic is closed.

If you need this topic reopened, please contact a staff member. This applies only to the original topic starter.

Everyone else, please open a new topic for your questions.