Win32.Zafi.B

I'm having a problem with Win32.Zafi.B. My computer restarted by itself, I got that warning so I ran a couple anti virus programs, then I came here. I downloaded mbam twice, first time didn't work, but second time it installed but would not run. I uninstalled it, which required me to restart the computer, but when I came back here and tried to download it again to start over, I keep getting a page error. This is the first time I have ever posted anywhere, so if I screw up, please be patient.
Here is the log from Hijakthis

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 4:58:53 PM, on 11/01/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.20661)
Boot mode: Normal

Running processes:
E:\WINDOWS\System32\smss.exe
E:\WINDOWS\system32\winlogon.exe
E:\WINDOWS\system32\services.exe
E:\WINDOWS\system32\lsass.exe
E:\WINDOWS\system32\svchost.exe
E:\WINDOWS\System32\svchost.exe
E:\WINDOWS\Explorer.EXE
E:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
E:\WINDOWS\system32\spoolsv.exe
E:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
E:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
E:\WINDOWS\system32\cisvc.exe
E:\WINDOWS\system32\svchost.exe
E:\Program Files\NeoSmart Technologies\ToolTipFixer\ToolTipFixer.exe
E:\Program Files\Java\jre1.6.0_04\bin\jusched.exe
E:\Program Files\Microsoft IntelliType Pro\itype.exe
E:\WINDOWS\system32\ctfmon.exe
E:\Program Files\Verizon Wireless\VZAccess Manager\VZAccess Manager.exe
E:\Program Files\OpenOffice.org 2.4\program\soffice.exe
E:\Program Files\OpenOffice.org 2.4\program\soffice.BIN
E:\Program Files\Mozilla Firefox\firefox.exe
E:\Program Files\Java\jre1.6.0_04\bin\jucheck.exe
E:\WINDOWS\system32\cidaemon.exe
E:\Users\Administrator\Desktop\hijackgpthis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = IE
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Favorites
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - E:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "E:\Program Files\Java\jre1.6.0_04\bin\jusched.exe"
O4 - HKLM\..\Run: [itype] "E:\Program Files\Microsoft IntelliType Pro\itype.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] E:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] E:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] E:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] E:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] E:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Default user')
O4 - Startup: OpenOffice.org 2.4.lnk = E:\Program Files\OpenOffice.org 2.4\program\quickstart.exe
O4 - Startup: VZAccess Manager.lnk = E:\Program Files\Verizon Wireless\VZAccess Manager\VZAccess Manager.exe
O4 - Startup: ZET 8 Lite
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Toolbars\Restrictions present
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{215A6436-2777-42D0-A173-FF83B1407207}: NameServer = 66.174.92.14 69.78.96.14
O17 - HKLM\System\CS1\Services\Tcpip\..\{215A6436-2777-42D0-A173-FF83B1407207}: NameServer = 66.174.92.14 69.78.96.14
O20 - AppInit_DLLs: prio.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - E:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - E:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - E:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: NST ToolTipFixer (TTFixerService) - NeoSmart Technologies - E:\Program Files\NeoSmart Technologies\ToolTipFixer\ToolTipFixer.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software GmbH - E:\WINDOWS\System32\TuneUpDefragService.exe

Bless You!
Billie

• Open HijackThis
  
• Choose "Do a system scan only"
  
• Check the boxes in front of these lines:
  
  
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
  O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'LOCAL SERVICE')
  O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'NETWORK SERVICE')
  O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SYSTEM')
  O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Default user')
  O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
  O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
  O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Toolbars\Restrictions present
  O20 - AppInit_DLLs: prio.dll
  
  
  
• Press "Fix Checked"
  
• Close Hijack This.
  

1. Please download The Avenger by Swandog46 to your Desktop
Link: HERE or HERE.

• Click on Avenger.zip to open the file
  
• Extract avenger.exe to your desktop
  

2. Copy all the text contained in the code box below to your Clipboard by highlighting it and pressing (Ctrl+C):

Files to delete:
C:\WINDOWS\system32\prio.dll

Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.

3. Now, start The Avenger program by clicking on its icon on your desktop.

• Under "Input script here:", paste in the script from the quote box above.
  
• Leave the ticked box "Scan for rootkit" ticked.
  
• Then tick "Disable any rootkits found"
  
• Now click on the Execute to begin execution of the script.
  
• Answer "Yes" twice when prompted.
  
  The Avenger will automatically do the following:
  
  
• It will Restart your computer.
  
• On reboot, it will briefly open a black command window on your desktop, this is normal.
  
• After the restart, it creates a log file that should open with the results of Avenger’s actions. This log file will be located at C:\avenger.txt
  
• The Avenger will also have backed up all the files, etc., that you asked it to delete, and will have zipped them and moved the zip archives to C:\avenger\backup.zip.
  

4. Please copy/paste the content of c:\avenger.txt into your reply.

• Please download DDS by sUBs to your Desktop (Important!!) from one of these locations:
  Link 1
  Link 2
  Link 3
  
• Double click DDS.scr to run
  
• When complete, DDS.txt will open.
  
• Click No for Optional Scan.
  
• Save the report to your Desktop.
  
• Copy and paste DDS.txt back here, I don't need to see attach.txt.
  

Please post the avenger log and DDS log.
Use more than one post if needed.

Logfile of The Avenger Version 2.0, (c) by Swandog46
http://swandog46.geekstogo.com

Platform: Windows XP

*******************

script file opened successfully.
script file read successfully.

Backups directory opened successfully at E:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.

Hidden driver "TDSSserv.sys" found!
ImagePath: \systemroot\system32\drivers\TDSSpqxt.sys
Driver disabled successfully.

Rootkit scan completed.


Error: could not open file "C:\WINDOWS\system32\prio.dll"
Deletion of file "C:\WINDOWS\system32\prio.dll" failed!
Status: 0xc000003a (STATUS_OBJECT_PATH_NOT_FOUND)
--> bad path / the parent directory does not exist


Completed script processing.

*******************

Finished! Terminate.



//////////////////////////////////////////
Avenger Pre-Processor log
//////////////////////////////////////////

Platform: Windows XP (build 2600, Service Pack 2)
Sun Jan 11 18:55:23 2009

18:55:23: Error: Invalid script. A valid script must begin with a command directive.
Aborting execution!


//////////////////////////////////////////


Logfile of The Avenger Version 2.0, (c) by Swandog46
http://swandog46.geekstogo.com

Platform: Windows XP

*******************

script file opened successfully.
script file read successfully.

Backups directory opened successfully at E:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.
No rootkits found!

File "E:\WINDOWS\system32\prio.dll" deleted successfully.

Completed script processing.

*******************

Finished! Terminate.


DDS (Ver_09-01-07.01) - NTFSx86
Run by Administrator at 19:28:45.33 on Sun 11/01/2009
Internet Explorer: 7.0.5730.11
Microsoft Windows XP Professional 5.1.2600.2.1252.61.1033.18.1023.649 [GMT -7:00]


============== Running Processes ===============

E:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
E:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
E:\WINDOWS\Explorer.EXE
E:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
E:\WINDOWS\system32\NOTEPAD.EXE
E:\WINDOWS\system32\spoolsv.exe
E:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
E:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
E:\WINDOWS\system32\cisvc.exe
E:\WINDOWS\system32\svchost.exe -k imgsvc
E:\Program Files\NeoSmart Technologies\ToolTipFixer\ToolTipFixer.exe
E:\Program Files\Java\jre1.6.0_04\bin\jusched.exe
E:\Program Files\Microsoft IntelliType Pro\itype.exe
E:\Users\Administrator\Application Data\Google\yfijv17721328.exe
E:\WINDOWS\system32\ctfmon.exe
E:\Program Files\Verizon Wireless\VZAccess Manager\VZAccess Manager.exe
E:\Program Files\OpenOffice.org 2.4\program\soffice.exe
E:\Program Files\OpenOffice.org 2.4\program\soffice.BIN
E:\Program Files\Mozilla Firefox\firefox.exe
E:\WINDOWS\system32\cidaemon.exe
E:\Users\Administrator\Desktop\dds.com

============== Pseudo HJT Report ===============

uDefault_Page_URL = hxxp://www.google.com
uSearch Bar = hxxp://www.google.com/ie
uSearch Page = hxxp://www.google.com
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uWindow Title = IE
uSearchURL,(Default) = hxxp://www.google.com/keyword/%s
mSearchAssistant = hxxp://www.google.com/ie
mWinlogon: SfcDisable=-99 (0xffffff9d)
BHO: SSVHelper Class: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - e:\program files\java\jre1.6.0_04\bin\ssv.dll
uRun: [CTFMON.EXE] e:\windows\system32\ctfmon.exe
mRun: [SunJavaUpdateSched] "e:\program files\java\jre1.6.0_04\bin\jusched.exe"
mRun: [itype] "e:\program files\microsoft intellitype pro\itype.exe"
mRun: [wclock] "e:\users\administrator\application data\google\yfijv17721328.exe" 2
dRun: [CTFMON.EXE] e:\windows\system32\CTFMON.EXE
dRunOnce: [ShowDeskFix] regsvr32 /s /n /i:u shell32
StartupFolder: e:\users\admini~1\startm~1\programs\startup\openof~1.lnk - e:\program files\openoffice.org 2.4\program\quickstart.exe
StartupFolder: e:\users\admini~1\startm~1\programs\startup\vzacce~1.lnk - e:\program files\verizon wireless\vzaccess manager\VZAccess Manager.exe
StartupFolder: e:\users\admini~1\startm~1\programs\startup\zet8li~1\uninst~1.lnk - e:\program files\zet 8\Uninstall.exe
StartupFolder: e:\users\admini~1\startm~1\programs\startup\zet8li~1\user's~1.lnk - e:\program files\zet 8\language\english\manual\main.html
StartupFolder: e:\users\admini~1\startm~1\programs\startup\zet8li~1\zet8li~1.lnk - e:\program files\zet 8\zet.exe
uPolicies-explorer: ForceClassicControlPanel = 1 (0x1)
uPolicies-explorer: NoResolveTrack = 1 (0x1)
uPolicies-explorer: MemCheckBoxInRunDlg = 1 (0x1)
uPolicies-explorer: NoWindowsUpdate = 1 (0x1)
mPolicies-explorer: MemCheckBoxInRunDlg = 1 (0x1)
mPolicies-explorer: StartMenuFavorites = 1 (0x1)
mPolicies-explorer: ForceClassicControlPanel = 1 (0x1)
dPolicies-explorer: ForceClassicControlPanel = 1 (0x1)
dPolicies-explorer: NoResolveTrack = 1 (0x1)
IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0016-0000-0004-ABCDEFFEDCBC} - e:\program files\java\jre1.6.0_04\bin\ssv.dll
TCP: {215A6436-2777-42D0-A173-FF83B1407207} = 66.174.92.14 69.78.96.14
AppInit_DLLs: prio.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - e:\windows\system32\wpdshserviceobj.dll

================= FIREFOX ===================

FF - ProfilePath - e:\users\admini~1\applic~1\mozilla\firefox\profiles\pwnbg38b.default\

---- FIREFOX POLICIES ----
user_pref('capability.policy.policynames', 'localfilelinks');user_pref('capability.policy.localfilelinks.sites', 'hxxp://www.webmynd.com http://www.google.com');user_pref('capability.policy.localfilelinks.checkloaduri.enabled', 'allAccess');
============= SERVICES / DRIVERS ===============

R1 avgio;avgio;e:\program files\avira\antivir personaledition classic\avgio.sys [2009-1-11 11840]
R3 avgntflt;avgntflt;e:\program files\avira\antivir personaledition classic\avgntflt.sys [2009-1-11 52032]
R4 aawservice;Lavasoft Ad-Aware Service;e:\program files\lavasoft\ad-aware\aawservice.exe [2008-9-10 611664]
R4 AntiVirScheduler;Avira AntiVir Personal - Free Antivirus Scheduler;e:\program files\avira\antivir personaledition classic\sched.exe [2009-1-11 68865]
R4 AntiVirService;Avira AntiVir Personal - Free Antivirus Guard;e:\program files\avira\antivir personaledition classic\avguard.exe [2009-1-11 151297]
R4 TTFixerService;NST ToolTipFixer;e:\program files\neosmart technologies\tooltipfixer\ToolTipFixer.exe [2008-7-15 10240]

=============== Created Last 30 ================

2009-01-11 14:10 354,560 a------- e:\windows\system32\TuneUpDefragService.exe
2009-01-11 14:10 28,416 a------- e:\windows\system32\uxtuneup.dll
2009-01-11 14:00 --d----- e:\users\admini~1\applic~1\TuneUp Software
2009-01-11 13:59 --d----- e:\users\alluse~1\applic~1\TuneUp Software
2009-01-11 13:59 --d----- e:\program files\TuneUp Utilities 2008
2009-01-11 12:09 --d----- e:\users\alluse~1\applic~1\Avira
2009-01-11 12:09 --d----- e:\program files\Avira
2009-01-11 11:08 --d----- e:\program files\Lavasoft
2009-01-11 11:06 --d----- e:\program files\common files\Wise Installation Wizard
2009-01-11 11:00 2,204 a------- e:\windows\system32\TDSSfpmp.dll
2009-01-11 11:00 31,232 a------- e:\windows\system32\TDSSliqp.dll
2009-01-11 11:00 29,696 a------- e:\windows\system32\TDSSnrse.dll
2009-01-11 11:00 441 a------- e:\windows\system32\TDSSosvn.dat
2009-01-11 10:58 60,416 a------- e:\windows\system32\drivers\TDSSpqxt.sys
2009-01-11 10:58 35,840 a------- e:\windows\system32\TDSSoeqh.dll
2009-01-08 18:46 --d----- e:\windows\system32\appmgmt
2008-12-21 02:26 0 a---h--- e:\windows\system32\drivers\Msft_Kernel_NuidFltr_01005.Wdf
2008-12-21 02:26 0 a---h--- e:\windows\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf
2008-12-21 02:26 21,504 a------- e:\windows\system32\drivers\hidserv.dll
2008-12-21 01:55 1,421,384 a------- e:\windows\system32\wdfcoinstaller01005.dll
2008-12-21 01:55 18,504 a------- e:\windows\system32\drivers\nuidfltr.sys
2008-12-21 01:54 --d----- e:\program files\Microsoft IntelliType Pro
2008-12-21 01:40 --d----- e:\windows\system32\XPSViewer
2008-12-21 01:39 117,760 -------- e:\windows\system32\prntvpt.dll
2008-12-21 01:39 89,088 -------- e:\windows\system32\dllcache\filterpipelineprintproc.dll
2008-12-21 01:39 1,676,288 -------- e:\windows\system32\xpssvcs.dll
2008-12-21 01:39 1,676,288 -------- e:\windows\system32\dllcache\xpssvcs.dll
2008-12-21 01:39 597,504 -------- e:\windows\system32\dllcache\printfilterpipelinesvc.exe
2008-12-21 01:39 575,488 -------- e:\windows\system32\xpsshhdr.dll
2008-12-21 01:39 575,488 -------- e:\windows\system32\dllcache\xpsshhdr.dll
2008-12-19 00:23 --d----- e:\program files\ZET 8

==================== Find3M ====================

2008-05-29 13:56 37,375 a------- e:\program files\openoffice.org-xsltfilter.cab
2008-05-29 13:56 2,490,452 a------- e:\program files\openoffice.org-writer.cab
2008-05-29 13:56 207,388 a------- e:\program files\openoffice.org-testtool.cab
2008-05-29 13:55 2,504,975 a------- e:\program files\openoffice.org-pyuno.cab
2008-05-29 13:55 51,973 a------- e:\program files\openoffice.org-onlineupdate.cab
2008-05-29 13:55 1,090,334 a------- e:\program files\openoffice.org-math.cab
2008-05-29 13:55 118,910 a------- e:\program files\openoffice.org-javafilter.cab
2008-05-29 13:55 1,254,017 a------- e:\program files\openoffice.org-impress.cab
2008-05-29 13:55 86,870 a------- e:\program files\openoffice.org-graphicfilter.cab
2008-05-29 13:55 919,329 a------- e:\program files\openoffice.org-draw.cab
2008-05-29 13:55 2,769 a------- e:\program files\openoffice.org-emailmerge.cab
2008-05-29 13:55 2,031,954 a------- e:\program files\openoffice.org-core09.cab
2008-05-29 13:55 293,078 a------- e:\program files\openoffice.org-core08.cab
2008-05-29 13:55 3,842,531 a------- e:\program files\openoffice.org-core07.cab
2008-05-29 13:54 28,847,705 a------- e:\program files\openoffice.org-core06.cab
2008-05-29 13:50 18,634,513 a------- e:\program files\openoffice.org-core05.cab
2008-05-29 13:49 16,503,595 a------- e:\program files\openoffice.org-core04.cab
2008-05-29 13:48 9,117,929 a------- e:\program files\openoffice.org-core03.cab
2008-05-29 13:48 3,860,980 a------- e:\program files\openoffice.org-core02.cab
2008-05-29 13:47 15,104,219 a------- e:\program files\openoffice.org-core01.cab
2008-05-29 13:47 4,694,039 a------- e:\program files\openoffice.org-calc.cab
2008-05-29 13:47 1,803,630 a------- e:\program files\openoffice.org-base.cab
2008-05-29 13:46 43,005 a------- e:\program files\openoffice.org-activex.cab
2008-05-29 13:46 4,372,992 a------- e:\program files\openofficeorg24.msi
2008-05-29 13:46 217 a------- e:\program files\setup.ini
2008-02-16 06:42 15,504,896 a------- e:\program files\VZAccess_6.3.1_1638b-595u.msi
2008-02-08 13:33 323,584 a------- e:\program files\setup.exe
2002-03-11 02:06 1,822,520 a------- e:\program files\instmsiw.exe
2002-03-11 01:45 1,708,856 a------- e:\program files\instmsia.exe

============= FINISH: 19:31:04.43 ===============

I'm so sorry, my files are on local disk E

Thank You Billie

Hello.
We need to delete the rootkit now.

2. Copy all the text contained in the code box below to your Clipboard by highlighting it and pressing (Ctrl+C):

Drivers to delete:
TDSSserv.sys

Files to delete:
e:\windows\system32\drivers\TDSSpqxt.sys
e:\users\administrator\application data\google\yfijv17721328.exe
e:\windows\system32\TDSSfpmp.dll
e:\windows\system32\TDSSliqp.dll
e:\windows\system32\TDSSnrse.dll
e:\windows\system32\TDSSosvn.dat
e:\windows\system32\TDSSoeqh.dll

Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.

3. Now, start The Avenger program by clicking on its icon on your desktop.

• Under "Input script here:", paste in the script from the quote box above.
  
• Leave the ticked box "Scan for rootkit" ticked.
  
• Then tick "Disable any rootkits found"
  
• Now click on the Execute to begin execution of the script.
  
• Answer "Yes" twice when prompted.
  
  The Avenger will automatically do the following:
  
  
• It will Restart your computer.
  
• On reboot, it will briefly open a black command window on your desktop, this is normal.
  
• After the restart, it creates a log file that should open with the results of Avenger’s actions. This log file will be located at C:\avenger.txt
  
• The Avenger will also have backed up all the files, etc., that you asked it to delete, and will have zipped them and moved the zip archives to C:\avenger\backup.zip.
  

4. Please copy/paste the content of c:\avenger.txt into your reply.

Once you have the new avenger log, please run Hijack This and get a new Hijack This log.
Post the new avenger log + HJT log.
Use more than one post if needed.

Hi

Logfile of The Avenger Version 2.0, (c) by Swandog46
http://swandog46.geekstogo.com

Platform: Windows XP

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at E:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.
No rootkits found!

Driver "TDSSserv.sys" deleted successfully.
File "e:\windows\system32\drivers\TDSSpqxt.sys" deleted successfully.
File "e:\users\administrator\application data\google\yfijv17721328.exe" deleted successfully.
File "e:\windows\system32\TDSSfpmp.dll" deleted successfully.
File "e:\windows\system32\TDSSliqp.dll" deleted successfully.
File "e:\windows\system32\TDSSnrse.dll" deleted successfully.
File "e:\windows\system32\TDSSosvn.dat" deleted successfully.
File "e:\windows\system32\TDSSoeqh.dll" deleted successfully.

Completed script processing.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:37:07 AM, on 12/01/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.20661)
Boot mode: Normal

Running processes:
E:\WINDOWS\System32\smss.exe
E:\WINDOWS\system32\winlogon.exe
E:\WINDOWS\system32\services.exe
E:\WINDOWS\system32\lsass.exe
E:\WINDOWS\system32\svchost.exe
E:\WINDOWS\System32\svchost.exe
E:\WINDOWS\Explorer.EXE
E:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
E:\WINDOWS\system32\spoolsv.exe
E:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
E:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
E:\WINDOWS\system32\cisvc.exe
E:\WINDOWS\system32\svchost.exe
E:\Program Files\NeoSmart Technologies\ToolTipFixer\ToolTipFixer.exe
E:\Program Files\Java\jre1.6.0_04\bin\jusched.exe
E:\Program Files\Microsoft IntelliType Pro\itype.exe
E:\WINDOWS\system32\ctfmon.exe
E:\Program Files\Verizon Wireless\VZAccess Manager\VZAccess Manager.exe
E:\Program Files\OpenOffice.org 2.4\program\soffice.exe
E:\Program Files\OpenOffice.org 2.4\program\soffice.BIN
E:\Users\Administrator\Desktop\hijackgpthis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = IE
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Favorites
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - E:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "E:\Program Files\Java\jre1.6.0_04\bin\jusched.exe"
O4 - HKLM\..\Run: [itype] "E:\Program Files\Microsoft IntelliType Pro\itype.exe"
O4 - HKLM\..\Run: [wclock] "E:\Users\Administrator\Application Data\Google\yfijv17721328.exe" 2
O4 - HKCU\..\Run: [CTFMON.EXE] E:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] E:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [ShowDeskFix] regsvr32 /s /n /i:u shell32 (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] E:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [ShowDeskFix] regsvr32 /s /n /i:u shell32 (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] E:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [ShowDeskFix] regsvr32 /s /n /i:u shell32 (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] E:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [ShowDeskFix] regsvr32 /s /n /i:u shell32 (User 'Default user')
O4 - Startup: OpenOffice.org 2.4.lnk = E:\Program Files\OpenOffice.org 2.4\program\quickstart.exe
O4 - Startup: VZAccess Manager.lnk = E:\Program Files\Verizon Wireless\VZAccess Manager\VZAccess Manager.exe
O4 - Startup: ZET 8 Lite
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Toolbars\Restrictions present
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
O20 - AppInit_DLLs: prio.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - E:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - E:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - E:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: NST ToolTipFixer (TTFixerService) - NeoSmart Technologies - E:\Program Files\NeoSmart Technologies\ToolTipFixer\ToolTipFixer.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software GmbH - E:\WINDOWS\System32\TuneUpDefragService.exe

--
End of file - 4340 bytes


Thank You again for being so conscientious. I'm sure all the other people I see with this problem appreciates your knowledge too!
Billie

Hello.
Were almost done now, just one more thing to get rid of, then we can tidy up and let you go.

Please download the OTMoveIt3 by OldTimer.

• Save it to your desktop.
  
• Please double-click OTMoveIt3.exe to run it.
  
• Copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):
  
  
  :processes
  explorer.exe
  
  :files
  E:\Users\Administrator\Application Data\Google\*.*
  
  :reg
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  "wclock"=-
  
  :commands
  [purity]
  [emptytemp]
  [start explorer]
  [reboot]
  
  
  
  
• Return to OTMoveIt3, right click in the "Paste instructions for items to be Moved" window (under the light blue bar) and choose Paste.
  
• Click the red Moveit! button.
  
• Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
  
• Close OTMoveIt3
  

If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes.

Please post the OTMoveIt log.

Hi

Here is the log from OTMoveIt. Now Avira has sent me four warnings that they detected a trojan BDS/TDSS.adb back-door program and I have chosen delete all four times. I seem awfully vulnerable right now and I don't like that. My last computer which was destroyed in a move never had this problem, but I had an external firewall and I had Norton and Spybot. Should I get another external firewall?
Again, BLESS YOU
========== PROCESSES ==========
Process explorer.exe killed successfully.
========== FILES ==========
DllUnregisterServer procedure not found in E:\Users\Administrator\Application Data\Google\mjkspc.dll
E:\Users\Administrator\Application Data\Google\mjkspc.dll NOT unregistered.
E:\Users\Administrator\Application Data\Google\mjkspc.dll moved successfully.
========== REGISTRY ==========
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\wclock deleted successfully.
========== COMMANDS ==========
File delete failed. E:\Users\ADMINI~1\LOCALS~1\Temp\7467_appcompat.txt scheduled to be deleted on reboot.
File delete failed. E:\Users\ADMINI~1\LOCALS~1\Temp\etilqs_3gZaw61LRICRTbt2PJ6R scheduled to be deleted on reboot.
File delete failed. E:\Users\ADMINI~1\LOCALS~1\Temp\~DF2C35.tmp scheduled to be deleted on reboot.
File delete failed. E:\Users\ADMINI~1\LOCALS~1\Temp\~DF87E2.tmp scheduled to be deleted on reboot.
User's Temp folder emptied.
User's Temporary Internet Files folder emptied.
User's Internet Explorer cache folder emptied.
Local Service Temp folder emptied.
File delete failed. E:\Users\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
Local Service Temporary Internet Files folder emptied.
File delete failed. E:\WINDOWS\temp\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
File delete failed. E:\WINDOWS\temp\History\History.IE5\index.dat scheduled to be deleted on reboot.
File delete failed. E:\WINDOWS\temp\Cookies\index.dat scheduled to be deleted on reboot.
Windows Temp folder emptied.
Temp folders emptied.
Explorer started successfully

OTMoveIt3 by OldTimer - Version 1.0.8.0 log created on 01122009_135941

Files moved on Reboot...
E:\Users\ADMINI~1\LOCALS~1\Temp\7467_appcompat.txt moved successfully.
File E:\Users\ADMINI~1\LOCALS~1\Temp\etilqs_3gZaw61LRICRTbt2PJ6R not found!
File E:\Users\ADMINI~1\LOCALS~1\Temp\~DF2C35.tmp not found!
E:\Users\ADMINI~1\LOCALS~1\Temp\~DF87E2.tmp moved successfully.
E:\Users\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat moved successfully.
E:\WINDOWS\temp\Temporary Internet Files\Content.IE5\index.dat moved successfully.
E:\WINDOWS\temp\History\History.IE5\index.dat moved successfully.
E:\WINDOWS\temp\Cookies\index.dat moved successfully.

Avira will go crazy with warnings, but it's only found them in the avengers backup folder, so delete these two folders in bold:
C:\avenger
C:\_OTMoveIt

Scan with Avira now and see what it finds.

Due to lack of feedback, this topic is closed.

If you need this topic reopened, please contact a staff member. This applies only to the original topic starter.

Everyone else, please open a new topic for your questions.

Due to lack of feedback, this topic is closed.

If you need this topic reopened, please contact a staff member. This applies only to the original topic starter.

Everyone else, please open a new topic for your questions.