Malware, Trojan Alureon and others...

Hi,
My computer recently started acting funny while surfing the net (pop-ups that wouldn't stop, and slower speed), so I ran Windows live one scanner immediately after symptoms. It found 7 issues, in which it cleaned and deleted. Three kept coming back when I would run the scanner:
5th run on live one scanner:

2 severe issues found
Trojan:Win32/Alureon.BJ
Issue 1
c:\windows\system32\ovfsthrobwrdypwvroiifpxcsirsxyqdmhaadm.dll (restart required) deleted
c:\windows\system32\ovfsthpmvftaaaklqqrgoduwsanpeesyvukxli.dll (restart required) deleted
Trojan:WinNT/Alureon.C
Issue 1
c:\windows\system32\drivers\ovfsthyiuijnbakbwrpakktvvuwwqijfiimovd.sys deleted

1 High issue found
TrojanDownloader:JS/Renos
Issue 1
c:\document and setting\christinab\local settings\temp\dat184.tmp

Before I had the chance to find this site, I did the following advise from other sites:
Booted in Safe mode
Turned off System Restore
Ran Windows Live one scanner
Rebooted
Turned on System Restore
Ran Scanner again, the same results.

I also downloaded Malwarebytes and I have a log of what they got rid of. Then I ran Live one scanner again, but same results came back.

Then I found this site. Thank you for any help.

Hijacker logs:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:40:56 PM, on 4/26/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16827)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Elantech\ETDCtrl.exe
C:\Program Files\Elantech\ETDDect.exe
C:\Program Files\EeePC\ACPI\AsTray.exe
C:\Program Files\EeePC\ACPI\AsAcpiSvr.exe
C:\Program Files\EeePC\ACPI\AsEPCMon.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxext.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\Program Files\Google\Google Talk\googletalk.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\HP\Digital Imaging\Product Assistant\bin\hprblog.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Java\jre6\bin\java.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://eeepc.asus.com/global
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O1 - Hosts: 82.98.231.89 url.adtrgt.com
O1 - Hosts: 82.98.231.89 googleads2.gdoubleclick.net
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: (no name) - {3b08755a-b747-48c3-ad41-55bdce22fd3c} - (no file)
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [ETDWare] C:\Program Files\Elantech\ETDCtrl.exe
O4 - HKLM\..\Run: [ETDWareDetect] C:\Program Files\Elantech\ETDDect.exe
O4 - HKLM\..\Run: [AsusTray] C:\Program Files\EeePC\ACPI\AsTray.exe
O4 - HKLM\..\Run: [AsusACPIServer] C:\Program Files\EeePC\ACPI\AsAcpiSvr.exe
O4 - HKLM\..\Run: [AsusEPCMonitor] C:\Program Files\EeePC\ACPI\AsEPCMon.exe
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [googletalk] C:\Program Files\Google\Google Talk\googletalk.exe /autostart
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: Send to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O8 - Extra context menu item: Send To Bluetooth - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://housecall65.trendmicro.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase5483.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1236566946171
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1236566938014
O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (a-squared Scanner) - http://ax.emsisoft.com/asquared.cab
O20 - AppInit_DLLs: C:\WINDOWS\system32\tisehuza.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: getPlus(R) Helper - NOS Microsystems Ltd. - C:\Program Files\NOS\bin\getPlus_HelperSvc.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe

--
End of file - 6227 bytes

I'm actually suprised Windows Live is able to "delete" that .sys file being it's the main driver for the rootkit.

• Open HijackThis
  
• Choose "Do a system scan only"
  
• Check the boxes in front of these lines:
  
  
  O1 - Hosts: 82.98.231.89 url.adtrgt.com
  O1 - Hosts: 82.98.231.89 googleads2.gdoubleclick.net
  O2 - BHO: (no name) - {3b08755a-b747-48c3-ad41-55bdce22fd3c} - (no file)
  O20 - AppInit_DLLs: C:\WINDOWS\system32\tisehuza.dll
  
  
  
• Press "Fix Checked"
  
• Close Hijack This.
  

1. Please download The Avenger by Swandog46 to your Desktop
Link: HERE or HERE.

• Click on Avenger.zip to open the file
  
• Extract avenger.exe to your desktop
  

Note: This tool was posted specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.

2. Now, start The Avenger program by clicking on its icon on your desktop.

• Leave the script box empty.
  
• Leave the ticked box "Scan for rootkit" ticked.
  
• Then tick "Disable any rootkits found"
  
• Now click on the Execute to begin execution of the script.
  
• Answer "Yes" twice when prompted.
  
  The Avenger will automatically do the following:
  
  
• It will Restart your computer.
  
• On reboot, it will briefly open a black command window on your desktop, this is normal.
  
• After the restart, it creates a log file that should open with the results of Avenger’s actions. This log file will be located at C:\avenger.txt
  
• The Avenger will also have backed up all the files, etc., that you asked it to delete, and will have zipped them and moved the zip archives to C:\avenger\backup.zip.
  

3. Please copy/paste the content of c:\avenger.txt into your reply.

Hi,
Just to let you know, when I booted up, the toolbar tray (at the bottom right corner), a red x popped up and said that my firewall was turned off. I checked and it was still on. don't know what that was about

I did forget to mention, the:
1 High issue found
TrojanDownloader:JS/Renos
Issue 1
c:\document and setting\christinab\local settings\temp\dat184.tmp

that Windows Live One found did go away. I went and deleted the dat184.tmp from its place. don't know if I should have done that or not, but it no longer showed up as an issue from the scan after that.
Thx.

Logfile of The Avenger Version 2.0, (c) by Swandog46
http://swandog46.geekstogo.com

Platform: Windows XP

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.

Hidden driver "ovfsthsqtjifxmlxdqbrsenkvppjdulhajsbbd" found!
ImagePath: \systemroot\system32\drivers\ovfsthyiuijnbakbwrpakktvvuwwqijfiimovd.sys
Driver disabled successfully.

Rootkit scan completed.


Completed script processing.

*******************

Finished! Terminate.

2. Copy all the text contained in the code box below to your Clipboard by highlighting it and pressing (Ctrl+C):

Drivers to delete:
ovfsthsqtjifxmlxdqbrsenkvppjdulhajsbbd

Files to delete:
C:\WINDOWS\system32\drivers\ovfsthyiuijnbakbwrpakktvvuwwqijfiimovd.sys

Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.

3. Now, start The Avenger program by clicking on its icon on your desktop.

• Under "Input script here:", paste in the script from the quote box above.
  
• Leave the ticked box "Scan for rootkit" ticked.
  
• Then tick "Disable any rootkits found"
  
• Now click on the Execute to begin execution of the script.
  
• Answer "Yes" twice when prompted.
  
  The Avenger will automatically do the following:
  
  
• It will Restart your computer.
  
• On reboot, it will briefly open a black command window on your desktop, this is normal.
  
• After the restart, it creates a log file that should open with the results of Avenger’s actions. This log file will be located at C:\avenger.txt
  
• The Avenger will also have backed up all the files, etc., that you asked it to delete, and will have zipped them and moved the zip archives to C:\avenger\backup.zip.
  

4. Please copy/paste the content of c:\avenger.txt into your reply.

Logfile of The Avenger Version 2.0, (c) by Swandog46
http://swandog46.geekstogo.com

Platform: Windows XP

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.
No rootkits found!

Driver "ovfsthsqtjifxmlxdqbrsenkvppjdulhajsbbd" deleted successfully.
File "C:\WINDOWS\system32\drivers\ovfsthyiuijnbakbwrpakktvvuwwqijfiimovd.sys" deleted successfully.

Completed script processing.

*******************

Finished! Terminate.

Please download and run this tool.

Download Malwarebytes' Anti-Malware from Here

Double Click mbam-setup.exe to install the application.

• Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  
• If an update is found, it will download and install the latest version.
  
• Once the program has loaded, select "Perform Quick Scan", then click Scan.
  
• The scan may take some time to finish,so please be patient.
  
• When the scan is complete, click OK, then Show Results to view the results.
  
• Make sure that everything is checked, and click Remove Selected.
  
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Note)
  
• The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  

Note:
If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts.
Click OK to either and let MBAM proceed with the disinfection process.
If asked to restart the computer, please do so immediately.

Post the contents of the MBAM Log.

Malwarebytes' Anti-Malware 1.36
Database version: 2046
Windows 5.1.2600 Service Pack 3

4/27/2009 4:32:06 PM
mbam-log-2009-04-27 (16-32-06).txt

Scan type: Quick Scan
Objects scanned: 76067
Time elapsed: 3 minute(s), 54 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 8

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\WINDOWS\system32\ovfsthowltyyixehrqfjksqikmgejolteoqmql.dll (Trojan.TDSS) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\ovfsthpmvftaaaklqqrgoduwsanpeesyvukxli.dll (Trojan.TDSS) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\ovfsthrobwrdypwvroiifpxcsirsxyqdmhaadm.dll (Trojan.TDSS) -> Quarantined and deleted successfully.
C:\Documents and Settings\ChristinaB\Local Settings\Temp\ovfsthmdnymcxtll.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\ChristinaB\Local Settings\Temp\ovfsthtuwfjixjib.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\ovfsthcnwokiemlcsasrvosrnhpkhfwotxqyru.dat (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\ovfsthytvtlibrghhvrvruidtnkxceqvbqojyr.dat (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\ChristinaB\Local Settings\Temp\ovfsthpulabqqyqp.tmp (Trojan.Agent) -> Quarantined and deleted successfully.

DDS (Ver_09-03-16.01) - NTFSx86
Run by ChristinaB at 16:52:43.70 on Mon 04/27/2009
Internet Explorer: 7.0.5730.13 BrowserJavaVersion: 1.6.0_12
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1015.475 [GMT -4:00]


============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
svchost.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\WINDOWS\Explorer.EXE
C:\Program Files\Elantech\ETDCtrl.exe
C:\Program Files\Elantech\ETDDect.exe
C:\Program Files\EeePC\ACPI\AsTray.exe
C:\Program Files\EeePC\ACPI\AsAcpiSvr.exe
C:\Program Files\EeePC\ACPI\AsEPCMon.exe
C:\WINDOWS\system32\igfxext.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\Program Files\Google\Google Talk\googletalk.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\HP\Digital Imaging\Product Assistant\bin\hprblog.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\ChristinaB\Desktop\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://eeepc.asus.com/global
uInternet Settings,ProxyOverride = *.local
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
mRun: [ETDWare] c:\program files\elantech\ETDCtrl.exe
mRun: [ETDWareDetect] c:\program files\elantech\ETDDect.exe
mRun: [AsusTray] c:\program files\eeepc\acpi\AsTray.exe
mRun: [AsusACPIServer] c:\program files\eeepc\acpi\AsAcpiSvr.exe
mRun: [AsusEPCMonitor] c:\program files\eeepc\acpi\AsEPCMon.exe
mRun: [MSPY2002] c:\windows\system32\ime\pintlgnt\ImScInst.exe /SYNC
mRun: [IMJPMIG8.1] "c:\windows\ime\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
mRun: [googletalk] c:\program files\google\google talk\googletalk.exe /autostart
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [HP Software Update] c:\program files\hp\hp software update\HPWuSchd2.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\hpdigi~1.lnk - c:\program files\hp\digital imaging\bin\hpqtra08.exe
IE: Send to &Bluetooth Device... - c:\program files\widcomm\bluetooth software\btsendto_ie_ctx.htm
IE: Send To Bluetooth - c:\program files\widcomm\bluetooth software\btsendto_ie.htm
IE: {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - c:\program files\pokerstars\PokerStarsUpdate.exe
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} - hxxp://housecall65.trendmicro.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} - hxxp://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase5483.cab
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1236566946171
DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1236566938014
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_12-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} - hxxp://ax.emsisoft.com/asquared.cab
DPF: {CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_12-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_12-windows-i586.cab
Notify: igfxcui - igfxdev.dll
LSA: Notification Packages = scecli c:\windows\system32\tisehuza.dll

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\christ~1\applic~1\mozilla\firefox\profiles\dqy29trw.default\

============= SERVICES / DRIVERS ===============

R3 AsusACPI;ASUS ACPI Driver;c:\windows\system32\drivers\ASUSACPI.SYS [2008-12-4 10752]
R3 Ktp;Elantech Smart-Pad;c:\windows\system32\drivers\ETD.sys [2008-11-24 26112]
R3 RT80x86;Ralink 802.11n Wireless Driver;c:\windows\system32\drivers\rt2860.sys [2008-12-4 704384]
S3 getPlus(R) Helper;getPlus(R) Helper;c:\program files\nos\bin\getPlus_HelperSvc.exe [2009-3-10 33752]
S3 L1e;Miniport Driver for Atheros AR8121/AR8113/AR8114 PCI-E Ethernet Controller;c:\windows\system32\drivers\l1e51x86.sys [2008-11-4 38400]

=============== Created Last 30 ================

2009-04-26 22:20 --d----- c:\program files\Trend Micro
2009-04-26 21:49 --d----- c:\docume~1\christ~1\applic~1\Malwarebytes
2009-04-26 21:49 15,504 a------- c:\windows\system32\drivers\mbam.sys
2009-04-26 21:49 38,496 a------- c:\windows\system32\drivers\mbamswissarmy.sys
2009-04-26 21:49 --d----- c:\program files\Malwarebytes' Anti-Malware
2009-04-26 21:49 --d----- c:\docume~1\alluse~1\applic~1\Malwarebytes
2009-04-25 18:51 --d----- c:\docume~1\christ~1\applic~1\Antispyware
2009-04-25 18:48 --d----- c:\documents and settings\christinab\.housecall6.6
2009-04-24 21:57 28,320 a------- c:\windows\system32\drivers\szinbuuq.sys
2009-04-24 21:57 --d----- c:\program files\Windows Live Safety CenterRebootActions
2009-04-24 21:53 --d----- C:\My Downloads
2009-04-15 04:50 2,560 -------- c:\windows\system32\xpsp4res.dll
2009-04-13 06:13 --d----- c:\program files\Microsoft CAPICOM 2.1.0.2
2009-04-11 22:27 --d----- c:\docume~1\christ~1\applic~1\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
2009-04-10 07:07 45,056 a------- c:\windows\system32\hpzll3xu.dll
2009-04-10 07:02 --d----- c:\program files\HP
2009-04-10 07:01 78,848 a------- c:\windows\hpfins05.dat
2009-04-10 07:01 1,395 -------- c:\windows\hpfmdl05.dat
2009-04-10 07:00 372,736 a------- c:\windows\system32\hpzidi01.dll
2009-04-10 07:00 77,824 a------- c:\windows\system32\hpzids01.dll
2009-04-10 06:57 --d----- c:\docume~1\alluse~1\applic~1\PC Drivers HeadQuarters
2009-04-09 14:16 221,184 a------- c:\windows\system32\wmpns.dll
2009-04-09 14:11 25,856 ac------ c:\windows\system32\dllcache\usbprint.sys
2009-04-09 14:11 25,856 a------- c:\windows\system32\drivers\usbprint.sys
2009-04-05 14:12 459,264 -c------ c:\windows\system32\dllcache\msfeeds.dll
2009-04-05 14:12 52,224 -c------ c:\windows\system32\dllcache\msfeedsbs.dll
2009-04-05 14:12 268,288 -c------ c:\windows\system32\dllcache\iertutil.dll
2009-04-05 14:12 63,488 -c------ c:\windows\system32\dllcache\icardie.dll
2009-04-05 14:12 13,824 -c------ c:\windows\system32\dllcache\ieudinit.exe
2009-04-05 14:12 2,455,488 -c------ c:\windows\system32\dllcache\ieapfltr.dat
2009-04-05 14:12 991,232 -c------ c:\windows\system32\dllcache\ieframe.dll.mui
2009-04-05 14:12 383,488 -c------ c:\windows\system32\dllcache\ieapfltr.dll
2009-04-05 14:12 6,066,176 -c------ c:\windows\system32\dllcache\ieframe.dll
2009-04-04 21:23 78,336 a------- c:\windows\system32\ieencode.dll
2009-04-04 21:23 78,336 ac------ c:\windows\system32\dllcache\ieencode.dll
2009-04-04 21:15 --dsh--- c:\documents and settings\christinab\IETldCache
2009-04-04 21:13 --d----- c:\windows\ie8updates
2009-04-04 21:09 105,984 -c------ c:\windows\system32\dllcache\iecompat.dll
2009-04-04 20:48 --d----- c:\program files\Bonjour
2009-04-04 20:19 --d----- c:\program files\uTorrent
2009-04-04 20:19 --d----- c:\docume~1\christ~1\applic~1\uTorrent
2009-04-01 11:27 --d----- c:\program files\Bonjour(2)

==================== Find3M ====================

2009-04-25 21:34 76,487 a------- c:\windows\pchealth\helpctr\offlinecache\index.dat
2009-04-25 18:20 2,068 a------- c:\docume~1\christ~1\applic~1\wklnhst.dat
2009-04-24 21:43 52,224 a--sh--- c:\windows\system32\zaruwawi.exe
2009-03-13 09:31 410,984 a------- c:\windows\system32\deploytk.dll
2009-03-06 10:22 284,160 a------- c:\windows\system32\pdh.dll
2009-03-02 20:18 826,368 a------- c:\windows\system32\wininet.dll
2009-02-09 08:10 729,088 a------- c:\windows\system32\lsasrv.dll
2009-02-09 08:10 714,752 a------- c:\windows\system32\ntdll.dll
2009-02-09 08:10 617,472 a------- c:\windows\system32\advapi32.dll
2009-02-09 08:10 401,408 a------- c:\windows\system32\rpcss.dll
2009-02-09 07:13 1,846,784 a------- c:\windows\system32\win32k.sys
2009-02-06 07:11 110,592 a------- c:\windows\system32\services.exe
2009-02-06 07:06 2,145,280 a------- c:\windows\system32\ntoskrnl.exe
2009-02-06 06:39 35,328 a------- c:\windows\system32\sc.exe
2009-02-06 06:32 2,023,936 a------- c:\windows\system32\ntkrnlpa.exe
2009-02-03 15:59 56,832 a------- c:\windows\system32\secur32.dll
2008-05-07 04:34 15,523,560 a------- c:\program files\U1 Setup.exe

============= FINISH: 16:53:08.04 ===============

I see that you are running uTorrent.
P2P(Peer to peer) applications are designed to help you easily share and distribute files between you and a group of people. But they can also be used to distribute malware, and thus are not considered safe.
The removal of these programs is optional, but highly recommended.

If uTorrent is not removed, then I won't help you.

Go to Start > Control Panel > Add/Remove Programs and remove the following programs.

• uTorrent
  

You aren't running Anti Virus Software

Please install Avira antivirus otherwise you won't be protected.

1) Antivir PersonalEditionClassic
-Free anti-virus software for Windows.
-Detects and removes more than 50,000 viruses. Free support.

It is strongly recommended that you run only one antivirus program at a time. Having more than one antivirus program active in memory uses additional resources and can result in program conflicts and false virus alerts.

Please download the OTMoveIt3 by OldTimer.

• Save it to your desktop.
  
• Please double-click OTMoveIt3.exe to run it.
  
• Copy the bolded text below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):
  
  
  :files
  c:\windows\system32\zaruwawi.exe
  c:\program files\uTorrent
  c:\docume~1\christ~1\applic~1\uTorrent
  c:\windows\system32\drivers\szinbuuq.sys
  C:\Documents and Settings\ChristinaB\Desktop\dds.scr
  
  :reg
  [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
  "Notification Packages"=hex(7):73,63,65,63,6c,69,00,00
  
  
  
• Return to OTMoveIt3, right click in the "Paste instructions for items to be Moved" window (under the light blue bar) and choose Paste.
  
• Click the red Moveit! button.
  
• Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
  
• Close OTMoveIt3
  

If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes.

Please post the OTMoveIt log.

========== FILES ==========
c:\windows\system32\zaruwawi.exe moved successfully.
File/Folder c:\program files\uTorrent not found.
c:\docume~1\christ~1\applic~1\uTorrent moved successfully.
c:\windows\system32\drivers\szinbuuq.sys moved successfully.
C:\Documents and Settings\ChristinaB\Desktop\dds.scr moved successfully.
========== REGISTRY ==========
HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa\\"Notification Packages"|hex(7):73,63,65,63,6c,69,00,00 /E : value set successfully!

OTMoveIt3 by OldTimer - Version 1.0.11.0 log created on 04272009_171807

Hello.
The malware is gone now, but we need to talk.

The file I put in the script for OTMoveIt to move was created at exactly the same time as this folder:

c:\program files\Windows Live Safety CenterRebootActions

It was created: 2009-04-24 21:57

Did you download something via uTorrent/another P2P program and ran it? that folder name is a little suspicious, and even more suspicious why that sys file can't be found via a Google search, so it was probably malware.

That folder is probably malware too, but I need to know.

I did not download anything using p2p program at that time. But that is exactly the time all the pop ups started on my computer. I thought one of them was Windows trying to tell me that I have viruses, and said to Run something called Spyware2009. I unfortunately did, and found out later that I shouldn't have. Maybe its that?

I think you did download something malicious, because this folder was created just 4mins BEFORE that weird folder got on your machine.

C:\My Downloads

Lets run one more OTMoveIt script.

• Save it to your desktop.
  
• Please double-click OTMoveIt3.exe to run it.
  
• Copy the bolded text below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):
  
  
  :files
  C:\My Downloads
  c:\program files\Windows Live Safety CenterRebootActions
  
  
  
• Return to OTMoveIt3, right click in the "Paste instructions for items to be Moved" window (under the light blue bar) and choose Paste.
  
• Click the red Moveit! button.
  
• Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
  
• Close OTMoveIt3
  

If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes.

Please post the OTMoveIt log.

========== FILES ==========
C:\My Downloads moved successfully.
c:\program files\Windows Live Safety CenterRebootActions moved successfully.

OTMoveIt3 by OldTimer - Version 1.0.11.0 log created on 04272009_173353

Hello.
Did you install Avira like I asked?

It's important you run an AV, there is some very dangerous malware on the internet. You need to keep Avira upto date.

We can remove OTMoveIt now.

• Please double-click OTMoveIt3.exe to run it again.
  
• Press the green CleanUp! button.
  
• Press Yes cleanup process prompt, do the same for the reboot prompt.
  

How is the machine running now?

Hi,
Yes, I did download Avira.
My computer does run much faster, and no more pop ups. Thanks for your help!

I did have one other concern. I'm going to assume that I got all this mess on 4-24 around 21:30ish. I had some very personal information in one particular folder (tax forms for this year that I never got around to deleting), and I was wondering with the types of viruses that I had, could they have gotten that information? If so, I guess I should probably go out and change some account numbers?
Thx.

If you feel safer changing them, then do so.

Well, i'm doing a google search for homework stuff, and all the sites i click on from google keep taking me to other sites. and the title on all the pages keep saying "Nothing found - Mozilla Firefox" that's probably not good. should I run a scan with Avira?

Hello.
Okay, we'll fix that now. I had another user with the exact problem you had. The rootkit comes with a Google hijacker we can't say in logs.

Please download GooredFix and save it to your Desktop. Double-click GooredFix.exe to run it. Select 1. Find Goored (no fix) by typing 1 and pressing Enter. A log will open, please post the contents of that log in your next reply (it can also be found on your desktop, called GooredLog.txt). Note: Do not run Option #2 yet.

Also wanted to let you know that Avira found two viruses so far:

1) TR/Vundo.Gen
2) Recognition pattern of the HTML/Crypted.Gen HTML script virus

GooredFix v1.92 by jpshortstuff
Log created at 19:25 on 27/04/2009 running Option #1 (ChristinaB)
Firefox version 3.0.9 (en-US)

=====Suspect Goored Entries=====

C:\Program Files\Mozilla Firefox\extensions\{DE4AAE25-999B-4A13-9110-72B8384E1427}

C:\Program Files\Mozilla Firefox\extensions\{B6301458-0FE2-40F1-BAC4-67DCEE0CCE51}

C:\Program Files\Mozilla Firefox\extensions\{72838649-3477-48EB-9882-AA6470701B36}

C:\Program Files\Mozilla Firefox\extensions\{1793F2AD-B6D1-4590-B4BA-D1FCBD984122}

=====Dumping Registry Values=====

[HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox 3.0.9\extensions]
"Plugins"="C:\Program Files\Mozilla Firefox\plugins"

[HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox 3.0.9\extensions]
"Components"="C:\Program Files\Mozilla Firefox\components"

[HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Firefox\extensions]
"jqs@sun.com"="C:\Program Files\Java\jre6\lib\deploy\jqs\ff"

Please double-click GooredFix.exe on your Desktop to run it. Select 2. Fix Goored by typing 2 and pressing Enter. Make sure all instances of Firefox are closed at this point. Type y at the prompt and press Enter again. A log will open, please post the contents of that log in your next reply (it can also be found on your desktop, called GooredLog.txt).

GooredFix v1.92 by jpshortstuff
Log created at 09:52 on 28/04/2009 running Option #2 (ChristinaB)
Firefox version 3.0.9 (en-US)

=====Goored Deletions=====
C:\Program Files\Mozilla Firefox\extensions\{DE4AAE25-999B-4A13-9110-72B8384E1427}
->Backing up folder... Done.
->Emptying folder... Done.
->Deleting folder... Done.
C:\Program Files\Mozilla Firefox\extensions\{B6301458-0FE2-40F1-BAC4-67DCEE0CCE51}
->Backing up folder... Done.
->Emptying folder... Done.
->Deleting folder... Done.
C:\Program Files\Mozilla Firefox\extensions\{72838649-3477-48EB-9882-AA6470701B36}
->Backing up folder... Done.
->Emptying folder... Done.
->Deleting folder... Done.
C:\Program Files\Mozilla Firefox\extensions\{1793F2AD-B6D1-4590-B4BA-D1FCBD984122}
->Backing up folder... Done.
->Emptying folder... Done.
->Deleting folder... Done.

=====Dumping Registry Values=====

[HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox 3.0.9\extensions]
"Plugins"="C:\Program Files\Mozilla Firefox\plugins"

[HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox 3.0.9\extensions]
"Components"="C:\Program Files\Mozilla Firefox\components"

[HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Firefox\extensions]
"jqs@sun.com"="C:\Program Files\Java\jre6\lib\deploy\jqs\ff"

Hello.
The Google redirect/hijacks should stop now.

Click Start >> Run and then copy/paste the following into the box and hit Enter:
"%userprofile%\Desktop\GooredFix.exe" /uninstall
note the space between " /
If any of your security programs query a new Registry/AutoStart value being added please allow the changes.

Ok, all done. How about those other two issues that Avira found? I put them into quarantine, should I just delete them? Thanks.

1) TR/Vundo.Gen
2) Recognition pattern of the HTML/Crypted.Gen HTML script virus

Quarantine/delete, either way, they are probably leftovers.

Remember logs won't show EVERY file of an infection, logs only check for created files within a months time. Anything later than a month won't show.