This site is hosted at Hostgator.com

## Welcome to The Spykiller

You need to register to  get help with malware cleaning on your computer or take part in the general discussion forums and to upload files that have been requested from other forums. Unfortunately we are getting massive spam attacks from allowing guest postings to uploads
It takes a very long time and a lot of hard work on our part to read all the logs posted here and research and prepare the fixes for you. In many cases each part of the fix takes about 30 minutes to prepare so a large part of our time is spent helping you

### INSTRUCTIONS - Read This Before Posting For Malware Removal Help

#### oD323

• Guest
« on: December 12, 2009, 05:36:13 »
My anti-virus identified Alureon.F and since then I have had google redirects and multiple trojans pop up.  When I try to run DDS, GMER, or Hijack from C:/ I get a warning stating that I "may not have the appropriate permissions".  My windows firewall has also been disabled as so;

It won't let me turn it on at all..

DDS (Ver_09-12-01.01) - NTFSx86
Run by Sunndropp at 18:15:38.75 on Fri 12/11/2009
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_07
Microsoft Windows XP Home Edition  5.1.2600.3.1252.1.1033.18.1918.830 [GMT -8:00]

AV: Spy Sweeper with AntiVirus *On-access scanning enabled* (Updated)   {B3891867-7230-459B-9987-E7CCFA7A7D1D}
AV: Windows Live OneCare *On-access scanning enabled* (Updated)   {427ADFC3-B354-4A51-BE34-A9D4218E45C4}
FW: Windows Live OneCare Firewall *enabled*   {A3899D22-27E6-4A7E-AE4E-2C106646DAAB}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\Program Files\Microsoft Windows OneCare Live\Antivirus\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\Microsoft Windows OneCare Live\winssnotify.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Hp\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\OpenOffice.org 3\program\soffice.exe
C:\Program Files\OpenOffice.org 3\program\soffice.bin
svchost.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\WINDOWS\system32\svchost.exe -k hpdevmgmt
C:\WINDOWS\System32\svchost.exe -k HPZ12
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Microsoft Windows OneCare Live\OcHealthMon.exe
C:\WINDOWS\System32\svchost.exe -k HPZ12
C:\WINDOWS\system32\PnkBstrA.exe
C:\Program Files\Comcast\Desktop Doctor\bin\sprtsvc.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\Program Files\Microsoft Windows OneCare Live\Firewall\msfwsvc.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
C:\Program Files\Microsoft Windows OneCare Live\winss.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\WINDOWS\System32\svchost.exe -k HTTPFilter
C:\Program Files\Webroot\Spy Sweeper\SSU.EXE
C:\Program Files\Java\jre1.6.0_07\bin\jucheck.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
G:\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.lanecc.edu/
uWindow Title = Windows Internet Explorer provided by Qwest
uDefault_Page_URL = hxxp://qwest.live.com
uInternet Connection Wizard,ShellNext = iexplore
uURLSearchHooks: N/A: {0579b4b6-0293-4d73-b02d-5ebb0ba0f0a2} - c:\program files\asksbar\srchastt\1.bin\A2SRCHAS.DLL
BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File
BHO: HP Print Enhancer: {0347c33e-8762-4905-bf09-768834316c61} - c:\program files\hp\smart web printing\hpswp_printenhancer.dll
BHO: HP Print Clips: {053f9267-dc04-4294-a72c-58f732d338c0} - c:\program files\hp\smart web printing\hpswp_framework.dll
BHO: Yahoo! IE Services Button: {5bab4b5b-68bc-4b02-94d6-2fc0de4a7897} - c:\program files\yahoo!\common\yiesrvc.dll
BHO: SSVHelper Class: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre1.6.0_07\bin\ssv.dll
BHO: {7E853D72-626A-48EC-A868-BA8D5E23E045} - No File
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: 1 (0x1) - No File
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
mRun: [NvCplDaemon] "RUNDLL32.EXE" c:\windows\system32\NvCpl.dll,NvStartup
mRun: [nwiz] "nwiz.exe" /install
mRun: [SkyTel] SkyTel.EXE
mRun: [RTHDCPL] RTHDCPL.EXE
mRun: [Alcmtr] ALCMTR.EXE
mRun: [AppleSyncNotifier] "c:\program files\common files\apple\mobile device support\bin\AppleSyncNotifier.exe"
mRun: [OneCareUI] "c:\program files\microsoft windows onecare live\winssnotify.exe"
mRun: [ddoctorv2] "c:\program files\comcast\desktop doctor\bin\sprtcmd.exe" /P ddoctorv2
mRun: [<NO NAME>]
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [net] "c:\windows\system32\net.net"
mRun: [avast!] c:\progra~1\alwils~1\avast4\ashDisp.exe
mRun: [SpySweeper] "c:\program files\webroot\spy sweeper\SpySweeperUI.exe" /startintray
StartupFolder: c:\docume~1\sunndr~1\startm~1\programs\startup\openof~1.lnk - c:\program files\openoffice.org 3\program\quickstart.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\hpdigi~1.lnk - c:\program files\hp\digital imaging\bin\hpqtra08.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\micros~1.lnk - c:\program files\microsoft office\office\OSA9.EXE
IE: &Windows Live Search - c:\program files\windows live toolbar\msntb.dll/search.htm
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBC} - c:\program files\java\jre1.6.0_07\bin\ssv.dll
IE: {58ECB495-38F0-49cb-A538-10282ABF65E7} - {E763472E-A716-4CD9-89BD-DBDA6122F741} - c:\program files\hp\smart web printing\hpswp_extensions.dll
IE: {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - c:\program files\yahoo!\common\yiesrvc.dll
IE: {700259D7-1666-479a-93B1-3250410481E8} - {A93C41D8-01F8-4F8B-B14C-DE20B117E636} - c:\program files\hp\smart web printing\hpswp_extensions.dll
Trusted Zone: microsoft.com\office
Trusted Zone: revagency.net
Trusted Zone: teamavc.com
Trusted Zone: teamavc.com\im
Trusted Zone: teamavc.com\mail
DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} - c:\program files\yahoo!\common\Yinsthelper.dll
DPF: {4871A87A-BFDD-4106-8153-FFDE2BAC2967} - hxxp://dlm.tools.akamai.com/dlmanager/versions/activex/dlm-activex-2.2.3.5.cab
DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} - hxxp://gfx2.hotmail.com/mail/w3/resources/MSNPUpld.cab
DPF: {54BE6B6F-3056-470B-97E1-BB92E051B6C4} - hxxp://h20264.www2.hp.com/ediags/dd/install/HPDriverDiagnosticsxp2k.cab

hxxp://dl8-cdn-01.sun.com/s/ESD44/JSCDL/jdk/6u7/jinstall-6u7-windows-i586-jc.cab?e=1217042209526&h=d76334b7dab1596d6d19e037749fa2ff/&filename=jinstall-6u7-windows-i586-jc.cab
DPF: {9DBAFCCF-592F-101B-85CE-00608CEC297B} - hxxp://im.teamavc.com/jwchat/circ.cab
DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
Notify: WRNotifier - WRLogonNTF.dll

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\sunndr~1\applic~1\mozilla\firefox\profiles\pr3e48uz.default\
FF - prefs.js: browser.startup.homepage - http:/www.blingo.com
FF - component: c:\documents and settings\sunndropp\application data\mozilla\firefox\profiles\pr3e48uz.default\extensions\{463f6ca5-ee3c-4be1-b7e6-7fee11953374}\platform\winnt\components\FoxyTunes.dll
FF - plugin: c:\documents and settings\all users\application data\nexonus\ngm\npNxGameUS.dll
FF - plugin: c:\documents and settings\sunndropp\application data\mozilla\firefox\profiles\pr3e48uz.default\extensions\moveplayer@movenetworks.com\platform\winnt_x86-msvc\plugins\npmnqmp071303000006.dll
FF - plugin: c:\program files\mozilla firefox\plugins\NPAskSBr.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npCouponPrinter.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}

============= SERVICES / DRIVERS ===============

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2009-7-26 64160]
R1 BIOS;BIOS;c:\windows\system32\drivers\BIOS.sys [2008-2-29 13696]
R2 OcHealthMon;Windows Live OneCare Health Monitor;c:\program files\microsoft windows onecare live\OcHealthMon.exe [2009-7-9 26104]
R2 WebrootSpySweeperService;Webroot Spy Sweeper Engine;c:\program files\webroot\spy sweeper\SpySweeper.exe [2008-3-1 3572592]
R3 MpFilter;Microsoft Malware Protection Driver;c:\windows\system32\drivers\MpFilter.sys [2008-10-31 53168]
S3 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [2008-12-23 50704]
S3 root_repeal00001;root_repeal00001;\??\c:\windows\system32\drivers\root_repeal00001.sys --> c:\windows\system32\drivers\root_repeal00001.sys [?]
S3 rootrepeal;rootrepeal;\??\c:\windows\system32\drivers\rootrepeal.sys --> c:\windows\system32\drivers\rootrepeal.sys [?]
S3 XDva302;XDva302;\??\c:\windows\system32\xdva302.sys --> c:\windows\system32\XDva302.sys [?]

============== File Associations ===============

regfile="regedit.exe" "%1"

=============== Created Last 30 ================

2009-12-11 21:53:01   0   d-----w-   c:\program files\Trend Micro
2009-12-11 20:43:24   30784   ----a-w-   c:\windows\system32\drivers\szcmkwnl.sys
2009-12-11 20:43:24   105472   ------w-   c:\windows\system32\drivers\nvata.sys3C446617
2009-12-11 20:35:45   30784   ----a-w-   c:\windows\system32\drivers\rdtxriwk.sys
2009-12-11 20:35:45   105472   ------w-   c:\windows\system32\drivers\nvata.sys4F44496A
2009-12-11 20:33:15   30784   ----a-w-   c:\windows\system32\drivers\jtoxrgtv.sys
2009-12-11 20:33:15   105472   ------w-   c:\windows\system32\drivers\nvata.sysB3DEBCB3
2009-12-11 20:31:51   30784   ----a-w-   c:\windows\system32\drivers\wwzxrojm.sys
2009-12-11 20:31:51   105472   ----a-w-   c:\windows\system32\drivers\nvata.sys5FE83AF9
2009-12-11 20:29:55   30784   ----a-w-   c:\windows\system32\drivers\nygbrmdw.sys
2009-12-11 20:29:19   30784   ----a-w-   c:\windows\system32\drivers\vckyweiv.sys
2009-12-11 20:28:31   30784   ----a-w-   c:\windows\system32\drivers\gixqxrqf.sys
2009-12-11 20:28:31   105472   ------w-   c:\windows\system32\drivers\nvata.sysE98F7886
2009-12-11 20:28:15   30784   ----a-w-   c:\windows\system32\drivers\mtbwqdxy.sys
2009-12-11 20:28:14   105472   ----a-w-   c:\windows\system32\drivers\nvata.sys74349127
2009-12-11 08:03:51   0   d-----w-   c:\program files\Subagames
2009-12-11 06:13:51   36312   ----a-w-   c:\windows\system32\net.net
2009-12-10 12:37:10   0   d-----w-   c:\program files\OGPlanet
2009-12-10 12:36:20   0   d-----w-   c:\program files\ElastoMania111
2009-12-10 01:44:20   39669   ----a-w-   c:\documents and settings\sunndropp\.recently-used.xbel
2009-11-30 19:33:46   41872   ----a-w-   c:\windows\system32\xfcodec.dll
2009-11-14 21:24:49   0   d-----w-   c:\program files\iPod
2009-11-14 21:24:45   0   d-----w-   c:\program files\iTunes
2009-11-14 21:24:45   0   d-----w-   c:\docume~1\alluse~1\applic~1\{755AC846-7372-4AC8-8550-C52491DAA8BD}

==================== Find3M  ====================

2009-12-11 20:11:24   105472   ------w-   c:\windows\system32\drivers\nvata.sys
2009-12-10 01:20:50   147606   ----a-w-   c:\windows\hpoins21.dat
2009-10-29 07:45:38   916480   ----a-w-   c:\windows\system32\wininet.dll
2009-10-21 05:38:36   75776   ----a-w-   c:\windows\system32\strmfilt.dll
2009-10-21 05:38:36   25088   ----a-w-   c:\windows\system32\httpapi.dll
2009-10-20 16:20:16   265728   ----a-w-   c:\windows\system32\drivers\http.sys
2009-10-13 10:30:16   270336   ----a-w-   c:\windows\system32\oakley.dll
2009-10-12 13:38:19   149504   ----a-w-   c:\windows\system32\rastls.dll
2009-10-12 13:38:18   79872   ----a-w-   c:\windows\system32\raschap.dll
2008-11-19 07:29:57   32768   --sha-w-   c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012008111820081119\index.dat
2009-01-03 20:59:02   16384   --sha-w-   c:\windows\temp\history\history.ie5\index.dat
2009-01-03 20:59:02   32768   --sha-w-   c:\windows\temp\temporary internet files\content.ie5\index.dat

============= FINISH: 18:17:23.31 ===============

#### Derek

• Posts: 11927
##### Re: Alureon.F Google Redirection problem.
« Reply #1 on: December 12, 2009, 10:00:26 »
Delete any existing version of ComboFix you have sitting on your desktop

**Note:  It is important that it is saved directly to your desktop  and run from the desktop and not any other folder on your computer**
--------------------------------------------------------------------
1. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

• Very Important! Temporarily disable your anti-virus and  anti-malware real-time protection and any script blocking components of them or your firewall before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results" or stop combofix running at all
• Click on THIS LINK to see instructions on how to temporarily disable many security programs while running combofix. The list does not cover every program. If yours is not listed and you don't know how to disable it, please ask.
• Remember to re enable the protection again after combofix has finished
--------------------------------------------------------------------
2. Close any open browsers and any other programs you might have running
Double click on combofix.exe & follow the prompts.
If you are using windows XP It might display a pop up saying that "Recovery console is not installed, do you want to install?"
When finished, it will produce a report for you.
Please post the "C:\ComboFix.txt" for further review

****Note: Do not mouseclick combofix's window while it's running. That may cause it to stall or freeze ****

Note: ComboFix may reset a number of Internet Explorer's settings, including making it the default browser.
Note: Combofix prevents autorun of ALL CDs, floppies and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you -- please tell us when you reply. Read HERE why we disable autoruns

Please do not install any new programs or update anything (always allow your antivirus/antispyware to update) unless told to do so while we are fixing your problem. If combofix alerts to a new version and offers to update, please let it. It is essential we always use the latest version.
Derek
Microsoft MVP  Windows - Security
Modern Malware is so involved and difficult to fix that it takes a very long time and a lot of hard work and research to prepare the fixes for you. A large part of my time is spent helping you
Would you do all this for nothing?
I run this site to raise funds for Hedgehog Rescue
Please donate if I have helped you or you have found this site useful.

#### oD323

• Guest
##### Re: Alureon.F Google Redirection problem.
« Reply #2 on: December 12, 2009, 13:25:45 »
Thank You for the quick response, I did all as instructed but when I go to run ComboFix from the desktop I receive this:

I tried running Safe Mode and Safe Mode with Networking, but it would just restart any time I tried to boot it.
[Earlier, I was able to run the other diagnostics from an external drive (they would receive the same error when executed on C:]

#### Derek

• Posts: 11927
##### Re: Alureon.F Google Redirection problem.
« Reply #3 on: December 12, 2009, 13:56:21 »
we need to try something here, which might or might not work

first you need to disable onecare which is interfering with any fixes, you might have to uninstall it to let us do any fixes

do you have your windows cd

go to C:\WINDOWS\system32\drivers\nvata.sys  & right click it & select copy

then go to C:\  and right click a blank spot & select paste

that makes a copy of the file & palces it where we ned to use it

unzip it & place it on desktop

double click it run & in teh box paste the contents of the quote box

Quote

Files to move:
C:\nvata.sys | C:\WINDOWS\system32\drivers\nvata.sys

press execute & the computer will reboot

after booting copy the log it makes and post that back here then try combofix which should run
Derek
Microsoft MVP  Windows - Security
Modern Malware is so involved and difficult to fix that it takes a very long time and a lot of hard work and research to prepare the fixes for you. A large part of my time is spent helping you
Would you do all this for nothing?
I run this site to raise funds for Hedgehog Rescue
Please donate if I have helped you or you have found this site useful.

#### oD323

• Guest
##### Re: Alureon.F Google Redirection problem.
« Reply #4 on: December 13, 2009, 23:55:41 »
I did as instructed,(disabled onecare through CMD) and upon restart the avenger log said that it "could not locate nvata.sys.  I then tried to run combofix, but was still restricted.  I saw that the file I copied to C:\ was named "nvata" nvata.sys, so I renamed it ( and the original),  then tried running avenger again ( which said that it had completed successfully and could reboot.    Upon starting, I'm greeted by a screen that says " a system file [nvata.sys] is missing or corrupt."   It then asks for a windows CD to enter the recovery console, I have my CD now and am logged onto C:\WINDOWS.
What should I do from here? (sorry for messing up that bad, it was late).
Thank you

#### Derek

• Posts: 11927
##### Re: Alureon.F Google Redirection problem.
« Reply #5 on: December 14, 2009, 08:29:03 »
if you are in recovery console

type cd c:\windows\system32\drivers  press ok

then look for nvata.sys and make sure it is called nvata.sys & not any other name with spaces or any additional bits to it

let me know if it is called anything else

you should see several nvata.sys there with names like this
c:\windows\system32\drivers\nvata.sys3C446617

if there is NO nvata.sys on its own without teh extra letters then carefully write down the exact name of 1 of the files if thre letters etc after nvata.sys are different to what I have written, then change it to the one you find

then type ren c:\windows\system32\drivers\nvata.sys3C446617 nvata.sys  ( ppress ok/enter)

make sure there is a space between ren & C and between 3C446617   and nvata.sys

you should get a message file renamed successfully

once you get that type exit & press enter to get out of recovery console

reboot & see if it will boot normally

Derek
Microsoft MVP  Windows - Security
Modern Malware is so involved and difficult to fix that it takes a very long time and a lot of hard work and research to prepare the fixes for you. A large part of my time is spent helping you
Would you do all this for nothing?
I run this site to raise funds for Hedgehog Rescue
Please donate if I have helped you or you have found this site useful.

### Donations

You have come to The Spykiller for help because your Antivirus or Antispyware hasn't been able to fix your problem.

Modern Malware has become so involved and difficult to fix that it takes a very long time and a lot of hard work to read all the logs posted here and research and prepare the fixes for you. In many cases each part of the fix takes about 30 minutes to prepare, so a large part of my time is spent helping you

Would you do all this for nothing?

The reason I run this site is to raise funds for Hedgehog Rescue

Please donate if I have helped you or you have found this site useful.

You can donate safely and securely by using the paypal service, just click on one of the buttons below.

To donate in UK £