Hi all, i've been infected with the Win32/Rustock.gen!C Virus. Ive searched everywhere and cannot come up with something that will assist me in removing this virus. I've scanned in safe mode using norton antivirus updated, and scanned in safe mode with the windows malicious tool, both found nothing. The CPU will work for a few minutes, then it will give me a mshtml.dll error and give me a services and controller application error, and countdown from 60 seconds until the system reboots.....any help would be greatly appreciated!

Download rustbfix.exe and save it to your desktop.

Double click on rustbfix.exe to run the tool.
If a Rustock.b-infection is found, you will shortly hereafter be asked to reboot the computer. The reboot will probably take quite a while, and perhaps 2 reboots will be needed. But this will happen automatically.
After the reboot 2 logfiles will open (%root%\avenger.txt & %root%\rustbfix\pelog.txt). If needed (still infected), post the content of these logfiles along with a new HijackThis log.

Examples Only

Note : If the infection is found, the tool will produce 2 logs: The specific rusbfix-log could look like this:

**** Rustock.b-fix -- By ejvindh ****
19-10-2006 21:59:37,90

**** Pre-run Status of system *******

Rootkit driver PE386 is found. Starting the unload-procedure....
Examine the Avenger-logfile in order to assess the success of the unload-procedure

Rustock.b-ADS attached to the System32-folder:
:lzx32.sys 66432
Total size: 66432 bytes.
Attempting to remove ADS...
system32: deleted 66432 bytes in 1 streams.

*** Post-run Status of system ***

Rustock.b-driver on the system: NONE!

Rustock.b-ADS attached to the System32-folder:
No streams found.

******** End of Logfile ***********

If no rustock.b-infection is found, the logfile will look like this:

***** Rustock.b-fix -- By ejvindh*****
06-10-19 22:37:34.93

No Rustock.b-rootkits found

******* End of Logfile *******

Thank you for the reply jabuck. I will run this and let you know how things go.

Here is the results, I have no idea if it found anything, or if there is anything on my CPU.

PELOG

************************* Rustock.b-fix -- By ejvindh *************************
Fri 04/06/2007 0:45:16.85

******************* Pre-run Status of system *******************

Rootkit driver PE386 is found. Starting the unload-procedure....

Rustock.b-ADS attached to the System32-folder:
:lzx32.sys 80488
Total size: 80488 bytes.
Attempting to remove ADS...
system32: deleted 80488 bytes in 1 streams.

Looking for Rustock.b-files in the System32-folder:
No Rustock.b-files found in system32

******************* Post-run Status of system *******************

Rustock.b-driver on the system: NONE!

Rustock.b-ADS attached to the System32-folder:
No System32-ADS found.

Looking for Rustock.b-files in the System32-folder:
No Rustock.b-files found in system32

******************************* End of Logfile ********************************

It found and removed a rootkit.

Please download ComboFix to the desktop from this link:

http://download.bleepingcomputer.com/sUBs/ComboFix.exe

Please post a Hijack This log so that the files associated with the virus/spyware/hijacker can be identified.

Please download HJTsetup.exe from this link http://www.thespykiller.co.uk/files/HJTsetup.exe to your desktop.
Doubleclick on the HJTsetup.exe icon on your desktop.
By default it will install to C:\Program Files\Hijack This.
Continue to click "next" in the setup dialogue boxes until you get to the "Select Addition Tasks" dialogue.
Put a check by "Create a desktop icon" then click "Next" again.
Continue to follow the rest of the prompts from there.
At the final dialogue box click "Finish" and it will launch Hijack This.
Click on the "Do a system scan and save a logfile" button. It will scan and the log should open in notepad.
Click on "Edit > Select All" then click on "Edit > Copy" to copy the entire contents of the log and post it in this thread.

Do not fix anything yet unless you know what you are doing. This is a powerful tool that can crash the computer if used improperly.

Double-click combofix.exe
Follow the prompts.
(Don't click on the window while the program is running, it may cause your system to hang.)

Please post the log it produces.

Logfile of HijackThis v1.99.1
Scan saved at 1:42:20 AM, on 4/6/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\WINDOWS\system32\sesinetd.exe
C:\WINDOWS\system32\hserver.exe
C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton SystemWorks\Norton AntiVirus\IWP\NPFMntor.exe
C:\PROGRA~1\NORTON~1\NORTON~1\NPROTECT.EXE
C:\PROGRA~1\NORTON~1\NORTON~1\SPEEDD~1\NOPDB.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\hphmon03.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
C:\WINDOWS\system32\devldr32.exe
C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe
C:\Program Files\USB Disk Win98 Driver\Res.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\system32\CTHELPER.EXE
C:\PROGRA~1\MYSECR~1\MSFMON.exe
C:\PROGRA~1\HEWLET~1\HPSHAR~1\hpgs2wnf.exe
C:\WINDOWS\system32\HPHipm09.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\Program Files\Hijackthis\HijackThis.exe
C:\Program Files\Messenger\msmsgs.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.standardbredcanada.ca/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = c:\secure32.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = c:\secure32.html
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer =

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe
O4 - HKLM\..\Run: [HPHmon03] C:\WINDOWS\system32\hphmon03.exe
O4 - HKLM\..\Run: [OM_Monitor] C:\Program Files\OLYMPUS\OLYMPUS Master\FirstStart.exe
O4 - HKLM\..\Run: [H2O] C:\Program Files\SyncroSoft\Pos\H2O\cledx.exe
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe"
O4 - HKLM\..\Run: [USB Storage Toolbox] C:\Program Files\USB Disk Win98 Driver\Res.EXE
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [WINDVDPatch] CTHELPER.EXE
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [Jet Detection] "C:\Program Files\Creative\SBLive\PROGRAM\ADGJDet.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [MSF_Monitor] C:\PROGRA~1\MYSECR~1\MSFMON.exe /Start
O4 - HKLM\..\Run: [MediaFace Integration] C:\Program Files\Fellowes\MediaFACE 5.0\SetHook.exe
O4 - HKCU\..\Run: [OM_Monitor] C:\Program Files\OLYMPUS\OLYMPUS Master\Monitor.exe -NoStart
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: http://onecare.live.com
O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/su/ocx/1502...
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?lin...
O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} - http://www.symantec.com/techsupp/as...
O16 - DPF: {2E12FB00-546B-4EE3-9CC2-057BF02E1C17} (Webshots Multiple Media Uploader - Container) - http://community.webshots.com/html/...
O16 - DPF: {3451DEDE-631F-421C-8127-FD793AFC6CC8} - http://www.symantec.com/techsupp/as...
O16 - DPF: {44990200-3C9D-426D-81DF-AAB636FA4345} (Symantec SmartIssue) - http://www.symantec.com/techsupp/as...
O16 - DPF: {44990301-3C9D-426D-81DF-AAB636FA4345} (Symantec Script Runner Class) - http://www.symantec.com/techsupp/as...
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by109fd.bay109.hotmail.msn.c...
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls...
O16 - DPF: {670821E0-76D1-11D4-9F60-009027A966BF} (YouBet Secure Data Transfer Control) - http://racing.youbet.com/wr_6_1/con...
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microso...
O16 - DPF: {70BA88C8-DAE8-4CE9-92BB-979C4A75F53B} (GSDACtl Class) - http://launch.gamespyarcade.com/sof...
O16 - DPF: {9732FB42-C321-11D1-836F-00A0C993F125} (mhLabel Class) - http://pcpitstop.com/mhLbl.cab
O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} (Get_ActiveX Control) - https://h17000.www1.hp.com/ewfrf-JAVA/Secure/HPGetDownloadManager.ocx
O16 - DPF: {C9DB5AF8-4C14-4A3E-90F8-DB49D6B4866D} (YBUICtrl.FloatWnd.1) - http://racing.youbet.com/wr_6_1/con...
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/i...
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su/ocx/1502...
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AutoComplete Service (Autocomplete) - Acesoft - C:\Program Files\Acesoft\Tracks Eraser Pro\autocomp.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Houdini License Server (HoudiniLicenseServer) - Side Effects Software Inc. - C:\WINDOWS\system32\sesinetd.exe
O23 - Service: Houdini License Client (HoudiniServer) - Side Effects Software Inc. - C:\WINDOWS\system32\hserver.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~1\NPROTECT.EXE
O23 - Service: Pml Driver - HP - C:\WINDOWS\system32\HPHipm09.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~1\SPEEDD~1\NOPDB.EXE
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

Im not touching the Combofix until you tell me.

Please download ATF-Cleaner to your desktop from this link
http://www.atribune.org/content/view/19/2/ We will need it later in safe mode

Download and install AVG Anti-Spyware We will need this later in safe mode

Be sure to update AVG Anti- Spyware

Empty the restore folder. Go to start>control panel>system>system restore tab>check the box beside "turn off system restore>apply (takes a minute)>ok. Go back and uncheck the box to turn system restore back on>apply>ok.

Next, please reboot your computer in Safe Mode by doing the following :

Restart your computer

After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;

Instead of Windows loading as normal, a menu with options should appear;

Select the first option, to run Windows in Safe Mode, then press "Enter".

Choose your usual account.

Run Hijack This from safe mode, close all windows except Hijack This, place a check to the left of the following items and press "fix checked":

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = c:\secure32.html

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = c:\secure32.html

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

Exit Hijack This but remain in safe mode.

From safe mode navigate to and delete this file if found:

c:\secure32.html

Run ATF-Cleaner from safe mode.Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.

In Safe Mode, run AVG Anti-spyware and click on the Scanner tab at the top. Click the "Settings" tab and then change the recommended action to Quarantine and click Automatically generate report after every scan. Click back to the "Scan" tab and then click on Complete System Scan. This scan can take quite a while to run, so be prepared.

AVG Anti-Spyware will list any infections found on the left hand side. When the scan has finished, it will automatically set the recommended action. Click the Apply all actions button. AVG Anti-Spyware will display "All actions have been applied" on the right hand side.

Click on "Save Report", then "Save Report As". This will create a text file. Make sure you know where to find this file again (like on the Desktop).

Post the AVg Log and the combofix log please.

You need to update your java as soon as possible. Download the latest version of http://java.sun.com/javase/downloads/index.jsp

Scroll down to where it says "The J2SE Runtime Environment (JRE) allows end-users to run Java applications".

Click the "Download" button to the right.

Check the box that says: "Accept License Agreement". The page will refresh.

Click on the link to download Windows Offline Installation with or without Multi-language and save to your desktop.

Close any programs you may have running - especially your web browser.

Go to Start > Control Panel double-click on Add/Remove programs and remove all older versions of Java. Check any item with Java Runtime Environment (JRE or J2SE) in the name. It should have the "coffee cup" icon next to it.

Click the Remove or Change/Remove button. Repeat as many times as necessary to remove each Java versions.

Reboot your computer once all Java components are removed

. Then from your desktop double-click on jre-1_6_0-windowsi586-p.exe to install the newest version.

How is the computer operating.

Hi Jabuck,

The computer has been running great since i ran the rustbfix.exe file. I don't get that annoying 60 second reboot thing anymore. I've had issues in the past with AVG freezing my computer, so I did not install it. With regards to the cleanup, I have downloaded the atf cleaner and i have run that sucessfully.

Now I'm facing the fact that most of my programs are unable to load up because of missing .dll files, especially my xp search function which does not work. Should I continue with running anti-virus in safe mode, or should I go on to fixing my .dll issues. What would you recommend for my .dll issue?

Your help has been very much appreciated!

Could you post the combofix log please.

"karen" - 07-04-06 13:03:09 Service Pack 2
ComboFix 07-04-05 - Running from: "C:\Documents and Settings\karen\Desktop"

((((((((((((((((((((((((((((((( Files Created from 2007-03-06 to 2007-04-06 ))))))))))))))))))))))))))))))))))

2007-04-06 12:27 50,688 --a------ C:\DOCUME~1\ADMINI~1\ATF-Cleaner.exe
2007-04-06 12:27 400,996 --a------ C:\DOCUME~1\ADMINI~1\rustbfix.exe
2007-04-06 12:26 488,144 --a------ C:\DOCUME~1\ADMINI~1\HJTsetup.exe
2007-04-06 12:24 <DIR> d-------- C:\Program Files\Java
2007-04-06 12:24 <DIR> d-------- C:\Program Files\Common Files\Java
2007-04-06 01:56 68,888 --a------ C:\WINDOWS\system32\xinput1_3.dll
2007-04-06 01:56 62,744 --a------ C:\WINDOWS\system32\xinput1_2.dll
2007-04-06 01:56 3,426,072 --a------ C:\WINDOWS\system32\d3dx9_32.dll
2007-04-06 01:56 255,848 --a------ C:\WINDOWS\system32\xactengine2_6.dll
2007-04-06 01:56 251,672 --a------ C:\WINDOWS\system32\xactengine2_5.dll
2007-04-06 01:56 237,848 --a------ C:\WINDOWS\system32\xactengine2_4.dll
2007-04-06 01:56 236,824 --a------ C:\WINDOWS\system32\xactengine2_3.dll
2007-04-06 01:56 2,414,360 --a------ C:\WINDOWS\system32\d3dx9_31.dll
2007-04-06 01:56 15,128 --a------ C:\WINDOWS\system32\x3daudio1_1.dll
2007-04-06 01:55 <DIR> d-------- C:\dx
2007-04-06 00:50 <DIR> d-------- C:\avenger
2007-04-06 00:45 <DIR> d-------- C:\Rustbfix
2007-04-05 00:32 <DIR> d-------- C:\DOCUME~1\ADMINI~1\SDFix
2007-04-04 01:42 <DIR> d-------- C:\WINDOWS\McAfee.com
2007-04-04 00:45 <DIR> d-------- C:\Program Files\Microsoft XML Parser SDK
2007-04-03 14:55 5,954,520 --a------ C:\DOCUME~1\ALLUSE~1\Windows-KB890830-V1.27.exe
2007-04-03 14:55 5,954,520 --a------ C:\DOCUME~1\ADMINI~1\Windows-KB890830-V1.27.exe
2007-04-03 00:48 <DIR> d-------- C:\DOCUME~1\ADMINI~1\APPLIC~1\Share-to-Web Upload Folder
2007-04-03 00:33 <DIR> d-------- C:\d4a32ae2587817f8034d51c0ed
2007-04-02 19:53 <DIR> d---s---- C:\DOCUME~1\LOCALS~1\UserData
2007-03-30 20:16 <DIR> d-------- C:\DOCUME~1\karen\APPLIC~1\Opera
2007-03-29 02:09 <DIR> d-------- C:\DOCUME~1\karen\APPLIC~1\Media Player Classic
2007-03-28 18:41 517,848 --a------ C:\WINDOWS\system32\SymNeti.dll
2007-03-28 18:41 47,192 --a------ C:\WINDOWS\system32\drivers\symndis.sys
2007-03-28 18:41 37,016 --a------ C:\WINDOWS\system32\drivers\symids.sys
2007-03-28 18:41 266,552 --a------ C:\WINDOWS\system32\drivers\symtdi.sys
2007-03-28 18:41 18,904 --a------ C:\WINDOWS\system32\drivers\symredrv.sys
2007-03-28 18:41 171,928 --a------ C:\WINDOWS\system32\drivers\symfw.sys
2007-03-28 18:41 132,824 --a------ C:\WINDOWS\system32\SymRedir.dll
2007-03-28 18:41 11,480 --a------ C:\WINDOWS\system32\drivers\symdns.sys
2007-03-26 05:19 127,208 --a------ C:\WINDOWS\system32\mucltui.dll
2007-03-23 16:30 <DIR> d-------- C:\Program Files\ffdshow
2007-03-16 15:46 <DIR> d-a------ C:\DOCUME~1\ALLUSE~1\APPLIC~1\TEMP
2007-03-15 16:51 77,824 --a------ C:\WINDOWS\system32\mplaw7.dll
2007-03-15 16:51 77,824 --a------ C:\WINDOWS\system32\mplaa6.dll
2007-03-15 16:51 65,536 --a------ C:\WINDOWS\system32\mplapx.dll
2007-03-15 16:51 65,536 --a------ C:\WINDOWS\system32\mplam6.dll
2007-03-15 16:51 19,968 --a------ C:\WINDOWS\system32\cpuinf32.dll
2007-03-15 16:51 1,650,688 --a------ C:\WINDOWS\system32\mplva6.dll
2007-03-15 16:51 1,581,056 --a------ C:\WINDOWS\system32\mplvw7.dll
2007-03-15 16:51 1,552,384 --a------ C:\WINDOWS\system32\mplvm6.dll
2007-03-15 16:51 1,122,304 --a------ C:\WINDOWS\system32\mplvpx.dll
2007-03-15 16:46 94,208 --a------ C:\WINDOWS\system32\DLLCPY32.dll
2007-03-15 16:46 65,536 --a------ C:\WINDOWS\system32\DLLPTL32.dll
2007-03-15 16:46 61,440 --a------ C:\WINDOWS\system32\DLLCDF32.dll
2007-03-15 16:46 57,344 --a------ C:\WINDOWS\system32\DLLTPO32.dll
2007-03-15 16:46 53,248 --a------ C:\WINDOWS\system32\DLLPRJ32.dll
2007-03-15 16:46 49,152 --a------ C:\WINDOWS\system32\DLLPRF32.dll
2007-03-15 16:46 49,152 --a------ C:\WINDOWS\system32\DLLIO32.dll
2007-03-15 16:46 462,848 --a------ C:\WINDOWS\system32\DLLAV32.dll
2007-03-15 16:46 45,056 --a------ C:\WINDOWS\system32\DLLIMG32.dll
2007-03-15 16:46 430,080 --a------ C:\WINDOWS\system32\MXRestore.exe
2007-03-15 16:46 40,960 --a------ C:\WINDOWS\system32\DLLRD32.dll
2007-03-15 16:46 36,864 --a------ C:\WINDOWS\system32\DLLPNT32.dll
2007-03-15 16:46 32,768 --a------ C:\WINDOWS\system32\STRING32.dll
2007-03-15 16:46 32,768 --a------ C:\WINDOWS\system32\DLLMSC32.dll
2007-03-15 16:46 32,768 --a------ C:\WINDOWS\system32\DLLISO32.dll
2007-03-15 16:46 32,768 --a------ C:\WINDOWS\system32\DLLDIR32.dll
2007-03-15 16:46 24,576 --a------ C:\WINDOWS\system32\TTIC32.dll
2007-03-15 16:46 24,576 --a------ C:\WINDOWS\system32\TTI32.dll
2007-03-15 16:46 24,576 --a------ C:\WINDOWS\system32\DLLIX.dll
2007-03-15 16:46 188,416 --a------ C:\WINDOWS\system32\DLLRES32.dll
2007-03-15 16:46 163,840 --a------ C:\WINDOWS\system32\DLLDEV32.dll
2007-03-15 16:46 151,552 --a------ C:\WINDOWS\system32\DLLDRV32.dll
2007-03-15 16:46 114,688 --a------ C:\WINDOWS\system32\DLLCDA32.dll
2007-03-15 16:46 <DIR> d-------- C:\Program Files\Common Files\MAGIX Shared
2007-03-15 16:45 622,592 --a------ C:\WINDOWS\system32\mgxoschk.dll
2007-03-15 16:45 1,089,536 --a------ C:\WINDOWS\system32\ROBOEX32.DLL
2007-03-15 16:45 <DIR> d-------- C:\WINDOWS\system32\MAGIX
2007-03-13 13:09 <DIR> d-------- C:\WINDOWS\system32\oodag
2007-03-11 18:38 151,552 --------- C:\WINDOWS\system32\pxwma.dll
2007-03-11 18:38 109,568 --------- C:\WINDOWS\system32\pxinsi64.exe
2007-03-11 18:38 108,544 --------- C:\WINDOWS\system32\pxcpyi64.exe
2007-03-10 20:24 <DIR> d-------- C:\DOCUME~1\karen\APPLIC~1\LEAPS


(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-04-06 12:38 -------- d-------- C:\Program Files\msn messenger
2007-04-06 12:27 313 --a------ C:\WINDOWS\option.dat
2007-04-06 11:57 -------- d-------- C:\Program Files\Common Files\symantec shared
2007-04-05 14:52 96256 --a------ C:\WINDOWS\system32\drivers\sptd5661.sys
2007-04-04 00:58 -------- d-------- C:\Program Files\symantec
2007-04-04 00:42 -------- d--h----- C:\Program Files\windowsupdate
2007-04-02 23:40 -------- d-------- C:\Program Files\google videorip
2007-04-02 23:37 -------- d-------- C:\Program Files\norton systemworks
2007-03-29 11:22 -------- d-------- C:\Program Files\micro application
2007-03-28 14:53 -------- d--h----- C:\Program Files\installshield installation information
2007-03-28 14:50 -------- d-------- C:\Program Files\google
2007-03-28 14:49 -------- d-------- C:\Program Files\cyanide
2007-03-24 18:48 -------- d-------- C:\Program Files\gamespy arcade
2007-03-20 14:53 -------- d-------- C:\Program Files\waves
2007-03-20 14:47 -------- d-------- C:\Program Files\christv
2007-03-18 17:43 -------- d-------- C:\Program Files\google video
2007-03-16 21:38 -------- d-------- C:\DOCUME~1\karen\APPLIC~1\google
2007-03-16 15:49 5632 --ahs---- C:\Program Files\thumbs.db
2007-03-13 01:15 -------- d-------- C:\Program Files\pegasys inc
2007-03-13 01:14 -------- d-------- C:\Program Files\xp repair pro 2007
2007-03-11 18:38 -------- d-------- C:\DOCUME~1\karen\APPLIC~1\pegasys inc
2007-03-11 00:19 -------- d-------- C:\Program Files\limewire
2007-03-11 00:19 -------- d-------- C:\DOCUME~1\karen\APPLIC~1\limewire
2007-03-08 12:36 577536 --a------ C:\WINDOWS\system32\user32.dll
2007-03-08 12:36 40960 --a------ C:\WINDOWS\system32\mf3216.dll
2007-03-08 12:36 281600 --a------ C:\WINDOWS\system32\gdi32.dll
2007-03-08 10:47 1843584 --a------ C:\WINDOWS\system32\win32k.sys
2007-03-07 15:39 5 --a------ C:\WINDOWS\system32\sysmp3cutjoin.dat
2007-03-07 15:39 32 --a------ C:\WINDOWS\system32\msvcsv60.dll
2007-03-07 15:39 32 --a------ C:\WINDOWS\msocreg32.dat
2007-03-05 22:40 -------- d-------- C:\Program Files\clock tray skins
2007-03-04 17:28 -------- d-------- C:\DOCUME~1\karen\APPLIC~1\ahead
2007-03-04 17:12 -------- d-------- C:\Program Files\fairuse wizard 2
2007-03-04 12:30 11270 --ahs---- C:\WINDOWS\system32\kgygaavl.sys
2007-03-03 18:18 234050 --a------ C:\WINDOWS\uninstall.exe
2007-02-27 14:22 -------- d-------- C:\Program Files\mp3 player utilities v1.28
2007-02-22 15:41 -------- d-------- C:\Program Files\winamp
2007-02-22 03:19 -------- d-------- C:\Program Files\audiotoolsfactory
2007-02-17 03:05 -------- d-------- C:\Program Files\folder lock
2007-02-17 02:56 -------- d-------- C:\Program Files\mysecretfolder xp
2007-02-17 02:52 720 --a------ C:\sccfg.sys
2007-02-11 20:30 -------- d-------- C:\DOCUME~1\karen\APPLIC~1\masque
2007-02-11 19:46 -------- d-------- C:\Program Files\masque slots featuring wms gaming
2007-02-06 13:58 -------- d-------- C:\Program Files\wmv9_vcm
2007-02-05 16:15 156 --a------ C:\WINDOWS\system32\{11c98e1a-ec91-4b38-b44c-c562292d8453}-functioncontent.dat
2007-02-05 16:15 15236 --a------ C:\WINDOWS\system32\pre20_fcblueprint.dat
2007-02-02 19:34 520192 --------- C:\WINDOWS\system32\ati2sgag.exe
2007-02-02 17:17 307200 --a------ C:\WINDOWS\system32\atiiiexx.dll
2007-02-02 17:04 307200 --a------ C:\WINDOWS\system32\atidemgx.dll
2007-02-02 17:03 264704 --a------ C:\WINDOWS\system32\ati2dvag.dll
2007-02-02 16:57 118784 --a------ C:\WINDOWS\system32\atipdlxx.dll
2007-02-02 16:56 42496 --a------ C:\WINDOWS\system32\ati2edxx.dll
2007-02-02 16:56 26112 --a------ C:\WINDOWS\system32\ati2mdxx.exe
2007-02-02 16:56 110592 --a------ C:\WINDOWS\system32\oemdspif.dll
2007-02-02 16:56 110592 --a------ C:\WINDOWS\system32\ati2evxx.dll
2007-02-02 16:55 446464 --a------ C:\WINDOWS\system32\ati2evxx.exe
2007-02-02 16:54 53248 --a------ C:\WINDOWS\system32\atiddc.dll
2007-02-02 16:46 2827968 --a------ C:\WINDOWS\system32\ati3duag.dll
2007-02-02 16:40 3107788 --a------ C:\WINDOWS\system32\ativvaxx.dat
2007-02-02 16:40 1272960 --a------ C:\WINDOWS\system32\ativvaxx.dll
2007-02-02 16:27 241664 --a------ C:\WINDOWS\system32\atikvmag.dll
2007-02-02 16:25 17408 --a------ C:\WINDOWS\system32\atitvo32.dll
2007-02-02 16:20 348160 --a------ C:\WINDOWS\system32\ati2cqag.dll
2007-02-02 16:19 5312512 --a------ C:\WINDOWS\system32\atioglxx.dll
2007-01-31 13:56 92 --a------ C:\WINDOWS\vmreg32.dll
2007-01-30 13:21 128813 --a------ C:\WINDOWS\system32\atiicdxx.dat
2007-01-28 19:50 24 --a------ C:\WINDOWS\system32\dvcstatebkp-{00000000-00000000-00000009-00001102-00000002-80641102}.dat
2007-01-28 19:50 24 --a------ C:\WINDOWS\system32\dvcstate-{00000000-00000000-00000009-00001102-00000002-80641102}.dat
2007-01-28 13:26 3 --a------ C:\DOCUME~1\karen\APPLIC~1\gs2 preferences
2007-01-28 13:26 0 --a------ C:\DOCUME~1\karen\APPLIC~1\ags2license
2007-01-23 02:53 737280 --a------ C:\WINDOWS\iun6002.exe
2007-01-23 01:43 277504 --a------ C:\WINDOWS\system32\oestore.dll
2007-01-19 12:53 51056 --a------ C:\WINDOWS\system32\sirenacm.dll
2007-01-12 02:53 4212 ---h----- C:\WINDOWS\system32\zllictbl.dat


(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries & legit default entries are not shown

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"OM_Monitor"="C:\\Program Files\\OLYMPUS\\OLYMPUS Master\\Monitor.exe -NoStart"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"HPDJ Taskbar Utility"="C:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\hpztsb04.exe"
"HPHmon03"="C:\\WINDOWS\\system32\\hphmon03.exe"
"OM_Monitor"="C:\\Program Files\\OLYMPUS\\OLYMPUS Master\\FirstStart.exe"
"H2O"="C:\\Program Files\\SyncroSoft\\Pos\\H2O\\cledx.exe"
"Share-to-Web Namespace Daemon"="C:\\Program Files\\Hewlett-Packard\\HP Share-to-Web\\hpgs2wnd.exe"
"USB Storage Toolbox"="C:\\Program Files\\USB Disk Win98 Driver\\Res.EXE"
"ccApp"="\"C:\\Program Files\\Common Files\\Symantec Shared\\ccApp.exe\""
"Symantec NetDriver Monitor"="C:\\PROGRA~1\\SYMNET~1\\SNDMon.exe /Consumer"
"WINDVDPatch"="CTHELPER.EXE"
"UpdReg"="C:\\WINDOWS\\UpdReg.EXE"
"Jet Detection"="\"C:\\Program Files\\Creative\\SBLive\\PROGRAM\\ADGJDet.exe\""
"NeroFilterCheck"="C:\\Program Files\\Common Files\\Ahead\\Lib\\NeroCheck.exe"
"MSF_Monitor"="C:\\PROGRA~1\\MYSECR~1\\MSFMON.exe /Start"
"MediaFace Integration"="C:\\Program Files\\Fellowes\\MediaFACE 5.0\\SetHook.exe"
"SunJavaUpdateSched"="\"C:\\Program Files\\Java\\jre1.6.0_01\\bin\\jusched.exe\""

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL]
"Installed"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI]
"Installed"="1"
"NoChange"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS]
"Installed"="1"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll"

HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa
Authentication Packages REG_MULTI_SZ msv1_0\0\0
Security Packages REG_MULTI_SZ kerberos\0msv1_0\0schannel\0wdigest\0\0
Notification Packages REG_MULTI_SZ scecli\0\0

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost]
LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0
NetworkService REG_MULTI_SZ DnsCache\0\0
rpcss REG_MULTI_SZ RpcSs\0\0
imgsvc REG_MULTI_SZ StiSvc\0\0
termsvcs REG_MULTI_SZ TermService\0\0
HTTPFilter REG_MULTI_SZ HTTPFilter\0\0
DcomLaunch REG_MULTI_SZ DcomLaunch\0TermService\0\0

Contents of the 'Scheduled Tasks' folder
C:\WINDOWS\tasks\Norton AntiVirus - Scan my computer - karen.job
C:\WINDOWS\tasks\Norton SystemWorks One Button Checkup.job
C:\WINDOWS\tasks\Symantec Drmc.job

********************************************************************

catchme 0.2 W2K/XP/Vista - userland rootkit detector by Gmer, 17 October 2006
http://www.gmer.net

scanning hidden processes ...

scanning hidden services ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0

********************************************************************

Completion time: 07-04-06 13:06:53
C:\ComboFix-quarantined-files.txt ... 07-04-06 13:06

The AVG AntiSpyware tool is not an antivirus so it should not conflict with your.

Or you could run this tool.

Please download Dr Web CureIt to your desktop from this link ftp://ftp.drweb.com/pub/drweb/cureit/drweb-cureit.exe
Doubleclick the drweb-cureit.exe file and Allow to run the express scan.
This will scan the files currently running in memory and when something is found, click the yes button when it asks you if you want to cure it.
This is only a short scan.
Once the short scan has finished, mark the drives that you want to scan.
Select all drives.
A red dot shows which drives have been chosen.
Click the green arrow at the right, and the scan will start.
Click 'Yes to all' if it asks if you want to cure/move the file.
When the scan has finished, look if you can click next icon next to the files found:
If so, click it and then click the next icon right below and select Move incurable.
This will move it to the %userprofile%\DoctorWeb\quarantaine-folder if it can't be cured. (this in case if we need samples)
After selecting, in the Dr.Web CureIt menu on top, click file and choose save report list
Save the report to your desktop. The report will be called DrWeb.csv
Close Dr.Web Cureit.
Reboot your computer!! Because it could be possible that files in use will be moved/deleted during reboot.
After reboot, post the contents of the log on your desktop.

I was infected with this too jabuck! The rustbfix seems to have fixed it! I don't get the stupid 60 seconds countdown thing anymore! Thank you so much

Regards
Sam.

Hello Jabuck, I found this thread to be very helpful.
I have downloaded the rustbfix and run it...rebooted several times and the fix seems to work. However, I wanted to make sure there is no long standing damage files on my comp.
I have also downloaded HJTsetup and ComboFix but have run neither. I would greatly appreciate assistance with the programs before attempting to run them.

Here are the logs for the Rustbfix run:
PELOG
************************* Rustock.b-fix -- By ejvindh *************************
Mon 04/16/2007 12:28:43.96

******************* Pre-run Status of system *******************

Rootkit driver PE386 is found. Starting the unload-procedure....

Rustock.b-ADS attached to the System32-folder:
:lzx32.sys 73148
Total size: 73148 bytes.
Attempting to remove ADS...
system32: deleted 73148 bytes in 1 streams.

Looking for Rustock.b-files in the System32-folder:
No Rustock.b-files found in system32

******************* Post-run Status of system *******************

Rustock.b-driver on the system: NONE!

Rustock.b-ADS attached to the System32-folder:
No System32-ADS found.

Looking for Rustock.b-files in the System32-folder:
No Rustock.b-files found in system32

******************************* End of Logfile ********************************

AVENGER
Logfile of The Avenger version 1, by Swandog46
Running from registry key:
\Registry\Machine\System\CurrentControlSet\Services\wltccuxg

*******************

Script file located at: \??\C:\ujdnbqen.txt
Script file opened successfully.

Script file read successfully

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Driver PE386 unloaded successfully.
Program C:\Rustbfix\2run.bat successfully set up to run once on reboot.

Completed script processing.

*******************

Finished! Terminate.

I also have this virus, I turn my computer on and Windows tells me there has been a serious system error and wants to do an error report, and then it tells me I am infected with the virus, but after that my computer just restarts spontaneously with no warning and the same thing happens again if I log on. Please Help!

Got the same problems with Rustock... Ran rustbfix and following is the log. What does it mean by this, what next step should i take.My NetMeter shows Up greater than Down and fluctuates a lot after this virus infection. Kindly help me!

Logfile of The Avenger version 1, by Swandog46
Running from registry key:
\Registry\Machine\System\CurrentControlSet\Services\wmwvtnww

*******************

Script file located at: tcsnhwkr

Could not open script file! Error

Could not open script file! Status: 0xc000003b Abort!

Hi.. i need some help too withe the virus.. i have followed the above steps, and will post the log's so i would like you to guide me through the clean-up..

Logfile of HijackThis v1.99.1
Scan saved at 21:01:33, on 15-05-2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16441)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programmer\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\system32\cmd.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\Programmer\Fælles filer\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Rundll32.exe
C:\WINDOWS\System32\keyhook.exe
C:\Programmer\Synaptics\SynTP\SynTPLpr.exe
C:\Programmer\Synaptics\SynTP\SynTPEnh.exe
C:\Programmer\Java\jre1.6.0_01\bin\jusched.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\WINDOWS\system32\rundll32.exe
C:\Programmer\DAEMON Tools\daemon.exe
C:\WINDOWS\domino.exe
C:\WINDOWS\VMSnap1.exe
C:\Programmer\QuickTime\qttask.exe
C:\Programmer\Nokia\Nokia PC Suite 6\LaunchApplication.exe
C:\Programmer\Fælles filer\Real\Update_OB\realsched.exe
C:\Programmer\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmer\PC Connectivity Solution\ServiceLayer.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Programmer\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://thepiratebay.org/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?Lin...
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?Lin...
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?Lin...
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O2 - BHO: (no name) - {04F0B796-6E22-4624-A974-18F54AE51452} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmer\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Programmer\BitComet\tools\BitCometBHO.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programmer\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programmer\Fælles filer\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exe
O4 - HKLM\..\Run: [SiSPower] Rundll32.exe SiSPower.dll,ModeAgent
O4 - HKLM\..\Run: [SiS Windows KeyHook] C:\WINDOWS\System32\keyhook.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Programmer\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Programmer\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programmer\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Programmer\Fælles filer\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Programmer\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [domino] C:\WINDOWS\domino.exe
O4 - HKLM\..\Run: [VMSnap1] C:\WINDOWS\VMSnap1.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmer\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Programmer\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup
O4 - HKLM\..\Run: [TkBellExe] "C:\Programmer\Fælles filer\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Programmer\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Programmer\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Programmer\Fælles filer\Ahead\Lib\NMBgMonitor.exe"
O4 - Global Startup: Utility Tray.lnk = C:\WINDOWS\system32\sistray.exe
O8 - Extra context menu item: Download all links using BitComet - res://C:\Programmer\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: Download all videos using BitComet - res://C:\Programmer\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: Download link using &BitComet - res://C:\Programmer\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Opslag - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: bet365 Poker - {B1BA4A3F-1C95-497b-9F82-F8DA4A5C89DD} - C:\Programmer\bet365MPP\MPPoker.exe
O9 - Extra button: Ladbrokes Poker - {C2A80015-C447-4dc4-82DD-AED83D6ED57E} - C:\Programmer\ladbrokesMPP\MPPoker.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://a1540.g.akamai.net/7/1540/52...
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?lin...
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://rallu9.spaces.live.com//Phot...
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/re...
O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - http://a1540.g.akamai.net/7/1540/52...
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: rqropqo - rqropqo.dll (file missing)
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Programmer\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: NBService - Nero AG - C:\Programmer\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Programmer\Fælles filer\Ahead\Lib\NMIndexingService.exe
O23 - Service: ServiceLayer - Nokia. - C:\Programmer\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe

PLEASE HELP ME!!! my computer got trashed and I don't know how. I know I have the same virus as mentioned in this thread, but when i ran the rusbfix.exe program this is what i got:

Logfile of The Avenger version 1, by Swandog46
Running from registry key:
\Registry\Machine\System\CurrentControlSet\Services\oqxendoj

*******************

Script file located at: pspaacsc

Could not open script file! Error

Could not open script file! Status: 0xc000003b Abort!

I need some help, if anyone can tell me what to do. I use iolo system mechanic pro 7.0. Thank you so much