X.exe Virus (help)

hmm, i got problem deleting x.exe

it keeps on coming back and infecting my pc over and over

even reformat my pc it's still there i tried quick format and full format but it's still there..

anyone here would like to help me remove this thing?

bitdefender can delete it but. it keeps on going back...

and i'm tired looking pop up saying the virus has been deleted and after 1 min another pop up saying that another virus =.=

Thanks... !!@!@!@!

Find more posts tagged with

Comments

Cristi Raducu

Hello xtopher,

Please post a deep system scan log.

Thank you.

bladeako

do you mean bitdefender scan log?

bladeako

do you mean bitdefender scan log?

sorry i can't edit my post heres the log

ComboFix 10-03-29.04 - Christopher 03/31/2010 7:00.1.1 - x86

Running from: c:\documents and settings\Christopher\Desktop\ComboFix.exe

AV: AntiVir Desktop *On-access scanning disabled* (Outdated) {AD166499-45F9-482A-A743-FDD3350758C7}

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

c:\windows\system32\glow.dll

c:\windows\system32\iexplore.exe

c:\windows\system32\Thumbs.db

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

-------\Legacy_WINSPOOLSVC

-------\Service_WinSpoolSvc

((((((((((((((((((((((((( Files Created from 2010-02-28 to 2010-03-30 )))))))))))))))))))))))))))))))

2010-03-30 22:45 . 2010-03-30 22:45 126976 ----a-w- c:\windows\system32\xtqd.exe

2010-03-30 05:57 . 2010-03-30 06:00 -------- d-----w- c:\documents and settings\Christopher\Application Data\QuickScan

2010-03-30 05:56 . 2010-03-26 06:33 668648 ----a-w- c:\documents and settings\Christopher\Application Data\Mozilla\Firefox\Profiles\utvqjv29.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\components\qscanff.dll

2010-03-30 05:56 . 2010-03-26 06:33 830864 ----a-w- c:\documents and settings\Christopher\Application Data\Mozilla\Firefox\Profiles\utvqjv29.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\plugins\npqscan.dll

2010-03-30 04:47 . 2010-03-30 04:47 98304 ----a-w- c:\windows\system32\Vcorp.dll

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2010-03-29 13:56 . 2010-03-29 13:56 12328 ----a-w- c:\documents and settings\Christopher\Local Settings\Application Data\GDIPFONTCACHEV1.DAT

2010-03-29 13:04 . 2010-03-29 13:04 -------- d-----w- c:\documents and settings\Christopher\Application Data\Avira

2010-03-29 12:56 . 2010-03-29 12:56 -------- d-----w- c:\program files\Avira

2010-03-29 12:56 . 2010-03-29 12:56 -------- d-----w- c:\documents and settings\All Users\Application Data\Avira

2010-03-29 12:46 . 2010-03-29 12:44 -------- d-----w- c:\program files\SpeedBit Video Accelerator

2010-03-29 12:44 . 2010-03-29 12:40 -------- d-----w- c:\documents and settings\All Users\Application Data\SpeedBit

2010-03-29 12:42 . 2010-03-29 12:40 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP

2010-03-29 12:42 . 2010-03-29 12:40 -------- d-----w- c:\program files\DAP

2010-03-29 12:42 . 2010-03-29 12:42 3509272 ----a-w- c:\documents and settings\All Users\Application Data\SpeedBit\DAP\Offers\VA31_DapSo.exe

2010-03-29 12:40 . 2010-03-29 12:40 50688 ----a-w- c:\windows\system32\wbhelp2.dll

2010-03-29 12:35 . 2010-03-29 12:35 0 ----a-w- c:\windows\nsreg.dat

2010-03-29 12:30 . 2010-03-29 12:25 -------- d-----w- c:\program files\Common Files\InstallShield

2010-03-29 12:29 . 2010-03-29 12:29 -------- d--h--w- c:\program files\InstallShield Installation Information

2010-03-29 12:29 . 2010-03-29 12:29 -------- d-----w- c:\program files\ATI Technologies

2010-03-29 12:08 . 2010-03-29 11:39 86327 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat

2010-03-29 11:41 . 2010-03-29 11:41 -------- d-----w- c:\program files\microsoft frontpage

2010-03-29 11:36 . 2010-03-29 11:36 21640 ----a-w- c:\windows\system32\emptyregdb.dat

2010-03-01 01:05 . 2010-03-29 12:56 124784 ----a-w- c:\windows\system32\drivers\avipbb.sys

2010-02-16 05:24 . 2010-03-29 12:56 60936 ----a-w- c:\windows\system32\drivers\avgntflt.sys

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{FF6C3CF0-4B15-11D1-ABED-709549C10000}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"DownloadAccelerator"="c:\program files\DAP\DAP.EXE" [2009-06-18 921600]

"SpeedBitVideoAccelerator"="c:\program files\SpeedBit Video Accelerator\VideoAccelerator.exe" [2010-03-29 1607272]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2010-03-02 282792]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"1747:TCP"= 1747:TCP:ojcrubvt

R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [3/29/2010 8:57 PM 135336]

R2 VideoAcceleratorService;VideoAcceleratorService;c:\progra~1\SPEEDB~1\VideoAcceleratorService.exe -start -scm --> c:\progra~1\SPEEDB~1\VideoAcceleratorService.exe -start -scm [?]

S2 fouqhc;Support Helper;c:\windows\system32\svchost.exe -k netsvcs [8/4/2004 8:00 PM 14336]

S3 LLRING0;LLRING0;c:\documents and settings\Christopher\Desktop\unitedmu\MuGuard\llck1.sys [3/30/2010 12:49 PM 2688]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs

fouqhc

------- Supplementary Scan -------

IE: &Clean Traces - c:\program files\DAP\Privacy Package\dapcleanerie.htm

IE: &Download with &DAP - c:\program files\DAP\dapextie.htm

IE: Download &all with DAP - c:\program files\DAP\dapextie2.htm

LSP: c:\progra~1\SPEEDB~1\sblsp.dll

FF - ProfilePath - c:\documents and settings\Christopher\Application Data\Mozilla\Firefox\Profiles\utvqjv29.default\

FF - component: c:\documents and settings\Christopher\Application Data\Mozilla\Firefox\Profiles\utvqjv29.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\components\qscanff.dll

FF - component: c:\program files\DAP\DAPFireFox\components\DAPFireFox.dll

FF - plugin: c:\documents and settings\Christopher\Application Data\Mozilla\Firefox\Profiles\utvqjv29.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\plugins\npqscan.dll

---- FIREFOX POLICIES ----

c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug", false);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false);

c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pr

ef", true);

c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");

c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);

c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);

c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);

c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");

c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);

- - - - ORPHANS REMOVED - - - -

MSConfigStartUp-Microsoft Internet Explorer - c:\windows\system32\iexplore.exe

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2010-03-31 07:07

Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\fouqhc]

"ServiceDll"="c:\windows\system32\htguhix.dll"

--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(728)

c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'lsass.exe'(784)

c:\progra~1\SPEEDB~1\sblsp.dll

c:\program files\SpeedBit Video Accelerator\ConfigDB.dll

c:\program files\SpeedBit Video Accelerator\Accelerator.dll

c:\program files\SpeedBit Video Accelerator\Collector.dll

------------------------ Other Running Processes ------------------------

c:\windows\system32\Ati2evxx.exe

c:\program files\Avira\AntiVir Desktop\avguard.exe

c:\progra~1\SPEEDB~1\VideoAcceleratorService.exe

c:\progra~1\SPEEDB~1\VideoAcceleratorEngine.exe

c:\program files\Avira\AntiVir Desktop\avshadow.exe

c:\windows\system32\wscntfy.exe

**************************************************************************

Completion time: 2010-03-31 07:10:20 - machine was rebooted

ComboFix-quarantined-files.txt 2010-03-30 23:10

Pre-Run: 55,572,799,488 bytes free

Post-Run: 55,690,739,712 bytes free

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe

[boot loader]

timeout=2

default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS

[operating systems]

c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

- - End Of File - - 663DF4D2E88749FF080D1946A4C17EA2

i use combofix cuz i saw some topic here using it..

anyways

and i tried to reinstall bitdef but i have to download again XD cuz after the installation it ask to reboot then after that bitdef didn't start-up

Cristi Raducu

The log doesn't show that you're running BitDefender but an antivirus from a different vendor.

If you uninstall that antivirus you will be able to run BitDefender.

Please send me by PM (private message) the following file:

c:\windows\system32\htguhix.dll

bladeako

Ok i have bitdefender installed in my pc..

i'm scanning (deep scan)

and this 1 c:\windows\system32\htguhix.dll

does not show up in the folder =S

cuz it keeps on coming back ..

bladeako

and heres the log for bitdefender...

BitDefender Log File

Product: BitDefender Antivirus 2010

Version: BitDefender Antivirus Scanner

Scanning task: Deep System Scan

Log date: 4/1/2010 6:26:27 AM

Log path: C:\Documents and Settings\All Users\Application Data\BitDefender\Desktop\Profiles\Logs\deep_scan\1270074387_1_02.xml

Scan paths:

Path 0000: C:\

Scan Level:

Scan for viruses: Yes

Scan for adware: Yes

Scan for spyware: Yes

Scan for applications: Yes

Scan for dialers: Yes

Scan for rootkits: Yes

Scan for keyloggers: Yes

Virus Scanning Options:

Scan registry keys: Yes

Scan cookies: Yes

Scan boot sectors: Yes

Scan memory processes: Yes

Scan archives: Yes

Scan runtime packers: Yes

Scan e-mails: Yes

Scan all files: Yes

Heuristic Scan: Yes

Scanned extensions: not configured

Excluded extensions: not configured

Target Processing:

Default first action for infected objects: Disinfect

Default second action for infected objects: None

Default first action for suspect objects : None

Default second action for suspicious objects: None

Default action for hidden objects: None

Default first action for encrypted infected objects: Disinfect

Default second action for encrypted infected objects: None

Default first action for encrypted suspicious objects: None

Default second action for encrypted suspicious objects: None

Default action for password-protected objects: Log only

Scan Engines Summary

Virus signatures: 5555450

Archive plugins: 44

E-mail plugins: 6

Scan plugins: 13

System plugins: 5

Unpack plugins: 8

Basic

Scanned items: 211380

Infected items: 11

Suspect items: 0 (no suspected items have been detected)

Hidden items: 0 (no hidden items have been detected during this scan)

Resolved items: 10

Unresolved items: 1

Advanced

Scan time: 01:25:06

Files per second: 41

Skipped items: 777

Password-protected items: 0

Over-compressed items: 0

Individual viruses found: 2

Scanned folders: 1974

Scanned boot sectors: 2

Scanned archives: 820

Input-output errors: 37

Scanned processes: 73

Infected processes: 0

Scanned registry keys: 631

Infected registry keys: 3

Scanned cookies: 20

Infected cookies: 0

Remaining issues:Object Path Threat Name Final Status

C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\WXQR4DMN\x[1] Trojan.Peed.Gen Disinfect failed (object was not found)

Resolved issues:Object Path Threat Name Final Status

<System>=>HKEY_LOCAL_MACHINE\SYSTEM\CONTROLSET001\SERVICES\FOUQHC\PARAMETERS\ServiceDll=>C:\WINDOWS\SYSTEM32\HTGUHIX.DLL Win32.Worm.Downadup.Gen Deleted

<System>=>HKEY_LOCAL_MACHINE\SYSTEM\CONTROLSET001\SERVICES\MNOFBK\PARAMETERS\ServiceDll=>C:\WINDOWS\SYSTEM32\HTGUHIX.DLL Win32.Worm.Downadup.Gen Deleted

<System>=>HKEY_LOCAL_MACHINE\SYSTEM\CURRENTCONTROLSET\SERVICES\MNOFBK\PARAMETERS\ServiceDll=>C:\WINDOWS\SYSTEM32\HTGUHIX.DLL Win32.Worm.Downadup.Gen Deleted

C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\0TQBKHAF\vxoyvk[1].gif Win32.Worm.Downadup.Gen Deleted

C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\KHANKDQN\evhayqk[1].png Win32.Worm.Downadup.Gen Deleted

C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\KHANKDQN\ijqrs[1].bmp Win32.Worm.Downadup.Gen Deleted

C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\KHANKDQN\jxlzslt[1].bmp Win32.Worm.Downadup.Gen Deleted

C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\WXQR4DMN\avtgk[1].png Win32.Worm.Downadup.Gen Deleted

C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\WXQR4DMN\zxkevlgg[1].png Win32.Worm.Downadup.Gen Deleted

C:\System Volume Information\_restore{C2019D48-D882-4089-B779-8A16DE651D00}\RP2\A0000010.dll Win32.Worm.Downadup.Gen Deleted

theres still 1 virus that didn't deleted yet..

C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\WXQR4DMN\x[1]

Cristi Raducu

To get rid of the remaining item you need to clear your browser cache in Internet Explorer.

Afterward go to this link:

http://www.bitdefender.com/VIRUS-1000462-e...wnadup.Gen.html

If you scroll down on that page you will have to follow the removal instructions one by one to prevent reinfection.

bladeako

To get rid of the remaining item you need to clear your browser cache in Internet Explorer.

Afterward go to this link:

http://www.bitdefender.com/VIRUS-1000462-e...wnadup.Gen.html

If you scroll down on that page you will have to follow the removal instructions one by one to prevent reinfection.

i reformat my pc.. and i scanned my pc there was 4 virus humm ill try to observe if there is still virus..

if yes ill do this remove thing

thanks for helping!!@!

Bitdefender <3333333