Need help with a trojan (malware)

Havent gotten any virus's in quite sometime but the other night I went to my favorite photographers forum I have gone to for the past 5 years and got nailed. I am running Macafee Corporate Edition antivirus/interent security which quarantined the file(s) Heres the Hijackthis log and Macafee log


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:19:18 PM, on 8/6/2008
Platform: Windows 2003 SP2 (WinNT 5.02.3790)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\Bonjour\mDNSResponder.exe
C:\Program Files (x86)\Network Associates\Common Framework\FrameworkService.exe
C:\Program Files (x86)\Network Associates\VirusScan\Mcshield.exe
C:\Program Files (x86)\Network Associates\VirusScan\VsTskMgr.exe
C:\WINDOWS\SysWOW64\PnkBstrA.exe
C:\WINDOWS\syswow64\RunDll32.exe
C:\Program Files (x86)\Microsoft ActiveSync\Wcescomm.exe
C:\Program Files (x86)\Common Files\Real\Update_OB\realsched.exe
C:\PROGRA~2\MICROS~3\rapimgr.exe
C:\Program Files (x86)\Network Associates\VirusScan\SHSTAT.EXE
C:\Program Files (x86)\Network Associates\Common Framework\UpdaterUI.exe
C:\Program Files (x86)\Common Files\Network Associates\TalkBack\TBMon.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Program Files (x86)\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.transamcuda.com/cgi-bin/yabb2/YaBB.pl
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files (x86)\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files (x86)\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files (x86)\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files (x86)\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [Network Associates Error Reporting Service] "C:\Program Files (x86)\Common Files\Network Associates\TalkBack\TBMon.exe"
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files (x86)\Adobe\Adobe Photoshop Lightroom 1.4\apdproxy.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files (x86)\Microsoft ActiveSync\Wcescomm.exe"
O4 - HKUS\S-1-5-18\..\Run: [MySpaceIM] C:\Program Files (x86)\MySpace\IM\MySpaceIM.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [MySpaceIM] C:\Program Files (x86)\MySpace\IM\MySpaceIM.exe (User 'Default user')
O4 - Startup: Nikon Monitor.lnk = C:\Program Files (x86)\Common Files\Nikon\Monitor\NkMonitor.exe
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~2\MICROS~3\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~2\MICROS~3\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~2\MICROS~3\INetRepl.dll
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB
O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1006.cab
O16 - DPF: {5C6698D9-7BE4-4122-8EC5-291D84DBD4A0} (Facebook Photo Uploader 4 Control) - http://upload.facebook.com/controls/FacebookPhotoUploader3.cab
O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownload/srl/2.0.0.1/sysreqlab2.cab
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files (x86)\Bonjour\mDNSResponder.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - Unknown owner - C:\WINDOWS\System32\dmadmin.exe (file missing)
O23 - Service: Event Log (Eventlog) - Unknown owner - C:\WINDOWS\system32\services.exe (file missing)
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: HTTP SSL (HTTPFilter) - Unknown owner - C:\WINDOWS\System32\lsass.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: IMAPI CD-Burning COM Service (ImapiService) - Unknown owner - C:\WINDOWS\system32\imapi.exe (file missing)
O23 - Service: McAfee Framework Service (McAfeeFramework) - Network Associates, Inc. - C:\Program Files (x86)\Network Associates\Common Framework\FrameworkService.exe
O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files (x86)\Network Associates\VirusScan\Mcshield.exe
O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files (x86)\Network Associates\VirusScan\VsTskMgr.exe
O23 - Service: Distributed Transaction Coordinator (MSDTC) - Unknown owner - C:\WINDOWS\system32\msdtc.exe (file missing)
O23 - Service: Net Logon (Netlogon) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: NT LM Security Support Provider (NtLmSsp) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - Unknown owner - C:\WINDOWS\system32\nvsvc64.exe (file missing)
O23 - Service: Plug and Play (PlugPlay) - Unknown owner - C:\WINDOWS\system32\services.exe (file missing)
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: IPSEC Services (PolicyAgent) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: Protected Storage (ProtectedStorage) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: Remote Desktop Help Session Manager (RDSessMgr) - Unknown owner - C:\WINDOWS\system32\sessmgr.exe (file missing)
O23 - Service: Security Accounts Manager (SamSs) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: Virtual Disk Service (vds) - Unknown owner - C:\WINDOWS\System32\vds.exe (file missing)
O23 - Service: Volume Shadow Copy (VSS) - Unknown owner - C:\WINDOWS\System32\vssvc.exe (file missing)
O23 - Service: WMI Performance Adapter (WmiApSrv) - Unknown owner - C:\WINDOWS\system32\wbem\wmiapsrv.exe (file missing)

and Macafee log

C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\NXA0275O\yahoo[1].htm => yahoo[1].htm.Vir
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\NXA0275O\rondll32[1].exe => rondll32[1].exe.Vir
C:\RECYCLER\S-1-5-21-2983074254-2833881202-2080314277-500\Dc54.Vir => Dc54.Vir.Vir
C:\RECYCLER\S-1-5-21-2983074254-2833881202-2080314277-500\Dc55.Vir => Dc55.Vir.Vir
C:\RECYCLER\S-1-5-21-2983074254-2833881202-2080314277-500\Dc56.Vir => Dc56.Vir.Vir
C:\RECYCLER\S-1-5-21-2983074254-2833881202-2080314277-500\Dc57.Vir => Dc57.Vir.Vir
C:\RECYCLER\S-1-5-21-2983074254-2833881202-2080314277-500\Dc58.Vir => Dc58.Vir.Vir
C:\RECYCLER\S-1-5-21-2983074254-2833881202-2080314277-500\Dc59.Vir => Dc59.Vir.Vir

The multiple Dc names is from me trying to remove/delete them. It just renamed it. I have run ccleaner and hijackthis but they are still there. I Googled the file names but couldnt find a removal tool for them. Am I going to have to remoce them manually??? Any help would be appreciated. Thanx

 

I have also installed and run Spybot Search and Destroy which picked up a few things. But Id like to know if my logs show anything else I should remove. Thanx

 

Well I thought I installed HJT right and I dont know why it says im running WIN2003 because Im running an XP Pro 64 bit system. I will install and run what is suggested and post logs. Thanx

 

Ok I downloaded and ran all but 2. I cannot run MGtools because I am running a 64bit system. as for combofix I do not feel comfortable enough to install and run the program as instructed as I dont feel good about using recovery console. But here are the logs from the scans I was able to run.

SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 08/10/2008 at 08:47 PM

Application Version : 4.15.1000

Core Rules Database Version : 3532
Trace Rules Database Version: 1521

Scan type : Complete Scan
Total Scan Time : 00:54:49

Memory items scanned : 163
Memory threats detected : 0
Registry items scanned : 4447
Registry threats detected : 0
File items scanned : 43887
File threats detected : 1

Trojan.Media-Codec/RichVideo
C:\PROGRAM FILES (X86)\TREND MICRO\HIJACKTHIS\BACKUPS\BACKUP-20080726-202845-826.DLL




Malwarebytes' Anti-Malware 1.24
Database version: 1038
Windows 5.2.3790 Service Pack 2

9:20:32 PM 8/10/2008
mbam-log-8-10-2008 (21-20-32).txt

Scan type: Quick Scan
Objects scanned: 79711
Time elapsed: 2 minute(s), 49 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 5
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CLASSES_ROOT\AppID\{f4406238-983a-4845-9053-f1d0007fd135} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{48e92754-2daf-4de4-8385-34f631580e9b} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{a1c23ba2-8f20-4c01-b663-7ff2b3421194} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{84562fca-ee8b-4585-a1d1-eae97b23370e} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\AppID\CodecBHO.DLL (Trojan.FakeAlert) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)



If not running the other 2 programs will keep me from fixing the issue then im stuck. I cant run MGTools due to my operating system. But if it is REALLY necassary to run Combofix then I will have a friend come over and help me walk through the installation. Thanx again.

 

None at the moment other than my windows security keeps telling me I dont have anti virus protection but I am running Macafee Corporate Edition. I cant remember if I disabled that part of my windows antivirus so it wouldnt prompt me. its been a while and I havent had any issues at all since putting this machine together almost a year ago. I have been lucky I guess. Macafee has stopped and deleted 3 problems for me. kinda weird how this one got through. With what I have posted so far is there anything I should get rid of that I havent already?? Thanx for all the help.