New Malware? No Google Hits on .DLL Searches

Windows XP Media Center SP2 32-bit
Toshiba Satellite A105 S4084
Intel Pentium M T2050 1.6 GHz Dual Core
1GB PC4300 DDR-SDRAM

This problem was the result of a keygen which I was checking for malicious code for a friend. I made the mistake of running the .exe outside of sandbox and hell followed with. I have posted on two other help forums on this issue. The timeline went something like this (quoted from hxxp://www.techsupportforum.com/security-center/virus-trojan-spyware-help/352582-possible-new-malware-no-google-hits-dll-names.html#post2007031):

Spybot goes berserk, initially telling me about a registry change from something named cbXOEuvv. a google search came up with nothing on this. a browser help object got blocked too and spybot told me the registry location. peer guardian immediately starts getting udp hits in the 192.168.0.8.1000 (one or two 4257) range from something calling itself "Malware Exploits." I logged out and logged back in twice to see if it would go away (how silly of me). new .dll's start loading and Prevx AUTHENTICATES them ALL like the worthless heuristics program it is. i caught the names in screenshots:

USSGSF.dll
KWNPISNE.dll

I check in Prevx's Program Activity logs and find C:\WINDOWS\TEMP\TEMPO-866628296.TMP and RECYCLER\S-9-0-68-100031515-100024676-100031693-3668.com have also been given the green light to do whatever they please. By now the SpyBot declination windows are filling up half the screen as the registry changes I've autodenied get re-attempted over and over. I manage a quick click on the SpyBot icon in the taskbar and get a look at the Blocked Registry Changes tab where at least four offenders are listed:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cbXOEuvv=

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Brows er Helper Objects\(52AC0AAC-2C77-4CEA-B436-BD03E601808F)=

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\1042d1f6=r undll32.exe "C:\WINDOWS\ystem32\kwnpisne.dll",b

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Brows er Helper Object\(1bff3995-32d8-4dd6-a9ed-b74ef636d2ae)=

I soft rebooted once, hard booted twice, no changes. I got HijackThis to run, and while Prevx masturbated with its authentication garbage for a minute, all the SpyBot declination windows stopped, only to start again after hijackthis loaded. a scan showed at least two questionable entries, each corresponding to entries on spybot's Blocked Registry Changes tab. I can't upload a HijackThis log here because the comp has stopped recognizing flash drives, and won't even allow direct access to c:/ (right-click, explore still works). an error comes up saying:

" Windows cannot find 'RECYCLER\S-9-0-68-100031515-100024676-100031693-3668.com'. Make sure you typed the name correctly, and then try again. To search for a file, click the Start button, and then click Search. "

All browsing has been blocked. Torrents still work fine. I'm beginning to worry about the integrity of the HD data. I've already unplugged the externals, but whether or not they are affected I can only wonder.

--------------------------------------------------------------------------

Since posting this a day or so ago I have gone through MajorGeeks.com's step by step malware removal, which seems to have eliminated the problem, mostly thanks to ComboFix. I'm posting here so that a qualified individual can take a look at the log files and ensure that everything's been cleared up. Here's a summary of my actions so far since infection:

CCleaner installed and run.
MSConfig returned to normal mode.
StartupCPL installed and configured.
Java uninstalled and updated.
Hidden and system files viewable.
SUPERAntiSpyware installed, scan completed and logged.
SpyBot S&D installed, scan completed and logged.
Malwarebytes Anti-Malware installed, scan completed and logged.
ComboFix scan completed and logged.
MGTools scan completed, logged and zipped.

There is a hidden folder on each of my three drives (2 ext 1 int) called RECYCLER with anywhere from 1-6 files inside bearing the numbering and naming pattern of the process which Prevx allowed back when the offending .exe was first run. The files each have the icon of the recycle bin. I have never seen these before and usually have hidden and system files and folders visible all the time by default. This is my only remaining concern. Otherwise, all malfunctions seem to have been completely resolved.

Any and all help is greatly appreciated.

-Danny

 

SUPERAntiSpyware Log

SUPERAntiSpyware Scan Log - 03-05-2009 - 17-34-03.txt

 

Hello chaslang,

Yes, everything is working much better now. I am informing the other help sites that I'm being assisted by you and will only pursue one forum in the future.

Might I ask what your day job is? And how you came to be well versed in all things computers? This is an impressive site. I've downloaded several utilities since first arriving, all of which have been welcome additions to my system, be they cosmetic or utilitarian. If I could flip a switch, I would love to be the computer genius my parents thought I was going to be. But alas, now that I have not gone that route (though I'd have liked to), teaching myself via textbooks or internet guides is just not the teaching style for me. In-person, mentorship-like learning is much easier. Maybe you know of some meet ups, conferences or events where I could get my feet wet...

The requested logs are attached. Thank you kindly for your help and patience.