Another Winbluesoft victim

View previous topic View next topic Go down

Another Winbluesoft victim

Post by Mr Blint on Wed Jun 03, 2009 7:13 pm

Hi - I too am a victim of this miserable Winbluesoft thing. Initially I had the same problems as others in that it did not allow me to run anything to eliminate the virus, but reading posts I was able to knock out the Blocker.DLL . I subsequently ran MAlwarebytes anti malware and superantispyware. My PC is now nearly normal. However, the stupid splash screen is still stuck on my desktop and I figure ther might be a few things the antispyware could noit fix. Here is my HJ log
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:52:08, on 6/3/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\ibmpmsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\ThinkPad\Bluetooth Software\bin\btwdins.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Symantec Client Security\Symantec Client Firewall\ISSVC.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\Drivers\trcboot.exe
C:\Program Files\IBM\Personal Communications\PCS_AGNT.EXE
C:\Program Files\ThinkPad\ConnectUtilities\AcPrfMgrSvc.exe
C:\WINDOWS\system32\cisvc.exe
C:\Program Files\IBM\tivoli\dcd\client\ISSI\cds\CDSWinSrv.exe
C:\Program Files\Symantec Client Security\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Executive Software\DiskeeperWorkstation\DKService.exe
C:\Program Files\C4ebreg\c4ebreg.exe
c:\sdwork\issimsvc.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\notes\ntmulti.exe
C:\PROGRA~1\AT&TNE~1\NetCfgSv.EXE
C:\WINDOWS\system32\cmd.exe
c:\Program Files\Symantec Client Security\Symantec AntiVirus\SavRoam.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Symantec Client Security\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\Symantec Client Security\Symantec Client Firewall\SymSPort.exe
C:\WINDOWS\System32\TPHDEXLG.EXE
C:\WINDOWS\system32\TpKmpSVC.exe
C:\WINDOWS\system32\Drivers\ldlcserv.exe
C:\Program Files\ThinkPad\ConnectUtilities\AcSvc.exe
C:\Program Files\IBM\tivoli\dcd\client\ISSI\_jvm\jre\bin\java.exe
C:\WINDOWS\system32\acs.exe
C:\Program Files\ThinkPad\ConnectUtilities\SvcGuiHlpr.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\SYMANT~2\SYMANT~2\VPTray.exe
C:\WINDOWS\system32\TpShocks.exe
C:\PROGRA~1\Lenovo\PkgMgr\HOTKEY\TPHKMGR.exe
C:\Program Files\IBM\Personal Communications\tpam.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Lenovo\PkgMgr\HOTKEY\TPONSCR.exe
C:\Program Files\Lenovo\PkgMgr\HOTKEY_1\TpScrex.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\ThinkPad\UltraNav Wizard\UNavTray.EXE
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\IBM\My Help\plugins\com.ibm.myhelp.common_1.4.19\pmonmh.exe
C:\Program Files\Lexmark X6100 Series\lxbfbmgr.exe
C:\Program Files\Lexmark X6100 Series\lxbfbmon.exe
C:\Program Files\C4ebreg\isamtray.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\ThinkPad\ConnectUtilities\ACWLIcon.exe
C:\Program Files\ThinkPad\ConnectUtilities\ACTray.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe
C:\Program Files\IBM\Infoprint Select\ipnotify.exe
C:\PROGRA~1\ThinkPad\BLUETO~1\BTSTAC~1.EXE
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\WINDOWS\system32\cidaemon.exe
C:\WINDOWS\system32\cidaemon.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Program Files\IBM\My Help\MyHelp.exe
C:\Program Files\IBM\My Help\jre\bin\myhelpw.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = [You must be registered and logged in to see this link.]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = [You must be registered and logged in to see this link.]
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = [You must be registered and logged in to see this link.]
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy.att.com:8000
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *ibm.com;
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll
O2 - BHO: MSN Toolbar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\MSN\Toolbar\3.0.1125.0\msneshellx.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: MSN Toolbar - {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - C:\Program Files\MSN\Toolbar\3.0.1125.0\msneshellx.dll
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~2\SYMANT~2\VPTray.exe
O4 - HKLM\..\Run: [TpShocks] TpShocks.exe
O4 - HKLM\..\Run: [TPKMAPHELPER] C:\Program Files\ThinkPad\Utilities\TpKmapAp.exe -helper
O4 - HKLM\..\Run: [TPHOTKEY] C:\PROGRA~1\Lenovo\PkgMgr\HOTKEY\TPHKMGR.exe
O4 - HKLM\..\Run: [Tpam.exe] "C:\Program Files\IBM\Personal Communications\tpam.exe"
O4 - HKLM\..\Run: [TP4EX] tp4ex.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [stgclean] c:\sdwork\w32main2.exe /cleanup
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [PWRMGRTR] rundll32 C:\PROGRA~1\ThinkPad\UTILIT~1\PWRMGRTR.DLL,PwrMgrBkGndMonitor
O4 - HKLM\..\Run: [PSQLLauncher] "C:\Program Files\Thinkvantage Fingerprint Software\launcher.exe" /startup
O4 - HKLM\..\Run: [pmonmh] C:\Program Files\IBM\My Help\plugins\\com.ibm.myhelp.common_1.4.19/pmonmh.exe
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [MyHelpService] C:\Program Files\IBM\My Help\workspace\service\delayStart.exe
O4 - HKLM\..\Run: [Microsoft Default Manager] "C:\Program Files\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" -resume
O4 - HKLM\..\Run: [Lexmark X6100 Series] "C:\Program Files\Lexmark X6100 Series\lxbfbmgr.exe"
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [ISSI Service] "c:\sdwork\issimsvc.exe"
O4 - HKLM\..\Run: [ISAMTray] "C:\Program Files\C4ebreg\isamtray.exe"
O4 - HKLM\..\Run: [ISAM SMT Service] "C:\Program Files\C4ebreg\isamsmt.exe"
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [C4EBReg] "C:\Program Files\C4ebreg\c4ebreg.exe" /q
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [BLOG] rundll32 C:\PROGRA~1\ThinkPad\UTILIT~1\BatLogEx.DLL,StartBattLog
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [ACWLIcon] C:\Program Files\ThinkPad\ConnectUtilities\ACWLIcon.exe
O4 - HKLM\..\Run: [ACTray] C:\Program Files\ThinkPad\ConnectUtilities\ACTray.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - Global Startup: Bluetooth.lnk = ?
O4 - Global Startup: Infoprint Select Notification.lnk = C:\Program Files\IBM\Infoprint Select\ipnotify.exe
O4 - Global Startup: Lotus QuickStart.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - [You must be registered and logged in to see this link.]
O8 - Extra context menu item: Send to &Bluetooth Device... - C:\Program Files\ThinkPad\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\ThinkPad\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\ThinkPad\Bluetooth Software\btsendto_ie.htm

Mr Blint
Novice
Novice

Posts Posts : 11
Joined Joined : 2009-06-03
OS OS : Win XP sp2
Points Points : 27423
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Another Winbluesoft victim

Post by Mr Blint on Wed Jun 03, 2009 7:14 pm

PART 2
O11 - Options group: [JAVA_IBM] Java (IBM)
O14 - IERESET.INF: START_PAGE_URL=http://w3.ibm.com
O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} (Office Genuine Advantage Validation Tool) - [You must be registered and logged in to see this link.]
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - [You must be registered and logged in to see this link.]
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - [You must be registered and logged in to see this link.]
O16 - DPF: {74FFE28D-2378-11D5-990C-006094235084} (IBM Access Support) - [You must be registered and logged in to see this link.]
O16 - DPF: {76E5AF9D-2B3E-4FEB-A31F-A9E63A27FA29} (IASRunner Class) - [You must be registered and logged in to see this link.]
O16 - DPF: {9519B2A2-6592-4E41-8290-D0298459270C} (LNWebAssist Class) - [You must be registered and logged in to see this link.]
O16 - DPF: {A4B28810-11A2-4956-82D1-B2DCBA4B2AFD} (gpwsx.plugin) - [You must be registered and logged in to see this link.]
O16 - DPF: {CAD4ADEB-C52B-4E83-A7D1-9C75E022ECCC} (Unyte Conferencing Plugin) - [You must be registered and logged in to see this link.]
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = worchester.ibm.com
O17 - HKLM\Software\..\Telephony: DomainName = worchester.ibm.com
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = worchester.ibm.com
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: SearchList = IBM.COM
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList = IBM.COM
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: ACNotify - ACNotify.dll (file missing)
O23 - Service: Ac Profile Manager Service (AcPrfMgrSvc) - Unknown owner - C:\Program Files\ThinkPad\ConnectUtilities\AcPrfMgrSvc.exe
O23 - Service: ACU Configuration Service (ACS) - Unknown owner - C:\WINDOWS\system32\acs.exe
O23 - Service: Access Connections Main Service (AcSvc) - Lenovo - C:\Program Files\ThinkPad\ConnectUtilities\AcSvc.exe
O23 - Service: AppnNode - IBM Corporation - C:\WINDOWS\system32\Drivers\appnnode.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\ThinkPad\Bluetooth Software\bin\btwdins.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: IBM DCD Standard Client (DCDClient-ISSI) (DCDClient-ISSI) - Unknown owner - C:\Program Files\IBM\tivoli\dcd\client\ISSI\cds\CDSWinSrv.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec Client Security\Symantec AntiVirus\DefWatch.exe
O23 - Service: Diskeeper - Executive Software International, Inc. - C:\Program Files\Executive Software\DiskeeperWorkstation\DKService.exe
O23 - Service: ThinkPad PM Service (IBMPMSVC) - Unknown owner - C:\WINDOWS\system32\ibmpmsvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: ISAM SMT Service (ISAMsmt) - Unknown owner - C:\Program Files\C4ebreg\isamsmt.exe (file missing)
O23 - Service: IBM Standard Asset Manager Service (ISAMSvc) - IBM Corp. - C:\Program Files\C4ebreg\c4ebreg.exe
O23 - Service: ISSI (ISSIMon) - IBM Corp. - c:\sdwork\issimsvc.exe
O23 - Service: IS Service (ISSVC) - Symantec Corporation - C:\Program Files\Symantec Client Security\Symantec Client Firewall\ISSVC.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: IBM Enterprise Extender (ldlcserv) - IBM Corporation - C:\WINDOWS\system32\Drivers\ldlcserv.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Multi-user Cleanup Service - IBM Corp - C:\notes\ntmulti.exe
O23 - Service: Network Configuration Service (NetCfgSvr) - AT&T - C:\PROGRA~1\AT&TNE~1\NetCfgSv.EXE
O23 - Service: SAVRoam (SavRoam) - symantec - c:\Program Files\Symantec Client Security\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: SSDP Discovery Service SSDPSRVISSIMon (SSDPSRVISSIMon) - Unknown owner - C:\WINDOWS\system32\aaaamonc.exe (file missing)
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec Client Security\Symantec AntiVirus\Rtvscan.exe
O23 - Service: Symantec SecurePort (SymSecurePort) - Symantec Corporation - C:\Program Files\Symantec Client Security\Symantec Client Firewall\SymSPort.exe
O23 - Service: ThinkPad HDD APS Logging Service (TPHDEXLGSVC) - Lenovo. - C:\WINDOWS\System32\TPHDEXLG.EXE
O23 - Service: IBM KCU Service (TpKmpSVC) - Unknown owner - C:\WINDOWS\system32\TpKmpSVC.exe
O23 - Service: IBM Trace Facility (TrcBoot) - IBM Corporation - C:\WINDOWS\system32\Drivers\trcboot.exe[u]

Mr Blint
Novice
Novice

Posts Posts : 11
Joined Joined : 2009-06-03
OS OS : Win XP sp2
Points Points : 27423
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Another Winbluesoft victim

Post by Belahzur on Wed Jun 03, 2009 7:18 pm


  • Download combofix from here
    [You must be registered and logged in to see this link.]
    [You must be registered and logged in to see this link.]

    1. If you are using Firefox, make sure that your download settings are as follows:

    * Tools->Options->Main tab
    * Set to "Always ask me where to Save the files".

    2. During the download, rename Combofix to Combo-Fix as follows:





    3. It is important you rename Combofix during the download, but not after.
    4. Please do not rename Combofix to other names, but only to the one indicated.
    5. Close any open browsers.
    6. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

  • We need to disable your local AV (Anti-virus) before running Combofix.
  • See [You must be registered and logged in to see this link.] for how to disable your AV. (Symantec)
  • Double click on ComboFix.exe.
  • Follow the prompts. NOTE:
  • ComboFix will check to see if the Microsoft Windows Recovery Console is installed.
    ***It's strongly recommended to have the Recovery Console installed before doing any malware removal.***

    **Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will automatically proceed with its scan.


  • The Recovery Console provides a recovery/repair mode should a problem occur during a Combofix run.



  • Allow ComboFix to download the Recovery Console.
  • Accept the End-User License Agreement.
  • The Recovery Console will be installed.
  • You will then get this next prompt that asks if you want to continue the malware scan, select yes



  • Allow combofix to run
  • Post C:\combofix.txt back here.

    Note:
    Do not mouseclick combofix's window whilst it's running. That may cause it to stall.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34916
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : XP SP3 Media Centre
Points Points : 245049
# Likes # Likes : 1

View user profile

Back to top Go down

Re: Another Winbluesoft victim

Post by Mr Blint on Wed Jun 03, 2009 9:09 pm

ok here is the log for Combofix and things are looking quite normal!
ComboFix 09-06-03.01 - meckhard 06/03/2009 16:47.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.2038.1444 [GMT -4:00]
Running from: c:\documents and settings\Administrator\Desktop\Combo-Fix.exe
AV: Symantec AntiVirus Corporate Edition *On-access scanning disabled* (Updated) {FB06448E-52B8-493A-90F3-E43226D3305C}
FW: Symantec Client Firewall *disabled* {5CB76A43-5FAD-476B-B9FF-26FA61F13187}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Autorun.inf
c:\documents and settings\All Users\Start Menu\Internet Explorer.lnk
c:\windows\10409hackto5ze59.exe
c:\windows\1049thzef32555.dll
c:\windows\1057n5z-a-vir9s428.ocx
c:\windows\10604not-a-z9r5s78a.dll
c:\windows\107z1s953d0.exe
c:\windows\10845v9rus5aez.cpl
c:\windows\1090backdo5926z6.exe
c:\windows\10z10not-9-virus5275.dll
c:\windows\11345not-a9virus4z5.bin
c:\windows\11721notz5-vi9us594.bin
c:\windows\1190virusza05.dll
c:\windows\11958hazktool1ac.exe
c:\windows\12019zr9j795.exe
c:\windows\125569roj4z0.bin
c:\windows\12d7ad5warz1689.exe
c:\windows\134355ot-a-viz9s10c.ocx
c:\windows\13735wor9z6a.bin
c:\windows\13831vi9u51z0.exe
c:\windows\1397ste5l2785z.bin
c:\windows\1435zworm559.cpl
c:\windows\14395iz2993.ocx
c:\windows\1448thre5t12093z.cpl
c:\windows\14598sp9z9f.cpl
c:\windows\14759wzr91e5.cpl
c:\windows\14899not5a-vzrus678.exe
c:\windows\14e0addwarz569.dll
c:\windows\1519zp5238.cpl
c:\windows\15457spz9b0.dll
c:\windows\154z95irus93c.ocx
c:\windows\15534noz9a-v5rus91.dll
c:\windows\15595szy9c.ocx
c:\windows\15797h5cktozl990.exe
c:\windows\157zteal1937.exe
c:\windows\15932wzrm39c.exe
c:\windows\15984spambo93zd.cpl
c:\windows\15994spy56z.cpl
c:\windows\15e4spzrse22789.exe
c:\windows\160z9viru56829.ocx
c:\windows\1694z9or5403.exe
c:\windows\170955orm5ez.bin
c:\windows\1710ztro92355.ocx
c:\windows\1713z9pambot2d95.bin
c:\windows\17395spambo57z9.cpl
c:\windows\17709not-z5virus1cc.bin
c:\windows\17858vi9zs542.dll
c:\windows\18365sp9223z.cpl
c:\windows\18649s5yz6.exe
c:\windows\188615oz-a-vir9s2dc.exe
c:\windows\18960spamzot4355.exe
c:\windows\18f4a5dwar9z325.exe
c:\windows\19262hackto9510z.cpl
c:\windows\19300n9t-a-5irus208z.exe
c:\windows\1935zspy370.dll
c:\windows\1939zw5rm2dd.ocx
c:\windows\19459z59m524.exe
c:\windows\19585hzck5ool2a49.cpl
c:\windows\195es5arse1722z.bin
c:\windows\1961azdware5419.ocx
c:\windows\19654v5rus603z.dll
c:\windows\19655hz5ktool7f5.dll
c:\windows\197bd5wn9oadzr2015.exe
c:\windows\1985spyz30.bin
c:\windows\1990zha5ktool53b.ocx
c:\windows\19ze9pywa5e874.bin
c:\windows\1a21sp9rsz28905.cpl
c:\windows\1b36z59ware467.dll
c:\windows\1c86th5eatz8569.exe
c:\windows\1d89downzo5der10579.dll
c:\windows\1d9fdow5loade92658z.cpl
c:\windows\1df0addza591025.bin
c:\windows\1z169sp5mb9t323.ocx
c:\windows\1z476spy4915.dll
c:\windows\2016do9n5ozder515.ocx
c:\windows\20527spambo9z54.cpl
c:\windows\2064tro5zf39.dll
c:\windows\20681no9-a-viruz27a5.dll
c:\windows\206zste5l2319.exe
c:\windows\208fbac5door1397z.ocx
c:\windows\21179t5ojz4d.ocx
c:\windows\21258wo9m5zc.exe
c:\windows\21269zorm551.exe
c:\windows\21589h5cktool531z.bin
c:\windows\22529hack9ool5cz.bin
c:\windows\22eeba95door3z90.cpl
c:\windows\23562troj4z79.exe
c:\windows\2359nzt-a-9irus66e.bin
c:\windows\237zv591512.cpl
c:\windows\23918not5a-viruz437.ocx
c:\windows\24115not-z-viru5956.bin
c:\windows\242925ot-a9virus23z.dll
c:\windows\2433659tza-virus6ed.dll
c:\windows\2446addzare9540.cpl
c:\windows\246addwzr927125.dll
c:\windows\24720not-5-vizus9a6.bin
c:\windows\24z69wo9m365.dll
c:\windows\25185zroj759.cpl
c:\windows\2569s5yware122z.cpl
c:\windows\25783spyz279.ocx
c:\windows\25e1s9eaz3136.dll
c:\windows\25z85not-a-v5rus988.bin
c:\windows\26694not-59virzs4ce.dll
c:\windows\26859wozm457.exe
c:\windows\2685downloa9zr5800.exe
c:\windows\2686zv5rus965.ocx
c:\windows\26896z5y599.ocx
c:\windows\268down5oadez949.exe
c:\windows\26d09pyzare18505.cpl
c:\windows\26z85hackt9ol451.dll
c:\windows\27095vz5uscd.ocx
c:\windows\271559roj1bz.cpl
c:\windows\27425zorm9f8.ocx
c:\windows\2759spy5are14z.exe
c:\windows\275thiefz559.dll
c:\windows\282405ot-a-vir9sz80.ocx
c:\windows\28999tr5jzc3.bin
c:\windows\28z275py2cc9.bin
c:\windows\29023hackto9l45z.dll
c:\windows\29254zot-a-virus7169.bin
c:\windows\2937hack5oolz55.cpl
c:\windows\29507sz912d.ocx
c:\windows\29918vi5us95z.ocx
c:\windows\299959orz7ff.bin
c:\windows\29c1thr9at275z05.dll
c:\windows\2a15zddware99.exe
c:\windows\2a59vi91z98.dll
c:\windows\2cb9thze5439.cpl
c:\windows\2d55backdoorz95.bin
c:\windows\2e7dsp5z9e1981.bin
c:\windows\2z39hi5f372.exe
c:\windows\2z906w95m659.cpl
c:\windows\30258zroj59c.cpl
c:\windows\303z8sp5998.cpl
c:\windows\305baddwarez8995.exe
c:\windows\3095spywzre2790.dll
c:\windows\31285wormz9.exe
c:\windows\3131zot-9-5irus797.cpl
c:\windows\315985pyz19.exe
c:\windows\31747ha5ktool19z.dll
c:\windows\3195s9arse1420z.ocx
c:\windows\31965s5y69bz.ocx
c:\windows\31z5thief3092.cpl
c:\windows\32229woz5769.exe
c:\windows\322zd5wnloader2954.dll
c:\windows\32759virus54az.bin
c:\windows\3303b9ckd5or3z95.dll
c:\windows\33ebsparse9z5.dll
c:\windows\33z9worm185.cpl
c:\windows\3409oz5502.ocx
c:\windows\345zback9oor1928.exe
c:\windows\34f1b5ckdoor69z.exe
c:\windows\350zvirus693.cpl
c:\windows\3544tro97z75.cpl
c:\windows\3562d5wn9oadez992.bin
c:\windows\3593ste9lz834.cpl
c:\windows\35c0t9zeat13592.exe
c:\windows\3802sp9wzr53015.bin
c:\windows\3815za59door956.exe
c:\windows\38d9thzef29925.dll
c:\windows\39057spy4ze.exe
c:\windows\39554wormz59.ocx
c:\windows\398zspa5se873.ocx
c:\windows\39b4vi95816z.bin
c:\windows\39d7vi51z4.exe
c:\windows\39d8spz9se2795.cpl
c:\windows\3ac8vzr1995.exe
c:\windows\3af5ste9l314z.dll
c:\windows\3bef59r129z.exe
c:\windows\3c955tzal2679.ocx
c:\windows\3ca89a5kdoor2z44.ocx
c:\windows\3cz8ste9l395.ocx
c:\windows\3d0edow9loadez2975.ocx
c:\windows\3e915ddzare58.cpl
c:\windows\3fbcdo5nloaze9460.dll
c:\windows\3z0455pamb9t592.cpl
c:\windows\3z5d9teal571.bin
c:\windows\404zth5e9189.dll
c:\windows\40815pz38a9.exe
c:\windows\41795pywzre2296.cpl
c:\windows\43z6spyware1509.ocx
c:\windows\43z95orm6ab.exe
c:\windows\44a9vir205z.exe
c:\windows\456bstealz095.ocx
c:\windows\458bszar9e815.dll
c:\windows\4592stealz945.bin
c:\windows\45a25zeal15469.exe
c:\windows\467e9azkdoor5264.bin
c:\windows\4788do5nloa9erz633.cpl
c:\windows\484et9ief5348z.bin
c:\windows\48559hreat9129z.ocx
c:\windows\492zbac5door677.bin
c:\windows\49z3a5dware1331.bin
c:\windows\49z9addwar51820.cpl
c:\windows\4a79b9ckzoor1557.exe
c:\windows\4b5azpywa5e94.bin
c:\windows\4becbaczd5or9001.bin
c:\windows\4dz2d9wnloader517.bin
c:\windows\4e53spy9zre24.exe
c:\windows\4f3fbzck9oor945.bin
c:\windows\4fad5warez99.ocx
c:\windows\4zees9eal1745.bin
c:\windows\50790zp9368.ocx
c:\windows\509tzief3079.bin
c:\windows\50z40sp9316.dll
c:\windows\5109st5a9541z.bin
c:\windows\52024spy2z9.bin
c:\windows\5204z5y985.dll
c:\windows\5238do9nzoad5r1856.dll
c:\windows\5319steal3175z.exe
c:\windows\5368spz9are2979.cpl
c:\windows\5397zir641.exe
c:\windows\53dcspa9se200z.exe
c:\windows\53z0add9are2559.exe
c:\windows\5429tr9z37c.bin
c:\windows\542aspzrse9859.dll
c:\windows\546czackdoor24529.ocx
c:\windows\5520sparsz928.dll
c:\windows\5529thief5z5.exe
c:\windows\5598vir1949z.ocx
c:\windows\559bsparsz1261.ocx
c:\windows\55b8szeal9116.cpl
c:\windows\55z2s9eal578.cpl
c:\windows\56727zot-a-virus6e9.ocx
c:\windows\5793sp9rse305z.bin
c:\windows\5795h5cktozlf29.exe
c:\windows\57z5d9wnloader25845.exe
c:\windows\583downloa59r3052z.cpl
c:\windows\58934hzcktool98.dll
c:\windows\594z1troj69d.dll
c:\windows\5968s9zal1170.ocx
c:\windows\5999wormzc5.cpl
c:\windows\599addwaze548.ocx
c:\windows\59z3virus905.dll
c:\windows\59z5b9ckdoor2972.ocx
c:\windows\59z90spy7d5.cpl
c:\windows\5b65zhief359.dll
c:\windows\5c9zaddwa5e1355.exe
c:\windows\5d59acz5oor1769.ocx
c:\windows\5d87s9ez5511.ocx
c:\windows\5e0eba9kdoor12z1.ocx
c:\windows\5e53t9iefz57.bin
c:\windows\5e95st9al214z.cpl
c:\windows\5f85steaz959.exe
c:\windows\5f95thi5f638z.bin
c:\windows\5fd9vir1295z.ocx
c:\windows\5z0daddw5re20729.cpl
c:\windows\5z17wor5915.cpl
c:\windows\5z532virus679.ocx
c:\windows\5z6959reat12219.bin
c:\windows\5z85sp9mbot226.bin
c:\windows\617fvi5539z.exe
c:\windows\61fba59zare2396.ocx
c:\windows\61z5d9wnloa5er1015.bin
c:\windows\629wo593e6z.dll
c:\windows\62a3ad9wzre28285.ocx
c:\windows\6359z5r2491.ocx
c:\windows\6371t95j5ze.cpl
c:\windows\6453thrzat4895.bin
c:\windows\6463spzr5e3059.ocx
c:\windows\64a9thiz5710.bin
c:\windows\651aspywzre2916.dll
c:\windows\6533woz55c99.cpl
c:\windows\666et5rzat24379.bin
c:\windows\6871not-azv9rus454.bin
c:\windows\6909virusz85.bin
c:\windows\6931do5nloazer2619.dll
c:\windows\6959zot-a-vi5us51c.ocx
c:\windows\6989add9arz855.ocx
c:\windows\699zbackdoo5178.exe
c:\windows\69bzvir5785.cpl
c:\windows\6a19ba5kd9or1z32.bin
c:\windows\6a295hzeat17649.cpl
c:\windows\6a945ddware2049z.exe
c:\windows\6b5cdownload95z691.ocx
c:\windows\6bb1viz15449.exe
c:\windows\6d75doznloa5er1950.cpl
c:\windows\6e28a5dwaze9219.dll
c:\windows\6e5fspzrs92532.cpl
c:\windows\6edathz5f22089.cpl
c:\windows\6fz9vir595.bin
c:\windows\6z51tro95a.cpl
c:\windows\6z91v9r5935.ocx
c:\windows\6za2thi5f983.bin
c:\windows\6zccb9ckdoor13765.cpl
c:\windows\72249ddwaze29445.exe
c:\windows\7326not-az95rus6f4.exe
c:\windows\7368szambot2e59.cpl
c:\windows\7421th5eat25z9.exe
c:\windows\7519spywz5e2710.bin
c:\windows\754f9ddware2z83.cpl
c:\windows\7555hac9tool6zb.exe
c:\windows\7652n5t-a-viruz592.bin
c:\windows\7753addwzr9512.exe
c:\windows\7886s5e9l23z9.exe
c:\windows\78a9bazkdoo52203.dll
c:\windows\7952zr9j6c5.dll
c:\windows\79cd5ddware314z.dll
c:\windows\7bc2a5dzare1698.bin
c:\windows\7fz3a5dware9655.ocx
c:\windows\7z99vir23595.dll
c:\windows\82z5s9ambot199.ocx
c:\windows\8893woz5599.bin
c:\windows\8996spzm5ot4f9.bin
c:\windows\909thze5846.ocx
c:\windows\91259troj25az.cpl
c:\windows\9167t5reat84z0.exe
c:\windows\91zeth5ef67.bin
c:\windows\92590wozm2a3.bin
c:\windows\92fsze5l696.dll
c:\windows\9368s5arsez361.bin
c:\windows\9398zw5rm7a4.ocx
c:\windows\94001v5zus64c.dll
c:\windows\942edzwnloader1657.ocx
c:\windows\943515orm19z.exe
c:\windows\949worz546.exe
c:\windows\95070h5cktool5bz.exe
c:\windows\95355vzrus7a9.ocx
c:\windows\9556zirus6655.ocx
c:\windows\9558sparse1014z.ocx
c:\windows\95750troz578.exe
c:\windows\95853vizus550.ocx
c:\windows\95fzaddw5re2052.ocx
c:\windows\96075virzs6165.exe
c:\windows\96795zy39d.ocx
c:\windows\96a7t5ief5z8.exe
c:\windows\972815ot-z-virus33d.ocx
c:\windows\973z2w5rm50c.ocx
c:\windows\9748thrzat14805.cpl
c:\windows\9785dd9are3z66.dll
c:\windows\99258h5zktool2a2.dll
c:\windows\99363hacktoolzb5.ocx
c:\windows\9939steal2358z.cpl
c:\windows\9b55viz620.dll
c:\windows\9b5backd9orz68.ocx
c:\windows\9z45vir1725.dll
c:\windows\a12thie5z339.exe
c:\windows\a70addw9rz2052.bin
c:\windows\b3bthrez593932.cpl
c:\windows\bb5thr9az3175.cpl
c:\windows\cbezhre5914584.bin
c:\windows\d79thzef258.exe
c:\windows\dcds9zr5e3180.exe
c:\windows\e25downl9ader155z.bin
c:\windows\e6dbackdooz495.ocx
c:\windows\f665irz079.cpl
c:\windows\f95d5wnloader1z9.ocx

Mr Blint
Novice
Novice

Posts Posts : 11
Joined Joined : 2009-06-03
OS OS : Win XP sp2
Points Points : 27423
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Another Winbluesoft victim

Post by Mr Blint on Wed Jun 03, 2009 9:12 pm

PART 2

c:\windows\system32\103z5sp5499.dll
c:\windows\system32\104dthief254z9.cpl
c:\windows\system32\10904spambz95a5.bin
c:\windows\system32\11006sp5mbotz5f9.cpl
c:\windows\system32\111459zrus2ca.dll
c:\windows\system32\11337virusz559.cpl
c:\windows\system32\11705tzo9558.exe
c:\windows\system32\11878hzc9tool651.cpl
c:\windows\system32\11bbdoznl9ader2951.bin
c:\windows\system32\11c3d95nloaderz27.dll
c:\windows\system32\11cdbazkdo5r3489.cpl
c:\windows\system32\12599h5ckto9lz1.ocx
c:\windows\system32\1279s5yware247z.bin
c:\windows\system32\1297vi5uz21a.cpl
c:\windows\system32\13034s597zf.cpl
c:\windows\system32\132z9ac5tool306.ocx
c:\windows\system32\13422spa9bzt5d2.cpl
c:\windows\system32\13539v9ru53cz.dll
c:\windows\system32\13713spambot95z.bin
c:\windows\system32\13787hacktzo9523.cpl
c:\windows\system32\13963vz5us2b2.exe
c:\windows\system32\1399spar9e5z70.exe
c:\windows\system32\139cdzw5loader967.cpl
c:\windows\system32\1454zhack5oo92f.ocx
c:\windows\system32\14715d9ware96z.bin
c:\windows\system32\151not-5-vi9us67z.bin
c:\windows\system32\1528ztr9j655.exe
c:\windows\system32\15550not-a-vzrus6b9.cpl
c:\windows\system32\1598zhacktoolb9.dll
c:\windows\system32\159cviz9556.cpl
c:\windows\system32\15a4spywarz14359.ocx
c:\windows\system32\16160z9oj551.dll
c:\windows\system32\162255zam9ot2d3.dll
c:\windows\system32\16439zp5926.dll
c:\windows\system32\165cspy9are1954z.ocx
c:\windows\system32\16cddo5nloaz9r3140.cpl
c:\windows\system32\16f89zreat24657.ocx
c:\windows\system32\17097tr5j3z5.dll
c:\windows\system32\17099trojb5z.exe
c:\windows\system32\17111zpambo941c5.exe
c:\windows\system32\173489pambot2za5.dll
c:\windows\system32\1747zs5y7de9.ocx
c:\windows\system32\1748steaz29015.exe
c:\windows\system32\174z1s9ambot355.exe
c:\windows\system32\1799a5z9are287.ocx
c:\windows\system32\18201hac95oolze9.exe
c:\windows\system32\1823895rmz6c.cpl
c:\windows\system32\18323t59j3z0.exe
c:\windows\system32\1858z9roj3fe.dll
c:\windows\system32\185z9teal1892.bin
c:\windows\system32\18610zirus5959.bin
c:\windows\system32\1905virz369.bin
c:\windows\system32\191859i5usz99.ocx
c:\windows\system32\19367hazktool5549.dll
c:\windows\system32\19417wzrm5c.cpl
c:\windows\system32\19469hazktool55d.bin
c:\windows\system32\19475ot-a-virus3dz.ocx
c:\windows\system32\19880not9a-vizus6f35.bin
c:\windows\system32\1990znot5a-virus26d.exe
c:\windows\system32\19982vi59s249z.bin
c:\windows\system32\199955orm2za.cpl
c:\windows\system32\19996not-azvirus735.dll
c:\windows\system32\19997vi5us2ze.exe
c:\windows\system32\199cszarse2353.cpl
c:\windows\system32\1a4edownloa9er13z5.bin
c:\windows\system32\1a69spyw5rez549.bin
c:\windows\system32\1a7dadd9ar52661z.ocx
c:\windows\system32\1ab79ackdoorz534.dll
c:\windows\system32\1abeba5kdoor3z49.dll
c:\windows\system32\1dzavir90755.bin
c:\windows\system32\1e15zhief3019.dll
c:\windows\system32\1e68spyw5ze2998.ocx
c:\windows\system32\1e68zddw5re9264.bin
c:\windows\system32\1f52thr9at1z79.exe
c:\windows\system32\1f85szyware9814.cpl
c:\windows\system32\1z465s9ambot759.dll
c:\windows\system32\1z476v5rus908.bin
c:\windows\system32\1z589troj662.dll
c:\windows\system32\1z9cadd5a9e142.bin
c:\windows\system32\2032tzo541f9.cpl
c:\windows\system32\20476woz9153.bin
c:\windows\system32\20531spam9zt2d1.dll
c:\windows\system32\2055v9rz907.ocx
c:\windows\system32\205zth9ef1819.dll
c:\windows\system32\206z75pambot496.cpl
c:\windows\system32\21362not-a-viru956z.exe
c:\windows\system32\2152vir9z599.ocx
c:\windows\system32\21587hac9t5zl309.bin
c:\windows\system32\21587tz5j9f2.dll
c:\windows\system32\2168s5amzot4e9.bin
c:\windows\system32\2173zspy5c9.exe
c:\windows\system32\21989wo5m50fz.exe
c:\windows\system32\21b1v593z90.exe
c:\windows\system32\22442zo952fd.ocx
c:\windows\system32\224bsp9wa5e74z.dll
c:\windows\system32\22565or937z.cpl
c:\windows\system32\2275z9wnloader1104.ocx
c:\windows\system32\23579viruzfb.cpl
c:\windows\system32\235z4viru959.ocx
c:\windows\system32\23645not-5-9irzs95.ocx
c:\windows\system32\23868not5a-viz9s1f1.dll
c:\windows\system32\2395hacktooz1b9.exe
c:\windows\system32\23990zpy759.ocx
c:\windows\system32\23z58vir9s51e.exe
c:\windows\system32\245z8wor55439.exe
c:\windows\system32\24653z9rm3e7.ocx
c:\windows\system32\249z795y605.cpl
c:\windows\system32\24zs95al592.ocx
c:\windows\system32\25195spy67z.dll
c:\windows\system32\254z4virus7d09.ocx
c:\windows\system32\25535wor9z99.exe
c:\windows\system32\257039or5zc4.dll
c:\windows\system32\2577spars91210z.bin
c:\windows\system32\25849worm4b0z.exe
c:\windows\system32\2585zh9ef615.dll
c:\windows\system32\25899wozm4a9.ocx
c:\windows\system32\2594z9roj2ab.dll
c:\windows\system32\263b59ief8z4.ocx
c:\windows\system32\26569hacztool32c9.bin
c:\windows\system32\265z395oj72d.dll
c:\windows\system32\26864v5ru95e6z.ocx
c:\windows\system32\26z9t5oj513.cpl
c:\windows\system32\27205viruz799.exe
c:\windows\system32\27257not-a-zirus39e.ocx
c:\windows\system32\272zs9ars52158.cpl
c:\windows\system32\27588w9z54a6.dll
c:\windows\system32\278509roj5z1.bin
c:\windows\system32\27916no9-a-viruz3525.bin
c:\windows\system32\2803zspa95ot51c.dll
c:\windows\system32\28070n5t-azvirus519.cpl
c:\windows\system32\28594vi5uz1e.exe
c:\windows\system32\285downloader519z9.dll
c:\windows\system32\28763w5r9zc6.cpl
c:\windows\system32\28769sp51z5.exe
c:\windows\system32\290429ot-azvirus6285.dll
c:\windows\system32\29095hac5toolz69.ocx
c:\windows\system32\29181not-a-vi5u95bfz.cpl
c:\windows\system32\291cthrezt22165.ocx
c:\windows\system32\292329py45z.dll
c:\windows\system32\29304worm40z5.bin
c:\windows\system32\29513viruz37.ocx
c:\windows\system32\29537zpy98.cpl
c:\windows\system32\29550troj699z.exe
c:\windows\system32\295619pamboz338.cpl
c:\windows\system32\295975iruz9f0.ocx
c:\windows\system32\29661sp5z12.dll
c:\windows\system32\29701s5y4dz.exe
c:\windows\system32\29763s5zmb9t66b.cpl
c:\windows\system32\29799no5-azv9rusf4.bin
c:\windows\system32\2994s9am5ot33ez.cpl
c:\windows\system32\299865zrm75a.bin
c:\windows\system32\29ba5ir387z.dll
c:\windows\system32\29z245i9us37f.ocx
c:\windows\system32\2eza9teal2586.ocx
c:\windows\system32\2f58sp5wa9e11z7.ocx
c:\windows\system32\2fz3sp9w5re281.cpl
c:\windows\system32\2z023sp955d5.cpl
c:\windows\system32\2z36vi59s170.exe
c:\windows\system32\2z5199py625.cpl
c:\windows\system32\2z5hackto9l513.exe
c:\windows\system32\2z6fth9eat8265.exe
c:\windows\system32\2z7c5hi9f921.exe
c:\windows\system32\2z86thi5f954.bin
c:\windows\system32\2z915tro9601.ocx
c:\windows\system32\2z98backdoo5996.bin
c:\windows\system32\305f9parse1851z.ocx
c:\windows\system32\305z5hreat6922.ocx
c:\windows\system32\30868tr5jz49.bin
c:\windows\system32\3091thi9f553z.dll
c:\windows\system32\3093doz5l9ader1874.exe
c:\windows\system32\30z96spy5d9.bin
c:\windows\system32\31194szy555.cpl
c:\windows\system32\31467sp9mzo5146.exe
c:\windows\system32\3147695ambotza6.ocx
c:\windows\system32\315db9ckdoorz93.dll
c:\windows\system32\31659trz593f.exe
c:\windows\system32\32559tealz39.bin
c:\windows\system32\32602not-5-virz926a.dll
c:\windows\system32\329v9r1z075.exe
c:\windows\system32\32b9downloadzr532.exe
c:\windows\system32\32z65vi9us5bd.bin
c:\windows\system32\333t59ezt24284.ocx
c:\windows\system32\3393ad5wa9e2809z.dll
c:\windows\system32\3455z9eal830.ocx
c:\windows\system32\35aa9ozn5oader1182.dll
c:\windows\system32\35z81wor97e0.cpl
c:\windows\system32\3779tro5zcb.exe
c:\windows\system32\37d35ackdoorz3599.ocx
c:\windows\system32\386e5ackdo9r1201z.dll
c:\windows\system32\387cz9arse2759.exe
c:\windows\system32\3957steal3206z.exe
c:\windows\system32\395avzr2575.bin
c:\windows\system32\3995sparse270z.dll
c:\windows\system32\3a4a5ownloadez1119.bin
c:\windows\system32\3c99spywa9e57z5.ocx
c:\windows\system32\3d9zvir1534.cpl
c:\windows\system32\3e13zpyware31985.exe
c:\windows\system32\3efa9hief598z.exe
c:\windows\system32\3zf5vir2279.cpl
c:\windows\system32\404Fix.exe
c:\windows\system32\4110s95az968.exe
c:\windows\system32\41885ownloa9er18z5.ocx
c:\windows\system32\4293spzr5e478.exe
c:\windows\system32\43945pyware3071z.ocx
c:\windows\system32\4445s9ambotd3z.cpl
c:\windows\system32\44bfsparse2z595.bin
c:\windows\system32\4565szeal915.exe
c:\windows\system32\46799ot-a-z5rus14b.dll
c:\windows\system32\467zdow9loader250.cpl
c:\windows\system32\46a9tzief5589.exe
c:\windows\system32\46b5viz1937.dll
c:\windows\system32\46zbthr9at55834.cpl
c:\windows\system32\473ead95arz1799.cpl
c:\windows\system32\488cbac95ooz2134.dll
c:\windows\system32\4909s9z5are705.ocx
c:\windows\system32\4929sparse5z78.cpl
c:\windows\system32\4991hacktoz549d.dll
c:\windows\system32\49eespywar52z95.cpl
c:\windows\system32\4a4sp9waze22975.dll
c:\windows\system32\4a79thre5z7709.dll
c:\windows\system32\4a9addwaz52199.dll
c:\windows\system32\4bf9py5aze644.dll
c:\windows\system32\4cdbthreat591z4.ocx
c:\windows\system32\4e59threzt5269.ocx
c:\windows\system32\4z6athie9536.exe
c:\windows\system32\501449orm2ez.exe
c:\windows\system32\50599not-a-virzs182.bin
c:\windows\system32\5063h9cktoolz165.ocx
c:\windows\system32\50721szambo9265.exe
c:\windows\system32\5097n5t-azvir9s63b.dll
c:\windows\system32\5099spywarz1705.exe
c:\windows\system32\519z4virus2db.cpl
c:\windows\system32\51z2t9oj4f1.cpl
c:\windows\system32\51z79acktool4e9.dll
c:\windows\system32\5238downloa9er2755z.dll
c:\windows\system32\5286s9ealz7205.ocx
c:\windows\system32\52a9dzwnloader5256.exe
c:\windows\system32\52e6sp9ware55z.cpl
c:\windows\system32\52z54troj695.bin
c:\windows\system32\539spa5sz2836.cpl
c:\windows\system32\54075t9zj677.dll
c:\windows\system32\544esp5rsz9946.ocx
c:\windows\system32\54935t9oj4z4.exe
c:\windows\system32\54acthreatz19885.exe
c:\windows\system32\5529d9wnloadez685.exe
c:\windows\system32\558w9rz2f3.exe
c:\windows\system32\559csteal136z.dll
c:\windows\system32\55aethief2975z.ocx
c:\windows\system32\56113wor9152z.dll
c:\windows\system32\5673a5zware3290.exe
c:\windows\system32\56815hreat396z6.ocx
c:\windows\system32\57899h9cktoolzbd.exe
c:\windows\system32\57d0vi9z855.cpl
c:\windows\system32\57fbtzreat29945.cpl
c:\windows\system32\57z9downloade522699.dll
c:\windows\system32\58055hreatz77349.exe
c:\windows\system32\58ae9pywaze2209.ocx
c:\windows\system32\594thi9f1536z.cpl
c:\windows\system32\5951hacktoo9bdz.exe
c:\windows\system32\5977downlo9der2z98.ocx
c:\windows\system32\599zv9r5226.dll
c:\windows\system32\5a99threat24z585.dll
c:\windows\system32\5a9zt5al1567.cpl
c:\windows\system32\5aa7st5al1098z.bin
c:\windows\system32\5b19downloade51z.exe
c:\windows\system32\5bbad9w5re1979z.bin
c:\windows\system32\5c39threat16974z.ocx
c:\windows\system32\5ccb9ackdozr2556.dll
c:\windows\system32\5e1dthief969z.cpl
c:\windows\system32\5e42addwz5e8189.bin
c:\windows\system32\5e6s5ea9z979.ocx
c:\windows\system32\5f7caddware3z92.cpl
c:\windows\system32\5fastea9274z.dll
c:\windows\system32\5fdazackdoor2949.dll
c:\windows\system32\5z95vir50.exe
c:\windows\system32\6063vzr25909.ocx
c:\windows\system32\619fzte5l1969.dll
c:\windows\system32\63d0stealz1795.ocx
c:\windows\system32\6573wozm397.cpl
c:\windows\system32\65a25tzal996.bin
c:\windows\system32\65edz9r3098.cpl
c:\windows\system32\6625s5y9are208z.dll
c:\windows\system32\6677zroj7955.exe
c:\windows\system32\66davz52549.ocx
c:\windows\system32\675adown9zader2577.dll
c:\windows\system32\6829addwaze1513.dll
c:\windows\system32\68519py5z.exe
c:\windows\system32\68f8vir19z35.cpl
c:\windows\system32\6998not-a-ziru51d9.dll
c:\windows\system32\6a5f9teal1779z.dll
c:\windows\system32\6aczspyw95e116.cpl
c:\windows\system32\6adddo5zlo9der2159.exe
c:\windows\system32\6b2zvir32599.bin
c:\windows\system32\6e85hreat849z.dll
c:\windows\system32\6z42threat35095.bin
c:\windows\system32\6z95spy558.exe
c:\windows\system32\70999i5us3za.exe
c:\windows\system32\70ac9owzl5ader2500.ocx
c:\windows\system32\7144ba9kdoo53038z.dll
c:\windows\system32\74355hrzat29381.ocx
c:\windows\system32\74bes9za5555.cpl
c:\windows\system32\7559rus156z.bin
c:\windows\system32\755cvir2z9.exe
c:\windows\system32\75955oznloader3189.cpl
c:\windows\system32\75z3t5ie9695.bin
c:\windows\system32\7647threat559z.exe
c:\windows\system32\78d8zackd9or1513.exe
c:\windows\system32\78z6v9rus5e.ocx
c:\windows\system32\79bdbzckd5or2566.bin
c:\windows\system32\7c0z95ware445.ocx
c:\windows\system32\7c20stea5z1549.bin
c:\windows\system32\7zd4downlo5der9207.dll
c:\windows\system32\80z2sp9151.bin
c:\windows\system32\85249p57z5.ocx
c:\windows\system32\8595spamb5t557z.cpl
c:\windows\system32\869wzrm7c15.cpl
c:\windows\system32\871zspam5ot59.cpl
c:\windows\system32\90395szambotab.cpl
c:\windows\system32\90447troj4z5.cpl
c:\windows\system32\90661zirus596.ocx
c:\windows\system32\9129th5eat43z3.exe
c:\windows\system32\917zthreat25545.exe
c:\windows\system32\923z9r5j5c8.cpl
c:\windows\system32\925z7spy715.exe
c:\windows\system32\92672sp57c8z.exe
c:\windows\system32\93f7spywzre2553.exe
c:\windows\system32\93fsze5l504.ocx
c:\windows\system32\93z8worm45d.cpl
c:\windows\system32\950backdoor15z9.bin
c:\windows\system32\951virz330.ocx
c:\windows\system32\95239spambot62z.cpl
c:\windows\system32\9540zworm31.exe
c:\windows\system32\9559vzrus49d.exe
c:\windows\system32\9565azdware1847.exe
c:\windows\system32\9566sparse304z.cpl
c:\windows\system32\9592viruz595.dll
c:\windows\system32\96005worm69z5.exe
c:\windows\system32\97threa52z919.cpl
c:\windows\system32\9859ha9ktzol361.dll
c:\windows\system32\98ebzir2945.dll
c:\windows\system32\99259tzoj7a4.exe
c:\windows\system32\99376viru5z96.cpl
c:\windows\system32\99509zirus55d.exe
c:\windows\system32\997spy35z.dll
c:\windows\system32\9994spy5z0.dll
c:\windows\system32\99aes5azse1542.bin
c:\windows\system32\9azavi5892.dll
c:\windows\system32\9b64szarse5108.bin
c:\windows\system32\9b6ethr5atz3947.ocx
c:\windows\system32\9e03zhief6695.bin
c:\windows\system32\9e8zth5ef2923.cpl
c:\windows\system32\9f8aspywaze335.ocx
c:\windows\system32\a4thrz954744.bin
c:\windows\system32\Agent.OMZ.Fix.exe
c:\windows\system32\c18down5zader759.cpl
c:\windows\system32\c47downl5azer695.exe
c:\windows\system32\ddaaddwaz59036.dll

Mr Blint
Novice
Novice

Posts Posts : 11
Joined Joined : 2009-06-03
OS OS : Win XP sp2
Points Points : 27423
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Another Winbluesoft victim

Post by Belahzur on Wed Jun 03, 2009 9:20 pm

Awaiting the rest of the log.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34916
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : XP SP3 Media Centre
Points Points : 245049
# Likes # Likes : 1

View user profile

Back to top Go down

Re: Another Winbluesoft victim

Post by Mr Blint on Wed Jun 03, 2009 9:24 pm

c:\windows\system32\drivers\IBM_1951_A31_TP.MRK
c:\windows\system32\dumphive.exe
c:\windows\system32\e99threatz0597.cpl
c:\windows\system32\e9fadd5arez094.bin
c:\windows\system32\f25spywaze3190.ocx
c:\windows\system32\IEDFix.C.exe
c:\windows\system32\IEDFix.exe
c:\windows\system32\NicEtCoE.dll
c:\windows\system32\o4Patch.exe
c:\windows\system32\Process.exe
c:\windows\system32\SrchSTS.exe
c:\windows\system32\tmp.reg
c:\windows\system32\VACFix.exe
c:\windows\system32\VCCLSID.exe
c:\windows\system32\WS2Fix.exe
c:\windows\system32\z194s5a9bot47e.cpl
c:\windows\system32\z3994vir5s9c.bin
c:\windows\system32\z529spy579.bin
c:\windows\system32\z5464spy592.exe
c:\windows\system32\z560vir3091.exe
c:\windows\system32\z5935ir672.dll
c:\windows\system32\z59565r9j79c.bin
c:\windows\system32\z665parse295.cpl
c:\windows\system32\z677v9r5177.ocx
c:\windows\system32\z695no5-a-vir9s2c.dll
c:\windows\system32\z6a9addwar51032.cpl
c:\windows\system32\z70bvi91595.ocx
c:\windows\system32\z7983spy3275.exe
c:\windows\system32\z8793wor519d.ocx
c:\windows\system32\z8fdthief35989.cpl
c:\windows\system32\z9318wor52c7.dll
c:\windows\system32\z9935sp5292.bin
c:\windows\system32\zbfs9eal2505.exe
c:\windows\system32\zf08back9oor2275.exe
c:\windows\z08335orm904.cpl
c:\windows\z0997h9c5tool7ed.cpl
c:\windows\z1446not-9-v5rus768.bin
c:\windows\z175stea9549.ocx
c:\windows\z1f5s9arse2694.exe
c:\windows\z239spyware1547.bin
c:\windows\z2559troj14b9.bin
c:\windows\z2996hac9tool3a15.ocx
c:\windows\z345thre9t15968.bin
c:\windows\z442not-a5virus479.cpl
c:\windows\z4901troj3b59.cpl
c:\windows\z5856h5cktoo93b1.ocx
c:\windows\z59735acktool3c5.dll
c:\windows\z5e8addware31509.exe
c:\windows\z65bthreat90753.cpl
c:\windows\z7317not-a-9i5us1cc.bin
c:\windows\z820add9ar52988.ocx
c:\windows\z95bste5l2043.ocx
c:\windows\za8e5ownloader9415.cpl
c:\windows\za99vir1595.dll
c:\windows\zc1th5eat250859.exe
c:\windows\zceas5eal1399.dll
c:\windows\zd81v9r554.ocx
c:\windows\zde0downloa5er2971.ocx
c:\windows\ze2thief9528.dll
c:\windows\zf6edownl9a5er2981.cpl
F:\Autorun.inf

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_SSDPSRVISSIMON
-------\Service_SSDPSRVISSIMon


((((((((((((((((((((((((( Files Created from 2009-05-03 to 2009-06-03 )))))))))))))))))))))))))))))))
.

2009-06-03 15:21 . 2009-06-03 20:59 117760 ----a-w- c:\documents and settings\Administrator\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
2009-06-03 15:20 . 2009-06-03 15:20 -------- d-----w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2009-06-03 15:20 . 2009-06-03 15:20 -------- d-----w- c:\program files\SUPERAntiSpyware
2009-06-03 15:20 . 2009-06-03 15:20 -------- d-----w- c:\documents and settings\Administrator\Application Data\SUPERAntiSpyware.com
2009-06-03 14:24 . 2009-06-03 14:24 -------- d-----w- c:\documents and settings\Administrator\Application Data\Malwarebytes
2009-06-03 14:24 . 2009-05-26 17:20 40160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-06-03 14:24 . 2009-06-03 14:24 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-06-03 14:24 . 2009-05-26 17:19 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-06-03 14:13 . 2009-06-03 14:13 -------- d-----w- C:\Quarentine
2009-06-02 14:22 . 2009-06-02 14:22 -------- d-----w- c:\program files\Trend Micro
2009-06-02 10:26 . 2009-06-03 14:24 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-05-27 23:58 . 2009-05-27 23:58 32 --s-a-w- c:\windows\system32\146893506.dat
2009-05-22 19:18 . 2009-05-22 08:00 259368 ----a-w- c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\I2_LDVP.VDB\vd2d6c02.vdb\ECMSVR32.DLL
2009-05-22 19:18 . 2009-02-12 23:04 876144 ----a-w- c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\I2_LDVP.VDB\vd2d6c02.vdb\NAVEX15.SYS
2009-05-22 19:18 . 2009-02-12 23:04 89104 ----a-w- c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\I2_LDVP.VDB\vd2d6c02.vdb\NAVENG.SYS
2009-05-22 19:18 . 2009-02-12 23:03 1181040 ----a-w- c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\I2_LDVP.VDB\vd2d6c02.vdb\NAVEX32A.DLL
2009-05-22 19:18 . 2009-02-12 23:03 177520 ----a-w- c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\I2_LDVP.VDB\vd2d6c02.vdb\NAVENG32.DLL
2009-05-22 19:18 . 2009-02-06 19:26 101936 ----a-w- c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\I2_LDVP.VDB\vd2d6c02.vdb\ERASER.SYS
2009-05-22 19:18 . 2009-02-06 19:26 371248 ----a-w- c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\I2_LDVP.VDB\vd2d6c02.vdb\EECTRL.SYS
2009-05-22 19:18 . 2009-02-18 19:41 2414128 ----a-w- c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\I2_LDVP.VDB\vd2d6c02.vdb\CCERASER.DLL
2009-05-21 12:44 . 2009-05-21 12:44 -------- d-----w- c:\program files\Microsoft
2009-05-20 03:46 . 2009-05-20 03:46 -------- d-----w- c:\windows\Sun
2009-05-19 21:39 . 2009-05-19 21:39 410984 ----a-w- c:\windows\system32\deploytk.dll
2009-05-19 21:38 . 2009-05-19 21:38 -------- d-----w- c:\program files\Java
2009-05-19 21:38 . 2009-05-19 21:38 152576 ----a-w- c:\documents and settings\Administrator\Application Data\Sun\Java\jre1.6.0_13\lzma.dll
2009-05-18 22:45 . 2009-05-18 22:45 -------- d-----w- c:\documents and settings\All Users\Application Data\Kodak

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2020-02-17 19:53 . 1922-01-02 09:45 98304 ----a-w- c:\windows\system32\TPMDDL.dll
2020-02-17 19:53 . 1921-09-08 15:58 15872 ----a-w- c:\windows\system32\drivers\atmeltpm.sys
2015-04-12 04:06 . 1908-05-18 13:18 23552 ----a-w- c:\windows\system32\PostProc.dll
2009-06-03 20:59 . 2009-01-26 17:37 -------- d-----w- c:\documents and settings\Administrator\Application Data\Skype
2009-06-03 20:56 . 2005-04-05 17:21 -------- d-----w- c:\program files\C4ebreg
2009-06-03 20:54 . 2007-04-02 13:57 40 ----a-w- c:\windows\system32\profile.dat
2009-06-03 17:13 . 2006-03-27 21:50 -------- d-----w- c:\program files\WST
2009-06-03 16:07 . 2006-01-24 00:45 -------- d-----w- c:\program files\Common Files\Symantec Shared
2009-06-03 14:34 . 2009-01-26 17:41 -------- d-----w- c:\documents and settings\Administrator\Application Data\skypePM
2009-05-25 18:20 . 2007-09-20 13:04 -------- d-----w- c:\program files\Google
2009-05-17 15:45 . 2006-12-11 13:33 -------- d-----w- c:\program files\AT&T Network Client
2009-05-17 15:32 . 2009-04-08 12:49 0 ----a-w- c:\windows\Hsuruja.bin
2009-04-30 18:34 . 2009-04-14 18:08 112072 ----a-w- c:\documents and settings\Administrator\Application Data\WDPlugin\wd_hook81.dll
2009-04-30 18:34 . 2009-04-14 18:08 197992 ----a-w- c:\documents and settings\Administrator\Application Data\WDPlugin\wdappview82.dll
2009-04-17 12:07 . 2009-04-17 12:07 0 ----a-w- c:\windows\Hsuruja.binHsuruja.bin
2009-04-15 16:35 . 2009-04-08 12:49 408 ----a-w- c:\windows\Vxewulaqocuba.dat
2009-04-14 18:08 . 2009-04-14 18:08 -------- d-----w- c:\documents and settings\Administrator\Application Data\WDPlugin
2009-03-20 19:26 . 2005-07-29 18:05 64752 ----a-w- c:\windows\isamunin.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2008-11-18 21633320]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2009-05-26 1830128]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TPKMAPHELPER"="c:\program files\ThinkPad\Utilities\TpKmapAp.exe" [2006-06-02 856064]
"TPHOTKEY"="c:\progra~1\Lenovo\PkgMgr\HOTKEY\TPHKMGR.exe" [2006-07-25 94208]
"Tpam.exe"="c:\program files\IBM\Personal Communications\tpam.exe" [2005-09-06 28672]
"SynTPLpr"="c:\program files\Synaptics\SynTP\SynTPLpr.exe" [2006-02-14 110592]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-02-14 512000]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-05-19 148888]
"stgclean"="c:\sdwork\w32main2.exe" [2009-06-01 298496]
"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [1951-09-04 925696]
"PWRMGRTR"="c:\progra~1\ThinkPad\UTILIT~1\PWRMGRTR.DLL" [2006-05-26 151552]
"pmonmh"="c:\program files\IBM\My Help\plugins\\com.ibm.myhelp.common_1.4.19/pmonmh.exe" [2009-03-13 184371]
"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168]
"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168]
"MyHelpService"="c:\program files\IBM\My Help\workspace\service\delayStart.exe" [2009-03-13 94208]
"Microsoft Default Manager"="c:\program files\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" [2009-02-03 233304]
"Lexmark X6100 Series"="c:\program files\Lexmark X6100 Series\lxbfbmgr.exe" [2003-09-23 57344]
"ISSI Service"="c:\sdwork\issimsvc.exe" [2009-06-01 242928]
"ISAMTray"="c:\program files\C4ebreg\isamtray.exe" [2009-03-20 265456]
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-04 208952]
"igfxtray"="c:\windows\system32\igfxtray.exe" [2014-05-15 98304]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2014-05-15 118784]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2014-05-15 77824]
"dla"="c:\windows\system32\dla\tfswctrl.exe" [2004-11-16 127035]
"ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2006-07-19 52896]
"C4EBReg"="c:\program files\C4ebreg\c4ebreg.exe" [2009-03-20 417008]
"BLOG"="c:\progra~1\ThinkPad\UTILIT~1\BatLogEx.DLL" [2006-05-26 208896]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-12 39792]
"ACWLIcon"="c:\program files\ThinkPad\ConnectUtilities\ACWLIcon.exe" [2006-04-17 98304]
"ACTray"="c:\program files\ThinkPad\ConnectUtilities\ACTray.exe" [2006-04-17 409600]
"TpShocks"="TpShocks.exe" - c:\windows\system32\TpShocks.exe [2006-03-15 106496]
"TP4EX"="tp4ex.exe" - c:\windows\system32\TP4EX.exe [2005-10-17 65536]
"BluetoothAuthenticationAgent"="bthprops.cpl" - c:\windows\system32\bthprops.cpl [2004-08-04 110592]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Bluetooth.lnk - c:\program files\ThinkPad\Bluetooth Software\BTTray.exe [2006-8-1 622653]
Infoprint Select Notification.lnk - c:\program files\IBM\Infoprint Select\ipnotify.exe [2005-4-5 143360]
Lotus QuickStart.lnk - c:\lotus\wordpro\ltsstart.exe [2003-4-7 32768]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"NoDispBackgroundPage"= 1 (0x1)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoDevMgrUpdate"= 1 (0x1)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-12-22 16:05 356352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ACNotify]
2006-04-17 13:01 32768 ----a-w- c:\program files\ThinkPad\ConnectUtilities\ACNotify.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\atmgrtok]
2005-09-06 09:07 53248 ----a-w- c:\program files\IBM\Personal Communications\atmgrtok.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\pcsinst]
2005-09-06 18:43 49152 ----a-w- c:\windows\system32\pcsinst.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tpfnf2]
2005-07-06 00:00 28672 ----a-w- c:\windows\system32\notifyf2.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tphotkey]
2005-12-01 00:00 24576 ----a-w- c:\windows\system32\tphklock.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"IBMconfig"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\IBM\\Infoprint Select\\ipnotify.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundTimestampRequest"= 1 (0x1)
"AllowInboundMaskRequest"= 1 (0x1)
"AllowInboundRouterRequest"= 1 (0x1)

Mr Blint
Novice
Novice

Posts Posts : 11
Joined Joined : 2009-06-03
OS OS : Win XP sp2
Points Points : 27423
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Another Winbluesoft victim

Post by Mr Blint on Wed Jun 03, 2009 9:24 pm

R0 Shockprf;Shockprf;c:\windows\system32\drivers\shockprf.sys [12/11/2006 9:32 AM 88576]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [5/26/2009 10:05 AM 9968]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [5/26/2009 10:05 AM 72944]
R1 ShockMgr;ShockMgr;c:\windows\system32\drivers\ShockMgr.sys [12/11/2006 9:32 AM 4736]
R1 TPPWRIF;TPPWRIF;c:\windows\system32\drivers\TPPWRIF.SYS [12/11/2006 9:31 AM 4442]
R2 AppnApi;AppnApi;c:\windows\system32\drivers\appnapi.sys [9/6/2005 5:07 AM 120192]
R2 DCDClient-ISSI;IBM DCD Standard Client (DCDClient-ISSI);c:\program files\IBM\tivoli\dcd\client\ISSI\cds\CDSWinSrv.exe [8/6/2008 12:29 PM 53248]
R2 IBM_LLC2;IBM Personal Communications LLC2 Driver;c:\windows\system32\drivers\llc2.sys [9/6/2005 5:07 AM 101408]
R2 ISAMSvc;IBM Standard Asset Manager Service;c:\program files\C4ebreg\c4ebreg.exe [3/20/2009 3:25 PM 417008]
R2 NsTrcNT;NsTrcNT;c:\windows\system32\drivers\nstrcnt.sys [9/6/2005 5:07 AM 12028]
R2 pdlnctdl;Twinax CUT Adapter;c:\windows\system32\drivers\pdlnctdl.sys [9/6/2005 5:07 AM 12288]
R2 pdlndldl;IBM Enterprise Extender (HPR/IP);c:\windows\system32\drivers\pdlndldl.sys [9/6/2005 5:07 AM 59392]
R2 SavRoam;SAVRoam;c:\program files\Symantec Client Security\Symantec AntiVirus\SavRoam.exe [9/27/2006 8:33 PM 116464]
R3 ABVPN2K;Net Firewall Miniport Interface;c:\windows\system32\drivers\abvpn2k.sys [12/11/2006 9:34 AM 164224]
R3 Anydlc;Anydlc;c:\windows\system32\drivers\anydlc.sys [9/6/2005 5:07 AM 38236]
R3 Appn;Appn;c:\windows\system32\drivers\appn.sys [9/6/2005 5:07 AM 1286560]
R3 AppnBase;AppnBase;c:\windows\system32\drivers\appnbase.sys [9/6/2005 5:07 AM 195872]
R3 avpnnic;AGN Virtual Network Adapter;c:\windows\system32\drivers\avpnnic.sys [12/11/2006 9:33 AM 13952]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2/26/2009 6:50 PM 101936]
R3 KLOGNT;KLOGNT;c:\windows\system32\drivers\klognt.sys [9/6/2005 5:07 AM 24588]
R3 pdlnacom;PDLC Adapter -- COM;c:\windows\system32\drivers\pdlnacom.sys [9/6/2005 5:07 AM 75200]
R3 pdlnafac;PDLC Adapter Factory;c:\windows\system32\drivers\pdlnafac.sys [9/6/2005 5:07 AM 36048]
R3 pdlnatcm;Twinax Adapter Common;c:\windows\system32\drivers\pdlnatcm.sys [9/6/2005 5:07 AM 20480]
R3 pdlnatdl;Twinax Adapter;c:\windows\system32\drivers\pdlnatdl.sys [9/6/2005 5:07 AM 18432]
R3 pdlncbas;PDLC CxM Classes;c:\windows\system32\drivers\pdlncbas.sys [9/6/2005 5:07 AM 6784]
R3 pdlncfwk;PDLC Connection Manager;c:\windows\system32\drivers\pdlncfwk.sys [9/6/2005 5:07 AM 160288]
R3 pdlndint;PDLC DLC Classes;c:\windows\system32\drivers\pdlndint.sys [9/6/2005 5:07 AM 12800]
R3 pdlndlpb;PDLC LAPB;c:\windows\system32\drivers\pdlndlpb.sys [9/6/2005 5:07 AM 70144]
R3 pdlndoem;PDLC OEM Interface;c:\windows\system32\drivers\pdlndoem.sys [9/6/2005 5:07 AM 18944]
R3 pdlndqll;PDLC QLLC;c:\windows\system32\drivers\pdlndqll.sys [9/6/2005 5:07 AM 53248]
R3 pdlndsdl;PDLC SDLC;c:\windows\system32\drivers\pdlndsdl.sys [9/6/2005 5:07 AM 67072]
R3 pdlndtdl;Twinax DLC;c:\windows\system32\drivers\pdlndtdl.sys [9/6/2005 5:07 AM 51712]
R3 pdlnebas;PDLC Environment;c:\windows\system32\drivers\pdlnebas.sys [9/6/2005 5:07 AM 8608]
R3 pdlnecfg;PDLC Configuration;c:\windows\system32\drivers\pdlnecfg.sys [9/6/2005 5:07 AM 50336]
R3 pdlnemap;PDLC Mapper;c:\windows\system32\drivers\pdlnemap.sys [9/6/2005 5:07 AM 67184]
R3 pdlnemsg;PDLC Message Driver;c:\windows\system32\drivers\pdlnemsg.sys [9/6/2005 5:07 AM 12768]
R3 pdlnepkt;PDLC Buffer Manager;c:\windows\system32\drivers\pdlnepkt.sys [9/6/2005 5:07 AM 19984]
R3 pdlnshay;PDLC Hayes At signalling;c:\windows\system32\drivers\pdlnshay.sys [9/6/2005 5:07 AM 59504]
R3 pdlnslea;PDLC SDLC Leased;c:\windows\system32\drivers\pdlnslea.sys [9/6/2005 5:07 AM 22384]
R3 pdlnsv25;PDLC V25bis signalling;c:\windows\system32\drivers\pdlnsv25.sys [9/6/2005 5:07 AM 54416]
R3 pdlnsx25;PDLC X.25;c:\windows\system32\drivers\pdlnsx25.sys [9/6/2005 5:07 AM 58432]
R3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [5/26/2009 10:05 AM 7408]
S2 gaovyosjray;gaovyosjray;c:\windows\System32\svchost.exe -k netsvcs [8/4/2004 1:00 AM 14336]
S3 el575nd5;FE575C-3Com 10/100 LAN CardBus PC Card Driver;c:\windows\system32\drivers\el575ND5.sys [6/2/1920 12:52 PM 61021]
S3 gwiopm;gwiopm;\??\c:\program files\wst\gwiopm.sys --> c:\program files\wst\gwiopm.sys [?]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
gaovyosjray
.
Contents of the 'Scheduled Tasks' folder

2009-06-03 c:\windows\Tasks\PMTask.job
- c:\progra~1\ThinkPad\UTILIT~1\PWMIDTSK.EXE [2006-12-11 00:00]
.
- - - - ORPHANS REMOVED - - - -

HKLM-Run-PSQLLauncher - c:\program files\Thinkvantage Fingerprint Software\launcher.exe
HKLM-Run-ISAM SMT Service - c:\program files\C4ebreg\isamsmt.exe
HKLM-Run-Google Desktop Search - c:\program files\Google\Google Desktop Search\GoogleDesktop.exe
SafeBoot-procexp90.Sys


.
------- Supplementary Scan -------
.
uStart Page = [You must be registered and logged in to see this link.]
uInternet Connection Wizard,ShellNext = [You must be registered and logged in to see this link.]
uInternet Settings,ProxyServer = proxy.att.com:8000
uInternet Settings,ProxyOverride = *ibm.com;
uSearchURL,(Default) = [You must be registered and logged in to see this link.]
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
IE: Send to &Bluetooth Device... - c:\program files\ThinkPad\Bluetooth Software\btsendto_ie_ctx.htm
DPF: Microsoft XML Parser for Java - [You must be registered and logged in to see this link.]
DPF: {9519B2A2-6592-4E41-8290-D0298459270C} - [You must be registered and logged in to see this link.]
DPF: {A4B28810-11A2-4956-82D1-B2DCBA4B2AFD} - [You must be registered and logged in to see this link.]
DPF: {CAD4ADEB-C52B-4E83-A7D1-9C75E022ECCC} - [You must be registered and logged in to see this link.]
FF - ProfilePath - c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4mhp4cbb.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - [You must be registered and logged in to see this link.]
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, [You must be registered and logged in to see this link.]
Rootkit scan 2009-06-03 16:57
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...


c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4mhp4cbb.default\StumbleUpon\favicons\houwebpas02 : WEB-P-GPortal-E-HOUWEBPAS02-9075.ico 15166 bytes hidden from API

scan completed successfully
hidden files: 1

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(984)
c:\program files\SUPERAntiSpyware\SASWINLO.dll
c:\program files\ThinkPad\ConnectUtilities\ACNotify.dll
c:\program files\ThinkPad\ConnectUtilities\AcSvcStub.dll
c:\program files\ThinkPad\ConnectUtilities\AcLocSettings.dll
c:\program files\ThinkPad\ConnectUtilities\ACHelper.dll
c:\windows\system32\MPR.dll
c:\windows\system32\tphklock.dll
c:\program files\IBM\Personal Communications\atmgrtok.dll
c:\program files\IBM\Personal Communications\MILLUTIL.DLL
c:\windows\system32\pcsinst.dll

- - - - - - - > 'explorer.exe'(3236)
c:\windows\system32\msi.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\btncopy.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\ibmpmsvc.exe
c:\program files\ThinkPad\Bluetooth Software\bin\btwdins.exe
c:\program files\Common Files\Symantec Shared\ccSetMgr.exe
c:\program files\Common Files\Symantec Shared\ccEvtMgr.exe
c:\program files\Common Files\Symantec Shared\ccProxy.exe
c:\program files\Symantec Client Security\Symantec Client Firewall\ISSVC.exe
c:\program files\Common Files\Symantec Shared\SNDSrvc.exe
c:\program files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
c:\windows\system32\LEXBCES.EXE
c:\windows\system32\LEXPPS.EXE
c:\windows\system32\drivers\trcboot.exe
c:\program files\IBM\Personal Communications\PCS_AGNT.EXE
c:\program files\ThinkPad\ConnectUtilities\AcPrfMgrSvc.exe
c:\program files\Symantec Client Security\Symantec AntiVirus\DefWatch.exe
c:\program files\Executive Software\DiskeeperWorkstation\DKService.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\notes\ntmulti.exe
c:\progra~1\AT&TNE~1\NetCfgSv.EXE
c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
c:\program files\Symantec Client Security\Symantec Client Firewall\SymSPort.exe
c:\windows\system32\TPHDEXLG.exe
c:\windows\system32\TpKmpSvc.exe
c:\windows\system32\drivers\ldlcserv.exe
c:\program files\ThinkPad\ConnectUtilities\AcSvc.exe
c:\program files\IBM\tivoli\dcd\client\ISSI\_jvm\jre\bin\java.exe
c:\windows\system32\acs.exe
c:\program files\ThinkPad\ConnectUtilities\SvcGuiHlpr.exe
c:\windows\system32\wscntfy.exe
c:\program files\Lenovo\PkgMgr\HOTKEY\TPONSCR.exe
c:\program files\Lenovo\PkgMgr\HOTKEY_1\TpScrex.exe
c:\windows\system32\rundll32.exe
c:\program files\IBM\My Help\plugins\com.ibm.myhelp.common_1.4.19\pmonmh.exe
c:\program files\Lexmark X6100 Series\lxbfbmon.exe
c:\windows\system32\rundll32.exe
c:\progra~1\ThinkPad\BLUETO~1\BTSTAC~1.EXE
c:\program files\Skype\Plugin Manager\skypePM.exe
.
**************************************************************************
.
Completion time: 2009-06-03 17:02 - machine was rebooted
ComboFix-quarantined-files.txt 2009-06-03 21:02

Pre-Run: 39,906,443,264 bytes free
Post-Run: 39,993,126,912 bytes free

1056

Mr Blint
Novice
Novice

Posts Posts : 11
Joined Joined : 2009-06-03
OS OS : Win XP sp2
Points Points : 27423
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Another Winbluesoft victim

Post by Belahzur on Wed Jun 03, 2009 9:27 pm

Now open a new notepad file.
Input this into the notepad file:

KILLALL::

Driver::
gaovyosjray
gwiopm

File::
c:\windows\system32\146893506.dat
c:\windows\Vxewulaqocuba.dat
c:\windows\Hsuruja.binHsuruja.bin
c:\windows\Hsuruja.bin

NetSvc::
gaovyosjray

Save this as CFScript.txt, save it to your desktop also.
Then drag and drop CFScript.txt into combofix as seen below:


This will open combofix again, agree to it's terms and allow it to run.
It may want to reboot after it's done. (It will warn you if it wants to)
Post the resulting log back here.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34916
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : XP SP3 Media Centre
Points Points : 245049
# Likes # Likes : 1

View user profile

Back to top Go down

Re: Another Winbluesoft victim

Post by Mr Blint on Wed Jun 03, 2009 10:08 pm

ComboFix 09-06-03.01 - meckhard 06/03/2009 17:42.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.2038.1314 [GMT -4:00]
Running from: c:\documents and settings\Administrator\Desktop\Combo-Fix.exe
Command switches used :: c:\documents and settings\Administrator\Desktop\CFScript.txt
AV: Symantec AntiVirus Corporate Edition *On-access scanning disabled* (Updated) {FB06448E-52B8-493A-90F3-E43226D3305C}
FW: Symantec Client Firewall *disabled* {5CB76A43-5FAD-476B-B9FF-26FA61F13187}

FILE ::
"c:\windows\Hsuruja.bin"
"c:\windows\Hsuruja.binHsuruja.bin"
"c:\windows\system32\146893506.dat"
"c:\windows\Vxewulaqocuba.dat"
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\Hsuruja.bin
c:\windows\Hsuruja.binHsuruja.bin
c:\windows\system32\146893506.dat
c:\windows\Vxewulaqocuba.dat

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_GAOVYOSJRAY
-------\Legacy_GWIOPM
-------\Service_gaovyosjray
-------\Service_gwiopm


((((((((((((((((((((((((( Files Created from 2009-05-03 to 2009-06-03 )))))))))))))))))))))))))))))))
.

2009-06-03 15:21 . 2009-06-03 21:59 117760 ----a-w- c:\documents and settings\Administrator\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
2009-06-03 15:20 . 2009-06-03 15:20 -------- d-----w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2009-06-03 15:20 . 2009-06-03 15:20 -------- d-----w- c:\program files\SUPERAntiSpyware
2009-06-03 15:20 . 2009-06-03 15:20 -------- d-----w- c:\documents and settings\Administrator\Application Data\SUPERAntiSpyware.com
2009-06-03 14:24 . 2009-06-03 14:24 -------- d-----w- c:\documents and settings\Administrator\Application Data\Malwarebytes
2009-06-03 14:24 . 2009-05-26 17:20 40160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-06-03 14:24 . 2009-06-03 14:24 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-06-03 14:24 . 2009-05-26 17:19 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-06-03 14:13 . 2009-06-03 14:13 -------- d-----w- C:\Quarentine
2009-06-02 14:22 . 2009-06-02 14:22 -------- d-----w- c:\program files\Trend Micro
2009-06-02 10:26 . 2009-06-03 14:24 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-05-22 19:18 . 2009-05-22 08:00 259368 ----a-w- c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\I2_LDVP.VDB\vd2d6c02.vdb\ECMSVR32.DLL
2009-05-22 19:18 . 2009-02-12 23:04 876144 ----a-w- c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\I2_LDVP.VDB\vd2d6c02.vdb\NAVEX15.SYS
2009-05-22 19:18 . 2009-02-12 23:04 89104 ----a-w- c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\I2_LDVP.VDB\vd2d6c02.vdb\NAVENG.SYS
2009-05-22 19:18 . 2009-02-12 23:03 1181040 ----a-w- c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\I2_LDVP.VDB\vd2d6c02.vdb\NAVEX32A.DLL
2009-05-22 19:18 . 2009-02-12 23:03 177520 ----a-w- c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\I2_LDVP.VDB\vd2d6c02.vdb\NAVENG32.DLL
2009-05-22 19:18 . 2009-02-06 19:26 101936 ----a-w- c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\I2_LDVP.VDB\vd2d6c02.vdb\ERASER.SYS
2009-05-22 19:18 . 2009-02-06 19:26 371248 ----a-w- c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\I2_LDVP.VDB\vd2d6c02.vdb\EECTRL.SYS
2009-05-22 19:18 . 2009-02-18 19:41 2414128 ----a-w- c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\I2_LDVP.VDB\vd2d6c02.vdb\CCERASER.DLL
2009-05-21 12:44 . 2009-05-21 12:44 -------- d-----w- c:\program files\Microsoft
2009-05-20 03:46 . 2009-05-20 03:46 -------- d-----w- c:\windows\Sun
2009-05-19 21:39 . 2009-05-19 21:39 410984 ----a-w- c:\windows\system32\deploytk.dll
2009-05-19 21:38 . 2009-05-19 21:38 -------- d-----w- c:\program files\Java
2009-05-19 21:38 . 2009-05-19 21:38 152576 ----a-w- c:\documents and settings\Administrator\Application Data\Sun\Java\jre1.6.0_13\lzma.dll
2009-05-18 22:45 . 2009-05-18 22:45 -------- d-----w- c:\documents and settings\All Users\Application Data\Kodak

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2020-02-17 19:53 . 1922-01-02 09:45 98304 ----a-w- c:\windows\system32\TPMDDL.dll
2020-02-17 19:53 . 1921-09-08 15:58 15872 ----a-w- c:\windows\system32\drivers\atmeltpm.sys
2015-04-12 04:06 . 1908-05-18 13:18 23552 ----a-w- c:\windows\system32\PostProc.dll
2009-06-03 21:48 . 2005-04-05 17:21 -------- d-----w- c:\program files\C4ebreg
2009-06-03 21:42 . 2007-04-02 13:57 40 ----a-w- c:\windows\system32\profile.dat
2009-06-03 21:23 . 2009-01-26 17:37 -------- d-----w- c:\documents and settings\Administrator\Application Data\Skype
2009-06-03 21:02 . 2006-01-24 00:45 -------- d-----w- c:\program files\Common Files\Symantec Shared
2009-06-03 17:13 . 2006-03-27 21:50 -------- d-----w- c:\program files\WST
2009-06-03 14:34 . 2009-01-26 17:41 -------- d-----w- c:\documents and settings\Administrator\Application Data\skypePM
2009-05-25 18:20 . 2007-09-20 13:04 -------- d-----w- c:\program files\Google
2009-05-17 15:45 . 2006-12-11 13:33 -------- d-----w- c:\program files\AT&T Network Client
2009-04-30 18:34 . 2009-04-14 18:08 112072 ----a-w- c:\documents and settings\Administrator\Application Data\WDPlugin\wd_hook81.dll
2009-04-30 18:34 . 2009-04-14 18:08 197992 ----a-w- c:\documents and settings\Administrator\Application Data\WDPlugin\wdappview82.dll
2009-04-14 18:08 . 2009-04-14 18:08 -------- d-----w- c:\documents and settings\Administrator\Application Data\WDPlugin
2009-03-20 19:26 . 2005-07-29 18:05 64752 ----a-w- c:\windows\isamunin.exe
.

((((((((((((((((((((((((((((( [You must be registered and logged in to see this link.] )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-06-03 21:49 . 2009-06-03 21:49 16384 c:\windows\temp\Perflib_Perfdata_580.dat
+ 2009-06-03 21:49 . 2009-06-03 21:49 16384 c:\windows\temp\Perflib_Perfdata_4dc.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2008-11-18 21633320]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2009-05-26 1830128]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TPKMAPHELPER"="c:\program files\ThinkPad\Utilities\TpKmapAp.exe" [2006-06-02 856064]
"TPHOTKEY"="c:\progra~1\Lenovo\PkgMgr\HOTKEY\TPHKMGR.exe" [2006-07-25 94208]
"Tpam.exe"="c:\program files\IBM\Personal Communications\tpam.exe" [2005-09-06 28672]
"SynTPLpr"="c:\program files\Synaptics\SynTP\SynTPLpr.exe" [2006-02-14 110592]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-02-14 512000]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-05-19 148888]
"stgclean"="c:\sdwork\w32main2.exe" [2009-06-01 298496]
"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [1951-09-04 925696]
"PWRMGRTR"="c:\progra~1\ThinkPad\UTILIT~1\PWRMGRTR.DLL" [2006-05-26 151552]
"pmonmh"="c:\program files\IBM\My Help\plugins\\com.ibm.myhelp.common_1.4.19/pmonmh.exe" [2009-03-13 184371]
"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168]
"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168]
"MyHelpService"="c:\program files\IBM\My Help\workspace\service\delayStart.exe" [2009-03-13 94208]
"Microsoft Default Manager"="c:\program files\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" [2009-02-03 233304]
"Lexmark X6100 Series"="c:\program files\Lexmark X6100 Series\lxbfbmgr.exe" [2003-09-23 57344]
"ISSI Service"="c:\sdwork\issimsvc.exe" [2009-06-01 242928]
"ISAMTray"="c:\program files\C4ebreg\isamtray.exe" [2009-03-20 265456]
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-04 208952]
"igfxtray"="c:\windows\system32\igfxtray.exe" [2014-05-15 98304]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2014-05-15 118784]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2014-05-15 77824]
"dla"="c:\windows\system32\dla\tfswctrl.exe" [2004-11-16 127035]
"ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2006-07-19 52896]
"C4EBReg"="c:\program files\C4ebreg\c4ebreg.exe" [2009-03-20 417008]
"BLOG"="c:\progra~1\ThinkPad\UTILIT~1\BatLogEx.DLL" [2006-05-26 208896]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-12 39792]
"ACWLIcon"="c:\program files\ThinkPad\ConnectUtilities\ACWLIcon.exe" [2006-04-17 98304]
"ACTray"="c:\program files\ThinkPad\ConnectUtilities\ACTray.exe" [2006-04-17 409600]
"TpShocks"="TpShocks.exe" - c:\windows\system32\TpShocks.exe [2006-03-15 106496]
"TP4EX"="tp4ex.exe" - c:\windows\system32\TP4EX.exe [2005-10-17 65536]
"BluetoothAuthenticationAgent"="bthprops.cpl" - c:\windows\system32\bthprops.cpl [2004-08-04 110592]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Bluetooth.lnk - c:\program files\ThinkPad\Bluetooth Software\BTTray.exe [2006-8-1 622653]
Infoprint Select Notification.lnk - c:\program files\IBM\Infoprint Select\ipnotify.exe [2005-4-5 143360]
Lotus QuickStart.lnk - c:\lotus\wordpro\ltsstart.exe [2003-4-7 32768]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"NoDispBackgroundPage"= 1 (0x1)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoDevMgrUpdate"= 1 (0x1)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-12-22 16:05 356352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ACNotify]
2006-04-17 13:01 32768 ----a-w- c:\program files\ThinkPad\ConnectUtilities\ACNotify.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\atmgrtok]
2005-09-06 09:07 53248 ----a-w- c:\program files\IBM\Personal Communications\atmgrtok.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\pcsinst]
2005-09-06 18:43 49152 ----a-w- c:\windows\system32\pcsinst.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tpfnf2]
2005-07-06 00:00 28672 ----a-w- c:\windows\system32\notifyf2.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tphotkey]
2005-12-01 00:00 24576 ----a-w- c:\windows\system32\tphklock.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"IBMconfig"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\IBM\\Infoprint Select\\ipnotify.exe"=
"c:\\Program Files\\IBM\\My Help\\jre\\bin\\myhelpw.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundTimestampRequest"= 1 (0x1)
"AllowInboundMaskRequest"= 1 (0x1)
"AllowInboundRouterRequest"= 1 (0x1)

Mr Blint
Novice
Novice

Posts Posts : 11
Joined Joined : 2009-06-03
OS OS : Win XP sp2
Points Points : 27423
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Another Winbluesoft victim

Post by Mr Blint on Wed Jun 03, 2009 10:08 pm

R0 Shockprf;Shockprf;c:\windows\system32\drivers\shockprf.sys [12/11/2006 9:32 AM 88576]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [5/26/2009 10:05 AM 9968]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [5/26/2009 10:05 AM 72944]
R1 ShockMgr;ShockMgr;c:\windows\system32\drivers\ShockMgr.sys [12/11/2006 9:32 AM 4736]
R1 TPPWRIF;TPPWRIF;c:\windows\system32\drivers\TPPWRIF.SYS [12/11/2006 9:31 AM 4442]
R2 AppnApi;AppnApi;c:\windows\system32\drivers\appnapi.sys [9/6/2005 5:07 AM 120192]
R2 DCDClient-ISSI;IBM DCD Standard Client (DCDClient-ISSI);c:\program files\IBM\tivoli\dcd\client\ISSI\cds\CDSWinSrv.exe [8/6/2008 12:29 PM 53248]
R2 IBM_LLC2;IBM Personal Communications LLC2 Driver;c:\windows\system32\drivers\llc2.sys [9/6/2005 5:07 AM 101408]
R2 ISAMSvc;IBM Standard Asset Manager Service;c:\program files\C4ebreg\c4ebreg.exe [3/20/2009 3:25 PM 417008]
R2 NsTrcNT;NsTrcNT;c:\windows\system32\drivers\nstrcnt.sys [9/6/2005 5:07 AM 12028]
R2 pdlnctdl;Twinax CUT Adapter;c:\windows\system32\drivers\pdlnctdl.sys [9/6/2005 5:07 AM 12288]
R2 pdlndldl;IBM Enterprise Extender (HPR/IP);c:\windows\system32\drivers\pdlndldl.sys [9/6/2005 5:07 AM 59392]
R2 SavRoam;SAVRoam;c:\program files\Symantec Client Security\Symantec AntiVirus\SavRoam.exe [9/27/2006 8:33 PM 116464]
R3 ABVPN2K;Net Firewall Miniport Interface;c:\windows\system32\drivers\abvpn2k.sys [12/11/2006 9:34 AM 164224]
R3 Anydlc;Anydlc;c:\windows\system32\drivers\anydlc.sys [9/6/2005 5:07 AM 38236]
R3 Appn;Appn;c:\windows\system32\drivers\appn.sys [9/6/2005 5:07 AM 1286560]
R3 AppnBase;AppnBase;c:\windows\system32\drivers\appnbase.sys [9/6/2005 5:07 AM 195872]
R3 avpnnic;AGN Virtual Network Adapter;c:\windows\system32\drivers\avpnnic.sys [12/11/2006 9:33 AM 13952]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2/26/2009 6:50 PM 101936]
R3 KLOGNT;KLOGNT;c:\windows\system32\drivers\klognt.sys [9/6/2005 5:07 AM 24588]
R3 pdlnacom;PDLC Adapter -- COM;c:\windows\system32\drivers\pdlnacom.sys [9/6/2005 5:07 AM 75200]
R3 pdlnafac;PDLC Adapter Factory;c:\windows\system32\drivers\pdlnafac.sys [9/6/2005 5:07 AM 36048]
R3 pdlnatcm;Twinax Adapter Common;c:\windows\system32\drivers\pdlnatcm.sys [9/6/2005 5:07 AM 20480]
R3 pdlnatdl;Twinax Adapter;c:\windows\system32\drivers\pdlnatdl.sys [9/6/2005 5:07 AM 18432]
R3 pdlncbas;PDLC CxM Classes;c:\windows\system32\drivers\pdlncbas.sys [9/6/2005 5:07 AM 6784]
R3 pdlncfwk;PDLC Connection Manager;c:\windows\system32\drivers\pdlncfwk.sys [9/6/2005 5:07 AM 160288]
R3 pdlndint;PDLC DLC Classes;c:\windows\system32\drivers\pdlndint.sys [9/6/2005 5:07 AM 12800]
R3 pdlndlpb;PDLC LAPB;c:\windows\system32\drivers\pdlndlpb.sys [9/6/2005 5:07 AM 70144]
R3 pdlndoem;PDLC OEM Interface;c:\windows\system32\drivers\pdlndoem.sys [9/6/2005 5:07 AM 18944]
R3 pdlndqll;PDLC QLLC;c:\windows\system32\drivers\pdlndqll.sys [9/6/2005 5:07 AM 53248]
R3 pdlndsdl;PDLC SDLC;c:\windows\system32\drivers\pdlndsdl.sys [9/6/2005 5:07 AM 67072]
R3 pdlndtdl;Twinax DLC;c:\windows\system32\drivers\pdlndtdl.sys [9/6/2005 5:07 AM 51712]
R3 pdlnebas;PDLC Environment;c:\windows\system32\drivers\pdlnebas.sys [9/6/2005 5:07 AM 8608]
R3 pdlnecfg;PDLC Configuration;c:\windows\system32\drivers\pdlnecfg.sys [9/6/2005 5:07 AM 50336]
R3 pdlnemap;PDLC Mapper;c:\windows\system32\drivers\pdlnemap.sys [9/6/2005 5:07 AM 67184]
R3 pdlnemsg;PDLC Message Driver;c:\windows\system32\drivers\pdlnemsg.sys [9/6/2005 5:07 AM 12768]
R3 pdlnepkt;PDLC Buffer Manager;c:\windows\system32\drivers\pdlnepkt.sys [9/6/2005 5:07 AM 19984]
R3 pdlnshay;PDLC Hayes At signalling;c:\windows\system32\drivers\pdlnshay.sys [9/6/2005 5:07 AM 59504]
R3 pdlnslea;PDLC SDLC Leased;c:\windows\system32\drivers\pdlnslea.sys [9/6/2005 5:07 AM 22384]
R3 pdlnsv25;PDLC V25bis signalling;c:\windows\system32\drivers\pdlnsv25.sys [9/6/2005 5:07 AM 54416]
R3 pdlnsx25;PDLC X.25;c:\windows\system32\drivers\pdlnsx25.sys [9/6/2005 5:07 AM 58432]
R3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [5/26/2009 10:05 AM 7408]
S3 el575nd5;FE575C-3Com 10/100 LAN CardBus PC Card Driver;c:\windows\system32\drivers\el575ND5.sys [6/2/1920 12:52 PM 61021]
.
Contents of the 'Scheduled Tasks' folder

2009-06-03 c:\windows\Tasks\PMTask.job
- c:\progra~1\ThinkPad\UTILIT~1\PWMIDTSK.EXE [2006-12-11 00:00]
.
.
------- Supplementary Scan -------
.
uStart Page = [You must be registered and logged in to see this link.]
uInternet Connection Wizard,ShellNext = [You must be registered and logged in to see this link.]
uInternet Settings,ProxyServer = proxy.att.com:8000
uInternet Settings,ProxyOverride = *ibm.com;
uSearchURL,(Default) = [You must be registered and logged in to see this link.]
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
IE: Send to &Bluetooth Device... - c:\program files\ThinkPad\Bluetooth Software\btsendto_ie_ctx.htm
DPF: Microsoft XML Parser for Java - [You must be registered and logged in to see this link.]
DPF: {9519B2A2-6592-4E41-8290-D0298459270C} - [You must be registered and logged in to see this link.]
DPF: {A4B28810-11A2-4956-82D1-B2DCBA4B2AFD} - [You must be registered and logged in to see this link.]
DPF: {CAD4ADEB-C52B-4E83-A7D1-9C75E022ECCC} - [You must be registered and logged in to see this link.]
FF - ProfilePath - c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4mhp4cbb.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - [You must be registered and logged in to see this link.]
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, [You must be registered and logged in to see this link.]
Rootkit scan 2009-06-03 17:58
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...


c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4mhp4cbb.default\StumbleUpon\favicons\houwebpas02 : WEB-P-GPortal-E-HOUWEBPAS02-9075.ico 15166 bytes hidden from API

scan completed successfully
hidden files: 1

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(980)
c:\program files\SUPERAntiSpyware\SASWINLO.dll
c:\program files\ThinkPad\ConnectUtilities\ACNotify.dll
c:\program files\ThinkPad\ConnectUtilities\AcSvcStub.dll
c:\program files\ThinkPad\ConnectUtilities\AcLocSettings.dll
c:\program files\ThinkPad\ConnectUtilities\ACHelper.dll
c:\windows\system32\tphklock.dll
c:\program files\IBM\Personal Communications\atmgrtok.dll
c:\program files\IBM\Personal Communications\MILLUTIL.DLL
c:\windows\system32\pcsinst.dll

- - - - - - - > 'explorer.exe'(2060)
c:\windows\system32\msi.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\btncopy.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\ibmpmsvc.exe
c:\program files\ThinkPad\Bluetooth Software\bin\btwdins.exe
c:\program files\Common Files\Symantec Shared\ccSetMgr.exe
c:\program files\Common Files\Symantec Shared\ccEvtMgr.exe
c:\program files\Common Files\Symantec Shared\ccProxy.exe
c:\program files\Symantec Client Security\Symantec Client Firewall\ISSVC.exe
c:\program files\Common Files\Symantec Shared\SNDSrvc.exe
c:\program files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
c:\windows\system32\LEXBCES.EXE
c:\windows\system32\LEXPPS.EXE
c:\windows\system32\drivers\trcboot.exe
c:\program files\IBM\Personal Communications\PCS_AGNT.EXE
c:\program files\ThinkPad\ConnectUtilities\AcPrfMgrSvc.exe
c:\program files\Symantec Client Security\Symantec AntiVirus\DefWatch.exe
c:\program files\Executive Software\DiskeeperWorkstation\DKService.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\notes\ntmulti.exe
c:\progra~1\AT&TNE~1\NetCfgSv.EXE
c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
c:\program files\Symantec Client Security\Symantec Client Firewall\SymSPort.exe
c:\windows\system32\TPHDEXLG.exe
c:\windows\system32\TpKmpSvc.exe
c:\windows\system32\drivers\ldlcserv.exe
c:\program files\ThinkPad\ConnectUtilities\AcSvc.exe
c:\program files\IBM\tivoli\dcd\client\ISSI\_jvm\jre\bin\java.exe
c:\windows\system32\acs.exe
c:\program files\ThinkPad\ConnectUtilities\SvcGuiHlpr.exe
c:\windows\system32\wscntfy.exe
c:\program files\Lenovo\PkgMgr\HOTKEY\TPONSCR.exe
c:\program files\Lenovo\PkgMgr\HOTKEY_1\TpScrex.exe
c:\windows\system32\rundll32.exe
c:\program files\IBM\My Help\plugins\com.ibm.myhelp.common_1.4.19\pmonmh.exe
c:\program files\Lexmark X6100 Series\lxbfbmon.exe
c:\windows\system32\rundll32.exe
c:\progra~1\ThinkPad\BLUETO~1\BTSTAC~1.EXE
c:\program files\Skype\Plugin Manager\skypePM.exe
.
**************************************************************************
.
Completion time: 2009-06-03 18:03 - machine was rebooted
ComboFix-quarantined-files.txt 2009-06-03 22:03
ComboFix2.txt 2009-06-03 21:02

Pre-Run: 39,876,091,904 bytes free
Post-Run: 40,015,491,072 bytes free

296

Mr Blint
Novice
Novice

Posts Posts : 11
Joined Joined : 2009-06-03
OS OS : Win XP sp2
Points Points : 27423
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Another Winbluesoft victim

Post by Mr Blint on Wed Jun 03, 2009 10:08 pm

Looking much better now.

Mr Blint
Novice
Novice

Posts Posts : 11
Joined Joined : 2009-06-03
OS OS : Win XP sp2
Points Points : 27423
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Another Winbluesoft victim

Post by Belahzur on Wed Jun 03, 2009 10:25 pm

Click Start > Run and copy/paste the following bolded text into the Run box and click OK:

ComboFix /u



This will also reset your restore points.

How is the machine running now?


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34916
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : XP SP3 Media Centre
Points Points : 245049
# Likes # Likes : 1

View user profile

Back to top Go down

Re: Another Winbluesoft victim

Post by Mr Blint on Wed Jun 03, 2009 10:31 pm

Running normal again THANKS!

Mr Blint
Novice
Novice

Posts Posts : 11
Joined Joined : 2009-06-03
OS OS : Win XP sp2
Points Points : 27423
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Another Winbluesoft victim

Post by Belahzur on Wed Jun 03, 2009 10:35 pm

Need you to fix a leftover.

  • Now open a new notepad file.
  • Input this into the notepad file:

    Windows Registry Editor Version 5.00

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
    "NoDispBackgroundPage"=-
    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
    "NoDevMgrUpdate"=-

  • Save this as fix.reg, save it to your desktop.
  • Double click fix.reg to run it.
  • Select yes to the registry merge prompt.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34916
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : XP SP3 Media Centre
Points Points : 245049
# Likes # Likes : 1

View user profile

Back to top Go down

Re: Another Winbluesoft victim

Post by Mr Blint on Wed Jun 03, 2009 11:17 pm

Done and Thanks!

Mr Blint
Novice
Novice

Posts Posts : 11
Joined Joined : 2009-06-03
OS OS : Win XP sp2
Points Points : 27423
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Another Winbluesoft victim

Post by Belahzur on Thu Jun 04, 2009 12:38 am

Okay, this should be fine now.

Below I have included a number of recommendations for how to protect your computer in order to prevent future malware infections. Please take these recommendations seriously; these few simple steps can stave off the vast majority of spyware problems. As happy as we are to help you, for your sake we would rather not have repeat customers. Goofy

1) Please navigate to [You must be registered and logged in to see this link.] and download all the "critical updates" for Windows. This can patch many of the security holes through which attackers can gain access to your computer.

Please either enable Automatic Updates under Start -> Control Panel -> Automatic Updates , or get into the habit of checking for Windows updates regularly. I cannot stress enough how important this is.

2) In order to protect yourself against spyware, you should consider installing and running the following free programs:

[You must be registered and logged in to see this link.]
A tutorial on using Ad-Aware to remove spyware from your computer may be found [You must be registered and logged in to see this link.].

[You must be registered and logged in to see this link.]
A tutorial on using Spybot to remove spyware from your computer may be found [You must be registered and logged in to see this link.]. Please also remember to enable Spybot's "Immunize" and "TeaTimer" features.

[You must be registered and logged in to see this link.]
A tutorial on using SpywareBlaster to prevent spyware from ever installing on your computer may be found [You must be registered and logged in to see this link.].

[You must be registered and logged in to see this link.]
A tutorial on using SpywareGuard for realtime protection against spyware and hijackers may be found [You must be registered and logged in to see this link.].

Make sure to keep these programs up-to-date and to run them regularly, as this can prevent a great deal of spyware hassle.

3) Please consider using an alternate browser. Mozilla's Firefox browser is fantastic; it is much more secure than Internet Explorer, immune to almost all known browser hijackers, and also has the best built-in popup blocker (as an added benefit!) that I have ever seen. If you are interested, Firefox may be downloaded from here:
[You must be registered and logged in to see this link.]
I also recommand the following add-ons for Firefox, they will help keep you safe from malicious scripts or activeX exploits.
[You must be registered and logged in to see this link.]
[You must be registered and logged in to see this link.]
[You must be registered and logged in to see this link.]

4) Also make sure to run your antivirus software regularly, and to keep it up-to-date.

To help you keep your software updated, please considering using this free software program that will check for program updates.
[You must be registered and logged in to see this link.]

5) Finally, consider maintaining a firewall. Some good free firewalls are [You must be registered and logged in to see this link.], or
[You must be registered and logged in to see this link.]
A tutorial on understanding and using firewalls may be found [You must be registered and logged in to see this link.].

Please also read Tony Klein's excellent article: [You must be registered and logged in to see this link.]

If you would take a moment to fill out our feedback form, we would appreciate it.
The link can be found [You must be registered and logged in to see this link.].

Hopefully this should take care of your problems! Good luck. Big Grin


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34916
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : XP SP3 Media Centre
Points Points : 245049
# Likes # Likes : 1

View user profile

Back to top Go down

View previous topic View next topic Back to top

- Similar topics

 
Permissions in this forum:
You cannot reply to topics in this forum