System Security 2009, half removed

View previous topic View next topic Go down

System Security 2009, half removed

Post by mitam101 on 13th July 2009, 3:42 am

I had the same problem with System Security 2009.
I followed instructions on another website and got Malwarebyte's anti malware. I used that
to scan and remove alot of the virus's/trojans. When i start my computer up the System Security thing doesn't
come up anymore. But i can hear alot of random clicks and then random voices popping up. When i go to my processes
it shows that 3 - 4 Internet explorer processes are running. I will end them all, but in 10 minutes they're all back up again.
What can i do about this? This means i've only removed half of the virus?

Here is my HIJACKTHIS Log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:33:26 PM, on 7/12/2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
C:\WINDOWS\System32\rundll32.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32\Taskmgr.exe
C:\Program Files\Internet Explorer\Iexplore.exe
C:\Program Files\Internet Explorer\Iexplore.exe
C:\Users\Mitam\Downloads\winlogon.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = [You must be registered and logged in to see this link.]
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = [You must be registered and logged in to see this link.]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = [You must be registered and logged in to see this link.]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = [You must be registered and logged in to see this link.]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = [You must be registered and logged in to see this link.]
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = [You must be registered and logged in to see this link.]
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O4 - HKLM\..\Run: [hpWirelessAssistant] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
O4 - HKLM\..\Run: [WAWifiMessage] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\RunOnce: [Launcher] %WINDIR%\SMINST\launcher.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O8 - Extra context menu item: E&xport to Microsoft Excel - [You must be registered and logged in to see this link.]
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~1.0_0\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~1.0_0\bin\ssv.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra 'Tools' menuitem: @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O13 - Gopher Prefix:
O15 - Trusted Zone: *.antimalwareguard.com
O15 - Trusted Zone: *.gomyhit.com
O15 - Trusted Zone: *.antimalwareguard.com (HKLM)

mitam101
Novice
Novice

Posts Posts : 23
Joined Joined : 2009-07-13
OS OS : Windows Vista
Points Points : 27075
# Likes # Likes : 0

View user profile

Back to top Go down

Re: System Security 2009, half removed

Post by Belahzur on 13th July 2009, 3:38 pm

Hello.
The log is not complete, please post a full log.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34918
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : 7 Home Premium x64
Points Points : 245091
# Likes # Likes : 1

View user profile

Back to top Go down

Re: System Security 2009, half removed

Post by mitam101 on 13th July 2009, 5:44 pm

My fault:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:33:26 PM, on 7/12/2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
C:\WINDOWS\System32\rundll32.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32\Taskmgr.exe
C:\Program Files\Internet Explorer\Iexplore.exe
C:\Program Files\Internet Explorer\Iexplore.exe
C:\Users\Mitam\Downloads\winlogon.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = [You must be registered and logged in to see this link.]
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = [You must be registered and logged in to see this link.]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = [You must be registered and logged in to see this link.]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = [You must be registered and logged in to see this link.]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = [You must be registered and logged in to see this link.]
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = [You must be registered and logged in to see this link.]
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O4 - HKLM\..\Run: [hpWirelessAssistant] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
O4 - HKLM\..\Run: [WAWifiMessage] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\RunOnce: [Launcher] %WINDIR%\SMINST\launcher.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O8 - Extra context menu item: E&xport to Microsoft Excel - [You must be registered and logged in to see this link.]
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~1.0_0\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~1.0_0\bin\ssv.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra 'Tools' menuitem: @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O13 - Gopher Prefix:
O15 - Trusted Zone: *.antimalwareguard.com
O15 - Trusted Zone: *.gomyhit.com
O15 - Trusted Zone: *.antimalwareguard.com (HKLM)
O15 - Trusted Zone: *.gomyhit.com (HKLM)
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\CLSched.exe
O23 - Service: Com4Qlb - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4Qlb.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Roxio\Roxio MyDVD Basic v9\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Intuit Update Service (IntuitUpdateService) - Intuit Inc. - C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe
O23 - Service: stllssvr - Unknown owner - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe (file missing)
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

--
End of file - 6221 bytes

mitam101
Novice
Novice

Posts Posts : 23
Joined Joined : 2009-07-13
OS OS : Windows Vista
Points Points : 27075
# Likes # Likes : 0

View user profile

Back to top Go down

Re: System Security 2009, half removed

Post by Origin on 13th July 2009, 5:55 pm

Hello mitam101,

Welcome to Geek Police, my name is Origin and I will be helping you today. Please keep the following in mind:

  • If you do not get a reply from me or another helper within 2 days, please reply to your topic with the phrase BUMP
  • If you have any cracked/pirated software in your computer delete them or we will not help you.
  • Only follow advise from Geek Police Staff and not a regular member.
  • Do NOT run any tool without Geek Police supervision as it could hinder your system useless.



  • Open HijackThis.
  • Choose "Do a system scan only"
  • Check the boxes in front of these lines:


    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
    O1 - Hosts: ::1 localhost
    O15 - Trusted Zone: *.antimalwareguard.com
    O15 - Trusted Zone: *.gomyhit.com
    O15 - Trusted Zone: *.antimalwareguard.com (HKLM)
    O15 - Trusted Zone: *.gomyhit.com (HKLM)
    O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe


  • Press "Fix Checked"
  • Close Hijack This.


Please download and run this tool.

Download Malwarebytes' Anti-Malware from [You must be registered and logged in to see this link.]

Double Click mbam-setup.exe to install the application.

  • Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select "Perform Quick Scan", then click Scan.
  • The scan may take some time to finish,so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected.
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Note:
If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts.
Click OK to either and let MBAM proceed with the disinfection process.
If asked to restart the computer, please do so immediately.


Post the contents of the MBAM Log.


While my help is always free, please consider donating to keep this site alive: [You must be registered and logged in to see this link.]

[You must be registered and logged in to see this link.]

Origin
Master
Master

Posts Posts : 2685
Joined Joined : 2009-05-05
Gender Gender : Male
OS OS : Windows Xp Sp3
Points Points : 31503
# Likes # Likes : 0

View user profile

Back to top Go down

Re: System Security 2009, half removed

Post by mitam101 on 13th July 2009, 9:37 pm

Okay, so i followed the above steps.
1st - The computer wouldn't let me isntall the antivirus software. I clicked the install file, but it wouldn't run.
2nd - I changed the file name to winlogon.exe moved it to my desktop and then it installed the program. I had to also change the program name to winlogon.exe for me to run it. I updated it, and ran the scan and it found virus's/deleted some and i also restarted the computer.

Here is the log from the Anti-Virus software:

Malwarebytes' Anti-Malware 1.38
Database version: 2420
Windows 6.0.6001 Service Pack 1

7/13/2009 4:31:08 PM
mbam-log-2009-07-13 (16-31-08).txt

Scan type: Quick Scan
Objects scanned: 78172
Time elapsed: 3 minute(s), 41 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 1
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 2

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\UAC (Rootkit.Trace) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\Windows\system32\uacinit.dll (Trojan.Agent) -> Delete on reboot.
c:\Users\Mitam\Desktop\winlogon.exe (Heuristics.Reserved.Word.Exploit) -> Quarantined and deleted successfully.

mitam101
Novice
Novice

Posts Posts : 23
Joined Joined : 2009-07-13
OS OS : Windows Vista
Points Points : 27075
# Likes # Likes : 0

View user profile

Back to top Go down

Re: System Security 2009, half removed

Post by Origin on 13th July 2009, 9:39 pm


  • Download combofix from here
    [You must be registered and logged in to see this link.]
    [You must be registered and logged in to see this link.]
  • We need to disable your local AV (Anti-virus) before running Combofix.
  • See [You must be registered and logged in to see this link.] for how to disable your AV.
  • Double click on ComboFix.exe.
  • Follow the prompts. NOTE:
  • ComboFix will check to see if the Microsoft Windows Recovery Console is installed.
    ***It's strongly recommended to have the Recovery Console installed before doing any malware removal.***

    **Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will automatically proceed with its scan.


  • The Recovery Console provides a recovery/repair mode should a problem occur during a Combofix run.



  • Allow ComboFix to download the Recovery Console.
  • Accept the End-User License Agreement.
  • The Recovery Console will be installed.
  • You will then get this next prompt that asks if you want to continue the malware scan, select yes



  • Allow combofix to run
  • Post C:\combofix.txt back here.

    Note:
    Do not mouseclick combofix's window whilst it's running. That may cause it to stall.


While my help is always free, please consider donating to keep this site alive: [You must be registered and logged in to see this link.]

[You must be registered and logged in to see this link.]

Origin
Master
Master

Posts Posts : 2685
Joined Joined : 2009-05-05
Gender Gender : Male
OS OS : Windows Xp Sp3
Points Points : 31503
# Likes # Likes : 0

View user profile

Back to top Go down

Re: System Security 2009, half removed

Post by mitam101 on 13th July 2009, 11:36 pm

i clicked on the combofix.exe and nothing pops up, should i re-name it winlogon to run it?

mitam101
Novice
Novice

Posts Posts : 23
Joined Joined : 2009-07-13
OS OS : Windows Vista
Points Points : 27075
# Likes # Likes : 0

View user profile

Back to top Go down

Re: System Security 2009, half removed

Post by mitam101 on 14th July 2009, 12:48 am

I renamed the file winlogon.exe and ran the program.
It restarted my computer and ran through, stage 1 complete - stage 33 and on,
then it just went to a black screen and froze on that, i could still move my mouse
but it just stayed like that, so i restarted my computer, and looked for the combofixlog.txt or whatever
and didn't find it, im going for attempt 2

mitam101
Novice
Novice

Posts Posts : 23
Joined Joined : 2009-07-13
OS OS : Windows Vista
Points Points : 27075
# Likes # Likes : 0

View user profile

Back to top Go down

Re: System Security 2009, half removed

Post by AlleghanyMAN on 14th July 2009, 1:20 am

all of the links i follow are infected and blocked by this dang thing. i do not know enough about computers to rename things. i renamed the file saved to my desktop, but i do not know how to rename a program. the winlogin.exe is a good idea, but then i get lost in the computer jargon. i could use some specific help, i will make a donation, if it would help.

AlleghanyMAN
Beginner
Beginner

Posts Posts : 1
Joined Joined : 2009-07-14
OS OS : XP
Points Points : 27041
# Likes # Likes : 0

View user profile

Back to top Go down

Re: System Security 2009, half removed

Post by Origin on 14th July 2009, 2:44 am

Hello AlleghanyMAN, please refrain from posting in other members topics, if you need assistance start your own topic.


While my help is always free, please consider donating to keep this site alive: [You must be registered and logged in to see this link.]

[You must be registered and logged in to see this link.]

Origin
Master
Master

Posts Posts : 2685
Joined Joined : 2009-05-05
Gender Gender : Male
OS OS : Windows Xp Sp3
Points Points : 31503
# Likes # Likes : 0

View user profile

Back to top Go down

Re: System Security 2009, half removed

Post by mitam101 on 14th July 2009, 5:05 am

Yep, same thing happened again. Computer restarted and stayed on a black screen for an hour until i restarted the computer.
I checked the C:\ drive for the log file, and it wasn't there.
Now what?

mitam101
Novice
Novice

Posts Posts : 23
Joined Joined : 2009-07-13
OS OS : Windows Vista
Points Points : 27075
# Likes # Likes : 0

View user profile

Back to top Go down

Re: System Security 2009, half removed

Post by Belahzur on 14th July 2009, 4:22 pm

Download the GMER rootkit scan from here: [You must be registered and logged in to see this link.]

  1. Unzip it and start GMER.
  2. Click the >>> tab and then click the Scan button.
  3. Once done, click the Copy button.
  4. This will copy the results to your clipboard.
  5. Paste the results in your next reply.
Note:
If you're having problems with running GMER.exe, try it in safe mode. This tools works in safe mode.
You can also try renaming it since some malware blocks GMER.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34918
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : 7 Home Premium x64
Points Points : 245091
# Likes # Likes : 1

View user profile

Back to top Go down

Re: System Security 2009, half removed

Post by mitam101 on 14th July 2009, 10:01 pm

Okay, i had to run GMER in SAFEMODE, here is that log you wanted me to copy/paste:

GMER 1.0.15.14972 - [You must be registered and logged in to see this link.]
Rootkit scan 2009-07-14 16:56:25
Windows 6.0.6001 Service Pack 1


---- System - GMER 1.0.15 ----

INT 0x51 ? 83FE6BF8
INT 0x62 ? 855C8BF8
INT 0x82 ? 83FE5BF8
INT 0x92 ? 83FE6BF8

---- Kernel code sections - GMER 1.0.15 ----

? System32\Drivers\spjg.sys The system cannot find the path specified. !
.text USBPORT.SYS!DllUnload 87F5846F 5 Bytes JMP 855C81D8
.text a25f10mi.SYS 82BA8000 22 Bytes [26, F2, E0, 81, 10, F1, E0, ...]
.text a25f10mi.SYS 82BA8017 145 Bytes [00, 32, B7, 90, 82, 3D, B5, ...]
.text a25f10mi.SYS 82BA80A9 35 Bytes CALL 6B92212F
.text a25f10mi.SYS 82BA80CE 10 Bytes [00, 00, 00, 00, 00, 00, 66, ...]
.text a25f10mi.SYS 82BA80DA 12 Bytes [00, 00, 02, 00, 00, 00, 25, ...]
.text ...

---- Kernel IAT/EAT - GMER 1.0.15 ----

IAT \SystemRoot\system32\drivers\atapi.sys[ataport.SYS!AtaPortWritePortUchar] [828026D2] \SystemRoot\System32\Drivers\spjg.sys
IAT \SystemRoot\system32\drivers\atapi.sys[ataport.SYS!AtaPortReadPortUchar] [82802040] \SystemRoot\System32\Drivers\spjg.sys
IAT \SystemRoot\system32\drivers\atapi.sys[ataport.SYS!AtaPortWritePortBufferUshort] [828027FC] \SystemRoot\System32\Drivers\spjg.sys
IAT \SystemRoot\system32\drivers\atapi.sys[ataport.SYS!AtaPortReadPortUshort] [828020BE] \SystemRoot\System32\Drivers\spjg.sys
IAT \SystemRoot\system32\drivers\atapi.sys[ataport.SYS!AtaPortReadPortBufferUshort] [8280213C] \SystemRoot\System32\Drivers\spjg.sys
IAT \SystemRoot\System32\Drivers\a25f10mi.SYS[ataport.SYS!AtaPortNotification] 24488B66
IAT \SystemRoot\System32\Drivers\a25f10mi.SYS[ataport.SYS!AtaPortWritePortUchar] E84D8966
IAT \SystemRoot\System32\Drivers\a25f10mi.SYS[ataport.SYS!AtaPortWritePortUlong] 83E84D8B
IAT \SystemRoot\System32\Drivers\a25f10mi.SYS[ataport.SYS!AtaPortGetPhysicalAddress] 896602C1
IAT \SystemRoot\System32\Drivers\a25f10mi.SYS[ataport.SYS!AtaPortConvertPhysicalAddressToUlong] 488BEA4D
IAT \SystemRoot\System32\Drivers\a25f10mi.SYS[ataport.SYS!AtaPortGetScatterGatherList] 8DC80320
IAT \SystemRoot\System32\Drivers\a25f10mi.SYS[ataport.SYS!AtaPortReadPortUchar] 57500845
IAT \SystemRoot\System32\Drivers\a25f10mi.SYS[ataport.SYS!AtaPortStallExecution] F0458D57
IAT \SystemRoot\System32\Drivers\a25f10mi.SYS[ataport.SYS!AtaPortGetParentBusType] 00006850
IAT \SystemRoot\System32\Drivers\a25f10mi.SYS[ataport.SYS!AtaPortRequestCallback] 458DB002
IAT \SystemRoot\System32\Drivers\a25f10mi.SYS[ataport.SYS!AtaPortWritePortBufferUshort] 35FF50E8
IAT \SystemRoot\System32\Drivers\a25f10mi.SYS[ataport.SYS!AtaPortGetUnCachedExtension] [82BCDFBC] \SystemRoot\System32\Drivers\a25f10mi.SYS (ATAPI IDE Miniport Driver/Microsoft Corporation)
IAT \SystemRoot\System32\Drivers\a25f10mi.SYS[ataport.SYS!AtaPortCompleteRequest] 57EC4D89
IAT \SystemRoot\System32\Drivers\a25f10mi.SYS[ataport.SYS!AtaPortMoveMemory] 01F045C7
IAT \SystemRoot\System32\Drivers\a25f10mi.SYS[ataport.SYS!AtaPortCompleteAllActiveRequests] E8000000
IAT \SystemRoot\System32\Drivers\a25f10mi.SYS[ataport.SYS!AtaPortReleaseRequestSenseIrb] 0001E4E4
IAT \SystemRoot\System32\Drivers\a25f10mi.SYS[ataport.SYS!AtaPortBuildRequestSenseIrb] 4675C73B
IAT \SystemRoot\System32\Drivers\a25f10mi.SYS[ataport.SYS!AtaPortReadPortUshort] BCDFC8A1
IAT \SystemRoot\System32\Drivers\a25f10mi.SYS[ataport.SYS!AtaPortReadPortBufferUshort] 8D526A82
IAT \SystemRoot\System32\Drivers\a25f10mi.SYS[ataport.SYS!AtaPortInitialize] 00009A88
IAT \SystemRoot\System32\Drivers\a25f10mi.SYS[ataport.SYS!AtaPortGetDeviceBase] 48C08300
IAT \SystemRoot\System32\Drivers\a25f10mi.SYS[ataport.SYS!AtaPortDeviceStateChange] 8D076A50
IAT \SystemRoot\system32\DRIVERS\i8042prt.sys[HAL.dll!READ_PORT_UCHAR] [82812048] \SystemRoot\System32\Drivers\spjg.sys

---- User IAT/EAT - GMER 1.0.15 ----

IAT C:\Windows\Explorer.EXE[1072] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdiplusShutdown] [74137BA4] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18065_none_9e7abe2ec9c13222\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[1072] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCloneImage] [741798C5] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18065_none_9e7abe2ec9c13222\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[1072] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDrawImageRectI] [7413D3C8] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18065_none_9e7abe2ec9c13222\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[1072] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipSetInterpolationMode] [7412F527] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18065_none_9e7abe2ec9c13222\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[1072] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdiplusStartup] [74137599] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18065_none_9e7abe2ec9c13222\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[1072] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateFromHDC] [7412E43D] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18065_none_9e7abe2ec9c13222\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[1072] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateBitmapFromStreamICM] [7416B33D] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18065_none_9e7abe2ec9c13222\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[1072] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateBitmapFromStream] [7413D68A] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18065_none_9e7abe2ec9c13222\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[1072] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipGetImageHeight] [7413012E] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18065_none_9e7abe2ec9c13222\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[1072] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipGetImageWidth] [74130095] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18065_none_9e7abe2ec9c13222\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[1072] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDisposeImage] [741271F3] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18065_none_9e7abe2ec9c13222\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[1072] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipLoadImageFromFileICM] [741BD802] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18065_none_9e7abe2ec9c13222\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[1072] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipLoadImageFromFile] [741575E1] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18065_none_9e7abe2ec9c13222\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[1072] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDeleteGraphics] [7412DAE1] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18065_none_9e7abe2ec9c13222\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[1072] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipFree] [7412668F] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18065_none_9e7abe2ec9c13222\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[1072] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipAlloc] [741266BA] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18065_none_9e7abe2ec9c13222\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[1072] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipSetCompositingMode] [74131E45] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18065_none_9e7abe2ec9c13222\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)

mitam101
Novice
Novice

Posts Posts : 23
Joined Joined : 2009-07-13
OS OS : Windows Vista
Points Points : 27075
# Likes # Likes : 0

View user profile

Back to top Go down

Re: System Security 2009, half removed

Post by mitam101 on 14th July 2009, 10:02 pm

Here's the rest, it said the file was to big to post in one reply,

---- Devices - GMER 1.0.15 ----

Device \FileSystem\Ntfs \Ntfs 84DAF1F8

AttachedDevice \Driver\kbdclass \Device\KeyboardClass0 Wdf01000.sys (WDF Dynamic/Microsoft Corporation)

Device \Driver\sptd \Device\422226501 spjg.sys
Device \Driver\volmgr \Device\VolMgrControl 84DAB1F8
Device \Driver\usbohci \Device\USBPDO-0 855DB1F8
Device \Driver\usbehci \Device\USBPDO-1 855DC1F8
Device \Driver\PCI_PNP8493 \Device\00000055 spjg.sys
Device \Driver\nvstor32 \Device\00000063 84DAE1F8
Device \Driver\volmgr \Device\HarddiskVolume1 84DAB1F8
Device \Driver\volmgr \Device\HarddiskVolume2 84DAB1F8
Device \Driver\cdrom \Device\CdRom0 855E51F8
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-0 84DAD1F8
Device \Driver\atapi \Device\Ide\IdePort0 84DAD1F8
Device \Driver\atapi \Device\Ide\IdePort1 84DAD1F8
Device \Driver\cdrom \Device\CdRom1 855E51F8
Device \Driver\nvstor32 \Device\RaidPort0 84DAE1F8
Device \Driver\iScsiPrt \Device\RaidPort1 8562E1F8
Device \Driver\usbohci \Device\USBFDO-0 855DB1F8
Device \Driver\usbehci \Device\USBFDO-1 855DC1F8
Device \Driver\a25f10mi \Device\Scsi\a25f10mi1 85611500
Device \Driver\a25f10mi \Device\Scsi\a25f10mi1Port4Path0Target0Lun0 85611500
Device \FileSystem\cdfs \Cdfs 8582B1F8

---- Registry - GMER 1.0.15 ----

Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s1 771343423
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s2 285507792
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@h0 1
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0 C:\Program Files\DAEMON Tools Lite\
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0x03 0x30 0x45 0xBD ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh 0x08 0x4B 0x32 0x0F ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh 0xDD 0xDA 0x1C 0x1A ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0 C:\Program Files\DAEMON Tools Lite\
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0x03 0x30 0x45 0xBD ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh 0x08 0x4B 0x32 0x0F ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh 0xDD 0xDA 0x1C 0x1A ...

---- EOF - GMER 1.0.15 ----

mitam101
Novice
Novice

Posts Posts : 23
Joined Joined : 2009-07-13
OS OS : Windows Vista
Points Points : 27075
# Likes # Likes : 0

View user profile

Back to top Go down

Re: System Security 2009, half removed

Post by Belahzur on 14th July 2009, 10:23 pm

Log looks Combofix, maybe Combofix did work to some extent.

  • Please download DDS by sUBs to your Desktop (Important!!) from one of these locations:
    [You must be registered and logged in to see this link.]
    [You must be registered and logged in to see this link.]
  • Double click DDS.scr to run.
  • When complete, two logs will open. Save both of the report to your Desktop.
  • Copy and paste DDS.txt back here, I don't need to see attach.txt.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34918
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : 7 Home Premium x64
Points Points : 245091
# Likes # Likes : 1

View user profile

Back to top Go down

Re: System Security 2009, half removed

Post by mitam101 on 17th July 2009, 7:00 pm

Okay, sorry about the long response time, i've been out of state for the last few days. Here is that log file:

DDS (Ver_09-06-26.01) - NTFSx86
Run by Mitam at 13:57:52.21 on Fri 07/17/2009
Internet Explorer: 8.0.6001.18783
Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.1.1033.18.1982.1325 [GMT -5:00]

SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}

============== Running Processes ===============

C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe -k rpcss
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k GPSvcGroup
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\rundll32.exe
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\Explorer.EXE
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Windows\system32\svchost.exe -k bthsvcs
C:\Program Files\HP\QuickPlay\Kernel\TV\CLCapSvc.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
C:\WINDOWS\System32\rundll32.exe
C:\Program Files\AIM6\aim6.exe
C:\Windows\System32\svchost.exe -k HPZ12
C:\Windows\System32\svchost.exe -k HPZ12
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\System32\svchost.exe -k WerSvcGroup
C:\Windows\system32\DRIVERS\xaudio.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\AIM6\aolsoftware.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe
C:\Windows\system32\svchost.exe -k WindowsMobile
C:\Windows\system32\taskeng.exe
C:\Users\Mitam\Desktop\dds.scr
C:\Windows\system32\wbem\wmiprvse.exe

============== Pseudo HJT Report ===============

uStart Page = [You must be registered and logged in to see this link.]
mStart Page = [You must be registered and logged in to see this link.]
mDefault_Page_URL = [You must be registered and logged in to see this link.]
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: SSVHelper Class: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre1.6.0_07\bin\ssv.dll
uRun: [Aim6] "c:\program files\aim6\aim6.exe" /d locale=en-US [You must be registered and logged in to see this link.]
mRun: [hpWirelessAssistant] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
mRun: [WAWifiMessage] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRunOnce: [Launcher] %WINDIR%\SMINST\launcher.exe
mPolicies-system: EnableLUA = 0 (0x0)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: E&xport to Microsoft Excel - c:\progra~1\micros~3\office12\EXCEL.EXE/3000
IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBC} - c:\progra~1\java\jre16~1.0_0\bin\ssv.dll
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~3\office12\ONBttnIE.dll
IE: {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - c:\windows\windowsmobile\INetRepl.dll
IE: {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - c:\windows\windowsmobile\INetRepl.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~3\office12\REFIEBAR.DLL
DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} - [You must be registered and logged in to see this link.]
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - [You must be registered and logged in to see this link.]
DPF: {CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA} - [You must be registered and logged in to see this link.]
DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - [You must be registered and logged in to see this link.]
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - [You must be registered and logged in to see this link.]
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL

================= FIREFOX ===================

FF - ProfilePath - c:\users\mitam\appdata\roaming\mozilla\firefox\profiles\r1utmayd.default\
FF - plugin: c:\program files\mozilla firefox\plugins\npViewpoint.dll
FF - plugin: c:\program files\viewpoint\viewpoint media player\npViewpoint.dll
FF - plugin: c:\users\mitam\appdata\roaming\move networks\plugins\npqmp071503000010.dll

============= SERVICES / DRIVERS ===============

R2 IntuitUpdateService;Intuit Update Service;c:\program files\common files\intuit\update service\IntuitUpdateService.exe [2008-10-10 13088]
S3 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [2005-8-2 32512]
S4 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\viewpoint\common\ViewpointService.exe [2008-10-29 24652]

=============== Created Last 30 ================

2009-07-13 19:49 --ds---- C:\winlogon
2009-07-13 19:49 318,976 a------- c:\windows\system32\CF1991.exe
2009-07-13 19:14 219,648 a------- c:\windows\PEV.exe
2009-07-13 19:14 161,792 a------- c:\windows\SWREG.exe
2009-07-13 19:14 98,816 a------- c:\windows\sed.exe
2009-07-13 19:14 318,976 a------- c:\windows\system32\CF27901.exe
2009-07-12 18:47 --d----- c:\programdata\Spybot - Search & Destroy
2009-07-12 18:47 --d----- c:\program files\Spybot - Search & Destroy
2009-07-12 18:47 --d----- c:\progra~2\Spybot - Search & Destroy
2009-07-11 14:08 --d----- c:\users\mitam\appdata\roaming\Malwarebytes
2009-07-11 14:07 38,160 a------- c:\windows\system32\drivers\mbamswissarmy.sys
2009-07-11 14:07 19,096 a------- c:\windows\system32\drivers\mbam.sys
2009-07-11 14:07 --d----- c:\programdata\Malwarebytes
2009-07-11 14:07 --d----- c:\program files\Malwarebytes' Anti-Malware
2009-07-11 14:07 --d----- c:\progra~2\Malwarebytes
2009-07-10 16:11 --d----- c:\programdata\19924624
2009-07-10 16:11 --d----- c:\progra~2\19924624
2009-07-09 10:45 81 a------- C:\CTX.DAT
2009-07-09 10:45 --d----- c:\users\mitam\Citrix
2009-07-08 03:20 --d----- c:\program files\AviSynth 2.5
2009-07-08 03:20 --d----- c:\program files\Red Kawa
2009-07-08 03:18 --d----- c:\users\mitam\appdata\roaming\AVS4YOU
2009-07-08 03:18 --d----- c:\programdata\AVS4YOU
2009-07-08 03:18 --d----- c:\progra~2\AVS4YOU
2009-07-08 03:17 974,848 a------- c:\windows\system32\mfc70.dll
2009-07-08 03:17 --d----- c:\program files\common files\AVSMedia
2009-07-08 03:17 1,700,352 a------- c:\windows\system32\GdiPlus.dll
2009-07-08 03:17 24,576 a------- c:\windows\system32\msxml3a.dll
2009-07-08 03:17 --d----- c:\program files\AVS4YOU
2009-06-24 18:00 --d----- c:\programdata\acccore
2009-06-24 18:00 --d----- c:\progra~2\acccore
2009-06-24 17:59 --d----- c:\program files\AIM6
2009-06-24 11:03 --d----- c:\program files\CamStudio
2009-06-23 14:38 --d----- c:\users\mitam\appdata\roaming\Pamela
2009-06-23 14:38 176,128 a------- c:\windows\system32\RemoteControl.dll
2009-06-23 14:38 --d----- c:\program files\Pamela
2009-06-23 13:50 56 a---h--- c:\windows\system32\ezsidmv.dat
2009-06-23 13:48 --d--r-- c:\program files\Skype
2009-06-23 13:47 --d----- c:\programdata\Skype
2009-06-19 13:16 156,160 a------- c:\windows\system32\msls31.dll
2009-06-19 12:54 55,918 a------- c:\programdata\nvModes.dat
2009-06-19 12:54 55,918 a------- c:\progra~2\nvModes.dat
2009-06-19 12:43 105,016 a------- c:\windows\system32\PresentationCFFRasterizerNative_v0300.dll
2009-06-19 12:43 97,800 a------- c:\windows\system32\infocardapi.dll
2009-06-19 12:43 622,080 a------- c:\windows\system32\icardagt.exe
2009-06-19 12:43 43,544 a------- c:\windows\system32\PresentationHostProxy.dll
2009-06-19 12:43 37,384 a------- c:\windows\system32\infocardcpl.cpl
2009-06-19 12:43 11,264 a------- c:\windows\system32\icardres.dll
2009-06-19 12:43 781,344 a------- c:\windows\system32\PresentationNative_v0300.dll
2009-06-19 12:43 326,160 a------- c:\windows\system32\PresentationHost.exe
2009-06-19 12:29 96,760 a------- c:\windows\system32\dfshim.dll
2009-06-19 12:29 282,112 a------- c:\windows\system32\mscoree.dll
2009-06-19 12:29 41,984 a------- c:\windows\system32\netfxperf.dll
2009-06-19 12:28 158,720 a------- c:\windows\system32\mscorier.dll
2009-06-19 12:28 83,968 a------- c:\windows\system32\mscories.dll

==================== Find3M ====================

2009-06-19 12:55 143,360 a------- c:\windows\inf\infstrng.dat
2009-06-19 12:55 51,200 a------- c:\windows\inf\infpub.dat
2009-06-19 12:55 86,016 a------- c:\windows\inf\infstor.dat
2009-06-19 01:03 13,025 a------- c:\users\mitam\appdata\roaming\nvModes.dat
2009-05-09 00:50 915,456 a------- c:\windows\system32\wininet.dll
2009-05-09 00:34 71,680 a------- c:\windows\system32\iesetup.dll
2009-04-23 07:43 784,896 a------- c:\windows\system32\rpcrt4.dll
2009-04-23 07:42 636,928 a------- c:\windows\system32\localspl.dll
2009-04-21 06:55 2,033,152 a------- c:\windows\system32\win32k.sys
2009-01-30 13:29 174 a--sh--- c:\program files\desktop.ini
2009-01-30 13:02 665,600 a------- c:\windows\inf\drvindex.dat
2009-01-07 13:51 60,744 a------- c:\users\mitam\g2mdlhlpx.exe
2006-11-02 07:42 287,440 a------- c:\windows\inf\perflib\0409\perfi.dat
2006-11-02 07:42 287,440 a------- c:\windows\inf\perflib\0409\perfh.dat
2006-11-02 07:42 30,674 a------- c:\windows\inf\perflib\0409\perfd.dat
2006-11-02 07:42 30,674 a------- c:\windows\inf\perflib\0409\perfc.dat
2006-11-02 04:20 287,440 a------- c:\windows\inf\perflib\0000\perfi.dat
2006-11-02 04:20 287,440 a------- c:\windows\inf\perflib\0000\perfh.dat
2006-11-02 04:20 30,674 a------- c:\windows\inf\perflib\0000\perfd.dat
2006-11-02 04:20 30,674 a------- c:\windows\inf\perflib\0000\perfc.dat

============= FINISH: 13:59:12.16 ===============

mitam101
Novice
Novice

Posts Posts : 23
Joined Joined : 2009-07-13
OS OS : Windows Vista
Points Points : 27075
# Likes # Likes : 0

View user profile

Back to top Go down

Re: System Security 2009, half removed

Post by Origin on 18th July 2009, 12:35 am

Please download the [You must be registered and logged in to see this link.].

  • Save it to your desktop.
  • Please double-click OTM.exe to run it.
  • Copy the bolded text below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose CopyCrying


    :files
    c:\windows\PEV.exe
    c:\windows\sed.exe
    c:\programdata\19924624
    c:\progra~2\19924624



  • Return to OTMoveIt, right click in the "Paste instructions for items to be Moved" window (under the light blue bar) and choose Paste.
  • Click the red Moveit! button.
  • Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
  • Close OTMoveIt
If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes.

Please post the OTMoveIt log.



Also, run another Malwarebytes scan and post the log back here.


While my help is always free, please consider donating to keep this site alive: [You must be registered and logged in to see this link.]

[You must be registered and logged in to see this link.]

Origin
Master
Master

Posts Posts : 2685
Joined Joined : 2009-05-05
Gender Gender : Male
OS OS : Windows Xp Sp3
Points Points : 31503
# Likes # Likes : 0

View user profile

Back to top Go down

Re: System Security 2009, half removed

Post by mitam101 on 18th July 2009, 7:01 pm

OTMOVEIT Log:

========== FILES ==========
c:\windows\PEV.exe moved successfully.
c:\windows\sed.exe moved successfully.
c:\programdata\19924624 moved successfully.
File/Folder c:\progra~2\19924624 not found.

OTM by OldTimer - Version 3.0.0.5 log created on 07182009_140012


Malwarebytes Scan to come

mitam101
Novice
Novice

Posts Posts : 23
Joined Joined : 2009-07-13
OS OS : Windows Vista
Points Points : 27075
# Likes # Likes : 0

View user profile

Back to top Go down

Re: System Security 2009, half removed

Post by mitam101 on 18th July 2009, 7:15 pm

Here is a quick scan from Malwarebytes:

Malwarebytes' Anti-Malware 1.39
Database version: 2461
Windows 6.0.6001 Service Pack 1

7/18/2009 2:14:11 PM
mbam-log-2009-07-18 (14-14-07).txt

Scan type: Quick Scan
Objects scanned: 77922
Time elapsed: 3 minute(s), 52 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 1
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\UAC (Rootkit.Trace) -> No action taken.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

mitam101
Novice
Novice

Posts Posts : 23
Joined Joined : 2009-07-13
OS OS : Windows Vista
Points Points : 27075
# Likes # Likes : 0

View user profile

Back to top Go down

Re: System Security 2009, half removed

Post by mitam101 on 18th July 2009, 7:39 pm

I'm going to run a full scan to be sure. I deleted/quarantined the above infection (in the previous post)

mitam101
Novice
Novice

Posts Posts : 23
Joined Joined : 2009-07-13
OS OS : Windows Vista
Points Points : 27075
# Likes # Likes : 0

View user profile

Back to top Go down

Re: System Security 2009, half removed

Post by Origin on 18th July 2009, 9:28 pm

How is the computer running?


While my help is always free, please consider donating to keep this site alive: [You must be registered and logged in to see this link.]

[You must be registered and logged in to see this link.]

Origin
Master
Master

Posts Posts : 2685
Joined Joined : 2009-05-05
Gender Gender : Male
OS OS : Windows Xp Sp3
Points Points : 31503
# Likes # Likes : 0

View user profile

Back to top Go down

Re: System Security 2009, half removed

Post by mitam101 on 19th July 2009, 5:19 pm

Okay, here is the full scan:

Malwarebytes' Anti-Malware 1.39
Database version: 2461
Windows 6.0.6001 Service Pack 1

7/19/2009 12:17:47 PM
mbam-log-2009-07-19 (12-17-47).txt

Scan type: Full Scan (C:\|)
Objects scanned: 230039
Time elapsed: 50 minute(s), 39 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 9

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
c:\Qoobox\quarantine\C\WINDOWS\System32\hjgruitokuefos.dll.vir (Trojan.TDSS) -> Quarantined and deleted successfully.
c:\Qoobox\quarantine\C\WINDOWS\System32\hjgruiwsppjawh.dll.vir (Trojan.TDSS) -> Quarantined and deleted successfully.
c:\Qoobox\quarantine\C\WINDOWS\System32\UACaeqscdppqgrwqacut.dll.vir (Trojan.TDSS) -> Quarantined and deleted successfully.
c:\Qoobox\quarantine\C\WINDOWS\System32\UACbvvtctrkeaqnpqcdy.dll.vir (Trojan.TDSS) -> Quarantined and deleted successfully.
c:\Qoobox\quarantine\C\WINDOWS\System32\UACopfqiriikhrtqwtuk.dll.vir (Trojan.TDSS) -> Quarantined and deleted successfully.
c:\Qoobox\quarantine\C\WINDOWS\System32\UACpqwenvvexbbdovrmm.dll.vir (Trojan.TDSS) -> Quarantined and deleted successfully.
c:\Qoobox\quarantine\C\WINDOWS\System32\UACyxttlgbnwntelbxvf.dll.vir (Trojan.TDSS) -> Quarantined and deleted successfully.
c:\Qoobox\quarantine\C\WINDOWS\System32\drivers\hjgruiiruywbpm.sys.vir (Trojan.TDSS) -> Quarantined and deleted successfully.
c:\Qoobox\quarantine\C\WINDOWS\System32\drivers\UACrfpcepyixmnmdyerl.sys.vir (Trojan.TDSS) -> Quarantined and deleted successfully.


Computer is still running a little slow

mitam101
Novice
Novice

Posts Posts : 23
Joined Joined : 2009-07-13
OS OS : Windows Vista
Points Points : 27075
# Likes # Likes : 0

View user profile

Back to top Go down

Re: System Security 2009, half removed

Post by Origin on 19th July 2009, 7:03 pm

How is the computer running?


While my help is always free, please consider donating to keep this site alive: [You must be registered and logged in to see this link.]

[You must be registered and logged in to see this link.]

Origin
Master
Master

Posts Posts : 2685
Joined Joined : 2009-05-05
Gender Gender : Male
OS OS : Windows Xp Sp3
Points Points : 31503
# Likes # Likes : 0

View user profile

Back to top Go down

Re: System Security 2009, half removed

Post by mitam101 on 19th July 2009, 9:15 pm

The computer is running better than it was when we first started.
I can open Adobe now, i don't get redirected to random sites, and
internet explorer isn't popping up at random times! Although
it seems like every time i run Malwarebytes i have more viruses.

mitam101
Novice
Novice

Posts Posts : 23
Joined Joined : 2009-07-13
OS OS : Windows Vista
Points Points : 27075
# Likes # Likes : 0

View user profile

Back to top Go down

Re: System Security 2009, half removed

Post by Origin on 20th July 2009, 3:40 pm

See if you can run ComboFix now:

1. If you are using Firefox, make sure that your download settings are as follows:

* Tools->Options->Main tab
* Set to "Always ask me where to Save the files".

2. During the download, rename Combofix to Combo-Fix as follows:





3. It is important you rename Combofix during the download, but not after.
4. Please do not rename Combofix to other names, but only to the one indicated.
5. Close any open browsers.
6. We need to disable your local AV (Anti-virus) before running Combofix.

  • See [You must be registered and logged in to see this link.] for how to disable your AV.
  • Double click on ComboFix.exe.
  • Follow the prompts. NOTE:
  • Allow combofix to run
  • Post C:\combofix.txt back here.

    Note:
    Do not mouse click combofix's window whilst it's running. That may cause it to stall.


While my help is always free, please consider donating to keep this site alive: [You must be registered and logged in to see this link.]

[You must be registered and logged in to see this link.]

Origin
Master
Master

Posts Posts : 2685
Joined Joined : 2009-05-05
Gender Gender : Male
OS OS : Windows Xp Sp3
Points Points : 31503
# Likes # Likes : 0

View user profile

Back to top Go down

Re: System Security 2009, half removed

Post by mitam101 on 20th July 2009, 6:18 pm

Combo fix ran smoothly this time. Here is the long:

ComboFix 09-07-19.04 - Mitam 07/20/2009 13:01.3.2 - NTFSx86
Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.1.1033.18.1982.1199 [GMT -5:00]
Running from: c:\users\Mitam\Desktop\Combo-Fix.exe
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\$recycle.bin\S-1-5-21-2954942239-3376670357-2783907261-500
c:\$recycle.bin\S-1-5-21-4003641115-3550914113-3698931782-500
C:\WinLogon
c:\winlogon\catch_k.dat
c:\winlogon\CfReboot.dat
c:\winlogon\d-del2A.dat
c:\winlogon\d-del4AV.dat
c:\winlogon\drev.dat
c:\winlogon\ErrTrap1
c:\winlogon\mtee.cfexe
c:\winlogon\MUI
c:\winlogon\MWindows.dat
c:\winlogon\mynul.dat
c:\winlogon\mypictures.folder.dat
c:\winlogon\n.pif
c:\winlogon\N_\11032
c:\winlogon\N_\11255
c:\winlogon\N_\12467
c:\winlogon\N_\12797
c:\winlogon\N_\15600
c:\winlogon\N_\17644
c:\winlogon\N_\17763
c:\winlogon\N_\1806
c:\winlogon\N_\18382
c:\winlogon\N_\19282
c:\winlogon\N_\21061
c:\winlogon\N_\23244
c:\winlogon\N_\24002
c:\winlogon\N_\25245
c:\winlogon\N_\27881
c:\winlogon\N_\30564
c:\winlogon\N_\31479
c:\winlogon\N_\31494
c:\winlogon\N_\4221
c:\winlogon\N_\7031
c:\winlogon\ND_.bat
c:\winlogon\ndis_combofix.dat
c:\winlogon\netsvc.bad.dat
c:\winlogon\netsvc.dat
c:\winlogon\NetworkService.dat
c:\winlogon\NirCmd.cfexe
c:\winlogon\NircmdB.exe
c:\winlogon\NirCmdC.cfexe
c:\winlogon\NlsLanguageDefault
c:\winlogon\notifykeys.dat
c:\winlogon\NT-OS.cmd
c:\winlogon\NULL
c:\winlogon\Ori04
c:\winlogon\OriO4
c:\winlogon\OsId.txt
c:\winlogon\OSid.vbs
c:\winlogon\OsVer
c:\winlogon\patched.af
c:\winlogon\PathSearch
c:\winlogon\pend.txt
c:\winlogon\pev.cfexe
c:\winlogon\pev.exe
c:\winlogon\Policies.dat
c:\winlogon\PreDIR
c:\winlogon\Prep.inf
c:\winlogon\Profiles.Folder.dat
c:\winlogon\progfile.dat
c:\winlogon\Purity.dat
c:\winlogon\PV.cfexe
c:\winlogon\RCLink.dat
c:\winlogon\RcVer00
c:\winlogon\REGDACL.sed
c:\winlogon\RegDo.sed
c:\winlogon\region.dat
c:\winlogon\RegScan.cmd
c:\winlogon\regt.cfexe
c:\winlogon\RenVDel.dat
c:\winlogon\Resident.txt
c:\winlogon\RkDetectAA_tdssserv.dat
c:\winlogon\Rkey.cmd
c:\winlogon\rogues.dat
c:\winlogon\run.sed
c:\winlogon\run2.sed
c:\winlogon\Rust.str
c:\winlogon\safeboot.dat
c:\winlogon\safeboot.def.dat
c:\winlogon\safeboot.def.vista.dat
c:\winlogon\sed.cfexe
c:\winlogon\SetEnvmt.bat
c:\winlogon\SetPath.bat
c:\winlogon\setpath.cfexe
c:\winlogon\sfx.cmd
c:\winlogon\SnapShot.cmd
c:\winlogon\SRestore.cmd
c:\winlogon\srizbi.md5
c:\winlogon\startup.folder.dat
c:\winlogon\SuppScan.cmd
c:\winlogon\SuspectB_netsvc.dat
c:\winlogon\SuspectLegacy
c:\winlogon\suspectSvc.dat
c:\winlogon\svc_wht.dat
c:\winlogon\SvcCovered
c:\winlogon\SvcDiff
c:\winlogon\SvcDrv.vbs
c:\winlogon\SvcDump
c:\winlogon\SvcDumpB
c:\winlogon\SvcDumpFull
c:\winlogon\SvcFull
c:\winlogon\svchost.dat
c:\winlogon\svclist.dat
c:\winlogon\SvcTarget.dat
c:\winlogon\SWREG.cfexe
c:\winlogon\swreg.exe
c:\winlogon\swsc.cfexe
c:\winlogon\swxcacls.cfexe
c:\winlogon\SysPath.dat
c:\winlogon\system_ini.dat
c:\winlogon\tail.cfexe
c:\winlogon\temp2000
c:\winlogon\temp4900
c:\winlogon\temp4901
c:\winlogon\templates.folder.dat
c:\winlogon\toolbar.sed
c:\winlogon\unhand.dat
c:\winlogon\UploadThese
c:\winlogon\V-FilesB.dat
c:\winlogon\v-tmp.dat
c:\winlogon\v_str.dat
c:\winlogon\v_wht.dat
c:\winlogon\version.txt
c:\winlogon\Vista.mac
c:\winlogon\vRun_DLL
c:\winlogon\w_sock.dll
c:\winlogon\whitedir.dat
c:\winlogon\whitedirCreated.dat
c:\winlogon\Windir.dat
c:\winlogon\Wmi_rem.vbs
c:\winlogon\WrgNameDLL
c:\winlogon\wtf_tdssservB
c:\winlogon\zDomain.dat
c:\winlogon\zhsvc.dat
c:\winlogon\zip.cfexe
c:\winlogon\Zlob01

.
((((((((((((((((((((((((( Files Created from 2009-06-20 to 2009-07-20 )))))))))))))))))))))))))))))))
.

2009-07-20 18:07 . 2009-07-20 18:07 -------- d-----w- c:\users\Mitam\AppData\Local\temp
2009-07-20 18:07 . 2009-07-20 18:07 -------- d-----w- c:\windows\system32\config\systemprofile\AppData\Local\temp
2009-07-18 19:02 . 2009-07-18 19:02 3775176 ----a-w- c:\programdata\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe
2009-07-18 19:00 . 2009-07-18 19:00 -------- d-----w- C:\_OTM
2009-07-16 14:34 . 2009-06-15 15:24 156672 ----a-w- c:\windows\system32\t2embed.dll
2009-07-16 14:34 . 2009-06-15 15:20 72704 ----a-w- c:\windows\system32\fontsub.dll
2009-07-16 14:34 . 2009-06-15 15:20 10240 ----a-w- c:\windows\system32\dciman32.dll
2009-07-16 14:34 . 2009-06-15 12:52 289792 ----a-w- c:\windows\system32\atmfd.dll
2009-07-12 23:47 . 2009-07-12 23:52 -------- d-----w- c:\program files\Spybot - Search & Destroy
2009-07-12 23:47 . 2009-07-12 23:47 -------- d-----w- c:\programdata\Spybot - Search & Destroy
2009-07-11 19:08 . 2009-07-11 19:08 -------- d-----w- c:\users\Mitam\AppData\Roaming\Malwarebytes
2009-07-11 19:07 . 2009-07-13 18:36 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-07-11 19:07 . 2009-07-18 19:04 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-07-11 19:07 . 2009-07-13 18:36 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-07-11 19:07 . 2009-07-11 19:07 -------- d-----w- c:\programdata\Malwarebytes
2009-07-11 19:02 . 2009-07-11 19:02 680 ----a-w- c:\users\Mitam\AppData\Local\d3d9caps.dat
2009-07-10 04:30 . 2009-07-10 04:30 127872 ----a-w- c:\users\Mitam\AppData\Roaming\Move Networks\uninstall.exe
2009-07-10 04:30 . 2009-07-10 04:31 -------- d-----w- c:\users\Mitam\AppData\Roaming\Move Networks
2009-07-09 15:45 . 2009-07-09 15:45 81 ----a-w- C:\CTX.DAT
2009-07-09 15:45 . 2009-07-09 15:45 -------- d-----w- c:\users\Mitam\Citrix
2009-07-08 08:20 . 2009-07-08 08:20 -------- d-----w- c:\program files\AviSynth 2.5
2009-07-08 08:20 . 2009-07-08 08:20 -------- d-----w- c:\program files\Red Kawa
2009-07-08 08:18 . 2009-07-08 08:18 -------- d-----w- c:\users\Mitam\AppData\Roaming\AVS4YOU
2009-07-08 08:18 . 2009-07-08 08:18 -------- d-----w- c:\programdata\AVS4YOU
2009-07-08 08:17 . 2009-07-08 08:18 -------- d-----w- c:\program files\Common Files\AVSMedia
2009-07-08 08:17 . 2008-08-13 16:22 974848 ----a-w- c:\windows\system32\mfc70.dll
2009-07-08 08:17 . 2009-07-08 08:20 -------- d-----w- c:\program files\AVS4YOU
2009-07-08 08:17 . 2008-08-13 16:22 1700352 ----a-w- c:\windows\system32\GdiPlus.dll
2009-07-08 08:17 . 2008-08-13 16:22 24576 ----a-w- c:\windows\system32\msxml3a.dll
2009-06-25 17:30 . 2009-06-25 17:40 4506256 ----a-w- c:\users\Mitam\AppData\Roaming\LimeWire\.NetworkShare\LimeWireWin4.16.6.exe
2009-06-24 23:02 . 2009-06-24 23:02 -------- d-----w- c:\users\Mitam\AppData\Roaming\acccore
2009-06-24 23:01 . 2009-06-24 23:01 -------- d-----w- c:\users\Mitam\AppData\Local\AOL OCP
2009-06-24 23:00 . 2009-06-24 23:00 -------- d-----w- c:\programdata\acccore
2009-06-24 22:59 . 2009-06-24 23:00 -------- d-----w- c:\program files\AIM6
2009-06-24 16:03 . 2009-06-24 19:00 -------- d-----w- c:\program files\CamStudio
2009-06-23 19:38 . 2009-06-23 19:41 -------- d-----w- c:\users\Mitam\AppData\Roaming\Pamela
2009-06-23 19:38 . 2009-06-23 19:38 176128 ----a-w- c:\windows\system32\RemoteControl.dll
2009-06-23 19:38 . 2009-06-23 19:38 -------- d-----w- c:\program files\Pamela
2009-06-23 18:50 . 2009-06-23 18:50 56 ---ha-w- c:\windows\system32\ezsidmv.dat
2009-06-23 18:50 . 2009-07-11 18:24 -------- d-----w- c:\users\Mitam\AppData\Roaming\skypePM
2009-06-23 18:48 . 2009-07-10 21:27 -------- d-----w- c:\users\Mitam\AppData\Roaming\Skype
2009-06-23 18:48 . 2009-06-23 18:48 -------- d-----w- c:\program files\Common Files\Skype
2009-06-23 18:48 . 2009-06-23 18:48 -------- d-----r- c:\program files\Skype
2009-06-23 18:47 . 2009-06-23 18:48 -------- d-----w- c:\programdata\Skype

.

mitam101
Novice
Novice

Posts Posts : 23
Joined Joined : 2009-07-13
OS OS : Windows Vista
Points Points : 27075
# Likes # Likes : 0

View user profile

Back to top Go down

Re: System Security 2009, half removed

Post by mitam101 on 20th July 2009, 6:19 pm

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-07-20 17:42 . 2009-06-19 17:54 55918 ----a-w- c:\programdata\nvModes.dat
2009-07-20 04:06 . 2009-02-07 15:53 12 ----a-w- c:\windows\bthservsdp.dat
2009-07-17 01:28 . 2008-10-24 06:58 -------- d-----w- c:\program files\LimeWire
2009-07-16 14:42 . 2008-10-24 06:14 -------- d-----w- c:\users\Mitam\AppData\Roaming\Azureus
2009-07-12 06:32 . 2008-10-24 07:42 -------- d-----w- c:\program files\Warcraft III
2009-07-10 04:30 . 2009-06-16 06:35 4183416 ----a-w- c:\users\Mitam\AppData\Roaming\Move Networks\plugins\npqmp071503000010.dll
2009-06-24 23:00 . 2008-10-29 20:05 -------- d-----w- c:\programdata\Viewpoint
2009-06-24 22:59 . 2008-10-29 20:05 -------- d-----w- c:\program files\Common Files\AOL
2009-06-20 08:02 . 2008-10-24 03:34 76984 ----a-w- c:\users\Mitam\AppData\Local\GDIPFONTCACHEV1.DAT
2009-06-19 18:50 . 2008-10-24 07:55 -------- d-----w- c:\programdata\NVIDIA
2009-06-19 18:03 . 2008-07-14 02:57 -------- d-----w- c:\programdata\Microsoft Help
2009-06-19 18:00 . 2008-07-14 02:55 -------- d-----w- c:\program files\Microsoft Works
2009-06-19 06:03 . 2008-10-24 07:57 13025 ----a-w- c:\users\Mitam\AppData\Roaming\nvModes.dat
2009-06-17 04:45 . 2009-06-17 04:45 -------- d-----w- c:\program files\Microsoft Silverlight
2009-06-16 06:35 . 2009-06-16 06:35 97144 ----a-w- c:\users\Mitam\AppData\Roaming\Move Networks\ie_bin\MovePlayerUpgrade.exe
2009-06-10 22:05 . 2008-10-24 06:58 -------- d-----w- c:\users\Mitam\AppData\Roaming\LimeWire
2009-06-09 17:00 . 2009-06-02 19:58 -------- d-----w- c:\programdata\FLEXnet
2009-06-02 19:54 . 2008-07-14 03:17 -------- d-----w- c:\program files\Common Files\Adobe
2009-06-02 19:50 . 2009-06-02 19:50 -------- d-----w- c:\program files\Common Files\Macrovision Shared
2009-06-02 19:50 . 2009-06-02 19:50 -------- d-----w- c:\program files\Common Files\Adobe AIR
2009-05-09 05:50 . 2009-06-19 18:18 915456 ----a-w- c:\windows\system32\wininet.dll
2009-05-09 05:34 . 2009-06-19 18:18 71680 ----a-w- c:\windows\system32\iesetup.dll
2009-04-23 12:43 . 2009-06-11 06:46 784896 ----a-w- c:\windows\system32\rpcrt4.dll
2009-04-23 12:42 . 2009-06-11 06:46 636928 ----a-w- c:\windows\system32\localspl.dll
2009-06-12 19:30 . 2008-10-24 06:03 134648 ----a-w- c:\program files\mozilla firefox\components\brwsrcmp.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Aim6"="c:\program files\AIM6\aim6.exe" [2009-05-19 49968]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"hpWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2007-03-01 472776]
"WAWifiMessage"="c:\program files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe" [2007-01-10 317128]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-12-04 13556256]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-12-04 92704]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"Launcher"="c:\windows\SMINST\launcher.exe" [2006-11-08 44128]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=c:\windows\pss\Adobe Reader Speed Launch.lnk.CommonStartup
backupExtension=.CommonStartup

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Adobe Reader Synchronizer.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Reader Synchronizer.lnk
backup=c:\windows\pss\Adobe Reader Synchronizer.lnk.CommonStartup
backupExtension=.CommonStartup

[HKLM\~\startupfolder\C:^Users^Mitam^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OneNote 2007 Screen Clipper and Launcher.lnk]
path=c:\users\Mitam\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Screen Clipper and Launcher.lnk
backup=c:\windows\pss\OneNote 2007 Screen Clipper and Launcher.lnk.Startup
backupExtension=.Startup

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{9D7A51B4-1ADE-4856-B496-3C398698BF01}"= UDP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{80DD3954-7E43-49A8-A599-BD740C0EACDE}"= TCP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{73F8EB6E-7E17-4725-9182-B38B7283DA0C}"= c:\program files\HP\QuickPlay\QP.exe:Quick Play
"{A7DB3633-1AA8-4129-8FC4-53D2B15DDCBD}"= c:\program files\HP\QuickPlay\QPService.exe:Quick Play Resident Program
"{859BFBF2-8299-4F19-8F89-638C280BC252}"= UDP:c:\program files\earthlink totalaccess\TaskPanl.exe:taskpanl
"{56C3BF16-0580-478A-9DB5-C2D10146020E}"= TCP:c:\program files\earthlink totalaccess\TaskPanl.exe:taskpanl
"{5E8A0479-9B27-452D-AAEC-37D0C4F6AFC8}"= UDP:c:\program files\earthlink totalaccess\TaskPanl.exe:taskpanl
"{17E010E9-F214-46EB-ADB8-593154CA519E}"= TCP:c:\program files\earthlink totalaccess\TaskPanl.exe:taskpanl
"{606E5035-9832-4170-9280-9B9B79044CE1}"= UDP:c:\program files\earthlink totalaccess\TaskPanl.exe:taskpanl
"{19373767-1236-480A-8416-4909E02376F1}"= TCP:c:\program files\earthlink totalaccess\TaskPanl.exe:taskpanl
"{0D5F17B6-FB99-4C45-8A27-095A18602B7C}"= UDP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{0F232F3B-E633-456A-8794-0C458C5DAA85}"= TCP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{DBBD76F9-6810-40BC-A156-BCA1C7CC0F7B}"= UDP:c:\program files\iTunes\iTunes.exe:iTunes
"{9F6F4509-14D8-4693-8582-7B5AE64F6B48}"= TCP:c:\program files\iTunes\iTunes.exe:iTunes
"TCP Query User{AF7C0D04-74D2-4711-ACB9-203BFFE75E6B}c:\\program files\\vuze\\azureus.exe"= UDP:c:\program files\vuze\azureus.exe:Azureus
"UDP Query User{577555FB-3FBC-4F43-84F1-406D41ACFE61}c:\\program files\\vuze\\azureus.exe"= TCP:c:\program files\vuze\azureus.exe:Azureus
"{DE4314D7-2351-4345-A1BA-A4400E245E94}"= UDP:c:\program files\LimeWire\LimeWire.exe:LimeWire
"{0BD380BC-B3EB-4564-9A6F-1FF263735333}"= TCP:c:\program files\LimeWire\LimeWire.exe:LimeWire
"TCP Query User{5518BBB3-AFFE-4D97-9DDC-D1FDA0DEDF5A}c:\\program files\\warcraft iii\\war3.exe"= UDP:c:\program files\warcraft iii\war3.exe:Warcraft III
"UDP Query User{374C5C6B-D5E9-4FF4-8301-01D549041FF7}c:\\program files\\warcraft iii\\war3.exe"= TCP:c:\program files\warcraft iii\war3.exe:Warcraft III
"{CDF50E01-77A5-4FF1-A8DF-4D0089D9D37B}"= UDP:c:\program files\Yahoo!\Messenger\YahooMessenger.exe:Yahoo! Messenger
"{7485E0E5-5A0B-4C0B-9D2E-C13AA7AA1316}"= TCP:c:\program files\Yahoo!\Messenger\YahooMessenger.exe:Yahoo! Messenger
"{F81C8404-E972-4213-816F-9D2AC8D95575}"= UDP:c:\program files\Common Files\AOL\Loader\aolload.exe:AOL Loader
"{501D2856-05FC-487B-9686-11011CDB682A}"= TCP:c:\program files\Common Files\AOL\Loader\aolload.exe:AOL Loader
"{E5AFD565-800F-4FF1-B3CF-F65F9A4F1A09}"= UDP:c:\program files\AIM6\aim6.exe:AIM
"{969F0BA1-AA22-46AF-96B8-C33449FB0BB5}"= TCP:c:\program files\AIM6\aim6.exe:AIM
"TCP Query User{A3B9F169-42F4-4A8E-9E6A-A9B4CC9A990D}c:\\program files\\internet explorer\\iexplore.exe"= UDP:c:\program files\internet explorer\iexplore.exe:Internet Explorer
"UDP Query User{B3B4CA29-05CC-47A8-843E-6284A9DF4ABF}c:\\program files\\internet explorer\\iexplore.exe"= TCP:c:\program files\internet explorer\iexplore.exe:Internet Explorer
"{73DA009F-4370-4D31-8E5C-2D4A8E13CAF7}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{B3535CEF-7740-4B21-8FC9-269A4EE51717}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{441013F6-DEB1-4C4E-B611-8DDD4A2D6E40}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{51CAFA8E-73A8-4220-A3AD-FD729A765304}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{91644312-00F8-41DA-925B-D15DC7A41F48}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{CB4A6135-FC6A-4645-B657-40DA3D9471A4}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{C79DB1F1-7277-4487-9F8B-0ADE5C9EB14A}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{F6405534-88E5-4EA2-9698-01D75031CC00}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{B11E90E3-0245-4E8C-B22C-7D51C1748B0F}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{352DB064-03A4-40E8-8A34-774910FA7BBA}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{11420C5A-AC8E-4FA4-9A2A-B09D2113ED9E}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{6C659DDF-DBB2-40E4-BD24-65181AA1835A}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{6210DD36-0D54-481E-BCD7-28B50923CAD1}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{8AB07A11-330B-446A-A638-C7FB7BFDC22F}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{3785C76A-AA33-443C-9447-CE2A4A5AA3DE}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{0465D557-C130-4C98-B986-671BCBC96E83}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{571A3EC3-FEEC-4EF9-91D6-226076CE6DAA}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{96119DC4-3517-409C-BD3A-B4AE2510F6DC}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{608EAB65-E4A8-4B61-887B-8D7939DE4955}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{FC525F68-15FD-4412-83AF-41B62F7E3A88}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{8A4B07E3-F3C8-4B7E-8A3B-89BC5B675F24}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{EAACC13B-D578-43AD-BE37-CBF2D1E8632D}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{EACA67FC-9A53-4B47-BEEF-98DCAF9255E7}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{B269906B-3804-469B-93AA-74BE7B4FE88D}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{6F62F350-7962-4A39-AB7D-23E8DB5654EE}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{F2A5861F-37D8-4B75-8D5A-BFB43F7FA6BD}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{A760EAAA-D37C-432C-B71A-E9046ED64450}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{26A6B476-0055-4021-851B-CF2FD0B8BB17}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{1C8C36E5-A389-4843-AAF0-480023103836}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{C8BC1E25-FDC3-4285-9D8F-15AD5B985C43}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{1DE5C24D-6790-4B79-9471-11A836398E98}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{A3F35C3A-DE3D-4204-AE6B-35A73B6D2A91}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{EEA1B18F-5CB6-47F6-8692-9CC6360CC4DF}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{F230D5BC-21BE-4F5B-B6E6-E3BDE32DE202}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{7F645FE1-5621-481E-A6F0-29E43299D856}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{B1E6354F-15D5-4C49-9D42-0D3DE86E68EB}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{D9E1E4BF-2807-4F0E-B3FE-7D9AC37F2B6F}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{32CEC970-7B9D-4C97-AD99-36F62F2F027A}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{CF28384C-A20B-4379-AF2C-72754BB16B5C}"= c:\program files\Skype\Phone\Skype.exe:Skype

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile\AuthorizedApplications\List]
"c:\\Program Files\\EarthLink TotalAccess\\TaskPanl.exe"= c:\program files\EarthLink TotalAccess\TaskPanl.exe:*:Enabled:Earthlink

R2 IntuitUpdateService;Intuit Update Service;c:\program files\Common Files\Intuit\Update Service\IntuitUpdateService.exe [10/10/2008 5:45 AM 13088]
S3 NPF;NetGroup Packet Filter Driver;c:\windows\System32\drivers\npf.sys [8/2/2005 4:10 PM 32512]
S4 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [10/29/2008 3:05 PM 24652]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08
bthsvcs REG_MULTI_SZ BthServ
WindowsMobile REG_MULTI_SZ wcescomm rapimgr
LocalServiceRestricted REG_MULTI_SZ WcesComm RapiMgr

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\System32\rundll32.exe" "c:\windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
.

mitam101
Novice
Novice

Posts Posts : 23
Joined Joined : 2009-07-13
OS OS : Windows Vista
Points Points : 27075
# Likes # Likes : 0

View user profile

Back to top Go down

Re: System Security 2009, half removed

Post by mitam101 on 20th July 2009, 6:20 pm

------- Supplementary Scan -------
.
uStart Page = [You must be registered and logged in to see this link.]
mStart Page = [You must be registered and logged in to see this link.]
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
FF - ProfilePath - c:\users\Mitam\AppData\Roaming\Mozilla\Firefox\Profiles\r1utmayd.default\
FF - component: c:\program files\Mozilla Firefox\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}\components\NPComponent.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npViewpoint.dll
FF - plugin: c:\program files\Viewpoint\Viewpoint Media Player\npViewpoint.dll
FF - plugin: c:\users\Mitam\AppData\Roaming\Move Networks\plugins\npqmp071503000010.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, [You must be registered and logged in to see this link.]
Rootkit scan 2009-07-20 13:07
Windows 6.0.6001 Service Pack 1 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\RNG*]
"Seed"=hex:49,31,f4,88,04,28,01,14,c5,ca,fa,5f,f5,cf,66,6e,1f,6c,42,48,3b,1d,
bb,84,6e,c3,98,a3,07,68,b8,a1,8e,3f,71,ca,a8,53,6d,af,a8,e5,29,51,a3,e5,99,\
"Seed"=hex:49,31,f4,88,04,28,01,14,c5,ca,fa,5f,f5,cf,66,6e,1f,6c,42,48,3b,1d,
bb,84,6e,c3,98,a3,07,68,b8,a1,8e,3f,71,ca,a8,53,6d,af,a8,e5,29,51,a3,e5,99,\
"Seed"=hex:49,31,f4,88,04,28,01,14,c5,ca,fa,5f,f5,cf,66,6e,1f,6c,42,48,3b,1d,
bb,84,6e,c3,98,a3,07,68,b8,a1,8e,3f,71,ca,a8,53,6d,af,a8,e5,29,51,a3,e5,99,\
"Seed"=hex:49,31,f4,88,04,28,01,14,c5,ca,fa,5f,f5,cf,66,6e,1f,6c,42,48,3b,1d,
bb,84,6e,c3,98,a3,07,68,b8,a1,8e,3f,71,ca,a8,53,6d,af,a8,e5,29,51,a3,e5,99,\

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Completion time: 2009-07-20 13:10
ComboFix-quarantined-files.txt 2009-07-20 18:10

Pre-Run: 43,290,333,184 bytes free
Post-Run: 43,300,876,288 bytes free

388 --- E O F --- 2009-07-20 17:31

mitam101
Novice
Novice

Posts Posts : 23
Joined Joined : 2009-07-13
OS OS : Windows Vista
Points Points : 27075
# Likes # Likes : 0

View user profile

Back to top Go down

Re: System Security 2009, half removed

Post by Origin on 21st July 2009, 5:55 pm

Now open a new notepad file.
Input this into the notepad file:

Folder::
c:\program files\LimeWire
c:\programdata\Viewpoint

Registry::
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"TCP Query User{AF7C0D04-74D2-4711-ACB9-203BFFE75E6B}c:\\program files\\vuze\\azureus.exe"=-
"UDP Query User{577555FB-3FBC-4F43-84F1-406D41ACFE61}c:\\program files\\vuze\\azureus.exe"=-
"{DE4314D7-2351-4345-A1BA-A4400E245E94}"=-
"{0BD380BC-B3EB-4564-9A6F-1FF263735333}"=-


Save this as CFScript.txt, save it to your desktop also.
Then drag and drop CFScript.txt into combofix as seen below:


This will open combofix again, agree to it's terms and allow it to run.
It may want to reboot after it's done. (It will warn you if it wants to)
Post the resulting log back here.


While my help is always free, please consider donating to keep this site alive: [You must be registered and logged in to see this link.]

[You must be registered and logged in to see this link.]

Origin
Master
Master

Posts Posts : 2685
Joined Joined : 2009-05-05
Gender Gender : Male
OS OS : Windows Xp Sp3
Points Points : 31503
# Likes # Likes : 0

View user profile

Back to top Go down

Re: System Security 2009, half removed

Post by mitam101 on 21st July 2009, 7:16 pm

ComboFix 09-07-20.05 - Mitam 07/21/2009 14:06.4.2 - NTFSx86
Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.1.1033.18.1982.1077 [GMT -5:00]
Running from: c:\users\Mitam\Desktop\Combo-Fix.exe
Command switches used :: c:\users\Mitam\Desktop\CFScript.txt
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\LimeWire
c:\program files\LimeWire\clink.jar
c:\program files\LimeWire\commons-httpclient.jar
c:\program files\LimeWire\commons-logging.jar
c:\program files\LimeWire\commons-net.jar
c:\program files\LimeWire\COPYING
c:\program files\LimeWire\daap.jar
c:\program files\LimeWire\data.ser
c:\program files\LimeWire\donotremove.htm
c:\program files\LimeWire\GenericWindowsUtils.dll
c:\program files\LimeWire\hashes
c:\program files\LimeWire\hs_err_pid3624.log
c:\program files\LimeWire\hs_err_pid3920.log
c:\program files\LimeWire\hs_err_pid3984.log
c:\program files\LimeWire\hs_err_pid4072.log
c:\program files\LimeWire\i18n.jar
c:\program files\LimeWire\icu4j.jar
c:\program files\LimeWire\id3v2.jar
c:\program files\LimeWire\install.log
c:\program files\LimeWire\jcraft.jar
c:\program files\LimeWire\jl011.jar
c:\program files\LimeWire\jmdns.jar
c:\program files\LimeWire\language.prop
c:\program files\LimeWire\LimeWire On Startup.lnk
c:\program files\LimeWire\LimeWire.exe
c:\program files\LimeWire\LimeWire.ico
c:\program files\LimeWire\LimeWire.jar
c:\program files\LimeWire\LimeWire20.dll
c:\program files\LimeWire\log4j.jar
c:\program files\LimeWire\log4j.properties
c:\program files\LimeWire\looks.jar
c:\program files\LimeWire\MessagesBundle.properties
c:\program files\LimeWire\MessagesBundles.jar
c:\program files\LimeWire\mp3sp14.jar
c:\program files\LimeWire\pmf.ico
c:\program files\LimeWire\ProgressTabs.jar
c:\program files\LimeWire\root\magnet10\badge.img
c:\program files\LimeWire\root\magnet10\canHandle.img
c:\program files\LimeWire\root\magnet10\limewire.gif
c:\program files\LimeWire\root\magnet10\options.js
c:\program files\LimeWire\root\magnet10\silentdetect.js
c:\program files\LimeWire\SOURCE
c:\program files\LimeWire\spacer.gif
c:\program files\LimeWire\themes.jar
c:\program files\LimeWire\tritonus.jar
c:\program files\LimeWire\uninstall.exe
c:\program files\LimeWire\update.ver
c:\program files\LimeWire\vorbis.jar
c:\program files\LimeWire\WindowsFirewall.dll
c:\program files\LimeWire\WindowsV5PlusUtils.dll
c:\program files\LimeWire\xerces.jar
c:\program files\LimeWire\xml-apis.jar
c:\program files\LimeWire\xml.war
c:\programdata\Viewpoint

.
((((((((((((((((((((((((( Files Created from 2009-06-21 to 2009-07-21 )))))))))))))))))))))))))))))))
.

2009-07-21 19:12 . 2009-07-21 19:12 -------- d-----w- c:\users\Mitam\AppData\Local\temp
2009-07-21 19:12 . 2009-07-21 19:12 -------- d-----w- c:\windows\system32\config\systemprofile\AppData\Local\temp
2009-07-21 00:19 . 2008-12-03 05:41 38200 ----a-w- c:\users\Mitam\AppData\Roaming\Macromedia\Flash Player\[You must be registered and logged in to see this link.]
2009-07-18 19:02 . 2009-07-18 19:02 3775176 ----a-w- c:\programdata\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe
2009-07-18 19:00 . 2009-07-18 19:00 -------- d-----w- C:\_OTM
2009-07-16 14:34 . 2009-06-15 15:24 156672 ----a-w- c:\windows\system32\t2embed.dll
2009-07-16 14:34 . 2009-06-15 15:20 72704 ----a-w- c:\windows\system32\fontsub.dll
2009-07-16 14:34 . 2009-06-15 15:20 10240 ----a-w- c:\windows\system32\dciman32.dll
2009-07-16 14:34 . 2009-06-15 12:52 289792 ----a-w- c:\windows\system32\atmfd.dll
2009-07-12 23:47 . 2009-07-12 23:52 -------- d-----w- c:\program files\Spybot - Search & Destroy
2009-07-12 23:47 . 2009-07-12 23:47 -------- d-----w- c:\programdata\Spybot - Search & Destroy
2009-07-11 19:08 . 2009-07-11 19:08 -------- d-----w- c:\users\Mitam\AppData\Roaming\Malwarebytes
2009-07-11 19:07 . 2009-07-13 18:36 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-07-11 19:07 . 2009-07-18 19:04 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-07-11 19:07 . 2009-07-13 18:36 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-07-11 19:07 . 2009-07-11 19:07 -------- d-----w- c:\programdata\Malwarebytes
2009-07-11 19:02 . 2009-07-11 19:02 680 ----a-w- c:\users\Mitam\AppData\Local\d3d9caps.dat
2009-07-10 04:30 . 2009-07-10 04:30 127872 ----a-w- c:\users\Mitam\AppData\Roaming\Move Networks\uninstall.exe
2009-07-10 04:30 . 2009-07-10 04:31 -------- d-----w- c:\users\Mitam\AppData\Roaming\Move Networks
2009-07-09 15:45 . 2009-07-09 15:45 81 ----a-w- C:\CTX.DAT
2009-07-09 15:45 . 2009-07-09 15:45 -------- d-----w- c:\users\Mitam\Citrix
2009-07-08 08:20 . 2009-07-08 08:20 -------- d-----w- c:\program files\AviSynth 2.5
2009-07-08 08:20 . 2009-07-08 08:20 -------- d-----w- c:\program files\Red Kawa
2009-07-08 08:18 . 2009-07-08 08:18 -------- d-----w- c:\users\Mitam\AppData\Roaming\AVS4YOU
2009-07-08 08:18 . 2009-07-08 08:18 -------- d-----w- c:\programdata\AVS4YOU
2009-07-08 08:17 . 2009-07-08 08:18 -------- d-----w- c:\program files\Common Files\AVSMedia
2009-07-08 08:17 . 2008-08-13 16:22 974848 ----a-w- c:\windows\system32\mfc70.dll
2009-07-08 08:17 . 2009-07-08 08:20 -------- d-----w- c:\program files\AVS4YOU
2009-07-08 08:17 . 2008-08-13 16:22 1700352 ----a-w- c:\windows\system32\GdiPlus.dll
2009-07-08 08:17 . 2008-08-13 16:22 24576 ----a-w- c:\windows\system32\msxml3a.dll
2009-06-25 17:30 . 2009-06-25 17:40 4506256 ----a-w- c:\users\Mitam\AppData\Roaming\LimeWire\.NetworkShare\LimeWireWin4.16.6.exe
2009-06-24 23:02 . 2009-06-24 23:02 -------- d-----w- c:\users\Mitam\AppData\Roaming\acccore
2009-06-24 23:01 . 2009-06-24 23:01 -------- d-----w- c:\users\Mitam\AppData\Local\AOL OCP
2009-06-24 23:00 . 2009-06-24 23:00 -------- d-----w- c:\programdata\acccore
2009-06-24 22:59 . 2009-06-24 23:00 -------- d-----w- c:\program files\AIM6
2009-06-24 16:03 . 2009-06-24 19:00 -------- d-----w- c:\program files\CamStudio
2009-06-23 19:38 . 2009-06-23 19:41 -------- d-----w- c:\users\Mitam\AppData\Roaming\Pamela
2009-06-23 19:38 . 2009-06-23 19:38 176128 ----a-w- c:\windows\system32\RemoteControl.dll
2009-06-23 19:38 . 2009-06-23 19:38 -------- d-----w- c:\program files\Pamela
2009-06-23 18:50 . 2009-06-23 18:50 56 ---ha-w- c:\windows\system32\ezsidmv.dat
2009-06-23 18:50 . 2009-07-11 18:24 -------- d-----w- c:\users\Mitam\AppData\Roaming\skypePM
2009-06-23 18:48 . 2009-07-10 21:27 -------- d-----w- c:\users\Mitam\AppData\Roaming\Skype
2009-06-23 18:48 . 2009-06-23 18:48 -------- d-----w- c:\program files\Common Files\Skype
2009-06-23 18:48 . 2009-06-23 18:48 -------- d-----r- c:\program files\Skype
2009-06-23 18:47 . 2009-06-23 18:48 -------- d-----w- c:\programdata\Skype

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-07-21 18:59 . 2009-06-19 17:54 55918 ----a-w- c:\programdata\nvModes.dat
2009-07-21 15:50 . 2009-02-07 15:53 12 ----a-w- c:\windows\bthservsdp.dat
2009-07-16 14:42 . 2008-10-24 06:14 -------- d-----w- c:\users\Mitam\AppData\Roaming\Azureus
2009-07-12 06:32 . 2008-10-24 07:42 -------- d-----w- c:\program files\Warcraft III
2009-07-10 04:30 . 2009-06-16 06:35 4183416 ----a-w- c:\users\Mitam\AppData\Roaming\Move Networks\plugins\npqmp071503000010.dll
2009-06-24 22:59 . 2008-10-29 20:05 -------- d-----w- c:\program files\Common Files\AOL
2009-06-20 08:02 . 2008-10-24 03:34 76984 ----a-w- c:\users\Mitam\AppData\Local\GDIPFONTCACHEV1.DAT
2009-06-19 18:50 . 2008-10-24 07:55 -------- d-----w- c:\programdata\NVIDIA
2009-06-19 18:03 . 2008-07-14 02:57 -------- d-----w- c:\programdata\Microsoft Help
2009-06-19 18:00 . 2008-07-14 02:55 -------- d-----w- c:\program files\Microsoft Works
2009-06-19 06:03 . 2008-10-24 07:57 13025 ----a-w- c:\users\Mitam\AppData\Roaming\nvModes.dat
2009-06-17 04:45 . 2009-06-17 04:45 -------- d-----w- c:\program files\Microsoft Silverlight
2009-06-16 06:35 . 2009-06-16 06:35 97144 ----a-w- c:\users\Mitam\AppData\Roaming\Move Networks\ie_bin\MovePlayerUpgrade.exe
2009-06-10 22:05 . 2008-10-24 06:58 -------- d-----w- c:\users\Mitam\AppData\Roaming\LimeWire
2009-06-09 17:00 . 2009-06-02 19:58 -------- d-----w- c:\programdata\FLEXnet
2009-06-02 19:54 . 2008-07-14 03:17 -------- d-----w- c:\program files\Common Files\Adobe
2009-06-02 19:50 . 2009-06-02 19:50 -------- d-----w- c:\program files\Common Files\Macrovision Shared
2009-06-02 19:50 . 2009-06-02 19:50 -------- d-----w- c:\program files\Common Files\Adobe AIR
2009-05-09 05:50 . 2009-06-19 18:18 915456 ----a-w- c:\windows\system32\wininet.dll
2009-05-09 05:34 . 2009-06-19 18:18 71680 ----a-w- c:\windows\system32\iesetup.dll
2009-04-23 12:43 . 2009-06-11 06:46 784896 ----a-w- c:\windows\system32\rpcrt4.dll
2009-04-23 12:42 . 2009-06-11 06:46 636928 ----a-w- c:\windows\system32\localspl.dll
2009-06-12 19:30 . 2008-10-24 06:03 134648 ----a-w- c:\program files\mozilla firefox\components\brwsrcmp.dll
.

((((((((((((((((((((((((((((( [You must be registered and logged in to see this link.] )))))))))))))))))))))))))))))))))))))))))
.
- 2009-07-20 16:20 . 2009-07-20 16:20 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2009-07-21 16:17 . 2009-07-21 16:17 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2009-07-21 16:17 . 2009-07-21 16:17 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
- 2009-07-20 16:20 . 2009-07-20 16:20 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
.

mitam101
Novice
Novice

Posts Posts : 23
Joined Joined : 2009-07-13
OS OS : Windows Vista
Points Points : 27075
# Likes # Likes : 0

View user profile

Back to top Go down

Re: System Security 2009, half removed

Post by mitam101 on 21st July 2009, 7:16 pm

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Aim6"="c:\program files\AIM6\aim6.exe" [2009-05-19 49968]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"hpWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2007-03-01 472776]
"WAWifiMessage"="c:\program files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe" [2007-01-10 317128]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-12-04 13556256]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-12-04 92704]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"Launcher"="c:\windows\SMINST\launcher.exe" [2006-11-08 44128]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=c:\windows\pss\Adobe Reader Speed Launch.lnk.CommonStartup
backupExtension=.CommonStartup

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Adobe Reader Synchronizer.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Reader Synchronizer.lnk
backup=c:\windows\pss\Adobe Reader Synchronizer.lnk.CommonStartup
backupExtension=.CommonStartup

[HKLM\~\startupfolder\C:^Users^Mitam^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OneNote 2007 Screen Clipper and Launcher.lnk]
path=c:\users\Mitam\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Screen Clipper and Launcher.lnk
backup=c:\windows\pss\OneNote 2007 Screen Clipper and Launcher.lnk.Startup
backupExtension=.Startup

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{9D7A51B4-1ADE-4856-B496-3C398698BF01}"= UDP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{80DD3954-7E43-49A8-A599-BD740C0EACDE}"= TCP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{73F8EB6E-7E17-4725-9182-B38B7283DA0C}"= c:\program files\HP\QuickPlay\QP.exe:Quick Play
"{A7DB3633-1AA8-4129-8FC4-53D2B15DDCBD}"= c:\program files\HP\QuickPlay\QPService.exe:Quick Play Resident Program
"{859BFBF2-8299-4F19-8F89-638C280BC252}"= UDP:c:\program files\earthlink totalaccess\TaskPanl.exe:taskpanl
"{56C3BF16-0580-478A-9DB5-C2D10146020E}"= TCP:c:\program files\earthlink totalaccess\TaskPanl.exe:taskpanl
"{5E8A0479-9B27-452D-AAEC-37D0C4F6AFC8}"= UDP:c:\program files\earthlink totalaccess\TaskPanl.exe:taskpanl
"{17E010E9-F214-46EB-ADB8-593154CA519E}"= TCP:c:\program files\earthlink totalaccess\TaskPanl.exe:taskpanl
"{606E5035-9832-4170-9280-9B9B79044CE1}"= UDP:c:\program files\earthlink totalaccess\TaskPanl.exe:taskpanl
"{19373767-1236-480A-8416-4909E02376F1}"= TCP:c:\program files\earthlink totalaccess\TaskPanl.exe:taskpanl
"{0D5F17B6-FB99-4C45-8A27-095A18602B7C}"= UDP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{0F232F3B-E633-456A-8794-0C458C5DAA85}"= TCP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{DBBD76F9-6810-40BC-A156-BCA1C7CC0F7B}"= UDP:c:\program files\iTunes\iTunes.exe:iTunes
"{9F6F4509-14D8-4693-8582-7B5AE64F6B48}"= TCP:c:\program files\iTunes\iTunes.exe:iTunes
"TCP Query User{5518BBB3-AFFE-4D97-9DDC-D1FDA0DEDF5A}c:\\program files\\warcraft iii\\war3.exe"= UDP:c:\program files\warcraft iii\war3.exe:Warcraft III
"UDP Query User{374C5C6B-D5E9-4FF4-8301-01D549041FF7}c:\\program files\\warcraft iii\\war3.exe"= TCP:c:\program files\warcraft iii\war3.exe:Warcraft III
"{CDF50E01-77A5-4FF1-A8DF-4D0089D9D37B}"= UDP:c:\program files\Yahoo!\Messenger\YahooMessenger.exe:Yahoo! Messenger
"{7485E0E5-5A0B-4C0B-9D2E-C13AA7AA1316}"= TCP:c:\program files\Yahoo!\Messenger\YahooMessenger.exe:Yahoo! Messenger
"{F81C8404-E972-4213-816F-9D2AC8D95575}"= UDP:c:\program files\Common Files\AOL\Loader\aolload.exe:AOL Loader
"{501D2856-05FC-487B-9686-11011CDB682A}"= TCP:c:\program files\Common Files\AOL\Loader\aolload.exe:AOL Loader
"{E5AFD565-800F-4FF1-B3CF-F65F9A4F1A09}"= UDP:c:\program files\AIM6\aim6.exe:AIM
"{969F0BA1-AA22-46AF-96B8-C33449FB0BB5}"= TCP:c:\program files\AIM6\aim6.exe:AIM
"TCP Query User{A3B9F169-42F4-4A8E-9E6A-A9B4CC9A990D}c:\\program files\\internet explorer\\iexplore.exe"= UDP:c:\program files\internet explorer\iexplore.exe:Internet Explorer
"UDP Query User{B3B4CA29-05CC-47A8-843E-6284A9DF4ABF}c:\\program files\\internet explorer\\iexplore.exe"= TCP:c:\program files\internet explorer\iexplore.exe:Internet Explorer
"{73DA009F-4370-4D31-8E5C-2D4A8E13CAF7}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{B3535CEF-7740-4B21-8FC9-269A4EE51717}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{441013F6-DEB1-4C4E-B611-8DDD4A2D6E40}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{51CAFA8E-73A8-4220-A3AD-FD729A765304}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{91644312-00F8-41DA-925B-D15DC7A41F48}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{CB4A6135-FC6A-4645-B657-40DA3D9471A4}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{C79DB1F1-7277-4487-9F8B-0ADE5C9EB14A}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{F6405534-88E5-4EA2-9698-01D75031CC00}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{B11E90E3-0245-4E8C-B22C-7D51C1748B0F}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{352DB064-03A4-40E8-8A34-774910FA7BBA}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{11420C5A-AC8E-4FA4-9A2A-B09D2113ED9E}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{6C659DDF-DBB2-40E4-BD24-65181AA1835A}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{6210DD36-0D54-481E-BCD7-28B50923CAD1}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{8AB07A11-330B-446A-A638-C7FB7BFDC22F}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{3785C76A-AA33-443C-9447-CE2A4A5AA3DE}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{0465D557-C130-4C98-B986-671BCBC96E83}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{571A3EC3-FEEC-4EF9-91D6-226076CE6DAA}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{96119DC4-3517-409C-BD3A-B4AE2510F6DC}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{608EAB65-E4A8-4B61-887B-8D7939DE4955}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{FC525F68-15FD-4412-83AF-41B62F7E3A88}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{8A4B07E3-F3C8-4B7E-8A3B-89BC5B675F24}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{EAACC13B-D578-43AD-BE37-CBF2D1E8632D}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{EACA67FC-9A53-4B47-BEEF-98DCAF9255E7}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{B269906B-3804-469B-93AA-74BE7B4FE88D}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{6F62F350-7962-4A39-AB7D-23E8DB5654EE}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{F2A5861F-37D8-4B75-8D5A-BFB43F7FA6BD}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{A760EAAA-D37C-432C-B71A-E9046ED64450}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{26A6B476-0055-4021-851B-CF2FD0B8BB17}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{1C8C36E5-A389-4843-AAF0-480023103836}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{C8BC1E25-FDC3-4285-9D8F-15AD5B985C43}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{1DE5C24D-6790-4B79-9471-11A836398E98}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{A3F35C3A-DE3D-4204-AE6B-35A73B6D2A91}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{EEA1B18F-5CB6-47F6-8692-9CC6360CC4DF}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{F230D5BC-21BE-4F5B-B6E6-E3BDE32DE202}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{7F645FE1-5621-481E-A6F0-29E43299D856}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{B1E6354F-15D5-4C49-9D42-0D3DE86E68EB}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{D9E1E4BF-2807-4F0E-B3FE-7D9AC37F2B6F}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{32CEC970-7B9D-4C97-AD99-36F62F2F027A}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{CF28384C-A20B-4379-AF2C-72754BB16B5C}"= c:\program files\Skype\Phone\Skype.exe:Skype

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile\AuthorizedApplications\List]
"c:\\Program Files\\EarthLink TotalAccess\\TaskPanl.exe"= c:\program files\EarthLink TotalAccess\TaskPanl.exe:*:Enabled:Earthlink

R2 IntuitUpdateService;Intuit Update Service;c:\program files\Common Files\Intuit\Update Service\IntuitUpdateService.exe [10/10/2008 5:45 AM 13088]
S3 NPF;NetGroup Packet Filter Driver;c:\windows\System32\drivers\npf.sys [8/2/2005 4:10 PM 32512]
S4 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [10/29/2008 3:05 PM 24652]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08
bthsvcs REG_MULTI_SZ BthServ
WindowsMobile REG_MULTI_SZ wcescomm rapimgr
LocalServiceRestricted REG_MULTI_SZ WcesComm RapiMgr

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\System32\rundll32.exe" "c:\windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
.
------- Supplementary Scan -------
.
uStart Page = [You must be registered and logged in to see this link.]
mStart Page = [You must be registered and logged in to see this link.]
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
FF - ProfilePath - c:\users\Mitam\AppData\Roaming\Mozilla\Firefox\Profiles\r1utmayd.default\
FF - component: c:\program files\Mozilla Firefox\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}\components\NPComponent.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npViewpoint.dll
FF - plugin: c:\program files\Viewpoint\Viewpoint Media Player\npViewpoint.dll
FF - plugin: c:\users\Mitam\AppData\Roaming\Move Networks\plugins\npqmp071503000010.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, [You must be registered and logged in to see this link.]
Rootkit scan 2009-07-21 14:12
Windows 6.0.6001 Service Pack 1 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\RNG*]
"Seed"=hex:49,31,f4,88,04,28,01,14,c5,ca,fa,5f,f5,cf,66,6e,1f,6c,42,48,3b,1d,
bb,84,6e,c3,98,a3,07,68,b8,a1,8e,3f,71,ca,a8,53,6d,af,a8,e5,29,51,a3,e5,99,\
"Seed"=hex:49,31,f4,88,04,28,01,14,c5,ca,fa,5f,f5,cf,66,6e,1f,6c,42,48,3b,1d,
bb,84,6e,c3,98,a3,07,68,b8,a1,8e,3f,71,ca,a8,53,6d,af,a8,e5,29,51,a3,e5,99,\
"Seed"=hex:49,31,f4,88,04,28,01,14,c5,ca,fa,5f,f5,cf,66,6e,1f,6c,42,48,3b,1d,
bb,84,6e,c3,98,a3,07,68,b8,a1,8e,3f,71,ca,a8,53,6d,af,a8,e5,29,51,a3,e5,99,\
"Seed"=hex:49,31,f4,88,04,28,01,14,c5,ca,fa,5f,f5,cf,66,6e,1f,6c,42,48,3b,1d,
bb,84,6e,c3,98,a3,07,68,b8,a1,8e,3f,71,ca,a8,53,6d,af,a8,e5,29,51,a3,e5,99,\

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Completion time: 2009-07-21 14:14
ComboFix-quarantined-files.txt 2009-07-21 19:14
ComboFix2.txt 2009-07-20 18:10

Pre-Run: 42,932,330,496 bytes free
Post-Run: 42,905,620,480 bytes free

308 --- E O F --- 2009-07-20 17:31

mitam101
Novice
Novice

Posts Posts : 23
Joined Joined : 2009-07-13
OS OS : Windows Vista
Points Points : 27075
# Likes # Likes : 0

View user profile

Back to top Go down

Re: System Security 2009, half removed

Post by Origin on 21st July 2009, 7:17 pm

Please download and run this tool.

Download Malwarebytes' Anti-Malware from [You must be registered and logged in to see this link.]

Double Click mbam-setup.exe to install the application.

  • Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select "Perform Quick Scan", then click Scan.
  • The scan may take some time to finish,so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected.
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Note:
If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts.
Click OK to either and let MBAM proceed with the disinfection process.
If asked to restart the computer, please do so immediately.


Post the contents of the MBAM Log.


While my help is always free, please consider donating to keep this site alive: [You must be registered and logged in to see this link.]

[You must be registered and logged in to see this link.]

Origin
Master
Master

Posts Posts : 2685
Joined Joined : 2009-05-05
Gender Gender : Male
OS OS : Windows Xp Sp3
Points Points : 31503
# Likes # Likes : 0

View user profile

Back to top Go down

Re: System Security 2009, half removed

Post by mitam101 on 21st July 2009, 7:28 pm

Malwarebytes' Anti-Malware 1.39
Database version: 2475
Windows 6.0.6001 Service Pack 1

7/21/2009 2:27:40 PM
mbam-log-2009-07-21 (14-27-40).txt

Scan type: Quick Scan
Objects scanned: 78181
Time elapsed: 3 minute(s), 20 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)


Smile

mitam101
Novice
Novice

Posts Posts : 23
Joined Joined : 2009-07-13
OS OS : Windows Vista
Points Points : 27075
# Likes # Likes : 0

View user profile

Back to top Go down

Re: System Security 2009, half removed

Post by Origin on 21st July 2009, 7:31 pm

Click Start > Run and copy/paste the following bolded text into the Run box and click OK:

ComboFix /u



This will also reset your restore points.

How is the machine running now?


While my help is always free, please consider donating to keep this site alive: [You must be registered and logged in to see this link.]

[You must be registered and logged in to see this link.]

Origin
Master
Master

Posts Posts : 2685
Joined Joined : 2009-05-05
Gender Gender : Male
OS OS : Windows Xp Sp3
Points Points : 31503
# Likes # Likes : 0

View user profile

Back to top Go down

Re: System Security 2009, half removed

Post by mitam101 on 22nd July 2009, 1:53 am

I don't know if it's because of the virus or something else, but my Internet seems to be running very slow.
Alot slower than usual

mitam101
Novice
Novice

Posts Posts : 23
Joined Joined : 2009-07-13
OS OS : Windows Vista
Points Points : 27075
# Likes # Likes : 0

View user profile

Back to top Go down

Re: System Security 2009, half removed

Post by Origin on 23rd July 2009, 6:54 pm


  • Open HijackThis.
  • When Hijack This opens, click "Open the Misc Tools section"
  • Then select "Open Uninstall Manager"
  • Click on "Save List..." (generates uninstall_list.txt)
  • Click Save, copy and paste the results in your next post.


While my help is always free, please consider donating to keep this site alive: [You must be registered and logged in to see this link.]

[You must be registered and logged in to see this link.]

Origin
Master
Master

Posts Posts : 2685
Joined Joined : 2009-05-05
Gender Gender : Male
OS OS : Windows Xp Sp3
Points Points : 31503
# Likes # Likes : 0

View user profile

Back to top Go down

Re: System Security 2009, half removed

Post by mitam101 on 23rd July 2009, 8:04 pm

32 Bit HP CIO Components Installer
Adobe AIR
Adobe AIR
Adobe Anchor Service CS4
Adobe Captivate 4
Adobe Captivate 4
Adobe Captivate Reviewer 1.0
Adobe Flash Player 10 Plugin
Adobe Flash Player 9 ActiveX
Adobe Flash Player ActiveX
Adobe Help Viewer 2
Adobe Reader 8
Adobe Setup
Adobe Update Manager CS4
AIM 6
AnswerWorks 5.0 English Runtime
Apple Mobile Device Support
Apple Software Update
Articulate Studio '09 Pro
AviSynth 2.5
Bonjour
CamStudio
Conexant HD Audio
dBpoweramp FLAC Codec
ESU for Microsoft Vista
Hewlett-Packard Active Check
Hewlett-Packard Asset Agent
HijackThis 2.0.2
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
HP Active Support Library
HP Active Support Library 32 bit components
HP Customer Experience Enhancements
HP Easy Setup - Frontend
HP Help and Support
HP Pavilion Webcam Driver for Vista v061.001.00005
HP Photosmart All-In-One Software 9.0
HP Photosmart Essential 2.0
HP Quick Launch Buttons 6.20 B1
HP QuickPlay 3.2
HP Total Care Advisor
HP Update
HP User Guides 0041
HP Wireless Assistant
HPNetworkAssistant
iTunes
Java(TM) 6 Update 7
Java(TM) SE Runtime Environment 6
LimeWire PRO 4.12.4
Malwarebytes' Anti-Malware
Microsoft .NET Framework 3.5 SP1
Microsoft .NET Framework 3.5 SP1
Microsoft Office 2007 Service Pack 2 (SP2)
Microsoft Office 2007 Service Pack 2 (SP2)
Microsoft Office 2007 Service Pack 2 (SP2)
Microsoft Office 2007 Service Pack 2 (SP2)
Microsoft Office 2007 Service Pack 2 (SP2)
Microsoft Office 2007 Service Pack 2 (SP2)
Microsoft Office 2007 Service Pack 2 (SP2)
Microsoft Office Excel MUI (English) 2007
Microsoft Office Home and Student 2007
Microsoft Office Home and Student 2007
Microsoft Office OneNote MUI (English) 2007
Microsoft Office PowerPoint MUI (English) 2007
Microsoft Office Proof (English) 2007
Microsoft Office Proof (French) 2007
Microsoft Office Proof (Spanish) 2007
Microsoft Office Proofing (English) 2007
Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
Microsoft Office Shared MUI (English) 2007
Microsoft Office Shared Setup Metadata MUI (English) 2007
Microsoft Office Word MUI (English) 2007
Microsoft Silverlight
Microsoft SQL Server Compact 3.5 ENU
Microsoft VC9 runtime libraries
Microsoft Visual C++ 2005 Redistributable
Mozilla Firefox (3.0.12)
MP3 Player Utilities 4.19
MSCU for Microsoft Vista
MSXML 4.0 SP2 (KB936181)
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 Parser and SDK
NVIDIA Drivers
Pamela Pro 4.5
PocketNester
QuickTime
Recover Files 2.1
Rhapsody Player Engine
Roxio Activation Module
Security Update for 2007 Microsoft Office System (KB969559)
Security Update for 2007 Microsoft Office System (KB969679)
Security Update for CAPICOM (KB931906)
Security Update for CAPICOM (KB931906)
Security Update for Microsoft Office Excel 2007 (KB969682)
Security Update for Microsoft Office PowerPoint 2007 (KB957789)
Security Update for Microsoft Office system 2007 (KB969613)
Security Update for Microsoft Office Word 2007 (KB969604)
Skype™ 4.0
Soft Data Fax Modem with SmartCP
Spybot - Search & Destroy
Suite Shared Configuration CS4
Synaptics Pointing Device Driver
System Requirements Lab
TurboTax 2008
TurboTax 2008 wiliper
TurboTax 2008 WinPerFedFormset
TurboTax 2008 WinPerProgramHelp
TurboTax 2008 WinPerReleaseEngine
TurboTax 2008 WinPerTaxSupport
TurboTax 2008 WinPerUserEducation
TurboTax 2008 wrapper
Update for 2007 Microsoft Office System (KB967642)
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
VDMSound 2.0.4
Videora iPod Converter 4.08
Viewpoint Media Player
VLC media player 0.9.4
Vuze
Warcraft III
WavePad Sound Editor
WC3Banlist
Windows Mobile Device Center
Windows Mobile Device Center Driver Update
WinPcap 3.1
WinRAR archiver
Yahoo! Messenger

mitam101
Novice
Novice

Posts Posts : 23
Joined Joined : 2009-07-13
OS OS : Windows Vista
Points Points : 27075
# Likes # Likes : 0

View user profile

Back to top Go down

Re: System Security 2009, half removed

Post by Origin on 23rd July 2009, 8:48 pm

I see that you are running Limewire.
P2P(Peer to peer) applications are designed to help you easily share and distribute files between you and a group of people. But they can also be used to distribute malware, and thus are not considered safe.
The removal of these programs is optional, but highly recommended.

If Limewire is not removed, then I won't help you.

Go to Start > Control Panel > Add/Remove Programs and remove the following programs.

  • Limewire
  • Java(TM) 6 Update 7
  • Java(TM) SE Runtime Environment 6
  • LimeWire PRO 4.12.4
  • Viewpoint Media Player
  • Vuze


There is a new version of Firefox out, version 3.5.1, please download it here:
[You must be registered and logged in to see this link.]

Did that fix your problem?


While my help is always free, please consider donating to keep this site alive: [You must be registered and logged in to see this link.]

[You must be registered and logged in to see this link.]

Origin
Master
Master

Posts Posts : 2685
Joined Joined : 2009-05-05
Gender Gender : Male
OS OS : Windows Xp Sp3
Points Points : 31503
# Likes # Likes : 0

View user profile

Back to top Go down

View previous topic View next topic Back to top

- Similar topics

 
Permissions in this forum:
You cannot reply to topics in this forum