System Security virus

View previous topic View next topic Go down

System Security virus

Post by killerfoot0 on 2nd August 2009, 2:17 pm

I got the system security virus, and I have run Malwarebytes' Anti-Malware, numerous times, at first I forgot to update it so it only found 1 virus, but then I updated it and I got a lot more viruses, and I also ran all of this in safe. Then I restarted my computer in normal mode and after a short while a blue screen came up where I couldn't do anything and it said "a problem has been detected..." and a "dump of physical memory" has occurred. And I ran hijack this and here are the results, what should I do?

Logfile of HijackThis v1.99.1
Scan saved at 10:11:15 AM, on 8/2/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16850)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\savedump.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Hijackthis\HijackThis.exe

O1 - Hosts: ::1 localhost
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam\Quickcam.exe" /hide
O4 - HKLM\..\Run: [ThreatFire] C:\Program Files\ThreatFire\TFTray.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\RunOnce: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [LogitechSetup] D:\setup.exe /skip_all_checks /p /start /restart /l:enu
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O11 - Options group: [INTERNATIONAL] International*
O14 - IERESET.INF: START_PAGE_URL=http://www.att.net
O16 - DPF: {149E45D8-163E-4189-86FC-45022AB2B6C9} (SpinTop DRM Control) - [You must be registered and logged in to see this link.]
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - [You must be registered and logged in to see this link.]
O16 - DPF: {197F8FE3-8DF6-4755-B925-B94A1FF2F58E} (OSAKit2.OSA_Kit) - [You must be registered and logged in to see this link.]
O16 - DPF: {2D0280B1-DC42-4DFA-9525-09BD48838539} (OSAKitPro.OSAKit) - [You must be registered and logged in to see this link.]
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {3EA4FA88-E0BE-419A-A732-9B79B87A6ED0} (CTVUAxCtrl Object) - [You must be registered and logged in to see this link.]
O16 - DPF: {54B52E52-8000-4413-BD67-FC7FE24B59F2} (EARTPatchX Class) - [You must be registered and logged in to see this link.]
O16 - DPF: {6A060448-60F9-11D5-A6CD-0002B31F7455} (ExentInf Class) -
O16 - DPF: {70BA88C8-DAE8-4CE9-92BB-979C4A75F53B} - [You must be registered and logged in to see this link.]
O16 - DPF: {C36661D7-3590-45B1-80B5-520839E94DAD} (MaxisSimCity4PatcherX Control) - [You must be registered and logged in to see this link.]
O16 - DPF: {C49134CC-B5EF-458C-A442-E8DFE7B4645F} (YYGInstantPlay Control) - [You must be registered and logged in to see this link.]
O16 - DPF: {CC450D71-CC90-424C-8638-1F2DBAC87A54} (ArmHelper Control) - [You must be registered and logged in to see this link.]
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
O20 - Winlogon Notify: opnklkj - opnklkj.dll (file missing)
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O21 - SSODL: AlrtSys - {e6590784-c1d4-4361-b7aa-fec28725bf66} - C:\WINDOWS\Installer\{e6590784-c1d4-4361-b7aa-fec28725bf66}\AlrtSys.dll (file missing)
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
O23 - Service: dlbt_device - Dell - C:\WINDOWS\system32\dlbtcoms.exe
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: GameConsoleService - WildTangent, Inc. - C:\Program Files\WildGames\Game Console - WildGames\GameConsoleService.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Unknown owner - C:\Program Files\iPod\bin\iPodService.exe (file missing)
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Unknown owner - C:\Program Files\Java\jre6\bin\jqs.exe" -service -config "C:\Program Files\Java\jre6\lib\deploy\jqs\jqs.conf (file missing)
O23 - Service: LVCOMSer - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe
O23 - Service: ThreatFire - PC Tools - C:\Program Files\ThreatFire\TFService.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

What should I do?

killerfoot0
Novice
Novice

Posts Posts : 6
Joined Joined : 2009-08-02
OS OS : XP
Points Points : 26858
# Likes # Likes : 0

View user profile

Back to top Go down

Re: System Security virus

Post by Origin on 2nd August 2009, 7:55 pm

Hello killerfoot0,

Welcome to Geek Police, my name is Origin and I will be helping you today. Please keep the following in mind:

  • If you do not get a reply from me or another helper within 2 days, please reply to your topic with the phrase BUMP
  • If you have any cracked/pirated software in your computer delete them or we will not help you.
  • Only follow advise from Geek Police Staff and not a regular member.
  • Do NOT run any tool without Geek Police supervision as it could hinder your system useless.


  • Open HijackThis.
  • Choose "Do a system scan only"
  • Check the boxes in front of these lines:


    O1 - Hosts: ::1 localhost
    O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
    O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
    O20 - Winlogon Notify: opnklkj - opnklkj.dll (file missing)



  • Press "Fix Checked"
  • Close Hijack This.

1. If you are using Firefox, make sure that your download settings are as follows:

* Tools->Options->Main tab
* Set to "Always ask me where to Save the files".

2. During the download, rename Combofix to Combo-Fix as follows:





3. It is important you rename Combofix during the download, but not after.
4. Please do not rename Combofix to other names, but only to the one indicated.
5. Close any open browsers.
6. We need to disable your local AV (Anti-virus) before running Combofix.

  • See [You must be registered and logged in to see this link.] for how to disable your AV.
  • Double click on ComboFix.exe.
  • Follow the prompts. NOTE:
  • Allow combofix to run
  • Post C:\combofix.txt back here.

    Note:
    Do not mouse click combofix's window whilst it's running. That may cause it to stall.


While my help is always free, please consider donating to keep this site alive: [You must be registered and logged in to see this link.]

[You must be registered and logged in to see this link.]

Origin
Master
Master

Posts Posts : 2685
Joined Joined : 2009-05-05
Gender Gender : Male
OS OS : Windows Xp Sp3
Points Points : 31503
# Likes # Likes : 0

View user profile

Back to top Go down

Re: System Security virus

Post by killerfoot0 on 3rd August 2009, 2:46 am

Ok much obliged for the help Origin, so I followed all the steps and here's the report

ComboFix 09-08-01.09 - John 08/02/2009 21:58.1.1 - NTFSx86 NETWORK
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.247.130 [GMT -4:00]
Running from: c:\documents and settings\John\My Documents\Combo-Fix.exe
AV: CyberDefender Internet Security *On-access scanning enabled* (Updated) {C6EC0229-8E2C-4434-B342-9C188000D324}

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\docume~1\ALLUSE~1\APPLIC~1\16291874
c:\docume~1\ALLUSE~1\APPLIC~1\16291874\16291874
c:\docume~1\ALLUSE~1\APPLIC~1\16291874\16291874.exe
c:\program files\Common Files\Companion Wizard
c:\windows\Help\SBSI\cdocr.bak1
c:\windows\Help\SBSI\cdocr.bak2
c:\windows\Help\SBSI\cdocr.ini2
c:\windows\Help\SBSI\cdocr.tmp
c:\windows\Installer\{e6590784-c1d4-4361-b7aa-fec28725bf66}\AlrtSys.dll
c:\windows\pack.epk
c:\windows\system32\adbvcxel.ini
c:\windows\SYSTEM32\ayadd.bak1
c:\windows\SYSTEM32\ayadd.bak2
c:\windows\system32\ayadd.ini
c:\windows\SYSTEM32\ayadd.ini2
c:\windows\SYSTEM32\ayadd.tmp
c:\windows\system32\bluaftye.ini
c:\windows\system32\bnittaaw.ini
c:\windows\system32\bshcowvo.ini
c:\windows\system32\btmxgwcw.ini
c:\windows\system32\cbbwhmpr.ini
c:\windows\system32\cbldtdbq.ini
c:\windows\system32\ciyewpfw.ini
c:\windows\system32\codhnxog.ini
c:\windows\system32\cwriqhwx.ini
c:\windows\system32\dcljedoo.ini
c:\windows\system32\ddmaofer.ini
c:\windows\system32\detjohjd.ini
c:\windows\system32\didnuaer.ini
c:\windows\system32\drivers\vsfocekyeqrrns.sys
c:\windows\system32\eflcbide.ini
c:\windows\system32\egjnoirv.ini
c:\windows\system32\eguywijy.ini
c:\windows\system32\fsxisudg.ini
c:\windows\system32\gmjapold.ini
c:\windows\system32\hkbyynxi.ini
c:\windows\system32\hrmuhtty.ini
c:\windows\system32\icrescmj.ini
c:\windows\system32\ieacybtm.ini
c:\windows\system32\ifapnjmy.ini
c:\windows\system32\ihgtltis.ini
c:\windows\system32\ijbelcxv.ini
c:\windows\system32\ipulivho.ini
c:\windows\system32\jsbhtwjy.ini
c:\windows\system32\jtnvqrif.ini
c:\windows\system32\kdywylcc.ini
c:\windows\system32\khmqkbfc.ini
c:\windows\system32\kxqqjaqm.ini
c:\windows\system32\laogdcgb.ini
c:\windows\system32\lfgaipwl.ini
c:\windows\system32\lrnfyjps.ini
c:\windows\system32\mjmwlgav.ini
c:\windows\system32\mmsrhpvd.ini
c:\windows\system32\negeqnqn.ini
c:\windows\system32\nfkosydf.ini
c:\windows\system32\nlsmhhnb.ini
c:\windows\system32\nxinnrlw.ini
c:\windows\system32\okoogoiv.ini
c:\windows\system32\ooarhanh.ini
c:\windows\system32\pajhyrfv.ini
c:\windows\system32\phmsrqce.ini
c:\windows\system32\plmaxqlx.ini
c:\windows\system32\pncuqtus.ini
c:\windows\system32\pwelbdpb.ini
c:\windows\system32\qennjkjd.ini
c:\windows\system32\qielrxxs.ini
c:\windows\system32\qiuilpox.ini
c:\windows\system32\qpffeaap.ini
c:\windows\system32\rbokmbpq.ini
c:\windows\system32\rokavrdd.ini
c:\windows\system32\rvpltckh.ini
c:\windows\system32\shxsajnj.ini
c:\windows\system32\sqodjpsy.ini
c:\windows\system32\ssemyceh.ini
c:\windows\system32\stera.log
c:\windows\system32\swnqiijj.ini
c:\windows\system32\taddcwjh.ini
c:\windows\system32\tlfbmthx.ini
c:\windows\system32\trsefaqx.ini
c:\windows\system32\uelxjyrc.ini
c:\windows\system32\uetostvc.ini
c:\windows\system32\umxocmcy.ini
c:\windows\system32\vhnggnbl.ini
c:\windows\system32\vleccwpl.ini
c:\windows\system32\vsfocemkvotqdb.dll
c:\windows\system32\vsfocemnjtbpwt.dat
c:\windows\system32\vsfocermlxdqwn.dat
c:\windows\system32\vsfocesqtoirkc.dll
c:\windows\system32\vtxpdkmr.ini
c:\windows\system32\wburbgre.ini
c:\windows\system32\wedmydyc.ini
c:\windows\system32\wgsfyugv.ini
c:\windows\system32\wijuqaoi.ini
c:\windows\system32\wkvxyaln.ini
c:\windows\system32\wojtbncv.ini
c:\windows\system32\wrqvpauk.ini
c:\windows\system32\xlwaefmt.ini
c:\windows\system32\xqsldgwd.ini
c:\windows\system32\xukovluj.ini
c:\windows\system32\xvwqpxwa.ini
c:\windows\system32\yemvtqqf.ini
c:\windows\system32\yftikbbt.ini
c:\windows\system32\ymqubhkv.ini
c:\windows\system32\yqmrxpgq.ini
c:\windows\system32\ysynigce.ini

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_vsfoceixudovrj
-------\Legacy_DOMAINSERVICE
-------\Legacy_FOPN
-------\Legacy_IPRIP
-------\Legacy_VSPF
-------\Legacy_VSPF_HK
-------\Service_Iprip
-------\Service_vspf
-------\Service_vspf_hk

killerfoot0
Novice
Novice

Posts Posts : 6
Joined Joined : 2009-08-02
OS OS : XP
Points Points : 26858
# Likes # Likes : 0

View user profile

Back to top Go down

Re: System Security virus

Post by killerfoot0 on 3rd August 2009, 2:46 am

((((((((((((((((((((((((( Files Created from 2009-07-03 to 2009-08-03 )))))))))))))))))))))))))))))))
.

2009-08-03 01:39 . 2009-08-03 01:39 -------- dc----w- c:\windows\LastGood
2009-08-02 02:50 . 2009-06-19 18:37 46864 -c--a-w- c:\windows\system32\drivers\TfSysMon.sys
2009-08-02 02:50 . 2009-06-19 18:37 33552 -c--a-w- c:\windows\system32\drivers\TfNetMon.sys
2009-08-02 02:50 . 2009-06-19 18:37 51984 -c--a-w- c:\windows\system32\drivers\TfFsMon.sys
2009-08-02 02:50 . 2009-08-02 02:50 -------- dc----w- c:\program files\ThreatFire
2009-08-02 02:50 . 2009-08-02 02:50 -------- dc----w- c:\docume~1\ALLUSE~1\APPLIC~1\PC Tools
2009-07-27 23:04 . 2009-07-27 23:04 -------- dc----w- c:\windows\system32\wbem\Repository
2009-07-27 22:42 . 2009-07-27 22:42 -------- dc----w- C:\ELECTION
2009-07-27 22:42 . 2009-07-27 22:42 -------- dc----w- c:\program files\Atari-Infogrames
2009-07-27 22:42 . 2009-07-27 22:42 -------- dc----w- c:\program files\Acclaim Entertainment
2009-07-27 22:42 . 2009-07-27 22:42 -------- dc----w- c:\program files\Encore
2009-07-27 22:42 . 2009-07-27 22:42 -------- dc----w- c:\program files\iTunes
2009-07-27 22:41 . 2009-08-01 22:54 -------- dc----w- c:\program files\GameBiz2
2009-07-27 22:41 . 2009-07-27 22:41 -------- dc----w- c:\program files\MDickie
2009-07-27 22:41 . 2009-07-27 22:41 -------- dc----w- c:\program files\iWin.com
2009-07-27 22:41 . 2009-07-27 22:41 -------- dc----w- c:\program files\New Star Soccer 3
2009-07-27 22:41 . 2009-07-27 22:41 -------- dc----w- c:\program files\New Star Soccer
2009-07-27 22:41 . 2009-07-27 22:41 -------- dc----w- c:\program files\New Star Soccer 2
2009-07-27 22:41 . 2009-07-27 22:41 -------- dc----w- c:\program files\Myrtilus Games
2009-07-27 22:41 . 2009-07-27 22:41 -------- dc----w- c:\program files\Myrtilus Entertainment
2009-07-27 22:41 . 2009-07-27 22:41 -------- dc----w- c:\program files\Nuance
2009-07-27 22:39 . 2009-07-27 22:39 -------- dc----w- c:\program files\Osiris Games
2009-07-27 22:39 . 2009-07-27 22:39 -------- dc----w- c:\program files\NetZeroInstallers
2009-07-27 22:39 . 2009-07-27 22:39 -------- dc----w- c:\program files\PopCap Games
2009-07-27 22:39 . 2009-07-27 22:39 -------- dc----w- c:\program files\Rhapsody
2009-07-27 22:39 . 2009-07-27 22:39 -------- dc----w- c:\program files\Sensational Soccer
2009-07-27 22:39 . 2009-07-27 22:39 -------- dc----w- c:\program files\The File Splitter 1.31
2009-07-27 22:38 . 2009-07-27 22:39 -------- dc----w- c:\program files\Valve
2009-07-27 22:38 . 2009-07-27 22:38 -------- dc----w- c:\program files\Veoh Networks
2009-07-27 22:38 . 2009-07-27 22:38 -------- dc----w- c:\program files\Verizon Games on Demand Player
2009-07-27 22:38 . 2009-07-27 22:38 -------- dc----w- c:\program files\VolleyballManager
2009-07-27 22:38 . 2009-07-27 22:38 -------- dc----w- c:\program files\VideoLAN
2009-07-27 22:38 . 2009-07-27 22:38 -------- dc----w- c:\program files\WCM2002
2009-07-27 22:30 . 2009-07-27 22:30 -------- dc----w- C:\vgastrat
2009-07-27 22:30 . 2009-07-27 22:30 -------- dc----w- C:\map
2009-07-27 22:30 . 2009-07-27 22:30 -------- dc----w- C:\scenarios
2009-07-27 22:29 . 2009-07-27 22:29 -------- dc----w- c:\windows\ADDINS
2009-07-27 22:29 . 2009-07-27 22:29 -------- dc----w- c:\windows\.jagex_cache_32
2009-07-27 22:29 . 2009-07-27 22:29 -------- dc----w- c:\windows\.file_store_32
2009-07-27 22:29 . 2009-07-27 22:29 -------- dc----w- c:\windows\Config
2009-07-27 22:29 . 2009-07-27 22:29 -------- dc----w- c:\windows\CodeBlue
2009-07-27 22:29 . 2009-07-27 22:29 -------- dc----w- c:\windows\BBSTORE
2009-07-27 22:29 . 2009-07-27 22:29 -------- dc----w- c:\windows\Desktop
2009-07-27 22:29 . 2009-07-27 22:29 -------- dc----w- c:\windows\Cursors
2009-07-27 22:29 . 2009-07-27 22:29 -------- dc----w- c:\windows\Connection Wizard
2009-07-27 22:28 . 2009-07-27 22:29 -------- dc----w- c:\windows\Downloaded Installations
2009-07-27 22:28 . 2009-07-27 22:28 -------- dc----w- c:\windows\JAVA
2009-07-27 22:28 . 2009-07-27 22:28 -------- dc----w- c:\windows\Intuit
2009-07-27 22:28 . 2009-07-27 22:28 -------- dc----w- c:\windows\Expert
2009-07-27 22:28 . 2009-07-27 22:28 -------- dc----w- c:\windows\Driver Cache
2009-07-27 22:28 . 2009-07-27 22:28 -------- dc----w- c:\windows\PlayOnline
2009-07-27 22:28 . 2009-07-27 22:28 -------- dc----w- c:\windows\Sun
2009-07-27 22:28 . 2009-07-27 22:28 -------- dc----w- c:\windows\solcache
2009-07-27 22:28 . 2009-07-27 22:28 -------- dc----w- c:\windows\Simpsons Jeopardy!
2009-07-27 15:34 . 2009-07-27 22:16 -------- dc----w- c:\docume~1\ALLUSE~1\APPLIC~1\12772344
2009-07-16 00:38 . 2009-08-02 15:54 664 -c--a-w- c:\windows\system32\d3d9caps.dat
2009-07-13 12:24 . 2009-07-27 22:43 -------- dc----w- c:\docume~1\ALLUSE~1\APPLIC~1\11350464
2009-07-07 21:08 . 2009-07-07 21:08 -------- dc----w- c:\documents and settings\Lenny\Local Settings\Application Data\Mozilla

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-08-03 02:27 . 2009-01-25 00:51 0 -c--a-w- c:\windows\system32\drivers\logiflt.iad
2009-08-03 01:38 . 2009-01-11 03:45 67424 -c--a-w- c:\windows\system32\drivers\CDAVFS.sys
2009-08-02 17:03 . 2007-10-19 23:05 -------- dc--a-w- c:\docume~1\ALLUSE~1\APPLIC~1\TEMP
2009-08-02 17:02 . 2009-01-25 00:52 0 -c--a-w- c:\windows\system32\drivers\lvuvc.hs
2009-08-02 15:10 . 2008-11-30 22:59 -------- dc----w- c:\documents and settings\John\Application Data\Skype
2009-08-02 14:13 . 2008-11-30 23:14 -------- dc----w- c:\documents and settings\John\Application Data\skypePM
2009-08-02 03:32 . 2009-01-11 22:56 -------- dc----w- c:\program files\Malwarebytes' Anti-Malware
2009-08-02 03:20 . 2008-04-20 18:52 -------- dc----w- c:\docume~1\ALLUSE~1\APPLIC~1\Google Updater
2009-07-27 22:45 . 2007-07-30 16:42 -------- dc----w- c:\documents and settings\Lenny\Application Data\U3
2009-07-27 22:37 . 2009-07-27 22:37 -------- dc----w- c:\program files\WebCyberCoach
2009-07-27 22:37 . 2009-07-27 22:37 -------- dc----w- c:\program files\Wesnoth
2009-07-27 22:37 . 2009-07-27 22:37 -------- dc----w- c:\program files\WildGames
2009-07-27 22:37 . 2009-07-27 22:37 -------- dc----w- c:\program files\Windows Media Connect 2
2009-07-13 17:36 . 2009-01-11 22:56 38160 -c--a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-07-13 17:36 . 2009-01-11 22:56 19096 -c--a-w- c:\windows\system32\drivers\mbam.sys
2009-06-16 14:55 . 2004-08-04 10:00 82432 -c--a-w- c:\windows\system32\fontsub.dll
2009-06-16 14:55 . 2004-08-04 10:00 119808 -c--a-w- c:\windows\system32\t2embed.dll
2009-06-03 19:27 . 2004-08-04 10:00 1290752 -c--a-w- c:\windows\system32\quartz.dll
2009-05-07 15:44 . 2004-08-04 10:00 344064 -c--a-w- c:\windows\system32\localspl.dll
2008-04-06 22:57 . 2008-04-06 22:57 0 -c--a-w- c:\program files\temp01
2009-08-03 00:36 . 2009-01-14 23:53 134648 -c--a-w- c:\program files\mozilla firefox\components\brwsrcmp.dll
2007-08-07 04:20 . 2007-08-06 19:39 1742217 -csh--w- c:\windows\INF\bcadcm.tmp
2007-08-13 18:41 . 2007-08-13 18:41 295 -csha-w- c:\windows\SYSTEM32\egjnoirv.tmp
2006-07-11 00:39 . 2006-07-11 00:39 757273 -csha-w- c:\windows\SYSTEM32\hhhkj.tmp
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2008-11-18 21633320]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"igfxtray"="c:\windows\system32\igfxtray.exe" [2005-09-20 94208]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2005-09-20 114688]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2005-09-20 77824]
"dla"="c:\windows\system32\dla\tfswctrl.exe" [2004-12-06 127035]
"LogitechQuickCamRibbon"="c:\program files\Logitech\QuickCam\Quickcam.exe" [2008-02-13 2196240]
"ThreatFire"="c:\program files\ThreatFire\TFTray.exe" [2009-06-19 259344]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ stera

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Games\\Halo\\halo.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\WINDOWS\\SYSTEM32\\FXSCLNT.EXE"=
"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"c:\\WINDOWS\\SYSTEM32\\DPVSETUP.EXE"=
"c:\\Program Files\\VideoLAN\\VLC\\vlc.exe"=
"c:\\Program Files\\Paradox Entertainment\\Europa Universalis 2\\eu2.exe"=
"c:\\Program Files\\Veoh Networks\\Veoh\\VeohClient.exe"=
"c:\\WINDOWS\\SYSTEM32\\DPLAYSVR.EXE"=
"c:\\Program Files\\Sports Interactive\\Worldwide Soccer Manager 2007\\fm.exe"=
"c:\\Program Files\\SopCast\\adv\\SopAdver.exe"=
"c:\\Program Files\\SopCast\\SopCast.exe"=
"c:\\Program Files\\Java\\jre1.6.0_05\\bin\\javaw.exe"=
"c:\\WINDOWS\\SYSTEM32\\java.exe"=
"c:\\Program Files\\Veoh Networks\\VeohWebPlayer\\veohwebplayer.exe"=
"c:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe"=
"c:\\Program Files\\Common Files\\AOL\\ACS\\AOLAcsd.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)
"AllowInboundTimestampRequest"= 1 (0x1)
"AllowInboundMaskRequest"= 1 (0x1)
"AllowInboundRouterRequest"= 1 (0x1)
"AllowOutboundDestinationUnreachable"= 1 (0x1)
"AllowOutboundSourceQuench"= 1 (0x1)
"AllowOutboundParameterProblem"= 1 (0x1)
"AllowOutboundTimeExceeded"= 1 (0x1)
"AllowRedirect"= 1 (0x1)
"AllowOutboundPacketTooBig"= 1 (0x1)

R0 TfFsMon;TfFsMon;c:\windows\SYSTEM32\DRIVERS\TfFsMon.sys [8/1/2009 10:50 PM 51984]
R0 TfSysMon;TfSysMon;c:\windows\SYSTEM32\DRIVERS\TfSysMon.sys [8/1/2009 10:50 PM 46864]
S2 bclwcb;bclwcb;c:\windows\system32\drivers\dolrbds.sys --> c:\windows\system32\drivers\dolrbds.sys [?]
S2 bqapwsb;bqapwsb;c:\windows\system32\drivers\prjqfx.sys --> c:\windows\system32\drivers\prjqfx.sys [?]
S3 CDAVFS;CDAVFS;c:\windows\SYSTEM32\DRIVERS\CDAVFS.sys [1/10/2009 11:45 PM 67424]
S3 gkmixern;gkmixern;\??\c:\docume~1\John\LOCALS~1\Temp\gkmixern.sys --> c:\docume~1\John\LOCALS~1\Temp\gkmixern.sys [?]
S3 TfNetMon;TfNetMon;c:\windows\SYSTEM32\DRIVERS\TfNetMon.sys [8/1/2009 10:50 PM 33552]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
p2psvc REG_MULTI_SZ p2psvc p2pimsvc p2pgasvc PNRPSvc

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
dttxqush
.
- - - - ORPHANS REMOVED - - - -

HKCU-Run-LogitechSetup - D:\setup.exe
HKCU-Run-CyberDefender Early Detection Center - c:\program files\CyberDefender\AntiSpyware\cdas250.exe


.
------- Supplementary Scan -------
.
uStart Page = about:blank
mStart Page = about:blank
uSearchURL,(Default) = [You must be registered and logged in to see this link.]
Trusted Zone: musicmatch.com\online
DPF: {197F8FE3-8DF6-4755-B925-B94A1FF2F58E} - [You must be registered and logged in to see this link.]
DPF: {2D0280B1-DC42-4DFA-9525-09BD48838539} - [You must be registered and logged in to see this link.]
DPF: {C49134CC-B5EF-458C-A442-E8DFE7B4645F} - [You must be registered and logged in to see this link.]
FF - ProfilePath - c:\docume~1\John\APPLIC~1\Mozilla\Firefox\Profiles\n11iic3e.default\
FF - prefs.js: browser.startup.homepage - [You must be registered and logged in to see this link.]
FF - plugin: c:\progra~1\Yahoo!\Common\npyaxmpb.dll
FF - plugin: c:\program files\Google\Google Updater\2.4.1536.6592\npCIDetect13.dll
FF - plugin: c:\program files\Veoh Networks\Veoh\Plugins\noreg\NPVeohVersion.dll
FF - plugin: c:\program files\Veoh Networks\VeohWebPlayer\NPVeohTVPlugin.dll
FF - plugin: c:\program files\Veoh Networks\VeohWebPlayer\npWebPlayerVideoPluginATL.dll
FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, [You must be registered and logged in to see this link.]
Rootkit scan 2009-08-02 22:28
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(660)
c:\windows\system32\scg726.acm
.
Completion time: 2009-08-03 22:38 - machine was rebooted
ComboFix-quarantined-files.txt 2009-08-03 02:37

Pre-Run: 29,205,958,656 bytes free
Post-Run: 32,277,442,560 bytes free

318 --- E O F --- 2009-08-02 04:02

killerfoot0
Novice
Novice

Posts Posts : 6
Joined Joined : 2009-08-02
OS OS : XP
Points Points : 26858
# Likes # Likes : 0

View user profile

Back to top Go down

Re: System Security virus

Post by Belahzur on 3rd August 2009, 8:26 pm

Hello.

Now open a new notepad file.
Input this into the notepad file:

File::
c:\windows\INF\bcadcm.tmp
c:\windows\SYSTEM32\egjnoirv.tmp
c:\windows\SYSTEM32\hhhkj.tmp

Driver::
bclwcb
bqapwsb
gkmixern

NetSvc::
dttxqush

DDS::
uStart Page = about:blank
mStart Page = about:blank

Save this as CFScript.txt, save it to your desktop also.
Then drag and drop CFScript.txt into combofix as seen below:


This will open combofix again, agree to it's terms and allow it to run.
It may want to reboot after it's done. (It will warn you if it wants to)
Post the resulting log back here.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34918
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : 7 Home Premium x64
Points Points : 245091
# Likes # Likes : 1

View user profile

Back to top Go down

Re: System Security virus

Post by killerfoot0 on 4th August 2009, 3:57 pm

Here are the results

ComboFix 09-08-03.A2 - John 08/04/2009 11:03.2.1 - NTFSx86 NETWORK
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.247.147 [GMT -4:00]
Running from: c:\documents and settings\John\Desktop\Combo-Fix.exe
Command switches used :: c:\documents and settings\John\Desktop\CFScript.txt
AV: CyberDefender Internet Security *On-access scanning enabled* (Updated) {C6EC0229-8E2C-4434-B342-9C188000D324}

FILE ::
"c:\windows\INF\bcadcm.tmp"
"c:\windows\SYSTEM32\egjnoirv.tmp"
"c:\windows\SYSTEM32\hhhkj.tmp"
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\LocalService\My Documents\(DGEmu[1].com)Mario Kart 64 (U) .zip
c:\windows\INF\bcadcm.tmp
c:\windows\SYSTEM32\egjnoirv.tmp
c:\windows\SYSTEM32\hhhkj.tmp

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_BCLWCB
-------\Legacy_BQAPWSB
-------\Legacy_GKMIXERN
-------\Service_bclwcb
-------\Service_bqapwsb
-------\Service_gkmixern


((((((((((((((((((((((((( Files Created from 2009-07-04 to 2009-08-04 )))))))))))))))))))))))))))))))
.

2009-08-03 01:39 . 2009-08-03 01:39 -------- dc----w- c:\windows\LastGood
2009-08-02 03:32 . 2009-08-02 03:32 3775175 -c--a-w- c:\documents and settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe
2009-07-27 23:04 . 2009-07-27 23:04 -------- dc----w- c:\windows\system32\wbem\Repository
2009-07-27 22:42 . 2009-07-27 22:42 -------- dc----w- C:\ELECTION
2009-07-27 22:42 . 2009-07-27 22:42 -------- dc----w- c:\program files\Atari-Infogrames
2009-07-27 22:42 . 2009-07-27 22:42 -------- dc----w- c:\program files\Acclaim Entertainment
2009-07-27 22:42 . 2009-07-27 22:42 -------- dc----w- c:\program files\Encore
2009-07-27 22:42 . 2009-07-27 22:42 -------- dc----w- c:\program files\iTunes
2009-07-27 22:41 . 2009-08-01 22:54 -------- dc----w- c:\program files\GameBiz2
2009-07-27 22:41 . 2009-07-27 22:41 -------- dc----w- c:\program files\MDickie
2009-07-27 22:41 . 2009-07-27 22:41 -------- dc----w- c:\program files\iWin.com
2009-07-27 22:41 . 2009-07-27 22:41 -------- dc----w- c:\program files\New Star Soccer 3
2009-07-27 22:41 . 2009-07-27 22:41 -------- dc----w- c:\program files\New Star Soccer
2009-07-27 22:41 . 2009-07-27 22:41 -------- dc----w- c:\program files\New Star Soccer 2
2009-07-27 22:41 . 2009-07-27 22:41 -------- dc----w- c:\program files\Myrtilus Games
2009-07-27 22:41 . 2009-07-27 22:41 -------- dc----w- c:\program files\Myrtilus Entertainment
2009-07-27 22:41 . 2009-07-27 22:41 -------- dc----w- c:\program files\Nuance
2009-07-27 22:39 . 2009-07-27 22:39 -------- dc----w- c:\program files\Osiris Games
2009-07-27 22:39 . 2009-07-27 22:39 -------- dc----w- c:\program files\NetZeroInstallers
2009-07-27 22:39 . 2009-07-27 22:39 -------- dc----w- c:\program files\PopCap Games
2009-07-27 22:39 . 2009-07-27 22:39 -------- dc----w- c:\program files\Rhapsody
2009-07-27 22:39 . 2009-07-27 22:39 -------- dc----w- c:\program files\Sensational Soccer
2009-07-27 22:39 . 2009-07-27 22:39 -------- dc----w- c:\program files\The File Splitter 1.31
2009-07-27 22:38 . 2009-08-04 01:14 -------- dc----w- c:\program files\Valve
2009-07-27 22:38 . 2009-07-27 22:38 -------- dc----w- c:\program files\Veoh Networks
2009-07-27 22:38 . 2009-07-27 22:38 -------- dc----w- c:\program files\Verizon Games on Demand Player
2009-07-27 22:38 . 2009-07-27 22:38 -------- dc----w- c:\program files\VolleyballManager
2009-07-27 22:38 . 2009-07-27 22:38 -------- dc----w- c:\program files\VideoLAN
2009-07-27 22:38 . 2009-07-27 22:38 -------- dc----w- c:\program files\WCM2002
2009-07-27 22:30 . 2009-07-27 22:30 -------- dc----w- C:\vgastrat
2009-07-27 22:30 . 2009-07-27 22:30 -------- dc----w- C:\map
2009-07-27 22:30 . 2009-07-27 22:30 -------- dc----w- C:\scenarios
2009-07-27 22:29 . 2009-07-27 22:29 -------- dc----w- c:\windows\ADDINS
2009-07-27 22:29 . 2009-07-27 22:29 -------- dc----w- c:\windows\.jagex_cache_32
2009-07-27 22:29 . 2009-07-27 22:29 -------- dc----w- c:\windows\.file_store_32
2009-07-27 22:29 . 2009-07-27 22:29 -------- dc----w- c:\windows\Config
2009-07-27 22:29 . 2009-07-27 22:29 -------- dc----w- c:\windows\CodeBlue
2009-07-27 22:29 . 2009-07-27 22:29 -------- dc----w- c:\windows\BBSTORE
2009-07-27 22:29 . 2009-07-27 22:29 -------- dc----w- c:\windows\Desktop
2009-07-27 22:29 . 2009-07-27 22:29 -------- dc----w- c:\windows\Cursors
2009-07-27 22:29 . 2009-07-27 22:29 -------- dc----w- c:\windows\Connection Wizard
2009-07-27 22:28 . 2009-07-27 22:29 -------- dc----w- c:\windows\Downloaded Installations
2009-07-27 22:28 . 2009-07-27 22:28 -------- dc----w- c:\windows\JAVA
2009-07-27 22:28 . 2009-07-27 22:28 -------- dc----w- c:\windows\Intuit
2009-07-27 22:28 . 2009-07-27 22:28 -------- dc----w- c:\windows\Expert
2009-07-27 22:28 . 2009-07-27 22:28 -------- dc----w- c:\windows\Driver Cache
2009-07-27 22:28 . 2009-07-27 22:28 -------- dc----w- c:\windows\PlayOnline
2009-07-27 22:28 . 2009-07-27 22:28 -------- dc----w- c:\windows\Sun
2009-07-27 22:28 . 2009-07-27 22:28 -------- dc----w- c:\windows\solcache
2009-07-27 22:28 . 2009-07-27 22:28 -------- dc----w- c:\windows\Simpsons Jeopardy!
2009-07-27 15:34 . 2009-07-27 22:16 -------- dc----w- c:\documents and settings\All Users\Application Data\12772344
2009-07-16 00:38 . 2009-08-04 13:01 664 -c--a-w- c:\windows\system32\d3d9caps.dat
2009-07-13 12:24 . 2009-07-27 22:43 -------- dc----w- c:\documents and settings\All Users\Application Data\11350464
2009-07-07 21:08 . 2009-07-07 21:08 -------- dc----w- c:\documents and settings\Lenny\Local Settings\Application Data\Mozilla

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-08-04 15:24 . 2009-01-25 00:51 0 -c--a-w- c:\windows\system32\drivers\logiflt.iad
2009-08-04 01:15 . 2006-06-19 00:29 -------- dc----w- c:\program files\eMusic Download Manager
2009-08-03 01:38 . 2009-01-11 03:45 67424 -c--a-w- c:\windows\system32\drivers\CDAVFS.sys
2009-08-02 17:03 . 2007-10-19 23:05 -------- dc--a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-08-02 17:02 . 2009-01-25 00:52 0 -c--a-w- c:\windows\system32\drivers\lvuvc.hs
2009-08-02 15:10 . 2008-11-30 22:59 -------- dc----w- c:\documents and settings\John\Application Data\Skype
2009-08-02 14:13 . 2008-11-30 23:14 -------- dc----w- c:\documents and settings\John\Application Data\skypePM
2009-08-02 03:32 . 2009-01-11 22:56 -------- dc----w- c:\program files\Malwarebytes' Anti-Malware
2009-08-02 03:20 . 2008-04-20 18:52 -------- dc----w- c:\documents and settings\All Users\Application Data\Google Updater
2009-07-27 22:45 . 2007-07-30 16:42 -------- dc----w- c:\documents and settings\Lenny\Application Data\U3
2009-07-27 22:37 . 2009-07-27 22:37 -------- dc----w- c:\program files\WebCyberCoach
2009-07-27 22:37 . 2009-07-27 22:37 -------- dc----w- c:\program files\Wesnoth
2009-07-27 22:37 . 2009-07-27 22:37 -------- dc----w- c:\program files\WildGames
2009-07-27 22:37 . 2009-07-27 22:37 -------- dc----w- c:\program files\Windows Media Connect 2
2009-07-13 17:36 . 2009-01-11 22:56 38160 -c--a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-07-13 17:36 . 2009-01-11 22:56 19096 -c--a-w- c:\windows\system32\drivers\mbam.sys
2009-06-16 14:55 . 2004-08-04 10:00 82432 -c--a-w- c:\windows\system32\fontsub.dll
2009-06-16 14:55 . 2004-08-04 10:00 119808 -c--a-w- c:\windows\system32\t2embed.dll
2009-06-03 19:27 . 2004-08-04 10:00 1290752 -c--a-w- c:\windows\system32\quartz.dll
2009-05-07 15:44 . 2004-08-04 10:00 344064 -c--a-w- c:\windows\system32\localspl.dll
2008-04-06 22:57 . 2008-04-06 22:57 0 -c--a-w- c:\program files\temp01
2009-08-03 00:36 . 2009-01-14 23:53 134648 -c--a-w- c:\program files\mozilla firefox\components\brwsrcmp.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2008-11-18 21633320]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"igfxtray"="c:\windows\system32\igfxtray.exe" [2005-09-20 94208]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2005-09-20 114688]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2005-09-20 77824]
"dla"="c:\windows\system32\dla\tfswctrl.exe" [2004-12-06 127035]
"LogitechQuickCamRibbon"="c:\program files\Logitech\QuickCam\Quickcam.exe" [2008-02-13 2196240]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ stera

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Games\\Halo\\halo.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\WINDOWS\\SYSTEM32\\FXSCLNT.EXE"=
"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"c:\\WINDOWS\\SYSTEM32\\DPVSETUP.EXE"=
"c:\\Program Files\\VideoLAN\\VLC\\vlc.exe"=
"c:\\Program Files\\Paradox Entertainment\\Europa Universalis 2\\eu2.exe"=
"c:\\Program Files\\Veoh Networks\\Veoh\\VeohClient.exe"=
"c:\\WINDOWS\\SYSTEM32\\DPLAYSVR.EXE"=
"c:\\Program Files\\Sports Interactive\\Worldwide Soccer Manager 2007\\fm.exe"=
"c:\\Program Files\\SopCast\\adv\\SopAdver.exe"=
"c:\\Program Files\\SopCast\\SopCast.exe"=
"c:\\Program Files\\Java\\jre1.6.0_05\\bin\\javaw.exe"=
"c:\\WINDOWS\\SYSTEM32\\java.exe"=
"c:\\Program Files\\Veoh Networks\\VeohWebPlayer\\veohwebplayer.exe"=
"c:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe"=
"c:\\Program Files\\Common Files\\AOL\\ACS\\AOLAcsd.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)
"AllowInboundTimestampRequest"= 1 (0x1)
"AllowInboundMaskRequest"= 1 (0x1)
"AllowInboundRouterRequest"= 1 (0x1)
"AllowOutboundDestinationUnreachable"= 1 (0x1)
"AllowOutboundSourceQuench"= 1 (0x1)
"AllowOutboundParameterProblem"= 1 (0x1)
"AllowOutboundTimeExceeded"= 1 (0x1)
"AllowRedirect"= 1 (0x1)
"AllowOutboundPacketTooBig"= 1 (0x1)

R3 CDAVFS;CDAVFS;c:\windows\system32\DRIVERS\CDAVFS.sys [2009-08-03 67424]


[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
p2psvc REG_MULTI_SZ p2psvc p2pimsvc p2pgasvc PNRPSvc
.
Contents of the 'Scheduled Tasks' folder

2009-07-28 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-06-03 17:42]

2009-08-02 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2007-01-27 21:26]
.
.
------- Supplementary Scan -------
.
uSearchURL,(Default) = [You must be registered and logged in to see this link.]
Trusted Zone: musicmatch.com\online
DPF: {197F8FE3-8DF6-4755-B925-B94A1FF2F58E} - [You must be registered and logged in to see this link.]
DPF: {2D0280B1-DC42-4DFA-9525-09BD48838539} - [You must be registered and logged in to see this link.]
DPF: {C49134CC-B5EF-458C-A442-E8DFE7B4645F} - [You must be registered and logged in to see this link.]
FF - ProfilePath - c:\documents and settings\John\Application Data\Mozilla\Firefox\Profiles\n11iic3e.default\
FF - prefs.js: browser.startup.homepage - [You must be registered and logged in to see this link.]
FF - plugin: c:\progra~1\Yahoo!\Common\npyaxmpb.dll
FF - plugin: c:\program files\Google\Google Updater\2.4.1536.6592\npCIDetect13.dll
FF - plugin: c:\program files\Veoh Networks\Veoh\Plugins\noreg\NPVeohVersion.dll
FF - plugin: c:\program files\Veoh Networks\VeohWebPlayer\NPVeohTVPlugin.dll
FF - plugin: c:\program files\Veoh Networks\VeohWebPlayer\npWebPlayerVideoPluginATL.dll
FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, [You must be registered and logged in to see this link.]
Rootkit scan 2009-08-04 11:25
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(660)
c:\windows\system32\scg726.acm
.
Completion time: 2009-08-04 11:38 - machine was rebooted
ComboFix-quarantined-files.txt 2009-08-04 15:38
ComboFix2.txt 2009-08-03 02:38

Pre-Run: 32,277,729,280 bytes free
Post-Run: 32,269,819,904 bytes free

205 --- E O F --- 2009-08-02 04:02

killerfoot0
Novice
Novice

Posts Posts : 6
Joined Joined : 2009-08-02
OS OS : XP
Points Points : 26858
# Likes # Likes : 0

View user profile

Back to top Go down

Re: System Security virus

Post by Belahzur on 4th August 2009, 6:45 pm

Click Start > Run and copy/paste the following bolded text into the Run box and click OK:

ComboFix /u



This will also reset your restore points.

How is the machine running now?


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34918
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : 7 Home Premium x64
Points Points : 245091
# Likes # Likes : 1

View user profile

Back to top Go down

Re: System Security virus

Post by killerfoot0 on 4th August 2009, 7:00 pm

I restarted my computer normally, not in safe mode. And everything seems to be great, it seems to even be running faster. I am much obliged to you guys, I was really panicking when I first got this problem, thanks a lot Belahzur and Origin, I read some real scary stuff about how people actually had to scrap there computers cause of this virus, and I don't know where I'd be without you guys.

killerfoot0
Novice
Novice

Posts Posts : 6
Joined Joined : 2009-08-02
OS OS : XP
Points Points : 26858
# Likes # Likes : 0

View user profile

Back to top Go down

Re: System Security virus

Post by Origin on 4th August 2009, 10:00 pm

Below I have included a number of recommendations for how to protect your computer in order to prevent future malware infections. Please take these recommendations seriously; these few simple steps can stave off the vast majority of spyware problems. As happy as we are to help you, for your sake we would rather not have repeat customers. Goofy

1) Please navigate to [You must be registered and logged in to see this link.] and download all the "critical updates" for Windows. This can patch many of the security holes through which attackers can gain access to your computer.

Please either enable Automatic Updates under Start -> Control Panel -> Automatic Updates , or get into the habit of checking for Windows updates regularly. I cannot stress enough how important this is.

2) In order to protect yourself against spyware, you should consider installing and running the following free programs:

[You must be registered and logged in to see this link.]
A tutorial on using Ad-Aware to remove spyware from your computer may be found [You must be registered and logged in to see this link.].

[You must be registered and logged in to see this link.]
A tutorial on using Spybot to remove spyware from your computer may be found [You must be registered and logged in to see this link.]. Please also remember to enable Spybot's "Immunize" and "TeaTimer" features.

[You must be registered and logged in to see this link.]
A tutorial on using SpywareBlaster to prevent spyware from ever installing on your computer may be found [You must be registered and logged in to see this link.].

[You must be registered and logged in to see this link.]
A tutorial on using SpywareGuard for realtime protection against spyware and hijackers may be found [You must be registered and logged in to see this link.].

Make sure to keep these programs up-to-date and to run them regularly, as this can prevent a great deal of spyware hassle.

3) Please consider using an alternate browser. Mozilla's Firefox browser is fantastic; it is much more secure than Internet Explorer, immune to almost all known browser hijackers, and also has the best built-in popup blocker (as an added benefit!) that I have ever seen. If you are interested, Firefox may be downloaded from here:
[You must be registered and logged in to see this link.]
I also recommand the following add-ons for Firefox, they will help keep you safe from malicious scripts or activeX exploits.
[You must be registered and logged in to see this link.]
[You must be registered and logged in to see this link.]
[You must be registered and logged in to see this link.]

4) Also make sure to run your antivirus software regularly, and to keep it up-to-date.

To help you keep your software updated, please considering using this free software program that will check for program updates.
[You must be registered and logged in to see this link.]

5) Finally, consider maintaining a firewall. Some good free firewalls are [You must be registered and logged in to see this link.], or
[You must be registered and logged in to see this link.]
A tutorial on understanding and using firewalls may be found [You must be registered and logged in to see this link.].

Please also read Tony Klein's excellent article: [You must be registered and logged in to see this link.]

If you would take a moment to fill out our feedback form, we would appreciate it.
The link can be found [You must be registered and logged in to see this link.].

Hopefully this should take care of your problems! Good luck. Big Grin


While my help is always free, please consider donating to keep this site alive: [You must be registered and logged in to see this link.]

[You must be registered and logged in to see this link.]

Origin
Master
Master

Posts Posts : 2685
Joined Joined : 2009-05-05
Gender Gender : Male
OS OS : Windows Xp Sp3
Points Points : 31503
# Likes # Likes : 0

View user profile

Back to top Go down

Re: System Security virus

Post by killerfoot0 on 5th August 2009, 1:10 am

Yeah I already have some of things, but I do need something for spyware and a better fireware. Once again much obliged guys.

killerfoot0
Novice
Novice

Posts Posts : 6
Joined Joined : 2009-08-02
OS OS : XP
Points Points : 26858
# Likes # Likes : 0

View user profile

Back to top Go down

View previous topic View next topic Back to top

- Similar topics

 
Permissions in this forum:
You cannot reply to topics in this forum