Rootkit/tr crypt?

View previous topic View next topic Go down

Rootkit/tr crypt?

Post by crackbaby on 15th August 2009, 7:41 pm

I just got a new laptop yesterday and all of a sudden my Windows Security won't turn on and now I have some viruses on my computer for no reason. I didn't download anything malicious.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:40:01 PM, on 8/15/2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18294)
Boot mode: Normal

Running processes:
C:\Windows\system32\csrss.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\svchost.exe
C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\agrsmsvc.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Program Files\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe
C:\Program Files\Toshiba\TOSHIBA DVD PLAYER\TNaviSrv.exe
C:\Windows\system32\TODDSrv.exe
C:\Program Files\Toshiba\Power Saver\TosCoSrv.exe
C:\Program Files\TOSHIBA\SMARTLogService\TosIPCSrv.exe
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\SearchIndexer.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
C:\Program Files\Avira\AntiVir Desktop\avmailc.exe
C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE
C:\Windows\system32\taskeng.exe
C:\Program Files\Toshiba\SmartFaceV\SmartFaceVWatchSrv.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\sdra64.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\System32\igfxtray.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Windows\system32\igfxsrvc.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Camera Assistant Software for Toshiba\traybar.exe
C:\Program Files\Toshiba\Power Saver\TPwrMain.exe
C:\Program Files\Toshiba\SmoothView\SmoothView.exe
C:\Program Files\Toshiba\FlashCards\TCrdMain.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Toshiba\ConfigFree\NDSTray.exe
C:\Program Files\Toshiba\TOSHIBA Service Station\TSS.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Camera Assistant Software for Toshiba\CEC_MAIN.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\Toshiba\TOSCDSPD\TOSCDSPD.exe
C:\Program Files\Toshiba Registration\Registration.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\ooVoo\ooVoo.exe
C:\Program Files\AIM6\aim6.exe
C:\Program Files\LimeWire\LimeWire.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\igfxext.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files\Toshiba\ConfigFree\CFSwMgr.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Windows\system32\conime.exe
C:\Program Files\AIM6\aolsoftware.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Windows\system32\wuauclt.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = [You must be registered and logged in to see this link.]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = [You must be registered and logged in to see this link.]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = [You must be registered and logged in to see this link.]
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=C:\Windows\system32\userinit.exe,C:\Windows\system32\sdra64.exe,
O1 - Hosts: ::1 localhost
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O2 - BHO: Partner BHO Class - {83FF80F4-8C74-4b80-B5BA-C8DDD434E5C4} - C:\ProgramData\Partner\partner.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [Camera Assistant Software] "C:\Program Files\Camera Assistant Software for Toshiba\traybar.exe" /start
O4 - HKLM\..\Run: [TPwrMain] %ProgramFiles%\TOSHIBA\Power Saver\TPwrMain.EXE
O4 - HKLM\..\Run: [SmoothView] %ProgramFiles%\Toshiba\SmoothView\SmoothView.exe
O4 - HKLM\..\Run: [00TCrdMain] %ProgramFiles%\TOSHIBA\FlashCards\TCrdMain.exe
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [NDSTray.exe] NDSTray.exe
O4 - HKLM\..\Run: [cfFncEnabler.exe] cfFncEnabler.exe
O4 - HKLM\..\Run: [ToshibaServiceStation] "C:\Program Files\TOSHIBA\TOSHIBA Service Station\TSS.exe" /hide
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKCU\..\Run: [TOSCDSPD] C:\Program Files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe
O4 - HKCU\..\Run: [951738463] C:\Program Files\Toshiba Registration\Registration.exe /r "C:\Program Files\Toshiba Registration\Registration.rpd"
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [oovoo.exe] C:\Program Files\ooVoo\oovoo.exe /minimized
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US [You must be registered and logged in to see this link.]
O4 - HKCU\..\Run: [Steam] "C:\Program Files\Steam\Steam.exe" -silent
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - Startup: LimeWire On Startup.lnk = C:\Program Files\LimeWire\LimeWire.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O13 - Gopher Prefix:
O18 - Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL
O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\Windows\system32\agrsmsvc.exe
O23 - Service: Avira AntiVir MailGuard (AntiVirMailService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avmailc.exe
O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Avira AntiVir WebGuard (AntiVirWebService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: ConfigFree Service - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
O23 - Service: Google Desktop Manager 5.7.802.22438 (GoogleDesktopManager-022208-143751) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Partner Service - Google Inc. - C:\ProgramData\Partner\partner.exe
O23 - Service: SmartFaceVWatchSrv - Toshiba - C:\Program Files\Toshiba\SmartFaceV\SmartFaceVWatchSrv.exe
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe
O23 - Service: TMachInfo - TOSHIBA Corporation - C:\Program Files\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe
O23 - Service: TOSHIBA Navi Support Service (TNaviSrv) - TOSHIBA Corporation - C:\Program Files\Toshiba\TOSHIBA DVD PLAYER\TNaviSrv.exe
O23 - Service: TOSHIBA Optical Disc Drive Service (TODDSrv) - TOSHIBA Corporation - C:\Windows\system32\TODDSrv.exe
O23 - Service: TOSHIBA Power Saver (TosCoSrv) - TOSHIBA Corporation - C:\Program Files\Toshiba\Power Saver\TosCoSrv.exe
O23 - Service: TOSHIBA SMART Log Service - TOSHIBA Corporation - C:\Program Files\TOSHIBA\SMARTLogService\TosIPCSrv.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe

--
End of file - 11402 bytes

crackbaby
Intermediate
Intermediate

Posts Posts : 62
Joined Joined : 2008-11-24
OS OS : Windows XP/ Vista
Points Points : 29499
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Rootkit/tr crypt?

Post by Belahzur on 15th August 2009, 8:31 pm

1. If you are using Firefox, make sure that your download settings are as follows:

* Tools->Options->Main tab
* Set to "Always ask me where to Save the files".

2. During the download, rename Combofix to Combo-Fix as follows:





3. It is important you rename Combofix during the download, but not after.
4. Please do not rename Combofix to other names, but only to the one indicated.
5. Close any open browsers.
6. We need to disable your local AV (Anti-virus) before running Combofix.

  • See [You must be registered and logged in to see this link.] for how to disable your AV.
  • Double click on ComboFix.exe.
  • Follow the prompts. NOTE:
  • Allow combofix to run
  • Post C:\combofix.txt back here.

    Note:
    Do not mouse click combofix's window whilst it's running. That may cause it to stall.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34918
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : 7 Home Premium x64
Points Points : 245101
# Likes # Likes : 1

View user profile

Back to top Go down

Re: Rootkit/tr crypt?

Post by crackbaby on 15th August 2009, 8:51 pm

ComboFix 09-08-10.06 - Andrew 08/15/2009 13:38.1.2 - NTFSx86
Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.1.1033.18.2939.1614 [GMT -7:00]
Running from: c:\users\Andrew\Desktop\Combo-Fix.exe
SP: SUPERAntiSpyware *disabled* (Updated) {222A897C-5018-402e-943F-7E7AC8560DA7}
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\$recycle.bin\S-1-5-21-1934651463-4168729035-3063580607-500
c:\$recycle.bin\S-1-5-21-2622956832-1613152025-275448326-500
c:\program files\Mozilla Firefox\extensions\{F3ED8C29-EE24-49E5-97CF-3B33BA349714}
c:\program files\Mozilla Firefox\extensions\{F3ED8C29-EE24-49E5-97CF-3B33BA349714}\chrome.manifest
c:\program files\Mozilla Firefox\extensions\{F3ED8C29-EE24-49E5-97CF-3B33BA349714}\chrome\content\overlay.xul
c:\program files\Mozilla Firefox\extensions\{F3ED8C29-EE24-49E5-97CF-3B33BA349714}\install.rdf
c:\windows\Installer\WMEncoder.msi
c:\windows\system32\drivers\ovfsth.sys
c:\windows\system32\ovfsthmgfsgambugytitppvpcuobcvkxmpvnxi.dat
c:\windows\system32\vhosts.exe


.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_ovfsthnsjtebmmvurkobfoopxrmupqdeqbdahw
-------\Service_ovfsthnsjtebmmvurkobfoopxrmupqdeqbdahw


((((((((((((((((((((((((( Files Created from 2009-07-15 to 2009-08-15 )))))))))))))))))))))))))))))))
.

2009-08-15 20:26 . 2009-08-15 20:26 -------- d-----w- c:\users\Andrew\AppData\Roaming\Avira
2009-08-15 20:17 . 2009-08-15 20:46 117760 ----a-w- c:\users\Andrew\AppData\Roaming\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
2009-08-15 20:16 . 2009-08-15 20:16 -------- d-----w- c:\programdata\SUPERAntiSpyware.com
2009-08-15 20:16 . 2009-08-15 20:16 -------- d-----w- c:\program files\SUPERAntiSpyware
2009-08-15 20:16 . 2009-08-15 20:16 -------- d-----w- c:\users\Andrew\AppData\Roaming\SUPERAntiSpyware.com
2009-08-15 20:15 . 2009-08-15 20:15 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2009-08-15 19:39 . 2009-08-15 19:39 -------- d-----w- c:\program files\Trend Micro
2009-08-15 19:25 . 2009-08-15 19:23 79105 ----a-w- c:\programdata\Avira\AntiVir Desktop\TEMP\UPDATE\TMP_UPDATE\updaterc.dll
2009-08-15 19:25 . 2009-08-15 19:23 404737 ----a-w- c:\programdata\Avira\AntiVir Desktop\TEMP\UPDATE\TMP_UPDATE\update.exe
2009-08-15 19:25 . 2009-08-15 19:23 345345 ----a-w- c:\programdata\Avira\AntiVir Desktop\TEMP\UPDATE\TMP_UPDATE\update.dll
2009-08-15 19:25 . 2009-02-27 17:59 8961 ----a-w- c:\programdata\Avira\AntiVir Desktop\TEMP\UPDATE\TMP_UPDATE\updguirc.dll
2009-08-15 19:25 . 2009-02-24 19:16 117505 ----a-w- c:\programdata\Avira\AntiVir Desktop\TEMP\UPDATE\TMP_UPDATE\updgui.dll
2009-08-15 19:25 . 2008-12-05 17:32 126721 ----a-w- c:\programdata\Avira\AntiVir Desktop\TEMP\UPDATE\TMP_UPDATE\scewxmlw.dll
2009-08-15 19:17 . 2009-08-15 19:25 96104 ----a-w- c:\windows\system32\drivers\avipbb.sys
2009-08-15 19:17 . 2009-08-15 19:25 55656 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2009-08-15 19:17 . 2009-08-15 19:17 -------- d-----w- c:\programdata\Avira
2009-08-15 19:17 . 2009-08-15 19:17 -------- d-----w- c:\program files\Avira
2009-08-15 19:06 . 2009-08-15 19:30 -------- d-----w- c:\program files\Common Files\Steam
2009-08-15 19:06 . 2009-08-15 19:38 -------- d-----w- c:\program files\Steam
2009-08-15 18:47 . 2009-08-15 19:40 -------- d-----w- c:\users\Andrew\AppData\Roaming\LimeWire
2009-08-15 18:47 . 2009-08-15 18:47 -------- d-----w- c:\program files\LimeWire
2009-08-15 08:12 . 2009-08-15 08:12 -------- d-----w- c:\users\Andrew\AppData\Roaming\Thinstall
2009-08-15 08:05 . 2009-08-15 08:06 -------- d-----w- c:\users\Andrew\AppData\Roaming\Webcammax
2009-08-15 08:05 . 2008-03-11 13:14 941784 ----a-w- c:\windows\system32\drivers\CAMTHWDM.sys
2009-08-15 07:49 . 2009-08-15 07:49 -------- d-----w- c:\program files\7-Zip
2009-08-15 07:40 . 2009-08-15 07:40 -------- d-----w- c:\users\Andrew\AppData\Roaming\Apple Computer
2009-08-15 07:40 . 2009-08-15 07:40 -------- dc----w- c:\windows\system32\DRVSTORE
2009-08-15 07:40 . 2009-03-19 23:32 23400 ----a-w- c:\windows\system32\drivers\GEARAspiWDM.sys
2009-08-15 07:40 . 2008-04-17 19:12 107368 ----a-w- c:\windows\system32\GEARAspi.dll
2009-08-15 07:40 . 2009-08-15 07:40 -------- d-----w- c:\program files\iPod
2009-08-15 07:40 . 2009-08-15 07:40 -------- d-----w- c:\programdata\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}

crackbaby
Intermediate
Intermediate

Posts Posts : 62
Joined Joined : 2008-11-24
OS OS : Windows XP/ Vista
Points Points : 29499
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Rootkit/tr crypt?

Post by crackbaby on 15th August 2009, 8:52 pm

2009-08-15 07:40 . 2009-08-15 07:40 -------- d-----w- c:\program files\iTunes
2009-08-15 07:39 . 2009-08-15 07:39 -------- d-----w- c:\program files\Bonjour
2009-08-15 07:39 . 2009-08-15 07:39 -------- d-----w- c:\users\Andrew\AppData\Roaming\acccore
2009-08-15 07:37 . 2009-08-15 07:40 -------- d-----w- c:\program files\Common Files\Apple
2009-08-15 05:36 . 2009-08-15 07:40 -------- d-----w- c:\users\Andrew\AppData\Local\Apple Computer
2009-08-15 05:34 . 2009-08-15 07:40 -------- d-----w- c:\programdata\Apple Computer
2009-08-15 05:34 . 2009-08-15 05:38 -------- d-----w- c:\program files\QuickTime
2009-08-15 05:33 . 2009-08-15 05:33 -------- d-----w- c:\users\Andrew\AppData\Local\Apple
2009-08-15 05:32 . 2009-08-15 05:32 -------- d-----w- c:\program files\Apple Software Update
2009-08-15 05:32 . 2009-08-15 05:32 -------- d-----w- c:\programdata\Apple
2009-08-15 03:53 . 2009-08-15 03:56 -------- d-----w- c:\users\Andrew\AppData\Roaming\ooVoo Details
2009-08-15 03:53 . 2009-08-15 20:42 -------- d-----w- c:\program files\ooVoo
2009-08-15 03:43 . 2009-08-15 03:43 -------- d-----w- c:\users\Andrew\AppData\Local\AOL OCP
2009-08-15 03:43 . 2009-08-15 03:43 -------- d-----w- c:\users\Andrew\AppData\Local\AOL
2009-08-15 03:43 . 2009-08-15 19:58 -------- d-----w- c:\program files\Viewpoint
2009-08-15 03:43 . 2009-08-15 03:43 -------- d-----w- c:\programdata\Viewpoint
2009-08-15 03:43 . 2009-08-15 03:43 -------- d-----w- c:\programdata\acccore
2009-08-15 03:43 . 2009-08-15 03:44 -------- d-----w- c:\programdata\AOL OCP
2009-08-15 03:43 . 2009-08-15 03:43 -------- d-----w- c:\programdata\AOL
2009-08-15 03:15 . 2008-10-22 01:22 2048 ----a-w- c:\windows\system32\tzres.dll
2009-08-15 03:01 . 2008-06-20 01:14 105016 ----a-w- c:\windows\system32\PresentationCFFRasterizerNative_v0300.dll
2009-08-15 03:01 . 2008-06-20 01:14 97800 ----a-w- c:\windows\system32\infocardapi.dll
2009-08-15 03:01 . 2008-06-20 01:14 43544 ----a-w- c:\windows\system32\PresentationHostProxy.dll
2009-08-15 03:01 . 2008-06-20 01:14 11264 ----a-w- c:\windows\system32\icardres.dll
2009-08-15 03:01 . 2008-06-20 01:14 622080 ----a-w- c:\windows\system32\icardagt.exe
2009-08-15 03:01 . 2008-06-20 01:14 781344 ----a-w- c:\windows\system32\PresentationNative_v0300.dll
2009-08-15 03:01 . 2008-06-20 01:14 326160 ----a-w- c:\windows\system32\PresentationHost.exe
2009-08-15 02:58 . 2009-08-15 02:58 -------- d-----w- c:\program files\Common Files\AOL
2009-08-15 02:58 . 2009-08-15 03:43 -------- d-----w- c:\program files\AIM6
2009-08-15 02:56 . 2008-07-27 18:03 96760 ----a-w- c:\windows\system32\dfshim.dll
2009-08-15 02:56 . 2008-07-27 18:03 282112 ----a-w- c:\windows\system32\mscoree.dll
2009-08-15 02:56 . 2008-07-27 18:03 41984 ----a-w- c:\windows\system32\netfxperf.dll
2009-08-15 02:56 . 2008-07-27 18:03 158720 ----a-w- c:\windows\system32\mscorier.dll
2009-08-15 02:56 . 2008-07-27 18:03 83968 ----a-w- c:\windows\system32\mscories.dll
2009-08-15 02:54 . 2008-04-26 08:26 891448 ----a-w- c:\windows\system32\drivers\tcpip.sys
2009-08-15 02:54 . 2008-04-05 03:34 15360 ----a-w- c:\windows\system32\pacerprf.dll
2009-08-15 02:54 . 2008-04-05 01:21 72192 ----a-w- c:\windows\system32\drivers\pacer.sys
2009-08-15 02:54 . 2008-06-26 01:45 12240896 ----a-w- c:\windows\system32\NlsLexicons0007.dll
2009-08-15 02:54 . 2008-06-26 01:45 2644480 ----a-w- c:\windows\system32\NlsLexicons0009.dll
2009-08-15 02:54 . 2008-06-26 03:29 801280 ----a-w- c:\windows\system32\NaturalLanguage6.dll
2009-08-15 02:52 . 2008-06-06 03:27 562176 ----a-w- c:\windows\system32\msdtcprx.dll
2009-08-15 02:50 . 2008-06-23 01:59 2868736 ----a-w- c:\windows\system32\mf.dll
2009-08-15 02:50 . 2008-06-23 01:59 996352 ----a-w- c:\windows\system32\WMNetMgr.dll
2009-08-15 02:50 . 2008-06-23 01:58 94720 ----a-w- c:\windows\system32\logagent.exe
2009-08-15 02:50 . 2009-07-14 13:00 313344 ----a-w- c:\windows\system32\wmpdxm.dll
2009-08-15 02:50 . 2009-07-14 12:59 4096 ----a-w- c:\windows\system32\dxmasf.dll
2009-08-15 02:50 . 2009-07-14 12:58 7680 ----a-w- c:\windows\system32\spwmp.dll
2009-08-15 02:50 . 2009-07-14 10:59 8147456 ----a-w- c:\windows\system32\wmploc.DLL
2009-08-15 02:49 . 2008-12-16 02:42 288768 ----a-w- c:\windows\system32\drivers\srv.sys
2009-08-15 02:47 . 2009-04-23 12:43 784896 ----a-w- c:\windows\system32\rpcrt4.dll
2009-08-15 02:47 . 2008-10-21 05:25 1645568 ----a-w- c:\windows\system32\connect.dll
2009-08-15 02:45 . 2008-09-10 03:40 1334272 ----a-w- c:\windows\system32\msxml6.dll
2009-08-15 02:41 . 2008-10-16 21:13 1809944 ----a-w- c:\windows\system32\wuaueng.dll
2009-08-15 02:41 . 2008-10-16 21:09 51224 ----a-w- c:\windows\system32\wuauclt.exe
2009-08-15 02:41 . 2008-10-16 21:09 43544 ----a-w- c:\windows\system32\wups2.dll
2009-08-15 02:41 . 2008-10-16 20:56 1524736 ----a-w- c:\windows\system32\wucltux.dll
2009-08-15 02:40 . 2008-10-16 21:12 561688 ----a-w- c:\windows\system32\wuapi.dll
2009-08-15 02:40 . 2008-10-16 21:08 34328 ----a-w- c:\windows\system32\wups.dll
2009-08-15 02:40 . 2008-10-16 20:55 83456 ----a-w- c:\windows\system32\wudriver.dll
2009-08-15 02:40 . 2008-10-16 21:08 162064 ----a-w- c:\windows\system32\wuwebv.dll
2009-08-15 02:40 . 2008-10-16 20:56 31232 ----a-w- c:\windows\system32\wuapp.exe
2009-08-15 02:36 . 2009-08-15 02:36 -------- d-----w- c:\users\Andrew\AppData\Local\Toshiba
2009-08-15 02:36 . 2009-08-15 03:45 -------- d-----w- c:\users\Andrew\AppData\Local\Google
2009-08-15 02:35 . 2009-08-15 08:24 81888 ----a-w- c:\users\Andrew\AppData\Local\GDIPFONTCACHEV1.DAT
2009-08-15 02:35 . 2009-08-15 05:07 -------- d-----w- c:\users\Andrew\AppData\Roaming\Symantec
2009-08-15 02:35 . 2009-08-15 08:22 -------- d-----w- c:\users\Andrew\AppData\Local\VirtualStore

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-08-15 16:47 . 2008-08-18 18:50 -------- d-----w- c:\program files\Norton 360
2009-08-15 16:47 . 2008-08-18 18:48 -------- d-----w- c:\programdata\Symantec
2009-08-15 16:47 . 2008-08-18 18:48 -------- d-----w- c:\program files\Common Files\Symantec Shared
2009-08-15 08:20 . 2009-07-01 18:16 -------- d-----w- c:\programdata\Microsoft Help
2009-08-15 03:52 . 2008-08-18 17:42 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-08-15 03:29 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail
2009-08-15 02:42 . 2008-08-18 17:52 -------- d-----w- c:\programdata\WildTangent
2009-08-15 02:35 . 2009-08-15 02:35 13 --sh--r- c:\windows\system32\drivers\fbd.sys
2009-08-15 02:35 . 2009-08-15 02:35 4 --sh--r- c:\windows\system32\drivers\taishop.sys
2009-07-18 16:06 . 2009-08-15 02:51 827904 ----a-w- c:\windows\system32\wininet.dll
2009-07-18 16:01 . 2009-08-15 02:51 78336 ----a-w- c:\windows\system32\ieencode.dll
2009-07-18 09:46 . 2009-08-15 02:51 26624 ----a-w- c:\windows\system32\ieUnatt.exe
2009-07-17 14:35 . 2009-08-15 02:52 71680 ----a-w- c:\windows\system32\atl.dll
2009-07-13 21:22 . 2009-07-13 21:22 75048 ----a-w- c:\programdata\Apple Computer\Installer Cache\iTunes 8.2.1.6\SetupAdmin.exe
2009-07-01 19:30 . 2008-08-21 20:20 50 ----a-w- c:\windows\system32\drivers\DCX.LOG
2009-07-01 19:20 . 2008-08-18 18:15 -------- d-----w- c:\program files\Google
2009-07-01 19:20 . 2009-07-01 19:20 157168 ----a-w- c:\programdata\Partner\partner.dll
2009-07-01 19:20 . 2009-07-01 19:20 110576 ----a-w- c:\programdata\Partner\partner.exe
2009-07-01 19:20 . 2009-07-01 19:20 -------- d-----w- c:\programdata\Partner
2009-07-01 19:16 . 2008-08-18 17:10 -------- d-----w- c:\program files\Toshiba
2009-07-01 18:58 . 2009-07-01 18:57 -------- d-----w- c:\program files\Common Files\Toshiba Shared
2009-07-01 18:57 . 2008-08-18 17:47 -------- d-----w- c:\programdata\Toshiba
2009-07-01 18:49 . 2008-08-18 17:42 -------- d-----w- c:\program files\Realtek
2009-07-01 18:47 . 2009-07-01 18:47 -------- d-----w- c:\program files\REALTEK RTL8187B Wireless LAN Driver
2009-07-01 18:44 . 2009-07-01 18:44 -------- d-----w- c:\program files\Camera Assistant Software for Toshiba
2009-07-01 18:42 . 2009-07-01 18:42 0 ---ha-w- c:\windows\system32\drivers\Msft_Kernel_SynTP_01000.Wdf
2009-07-01 18:42 . 2009-07-01 18:42 -------- d-----w- c:\program files\Synaptics
2009-07-01 18:40 . 2008-08-18 17:40 -------- d-----w- c:\program files\Intel
2009-07-01 18:38 . 2009-07-01 18:38 -------- d-----w- c:\program files\ltmoh
2009-07-01 18:36 . 2009-07-01 18:36 319456 ----a-w- c:\windows\DIFxAPI.dll
2009-07-01 18:36 . 2009-07-01 18:36 315392 ----a-w- c:\windows\HideWin.exe
2009-07-01 18:29 . 2009-07-01 18:28 -------- d-----w- c:\program files\Microsoft Office Suite Activation Assistant
2009-07-01 18:14 . 2009-07-01 18:14 -------- d-----w- c:\program files\Microsoft Works
2009-06-15 18:20 . 2009-08-15 02:53 439896 ----a-w- c:\windows\system32\drivers\ksecdd.sys
2009-06-15 15:24 . 2009-08-15 02:53 175104 ----a-w- c:\windows\system32\wdigest.dll
2009-06-15 15:24 . 2009-08-15 02:52 156672 ----a-w- c:\windows\system32\t2embed.dll
2009-06-15 15:24 . 2009-08-15 02:53 72704 ----a-w- c:\windows\system32\secur32.dll
2009-06-15 15:24 . 2009-08-15 02:53 270848 ----a-w- c:\windows\system32\schannel.dll
2009-06-15 15:23 . 2009-08-15 02:53 1256448 ----a-w- c:\windows\system32\lsasrv.dll
2009-06-15 15:22 . 2009-08-15 02:53 213504 ----a-w- c:\windows\system32\msv1_0.dll
2009-06-15 15:21 . 2009-08-15 02:53 499712 ----a-w- c:\windows\system32\kerberos.dll
2009-06-15 15:20 . 2009-08-15 02:52 72704 ----a-w- c:\windows\system32\fontsub.dll
2009-06-15 15:20 . 2009-08-15 02:52 10240 ----a-w- c:\windows\system32\dciman32.dll
2009-06-15 12:57 . 2009-08-15 02:53 9728 ----a-w- c:\windows\system32\lsass.exe
2009-06-15 12:52 . 2009-08-15 02:52 289792 ----a-w- c:\windows\system32\atmfd.dll
2009-06-10 12:12 . 2009-08-15 02:52 160256 ----a-w- c:\windows\system32\wkssvc.dll
2009-06-10 12:07 . 2009-08-15 02:52 91136 ----a-w- c:\windows\system32\avifil32.dll
2009-06-04 12:34 . 2009-08-15 02:52 2066432 ----a-w- c:\windows\system32\mstscax.dll
.

crackbaby
Intermediate
Intermediate

Posts Posts : 62
Joined Joined : 2008-11-24
OS OS : Windows XP/ Vista
Points Points : 29499
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Rootkit/tr crypt?

Post by crackbaby on 15th August 2009, 8:53 pm

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{83FF80F4-8C74-4b80-B5BA-C8DDD434E5C4}]
2009-07-01 19:20 157168 ----a-w- c:\programdata\Partner\partner.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TOSCDSPD"="c:\program files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe" [2008-04-24 430080]
"951738463"="c:\program files\Toshiba Registration\Registration.exe" [2008-07-22 87536]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-07-01 39408]
"oovoo.exe"="c:\program files\ooVoo\oovoo.exe" [2009-07-31 17377584]
"Aim6"="c:\program files\AIM6\aim6.exe" [2009-07-09 49968]
"Steam"="c:\program files\Steam\Steam.exe" [2009-08-15 1217784]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2009-08-05 1830128]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-06-25 150040]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-06-25 170520]
"Persistence"="c:\windows\system32\igfxpers.exe" [2008-06-25 145944]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2008-04-16 178712]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-12-07 1029416]
"Camera Assistant Software"="c:\program files\Camera Assistant Software for Toshiba\traybar.exe" [2008-04-29 417792]
"TPwrMain"="c:\program files\TOSHIBA\Power Saver\TPwrMain.EXE" [2008-02-06 431456]
"SmoothView"="c:\program files\Toshiba\SmoothView\SmoothView.exe" [2008-06-02 505720]
"00TCrdMain"="c:\program files\TOSHIBA\FlashCards\TCrdMain.exe" [2008-05-09 716800]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-21 1008184]
"ToshibaServiceStation"="c:\program files\TOSHIBA\TOSHIBA Service Station\TSS.exe" [2008-08-04 1242424]
"Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2008-08-21 29744]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-05-27 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-07-13 292128]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
"RtHDVCpl"="RtHDVCpl.exe" - c:\windows\RtHDVCpl.exe [2008-04-08 6037504]
"NDSTray.exe"="NDSTray.exe" [BU]

c:\users\Andrew\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
LimeWire On Startup.lnk - c:\program files\LimeWire\LimeWire.exe [2009-3-3 139776]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-12-22 19:05 356352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\progra~1\Google\GOOGLE~1\GoogleDesktopNetwork3.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{B40C0D2D-4B9A-46E8-A682-1C651372FEB4}"= UDP:c:\program files\Common Files\AOL\Loader\aolload.exe:AOL Loader
"{4E640124-42FE-4BF0-9CDF-B52E632B93CD}"= TCP:c:\program files\Common Files\AOL\Loader\aolload.exe:AOL Loader
"{85AA1BD1-FDD8-4EFC-AAB7-896559B6C970}"= UDP:c:\program files\AIM6\aim6.exe:AIM
"{4A7F3755-47C1-42D4-A5C5-A6BA4CA0D39E}"= TCP:c:\program files\AIM6\aim6.exe:AIM
"{7434F316-59F0-4AD1-B655-5B53A8C97B2A}"= UDP:443:ooVoo TCP port 443
"{DB4E1E27-8095-4F14-8DA1-7F11299C57EB}"= TCP:443:ooVoo UDP port 443
"{AC341CE8-591F-495D-8C33-21305C2F0F4D}"= UDP:37674:ooVoo TCP port 37674
"{2CCEBDBA-0FDF-45CF-8E22-57379A5FDF54}"= TCP:37674:ooVoo UDP port 37674
"{ACB87422-E256-475B-8D5D-47A6DE73A762}"= TCP:37675:ooVoo UDP port 37675
"{9775F503-A93E-4E64-94F3-289F68E7DEFF}"= UDP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{EDF2D1EE-DE09-4ADC-80B3-C3AA15864525}"= TCP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{A7AEDEE6-8F3F-4DD4-8EA1-36D1D19FA592}"= UDP:c:\program files\iTunes\iTunes.exe:iTunes
"{9556DFC4-113C-42BE-BA62-A3575AFD3435}"= TCP:c:\program files\iTunes\iTunes.exe:iTunes
"TCP Query User{81D52F35-EBB1-40D9-97DA-9ED5A2AD1FDB}c:\\program files\\limewire\\limewire.exe"= UDP:c:\program files\limewire\limewire.exe:LimeWire
"UDP Query User{AF284A7D-E71A-48F4-B94C-8DD545916604}c:\\program files\\limewire\\limewire.exe"= TCP:c:\program files\limewire\limewire.exe:LimeWire

R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [8/5/2009 4:06 PM 9968]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [8/5/2009 4:06 PM 74480]
R2 AntiVirMailService;Avira AntiVir MailGuard;c:\program files\Avira\AntiVir Desktop\avmailc.exe [8/15/2009 12:17 PM 194817]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [8/15/2009 12:17 PM 108289]
R2 AntiVirWebService;Avira AntiVir WebGuard;c:\program files\Avira\AntiVir Desktop\avwebgrd.exe [8/15/2009 12:17 PM 434945]
R2 ConfigFree Service;ConfigFree Service;c:\program files\Toshiba\ConfigFree\CFSvcs.exe [4/17/2008 12:19 AM 40960]
R2 TMachInfo;TMachInfo;c:\program files\Toshiba\TOSHIBA Service Station\TMachInfo.exe [8/18/2008 10:58 AM 46392]
R2 TOSHIBA SMART Log Service;TOSHIBA SMART Log Service;c:\program files\Toshiba\SMARTLogService\TosIPCSrv.exe [12/3/2007 5:03 PM 126976]
R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [8/14/2009 8:43 PM 24652]
R3 FwLnk;FwLnk Driver;c:\windows\System32\drivers\FwLnk.sys [8/18/2008 10:48 AM 7168]
R3 RTL8187B;Realtek RTL8187B Wireless 802.11b/g 54Mbps USB 2.0 Network Adapter;c:\windows\System32\drivers\rtl8187B.sys [7/1/2009 11:47 AM 290304]
R3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [8/5/2009 4:06 PM 7408]
R3 SmartFaceVWatchSrv;SmartFaceVWatchSrv;c:\program files\Toshiba\SmartFaceV\SmartFaceVWatchSrv.exe [4/24/2008 6:35 PM 73728]
S3 GoogleDesktopManager-022208-143751;Google Desktop Manager 5.7.802.22438;c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [8/21/2008 11:31 AM 29744]
S3 Partner Service;Partner Service;c:\programdata\Partner\partner.exe [7/1/2009 12:20 PM 110576]
S3 SVRPEDRV;SVRPEDRV;c:\windows\System32\sysprep\PEDRV.SYS [8/21/2008 1:18 PM 9216]
.
- - - - ORPHANS REMOVED - - - -

HKLM-Run-cfFncEnabler.exe - cfFncEnabler.exe


.
------- Supplementary Scan -------
.
uStart Page = [You must be registered and logged in to see this link.]
mStart Page = [You must be registered and logged in to see this link.]
uInternet Settings,ProxyOverride = *.local
LSP: c:\program files\Avira\AntiVir Desktop\avsda.dll
FF - ProfilePath - c:\users\Andrew\AppData\Roaming\Mozilla\Firefox\Profiles\m7p9ug83.default\

---- FIREFOX POLICIES ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.enforce_same_site_origin", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.cache_size", 51200);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.ogg.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.wave.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.autoplay.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.urlbar.autocomplete.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("capability.policy.mailnews.*.wholeText", "noAccess");
c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.storage.default_quota", 5120);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("content.sink.event_probe_rate", 3);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.http.prompt-temp-redirect", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("layout.css.dpi", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("layout.css.devPixelsPerPx", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("gestures.enable_single_finger_input", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.max_chrome_script_run_time", 0);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.tcp.sendbuffer", 131072);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("geo.enabled", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.remember_cert_checkbox_default_setting", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr", "moz35");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-cjkt", "moz35");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.blocklist.level", 2);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.urlbar.restrict.typed", "~");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.urlbar.default.behavior", 0);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.history", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.formdata", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.passwords", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.downloads", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cookies", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cache", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.sessions", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.offlineApps", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.siteSettings", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.history", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.formdata", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.passwords", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.downloads", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.cookies", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.cache", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.sessions", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.offlineApps", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.siteSettings", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.sanitize.migrateFx3Prefs", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.ssl_override_behavior", 2);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("security.alternate_certificate_error_page", "certerror");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.autostart", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.dont_prompt_on_enter", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("geo.wifi.uri", "https://www.google.com/loc/json");
.

crackbaby
Intermediate
Intermediate

Posts Posts : 62
Joined Joined : 2008-11-24
OS OS : Windows XP/ Vista
Points Points : 29499
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Rootkit/tr crypt?

Post by crackbaby on 15th August 2009, 8:53 pm

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, [You must be registered and logged in to see this link.]
Rootkit scan 2009-08-15 13:44
Windows 6.0.6001 Service Pack 1 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5
.
------------------------ Other Running Processes ------------------------
.
c:\windows\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
c:\windows\System32\audiodg.exe
c:\windows\System32\agrsmsvc.exe
c:\program files\Avira\AntiVir Desktop\avguard.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Toshiba\TOSHIBA DVD PLAYER\TNaviSrv.exe
c:\windows\System32\TODDSrv.exe
c:\program files\Toshiba\Power Saver\TosCoSrv.exe
c:\program files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
c:\program files\Intel\Intel Matrix Storage Manager\IAANTmon.exe
c:\program files\Avira\AntiVir Desktop\avscan.exe
c:\windows\System32\conime.exe
c:\windows\System32\igfxsrvc.exe
c:\program files\Camera Assistant Software for Toshiba\CEC_MAIN.exe
c:\program files\Toshiba\ConfigFree\NDSTray.exe
c:\windows\System32\wbem\unsecapp.exe
c:\windows\System32\igfxext.exe
c:\program files\Synaptics\SynTP\SynTPHelper.exe
c:\program files\Toshiba\ConfigFree\CFSwMgr.exe
c:\program files\iPod\bin\iPodService.exe
c:\program files\AIM6\aolsoftware.exe
c:\windows\System32\wbem\WMIADAP.exe
c:\windows\System32\rundll32.exe
.
**************************************************************************
.
Completion time: 2009-08-15 13:50 - machine was rebooted
ComboFix-quarantined-files.txt 2009-08-15 20:50

Pre-Run: 270,667,386,880 bytes free
Post-Run: 270,363,062,272 bytes free

363 --- E O F --- 2009-08-15 03:37

crackbaby
Intermediate
Intermediate

Posts Posts : 62
Joined Joined : 2008-11-24
OS OS : Windows XP/ Vista
Points Points : 29499
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Rootkit/tr crypt?

Post by Belahzur on 15th August 2009, 11:23 pm

Hello.

Now open a new notepad file.
Input this into the notepad file:

Driver::
Partner Service

Folder::
c:\programdata\Partner

Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{83FF80F4-8C74-4b80-B5BA-C8DDD434E5C4}]

Save this as CFScript.txt, save it to your desktop also.
Then drag and drop CFScript.txt into combofix as seen below:


This will open combofix again, agree to it's terms and allow it to run.
It may want to reboot after it's done. (It will warn you if it wants to)
Post the resulting log back here.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34918
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : 7 Home Premium x64
Points Points : 245101
# Likes # Likes : 1

View user profile

Back to top Go down

Re: Rootkit/tr crypt?

Post by crackbaby on 16th August 2009, 3:19 am

Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.1.1033.18.2939.1924 [GMT -7:00]
Running from: C:\Users\Andrew\Desktop\Combo-Fix.exe
Command switches used :: C:\Users\Andrew\Desktop\CFScript.txt.txt
SP: SUPERAntiSpyware *disabled* (Updated) {222A897C-5018-402e-943F-7E7AC8560DA7}
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\programdata\Partner
c:\programdata\Partner\partner.dll
c:\programdata\Partner\partner.exe


.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_Partner Service


((((((((((((((((((((((((( Files Created from 2009-07-16 to 2009-08-16 )))))))))))))))))))))))))))))))
.

2009-08-16 03:11:41 . 2009-08-16 03:11:41 0 d-----w- C:\Users\Public\AppData\Local\temp
2009-08-16 03:11:41 . 2009-08-16 03:11:41 0 d-----w- C:\Users\Default\AppData\Local\temp
2009-08-15 21:26:23 . 2009-08-15 21:26:23 211968 ----a-w- C:\Users\Andrew\AppData\Roaming\Thinstall\Microsoft Office Enterprise 2007\1000000600002i\verclsid.exe
2009-08-15 20:26:12 . 2009-08-15 20:26:12 0 d-----w- C:\Users\Andrew\AppData\Roaming\Avira
2009-08-15 20:17:12 . 2009-08-16 02:56:54 117760 ----a-w- C:\Users\Andrew\AppData\Roaming\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
2009-08-15 20:16:37 . 2009-08-15 20:16:37 0 d-----w- C:\ProgramData\SUPERAntiSpyware.com
2009-08-15 20:16:30 . 2009-08-15 20:16:31 0 d-----w- C:\Program Files\SUPERAntiSpyware
2009-08-15 20:16:30 . 2009-08-15 20:16:30 0 d-----w- C:\Users\Andrew\AppData\Roaming\SUPERAntiSpyware.com
2009-08-15 20:15:56 . 2009-08-15 20:15:56 0 d-----w- C:\Program Files\Common Files\Wise Installation Wizard
2009-08-15 19:39:49 . 2009-08-15 19:39:49 0 d-----w- C:\Program Files\Trend Micro
2009-08-15 19:17:33 . 2009-08-15 19:25:37 96104 ----a-w- C:\Windows\system32\drivers\avipbb.sys
2009-08-15 19:17:33 . 2009-08-15 19:25:37 55656 ----a-w- C:\Windows\system32\drivers\avgntflt.sys
2009-08-15 19:17:30 . 2009-08-15 19:17:38 0 d-----w- C:\ProgramData\Avira
2009-08-15 19:17:30 . 2009-08-15 19:17:30 0 d-----w- C:\Program Files\Avira
2009-08-15 19:06:02 . 2009-08-15 19:30:07 0 d-----w- C:\Program Files\Common Files\Steam
2009-08-15 19:06:01 . 2009-08-16 02:56:57 0 d-----w- C:\Program Files\Steam
2009-08-15 18:47:36 . 2009-08-16 02:59:46 0 d-----w- C:\Users\Andrew\AppData\Roaming\LimeWire
2009-08-15 18:47:24 . 2009-08-15 18:47:28 0 d-----w- C:\Program Files\LimeWire
2009-08-15 08:12:37 . 2009-08-15 08:12:37 0 d-----w- C:\Users\Andrew\AppData\Roaming\Thinstall
2009-08-15 08:05:59 . 2009-08-15 08:06:54 0 d-----w- C:\Users\Andrew\AppData\Roaming\Webcammax
2009-08-15 08:05:39 . 2008-03-11 13:14:54 941784 ----a-w- C:\Windows\system32\drivers\CAMTHWDM.sys
2009-08-15 07:49:06 . 2009-08-15 07:49:07 0 d-----w- C:\Program Files\7-Zip
2009-08-15 07:40:50 . 2009-08-15 07:40:50 0 d-----w- C:\Users\Andrew\AppData\Roaming\Apple Computer
2009-08-15 07:40:44 . 2009-08-15 07:40:44 0 dc----w- C:\Windows\system32\DRVSTORE
2009-08-15 07:40:44 . 2009-03-19 23:32:48 23400 ----a-w- C:\Windows\system32\drivers\GEARAspiWDM.sys
2009-08-15 07:40:44 . 2008-04-17 19:12:54 107368 ----a-w- C:\Windows\system32\GEARAspi.dll
2009-08-15 07:40:31 . 2009-08-15 07:40:31 0 d-----w- C:\Program Files\iPod
2009-08-15 07:40:29 . 2009-08-15 07:40:44 0 d-----w- C:\ProgramData\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
2009-08-15 07:40:29 . 2009-08-15 07:40:44 0 d-----w- C:\Program Files\iTunes
2009-08-15 07:39:08 . 2009-08-15 07:39:09 0 d-----w- C:\Program Files\Bonjour
2009-08-15 07:39:01 . 2009-08-15 07:39:11 0 d-----w- C:\Users\Andrew\AppData\Roaming\acccore
2009-08-15 07:37:52 . 2009-08-15 07:40:31 0 d-----w- C:\Program Files\Common Files\Apple
2009-08-15 05:36:36 . 2009-08-15 07:40:50 0 d-----w- C:\Users\Andrew\AppData\Local\Apple Computer
2009-08-15 05:34:02 . 2009-08-15 07:40:29 0 d-----w- C:\ProgramData\Apple Computer
2009-08-15 05:34:02 . 2009-08-15 05:38:13 0 d-----w- C:\Program Files\QuickTime
2009-08-15 05:33:00 . 2009-08-15 05:33:00 0 d-----w- C:\Users\Andrew\AppData\Local\Apple
2009-08-15 05:32:58 . 2009-08-15 05:32:59 0 d-----w- C:\Program Files\Apple Software Update
2009-08-15 05:32:57 . 2009-08-15 05:32:57 0 d-----w- C:\ProgramData\Apple
2009-08-15 03:53:10 . 2009-08-15 03:56:04 0 d-----w- C:\Users\Andrew\AppData\Roaming\ooVoo Details
2009-08-15 03:53:00 . 2009-08-15 20:42:44 0 d-----w- C:\Program Files\ooVoo
2009-08-15 03:43:50 . 2009-08-15 03:43:50 0 d-----w- C:\Users\Andrew\AppData\Local\AOL OCP
2009-08-15 03:43:50 . 2009-08-15 03:43:50 0 d-----w- C:\Users\Andrew\AppData\Local\AOL
2009-08-15 03:43:39 . 2009-08-15 19:58:57 0 d-----w- C:\Program Files\Viewpoint
2009-08-15 03:43:39 . 2009-08-15 03:43:39 0 d-----w- C:\ProgramData\Viewpoint
2009-08-15 03:43:38 . 2009-08-15 03:43:38 0 d-----w- C:\ProgramData\acccore
2009-08-15 03:43:32 . 2009-08-15 03:44:00 0 d-----w- C:\ProgramData\AOL OCP
2009-08-15 03:43:32 . 2009-08-15 03:43:32 0 d-----w- C:\ProgramData\AOL
2009-08-15 03:15:52 . 2008-10-22 01:22:11 2048 ----a-w- C:\Windows\system32\tzres.dll
2009-08-15 03:01:33 . 2008-06-20 01:14:45 105016 ----a-w- C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll
2009-08-15 03:01:33 . 2008-06-20 01:14:34 97800 ----a-w- C:\Windows\system32\infocardapi.dll
2009-08-15 03:01:32 . 2008-06-20 01:14:45 43544 ----a-w- C:\Windows\system32\PresentationHostProxy.dll
2009-08-15 03:01:32 . 2008-06-20 01:14:34 11264 ----a-w- C:\Windows\system32\icardres.dll
2009-08-15 03:01:32 . 2008-06-20 01:14:33 622080 ----a-w- C:\Windows\system32\icardagt.exe
2009-08-15 03:01:31 . 2008-06-20 01:14:45 781344 ----a-w- C:\Windows\system32\PresentationNative_v0300.dll
2009-08-15 03:01:29 . 2008-06-20 01:14:45 326160 ----a-w- C:\Windows\system32\PresentationHost.exe
2009-08-15 02:58:56 . 2009-08-15 02:58:57 0 d-----w- C:\Program Files\Common Files\AOL
2009-08-15 02:58:43 . 2009-08-15 03:43:50 0 d-----w- C:\Program Files\AIM6
2009-08-15 02:56:22 . 2008-07-27 18:03:16 96760 ----a-w- C:\Windows\system32\dfshim.dll
2009-08-15 02:56:20 . 2008-07-27 18:03:17 282112 ----a-w- C:\Windows\system32\mscoree.dll
2009-08-15 02:56:19 . 2008-07-27 18:03:17 41984 ----a-w- C:\Windows\system32\netfxperf.dll
2009-08-15 02:56:10 . 2008-07-27 18:03:17 158720 ----a-w- C:\Windows\system32\mscorier.dll
2009-08-15 02:56:05 . 2008-07-27 18:03:17 83968 ----a-w- C:\Windows\system32\mscories.dll
2009-08-15 02:54:22 . 2008-04-26 08:26:49 891448 ----a-w- C:\Windows\system32\drivers\tcpip.sys
2009-08-15 02:54:22 . 2008-04-05 03:34:31 15360 ----a-w- C:\Windows\system32\pacerprf.dll
2009-08-15 02:54:22 . 2008-04-05 01:21:42 72192 ----a-w- C:\Windows\system32\drivers\pacer.sys
2009-08-15 02:54:18 . 2008-06-26 01:45:43 12240896 ----a-w- C:\Windows\system32\NlsLexicons0007.dll
2009-08-15 02:54:15 . 2008-06-26 01:45:55 2644480 ----a-w- C:\Windows\system32\NlsLexicons0009.dll
2009-08-15 02:54:05 . 2008-06-26 03:29:06 801280 ----a-w- C:\Windows\system32\NaturalLanguage6.dll
2009-08-15 02:52:59 . 2008-06-06 03:27:05 562176 ----a-w- C:\Windows\system32\msdtcprx.dll
2009-08-15 02:50:40 . 2008-06-23 01:59:25 2868736 ----a-w- C:\Windows\system32\mf.dll
2009-08-15 02:50:38 . 2008-06-23 01:59:26 996352 ----a-w- C:\Windows\system32\WMNetMgr.dll
2009-08-15 02:50:38 . 2008-06-23 01:58:43 94720 ----a-w- C:\Windows\system32\logagent.exe
2009-08-15 02:50:33 . 2009-07-14 13:00:17 313344 ----a-w- C:\Windows\system32\wmpdxm.dll
2009-08-15 02:50:32 . 2009-07-14 12:59:28 4096 ----a-w- C:\Windows\system32\dxmasf.dll
2009-08-15 02:50:32 . 2009-07-14 12:58:44 7680 ----a-w- C:\Windows\system32\spwmp.dll
2009-08-15 02:50:31 . 2009-07-14 10:59:56 8147456 ----a-w- C:\Windows\system32\wmploc.DLL
2009-08-15 02:49:47 . 2008-12-16 02:42:39 288768 ----a-w- C:\Windows\system32\drivers\srv.sys
2009-08-15 02:47:48 . 2009-04-23 12:43:04 784896 ----a-w- C:\Windows\system32\rpcrt4.dll
2009-08-15 02:47:41 . 2008-10-21 05:25:17 1645568 ----a-w- C:\Windows\system32\connect.dll
2009-08-15 02:45:29 . 2008-09-10 03:40:14 1334272 ----a-w- C:\Windows\system32\msxml6.dll
2009-08-15 02:41:03 . 2008-10-16 21:13:38 1809944 ----a-w- C:\Windows\system32\wuaueng.dll
2009-08-15 02:41:03 . 2008-10-16 21:09:43 51224 ----a-w- C:\Windows\system32\wuauclt.exe
2009-08-15 02:41:03 . 2008-10-16 21:09:43 43544 ----a-w- C:\Windows\system32\wups2.dll
2009-08-15 02:41:03 . 2008-10-16 20:56:28 1524736 ----a-w- C:\Windows\system32\wucltux.dll
2009-08-15 02:40:44 . 2008-10-16 21:12:19 561688 ----a-w- C:\Windows\system32\wuapi.dll
2009-08-15 02:40:44 . 2008-10-16 21:08:57 34328 ----a-w- C:\Windows\system32\wups.dll
2009-08-15 02:40:44 . 2008-10-16 20:55:59 83456 ----a-w- C:\Windows\system32\wudriver.dll
2009-08-15 02:40:33 . 2008-10-16 21:08:00 162064 ----a-w- C:\Windows\system32\wuwebv.dll
2009-08-15 02:40:33 . 2008-10-16 20:56:04 31232 ----a-w- C:\Windows\system32\wuapp.exe
2009-08-15 02:36:10 . 2009-08-15 02:36:10 0 d-----w- C:\Users\Andrew\AppData\Local\Toshiba
2009-08-15 02:36:05 . 2009-08-15 03:45:32 0 d-----w- C:\Users\Andrew\AppData\Local\Google
2009-08-15 02:35:59 . 2009-08-15 08:24:04 81888 ----a-w- C:\Users\Andrew\AppData\Local\GDIPFONTCACHEV1.DAT
2009-08-15 02:35:57 . 2009-08-15 05:07:50 0 d-----w- C:\Users\Andrew\AppData\Roaming\Symantec
2009-08-15 02:35:25 . 2009-08-15 08:22:59 0 d-----w- C:\Users\Andrew\AppData\Local\VirtualStore

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-08-15 16:47:23 . 2008-08-18 18:50:06 0 d-----w- C:\Program Files\Norton 360
2009-08-15 16:47:23 . 2008-08-18 18:48:13 0 d-----w- C:\ProgramData\Symantec
2009-08-15 16:47:23 . 2008-08-18 18:48:13 0 d-----w- C:\Program Files\Common Files\Symantec Shared
2009-08-15 08:20:13 . 2009-07-01 18:16:54 0 d-----w- C:\ProgramData\Microsoft Help
2009-08-15 03:52:59 . 2008-08-18 17:42:57 0 d--h--w- C:\Program Files\InstallShield Installation Information
2009-08-15 03:29:24 . 2006-11-02 11:18:33 0 d-----w- C:\Program Files\Windows Mail
2009-08-15 02:42:37 . 2008-08-18 17:52:52 0 d-----w- C:\ProgramData\WildTangent
2009-08-15 02:35:24 . 2009-08-15 02:35:24 13 --sh--r- C:\Windows\system32\drivers\fbd.sys
2009-08-15 02:35:22 . 2009-08-15 02:35:22 4 --sh--r- C:\Windows\system32\drivers\taishop.sys
2009-07-18 16:06:20 . 2009-08-15 02:51:35 827904 ----a-w- C:\Windows\system32\wininet.dll
2009-07-18 16:01:48 . 2009-08-15 02:51:34 78336 ----a-w- C:\Windows\system32\ieencode.dll
2009-07-18 09:46:14 . 2009-08-15 02:51:34 26624 ----a-w- C:\Windows\system32\ieUnatt.exe
2009-07-17 14:35:11 . 2009-08-15 02:52:33 71680 ----a-w- C:\Windows\system32\atl.dll
2009-07-13 21:22:08 . 2009-07-13 21:22:08 75048 ----a-w- C:\ProgramData\Apple Computer\Installer Cache\iTunes 8.2.1.6\SetupAdmin.exe
2009-07-01 19:30:30 . 2008-08-21 20:20:56 50 ----a-w- C:\Windows\system32\drivers\DCX.LOG
2009-07-01 19:20:45 . 2008-08-18 18:15:21 0 d-----w- C:\Program Files\Google
2009-07-01 19:16:53 . 2008-08-18 17:10:57 0 d-----w- C:\Program Files\Toshiba
2009-07-01 18:58:10 . 2009-07-01 18:57:19 0 d-----w- C:\Program Files\Common Files\Toshiba Shared
2009-07-01 18:57:21 . 2008-08-18 17:47:25 0 d-----w- C:\ProgramData\Toshiba
2009-07-01 18:49:03 . 2008-08-18 17:42:57 0 d-----w- C:\Program Files\Realtek
2009-07-01 18:47:21 . 2009-07-01 18:47:21 0 d-----w- C:\Program Files\REALTEK RTL8187B Wireless LAN Driver
2009-07-01 18:44:05 . 2009-07-01 18:44:00 0 d-----w- C:\Program Files\Camera Assistant Software for Toshiba
2009-07-01 18:42:48 . 2009-07-01 18:42:48 0 ---ha-w- C:\Windows\system32\drivers\Msft_Kernel_SynTP_01000.Wdf
2009-07-01 18:42:22 . 2009-07-01 18:42:22 0 d-----w- C:\Program Files\Synaptics
2009-07-01 18:40:14 . 2008-08-18 17:40:29 0 d-----w- C:\Program Files\Intel
2009-07-01 18:38:28 . 2009-07-01 18:38:28 0 d-----w- C:\Program Files\ltmoh
2009-07-01 18:36:04 . 2009-07-01 18:36:04 319456 ----a-w- C:\Windows\DIFxAPI.dll
2009-07-01 18:36:01 . 2009-07-01 18:36:01 315392 ----a-w- C:\Windows\HideWin.exe
2009-07-01 18:29:01 . 2009-07-01 18:28:13 0 d-----w- C:\Program Files\Microsoft Office Suite Activation Assistant
2009-07-01 18:14:53 . 2009-07-01 18:14:30 0 d-----w- C:\Program Files\Microsoft Works
2009-06-15 18:20:59 . 2009-08-15 02:53:01 439896 ----a-w- C:\Windows\system32\drivers\ksecdd.sys
2009-06-15 15:24:38 . 2009-08-15 02:53:02 175104 ----a-w- C:\Windows\system32\wdigest.dll
2009-06-15 15:24:24 . 2009-08-15 02:52:52 156672 ----a-w- C:\Windows\system32\t2embed.dll
2009-06-15 15:24:05 . 2009-08-15 02:53:01 72704 ----a-w- C:\Windows\system32\secur32.dll
2009-06-15 15:24:02 . 2009-08-15 02:53:01 270848 ----a-w- C:\Windows\system32\schannel.dll
2009-06-15 15:23:47 . 2009-08-15 02:53:01 1256448 ----a-w- C:\Windows\system32\lsasrv.dll
2009-06-15 15:22:19 . 2009-08-15 02:53:02 213504 ----a-w- C:\Windows\system32\msv1_0.dll
2009-06-15 15:21:07 . 2009-08-15 02:53:02 499712 ----a-w- C:\Windows\system32\kerberos.dll
2009-06-15 15:20:27 . 2009-08-15 02:52:52 72704 ----a-w- C:\Windows\system32\fontsub.dll
2009-06-15 15:20:00 . 2009-08-15 02:52:52 10240 ----a-w- C:\Windows\system32\dciman32.dll
2009-06-15 12:57:59 . 2009-08-15 02:53:01 9728 ----a-w- C:\Windows\system32\lsass.exe
2009-06-15 12:52:13 . 2009-08-15 02:52:52 289792 ----a-w- C:\Windows\system32\atmfd.dll
2009-06-10 12:12:29 . 2009-08-15 02:52:45 160256 ----a-w- C:\Windows\system32\wkssvc.dll
2009-06-10 12:07:30 . 2009-08-15 02:52:42 91136 ----a-w- C:\Windows\system32\avifil32.dll
2009-06-04 12:34:04 . 2009-08-15 02:52:56 2066432 ----a-w- C:\Windows\system32\mstscax.dll
.

crackbaby
Intermediate
Intermediate

Posts Posts : 62
Joined Joined : 2008-11-24
OS OS : Windows XP/ Vista
Points Points : 29499
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Rootkit/tr crypt?

Post by crackbaby on 16th August 2009, 3:20 am

((((((((((((((((((((((((((((( [You must be registered and logged in to see this link.] )))))))))))))))))))))))))))))))))))))))))
.
+ 2006-11-02 13:05:11 . 2009-08-16 02:57:15 70196 C:\Windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin
- 2009-07-01 19:31:06 . 2009-08-15 19:36:21 16384 C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2009-07-01 19:31:06 . 2009-08-16 03:00:16 16384 C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2009-07-01 19:31:06 . 2009-08-16 03:00:16 32768 C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2009-07-01 19:31:06 . 2009-08-15 19:36:21 32768 C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2009-07-01 19:31:06 . 2009-08-15 19:36:21 16384 C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2009-07-01 19:31:06 . 2009-08-16 03:00:16 16384 C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2006-11-02 10:25:05 . 2009-08-15 20:16:19 51200 C:\Windows\inf\infpub.dat
+ 2006-11-02 10:25:05 . 2009-08-16 02:50:04 51200 C:\Windows\inf\infpub.dat
+ 2009-08-15 02:36:32 . 2009-08-16 02:57:15 2440 C:\Windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-1934651463-4168729035-3063580607-1000_UserData.bin
+ 2009-08-16 03:12:58 . 2009-08-16 03:12:58 2048 C:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2009-08-16 03:12:58 . 2009-08-16 03:12:58 2048 C:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2009-08-15 04:11:18 . 2009-08-16 02:49:43 182722 C:\Windows\System32\WDI\SuspendPerformanceDiagnostics_SystemData_S3.bin
+ 2006-11-02 10:33:01 . 2009-08-16 03:00:03 608136 C:\Windows\System32\perfh009.dat
- 2006-11-02 10:33:01 . 2009-08-15 19:53:01 608136 C:\Windows\System32\perfh009.dat
- 2006-11-02 10:33:01 . 2009-08-15 19:53:01 105574 C:\Windows\System32\perfc009.dat
+ 2006-11-02 10:33:01 . 2009-08-16 03:00:03 105574 C:\Windows\System32\perfc009.dat
- 2009-07-01 19:22:31 . 2009-08-15 20:43:27 761704 C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache3.0.0.0.dat
+ 2009-07-01 19:22:31 . 2009-08-16 03:12:08 761704 C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache3.0.0.0.dat
+ 2006-11-02 10:25:05 . 2009-08-16 02:50:03 143360 C:\Windows\inf\infstrng.dat
- 2006-11-02 10:25:05 . 2009-08-15 20:16:19 143360 C:\Windows\inf\infstrng.dat
+ 2009-08-16 03:11:53 . 2009-08-16 03:11:53 307200 C:\Windows\ERDNT\subs\Users\00000004\UsrClass.dat
+ 2009-08-16 03:11:53 . 2009-08-16 03:11:53 208896 C:\Windows\ERDNT\subs\Users\00000002\NTUSER.DAT
- 2009-08-15 20:43:11 . 2009-08-15 20:43:11 208896 C:\Windows\ERDNT\subs\Users\00000002\NTUSER.DAT
+ 2009-08-16 03:11:53 . 2009-08-16 03:11:53 208896 C:\Windows\ERDNT\subs\Users\00000001\NTUSER.DAT
- 2009-08-15 20:43:11 . 2009-08-15 20:43:11 208896 C:\Windows\ERDNT\subs\Users\00000001\NTUSER.DAT
+ 2009-08-16 03:11:53 . 2009-08-16 03:11:53 1101824 C:\Windows\ERDNT\subs\Users\00000003\NTUSER.DAT
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TOSCDSPD"="C:\Program Files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe" [2008-04-24 20:03:12 430080]
"951738463"="C:\Program Files\Toshiba Registration\Registration.exe" [2008-07-22 23:02:36 87536]
"Steam"="C:\Program Files\Steam\Steam.exe" [2009-08-15 19:06:24 1217784]
"SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2009-08-05 23:06:26 1830128]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="C:\Windows\system32\igfxtray.exe" [2008-06-25 22:06:10 150040]
"HotKeysCmds"="C:\Windows\system32\hkcmd.exe" [2008-06-25 22:05:50 170520]
"Persistence"="C:\Windows\system32\igfxpers.exe" [2008-06-25 22:06:02 145944]
"IAAnotif"="C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2008-04-16 00:54:40 178712]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2007-12-07 01:12:44 1029416]
"Camera Assistant Software"="C:\Program Files\Camera Assistant Software for Toshiba\traybar.exe" [2008-04-29 17:33:28 417792]
"TPwrMain"="C:\Program Files\TOSHIBA\Power Saver\TPwrMain.EXE" [2008-02-06 20:52:52 431456]
"SmoothView"="C:\Program Files\Toshiba\SmoothView\SmoothView.exe" [2008-06-02 20:26:48 505720]
"00TCrdMain"="C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe" [2008-05-09 18:49:30 716800]
"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2008-01-21 02:23:32 1008184]
"ToshibaServiceStation"="C:\Program Files\TOSHIBA\TOSHIBA Service Station\TSS.exe" [2008-08-04 21:46:38 1242424]
"Google Desktop Search"="C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" [2008-08-21 18:31:36 29744]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2009-05-27 00:18:30 413696]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2009-07-13 21:03:10 292128]
"avgnt"="C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 19:08:47 209153]
"RtHDVCpl"="RtHDVCpl.exe" - C:\Windows\RtHDVCpl.exe [2008-04-08 22:14:50 6037504]
"NDSTray.exe"="NDSTray.exe" [BU]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "C:\Program Files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 17:13:36 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-12-22 19:05:34 356352 ----a-w- C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=C:\PROGRA~1\Google\GOOGLE~1\GoogleDesktopNetwork3.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{B40C0D2D-4B9A-46E8-A682-1C651372FEB4}"= UDP:C:\Program Files\Common Files\AOL\Loader\aolload.exe:AOL Loader
"{4E640124-42FE-4BF0-9CDF-B52E632B93CD}"= TCP:C:\Program Files\Common Files\AOL\Loader\aolload.exe:AOL Loader
"{85AA1BD1-FDD8-4EFC-AAB7-896559B6C970}"= UDP:C:\Program Files\AIM6\aim6.exe:AIM
"{4A7F3755-47C1-42D4-A5C5-A6BA4CA0D39E}"= TCP:C:\Program Files\AIM6\aim6.exe:AIM
"{7434F316-59F0-4AD1-B655-5B53A8C97B2A}"= UDP:443:ooVoo TCP port 443
"{DB4E1E27-8095-4F14-8DA1-7F11299C57EB}"= TCP:443:ooVoo UDP port 443
"{AC341CE8-591F-495D-8C33-21305C2F0F4D}"= UDP:37674:ooVoo TCP port 37674
"{2CCEBDBA-0FDF-45CF-8E22-57379A5FDF54}"= TCP:37674:ooVoo UDP port 37674
"{ACB87422-E256-475B-8D5D-47A6DE73A762}"= TCP:37675:ooVoo UDP port 37675
"{9775F503-A93E-4E64-94F3-289F68E7DEFF}"= UDP:C:\Program Files\Bonjour\mDNSResponder.exe:Bonjour
"{EDF2D1EE-DE09-4ADC-80B3-C3AA15864525}"= TCP:C:\Program Files\Bonjour\mDNSResponder.exe:Bonjour
"{A7AEDEE6-8F3F-4DD4-8EA1-36D1D19FA592}"= UDP:C:\Program Files\iTunes\iTunes.exe:iTunes
"{9556DFC4-113C-42BE-BA62-A3575AFD3435}"= TCP:C:\Program Files\iTunes\iTunes.exe:iTunes
"TCP Query User{81D52F35-EBB1-40D9-97DA-9ED5A2AD1FDB}C:\\program files\\limewire\\limewire.exe"= UDP:C:\program files\limewire\limewire.exe:LimeWire
"UDP Query User{AF284A7D-E71A-48F4-B94C-8DD545916604}C:\\program files\\limewire\\limewire.exe"= TCP:C:\program files\limewire\limewire.exe:LimeWire

R1 SASDIFSV;SASDIFSV;C:\Program Files\SUPERAntiSpyware\sasdifsv.sys [8/5/2009 4:06:28 PM 9968]
R1 SASKUTIL;SASKUTIL;C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS [8/5/2009 4:06:28 PM 74480]
R2 AntiVirMailService;Avira AntiVir MailGuard;C:\Program Files\Avira\AntiVir Desktop\avmailc.exe [8/15/2009 12:17:33 PM 194817]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;C:\Program Files\Avira\AntiVir Desktop\sched.exe [8/15/2009 12:17:33 PM 108289]
R2 AntiVirWebService;Avira AntiVir WebGuard;C:\Program Files\Avira\AntiVir Desktop\avwebgrd.exe [8/15/2009 12:17:33 PM 434945]
R2 ConfigFree Service;ConfigFree Service;C:\Program Files\Toshiba\ConfigFree\CFSvcs.exe [4/17/2008 12:19:48 AM 40960]
R2 TMachInfo;TMachInfo;C:\Program Files\Toshiba\TOSHIBA Service Station\TMachInfo.exe [8/18/2008 10:58:50 AM 46392]
R2 TOSHIBA SMART Log Service;TOSHIBA SMART Log Service;C:\Program Files\Toshiba\SMARTLogService\TosIPCSrv.exe [12/3/2007 5:03:52 PM 126976]
R2 Viewpoint Manager Service;Viewpoint Manager Service;C:\Program Files\Viewpoint\Common\ViewpointService.exe [8/14/2009 8:43:41 PM 24652]
R3 FwLnk;FwLnk Driver;C:\Windows\System32\drivers\FwLnk.sys [8/18/2008 10:48:17 AM 7168]
R3 RTL8187B;Realtek RTL8187B Wireless 802.11b/g 54Mbps USB 2.0 Network Adapter;C:\Windows\System32\drivers\rtl8187B.sys [7/1/2009 11:47:22 AM 290304]
R3 SASENUM;SASENUM;C:\Program Files\SUPERAntiSpyware\SASENUM.SYS [8/5/2009 4:06:30 PM 7408]
R3 SmartFaceVWatchSrv;SmartFaceVWatchSrv;C:\Program Files\Toshiba\SmartFaceV\SmartFaceVWatchSrv.exe [4/24/2008 6:35:46 PM 73728]
S3 GoogleDesktopManager-022208-143751;Google Desktop Manager 5.7.802.22438;C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe [8/21/2008 11:31:36 AM 29744]
S3 SVRPEDRV;SVRPEDRV;C:\Windows\System32\sysprep\PEDRV.SYS [8/21/2008 1:18:57 PM 9216]
.
.

crackbaby
Intermediate
Intermediate

Posts Posts : 62
Joined Joined : 2008-11-24
OS OS : Windows XP/ Vista
Points Points : 29499
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Rootkit/tr crypt?

Post by crackbaby on 16th August 2009, 3:20 am

------- Supplementary Scan -------
.
uStart Page = [You must be registered and logged in to see this link.]
mStart Page = [You must be registered and logged in to see this link.]
uInternet Settings,ProxyOverride = *.local
LSP: C:\Program Files\Avira\AntiVir Desktop\avsda.dll
FF - ProfilePath - C:\Users\Andrew\AppData\Roaming\Mozilla\Firefox\Profiles\m7p9ug83.default\

---- FIREFOX POLICIES ----
C:\Program Files\Mozilla Firefox\greprefs\all.js - pref("media.enforce_same_site_origin", false);
C:\Program Files\Mozilla Firefox\greprefs\all.js - pref("media.cache_size", 51200);
C:\Program Files\Mozilla Firefox\greprefs\all.js - pref("media.ogg.enabled", true);
C:\Program Files\Mozilla Firefox\greprefs\all.js - pref("media.wave.enabled", true);
C:\Program Files\Mozilla Firefox\greprefs\all.js - pref("media.autoplay.enabled", true);
C:\Program Files\Mozilla Firefox\greprefs\all.js - pref("browser.urlbar.autocomplete.enabled", true);
C:\Program Files\Mozilla Firefox\greprefs\all.js - pref("capability.policy.mailnews.*.wholeText", "noAccess");
C:\Program Files\Mozilla Firefox\greprefs\all.js - pref("dom.storage.default_quota", 5120);
C:\Program Files\Mozilla Firefox\greprefs\all.js - pref("content.sink.event_probe_rate", 3);
C:\Program Files\Mozilla Firefox\greprefs\all.js - pref("network.http.prompt-temp-redirect", true);
C:\Program Files\Mozilla Firefox\greprefs\all.js - pref("layout.css.dpi", -1);
C:\Program Files\Mozilla Firefox\greprefs\all.js - pref("layout.css.devPixelsPerPx", -1);
C:\Program Files\Mozilla Firefox\greprefs\all.js - pref("gestures.enable_single_finger_input", true);
C:\Program Files\Mozilla Firefox\greprefs\all.js - pref("dom.max_chrome_script_run_time", 0);
C:\Program Files\Mozilla Firefox\greprefs\all.js - pref("network.tcp.sendbuffer", 131072);
C:\Program Files\Mozilla Firefox\greprefs\all.js - pref("geo.enabled", true);
C:\Program Files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.remember_cert_checkbox_default_setting", true);
C:\Program Files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr", "moz35");
C:\Program Files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-cjkt", "moz35");
C:\Program Files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.blocklist.level", 2);
C:\Program Files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.urlbar.restrict.typed", "~");
C:\Program Files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.urlbar.default.behavior", 0);
C:\Program Files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.history", true);
C:\Program Files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.formdata", true);
C:\Program Files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.passwords", false);
C:\Program Files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.downloads", true);
C:\Program Files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cookies", true);
C:\Program Files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cache", true);
C:\Program Files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.sessions", true);
C:\Program Files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.offlineApps", false);
C:\Program Files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.siteSettings", false);
C:\Program Files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.history", true);
C:\Program Files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.formdata", true);
C:\Program Files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.passwords", false);
C:\Program Files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.downloads", true);
C:\Program Files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.cookies", true);
C:\Program Files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.cache", true);
C:\Program Files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.sessions", true);
C:\Program Files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.offlineApps", false);
C:\Program Files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.siteSettings", false);
C:\Program Files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.sanitize.migrateFx3Prefs", false);
C:\Program Files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.ssl_override_behavior", 2);
C:\Program Files\Mozilla Firefox\defaults\pref\firefox.js - pref("security.alternate_certificate_error_page", "certerror");
C:\Program Files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.autostart", false);
C:\Program Files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.dont_prompt_on_enter", false);
C:\Program Files\Mozilla Firefox\defaults\pref\firefox.js - pref("geo.wifi.uri", "https://www.google.com/loc/json");
.

crackbaby
Intermediate
Intermediate

Posts Posts : 62
Joined Joined : 2008-11-24
OS OS : Windows XP/ Vista
Points Points : 29499
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Rootkit/tr crypt?

Post by Belahzur on 16th August 2009, 7:31 pm

Click Start > Run and copy/paste the following bolded text into the Run box and click OK:

ComboFix /u



This will also reset your restore points.

How is the machine running now?


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34918
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : 7 Home Premium x64
Points Points : 245101
# Likes # Likes : 1

View user profile

Back to top Go down

Re: Rootkit/tr crypt?

Post by crackbaby on 16th August 2009, 7:36 pm

When I put in the command in Search, it says Combo-Fix.exe is unrecognizable.

crackbaby
Intermediate
Intermediate

Posts Posts : 62
Joined Joined : 2008-11-24
OS OS : Windows XP/ Vista
Points Points : 29499
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Rootkit/tr crypt?

Post by Belahzur on 16th August 2009, 9:13 pm

Hello.

  • Open HijackThis.
  • When Hijack This opens, click "Open the Misc Tools section"
  • Then select "Open Uninstall Manager"
  • Click on "Save List..." (generates uninstall_list.txt)
  • Click Save, copy and paste the results in your next post.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34918
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : 7 Home Premium x64
Points Points : 245101
# Likes # Likes : 1

View user profile

Back to top Go down

Re: Rootkit/tr crypt?

Post by crackbaby on 16th August 2009, 10:52 pm

7-Zip 4.65
Adobe Flash Player 10 Plugin
Adobe Flash Player 9 ActiveX
Adobe Flash Player ActiveX
Adobe Reader 8.1.2
AIM 6
Apple Mobile Device Support
Apple Software Update
Avira AntiVir Premium
Bonjour
Camera Assistant Software for Toshiba
CCleaner (remove only)
CD/DVD Drive Acoustic Silencer
Counter-Strike
DVD MovieFactory for TOSHIBA
Google Desktop
HijackThis 2.0.2
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
Intel(R) Graphics Media Accelerator Driver
Intel® Matrix Storage Manager
iTunes
Java(TM) 6 Update 6
LimeWire PRO 5.1.1
Microsoft .NET Framework 3.5 SP1
Microsoft .NET Framework 3.5 SP1
Microsoft Office PowerPoint Viewer 2007 (English)
Microsoft Office Suite Activation Assistant
Microsoft VC9 runtime libraries
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft Works
Mozilla Firefox (3.5.2)
MSXML 4.0 SP2 (KB941833)
MSXML 4.0 SP2 (KB954430)
ooVoo
Pando Media Booster
QuickTime
Realtek 8169 8168 8101E 8102E Ethernet Driver
Realtek High Definition Audio Driver
REALTEK RTL8187B Wireless LAN Driver
Realtek USB 2.0 Card Reader
Realtek WiFi Protected Setup Library
Security Update for Windows Media Encoder (KB954156)
Steam
Synaptics Pointing Device Driver
TOSHIBA Assist
TOSHIBA Disc Creator
TOSHIBA DVD PLAYER
TOSHIBA Extended Tiles for Windows Mobility Center
TOSHIBA Face Recognition
TOSHIBA Face Recognition
TOSHIBA Hardware Setup
TOSHIBA Recovery Disc Creator
TOSHIBA Service Station
TOSHIBA Software Modem
TOSHIBA Speech System Applications
TOSHIBA Speech System SR Engine(U.S.) Version1.0
TOSHIBA Speech System TTS Engine(U.S.) Version1.0
TOSHIBA Supervisor Password
TOSHIBA Value Added Package
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Windows Media Encoder 9 Series
Windows Media Encoder 9 Series

crackbaby
Intermediate
Intermediate

Posts Posts : 62
Joined Joined : 2008-11-24
OS OS : Windows XP/ Vista
Points Points : 29499
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Rootkit/tr crypt?

Post by Belahzur on 17th August 2009, 1:58 pm

Hello.

I see that you are running Limewire.
P2P(Peer to peer) applications are designed to help you easily share and distribute files between you and a group of people. But they can also be used to distribute malware, and thus are not considered safe.
The removal of these programs is optional, but highly recommended.

  • Click Start >> Control Panel.
  • Under the Programs click Uninstall a Program
  • Highlight the following:

    Adobe Reader 8.1.2
    Java(TM) 6 Update 6
    LimeWire PRO 5.1.1

  • Click on the Uninstall/Change button at the top.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34918
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : 7 Home Premium x64
Points Points : 245101
# Likes # Likes : 1

View user profile

Back to top Go down

Re: Rootkit/tr crypt?

Post by crackbaby on 17th August 2009, 5:54 pm

Anything close to Limewire that is safer?

crackbaby
Intermediate
Intermediate

Posts Posts : 62
Joined Joined : 2008-11-24
OS OS : Windows XP/ Vista
Points Points : 29499
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Rootkit/tr crypt?

Post by Belahzur on 17th August 2009, 9:33 pm

Not really.
All P2P like Limewire or Frostwire or other P2P clients that involve file sharing are dangerous, who know if what you were downloading was infected, that's why P2P is one of the biggest sources for getting infected.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34918
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : 7 Home Premium x64
Points Points : 245101
# Likes # Likes : 1

View user profile

Back to top Go down

Re: Rootkit/tr crypt?

Post by crackbaby on 19th August 2009, 6:46 am

I am wondering why my CPU usage is so high on Vista can you explain?

crackbaby
Intermediate
Intermediate

Posts Posts : 62
Joined Joined : 2008-11-24
OS OS : Windows XP/ Vista
Points Points : 29499
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Rootkit/tr crypt?

Post by Belahzur on 19th August 2009, 6:50 pm

You have a lot of junk running at startup.

Post a new Hijack This log and we'll stop some of the un-needed things and take some stress off the processor.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34918
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : 7 Home Premium x64
Points Points : 245101
# Likes # Likes : 1

View user profile

Back to top Go down

View previous topic View next topic Back to top


 
Permissions in this forum:
You cannot reply to topics in this forum