Definately need some help

View previous topic View next topic Go down

Definately need some help

Post by rappcon on Sun Oct 11, 2009 2:51 pm

Hi,

I just found your web site. I'm trying to help a neighbor with recovering her PC. Appears to have been infected by a nasty virus. Just so you know, I have already run the Malwarebytes program and removed a number of infected things. I did this before finding your site. The Malware program appears to come up clean, but something is running in the background and turning off regedit access, etc.

Removed acrobat.
Updated java to latest.
Can't update windows. Automatic updates are disabled at this point.

Here's the hijack log. Thanks for the help:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:40:09 PM, on 10/11/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Avira\AntiVir Desktop\avmailc.exe
C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\QuickTime\qttask.exe
C:\iTunes\iTunesHelper.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\WgaTray.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = [You must be registered and logged in to see this link.]
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = [You must be registered and logged in to see this link.]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = [You must be registered and logged in to see this link.]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = [You must be registered and logged in to see this link.]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = [You must be registered and logged in to see this link.]
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = [You must be registered and logged in to see this link.]
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R3 - URLSearchHook: (no name) - - (no file)
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
R3 - URLSearchHook: (no name) - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - (no file)
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
O3 - Toolbar: ALOT Toolbar - {5AA2BA46-9913-4dc7-9620-69AB0FA17AE7} - C:\Program Files\alot\bin\alot.dll (file missing)
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O3 - Toolbar: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [IntelMeM] C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKUS\S-1-5-18\..\Run: [Login Software 2009] C:\WINDOWS\TEMP\jkgbtcqju5.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [Yjafosi8kdf98winmdkmnkmfnwe] C:\WINDOWS\TEMP\869381508.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Login Software 2009] C:\WINDOWS\TEMP\jkgbtcqju5.exe (User 'Default user')
O8 - Extra context menu item: E&xport to Microsoft Excel - [You must be registered and logged in to see this link.]
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - [You must be registered and logged in to see this link.]
O16 - DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539} (Crucial cpcScan) - [You must be registered and logged in to see this link.]
O18 - Filter hijack: text/html - {47947b96-67db-4007-a625-b19be65374d1} - (no file)
O20 - AppInit_DLLs: c:\windows\system32\fofikeye.dll riyakuge.dll c:\windows\system32\fawuruvo.dll
O21 - SSODL: wozosupoh - {3520c932-6708-4cb8-aa60-174bc24b9e43} - (no file)
O21 - SSODL: liyelewin - {16ef2a49-0ce0-45bf-be46-98853d5880b0} - c:\windows\system32\fawuruvo.dll (file missing)
O22 - SharedTaskScheduler: jugezatag - {3520c932-6708-4cb8-aa60-174bc24b9e43} - (no file)
O22 - SharedTaskScheduler: gahurihor - {16ef2a49-0ce0-45bf-be46-98853d5880b0} - c:\windows\system32\fawuruvo.dll (file missing)
O23 - Service: Avira AntiVir MailGuard (AntiVirMailService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avmailc.exe
O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Avira AntiVir WebGuard (AntiVirWebService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE
O23 - Service: Background Intelligent Transfer Service (BITS) - Unknown owner - C:\WINDOWS\
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: McAfee SiteAdvisor Service - Unknown owner - C:\Program Files\McAfee\SiteAdvisor\McSACore.exe (file missing)
O23 - Service: McAfee Services (mcmscsvc) - Unknown owner - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe (file missing)
O23 - Service: McAfee Network Agent (McNASvc) - Unknown owner - c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe (file missing)
O23 - Service: McAfee Scanner (McODS) - Unknown owner - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe (file missing)
O23 - Service: McAfee Proxy Service (McProxy) - Unknown owner - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe (file missing)
O23 - Service: McAfee SystemGuards (McSysmon) - Unknown owner - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe (file missing)
O23 - Service: McAfee Personal Firewall Service (MpfService) - Unknown owner - C:\Program Files\McAfee\MPF\MPFSrv.exe (file missing)
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe

--
End of file - 9205 bytes

rappcon
Novice
Novice

Posts Posts : 17
Joined Joined : 2009-10-11
OS OS : xp, vista
Points Points : 26247
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Definately need some help

Post by Belahzur on Sun Oct 11, 2009 5:10 pm

Hello.

Completely Uninstall McAfee software

Download the [You must be registered and logged in to see this link.]

Using McAfee Consumer Product Removal Tool
Double click the MCPR.exe
A Command Line window will be displayed, and then close automatically.
Wait for a second Command Line window to be displayed. Note: Do not double-click MCPR.exe again, you may have to wait up to 1 minute for the next window to appear.
After the second window appears, the program will begin the cleanup.
Observe the installation, which could take several minutes. The following message will be displayed in the Command Line window: The machine must reboot to complete the un-installation. Reboot now? [y.n]
Press Y on the keyboard.
Wait for the computer to restart.
All McAfee products are now removed from your computer.




  • Open HijackThis
  • Choose "Do a system scan only"
  • Check the boxes in front of these lines:


    R3 - URLSearchHook: (no name) - - (no file)
    R3 - URLSearchHook: (no name) - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - (no file)
    O3 - Toolbar: ALOT Toolbar - {5AA2BA46-9913-4dc7-9620-69AB0FA17AE7} - C:\Program Files\alot\bin\alot.dll (file missing)
    O3 - Toolbar: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
    O4 - HKUS\S-1-5-18\..\Run: [Login Software 2009] C:\WINDOWS\TEMP\jkgbtcqju5.exe (User 'SYSTEM')
    O4 - HKUS\S-1-5-18\..\Run: [Yjafosi8kdf98winmdkmnkmfnwe] C:\WINDOWS\TEMP\869381508.exe (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [Login Software 2009] C:\WINDOWS\TEMP\jkgbtcqju5.exe (User 'Default user')
    O18 - Filter hijack: text/html - {47947b96-67db-4007-a625-b19be65374d1} - (no file)
    O20 - AppInit_DLLs: c:\windows\system32\fofikeye.dll riyakuge.dll c:\windows\system32\fawuruvo.dll
    O21 - SSODL: wozosupoh - {3520c932-6708-4cb8-aa60-174bc24b9e43} - (no file)
    O21 - SSODL: liyelewin - {16ef2a49-0ce0-45bf-be46-98853d5880b0} - c:\windows\system32\fawuruvo.dll (file missing)
    O22 - SharedTaskScheduler: jugezatag - {3520c932-6708-4cb8-aa60-174bc24b9e43} - (no file)
    O22 - SharedTaskScheduler: gahurihor - {16ef2a49-0ce0-45bf-be46-98853d5880b0} - c:\windows\system32\fawuruvo.dll (file missing)


  • Press "Fix Checked"
  • Close Hijack This.

Please download and run this tool.

Download Malwarebytes' Anti-Malware from [You must be registered and logged in to see this link.]

Double Click mbam-setup.exe to install the application.

  • Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select "Perform Quick Scan", then click Scan.
  • The scan may take some time to finish,so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected.
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Note:
If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts.
Click OK to either and let MBAM proceed with the disinfection process.
If asked to restart the computer, please do so immediately.


Post the contents of the MBAM Log.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34917
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : XP SP3 Media Centre
Points Points : 245080
# Likes # Likes : 1

View user profile

Back to top Go down

Re: Definately need some help

Post by rappcon on Sun Oct 11, 2009 10:46 pm

Here's the malware log:
Malwarebytes' Anti-Malware 1.41
Database version: 2943
Windows 5.1.2600 Service Pack 3

10/11/2009 9:15:26 PM
mbam-log-2009-10-11 (21-15-26).txt

Scan type: Quick Scan
Objects scanned: 129955
Time elapsed: 13 minute(s), 58 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 1
Registry Values Infected: 0
Registry Data Items Infected: 2
Folders Infected: 0
Files Infected: 7

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\AGprotect (Malware.Trace) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\BITS\ImagePath (Hijack.WindowsUpdates) -> Bad: (%fystemRoot%\system32\svchost.exe -k netsvcs) Good: (%SystemRoot%\System32\svchost.exe -k netsvcs) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\wuauserv\ImagePath (Hijack.WindowsUpdates) -> Bad: (%fystemroot%\system32\svchost.exe -k netsvcs) Good: (%SystemRoot%\System32\svchost.exe -k netsvcs) -> Quarantined and deleted successfully.

Folders Infected:
(No malicious items detected)

Files Infected:
C:\31.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\8A.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\8B.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\8C.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\8D.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\8E.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\8F.tmp (Trojan.Agent) -> Quarantined and deleted successfully.

rappcon
Novice
Novice

Posts Posts : 17
Joined Joined : 2009-10-11
OS OS : xp, vista
Points Points : 26247
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Definately need some help

Post by rappcon on Sun Oct 11, 2009 11:39 pm

I ran the malware program a second time and it found these errors. Should it run clean now?

Malwarebytes' Anti-Malware 1.41
Database version: 2943
Windows 5.1.2600 Service Pack 3

10/11/2009 10:03:43 PM
mbam-log-2009-10-11 (22-03-43).txt

Scan type: Quick Scan
Objects scanned: 130248
Time elapsed: 11 minute(s), 7 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 1
Registry Values Infected: 0
Registry Data Items Infected: 2
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\AGprotect (Malware.Trace) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\BITS\ImagePath (Hijack.WindowsUpdates) -> Bad: (%fystemRoot%\system32\svchost.exe -k netsvcs) Good: (%SystemRoot%\System32\svchost.exe -k netsvcs) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\wuauserv\ImagePath (Hijack.WindowsUpdates) -> Bad: (%fystemroot%\system32\svchost.exe -k netsvcs) Good: (%SystemRoot%\System32\svchost.exe -k netsvcs) -> Quarantined and deleted successfully.

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)



Also can you recommend a virus program for my neighbor? I've looked at:
AVG
Avira
Microsoft Essentials.

Thanks for your help,
Rob

rappcon
Novice
Novice

Posts Posts : 17
Joined Joined : 2009-10-11
OS OS : xp, vista
Points Points : 26247
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Definately need some help

Post by Belahzur on Mon Oct 12, 2009 6:21 am


  • Download combofix from here
    [You must be registered and logged in to see this link.]
    [You must be registered and logged in to see this link.]

    1. If you are using Firefox, make sure that your download settings are as follows:

    * Tools->Options->Main tab
    * Set to "Always ask me where to Save the files".

    2. During the download, rename Combofix to svchost as follows:





    3. It is important you rename Combofix during the download, but not after.
    4. Please do not rename Combofix to other names, but only to the one indicated.
    5. Close any open browsers.
    6. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

  • We need to disable your local AV (Anti-virus) before running Combofix.
  • See [You must be registered and logged in to see this link.] for how to disable your AV.
  • Double click on ComboFix.exe.
  • Follow the prompts. NOTE:
  • ComboFix will check to see if the Microsoft Windows Recovery Console is installed.
    ***It's strongly recommended to have the Recovery Console installed before doing any malware removal.***

    **Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will automatically proceed with its scan.


  • The Recovery Console provides a recovery/repair mode should a problem occur during a Combofix run.



  • Allow ComboFix to download the Recovery Console.
  • Accept the End-User License Agreement.
  • The Recovery Console will be installed.
  • You will then get this next prompt that asks if you want to continue the malware scan, select yes



  • Allow combofix to run
  • Post C:\combofix.txt back here.

    Note:
    Do not mouseclick combofix's window whilst it's running. That may cause it to stall.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34917
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : XP SP3 Media Centre
Points Points : 245080
# Likes # Likes : 1

View user profile

Back to top Go down

Re: Definately need some help

Post by rappcon on Mon Oct 12, 2009 3:26 pm

Ok here's the ComboFix log:

ComboFix 09-10-11.03 - carol 10/12/2009 14:11.2.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.510.302 [GMT -5:00]
Running from: c:\documents and settings\carol\Desktop\ComboFix.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\ntos.exe
c:\windows\system32\wsnpoem
c:\windows\system32\wsnpoem\audio.dll
c:\windows\system32\wsnpoem\video.dll
c:\windows\Temp\64628996.exe

c:\windows\system32\drivers\ndis.sys . . . is infected!!

.
((((((((((((((((((((((((( Files Created from 2009-09-12 to 2009-10-12 )))))))))))))))))))))))))))))))
.

2009-10-12 18:59 . 2009-10-01 15:29 195440 ------w- c:\windows\system32\MpSigStub.exe
2009-10-11 17:34 . 2009-10-11 17:34 -------- d-----w- c:\documents and settings\Administrator\Application Data\Malwarebytes
2009-10-08 21:34 . 2009-10-08 21:34 -------- d-----w- c:\documents and settings\Christina\Application Data\Malwarebytes
2009-10-03 19:14 . 2009-10-03 19:14 19024 ----a-w- c:\documents and settings\LocalService\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-10-03 18:11 . 2009-10-03 18:09 55656 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2009-10-03 17:54 . 2009-10-03 17:54 -------- d-----w- c:\program files\Windows Defender
2009-09-29 01:19 . 2009-09-29 01:19 -------- d-----w- c:\documents and settings\LocalService\Application Data\Malwarebytes
2009-09-29 01:17 . 2009-09-29 01:17 -------- d-----w- c:\documents and settings\Brandon\Application Data\Malwarebytes
2009-09-29 00:31 . 2009-09-29 00:31 -------- d-----w- c:\documents and settings\carol\Application Data\Malwarebytes
2009-09-29 00:31 . 2009-09-10 19:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-09-29 00:31 . 2009-09-29 00:31 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-09-29 00:31 . 2009-09-29 00:31 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-09-29 00:31 . 2009-09-10 19:53 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-09-29 00:08 . 2009-09-29 00:08 -------- d-----w- c:\program files\Trend Micro
2009-09-27 22:34 . 2009-09-27 22:43 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-09-27 20:52 . 2009-09-27 20:52 15605 ----a-w- c:\windows\adisyrutef.dat
2009-09-27 20:51 . 2009-09-27 20:51 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\BVRP Software
2009-09-27 19:52 . 2009-09-27 19:52 -------- d-s---w- c:\documents and settings\Administrator\UserData
2009-09-27 19:33 . 2009-09-27 19:33 212224 ----a-w- c:\windows\system32\dllcache\ndis.sys
2009-09-26 02:26 . 2009-09-26 02:26 13095 ----a-w- c:\windows\polipytym.com
2009-09-26 02:12 . 2009-09-27 19:12 0 ----a-w- c:\windows\system32\drivers\9bfaaad6.sys
2009-09-26 00:01 . 2009-09-26 02:14 108 ----a-w- c:\windows\system32\temp32.bat

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-10-12 18:02 . 2009-10-12 18:02 38 ----a-w- C:\8D.tmp
2009-10-12 18:02 . 2009-10-12 18:02 64000 ----a-w- C:\8A.tmp
2009-10-12 17:30 . 2009-10-12 17:30 38 ----a-w- C:\8B.tmp
2009-10-12 17:30 . 2009-10-12 17:30 64000 ----a-w- C:\31.tmp
2009-10-11 18:37 . 2005-08-17 02:30 -------- d-----w- c:\program files\Java
2009-10-11 18:36 . 2009-07-15 02:10 411368 ----a-w- c:\windows\system32\deploytk.dll
2009-10-09 03:57 . 2009-10-09 03:57 38 ----a-w- C:\2A.tmp
2009-10-09 00:02 . 2007-10-25 02:36 19024 -c--a-w- c:\documents and settings\Christina\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-10-08 23:01 . 2009-10-08 23:01 38 ----a-w- C:\21.tmp
2009-10-08 21:31 . 2009-10-08 21:31 38 ----a-w- C:\1B.tmp
2009-10-05 04:15 . 2009-10-05 04:15 38 ----a-w- C:\19.tmp
2009-10-05 01:03 . 2009-10-05 01:03 38 ----a-w- C:\14.tmp
2009-10-04 21:01 . 2006-01-23 22:39 -------- d-----w- c:\documents and settings\carol\Application Data\AdobeUM
2009-10-04 20:55 . 2009-10-04 20:55 38 ----a-w- C:\10.tmp
2009-10-04 17:49 . 2009-10-04 17:49 38 ----a-w- C:\18.tmp
2009-10-04 05:02 . 2009-10-04 05:02 38 ----a-w- C:\12.tmp
2009-10-04 04:05 . 2009-10-04 04:05 38 ----a-w- C:\F.tmp
2009-10-03 20:44 . 2009-10-03 20:44 38 ----a-w- C:\9.tmp
2009-10-03 19:13 . 2009-10-03 19:13 38 ----a-w- C:\D.tmp
2009-10-03 19:08 . 2009-10-03 19:08 38 ----a-w- C:\B.tmp
2009-10-03 19:05 . 2009-10-03 19:05 38 ----a-w- C:\7.tmp
2009-10-03 18:23 . 2009-10-03 18:23 38 ----a-w- C:\3E.tmp
2009-10-03 18:15 . 2009-10-03 18:15 38 ----a-w- C:\3C.tmp
2009-10-03 18:08 . 2009-10-03 18:08 38 ----a-w- C:\3A.tmp
2009-10-03 17:54 . 2009-10-03 17:54 38 ----a-w- C:\38.tmp
2009-10-03 17:40 . 2009-10-03 17:40 38 ----a-w- C:\36.tmp
2009-10-03 04:50 . 2009-10-03 04:50 38 ----a-w- C:\34.tmp
2009-10-03 01:33 . 2009-10-03 01:33 38 ----a-w- C:\32.tmp
2009-10-02 01:31 . 2009-10-02 01:31 38 ----a-w- C:\2F.tmp
2009-10-01 21:27 . 2009-10-01 21:27 38 ----a-w- C:\2D.tmp
2009-10-01 20:03 . 2009-10-01 20:03 38 ----a-w- C:\2B.tmp
2009-10-01 17:14 . 2009-10-01 17:14 38 ----a-w- C:\29.tmp
2009-10-01 02:48 . 2009-10-01 02:48 38 ----a-w- C:\27.tmp
2009-09-30 21:14 . 2009-09-30 21:14 38 ----a-w- C:\24.tmp
2009-09-30 20:14 . 2009-09-30 20:14 38 ----a-w- C:\23.tmp
2009-09-30 17:33 . 2009-09-30 17:33 38 ----a-w- C:\22.tmp
2009-09-30 00:02 . 2009-09-30 00:02 38 ----a-w- C:\1F.tmp
2009-09-29 23:35 . 2009-09-29 23:35 38 ----a-w- C:\26.tmp
2009-09-29 22:03 . 2009-09-29 22:03 38 ----a-w- C:\1C.tmp
2009-09-29 21:27 . 2009-09-29 21:27 38 ----a-w- C:\1A.tmp
2009-09-29 03:03 . 2009-09-29 03:03 38 ----a-w- C:\17.tmp
2009-09-29 02:14 . 2006-12-19 00:31 19024 -c--a-w- c:\documents and settings\Brandon\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-09-29 01:17 . 2009-09-29 01:17 38 ----a-w- C:\15.tmp
2009-09-29 01:12 . 2009-09-29 01:12 38 ----a-w- C:\13.tmp
2009-09-29 00:40 . 2009-09-29 00:40 38 ----a-w- C:\11.tmp
2009-09-29 00:39 . 2009-09-29 00:39 38 ----a-w- C:\E.tmp
2009-09-29 00:21 . 2009-09-29 00:21 38 ----a-w- C:\C.tmp
2009-09-29 00:15 . 2009-09-29 00:15 38 ----a-w- C:\A.tmp
2009-09-27 22:37 . 2009-09-27 22:37 38 ----a-w- C:\8.tmp
2009-09-27 20:57 . 2009-09-27 20:57 14539 ----a-w- c:\program files\Common Files\mewucyxe._sy
2009-09-27 20:57 . 2009-09-27 20:57 10028 ----a-w- c:\documents and settings\Administrator\Application Data\epahy.dat
2009-09-27 20:52 . 2009-09-27 20:52 18236 ----a-w- c:\documents and settings\All Users\Application Data\ilyz.dat
2009-09-27 19:52 . 2006-11-29 01:12 1324 ----a-w- c:\windows\system32\d3d9caps.dat
2009-09-27 19:50 . 2009-09-27 19:50 38 ----a-w- C:\6.tmp
2009-09-27 19:33 . 2004-08-10 17:51 212224 ----a-w- c:\windows\system32\drivers\ndis.sys
2009-09-16 18:56 . 2006-08-05 17:44 -------- d-----w- c:\documents and settings\Brandon\Application Data\AdobeUM
2009-09-14 19:50 . 2009-03-06 00:30 -------- d-----w- c:\documents and settings\LocalService\Application Data\SACore
2009-09-01 21:09 . 2005-10-12 20:48 19024 -c--a-w- c:\documents and settings\carol\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-08-22 21:54 . 2006-11-22 22:43 -------- d-----w- c:\documents and settings\Christina\Application Data\AdobeUM
2009-08-18 16:45 . 2005-08-17 02:37 -------- d-----w- c:\program files\Common Files\AOL
2009-08-17 01:57 . 2005-08-17 02:32 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-08-17 01:56 . 2008-12-27 03:42 -------- d-----w- c:\documents and settings\Christina\Application Data\FUJIFILM
2009-08-14 22:40 . 2009-08-14 22:40 -------- d-----w- c:\documents and settings\Christina\Application Data\acccore
2009-08-14 22:40 . 2009-08-14 22:37 -------- d-----w- c:\documents and settings\All Users\Application Data\AOL OCP
2009-08-14 22:38 . 2009-08-14 22:38 -------- d-----w- c:\program files\Viewpoint
2009-08-14 22:38 . 2005-08-17 02:39 -------- d-----w- c:\documents and settings\All Users\Application Data\Viewpoint
2009-08-14 22:38 . 2009-08-14 22:38 -------- d-----w- c:\documents and settings\All Users\Application Data\acccore
2009-08-14 22:37 . 2005-08-17 02:38 -------- d-----w- c:\documents and settings\All Users\Application Data\AOL
2009-08-05 09:01 . 2004-08-10 17:51 204800 ------w- c:\windows\system32\mswebdvd.dll
2009-07-17 19:01 . 2004-08-10 17:50 58880 ----a-w- c:\windows\system32\atl.dll
2009-04-22 00:49 . 2006-01-24 23:04 56 -csh--r- c:\windows\system32\B0CB720293.sys
.

------- Sigcheck -------

[7] 2004-08-04 . DA1F27D85E0D1525F6621372E7B685E9 . 4224 . . [5.1.2600.0] . . c:\windows\system32\dllcache\beep.sys

[-] 2009-09-27 19:33 . 3A668A0BEE89D008D6678578AF6B44B8 . 212224 . . [------] . . c:\windows\system32\dllcache\ndis.sys
[-] 2009-09-27 19:33 . 3A668A0BEE89D008D6678578AF6B44B8 . 212224 . . [------] . . c:\windows\system32\drivers\ndis.sys
[7] 2008-04-13 . 1DF7F42665C94B825322FAE71721130D . 182656 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\ndis.sys
[-] 2004-08-04 . 558635D3AF1C7546D26067D5D9B6959E . 182912 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\ndis.sys

[7] 2008-04-14 . 6D4FEB43EE538FC5428CC7F0565AA656 . 56320 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\eventlog.dll
[-] 2004-08-04 . 82B24CB70E5944E6E34662205A2A5B78 . 55808 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\eventlog.dll

c:\windows\system32\drivers\beep.sys ... is missing !!
c:\windows\system32\eventlog.dll ... is missing !!
.
((((((((((((((((((((((((((((( [You must be registered and logged in to see this link.] )))))))))))))))))))))))))))))))))))))))))
.
+ 2005-08-20 01:51 . 2009-10-12 19:06 65536 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
- 2005-08-20 01:51 . 2009-10-12 18:54 65536 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2005-08-20 01:51 . 2009-10-12 19:06 49152 c:\windows\system32\config\systemprofile\Cookies\index.dat
- 2005-08-20 01:51 . 2009-10-12 18:54 49152 c:\windows\system32\config\systemprofile\Cookies\index.dat
+ 2009-10-09 03:58 . 2009-10-12 19:06 311296 c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
- 2009-10-09 03:58 . 2009-10-12 18:54 311296 c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
+ 2009-07-16 22:11 . 2004-08-04 10:00 182912 c:\windows\$NtServicePackUninstall$\ndis.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-14 68856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2004-10-15 1404928]
"IntelMeM"="c:\program files\Intel\Modem Event Monitor\IntelMEM.exe" [2003-09-04 221184]
"dla"="c:\windows\system32\dla\tfswctrl.exe" [2004-12-06 127035]
"ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-27 221184]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2004-07-27 81920]
"igfxtray"="c:\windows\system32\igfxtray.exe" [2005-09-20 94208]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2005-09-20 77824]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2005-09-20 114688]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-11-04 413696]
"iTunesHelper"="c:\itunes\iTunesHelper.exe" [2008-11-20 290088]
"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2009-09-10 1312080]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2006-11-04 866584]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-10-11 149280]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoSetActiveDesktop"= 1 (0x1)
"NoActiveDesktopChanges"= 1 (0x1)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Kodak EasyShare software.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Kodak EasyShare software.lnk
backup=c:\windows\pss\Kodak EasyShare software.lnkCommon Startup

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Kodak\\Kodak EasyShare software\\bin\\EasyShare.exe"=
"c:\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\iPod\\bin\\iPodService.exe"=

R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [8/14/2009 5:38 PM 24652]
R2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [11/3/2006 7:19 PM 13592]
S1 9bfaaad6;9bfaaad6;c:\windows\system32\drivers\9bfaaad6.sys [9/25/2009 9:12 PM 0]
S2 gchanmpsnpzyiuy;gchanmpsnpzyiuy;\??\c:\windows\system32\drivers\dustyxcugjouar.sys --> c:\windows\system32\drivers\dustyxcugjouar.sys [?]
S2 wgmqjqkdpvmwycs;wgmqjqkdpvmwycs;\??\c:\windows\system32\drivers\ezxeihr.sys --> c:\windows\system32\drivers\ezxeihr.sys [?]
S2 ydwyduaczgcyl;ydwyduaczgcyl;\??\c:\windows\system32\drivers\jyguw.sys --> c:\windows\system32\drivers\jyguw.sys [?]
S3 W8100PCI;D-Link AirPlus G Wireless Driver;c:\windows\system32\drivers\MRV8K51.sys [8/19/2005 9:20 PM 297984]
.
Contents of the 'Scheduled Tasks' folder

2009-09-19 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 18:34]

2009-10-12 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Windows Defender\MpCmdRun.exe [2006-11-04 00:20]
.
.
------- Supplementary Scan -------
.
uStart Page = [You must be registered and logged in to see this link.]
mStart Page = [You must be registered and logged in to see this link.]
mSearch Bar = [You must be registered and logged in to see this link.]
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = [You must be registered and logged in to see this link.]
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, [You must be registered and logged in to see this link.]
Rootkit scan 2009-10-12 14:18
Windows 5.1.2600 Service Pack 3 NTFS

scanning hȋdden processes ...

scanning hȋdden autostart entries ...

scanning hȋdden files ...

scan completed successfully
hȋdden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(3620)
c:\windows\system32\hgib1pu5pt.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
c:\program files\Bonjour\mdnsNSP.dll
.
Completion time: 2009-10-12 14:21
ComboFix-quarantined-files.txt 2009-10-12 19:20

Pre-Run: 16,945,012,736 bytes free
Post-Run: 16,930,041,856 bytes free

Current=4 Default=4 Failed=3 LastKnownGood=5 Sets=1,2,3,4,5
223 --- E O F --- 2009-10-12 19:00

rappcon
Novice
Novice

Posts Posts : 17
Joined Joined : 2009-10-11
OS OS : xp, vista
Points Points : 26247
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Definately need some help

Post by Belahzur on Mon Oct 12, 2009 4:31 pm


  1. Close any open browsers.
  2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
  3. Open notepad and copy/paste the text in the quotebox below into it:

    KILLALL::

    File::
    c:\windows\system32\MpSigStub.exe
    c:\windows\adisyrutef.dat
    c:\windows\polipytym.com
    c:\windows\system32\drivers\9bfaaad6.sys
    c:\windows\system32\temp32.bat
    c:\program files\Common Files\mewucyxe._sy
    c:\documents and settings\Administrator\Application Data\epahy.dat
    c:\documents and settings\All Users\Application Data\ilyz.dat

    FCopy::
    c:\windows\system32\dllcache\beep.sys | c:\windows\system32\drivers\beep.sys
    c:\windows\$NtServicePackUninstall$\eventlog.dll | c:\windows\system32\eventlog.dll
    c:\windows\$NtServicePackUninstall$\ndis.sys | c:\windows\system32\dllcache\ndis.sys
    c:\windows\$NtServicePackUninstall$\ndis.sys | c:\windows\system32\drivers\ndis.sys

    Registry::
    [-HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]

    Driver::
    9bfaaad6
    gchanmpsnpzyiuy
    wgmqjqkdpvmwycs
    ydwyduaczgcyl
  4. Save this as CFScript.txt, in the same location as ComboFix.exe



  5. Referring to the picture above, drag CFScript into ComboFix.exe
  6. When finished, it shall produce a log for you at C:\ComboFix.txt
  7. Please post the contents of the log in your next reply.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34917
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : XP SP3 Media Centre
Points Points : 245080
# Likes # Likes : 1

View user profile

Back to top Go down

Re: Definately need some help

Post by rappcon on Mon Oct 12, 2009 5:22 pm

Next set of logs. Seems to be getting closer:
ComboFix 09-10-11.03 - carol 10/12/2009 16:05.3.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.510.233 [GMT -5:00]
Running from: c:\documents and settings\carol\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\carol\Desktop\CFScript.txt

FILE ::
"c:\documents and settings\Administrator\Application Data\epahy.dat"
"c:\documents and settings\All Users\Application Data\ilyz.dat"
"c:\program files\Common Files\mewucyxe._sy"
"c:\windows\adisyrutef.dat"
"c:\windows\polipytym.com"
"c:\windows\system32\drivers\9bfaaad6.sys"
"c:\windows\system32\MpSigStub.exe"
"c:\windows\system32\temp32.bat"
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\docume~1\carol\LOCALS~1\Temp\svchost.exe
c:\documents and settings\Administrator\Application Data\epahy.dat
c:\documents and settings\All Users\Application Data\ilyz.dat
c:\program files\Common Files\mewucyxe._sy
c:\windows\adisyrutef.dat
c:\windows\polipytym.com
c:\windows\system32\awkdhpkvrs.dll
c:\windows\system32\d9Z2s.dll
c:\windows\system32\drivers\9bfaaad6.sys
c:\windows\system32\hgib1pu5pt.dll
c:\windows\system32\MpSigStub.exe
c:\windows\system32\ntos.exe
c:\windows\system32\temp32.bat
c:\windows\system32\wsnpoem
c:\windows\system32\wsnpoem\audio.dll
c:\windows\system32\wsnpoem\video.dll
c:\windows\temp\3450588306.exe
c:\windows\temp\470697312.exe

c:\windows\system32\drivers\ndis.sys . . . is infected!!

.
--------------- FCopy ---------------

c:\windows\system32\dllcache\beep.sys --> c:\windows\system32\drivers\beep.sys
c:\windows\$NtServicePackUninstall$\eventlog.dll --> c:\windows\system32\eventlog.dll
c:\windows\$NtServicePackUninstall$\ndis.sys --> c:\windows\system32\dllcache\ndis.sys
c:\windows\$NtServicePackUninstall$\ndis.sys --> c:\windows\system32\drivers\ndis.sys
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_gchanmpsnpzyiuy
-------\Legacy_WGMQJQKDPVMWYCS
-------\Legacy_YDWYDUACZGCYL
-------\Service_9bfaaad6
-------\Service_gchanmpsnpzyiuy
-------\Service_wgmqjqkdpvmwycs
-------\Service_ydwyduaczgcyl


((((((((((((((((((((((((( Files Created from 2009-09-12 to 2009-10-12 )))))))))))))))))))))))))))))))
.

2009-10-12 21:05 . 2004-08-04 10:00 55808 ----a-w- c:\windows\system32\eventlog.dll
2009-10-12 21:05 . 2004-08-04 10:00 4224 ----a-w- c:\windows\system32\drivers\beep.sys
2009-10-11 17:34 . 2009-10-11 17:34 -------- d-----w- c:\documents and settings\Administrator\Application Data\Malwarebytes
2009-10-08 21:34 . 2009-10-08 21:34 -------- d-----w- c:\documents and settings\Christina\Application Data\Malwarebytes
2009-10-03 19:14 . 2009-10-03 19:14 19024 ----a-w- c:\documents and settings\LocalService\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-10-03 18:11 . 2009-10-03 18:09 55656 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2009-10-03 17:54 . 2009-10-03 17:54 -------- d-----w- c:\program files\Windows Defender
2009-09-29 01:19 . 2009-09-29 01:19 -------- d-----w- c:\documents and settings\LocalService\Application Data\Malwarebytes
2009-09-29 01:17 . 2009-09-29 01:17 -------- d-----w- c:\documents and settings\Brandon\Application Data\Malwarebytes
2009-09-29 00:31 . 2009-09-29 00:31 -------- d-----w- c:\documents and settings\carol\Application Data\Malwarebytes
2009-09-29 00:31 . 2009-09-10 19:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-09-29 00:31 . 2009-09-29 00:31 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-09-29 00:31 . 2009-09-29 00:31 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-09-29 00:31 . 2009-09-10 19:53 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-09-29 00:08 . 2009-09-29 00:08 -------- d-----w- c:\program files\Trend Micro
2009-09-27 22:34 . 2009-09-27 22:43 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-09-27 20:51 . 2009-09-27 20:51 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\BVRP Software
2009-09-27 19:52 . 2009-09-27 19:52 -------- d-s---w- c:\documents and settings\Administrator\UserData
2009-09-27 19:33 . 2004-08-04 10:00 182912 ----a-w- c:\windows\system32\dllcache\ndis.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-10-12 20:58 . 2009-10-12 20:58 38 ----a-w- C:\1E.tmp
2009-10-12 20:58 . 2009-10-12 20:58 64000 ----a-w- C:\3.tmp
2009-10-12 19:35 . 2009-10-12 19:35 38 ----a-w- C:\4.tmp
2009-10-12 19:35 . 2009-10-12 19:35 64000 ----a-w- C:\2.tmp
2009-10-12 19:20 . 2009-10-12 19:20 38 ----a-w- C:\1D.tmp
2009-10-12 19:19 . 2009-10-12 19:19 64000 ----a-w- C:\5.tmp
2009-10-12 18:02 . 2009-10-12 18:02 38 ----a-w- C:\8D.tmp
2009-10-12 18:02 . 2009-10-12 18:02 64000 ----a-w- C:\8A.tmp
2009-10-12 17:30 . 2009-10-12 17:30 38 ----a-w- C:\8B.tmp
2009-10-12 17:30 . 2009-10-12 17:30 64000 ----a-w- C:\31.tmp
2009-10-11 18:37 . 2005-08-17 02:30 -------- d-----w- c:\program files\Java
2009-10-11 18:36 . 2009-07-15 02:10 411368 ----a-w- c:\windows\system32\deploytk.dll
2009-10-09 03:57 . 2009-10-09 03:57 38 ----a-w- C:\2A.tmp
2009-10-09 00:02 . 2007-10-25 02:36 19024 -c--a-w- c:\documents and settings\Christina\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-10-08 23:01 . 2009-10-08 23:01 38 ----a-w- C:\21.tmp
2009-10-08 21:31 . 2009-10-08 21:31 38 ----a-w- C:\1B.tmp
2009-10-05 04:15 . 2009-10-05 04:15 38 ----a-w- C:\19.tmp
2009-10-05 01:03 . 2009-10-05 01:03 38 ----a-w- C:\14.tmp
2009-10-04 21:01 . 2006-01-23 22:39 -------- d-----w- c:\documents and settings\carol\Application Data\AdobeUM
2009-10-04 20:55 . 2009-10-04 20:55 38 ----a-w- C:\10.tmp
2009-10-04 17:49 . 2009-10-04 17:49 38 ----a-w- C:\18.tmp
2009-10-04 05:02 . 2009-10-04 05:02 38 ----a-w- C:\12.tmp
2009-10-04 04:05 . 2009-10-04 04:05 38 ----a-w- C:\F.tmp
2009-10-03 20:44 . 2009-10-03 20:44 38 ----a-w- C:\9.tmp
2009-10-03 19:13 . 2009-10-03 19:13 38 ----a-w- C:\D.tmp
2009-10-03 19:08 . 2009-10-03 19:08 38 ----a-w- C:\B.tmp
2009-10-03 19:05 . 2009-10-03 19:05 38 ----a-w- C:\7.tmp
2009-10-03 18:23 . 2009-10-03 18:23 38 ----a-w- C:\3E.tmp
2009-10-03 18:15 . 2009-10-03 18:15 38 ----a-w- C:\3C.tmp
2009-10-03 18:08 . 2009-10-03 18:08 38 ----a-w- C:\3A.tmp
2009-10-03 17:54 . 2009-10-03 17:54 38 ----a-w- C:\38.tmp
2009-10-03 17:40 . 2009-10-03 17:40 38 ----a-w- C:\36.tmp
2009-10-03 04:50 . 2009-10-03 04:50 38 ----a-w- C:\34.tmp
2009-10-03 01:33 . 2009-10-03 01:33 38 ----a-w- C:\32.tmp
2009-10-02 01:31 . 2009-10-02 01:31 38 ----a-w- C:\2F.tmp
2009-10-01 21:27 . 2009-10-01 21:27 38 ----a-w- C:\2D.tmp
2009-10-01 20:03 . 2009-10-01 20:03 38 ----a-w- C:\2B.tmp
2009-10-01 17:14 . 2009-10-01 17:14 38 ----a-w- C:\29.tmp
2009-10-01 02:48 . 2009-10-01 02:48 38 ----a-w- C:\27.tmp
2009-09-30 21:14 . 2009-09-30 21:14 38 ----a-w- C:\24.tmp
2009-09-30 20:14 . 2009-09-30 20:14 38 ----a-w- C:\23.tmp
2009-09-30 17:33 . 2009-09-30 17:33 38 ----a-w- C:\22.tmp
2009-09-30 00:02 . 2009-09-30 00:02 38 ----a-w- C:\1F.tmp
2009-09-29 23:35 . 2009-09-29 23:35 38 ----a-w- C:\26.tmp
2009-09-29 22:03 . 2009-09-29 22:03 38 ----a-w- C:\1C.tmp
2009-09-29 21:27 . 2009-09-29 21:27 38 ----a-w- C:\1A.tmp
2009-09-29 03:03 . 2009-09-29 03:03 38 ----a-w- C:\17.tmp
2009-09-29 02:14 . 2006-12-19 00:31 19024 -c--a-w- c:\documents and settings\Brandon\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-09-29 01:17 . 2009-09-29 01:17 38 ----a-w- C:\15.tmp
2009-09-29 01:12 . 2009-09-29 01:12 38 ----a-w- C:\13.tmp
2009-09-29 00:40 . 2009-09-29 00:40 38 ----a-w- C:\11.tmp
2009-09-29 00:39 . 2009-09-29 00:39 38 ----a-w- C:\E.tmp
2009-09-29 00:21 . 2009-09-29 00:21 38 ----a-w- C:\C.tmp
2009-09-29 00:15 . 2009-09-29 00:15 38 ----a-w- C:\A.tmp
2009-09-27 22:37 . 2009-09-27 22:37 38 ----a-w- C:\8.tmp
2009-09-27 19:52 . 2006-11-29 01:12 1324 ----a-w- c:\windows\system32\d3d9caps.dat
2009-09-27 19:50 . 2009-09-27 19:50 38 ----a-w- C:\6.tmp
2009-09-16 18:56 . 2006-08-05 17:44 -------- d-----w- c:\documents and settings\Brandon\Application Data\AdobeUM
2009-09-14 19:50 . 2009-03-06 00:30 -------- d-----w- c:\documents and settings\LocalService\Application Data\SACore
2009-09-01 21:09 . 2005-10-12 20:48 19024 -c--a-w- c:\documents and settings\carol\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-08-22 21:54 . 2006-11-22 22:43 -------- d-----w- c:\documents and settings\Christina\Application Data\AdobeUM
2009-08-18 16:45 . 2005-08-17 02:37 -------- d-----w- c:\program files\Common Files\AOL
2009-08-17 01:57 . 2005-08-17 02:32 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-08-17 01:56 . 2008-12-27 03:42 -------- d-----w- c:\documents and settings\Christina\Application Data\FUJIFILM
2009-08-14 22:40 . 2009-08-14 22:40 -------- d-----w- c:\documents and settings\Christina\Application Data\acccore
2009-08-14 22:40 . 2009-08-14 22:37 -------- d-----w- c:\documents and settings\All Users\Application Data\AOL OCP
2009-08-14 22:38 . 2009-08-14 22:38 -------- d-----w- c:\program files\Viewpoint
2009-08-14 22:38 . 2005-08-17 02:39 -------- d-----w- c:\documents and settings\All Users\Application Data\Viewpoint
2009-08-14 22:38 . 2009-08-14 22:38 -------- d-----w- c:\documents and settings\All Users\Application Data\acccore
2009-08-14 22:37 . 2005-08-17 02:38 -------- d-----w- c:\documents and settings\All Users\Application Data\AOL
2009-08-05 09:01 . 2004-08-10 17:51 204800 ------w- c:\windows\system32\mswebdvd.dll
2009-07-17 19:01 . 2004-08-10 17:50 58880 ----a-w- c:\windows\system32\atl.dll
2009-04-22 00:49 . 2006-01-24 23:04 56 -csh--r- c:\windows\system32\B0CB720293.sys
.

------- Sigcheck -------

[7] 2008-04-13 . 1DF7F42665C94B825322FAE71721130D . 182656 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\ndis.sys
[-] 2004-08-04 . 558635D3AF1C7546D26067D5D9B6959E . 182912 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\ndis.sys
[-] 2004-08-04 . 558635D3AF1C7546D26067D5D9B6959E . 182912 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\ndis.sys
[-] 2004-08-04 . 558635D3AF1C7546D26067D5D9B6959E . 182912 . . [5.1.2600.2180] . . c:\windows\system32\drivers\ndis.sys

[7] 2008-04-14 . 6D4FEB43EE538FC5428CC7F0565AA656 . 56320 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\eventlog.dll
[-] 2004-08-04 . 82B24CB70E5944E6E34662205A2A5B78 . 55808 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\eventlog.dll
[-] 2004-08-04 . 82B24CB70E5944E6E34662205A2A5B78 . 55808 . . [5.1.2600.2180] . . c:\windows\system32\eventlog.dll
.
((((((((((((((((((((((((((((( [You must be registered and logged in to see this link.] )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-10-12 21:14 . 2009-10-12 21:14 16384 c:\windows\temp\Perflib_Perfdata_7e4.dat
+ 2009-10-12 17:32 . 2009-10-12 21:03 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012009101220091013\index.dat
- 2009-10-12 17:32 . 2009-10-12 18:20 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012009101220091013\index.dat
+ 2005-08-20 01:51 . 2009-10-12 21:03 81920 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2005-08-20 01:51 . 2009-10-12 21:03 49152 c:\windows\system32\config\systemprofile\Cookies\index.dat
- 2005-08-20 01:51 . 2009-10-12 18:54 49152 c:\windows\system32\config\systemprofile\Cookies\index.dat
+ 2009-10-09 03:58 . 2009-10-12 21:03 344064 c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
+ 2009-07-16 22:11 . 2004-08-04 10:00 182912 c:\windows\$NtServicePackUninstall$\ndis.sys
+ 2005-07-12 23:04 . 2008-03-20 23:06 1480232 c:\windows\system32\LegitCheckControl.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-14 68856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2004-10-15 1404928]
"IntelMeM"="c:\program files\Intel\Modem Event Monitor\IntelMEM.exe" [2003-09-04 221184]
"dla"="c:\windows\system32\dla\tfswctrl.exe" [2004-12-06 127035]
"ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-27 221184]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2004-07-27 81920]
"igfxtray"="c:\windows\system32\igfxtray.exe" [2005-09-20 94208]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2005-09-20 77824]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2005-09-20 114688]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-11-04 413696]
"iTunesHelper"="c:\itunes\iTunesHelper.exe" [2008-11-20 290088]
"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2009-09-10 1312080]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2006-11-04 866584]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-10-11 149280]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Kodak EasyShare software.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Kodak EasyShare software.lnk
backup=c:\windows\pss\Kodak EasyShare software.lnkCommon Startup

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Kodak\\Kodak EasyShare software\\bin\\EasyShare.exe"=
"c:\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\iPod\\bin\\iPodService.exe"=

R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [8/14/2009 5:38 PM 24652]
R2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [11/3/2006 7:19 PM 13592]
S3 W8100PCI;D-Link AirPlus G Wireless Driver;c:\windows\system32\drivers\MRV8K51.sys [8/19/2005 9:20 PM 297984]
.
Contents of the 'Scheduled Tasks' folder

2009-09-19 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 18:34]

2009-10-12 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Windows Defender\MpCmdRun.exe [2006-11-04 00:20]
.
.
------- Supplementary Scan -------
.
uStart Page = [You must be registered and logged in to see this link.]
uSearch Page = [You must be registered and logged in to see this link.]
uSearch Bar = [You must be registered and logged in to see this link.]
mDefault_Search_URL = [You must be registered and logged in to see this link.]
mStart Page = [You must be registered and logged in to see this link.]
mSearch Bar = [You must be registered and logged in to see this link.]
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = *.local
uSearchAssistant = [You must be registered and logged in to see this link.]
uSearchURL,(Default) = [You must be registered and logged in to see this link.]
mSearchAssistant = [You must be registered and logged in to see this link.]
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, [You must be registered and logged in to see this link.]
Rootkit scan 2009-10-12 16:14
Windows 5.1.2600 Service Pack 3 NTFS

scanning hȋdden processes ...

scanning hȋdden autostart entries ...

scanning hȋdden files ...

scan completed successfully
hȋdden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(3168)
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\wscntfy.exe
c:\program files\iPod\bin\iPodService.exe
.
**************************************************************************
.
Completion time: 2009-10-12 16:19 - machine was rebooted
ComboFix-quarantined-files.txt 2009-10-12 21:19
ComboFix2.txt 2009-10-12 19:21

Pre-Run: 16,490,414,080 bytes free
Post-Run: 16,429,965,312 bytes free

Current=4 Default=4 Failed=3 LastKnownGood=5 Sets=1,2,3,4,5
264 --- E O F --- 2009-10-12 19:00

rappcon
Novice
Novice

Posts Posts : 17
Joined Joined : 2009-10-11
OS OS : xp, vista
Points Points : 26247
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Definately need some help

Post by Belahzur on Mon Oct 12, 2009 7:50 pm

Hello.
One legit system file is infected again, we need to find a clean copy somewhere.

Please download the [You must be registered and logged in to see this link.].

  • Save it to your desktop.
  • Please double-click OTM.exe to run it.
  • Copy the bolded text below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose CopyCrying


    :files
    C:\*.tmp


  • Return to OTMoveIt, right click in the "Paste instructions for items to be Moved" window (under the light blue bar) and choose Paste.
  • Click the red Moveit! button.
  • Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
  • Close OTMoveIt
If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes.

Please post the OTMoveIt log.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34917
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : XP SP3 Media Centre
Points Points : 245080
# Likes # Likes : 1

View user profile

Back to top Go down

Re: Definately need some help

Post by rappcon on Wed Oct 14, 2009 8:41 pm

Sorry about responding. I was away for a while. Here's the log:

========== FILES ==========
C:\10.tmp moved successfully.
C:\11.tmp moved successfully.
C:\12.tmp moved successfully.
C:\13.tmp moved successfully.
C:\14.tmp moved successfully.
C:\15.tmp moved successfully.
C:\17.tmp moved successfully.
C:\18.tmp moved successfully.
C:\19.tmp moved successfully.
C:\1A.tmp moved successfully.
C:\1B.tmp moved successfully.
C:\1C.tmp moved successfully.
C:\1D.tmp moved successfully.
C:\1E.tmp moved successfully.
C:\1F.tmp moved successfully.
C:\2.tmp moved successfully.
C:\21.tmp moved successfully.
C:\22.tmp moved successfully.
C:\23.tmp moved successfully.
C:\24.tmp moved successfully.
C:\26.tmp moved successfully.
C:\27.tmp moved successfully.
C:\29.tmp moved successfully.
C:\2A.tmp moved successfully.
C:\2B.tmp moved successfully.
C:\2D.tmp moved successfully.
C:\2F.tmp moved successfully.
C:\3.tmp moved successfully.
C:\31.tmp moved successfully.
C:\32.tmp moved successfully.
C:\34.tmp moved successfully.
C:\36.tmp moved successfully.
C:\38.tmp moved successfully.
C:\3A.tmp moved successfully.
C:\3C.tmp moved successfully.
C:\3E.tmp moved successfully.
C:\4.tmp moved successfully.
C:\5.tmp moved successfully.
C:\6.tmp moved successfully.
C:\7.tmp moved successfully.
C:\8.tmp moved successfully.
C:\8A.tmp moved successfully.
C:\8B.tmp moved successfully.
C:\8D.tmp moved successfully.
C:\9.tmp moved successfully.
C:\A.tmp moved successfully.
C:\B.tmp moved successfully.
C:\C.tmp moved successfully.
C:\D.tmp moved successfully.
C:\E.tmp moved successfully.
C:\F.tmp moved successfully.

OTM by OldTimer - Version 3.0.0.6 log created on 10142009_193959

rappcon
Novice
Novice

Posts Posts : 17
Joined Joined : 2009-10-11
OS OS : xp, vista
Points Points : 26247
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Definately need some help

Post by Belahzur on Wed Oct 14, 2009 8:51 pm

Okay, please re-run Combofix now.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34917
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : XP SP3 Media Centre
Points Points : 245080
# Likes # Likes : 1

View user profile

Back to top Go down

Re: Definately need some help

Post by rappcon on Mon Oct 19, 2009 6:51 pm

Sorry it took so long to get this:

ComboFix 09-10-11.03 - carol 10/17/2009 12:52.4.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.510.156 [GMT -5:00]
Running from: c:\documents and settings\carol\Desktop\ComboFix.exe
AV: Microsoft Security Essentials *On-access scanning disabled* (Updated) {BCF43643-A118-4432-AEDE-D861FCBCFCDF}
.

((((((((((((((((((((((((( Files Created from 2009-09-17 to 2009-10-17 )))))))))))))))))))))))))))))))
.

2009-10-17 17:49 . 2009-10-17 17:49 -------- d-----w- c:\windows\LastGood
2009-10-15 00:39 . 2009-10-15 00:39 -------- d-----w- C:\_OTM
2009-10-13 21:17 . 2008-10-16 19:06 268648 ----a-w- c:\windows\system32\mucltui.dll
2009-10-13 21:17 . 2008-10-16 19:06 208744 ----a-w- c:\windows\system32\muweb.dll
2009-10-12 21:30 . 2009-10-01 15:29 195440 ------w- c:\windows\system32\MpSigStub.exe
2009-10-12 21:27 . 2009-10-12 21:27 -------- d-----w- c:\program files\Microsoft Security Essentials
2009-10-12 21:05 . 2004-08-04 10:00 55808 ----a-w- c:\windows\system32\eventlog.dll
2009-10-12 21:05 . 2004-08-04 10:00 4224 ------w- c:\windows\system32\drivers\beep.sys
2009-10-11 17:34 . 2009-10-11 17:34 -------- d-----w- c:\documents and settings\Administrator\Application Data\Malwarebytes
2009-10-08 21:34 . 2009-10-08 21:34 -------- d-----w- c:\documents and settings\Christina\Application Data\Malwarebytes
2009-10-03 19:14 . 2009-10-03 19:14 19024 ----a-w- c:\documents and settings\LocalService\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-10-03 18:11 . 2009-10-03 18:09 55656 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2009-10-03 17:54 . 2009-10-03 17:54 -------- d-----w- c:\program files\Windows Defender
2009-09-29 01:19 . 2009-09-29 01:19 -------- d-----w- c:\documents and settings\LocalService\Application Data\Malwarebytes
2009-09-29 01:17 . 2009-09-29 01:17 -------- d-----w- c:\documents and settings\Brandon\Application Data\Malwarebytes
2009-09-29 00:31 . 2009-09-29 00:31 -------- d-----w- c:\documents and settings\carol\Application Data\Malwarebytes
2009-09-29 00:31 . 2009-09-10 19:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-09-29 00:31 . 2009-09-29 00:31 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-09-29 00:31 . 2009-09-29 00:31 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-09-29 00:31 . 2009-09-10 19:53 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-09-29 00:08 . 2009-09-29 00:08 -------- d-----w- c:\program files\Trend Micro
2009-09-27 22:34 . 2009-09-27 22:43 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-09-27 20:51 . 2009-09-27 20:51 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\BVRP Software
2009-09-27 19:52 . 2009-09-27 19:52 -------- d-s---w- c:\documents and settings\Administrator\UserData
2009-09-27 19:33 . 2004-08-04 10:00 182912 ----a-w- c:\windows\system32\dllcache\ndis.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-10-11 18:37 . 2005-08-17 02:30 -------- d-----w- c:\program files\Java
2009-10-11 18:36 . 2009-07-15 02:10 411368 ----a-w- c:\windows\system32\deploytk.dll
2009-10-09 00:02 . 2007-10-25 02:36 19024 -c--a-w- c:\documents and settings\Christina\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-10-04 21:01 . 2006-01-23 22:39 -------- d-----w- c:\documents and settings\carol\Application Data\AdobeUM
2009-09-29 02:14 . 2006-12-19 00:31 19024 -c--a-w- c:\documents and settings\Brandon\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-09-27 19:52 . 2006-11-29 01:12 1324 ----a-w- c:\windows\system32\d3d9caps.dat
2009-09-16 18:56 . 2006-08-05 17:44 -------- d-----w- c:\documents and settings\Brandon\Application Data\AdobeUM
2009-09-14 19:50 . 2009-03-06 00:30 -------- d-----w- c:\documents and settings\LocalService\Application Data\SACore
2009-09-01 21:09 . 2005-10-12 20:48 19024 -c--a-w- c:\documents and settings\carol\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-08-22 21:54 . 2006-11-22 22:43 -------- d-----w- c:\documents and settings\Christina\Application Data\AdobeUM
2009-08-05 09:01 . 2004-08-10 17:51 204800 ------w- c:\windows\system32\mswebdvd.dll
2009-04-22 00:49 . 2006-01-24 23:04 56 -csh--r- c:\windows\system32\B0CB720293.sys
.

------- Sigcheck -------

[7] 2008-04-13 . 1DF7F42665C94B825322FAE71721130D . 182656 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\ndis.sys
[-] 2004-08-04 . 558635D3AF1C7546D26067D5D9B6959E . 182912 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\ndis.sys
[-] 2004-08-04 . 558635D3AF1C7546D26067D5D9B6959E . 182912 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\ndis.sys
[-] 2004-08-04 . 558635D3AF1C7546D26067D5D9B6959E . 182912 . . [5.1.2600.2180] . . c:\windows\system32\drivers\ndis.sys

[7] 2008-04-14 . 6D4FEB43EE538FC5428CC7F0565AA656 . 56320 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\eventlog.dll
[-] 2004-08-04 . 82B24CB70E5944E6E34662205A2A5B78 . 55808 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\eventlog.dll
[-] 2004-08-04 . 82B24CB70E5944E6E34662205A2A5B78 . 55808 . . [5.1.2600.2180] . . c:\windows\system32\eventlog.dll
.
((((((((((((((((((((((((((((( [You must be registered and logged in to see this link.] )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-05-22 22:50 . 2008-07-08 13:02 17272 c:\windows\system32\spmsg.dll
+ 2009-10-12 17:32 . 2009-10-12 21:03 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012009101220091013\index.dat
- 2009-10-12 17:32 . 2009-10-12 18:20 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012009101220091013\index.dat
+ 2005-08-20 01:51 . 2009-10-12 21:03 81920 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2009-06-18 23:48 . 2009-06-18 23:48 142832 c:\windows\system32\drivers\MpFilter.sys
+ 2009-10-09 03:58 . 2009-10-12 21:03 344064 c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
+ 2009-10-12 21:27 . 2009-10-12 21:27 259072 c:\windows\Installer\35b81.msi
+ 2009-10-12 21:27 . 2009-10-12 21:27 211968 c:\windows\Installer\35b7c.msi
+ 2009-10-12 21:27 . 2009-10-12 21:27 301056 c:\windows\Installer\35b77.msi
+ 2009-07-16 22:11 . 2004-08-04 10:00 182912 c:\windows\$NtServicePackUninstall$\ndis.sys
+ 2005-07-12 23:04 . 2008-03-20 23:06 1480232 c:\windows\system32\LegitCheckControl.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-14 68856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2004-10-15 1404928]
"IntelMeM"="c:\program files\Intel\Modem Event Monitor\IntelMEM.exe" [2003-09-04 221184]
"dla"="c:\windows\system32\dla\tfswctrl.exe" [2004-12-06 127035]
"ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-27 221184]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2004-07-27 81920]
"igfxtray"="c:\windows\system32\igfxtray.exe" [2005-09-20 94208]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2005-09-20 77824]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2005-09-20 114688]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-11-04 413696]
"iTunesHelper"="c:\itunes\iTunesHelper.exe" [2008-11-20 290088]
"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2009-09-10 1312080]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2006-11-04 866584]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-10-11 149280]
"MSSE"="c:\program files\Microsoft Security Essentials\msseces.exe" [2009-09-13 1048392]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Kodak EasyShare software.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Kodak EasyShare software.lnk
backup=c:\windows\pss\Kodak EasyShare software.lnkCommon Startup

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Kodak\\Kodak EasyShare software\\bin\\EasyShare.exe"=
"c:\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\iPod\\bin\\iPodService.exe"=

S3 W8100PCI;D-Link AirPlus G Wireless Driver;c:\windows\system32\drivers\MRV8K51.sys [8/19/2005 9:20 PM 297984]
.
Contents of the 'Scheduled Tasks' folder

2009-09-19 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 18:34]

2009-10-17 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Microsoft Security Essentials\MpCmdRun.exe [2009-07-02 22:36]
.
.
------- Supplementary Scan -------
.
uStart Page = [You must be registered and logged in to see this link.]
uSearch Page = [You must be registered and logged in to see this link.]
uSearch Bar = [You must be registered and logged in to see this link.]
mStart Page = [You must be registered and logged in to see this link.]
mSearch Bar = [You must be registered and logged in to see this link.]
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = [You must be registered and logged in to see this link.]
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, [You must be registered and logged in to see this link.]
Rootkit scan 2009-10-17 13:03
Windows 5.1.2600 Service Pack 3 NTFS

scanning hȋdden processes ...

scanning hȋdden autostart entries ...

scanning hȋdden files ...

scan completed successfully
hȋdden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(3608)
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Completion time: 2009-10-17 13:10
ComboFix-quarantined-files.txt 2009-10-17 18:10
ComboFix2.txt 2009-10-12 21:19
ComboFix3.txt 2009-10-12 19:21

Pre-Run: 15,377,694,720 bytes free
Post-Run: 15,628,390,400 bytes free

Current=4 Default=4 Failed=3 LastKnownGood=5 Sets=1,2,3,4,5
155 --- E O F --- 2009-10-17 17:50

rappcon
Novice
Novice

Posts Posts : 17
Joined Joined : 2009-10-11
OS OS : xp, vista
Points Points : 26247
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Definately need some help

Post by Dr Jay on Mon Oct 19, 2009 9:35 pm

Please re-open Malwarebytes, click the Update tab, and click Check for Updates. Then, click the Scanner tab, select Perform Quick Scan, and press Scan. Remove selected, and post the log in your next reply.


Dr. Jay (DJ)


[You must be registered and logged in to see this link.] ~ [You must be registered and logged in to see this link.] ~ [You must be registered and logged in to see this link.] ~ [You must be registered and logged in to see this link.]

Dr Jay
Head Administrator
Head Administrator

Posts Posts : 13757
Joined Joined : 2009-09-06
Gender Gender : Male
OS OS : Windows 10 Home & Pro
Protection Protection : Bitdefender Total Security
Points Points : 302262
# Likes # Likes : 10

View user profile

Back to top Go down

Re: Definately need some help

Post by rappcon on Thu Oct 29, 2009 7:29 pm

Sorry this took so long... I will definatly make a donation.

Malwarebytes' Anti-Malware 1.41
Database version: 2943
Windows 5.1.2600 Service Pack 3

10/28/2009 10:23:33 PM
mbam-log-2009-10-28 (22-23-33).txt

Scan type: Quick Scan
Objects scanned: 128209
Time elapsed: 9 minute(s), 21 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

rappcon
Novice
Novice

Posts Posts : 17
Joined Joined : 2009-10-11
OS OS : xp, vista
Points Points : 26247
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Definately need some help

Post by Belahzur on Thu Oct 29, 2009 9:17 pm

Click Start > Run and copy/paste the following bolded text into the Run box and click OK:

ComboFix /u



This will also reset your restore points.

How is the machine running now?


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34917
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : XP SP3 Media Centre
Points Points : 245080
# Likes # Likes : 1

View user profile

Back to top Go down

Re: Definately need some help

Post by rappcon on Wed Nov 04, 2009 8:55 pm

Ok so that appears to just uninstall ComboFix. The machine seems to be operating normal. Also all virus scans now come back clean. Thanks for your help!!!

rappcon
Novice
Novice

Posts Posts : 17
Joined Joined : 2009-10-11
OS OS : xp, vista
Points Points : 26247
# Likes # Likes : 0

View user profile

Back to top Go down

View previous topic View next topic Back to top


 
Permissions in this forum:
You cannot reply to topics in this forum