Security Tool Virus/Malware

View previous topic View next topic Go down

Security Tool Virus/Malware

Post by pfchang on 22nd December 2009, 6:35 pm

Below is the HJT logfile. Currently running windows xp on safe mode.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:33:07 AM, on 12/22/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Safe mode with network support

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Documents and Settings\sarechig\Desktop\winlogon.scr

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = [You must be registered and logged in to see this link.]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = [You must be registered and logged in to see this link.]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = [You must be registered and logged in to see this link.]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = [You must be registered and logged in to see this link.]
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = [You must be registered and logged in to see this link.]
O1 - Hosts: 78.159.110.49 [You must be registered and logged in to see this link.]
O1 - Hosts: 78.159.110.49 [You must be registered and logged in to see this link.]
O1 - Hosts: 78.159.110.49 [You must be registered and logged in to see this link.]
O1 - Hosts: 78.159.110.49 [You must be registered and logged in to see this link.]
O1 - Hosts: 78.159.110.49 [You must be registered and logged in to see this link.]
O1 - Hosts: 78.159.110.49 [You must be registered and logged in to see this link.]
O1 - Hosts: 78.159.110.49 [You must be registered and logged in to see this link.]
O1 - Hosts: 78.159.110.49 [You must be registered and logged in to see this link.]
O1 - Hosts: 78.159.110.49 [You must be registered and logged in to see this link.]
O1 - Hosts: 78.159.110.49 [You must be registered and logged in to see this link.]
O1 - Hosts: 78.159.110.49 [You must be registered and logged in to see this link.]
O1 - Hosts: 78.159.110.49 [You must be registered and logged in to see this link.]
O1 - Hosts: 78.159.110.49 [You must be registered and logged in to see this link.]
O1 - Hosts: 78.159.110.49 [You must be registered and logged in to see this link.]
O1 - Hosts: 78.159.110.49 [You must be registered and logged in to see this link.]
O1 - Hosts: 78.159.110.49 [You must be registered and logged in to see this link.]
O1 - Hosts: 78.159.110.49 [You must be registered and logged in to see this link.]
O1 - Hosts: 78.159.110.49 [You must be registered and logged in to see this link.]
O1 - Hosts: 78.159.110.49 [You must be registered and logged in to see this link.]
O1 - Hosts: 78.159.110.49 [You must be registered and logged in to see this link.]
O1 - Hosts: 78.159.110.49 [You must be registered and logged in to see this link.]
O1 - Hosts: 78.159.110.49 [You must be registered and logged in to see this link.]
O1 - Hosts: 78.159.110.49 [You must be registered and logged in to see this link.]
O1 - Hosts: 78.159.110.49 search.yahoo.com
O1 - Hosts: 78.159.110.49 us.search.yahoo.com
O1 - Hosts: 78.159.110.49 uk.search.yahoo.com
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.4.4525.1752\swg.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [SetRefresh] C:\Program Files\Compaq\SetRefresh\SetRefresh.exe
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\Sminst\Recguard.exe
O4 - HKLM\..\Run: [Reminder] C:\WINDOWS\Creator\Remind_XP.exe
O4 - HKLM\..\Run: [Scheduler] C:\WINDOWS\SMINST\Scheduler.exe
O4 - HKLM\..\Run: [Client Access Service] "C:\Program Files\IBM\Client Access\cwbsvstr.exe"
O4 - HKLM\..\Run: [Client Access Help Update] "C:\Program Files\IBM\Client Access\cwbinhlp.exe"
O4 - HKLM\..\Run: [Client Access Check Version] "C:\Program Files\IBM\Client Access\cwbckver.exe" LOGIN
O4 - HKLM\..\Run: [Client Access Express Welcome] "C:\Program Files\IBM\Client Access\cwbwlwiz.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [sysgif32] C:\WINDOWS\TEMP\~TMD.tmp
O4 - HKLM\..\Run: [29413423] C:\DOCUME~1\ALLUSE~1\APPLIC~1\29413423\29413423.exe
O4 - HKLM\..\Run: [CTFMON] C:\WINDOWS\Temp\_ex-08.exe
O4 - HKLM\..\Run: [Gcejatoqeziwa] rundll32.exe "C:\WINDOWS\enogaror.dll",Startup
O4 - HKCU\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKCU\..\Run: [ttool] C:\WINDOWS\sr882388.exe
O4 - Startup: siszyd32.exe
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - [You must be registered and logged in to see this link.]
O8 - Extra context menu item: Google Sidewiki... - [You must be registered and logged in to see this link.] Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll/cmsidewiki.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.hp.com
O18 - Filter: application/xhtml+xml; charset=iso-8859-1 - {32F66A26-7614-11D4-BD11-00104BD3F987} - C:\Program Files\Design Science\MathPlayer\MathMLMimer.dll
O18 - Filter: application/xhtml+xml; charset=utf-8 - {32F66A26-7614-11D4-BD11-00104BD3F987} - C:\Program Files\Design Science\MathPlayer\MathMLMimer.dll
O18 - Filter: text/xml; charset=iso-8859-1 - {32F66A26-7614-11D4-BD11-00104BD3F987} - C:\Program Files\Design Science\MathPlayer\MathMLMimer.dll
O18 - Filter: text/xml; charset=utf-8 - {32F66A26-7614-11D4-BD11-00104BD3F987} - C:\Program Files\Design Science\MathPlayer\MathMLMimer.dll
O23 - Service: Client Access Express Remote Command (Cwbrxd) - IBM Corporation - C:\WINDOWS\CWBRXD.EXE
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - c:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: IviRegMgr - InterVideo - C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
O23 - Service: PC Angel (PCA) - SoftThinks - C:\WINDOWS\SMINST\PCAngel.exe

--
End of file - 7234 bytes

pfchang
Intermediate
Intermediate

Posts Posts : 66
Joined Joined : 2009-03-05
OS OS : Windows XP Professional
Points Points : 28745
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Security Tool Virus/Malware

Post by Belahzur on 22nd December 2009, 6:41 pm

I notice that you never scanned with an Antivirus previously before starting this thread - because you don't even have an Antivirus installed!
This is somewhat suicidal in today's digital world.
That's why I want you to install one first!!

* Please install Avira Antivirus: [You must be registered and logged in to see this link.]
This is a free Antivirus.

Perform a full scan with Avira and let it delete everything it is finding.
Then reboot.
After reboot, open your Avira and select "reports".
There doubleclick the report from the Full scan you have done. Click the "Report File" button and copy and paste this report in your next reply.
Then we'll start from there, because it really makes no sense otherwise that we clean this up manually if an Antivirusscan is not present which should be able to deal with most and prevent further reinfection.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34918
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : 7 Home Premium x64
Points Points : 245101
# Likes # Likes : 1

View user profile

Back to top Go down

Re: Security Tool Virus/Malware

Post by pfchang on 22nd December 2009, 10:01 pm

i tried to install avira but had no luck. so i installed avast. hope that's ok. below is the report after the scan:

*
* avast! Report
* This file is generated automatically
*
* Task 'Simple user interface' used
* Started on Tuesday, December 22, 2009 1:36:07 PM
* VPS: 091222-1, 12/22/2009
*

C:\WINDOWS\System32\Drivers\zdboiau.sys||AntiRootkit [SVC]|||40|0|2|COO1||COO2|| [L] (0)
File will be deleted during the next system start...
C:\System Volume Information\_restore{D0D4C289-1775-4E84-B8F1-E8133151EDAF}\RP268\A0013275.dll [L] Win32:Trojan-gen (0)
While moving file to chest, error occurred: Virus chest server is not running. RPC communication failed.
While moving file to chest, error occurred: Virus chest server is not running. RPC communication failed.
While moving file to chest, error occurred: Virus chest server is not running. RPC communication failed.
File was successfully deleted...
C:\WINDOWS\system32\drivers\zdboiau.sys [E] A device attached to the system is not functioning (31)
Infected files: 3
Total files: 65908
Total folders: 5081
Total size: 13.4 GB

*
* Task stopped: Tuesday, December 22, 2009 1:57:23 PM
* Run-time was 21 minute(s), 16 second(s)
*

pfchang
Intermediate
Intermediate

Posts Posts : 66
Joined Joined : 2009-03-05
OS OS : Windows XP Professional
Points Points : 28745
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Security Tool Virus/Malware

Post by Belahzur on 22nd December 2009, 11:05 pm

Hello.

  • Download combofix from here
    [You must be registered and logged in to see this link.]
    [You must be registered and logged in to see this link.]

    1. If you are using Firefox, make sure that your download settings are as follows:

    * Tools->Options->Main tab
    * Set to "Always ask me where to Save the files".

    2. During the download, rename Combofix to Combo-Fix as follows:





    3. It is important you rename Combofix during the download, but not after.
    4. Please do not rename Combofix to other names, but only to the one indicated.
    5. Close any open browsers.
    6. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

  • We need to disable your local AV (Anti-virus) before running Combofix.
  • See [You must be registered and logged in to see this link.] for how to disable your AV.
  • Double click on ComboFix.exe.
  • Follow the prompts. NOTE:
  • ComboFix will check to see if the Microsoft Windows Recovery Console is installed.
    ***It's strongly recommended to have the Recovery Console installed before doing any malware removal.***

    **Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will automatically proceed with its scan.


  • The Recovery Console provides a recovery/repair mode should a problem occur during a Combofix run.



  • Allow ComboFix to download the Recovery Console.
  • Accept the End-User License Agreement.
  • The Recovery Console will be installed.
  • You will then get this next prompt that asks if you want to continue the malware scan, select yes



  • Allow combofix to run
  • Post C:\combofix.txt back here.

    Note:
    Do not mouseclick combofix's window whilst it's running. That may cause it to stall.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34918
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : 7 Home Premium x64
Points Points : 245101
# Likes # Likes : 1

View user profile

Back to top Go down

Re: Security Tool Virus/Malware

Post by pfchang on 23rd December 2009, 12:08 am

ComboFix 09-12-21.08 - sarechig 12/22/2009 15:51:10.1.2 - x86 NETWORK
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1014.814 [GMT -8:00]
Running from: c:\documents and settings\sarechig\Desktop\Combo-Fix.exe
AV: avast! antivirus 4.8.1368 [VPS 091222-1] *On-access scanning enabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users\Application Data\29413423
c:\documents and settings\All Users\Application Data\29413423\29413423.exe
c:\documents and settings\sarechig\Application Data\avdrn.dat
c:\documents and settings\sarechig\Desktop\Security Tool.lnk
c:\documents and settings\sarechig\Local Settings\Application Data\{21AF53E5-6867-41C1-B4D9-1D4DFD6B841A}
c:\documents and settings\sarechig\Local Settings\Application Data\{21AF53E5-6867-41C1-B4D9-1D4DFD6B841A}\chrome.manifest
c:\documents and settings\sarechig\Local Settings\Application Data\{21AF53E5-6867-41C1-B4D9-1D4DFD6B841A}\chrome\content\_cfg.js
c:\documents and settings\sarechig\Local Settings\Application Data\{21AF53E5-6867-41C1-B4D9-1D4DFD6B841A}\chrome\content\overlay.xul
c:\documents and settings\sarechig\Local Settings\Application Data\{21AF53E5-6867-41C1-B4D9-1D4DFD6B841A}\install.rdf
c:\documents and settings\sarechig\Start Menu\Programs\Security Tool.lnk
c:\documents and settings\sarechig\Start Menu\Programs\Startup\siszyd32.exe
c:\recycler\S-1-5-21-775688892-2513285845-2764565087-500
c:\windows\enogaror.dll
c:\windows\sr882388.exe
D:\Autorun.inf

.
((((((((((((((((((((((((( Files Created from 2009-11-22 to 2009-12-22 )))))))))))))))))))))))))))))))
.

2009-12-22 23:36 . 2009-12-22 23:36 148 ----a-w- c:\windows\system32\fjhdyfhsn.bat
2009-12-22 19:09 . 2009-11-24 23:49 48560 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2009-12-22 19:09 . 2009-11-24 23:48 23120 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2009-12-22 19:09 . 2009-11-24 23:47 27408 ----a-w- c:\windows\system32\drivers\aavmker4.sys
2009-12-22 19:09 . 2009-11-24 23:47 97480 ----a-w- c:\windows\system32\AvastSS.scr
2009-12-22 19:09 . 2009-11-24 23:51 93424 ----a-w- c:\windows\system32\drivers\aswmon.sys
2009-12-22 19:09 . 2009-11-24 23:50 94160 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2009-12-22 19:09 . 2009-11-24 23:50 114768 ----a-w- c:\windows\system32\drivers\aswSP.sys
2009-12-22 19:09 . 2009-11-24 23:50 20560 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2009-12-22 19:09 . 2009-11-24 23:54 1280480 ----a-w- c:\windows\system32\aswBoot.exe
2009-12-22 19:09 . 2003-03-18 21:20 1060864 ----a-w- c:\windows\system32\MFC71.dll
2009-12-22 19:09 . 2009-12-22 20:14 -------- d-----w- c:\program files\Avast4
2009-12-22 17:48 . 2009-12-22 17:48 -------- d-sh--w- c:\documents and settings\sarechig\IECompatCache
2009-12-22 17:19 . 2009-12-22 23:36 120 ----a-w- c:\windows\Drasehukuhoxa.dat
2009-12-22 17:19 . 2009-12-22 17:19 0 ----a-w- c:\windows\Ubawekudatugapo.bin
2009-12-22 17:16 . 2009-12-23 00:00 714752 ----a-w- c:\windows\system32\drivers\zdboiau.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-12-22 23:39 . 2009-12-22 23:36 28 ----a-w- c:\windows\system32\config\systemprofile\Application Data\fvgqad.dat
2009-12-22 17:58 . 2009-12-22 17:58 28 ----a-w- c:\documents and settings\LocalService\Application Data\fvgqad.dat
2009-12-22 17:15 . 2009-12-22 17:15 28 ----a-w- c:\documents and settings\NetworkService\Application Data\fvgqad.dat
2009-11-25 16:57 . 2009-11-11 17:18 -------- d-----w- c:\documents and settings\sarechig\Application Data\AdobeUM
2009-11-10 02:05 . 2009-11-09 20:03 -------- d-----w- c:\documents and settings\sarechig\Application Data\ICAClient
2009-11-09 19:20 . 2009-11-09 19:20 -------- d-----w- c:\documents and settings\All Users\Application Data\Avg7
2009-11-06 22:12 . 2004-08-09 13:32 88207 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat
2009-11-06 22:12 . 2008-03-05 16:36 74200 ----a-w- c:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-10-29 07:45 . 2004-08-04 08:00 916480 ----a-w- c:\windows\system32\wininet.dll
2009-10-21 05:38 . 2004-08-04 08:00 75776 ----a-w- c:\windows\system32\strmfilt.dll
2009-10-21 05:38 . 2004-08-04 08:00 25088 ----a-w- c:\windows\system32\httpapi.dll
2009-10-20 16:20 . 2004-08-04 08:00 265728 ----a-w- c:\windows\system32\drivers\http.sys
2009-10-13 10:30 . 2004-08-04 08:00 270336 ----a-w- c:\windows\system32\oakley.dll
2009-10-12 13:38 . 2004-08-04 08:00 149504 ----a-w- c:\windows\system32\rastls.dll
2009-10-12 13:38 . 2004-08-04 08:00 79872 ----a-w- c:\windows\system32\raschap.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-01-05 413696]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-05-10 68856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2006-09-25 98304]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2006-09-25 114688]
"Persistence"="c:\windows\system32\igfxpers.exe" [2006-09-25 94208]
"SetRefresh"="c:\program files\Compaq\SetRefresh\SetRefresh.exe" [2003-11-20 525824]
"Recguard"="c:\windows\Sminst\Recguard.exe" [2006-05-12 1138688]
"Reminder"="c:\windows\Creator\Remind_XP.exe" [2006-03-31 761856]
"Scheduler"="c:\windows\SMINST\Scheduler.exe" [2006-07-10 872448]
"Client Access Service"="c:\program files\IBM\Client Access\cwbsvstr.exe" [2000-11-28 20480]
"Client Access Help Update"="c:\program files\IBM\Client Access\cwbinhlp.exe" [2000-11-28 24576]
"Client Access Check Version"="c:\program files\IBM\Client Access\cwbckver.exe" [2000-11-28 49152]
"Client Access Express Welcome"="c:\program files\IBM\Client Access\cwbwlwiz.exe" [2000-11-28 20480]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-01-05 413696]
"avast!"="c:\progra~1\Avast4\ashDisp.exe" [2009-11-24 81000]

c:\documents and settings\Administrator\Start Menu\Programs\Startup\
Aurafin.lnk - c:\program files\Citrix\ICA Client\pn.exe [2007-2-8 523656]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Acrobat Assistant.lnk - c:\program files\Adobe\Acrobat 6.0\Distillr\acrotray.exe [2003-5-15 217193]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"avast! Web Scanner"=3 (0x3)
"avast! Mail Scanner"=3 (0x3)
"avast! Antivirus"=2 (0x2)
"aswUpdSv"=2 (0x2)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\SMINST\\Scheduler.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\ORL\\VNC\\WinVNC.exe"=
"c:\\Program Files\\Microsoft Office\\Live Meeting 8\\Console\\PWConsole.exe"=

R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [12/22/2009 11:09 AM 114768]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [12/22/2009 11:09 AM 20560]

--- Other Services/Drivers In Memory ---

*Deregistered* - zdboiau
.
------- Supplementary Scan -------
.
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll/cmsidewiki.html
.
- - - - ORPHANS REMOVED - - - -

HKLM-Run-Gcejatoqeziwa - c:\windows\enogaror.dll
Notify-NavLogon - (no file)
AddRemove-HijackThis - c:\documents and settings\sarechig\Local Settings\Temporary Internet Files\Content.IE5\VJ5T7EI1\HijackThis.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, [You must be registered and logged in to see this link.]
Rootkit scan 2009-12-22 15:59
Windows 5.1.2600 Service Pack 3 NTFS

scanning hȋdden processes ...

scanning hȋdden autostart entries ...

scanning hȋdden files ...

scan completed successfully
hȋdden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\zdboiau]

.
------------------------ Other Running Processes ------------------------
.
c:\program files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
.
**************************************************************************
.
Completion time: 2009-12-22 16:02:00 - machine was rebooted
ComboFix-quarantined-files.txt 2009-12-23 00:01

Pre-Run: 56,923,340,800 bytes free
Post-Run: 56,343,982,080 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

- - End Of File - - BB1019424A84E5C32AEE2C5004243877

pfchang
Intermediate
Intermediate

Posts Posts : 66
Joined Joined : 2009-03-05
OS OS : Windows XP Professional
Points Points : 28745
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Security Tool Virus/Malware

Post by Belahzur on 23rd December 2009, 12:12 am

Hello.

  1. Close any open browsers.
  2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
  3. Open notepad and copy/paste the text in the quotebox below into it:

    File::
    c:\windows\system32\fjhdyfhsn.bat
    c:\windows\Drasehukuhoxa.dat
    c:\windows\Ubawekudatugapo.bin
    c:\windows\system32\drivers\zdboiau.sys
    c:\windows\system32\config\systemprofile\Application Data\fvgqad.dat
    c:\documents and settings\LocalService\Application Data\fvgqad.dat
    c:\documents and settings\NetworkService\Application Data\fvgqad.dat

    Folder::
    c:\documents and settings\All Users\Application Data\Avg7

    Registry::
    [-HKEY_LOCAL_MACHINE\System\ControlSet001\Services\zdboiau]
  4. Save this as CFScript.txt, in the same location as ComboFix.exe



  5. Referring to the picture above, drag CFScript into ComboFix.exe
  6. When finished, it shall produce a log for you at C:\ComboFix.txt
  7. Please post the contents of the log in your next reply.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34918
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : 7 Home Premium x64
Points Points : 245101
# Likes # Likes : 1

View user profile

Back to top Go down

Re: Security Tool Virus/Malware

Post by pfchang on 23rd December 2009, 12:37 am

ComboFix 09-12-21.08 - sarechig 12/22/2009 16:21:52.2.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1014.708 [GMT -8:00]
Running from: c:\documents and settings\sarechig\Desktop\Combo-Fix.exe
Command switches used :: c:\documents and settings\sarechig\Desktop\CFScript.txt
AV: avast! antivirus 4.8.1368 [VPS 091222-1] *On-access scanning enabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}

FILE ::
"c:\documents and settings\LocalService\Application Data\fvgqad.dat"
"c:\documents and settings\NetworkService\Application Data\fvgqad.dat"
"c:\windows\Drasehukuhoxa.dat"
"c:\windows\system32\config\systemprofile\Application Data\fvgqad.dat"
"c:\windows\system32\drivers\zdboiau.sys"
"c:\windows\system32\fjhdyfhsn.bat"
"c:\windows\Ubawekudatugapo.bin"
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users\Application Data\Avg7
c:\documents and settings\LocalService\Application Data\fvgqad.dat
c:\documents and settings\NetworkService\Application Data\fvgqad.dat
c:\windows\Drasehukuhoxa.dat
c:\windows\system32\config\systemprofile\Application Data\fvgqad.dat
c:\windows\system32\drivers\zdboiau.sys
c:\windows\system32\fjhdyfhsn.bat
c:\windows\Ubawekudatugapo.bin

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_zdboiau
-------\Service_zdboiau


((((((((((((((((((((((((( Files Created from 2009-11-23 to 2009-12-23 )))))))))))))))))))))))))))))))
.

2009-12-22 23:49 . 2009-12-23 00:02 -------- d-----w- C:\Combo-Fix
2009-12-22 19:09 . 2009-11-24 23:49 48560 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2009-12-22 19:09 . 2009-11-24 23:48 23120 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2009-12-22 19:09 . 2009-11-24 23:47 27408 ----a-w- c:\windows\system32\drivers\aavmker4.sys
2009-12-22 19:09 . 2009-11-24 23:47 97480 ----a-w- c:\windows\system32\AvastSS.scr
2009-12-22 19:09 . 2009-11-24 23:51 93424 ----a-w- c:\windows\system32\drivers\aswmon.sys
2009-12-22 19:09 . 2009-11-24 23:50 94160 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2009-12-22 19:09 . 2009-11-24 23:50 114768 ----a-w- c:\windows\system32\drivers\aswSP.sys
2009-12-22 19:09 . 2009-11-24 23:50 20560 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2009-12-22 19:09 . 2009-11-24 23:54 1280480 ----a-w- c:\windows\system32\aswBoot.exe
2009-12-22 19:09 . 2003-03-18 21:20 1060864 ----a-w- c:\windows\system32\MFC71.dll
2009-12-22 19:09 . 2009-12-22 20:14 -------- d-----w- c:\program files\Avast4
2009-12-22 17:48 . 2009-12-22 17:48 -------- d-sh--w- c:\documents and settings\sarechig\IECompatCache

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-11-25 16:57 . 2009-11-11 17:18 -------- d-----w- c:\documents and settings\sarechig\Application Data\AdobeUM
2009-11-10 02:05 . 2009-11-09 20:03 -------- d-----w- c:\documents and settings\sarechig\Application Data\ICAClient
2009-11-06 22:12 . 2004-08-09 13:32 88207 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat
2009-11-06 22:12 . 2008-03-05 16:36 74200 ----a-w- c:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-10-29 07:45 . 2004-08-04 08:00 916480 ------w- c:\windows\system32\wininet.dll
2009-10-21 05:38 . 2004-08-04 08:00 75776 ----a-w- c:\windows\system32\strmfilt.dll
2009-10-21 05:38 . 2004-08-04 08:00 25088 ----a-w- c:\windows\system32\httpapi.dll
2009-10-20 16:20 . 2004-08-04 08:00 265728 ----a-w- c:\windows\system32\drivers\http.sys
2009-10-13 10:30 . 2004-08-04 08:00 270336 ----a-w- c:\windows\system32\oakley.dll
2009-10-12 13:38 . 2004-08-04 08:00 149504 ----a-w- c:\windows\system32\rastls.dll
2009-10-12 13:38 . 2004-08-04 08:00 79872 ----a-w- c:\windows\system32\raschap.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-01-05 413696]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-05-10 68856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2006-09-25 98304]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2006-09-25 114688]
"Persistence"="c:\windows\system32\igfxpers.exe" [2006-09-25 94208]
"SetRefresh"="c:\program files\Compaq\SetRefresh\SetRefresh.exe" [2003-11-20 525824]
"Recguard"="c:\windows\Sminst\Recguard.exe" [2006-05-12 1138688]
"Reminder"="c:\windows\Creator\Remind_XP.exe" [2006-03-31 761856]
"Scheduler"="c:\windows\SMINST\Scheduler.exe" [2006-07-10 872448]
"Client Access Service"="c:\program files\IBM\Client Access\cwbsvstr.exe" [2000-11-28 20480]
"Client Access Help Update"="c:\program files\IBM\Client Access\cwbinhlp.exe" [2000-11-28 24576]
"Client Access Check Version"="c:\program files\IBM\Client Access\cwbckver.exe" [2000-11-28 49152]
"Client Access Express Welcome"="c:\program files\IBM\Client Access\cwbwlwiz.exe" [2000-11-28 20480]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-01-05 413696]
"avast!"="c:\progra~1\Avast4\ashDisp.exe" [2009-11-24 81000]

c:\documents and settings\Administrator\Start Menu\Programs\Startup\
Aurafin.lnk - c:\program files\Citrix\ICA Client\pn.exe [2007-2-8 523656]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Acrobat Assistant.lnk - c:\program files\Adobe\Acrobat 6.0\Distillr\acrotray.exe [2003-5-15 217193]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"avast! Web Scanner"=3 (0x3)
"avast! Mail Scanner"=3 (0x3)
"avast! Antivirus"=2 (0x2)
"aswUpdSv"=2 (0x2)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\SMINST\\Scheduler.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\ORL\\VNC\\WinVNC.exe"=
"c:\\Program Files\\Microsoft Office\\Live Meeting 8\\Console\\PWConsole.exe"=

R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [12/22/2009 11:09 AM 114768]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [12/22/2009 11:09 AM 20560]
.
------- Supplementary Scan -------
.
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll/cmsidewiki.html
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, [You must be registered and logged in to see this link.]
Rootkit scan 2009-12-22 16:28
Windows 5.1.2600 Service Pack 3 NTFS

scanning hȋdden processes ...

scanning hȋdden autostart entries ...

scanning hȋdden files ...

scan completed successfully
hȋdden files: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
.
**************************************************************************
.
Completion time: 2009-12-22 16:30:34 - machine was rebooted
ComboFix-quarantined-files.txt 2009-12-23 00:30
ComboFix2.txt 2009-12-23 00:02

Pre-Run: 56,365,699,072 bytes free
Post-Run: 56,330,436,608 bytes free

- - End Of File - - 846EAC196C4D98C2E1FE338D7FF5454B

pfchang
Intermediate
Intermediate

Posts Posts : 66
Joined Joined : 2009-03-05
OS OS : Windows XP Professional
Points Points : 28745
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Security Tool Virus/Malware

Post by Belahzur on 23rd December 2009, 1:04 am

Click Start > Run and copy/paste the following bolded text into the Run box and click OK:

ComboFix /uninstall

This will also reset your restore points.

How is the machine running now?


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34918
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : 7 Home Premium x64
Points Points : 245101
# Likes # Likes : 1

View user profile

Back to top Go down

Re: Security Tool Virus/Malware

Post by pfchang on 23rd December 2009, 1:08 am

looks good so far. no more fake security pop-ups. thank you!

pfchang
Intermediate
Intermediate

Posts Posts : 66
Joined Joined : 2009-03-05
OS OS : Windows XP Professional
Points Points : 28745
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Security Tool Virus/Malware

Post by Belahzur on 23rd December 2009, 1:10 am

Below I have included a number of recommendations for how to protect your computer in order to prevent future malware infections. Please take these recommendations seriously; these few simple steps can stave off the vast majority of spyware problems. As happy as we are to help you, for your sake we would rather not have repeat customers. Goofy

1) Please navigate to [You must be registered and logged in to see this link.] and download all the "critical updates" for Windows. This can patch many of the security holes through which attackers can gain access to your computer.

Please either enable Automatic Updates under Start -> Control Panel -> Automatic Updates , or get into the habit of checking for Windows updates regularly. I cannot stress enough how important this is.

2) In order to protect yourself against spyware, you should consider installing and running the following free programs:

[You must be registered and logged in to see this link.]
A tutorial on using Ad-Aware to remove spyware from your computer may be found [You must be registered and logged in to see this link.].

[You must be registered and logged in to see this link.]
A tutorial on using Spybot to remove spyware from your computer may be found [You must be registered and logged in to see this link.]. Please also remember to enable Spybot's "Immunize" and "TeaTimer" features.

[You must be registered and logged in to see this link.]
A tutorial on using SpywareBlaster to prevent spyware from ever installing on your computer may be found [You must be registered and logged in to see this link.].

[You must be registered and logged in to see this link.]
A tutorial on using SpywareGuard for realtime protection against spyware and hijackers may be found [You must be registered and logged in to see this link.].

Make sure to keep these programs up-to-date and to run them regularly, as this can prevent a great deal of spyware hassle.

3) Please consider using an alternate browser. Mozilla's Firefox browser is fantastic; it is much more secure than Internet Explorer, immune to almost all known browser hijackers, and also has the best built-in popup blocker (as an added benefit!) that I have ever seen. If you are interested, Firefox may be downloaded from here:
[You must be registered and logged in to see this link.]
I also recommand the following add-ons for Firefox, they will help keep you safe from malicious scripts or activeX exploits.
[You must be registered and logged in to see this link.]
[You must be registered and logged in to see this link.]
[You must be registered and logged in to see this link.]

4) Also make sure to run your antivirus software regularly, and to keep it up-to-date.

To help you keep your software updated, please considering using this free software program that will check for program updates.
[You must be registered and logged in to see this link.]

5) Finally, consider maintaining a firewall. Some good free firewalls are [You must be registered and logged in to see this link.], or
[You must be registered and logged in to see this link.]
A tutorial on understanding and using firewalls may be found [You must be registered and logged in to see this link.].

Please also read Tony Klein's excellent article: [You must be registered and logged in to see this link.]

If you would take a moment to fill out our feedback form, we would appreciate it.
The link can be found [You must be registered and logged in to see this link.].

Hopefully this should take care of your problems! Good luck. Big Grin


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34918
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : 7 Home Premium x64
Points Points : 245101
# Likes # Likes : 1

View user profile

Back to top Go down

View previous topic View next topic Back to top

- Similar topics

 
Permissions in this forum:
You cannot reply to topics in this forum