Major Computer Problems

View previous topic View next topic Go down

Solved Major Computer Problems

Post by kcbiggerstaff on Sun Dec 14, 2008 7:10 pm

Major popups, system will shut down, etc. It also is putting popups on my desktop for porn sites that it will not let me remove. HELP!!!! I have something in my program files called Embassy Security Suite, which I am not familar with.....Did I mention I need help!!!








Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:05:39, on 12/14/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Safe mode with network support

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Documents and Settings\kbiggerstaff\Local Settings\Temporary Internet Files\Content.IE5\GHY3C5EJ\Hijack(GP)This[1].exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Monroe County School District
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy.mcs.monroe.k12.ky.us:80
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.monroe.k12.ky.us;*.ketsmail.us;
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet
O4 - HKLM\..\Run: [NVHotkey] rundll32.exe nvHotkey.dll,Start
O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"
O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [Synchronization Manager] %SystemRoot%\system32\mobsync.exe /logon
O4 - HKLM\..\Run: [WinVNC] "C:\Program Files\RealVNC\WinVNC\WinVNC.exe" -servicehelper
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Antivirus Pro 2009] "C:\Program Files\AntivirusPro2009\AntivirusPro2009.exe" /hide
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [brastk] brastk.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_0
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [SVCHOST.EXE] C:\WINDOWS\system32\drivers\svchost.exe
O4 - HKCU\..\Run: [msiexec.exe] ~.exe
O4 - Startup: LimeWire On Startup.lnk = C:\Program Files\LimeWire\LimeWire.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - [You must be registered and logged in to see this link.]
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.tes.monroe.k12.ky.us
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - [You must be registered and logged in to see this link.]
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = monroe.ketsds.net
O17 - HKLM\Software\..\Telephony: DomainName = monroe.ketsds.net
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = monroe.ketsds.net
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = monroe.ketsds.net
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - Network Associates, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
O23 - Service: Network Associates McShield (McShield) - McAfee, Inc. - C:\Program Files\Network Associates\VirusScan\Mcshield.exe
O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: VNC Server (winvnc) - RealVNC Ltd. - C:\Program Files\RealVNC\WinVNC\WinVNC.exe
O23 - Service: Intel(R) PROSet/Wireless SSO Service (WLANKEEPER) - Intel(R) Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe

--
End of file - 5456 bytes

kcbiggerstaff
Novice
Novice

Posts Posts : 24
Joined Joined : 2008-12-14
OS OS : Windows XP
Points Points : 29140
# Likes # Likes : 0

View user profile

Back to top Go down

Solved Re: Major Computer Problems

Post by kcbiggerstaff on Sun Dec 14, 2008 7:15 pm

Here is my unistall list:


Adobe Flash Player 9 ActiveX
Adobe Flash Player ActiveX
Adobe Reader 7.0
Adobe Shockwave Player
Apple Software Update
Conexant HDA D110 MDC V.92 Modem
Dell ResourceCD
High Definition Audio Driver Package - KB835221
HijackThis 2.0.2
Hotfix for Windows XP (KB926239)
Image Resizer Powertoy for Windows XP
Intel(R) PROSet/Wireless Software
Java(TM) 6 Update 3
KETS Enterprise VPN
LimeWire 4.18.3
Macromedia Dreamweaver MX 2004
Macromedia Extension Manager
Malwarebytes' Anti-Malware
McAfee VirusScan Enterprise
mCore
mDriver
mDrWiFi
mHlpDell
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Office Professional Edition 2003
Microsoft User-Mode Driver Framework Feature Pack 1.0
mIWA
mLogView
mMHouse
mPfMgr
mPfWiz
mProSafe
MSN Music Assistant
mSSO
mWlsSafe
mWMI
mXML
MySQL Connector/ODBC 3.51
mZConfig
NVIDIA Drivers
PrimoPDF
PrimoPDF Redistribution Package
QuickTime
SDT
Security Update for Windows Media Player (KB911564)
Security Update for Windows Media Player 10 (KB917734)
Security Update for Windows Media Player 9 (KB917734)
Security Update for Windows XP (KB883939)
Security Update for Windows XP (KB890046)
Security Update for Windows XP (KB893066)
Security Update for Windows XP (KB893756)
Security Update for Windows XP (KB896358)
Security Update for Windows XP (KB896422)
Security Update for Windows XP (KB896423)
Security Update for Windows XP (KB896424)
Security Update for Windows XP (KB896428)
Security Update for Windows XP (KB896688)
Security Update for Windows XP (KB899587)
Security Update for Windows XP (KB899588)
Security Update for Windows XP (KB899589)
Security Update for Windows XP (KB899591)
Security Update for Windows XP (KB900725)
Security Update for Windows XP (KB901017)
Security Update for Windows XP (KB901214)
Security Update for Windows XP (KB902400)
Security Update for Windows XP (KB903235)
Security Update for Windows XP (KB904706)
Security Update for Windows XP (KB905414)
Security Update for Windows XP (KB905749)
Security Update for Windows XP (KB905915)
Security Update for Windows XP (KB908519)
Security Update for Windows XP (KB911562)
Security Update for Windows XP (KB911567)
Security Update for Windows XP (KB911927)
Security Update for Windows XP (KB912812)
Security Update for Windows XP (KB912919)
Security Update for Windows XP (KB913433)
Security Update for Windows XP (KB913446)
Security Update for Windows XP (KB913580)
Security Update for Windows XP (KB914388)
Security Update for Windows XP (KB914389)
Security Update for Windows XP (KB916281)
Security Update for Windows XP (KB917159)
Security Update for Windows XP (KB917344)
Security Update for Windows XP (KB917422)
Security Update for Windows XP (KB917953)
Security Update for Windows XP (KB918439)
Security Update for Windows XP (KB918899)
Security Update for Windows XP (KB919007)
Security Update for Windows XP (KB920213)
Security Update for Windows XP (KB920214)
Security Update for Windows XP (KB920670)
Security Update for Windows XP (KB920683)
Security Update for Windows XP (KB920685)
Security Update for Windows XP (KB921398)
Security Update for Windows XP (KB921883)Security Update for Windows XP (KB922616)
Security Update for Windows XP (KB922760)
Security Update for Windows XP (KB922819)
Security Update for Windows XP (KB923191)
Security Update for Windows XP (KB923414)
Security Update for Windows XP (KB923980)
Security Update for Windows XP (KB924191)
Security Update for Windows XP (KB924270)
Security Update for Windows XP (KB924496)
Security Update for Windows XP (KB925486)
SigmaTel Audio
Update for Windows XP (KB894391)
Update for Windows XP (KB896727)
Update for Windows XP (KB898461)
Update for Windows XP (KB900485)
Update for Windows XP (KB908531)
Update for Windows XP (KB910437)
Update for Windows XP (KB911280)
Update for Windows XP (KB916595)
Update for Windows XP (KB920872)
Update for Windows XP (KB922582)
Video DVD Maker v1.14.0.108
Virtools 3D Life Player
VNC 3.3.7
Windows Driver Package - Ricoh Company Memorystick Host Controller (07/09/2005 1.00.01.12)
Windows Driver Package - Ricoh Company MMC Host Controller (07/14/2005 1.00.00.06)
Windows Driver Package - Ricoh Company xD-Picture Card/SmartMedia Host Controller (07/14/2005 1.00.02.04)
Windows Installer 3.1 (KB893803)
Windows Media Format 11 runtime
Windows Media Format 11 runtime
Windows Media Player 11
Windows Media Player 11
Windows XP Hotfix - KB867282
Windows XP Hotfix - KB873333
Windows XP Hotfix - KB873339
Windows XP Hotfix - KB885250
Windows XP Hotfix - KB885835Windows XP Hotfix - KB885836
Windows XP Hotfix - KB886185
Windows XP Hotfix - KB887472
Windows XP Hotfix - KB887742
Windows XP Hotfix - KB888113
Windows XP Hotfix - KB888302
Windows XP Hotfix - KB890047
Windows XP Hotfix - KB890175
Windows XP Hotfix - KB890859
Windows XP Hotfix - KB890923
Windows XP Hotfix - KB891781
Windows XP Hotfix - KB893086
WMV To VCD DVD MPEG Converter 4.0

kcbiggerstaff
Novice
Novice

Posts Posts : 24
Joined Joined : 2008-12-14
OS OS : Windows XP
Points Points : 29140
# Likes # Likes : 0

View user profile

Back to top Go down

Solved Re: Major Computer Problems

Post by Belahzur on Sun Dec 14, 2008 7:39 pm

Hello.


  • Download combofix from here, use the top links - [You must be registered and logged in to see this link.]
  • Double click on ComboFix.exe.
  • Follow the prompts. NOTE:
  • ComboFix will check to see if the Microsoft Windows Recovery Console is installed.
    ***It's strongly recommended to have the Recovery Console installed before doing any malware removal.***

    **Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will automatically proceed with its scan.


  • The Recovery Console provides a recovery/repair mode should a problem occur during a Combofix run.



  • Allow ComboFix to download the Recovery Console.
  • Accept the End-User License Agreement.
  • The Recovery Console will be installed.
  • You will this next prompt that asks if you want to continue the malware scan, select yes



  • Allow combofix to run
  • Post C:\combofix.txt back here.

    Note:
    Do not mouseclick combofix's window whilst it's running. That may cause it to stall.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34916
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : XP SP3 Media Centre
Points Points : 245069
# Likes # Likes : 1

View user profile

Back to top Go down

Solved Re: Major Computer Problems

Post by kcbiggerstaff on Sun Dec 14, 2008 8:21 pm

I can't get combofix to download ... it says "error you cannot rename combofix...use alphnumeric keys..."

kcbiggerstaff
Novice
Novice

Posts Posts : 24
Joined Joined : 2008-12-14
OS OS : Windows XP
Points Points : 29140
# Likes # Likes : 0

View user profile

Back to top Go down

Solved Re: Major Computer Problems

Post by Belahzur on Sun Dec 14, 2008 8:26 pm

Hello.


  • Open HijackThis
  • Choose "Do a system scan only"
  • Check the boxes in front of these lines:


    O4 - HKLM\..\Run: [Antivirus Pro 2009] "C:\Program Files\AntivirusPro2009\AntivirusPro2009.exe" /hide
    O4 - HKLM\..\Run: [brastk] brastk.exe
    O4 - HKCU\..\Run: [SVCHOST.EXE] C:\WINDOWS\system32\drivers\svchost.exe
    O4 - HKCU\..\Run: [msiexec.exe] ~.exe
    O4 - Startup: LimeWire On Startup.lnk = C:\Program Files\LimeWire\LimeWire.exe


  • Press "Fix Checked"
  • Close Hijack This.




1. Please download The Avenger by Swandog46 to your Desktop
Link: [You must be registered and logged in to see this link.].

  • Click on Avenger.zip to open the file
  • Extract avenger.exe to your desktop
2. Copy all the text contained in the code box below to your Clipboard by highlighting it and pressing (Ctrl+CCrying


Files to delete:
C:\WINDOWS\system32\brastk.exe
C:\WINDOWS\system32\~.exe
C:\WINDOWS\system32\drivers\svchost.exe

Folders to delete:
C:\Program Files\AntivirusPro2009

Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.


3. Now, start The Avenger program by clicking on its icon on your desktop.

  • Under "Input script here:", paste in the script from the quote box above.
  • Leave the ticked box "Scan for rootkit" ticked.
  • Then tick "Disable any rootkits found"
  • Now click on the Execute to begin execution of the script.
  • Answer "Yes" twice when prompted.

    The Avenger will automatically do the following:

  • It will Restart your computer.
  • On reboot, it will briefly open a black command window on your desktop, this is normal.
  • After the restart, it creates a log file that should open with the results of Avengerís actions. This log file will be located at C:\avenger.txt
  • The Avenger will also have backed up all the files, etc., that you asked it to delete, and will have zipped them and moved the zip archives to C:\avenger\backup.zip.
5. Please copy/paste the content of c:\avenger.txt into your reply.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34916
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : XP SP3 Media Centre
Points Points : 245069
# Likes # Likes : 1

View user profile

Back to top Go down

Solved Re: Major Computer Problems

Post by kcbiggerstaff on Sun Dec 14, 2008 8:36 pm

I got Combofix to run. Here is the contents of the log:
ComboFix 08-12-14.02 - kbiggerstaff 2008-12-14 14:27:37.1 - NTFSx86 NETWORK
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.2046.1747 [GMT -6:00]
Running from: c:\documents and settings\kbiggerstaff\Desktop\ComboFix.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat
c:\documents and settings\kbiggerstaff\Cookies\cadykiw.sys
c:\documents and settings\kbiggerstaff\Cookies\dyfuw.inf
c:\documents and settings\kbiggerstaff\Cookies\izynax.ban
c:\documents and settings\kbiggerstaff\Cookies\tanaqab.inf
c:\documents and settings\kbiggerstaff\Cookies\wuzob.scr
c:\documents and settings\kbiggerstaff\Cookies\ynutofur.ban
c:\documents and settings\kbiggerstaff\Local Settings\Temporary Internet Files\huragyte.dat
c:\documents and settings\kbiggerstaff\Local Settings\Temporary Internet Files\mekebaq.lib
c:\documents and settings\kbiggerstaff\Local Settings\Temporary Internet Files\zoweji._sy
c:\windows\brastk.exe
c:\windows\Downloaded Program Files\setup.inf
c:\windows\IE4 Error Log.txt
c:\windows\system32\~.exe
c:\windows\system32\404Fix.exe
c:\windows\system32\digeste.dll
c:\windows\system32\dllcache\beep.sys
c:\windows\system32\dllcache\figaro.sys
c:\windows\system32\dumphive.exe
c:\windows\system32\IEDFix.C.exe
c:\windows\system32\IEDFix.exe
c:\windows\system32\o4Patch.exe
c:\windows\system32\Process.exe
c:\windows\system32\SrchSTS.exe
c:\windows\system32\tmp.reg
c:\windows\system32\VACFix.exe
c:\windows\system32\VCCLSID.exe
c:\windows\system32\wini10891.exe
c:\windows\wiaserviv.log

----- BITS: Possible infected sites -----

[You must be registered and logged in to see this link.]
.
((((((((((((((((((((((((( Files Created from 2008-11-14 to 2008-12-14 )))))))))))))))))))))))))))))))
.

2008-12-14 11:29 . 2008-12-12 00:57 78,336 --a------ c:\windows\system32\Agent.OMZ.Fix.exe
2008-12-14 10:21 . 2008-12-14 10:21 d-------- c:\program files\Malwarebytes' Anti-Malware
2008-12-14 10:21 . 2008-12-14 10:21 d-------- c:\documents and settings\kbiggerstaff\Application Data\Malwarebytes
2008-12-14 10:21 . 2008-12-14 10:21 d-------- c:\documents and settings\All Users\Application Data\Malwarebytes
2008-12-14 10:21 . 2008-12-03 19:59 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
2008-12-14 10:21 . 2008-12-03 19:59 15,504 --a------ c:\windows\system32\drivers\mbam.sys
2008-12-14 09:51 . 2008-12-14 09:51 d-------- c:\documents and settings\kbiggerstaff\Application Data\SecurityCenter
2008-12-14 09:00 . 2008-12-14 09:00 d-------- c:\windows\5DF3D1BB894E4DCD8275159AC9829B43.TMP
2008-12-14 08:59 . 2008-12-14 08:59 19,136 --a------ c:\documents and settings\kbiggerstaff\Application Data\lojo.reg
2008-12-14 08:59 . 2008-12-14 08:59 17,920 --a------ c:\program files\Common Files\podikybiny.bin
2008-12-14 08:59 . 2008-12-14 08:59 17,909 --a------ c:\windows\ewam._dl
2008-12-14 08:59 . 2008-12-14 08:59 17,796 --a------ c:\windows\emadaxyg.dll
2008-12-14 08:59 . 2008-12-14 08:59 17,776 --a------ c:\windows\system32\pepysi.exe
2008-12-14 08:59 . 2008-12-14 08:59 17,496 --a------ c:\windows\xiwarixo.bat
2008-12-14 08:59 . 2008-12-14 08:59 17,459 --a------ c:\windows\system32\sujawy.vbs
2008-12-14 08:59 . 2008-12-14 08:59 16,436 --a------ c:\windows\ukexi.dat
2008-12-14 08:59 . 2008-12-14 08:59 16,141 --a------ c:\windows\qopu.lib
2008-12-14 08:59 . 2008-12-14 08:59 15,248 --a------ c:\windows\system32\rolyxos.bin
2008-12-14 08:59 . 2008-12-14 08:59 13,568 --a------ c:\documents and settings\All Users\Application Data\yvazek.scr
2008-12-14 08:59 . 2008-12-14 08:59 13,249 --a------ c:\windows\hapybiqy.vbs
2008-12-14 08:59 . 2008-12-14 08:59 11,163 --a------ c:\program files\Common Files\yjylo.dll
2008-12-14 08:59 . 2008-12-14 08:59 11,003 --a------ c:\windows\system32\alaqycyqo.lib
2008-12-14 08:26 . 2008-10-16 14:09 31,768 --a------ c:\windows\system32\wucltui.dll.mui
2008-12-14 08:26 . 2008-10-16 14:07 23,576 --a------ c:\windows\system32\wuaucpl.cpl.mui
2008-12-14 08:26 . 2008-10-16 14:07 23,576 --a------ c:\windows\system32\wuapi.dll.mui
2008-12-14 08:26 . 2008-10-16 14:07 18,456 --a------ c:\windows\system32\wuaueng.dll.mui
2008-12-13 22:50 . 2008-12-14 13:04 d-------- c:\program files\Extra Antivir
2008-12-13 22:50 . 2008-12-13 22:50 d-------- c:\documents and settings\kbiggerstaff\Application Data\s_6002_fHx8fHx8fDEyNDE4MTMwNTZ8_
2008-12-06 16:35 . 2008-12-06 16:35 31,744 --a------ c:\documents and settings\kbiggerstaff\~.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-12-14 15:50 --------- d-----w c:\program files\AntivirusPro2009
2008-12-12 15:59 --------- d-----w c:\documents and settings\kbiggerstaff\Application Data\Video DVD Maker PRO
2008-11-16 14:36 1,739 ----a-w c:\windows\Sysvxd.exe
2008-11-13 11:13 18,907 ----a-w c:\windows\ocydaz.com
2008-11-13 11:13 17,440 ----a-w c:\windows\decicu.vbs
2008-11-04 20:21 --------- d-----w c:\program files\Google
2008-10-26 15:17 --------- d-----w c:\program files\Windows Media Connect 2
2008-10-16 20:13 1,809,944 ----a-w c:\windows\system32\wuaueng.dll
2008-10-16 20:12 561,688 ----a-w c:\windows\system32\wuapi.dll
2008-10-16 20:12 323,608 ----a-w c:\windows\system32\wucltui.dll
2008-10-16 20:12 202,776 ----a-w c:\windows\system32\wuweb.dll
2008-10-16 20:09 92,696 ----a-w c:\windows\system32\cdm.dll
2008-10-16 20:09 51,224 ----a-w c:\windows\system32\wuauclt.exe
2008-10-16 20:09 43,544 ----a-w c:\windows\system32\wups2.dll
2008-10-16 20:08 34,328 ----a-w c:\windows\system32\wups.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]
"updateMgr"="c:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2004-11-22 307200]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2004-10-13 1694208]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-03-21 7557120]
"IntelZeroConfig"="c:\program files\Intel\Wireless\bin\ZCfgSvc.exe" [2005-12-28 667718]
"IntelWireless"="c:\program files\Intel\Wireless\Bin\ifrmewrk.exe" [2005-12-28 602182]
"Synchronization Manager"="c:\windows\system32\mobsync.exe" [2004-08-04 143360]
"WinVNC"="c:\program files\RealVNC\WinVNC\WinVNC.exe" [2003-03-05 335872]
"McAfeeUpdaterUI"="c:\program files\Network Associates\Common Framework\UpdaterUI.exe" [2004-06-15 135224]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 132496]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-04-03 413696]
"Antivirus Pro 2009"="c:\program files\AntivirusPro2009\AntivirusPro2009.exe" [2008-11-22 597372]
"ShStatEXE"="c:\program files\Network Associates\VirusScan\SHSTAT.EXE" [2004-09-22 98304]
"nwiz"="nwiz.exe" [2006-03-21 c:\windows\system32\nwiz.exe]
"NVHotkey"="nvHotkey.dll" [2006-03-21 c:\windows\system32\nvhotkey.dll]
"SigmatelSysTrayApp"="stsystra.exe" [2006-03-24 c:\windows\stsystra.exe]

c:\documents and settings\kbiggerstaff\Start Menu\Programs\Startup\
LimeWire On Startup.lnk - c:\program files\LimeWire\LimeWire.exe [2008-06-18 147456]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 29696]
Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2006-09-11 24576]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"DisablePersonalDirChange"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\Machine\scripts\Startup\0\0]
"script"=checkuser.vbs

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\Machine\scripts\Startup\1\0]
"script"=MONROEDSA.VBS

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\Machine\scripts\Startup\2\0]
"script"=Create_TrackUsrDir.vbs

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\Machine\scripts\Startup\2\1]
"script"=CompInv_MySQL.vbs

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-633537362-1140134473-879972363-1402\scripts\Logoff\0\0]
"script"=usrLogOff.vbs

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-633537362-1140134473-879972363-1402\scripts\Logon\0\0]
"script"=usrLogon.vbs

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-633537362-1140134473-879972363-5705\scripts\Logoff\0\0]
"script"=usrLogOff.vbs

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-633537362-1140134473-879972363-5705\scripts\Logon\0\0]
"script"=usrLogon.vbs

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-633537362-1140134473-879972363-5705\scripts\Logon\0\1]
"script"=CompInv_MySQL.vbs

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009

R1 NaiAvTdi1;NaiAvTdi1;c:\windows\system32\drivers\mvstdi5x.sys [2006-09-29 59904]
R3 Eacfilt;Eacfilt Miniport;c:\windows\system32\DRIVERS\eacfilt.sys [2006-09-29 9817]
S2 IPSECEXT;Nortel Extranet Access Protocol;c:\windows\system32\DRIVERS\ipsecw2k.sys [2006-09-29 117760]
S3 MBAMSwissArmy;MBAMSwissArmy;\??\c:\windows\system32\drivers\mbamswissarmy.sys [2008-12-14 38496]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\E]
\Shell\AutoRun\command - E:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{91bfa967-b368-11dc-aabe-444553544200}]
\Shell\AutoRun\command - E:\Autorun.exe /run
\Shell\Shell00\Command - E:\Autorun.exe /run
\Shell\Shell01\Command - E:\Autorun.exe /action
\Shell\Shell02\Command - E:\Autorun.exe /uninstall

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9ba23b58-5d14-11dd-aad8-444553544200}]
\Shell\AutoRun\command - E:\LaunchU3.exe -a

*Newly Created Service* - CATCHME
*Newly Created Service* - MDMXSDK
*Newly Created Service* - PROCEXP90
.
Contents of the 'Scheduled Tasks' folder

2008-12-05 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 14:57]

2008-12-14 c:\windows\Tasks\SDMsgUpdate (TE).job
- c:\progra~1\SMARTD~1\Messages\SDNotify.exe [2008-08-11 06:29]
.
- - - - ORPHANS REMOVED - - - -

HKCU-Run-msiexec.exe - ~.exe


.
------- Supplementary Scan -------
.
uStart Page = [You must be registered and logged in to see this link.]
mStart Page = [You must be registered and logged in to see this link.]
uInternet Settings,ProxyServer = proxy.mcs.monroe.k12.ky.us:80
uInternet Settings,ProxyOverride = *.monroe.k12.ky.us;*.ketsmail.us;
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, [You must be registered and logged in to see this link.]
Rootkit scan 2008-12-14 14:29:10
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-12-14 14:30:06
ComboFix-quarantined-files.txt 2008-12-14 20:29:31

Pre-Run: 85,550,821,376 bytes free
Post-Run: 87,341,711,360 bytes free

197

kcbiggerstaff
Novice
Novice

Posts Posts : 24
Joined Joined : 2008-12-14
OS OS : Windows XP
Points Points : 29140
# Likes # Likes : 0

View user profile

Back to top Go down

Solved Re: Major Computer Problems

Post by kcbiggerstaff on Sun Dec 14, 2008 8:37 pm

I am not going to do the other things until I here from you since Combofix worked this time.....let me know what I need to do next.

kcbiggerstaff
Novice
Novice

Posts Posts : 24
Joined Joined : 2008-12-14
OS OS : Windows XP
Points Points : 29140
# Likes # Likes : 0

View user profile

Back to top Go down

Solved Re: Major Computer Problems

Post by Belahzur on Sun Dec 14, 2008 8:43 pm

Now open a new notepad file.
Input this into the notepad file:

File::
c:\program files\Common Files\podikybiny.bin
c:\windows\ewam._dl
c:\windows\emadaxyg.dll
c:\windows\system32\pepysi.exe
c:\windows\xiwarixo.bat
c:\windows\system32\sujawy.vbs
c:\windows\ukexi.dat
c:\windows\qopu.lib
c:\windows\system32\rolyxos.bin
c:\documents and settings\All Users\Application Data\yvazek.scr
c:\windows\hapybiqy.vbs
c:\program files\Common Files\yjylo.dll
c:\windows\system32\alaqycyqo.lib
c:\documents and settings\kbiggerstaff\~.exe
c:\windows\Sysvxd.exe
c:\windows\ocydaz.com
c:\windows\decicu.vbs

Folder::
c:\documents and settings\kbiggerstaff\Application Data\SecurityCenter
c:\program files\AntivirusPro2009
c:\program files\Extra Antivir

Registry::
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Antivirus Pro 2009"=-
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"DisablePersonalDirChange"=-
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{91bfa967-b368-11dc-aabe-444553544200}]

Save this as CFScript.txt, save it to your desktop also.
Then drag and drop CFScript.txt into combofix as seen below:


This will open combofix.exe again, agree to it's terms and allow it to run, it may want to reboot after it's done. Post the resulting log back here.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34916
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : XP SP3 Media Centre
Points Points : 245069
# Likes # Likes : 1

View user profile

Back to top Go down

Solved Re: Major Computer Problems

Post by kcbiggerstaff on Sun Dec 14, 2008 8:56 pm

Here it is:::

ComboFix 08-12-14.02 - kbiggerstaff 2008-12-14 14:51:39.2 - NTFSx86 NETWORK
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.2046.1755 [GMT -6:00]
Running from: c:\documents and settings\kbiggerstaff\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\kbiggerstaff\Desktop\CFscript.txt

FILE ::
c:\documents and settings\All Users\Application Data\yvazek.scr
c:\documents and settings\kbiggerstaff\~.exe
c:\program files\Common Files\podikybiny.bin
c:\program files\Common Files\yjylo.dll
c:\windows\decicu.vbs
c:\windows\emadaxyg.dll
c:\windows\ewam._dl
c:\windows\hapybiqy.vbs
c:\windows\ocydaz.com
c:\windows\qopu.lib
c:\windows\system32\alaqycyqo.lib
c:\windows\system32\pepysi.exe
c:\windows\system32\rolyxos.bin
c:\windows\system32\sujawy.vbs
c:\windows\Sysvxd.exe
c:\windows\ukexi.dat
c:\windows\xiwarixo.bat
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users\Application Data\yvazek.scr
c:\documents and settings\kbiggerstaff\~.exe
c:\documents and settings\kbiggerstaff\Application Data\SecurityCenter
c:\documents and settings\kbiggerstaff\Application Data\SecurityCenter\Extra Antivir.ini
c:\program files\AntivirusPro2009
c:\program files\AntivirusPro2009\AntivirusPro2009.exe
c:\program files\AntivirusPro2009\AVEngn.dll
c:\program files\AntivirusPro2009\Uninstall.exe
c:\program files\Common Files\podikybiny.bin
c:\program files\Common Files\yjylo.dll
c:\program files\Extra Antivir
c:\program files\Extra Antivir\Uninstall.exe
c:\windows\decicu.vbs
c:\windows\emadaxyg.dll
c:\windows\ewam._dl
c:\windows\hapybiqy.vbs
c:\windows\ocydaz.com
c:\windows\qopu.lib
c:\windows\system32\alaqycyqo.lib
c:\windows\system32\pepysi.exe
c:\windows\system32\rolyxos.bin
c:\windows\system32\sujawy.vbs
c:\windows\Sysvxd.exe
c:\windows\ukexi.dat
c:\windows\xiwarixo.bat

.
((((((((((((((((((((((((( Files Created from 2008-11-14 to 2008-12-14 )))))))))))))))))))))))))))))))
.

2008-12-14 11:29 . 2008-12-12 00:57 78,336 --a------ c:\windows\system32\Agent.OMZ.Fix.exe
2008-12-14 10:21 . 2008-12-14 10:21 d-------- c:\program files\Malwarebytes' Anti-Malware
2008-12-14 10:21 . 2008-12-14 10:21 d-------- c:\documents and settings\kbiggerstaff\Application Data\Malwarebytes
2008-12-14 10:21 . 2008-12-14 10:21 d-------- c:\documents and settings\All Users\Application Data\Malwarebytes
2008-12-14 10:21 . 2008-12-03 19:59 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
2008-12-14 10:21 . 2008-12-03 19:59 15,504 --a------ c:\windows\system32\drivers\mbam.sys
2008-12-14 09:00 . 2008-12-14 09:00 d-------- c:\windows\5DF3D1BB894E4DCD8275159AC9829B43.TMP
2008-12-14 08:59 . 2008-12-14 08:59 19,136 --a------ c:\documents and settings\kbiggerstaff\Application Data\lojo.reg
2008-12-14 08:26 . 2008-10-16 14:09 31,768 --a------ c:\windows\system32\wucltui.dll.mui
2008-12-14 08:26 . 2008-10-16 14:07 23,576 --a------ c:\windows\system32\wuaucpl.cpl.mui
2008-12-14 08:26 . 2008-10-16 14:07 23,576 --a------ c:\windows\system32\wuapi.dll.mui
2008-12-14 08:26 . 2008-10-16 14:07 18,456 --a------ c:\windows\system32\wuaueng.dll.mui
2008-12-13 22:50 . 2008-12-13 22:50 d-------- c:\documents and settings\kbiggerstaff\Application Data\s_6002_fHx8fHx8fDEyNDE4MTMwNTZ8_

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-12-12 15:59 --------- d-----w c:\documents and settings\kbiggerstaff\Application Data\Video DVD Maker PRO
2008-11-04 20:21 --------- d-----w c:\program files\Google
2008-10-26 15:17 --------- d-----w c:\program files\Windows Media Connect 2
2008-10-16 20:13 1,809,944 ----a-w c:\windows\system32\wuaueng.dll
2008-10-16 20:12 561,688 ----a-w c:\windows\system32\wuapi.dll
2008-10-16 20:12 323,608 ----a-w c:\windows\system32\wucltui.dll
2008-10-16 20:12 202,776 ----a-w c:\windows\system32\wuweb.dll
2008-10-16 20:09 92,696 ----a-w c:\windows\system32\cdm.dll
2008-10-16 20:09 51,224 ----a-w c:\windows\system32\wuauclt.exe
2008-10-16 20:09 43,544 ----a-w c:\windows\system32\wups2.dll
2008-10-16 20:08 34,328 ----a-w c:\windows\system32\wups.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]
"updateMgr"="c:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2004-11-22 307200]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2004-10-13 1694208]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-03-21 7557120]
"IntelZeroConfig"="c:\program files\Intel\Wireless\bin\ZCfgSvc.exe" [2005-12-28 667718]
"IntelWireless"="c:\program files\Intel\Wireless\Bin\ifrmewrk.exe" [2005-12-28 602182]
"Synchronization Manager"="c:\windows\system32\mobsync.exe" [2004-08-04 143360]
"WinVNC"="c:\program files\RealVNC\WinVNC\WinVNC.exe" [2003-03-05 335872]
"McAfeeUpdaterUI"="c:\program files\Network Associates\Common Framework\UpdaterUI.exe" [2004-06-15 135224]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 132496]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-04-03 413696]
"ShStatEXE"="c:\program files\Network Associates\VirusScan\SHSTAT.EXE" [2004-09-22 98304]
"nwiz"="nwiz.exe" [2006-03-21 c:\windows\system32\nwiz.exe]
"NVHotkey"="nvHotkey.dll" [2006-03-21 c:\windows\system32\nvhotkey.dll]
"SigmatelSysTrayApp"="stsystra.exe" [2006-03-24 c:\windows\stsystra.exe]

c:\documents and settings\kbiggerstaff\Start Menu\Programs\Startup\
LimeWire On Startup.lnk - c:\program files\LimeWire\LimeWire.exe [2008-06-18 147456]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 29696]
Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2006-09-11 24576]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\Machine\scripts\Startup\0\0]
"script"=checkuser.vbs

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\Machine\scripts\Startup\1\0]
"script"=MONROEDSA.VBS

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\Machine\scripts\Startup\2\0]
"script"=Create_TrackUsrDir.vbs

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\Machine\scripts\Startup\2\1]
"script"=CompInv_MySQL.vbs

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-633537362-1140134473-879972363-1402\scripts\Logoff\0\0]
"script"=usrLogOff.vbs

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-633537362-1140134473-879972363-1402\scripts\Logon\0\0]
"script"=usrLogon.vbs

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-633537362-1140134473-879972363-5705\scripts\Logoff\0\0]
"script"=usrLogOff.vbs

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-633537362-1140134473-879972363-5705\scripts\Logon\0\0]
"script"=usrLogon.vbs

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-633537362-1140134473-879972363-5705\scripts\Logon\0\1]
"script"=CompInv_MySQL.vbs

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009

R1 NaiAvTdi1;NaiAvTdi1;c:\windows\system32\drivers\mvstdi5x.sys [2006-09-29 59904]
R3 Eacfilt;Eacfilt Miniport;c:\windows\system32\DRIVERS\eacfilt.sys [2006-09-29 9817]
S2 IPSECEXT;Nortel Extranet Access Protocol;c:\windows\system32\DRIVERS\ipsecw2k.sys [2006-09-29 117760]
S3 MBAMSwissArmy;MBAMSwissArmy;\??\c:\windows\system32\drivers\mbamswissarmy.sys [2008-12-14 38496]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\E]
\Shell\AutoRun\command - E:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9ba23b58-5d14-11dd-aad8-444553544200}]
\Shell\AutoRun\command - E:\LaunchU3.exe -a

*Newly Created Service* - CATCHME
*Newly Created Service* - MDMXSDK
*Newly Created Service* - PROCEXP90
.
Contents of the 'Scheduled Tasks' folder

2008-12-05 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 14:57]

2008-12-14 c:\windows\Tasks\SDMsgUpdate (TE).job
- c:\progra~1\SMARTD~1\Messages\SDNotify.exe [2008-08-11 06:29]
.
.
------- Supplementary Scan -------
.
uStart Page = [You must be registered and logged in to see this link.]
mStart Page = [You must be registered and logged in to see this link.]
uInternet Settings,ProxyServer = proxy.mcs.monroe.k12.ky.us:80
uInternet Settings,ProxyOverride = *.monroe.k12.ky.us;*.ketsmail.us;
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, [You must be registered and logged in to see this link.]
Rootkit scan 2008-12-14 14:52:48
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(1552)
c:\windows\system32\RASAPI32.dll
.
Completion time: 2008-12-14 14:54:14
ComboFix-quarantined-files.txt 2008-12-14 20:53:29
ComboFix2.txt 2008-12-14 20:30:07

Pre-Run: 87,430,897,664 bytes free
Post-Run: 87,431,688,192 bytes free

184

kcbiggerstaff
Novice
Novice

Posts Posts : 24
Joined Joined : 2008-12-14
OS OS : Windows XP
Points Points : 29140
# Likes # Likes : 0

View user profile

Back to top Go down

Solved Re: Major Computer Problems

Post by Belahzur on Sun Dec 14, 2008 8:57 pm

Looks good, what problems remain? Smile


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34916
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : XP SP3 Media Centre
Points Points : 245069
# Likes # Likes : 1

View user profile

Back to top Go down

Solved Re: Major Computer Problems

Post by kcbiggerstaff on Sun Dec 14, 2008 8:59 pm

Let me restart and I will get back to you....

kcbiggerstaff
Novice
Novice

Posts Posts : 24
Joined Joined : 2008-12-14
OS OS : Windows XP
Points Points : 29140
# Likes # Likes : 0

View user profile

Back to top Go down

Solved Re: Major Computer Problems

Post by kcbiggerstaff on Sun Dec 14, 2008 9:04 pm

Looks good now.....I put two of the porn site icons in the recycle bin and they didn't come back......popups are gone...

THANKS SO MUCH!!!!

kcbiggerstaff
Novice
Novice

Posts Posts : 24
Joined Joined : 2008-12-14
OS OS : Windows XP
Points Points : 29140
# Likes # Likes : 0

View user profile

Back to top Go down

Solved one last question

Post by kcbiggerstaff on Sun Dec 14, 2008 9:07 pm

Any suggestions on what I can get to keep this virus from coming back?

kcbiggerstaff
Novice
Novice

Posts Posts : 24
Joined Joined : 2008-12-14
OS OS : Windows XP
Points Points : 29140
# Likes # Likes : 0

View user profile

Back to top Go down

Solved Re: Major Computer Problems

Post by Belahzur on Sun Dec 14, 2008 10:04 pm

Will post some tips soon, but first, this.

Your version of Java is outdated and needs to be updated to take advantage of fixes that have eliminated security vulnerabilities.
Updating Java:

  • Download the latest version of [You must be registered and logged in to see this link.].
  • Select the first option where it says "Java SE Runtime Environment (JRE) 6 Update 11".
  • Click the "Download" button to the right.
  • In the Window that opens, select your platform and language, check the "agree" box, and click Continue.
  • Click on the link to download Windows Offline Installation and save to your desktop.
  • Close any programs you may have running - especially your web browser.
  • Go to Start > Control Panel double-click on Add or Remove Programs and remove all older versions of Java.
  • Check any item with Java Runtime Environment (JRE or J2SE) in the name.
    - Examples of older versions in Add or Remove Programs:
    - Java 2 Runtime Environment, SE v1.4.2
    - J2SE Runtime Environment 5.0
    - J2SE Runtime Environment 5.0 Update 2
  • Click the Remove or Change/Remove button.
  • Repeat as many times as necessary to remove each Java versions.
  • Reboot your computer once all Java components are removed.
  • Then from your desktop double-click on jre-6u11-windows-i586-p.exe that you downloaded to install the newest version.
Please make sure the new version of Java is installed before you run JavaRa.

Please download JavaRa from [You must be registered and logged in to see this link.]

  • First, unzip it.
  • Then run JavaRa.
  • Select English from the drop down menu and press Select.
  • This will open JavaRa.
  • Press Remove older versions
  • Press yes to the prompt.
  • It will make a log file of what it's removed.
  • Copy and paste the log back here.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34916
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : XP SP3 Media Centre
Points Points : 245069
# Likes # Likes : 1

View user profile

Back to top Go down

Solved Re: Major Computer Problems

Post by Doctor Inferno on Sat Jan 17, 2009 10:29 am

Since this issue is resolved, this topic is closed.

If you need this topic reopened, please contact a staff member. This applies only to the original topic starter.

Everyone else, please open a new topic for your questions.


Please be a GeekPolice fan on [You must be registered and logged in to see this link.]



Have we helped you? [You must be registered and logged in to see this link.] | Doctor by day, ninja by night.

Doctor Inferno
Administrator
Administrator

Posts Posts : 12015
Joined Joined : 2007-12-26
Gender Gender : Male
OS OS : Windows 7 Home Premium and Ultimate X64
Protection Protection : Kaspersky PURE and Malwarebytes' Anti-Malware
Points Points : 104600
# Likes # Likes : 0

View user profile

Back to top Go down

View previous topic View next topic Back to top

- Similar topics

 
Permissions in this forum:
You cannot reply to topics in this forum