About to fix this with a hammer, help pls

View previous topic View next topic Go down

Solved About to fix this with a hammer, help pls

Post by kalyco on 18th December 2008, 6:37 pm

Hi there. I am new to this forum and site. i was referred to this place by my friend who says after comming here he was able to solve his trojan woes. Basically this little bugger disabled one of my antivirus programs, removed all system restore points and loves to spam ad pages on IE whenever i run anything. Here is the file:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:24:51 AM, on 12/18/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Apoint2K\Apoint.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Apoint2K\Apntex.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\notepad.exe
C:\Documents and Settings\Robert\Desktop\hijackgpthis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = [You must be registered and logged in to see this link.]
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = [You must be registered and logged in to see this link.]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = [You must be registered and logged in to see this link.]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = [You must be registered and logged in to see this link.]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = [You must be registered and logged in to see this link.]
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = [You must be registered and logged in to see this link.]
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = [You must be registered and logged in to see this link.]
O2 - BHO: {74e37f2e-11d0-6f79-daa4-002a0a90bd52} - {25db09a0-a200-4aad-97f6-0d11e2f73e47} - C:\WINDOWS\system32\uecdxp.dll
O2 - BHO: (no name) - {6D794CB4-C7CD-4c6f-BFDC-9B77AFBDC02C} - C:\WINDOWS\system32\mlJBQkIA.dll (file missing)
O2 - BHO: (no name) - {7182EF47-5143-4DE5-B712-DB98F12C9CD1} - C:\WINDOWS\system32\qoMeCsQi.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe /Start
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [gadcom] "C:\Documents and Settings\Robert\Application Data\gadcom\gadcom.exe" 61A847B5BBF72813329B385772FF01F0B3E35B6638993F4661AA4EBD86D67C56389B284534F310
O4 - HKCU\..\Run: [Twain] C:\Documents and Settings\Robert\Application Data\Twain\Twain.exe
O4 - Global Startup: BTTray.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Quicken Scheduled Updates.lnk = C:\Program Files\Quicken\bagent.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - [You must be registered and logged in to see this link.]
O8 - Extra context menu item: Send To &Bluetooth - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: *.spyguardpro.com (HKLM)
O16 - DPF: {6B75345B-AA36-438A-BBE6-4078B4C6984D} (HpProductDetection Class) - [You must be registered and logged in to see this link.]
O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} (HP Download Manager) - [You must be registered and logged in to see this link.]
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - [You must be registered and logged in to see this link.]
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: ,avgrsstx.dll uecdxp.dll
O20 - Winlogon Notify: mlJBQkIA - mlJBQkIA.dll (file missing)
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Bluetooth Service (btwdins) - WIDCOMM, Inc. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

--
End of file - 7853 bytes

here is the uninstall list


Ad-Aware 2007
Adobe Flash Player ActiveX
Adobe Reader 8.1.2
Adobe Shockwave Player
Agere Systems AC'97 Modem
ALPS Touch Pad Driver
Apple Mobile Device Support
Apple Software Update
ATI - Software Uninstall Utility
ATI Control Panel
ATI Display Driver
AVG Free 8.0
Avira AntiVir Personal - Free Antivirus
Bluetooth by hp
Broadcom 802.11 Driver
C-Force
DivX Codec
DivX Converter
DivX Player
DivX Web Player
DriverAgent by TouchStone Software
Easy Video Joiner 5.01
HijackThis 2.0.2
Hotfix for Windows Internet Explorer 7 (KB947864)
Hotfix for Windows XP (KB952287)
HP Product Detection
InterVideo WinDVD
iTunes
Java 2 Runtime Environment, SE v1.4.2_03
Java(TM) 6 Update 4
Java(TM) 6 Update 5
LimeWire 4.16.6
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Hotfix (KB928366)
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft National Language Support Downlevel APIs
Microsoft Office XP Professional with FrontPage
Microsoft User-Mode Driver Framework Feature Pack 1.0
muvee autoProducer DVD Edition - HPH
PCI 1620 Cardbus Controller and Software
Quick Launch Buttons 4.20 E1
Quicken 2004
QuickTime
RealPlayer
Realtek RTL8139/810x Fast Ethernet NIC Driver Setup
RecordNow!
Security Update for Windows Internet Explorer 7 (KB938127)
Security Update for Windows Internet Explorer 7 (KB942615)
Security Update for Windows Internet Explorer 7 (KB944533)
Security Update for Windows Internet Explorer 7 (KB950759)
Security Update for Windows Internet Explorer 7 (KB953838)
Security Update for Windows Media Player 9 (KB917734)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950760)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951698)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB953839)
Sonic Update Manager
SoundMAX
Update for Windows XP (KB951072-v2)
Ventrilo Client
VeohTV BETA
WC3Banlist
Windows Media Format 11 runtime
Windows Media Format 11 runtime
Windows Media Player 11
Windows Media Player 11
Windows XP Service Pack 3
WinPcap 3.1
WinRAR archiver
World of Warcraft
Zone Deluxe Games

kalyco
Novice
Novice

Posts Posts : 22
Joined Joined : 2008-12-18
OS OS : Windows XP
Points Points : 29278
# Likes # Likes : 0

View user profile

Back to top Go down

Solved Re: About to fix this with a hammer, help pls

Post by Belahzur on 18th December 2008, 7:43 pm

Hello.


  • Download combofix from here, use the top links - [You must be registered and logged in to see this link.]
  • Double click on ComboFix.exe.
  • Follow the prompts. NOTE:
  • ComboFix will check to see if the Microsoft Windows Recovery Console is installed.
    ***It's strongly recommended to have the Recovery Console installed before doing any malware removal.***

    **Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will automatically proceed with its scan.


  • The Recovery Console provides a recovery/repair mode should a problem occur during a Combofix run.



  • Allow ComboFix to download the Recovery Console.
  • Accept the End-User License Agreement.
  • The Recovery Console will be installed.
  • You will this next prompt that asks if you want to continue the malware scan, select yes



  • Allow combofix to run
  • Post C:\combofix.txt back here.

    Note:
    Do not mouseclick combofix's window whilst it's running. That may cause it to stall.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34916
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : XP SP3 Media Centre
Points Points : 245079
# Likes # Likes : 1

View user profile

Back to top Go down

Solved Re: About to fix this with a hammer, help pls

Post by kalyco on 19th December 2008, 7:02 am

Here is the combo thing. The virus/malware thing is still alive.


ComboFix 08-12-18.01 - Robert 2008-12-18 22:47:52.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.639.384 [GMT -8:00]
Running from: c:\documents and settings\Robert\Desktop\ComboFix.exe
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat
c:\documents and settings\LocalService\Application Data\NetMon
c:\documents and settings\LocalService\Application Data\NetMon\domains.txt
c:\documents and settings\LocalService\Application Data\NetMon\log.txt
c:\documents and settings\Robert\Application Data\gadcom
c:\documents and settings\Robert\Application Data\SpeedRunner
c:\documents and settings\Robert\Local Settings\Temporary Internet Files\bestwiner.stt
c:\documents and settings\Robert\Local Settings\Temporary Internet Files\fbk.sts
c:\program files\inetget2
c:\program files\Mjcore
c:\temp\1cb
c:\temp\1cb\syscheck.log
c:\temp\DIV55
c:\temp\DIV55\xDb.log
c:\temp\tn3
c:\windows\Downloaded Program Files\setup.inf
c:\windows\licencia.txt
c:\windows\system32\_005904_.tmp.dll
c:\windows\system32\_005905_.tmp.dll
c:\windows\system32\_005906_.tmp.dll
c:\windows\system32\_005907_.tmp.dll
c:\windows\system32\_005914_.tmp.dll
c:\windows\system32\_005915_.tmp.dll
c:\windows\system32\_005916_.tmp.dll
c:\windows\system32\_005917_.tmp.dll
c:\windows\system32\_005919_.tmp.dll
c:\windows\system32\_005920_.tmp.dll
c:\windows\system32\_005923_.tmp.dll
c:\windows\system32\_005924_.tmp.dll
c:\windows\system32\_005926_.tmp.dll
c:\windows\system32\_005927_.tmp.dll
c:\windows\system32\_005928_.tmp.dll
c:\windows\system32\_005930_.tmp.dll
c:\windows\system32\_005933_.tmp.dll
c:\windows\system32\_005934_.tmp.dll
c:\windows\system32\_005938_.tmp.dll
c:\windows\system32\_005939_.tmp.dll
c:\windows\system32\_005941_.tmp.dll
c:\windows\system32\_005944_.tmp.dll
c:\windows\system32\_005946_.tmp.dll
c:\windows\system32\_005947_.tmp.dll
c:\windows\system32\_005948_.tmp.dll
c:\windows\system32\_005949_.tmp.dll
c:\windows\system32\_005950_.tmp.dll
c:\windows\system32\_005953_.tmp.dll
c:\windows\system32\_005954_.tmp.dll
c:\windows\system32\_005955_.tmp.dll
c:\windows\system32\_005956_.tmp.dll
c:\windows\system32\_005957_.tmp.dll
c:\windows\system32\_005962_.tmp.dll
c:\windows\system32\_005964_.tmp.dll
c:\windows\system32\Ati2evxx.dll
c:\windows\system32\C
c:\windows\system32\drivers\core.cache(2).dsk
c:\windows\system32\eqikseje.ini
c:\windows\system32\ibdoiymc.ini
c:\windows\system32\IN
c:\windows\system32\iQsCeMoq.ini
c:\windows\system32\iQsCeMoq.ini2
c:\windows\system32\ki3
c:\windows\system32\pkxtfpjw.ini
c:\windows\system32\pxissthx.ini
c:\windows\system32\svbnetpw.dll
c:\windows\system32\uecdxp.dll
c:\windows\system32\uglvmubp.dll
c:\windows\system32\wptenbvs.ini
c:\windows\system32\xbaiiedu.ini
c:\windows\Tasks\qvkruguz.job
c:\windows\Tasks\qziaxtzv.job
c:\windows\telefonos.txt
c:\windows\TEMP\salm.exe
c:\windows\textos.txt
c:\windows\system32\drivers\core.cache.dsk . . . . failed to delete

----- BITS: Possible infected sites -----

[You must be registered and logged in to see this link.]
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_CMDSERVICE
-------\Legacy_NETWORK_MONITOR


((((((((((((((((((((((((( Files Created from 2008-11-19 to 2008-12-19 )))))))))))))))))))))))))))))))
.

2008-12-18 22:52 . 2008-12-18 22:52 d-------- c:\temp\tn3
2008-12-11 18:06 . 2008-12-11 18:06 d-------- c:\program files\AVG
2008-12-11 15:10 . 2008-12-11 15:10 d-------- c:\program files\Avira
2008-12-11 15:10 . 2008-12-11 15:10 d-------- c:\documents and settings\All Users\Application Data\Avira
2008-12-10 22:23 . 2008-12-10 22:51 1,544,192 --a------ c:\windows\system32\eqikseje.tmp
2008-12-10 13:24 . 2008-12-11 15:18 d-------- c:\documents and settings\Robert\Application Data\Twain
2008-12-10 13:20 . 2008-12-10 13:27 d-------- c:\program files\Webtools
2008-12-10 12:32 . 2008-12-10 13:31 d--h----- C:\$AVG8.VAULT$
2008-12-09 22:50 . 2008-12-09 22:50 0 --a------ C:\LHT1E.tmp
2008-12-09 22:34 . 2008-12-11 18:06 d-------- c:\documents and settings\All Users\Application Data\avg8
2008-12-08 10:28 . 2008-12-08 11:38 d--hs---- c:\windows\Um9iZXJ0
2008-12-08 10:28 . 2008-12-08 10:28 86,272 --a------ c:\windows\system32\drivers\aecc.sys
2008-12-08 10:28 . 2008-12-18 22:52 932 --------- c:\windows\system32\drivers\core.cache.dsk
2008-12-08 10:27 . 2008-12-18 22:52 d-------- C:\Temp

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-12-18 21:08 --------- d-----w c:\program files\Warcraft III
2008-12-10 06:52 --------- d-----w c:\program files\World of Warcraft
2008-11-13 19:58 --------- d-----w c:\program files\Common Files\Blizzard Entertainment
2008-11-13 09:42 --------- d-----w c:\program files\InterVideo
2008-11-13 08:41 23,600 ----a-w c:\windows\system32\drivers\TVICHW32.SYS
2008-11-13 08:25 --------- d-----w c:\documents and settings\Robert\Application Data\InterVideo
2008-10-29 21:05 --------- d-----w c:\documents and settings\Dota\Application Data\Sonic
2008-10-24 18:36 71,976 ----a-w c:\documents and settings\Robert\Application Data\GDIPFONTCACHEV1.DAT
2008-08-31 17:40 32,768 --sha-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012008083120080901\index.dat
.

------- Sigcheck -------

2005-03-02 10:09 577024 de2db164bbb35db061af0997e4499054 c:\windows\$hf_mig$\KB890859\SP2GDR\user32.dll
2005-03-02 10:19 577024 1800f293bccc8ede8a70e12b88d80036 c:\windows\$hf_mig$\KB890859\SP2QFE\user32.dll
2007-03-08 07:48 578048 7aa4f6c00405dfc4b70ed4214e7d687b c:\windows\$hf_mig$\KB925902\SP2QFE\user32.dll
2007-03-08 07:36 577536 b409909f6e2e8a7067076ed748abf1e7 c:\windows\$NtServicePackUninstall$\user32.dll
2004-08-03 23:56 577024 c72661f8552ace7c5c85e16a3cf505c4 c:\windows\$NtUninstallKB890859$\user32.dll
2003-03-31 11:00 560128 dd9269230c21ee8fb7fd3fccc3b1cfcb c:\windows\$NtUninstallKB890859_0$\user32.dll
2005-03-02 10:09 577024 de2db164bbb35db061af0997e4499054 c:\windows\$NtUninstallKB925902$\user32.dll
2008-04-13 16:12 578560 b26b135ff1b9f60c9388b4a7d16f600b c:\windows\ServicePackFiles\i386\user32.dll
2007-03-08 07:36 577536 b409909f6e2e8a7067076ed748abf1e7 c:\windows\system32\user32.dll

2007-06-13 02:23 1033216 97bd6515465659ff8f3b7be375b2ea87 c:\windows\explorer.exe
2007-06-13 03:26 1033216 7712df0cdde3a5ac89843e61cd5b3658 c:\windows\$hf_mig$\KB938828\SP2QFE\explorer.exe
2007-06-13 02:23 1033216 97bd6515465659ff8f3b7be375b2ea87 c:\windows\$NtServicePackUninstall$\explorer.exe
2004-08-03 23:56 1032192 a0732187050030ae399b241436565e64 c:\windows\$NtUninstallKB938828$\explorer.exe
2008-04-13 16:12 1033728 12896823fb95bfb3dc9b46bcaedc9923 c:\windows\ServicePackFiles\i386\explorer.exe

2005-06-10 15:53 57856 da81ec57acd4cdc3d4c51cf3d409af9f c:\windows\$hf_mig$\KB896423\SP2GDR\spoolsv.exe
2005-06-10 16:17 57856 ad3d9d191aea7b5445fe1d82ffbb4788 c:\windows\$hf_mig$\KB896423\SP2QFE\spoolsv.exe
2005-06-10 15:53 57856 da81ec57acd4cdc3d4c51cf3d409af9f c:\windows\$NtServicePackUninstall$\spoolsv.exe
2004-08-03 23:56 57856 7435b108b935e42ea92ca94f59c8e717 c:\windows\$NtUninstallKB896423$\spoolsv.exe
2003-03-31 11:00 51200 9b4155ba58192d4073082b8fc5d42612 c:\windows\$NtUninstallKB896423_0$\spoolsv.exe
2008-04-13 16:12 57856 d8e14a61acc1d4a6cd0d38aebac7fa3b c:\windows\ServicePackFiles\i386\spoolsv.exe
2005-06-10 15:53 57856 da81ec57acd4cdc3d4c51cf3d409af9f c:\windows\system32\spoolsv.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-03 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Apoint"="c:\program files\Apoint2K\Apoint.exe" [2003-10-07 159744]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-05-15 335872]
"Cpqset"="c:\program files\HPQ\Default Settings\cpqset.exe" [2004-03-01 200766]
"eabconfg.cpl"="c:\program files\HPQ\Quick Launch Buttons\EabServr.exe" [2004-01-13 245760]
"UpdateManager"="c:\program files\Common Files\Sonic\Update Manager\sgtray.exe" [2003-08-19 110592]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 144784]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-03-28 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-03-30 267048]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-08-31 185896]
"avgnt"="c:\program files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-12 266497]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2008-12-11 1261336]
"AGRSMMSG"="AGRSMMSG.exe" [2003-10-30 c:\windows\AGRSMMSG.exe]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
BTTray.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2003-11-10 507965]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-02-13 83360]
Quicken Scheduled Updates.lnk - c:\program files\Quicken\bagent.exe [2003-07-29 57344]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=,avgrsstx.dll uecdxp.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Warcraft III\\war3.exe"=
"c:\\Program Files\\Veoh Networks\\Veoh\\VeohClient.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\World of Warcraft\\BackgroundDownloader.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3724:TCP"= 3724:TCP:Blizzard Downloader: 3724

R0 atiide;atiide;c:\windows\system32\DRIVERS\atiide.sys [2008-04-27 5632]
R1 aecc;aecc;c:\windows\system32\drivers\aecc.sys [2008-12-08 86272]
R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2008-12-11 231704]
S2 mrtRate;mrtRate; []
S3 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [2005-08-02 32512]
.
Contents of the 'Scheduled Tasks' folder

2008-12-10 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-04-11 16:57]
.
- - - - ORPHANS REMOVED - - - -

BHO-{25db09a0-a200-4aad-97f6-0d11e2f73e47} - c:\windows\system32\uecdxp.dll
BHO-{7182EF47-5143-4DE5-B712-DB98F12C9CD1} - c:\windows\system32\qoMeCsQi.dll
HKCU-Run-RecordNow! - (no file)
Notify-mlJBQkIA - mlJBQkIA.dll


.
------- Supplementary Scan -------
.
uStart Page = [You must be registered and logged in to see this link.]
uInternet Connection Wizard,ShellNext = [You must be registered and logged in to see this link.]
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
IE: Send To &Bluetooth - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
Trusted Zone: *.spyguardpro.com
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, [You must be registered and logged in to see this link.]
Rootkit scan 2008-12-18 22:53:04
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Cpqset = c:\program files\HPQ\Default Settings\cpqset.exe????????4?7?6?5??????? ???B???????????????B? ??????

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\ati2evxx.exe
c:\program files\Lavasoft\Ad-Aware 2007\aawservice.exe
c:\program files\Avira\AntiVir PersonalEdition Classic\sched.exe
c:\program files\Avira\AntiVir PersonalEdition Classic\avguard.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
c:\program files\Analog Devices\SoundMAX\SMAgent.exe
c:\program files\Apoint2K\ApntEx.exe
c:\windows\system32\wscntfy.exe
c:\program files\iPod\bin\iPodService.exe
.
**************************************************************************
.
Completion time: 2008-12-18 22:58:19 - machine was rebooted
ComboFix-quarantined-files.txt 2008-12-19 06:58:16

Pre-Run: 15,150,321,664 bytes free
Post-Run: 17,095,086,080 bytes free

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /fastdetect /NoExecute=OptIn

243 --- E O F --- 2008-12-08 11:05:48

kalyco
Novice
Novice

Posts Posts : 22
Joined Joined : 2008-12-18
OS OS : Windows XP
Points Points : 29278
# Likes # Likes : 0

View user profile

Back to top Go down

Solved Re: About to fix this with a hammer, help pls

Post by Belahzur on 19th December 2008, 9:35 am

Hello.
Before we can continue, I need to know alittle more about one file, can't find much on it.

Please upload this file in bold below:
c:\windows\system32\drivers\aecc.sys
to this site for a scan.
[You must be registered and logged in to see this link.]
Copy and paste the results back here.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34916
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : XP SP3 Media Centre
Points Points : 245079
# Likes # Likes : 1

View user profile

Back to top Go down

Solved Re: About to fix this with a hammer, help pls

Post by kalyco on 19th December 2008, 7:17 pm

I went to the site and tried to upload the file. everytime it said error that the file was not found. but the file is there, i see it in that directory. eagerly awaiting your assistance.

kalyco
Novice
Novice

Posts Posts : 22
Joined Joined : 2008-12-18
OS OS : Windows XP
Points Points : 29278
# Likes # Likes : 0

View user profile

Back to top Go down

Solved Re: About to fix this with a hammer, help pls

Post by Belahzur on 19th December 2008, 7:21 pm

Hello.
Okay, we'll nuke it, but first we have a fix a registry item.


  • Now open a new notepad file.
  • Input this into the notepad file:

    Windows Registry Editor Version 5.00

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
    "AppInit_DLLs"=""

  • Save this as fix.reg, save it to your desktop.
  • Double click fix.reg to run it.
  • Select yes to the registry merge prompt.


1. Please download The Avenger by Swandog46 to your Desktop
Link: [You must be registered and logged in to see this link.].

  • Click on Avenger.zip to open the file
  • Extract avenger.exe to your desktop
2. Copy all the text contained in the code box below to your Clipboard by highlighting it and pressing (Ctrl+CCrying


Files to delete:
c:\windows\system32\drivers\core.cache.dsk
c:\windows\system32\eqikseje.tmp
c:\windows\system32\drivers\aecc.sys
C:\LHT1E.tmp

Folders to delete:
c:\windows\Um9iZXJ0
c:\documents and settings\Robert\Application Data\Twain

Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.


3. Now, start The Avenger program by clicking on its icon on your desktop.

  • Under "Input script here:", paste in the script from the quote box above.
  • Leave the ticked box "Scan for rootkit" ticked.
  • Then tick "Disable any rootkits found"
  • Now click on the Execute to begin execution of the script.
  • Answer "Yes" twice when prompted.

    The Avenger will automatically do the following:

  • It will Restart your computer.
  • On reboot, it will briefly open a black command window on your desktop, this is normal.
  • After the restart, it creates a log file that should open with the results of Avengers actions. This log file will be located at C:\avenger.txt
  • The Avenger will also have backed up all the files, etc., that you asked it to delete, and will have zipped them and moved the zip archives to C:\avenger\backup.zip.
5. Please copy/paste the content of c:\avenger.txt into your reply.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34916
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : XP SP3 Media Centre
Points Points : 245079
# Likes # Likes : 1

View user profile

Back to top Go down

Solved Re: About to fix this with a hammer, help pls

Post by kalyco on 19th December 2008, 11:53 pm

I hope this is the text you are asking for.

Logfile of The Avenger Version 2.0, (c) by Swandog46
[You must be registered and logged in to see this link.]

Platform: Windows XP

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.
No rootkits found!

File "c:\windows\system32\drivers\core.cache.dsk" deleted successfully.
File "c:\windows\system32\eqikseje.tmp" deleted successfully.
File "c:\windows\system32\drivers\aecc.sys" deleted successfully.
File "C:\LHT1E.tmp" deleted successfully.
Folder "c:\windows\Um9iZXJ0" deleted successfully.
Folder "c:\documents and settings\Robert\Application Data\Twain" deleted successfully.

Completed script processing.

*******************

Finished! Terminate.

kalyco
Novice
Novice

Posts Posts : 22
Joined Joined : 2008-12-18
OS OS : Windows XP
Points Points : 29278
# Likes # Likes : 0

View user profile

Back to top Go down

Solved Re: About to fix this with a hammer, help pls

Post by Belahzur on 19th December 2008, 11:56 pm

Hello.
Looks good now, what problems remain?

Your version of Java is outdated and needs to be updated to take advantage of fixes that have eliminated security vulnerabilities.
Updating Java:

  • Download the latest version of [You must be registered and logged in to see this link.].
  • Select the first option where it says "Java SE Runtime Environment (JRE) 6 Update 11".
  • Click the "Download" button to the right.
  • In the Window that opens, select your platform and language, check the "agree" box, and click Continue.
  • Click on the link to download Windows Offline Installation and save to your desktop.
  • Close any programs you may have running - especially your web browser.
  • Go to Start > Control Panel double-click on Add or Remove Programs and remove all older versions of Java.
  • Check any item with Java Runtime Environment (JRE or J2SE) in the name.
    - Examples of older versions in Add or Remove Programs:
    - Java 2 Runtime Environment, SE v1.4.2
    - J2SE Runtime Environment 5.0
    - J2SE Runtime Environment 5.0 Update 2
  • Click the Remove or Change/Remove button.
  • Repeat as many times as necessary to remove each Java versions.
  • Reboot your computer once all Java components are removed.
  • Then from your desktop double-click on jre-6u11-windows-i586-p.exe that you downloaded to install the newest version.
Please make sure the new version of Java is installed before you run JavaRa.

Please download JavaRa from [You must be registered and logged in to see this link.]

  • First, unzip it.
  • Then run JavaRa.
  • Select English from the drop down menu and press Select.
  • This will open JavaRa.
  • Press Remove older versions
  • Press yes to the prompt.
  • It will make a log file of what it's removed.
  • Copy and paste the log back here.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34916
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : XP SP3 Media Centre
Points Points : 245079
# Likes # Likes : 1

View user profile

Back to top Go down

Solved Re: About to fix this with a hammer, help pls

Post by kalyco on 24th December 2008, 6:53 pm

Okay sorry for the late response. Well, while i was at work someone decided to use my computer prior to me updating the java files and it appears i now have a new more violitile virus. This new virus also does pop ups but in addition, tries to install some program everytime, locks up my browser, and more. here is he info and i think i will have to set this site as my default page. oh i dont know if this is a result of the virus but whenever i try to download some windows updates or java upates it says that my windows installer is messed up, says im in safe mode or it didnt get installed correctly.


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:46:01 AM, on 12/24/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\Program Files\tintinyproxyy\tinyproxy.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Apoint2K\Apoint.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Documents and Settings\Robert\Application Data\gadcom\gadcom.exe
C:\Documents and Settings\Robert\Application Data\SpeedRunner\SpeedRunner.exe
C:\Documents and Settings\Robert\Application Data\Microsoft\Windows\ticdrh.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Apoint2K\Apntex.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\internet explorer\iexplore.exe
C:\WINDOWS\explorer.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Documents and Settings\Robert\Desktop\hijackgpthis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = [You must be registered and logged in to see this link.]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = [You must be registered and logged in to see this link.]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = [You must be registered and logged in to see this link.]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = [You must be registered and logged in to see this link.]
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = [You must be registered and logged in to see this link.]
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = [You must be registered and logged in to see this link.]
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:9090
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local;
O2 - BHO: (no name) - {6D794CB4-C7CD-4c6f-BFDC-9B77AFBDC02C} - C:\WINDOWS\system32\opnnlKaA.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: (no name) - {77AB59B4-55A3-4737-9FD5-B93C64307F78} - C:\WINDOWS\system32\huajljtq.dll
O2 - BHO: (no name) - {CCB12D0B-3186-41CC-8FC8-D231F57D6FB8} - C:\WINDOWS\system32\cbXOIyXR.dll
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe /Start
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [prunnet] "C:\WINDOWS\system32\prunnet.exe"
O4 - HKLM\..\Run: [Eyoxofeseduz] rundll32.exe "C:\WINDOWS\Idecireyiluyi.dll",e
O4 - HKLM\..\Run: [Ohebugebudaxub] rundll32.exe "C:\WINDOWS\ewiwukatiyuwa.dll",e
O4 - HKLM\..\Run: [54784200] rundll32.exe "C:\WINDOWS\system32\hdwnoqbd.dll",b
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [prunnet] "C:\WINDOWS\system32\prunnet.exe"
O4 - HKCU\..\Run: [gadcom] "C:\Documents and Settings\Robert\Application Data\gadcom\gadcom.exe" 61A847B5BBF728173599284503996897C881250221C8670836AC4FA7C8833201749139
O4 - HKCU\..\Run: [SpeedRunner] C:\Documents and Settings\Robert\Application Data\SpeedRunner\SpeedRunner.exe
O4 - HKCU\..\Run: [SfKg6wIP] C:\Documents and Settings\Robert\Application Data\Microsoft\Windows\ticdrh.exe
O4 - Global Startup: BTTray.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Quicken Scheduled Updates.lnk = C:\Program Files\Quicken\bagent.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - [You must be registered and logged in to see this link.]
O8 - Extra context menu item: Send To &Bluetooth - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6B75345B-AA36-438A-BBE6-4078B4C6984D} (HpProductDetection Class) - [You must be registered and logged in to see this link.]
O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} (HP Download Manager) - [You must be registered and logged in to see this link.]
O20 - AppInit_DLLs: qropgp.dll ovykrz.dll svdhoh.dll hxqziu.dll bfczls.dll
O20 - Winlogon Notify: opnnlKaA - C:\WINDOWS\SYSTEM32\opnnlKaA.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Bluetooth Service (btwdins) - WIDCOMM, Inc. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: Computer Browser (Browser) - Unknown owner - C:\Program Files\tintinyproxyy\tinyproxy.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

--
End of file - 7563 bytes


Ad-Aware 2007
Adobe Flash Player ActiveX
Adobe Reader 8.1.2
Adobe Shockwave Player
Advertisement Service
Agere Systems AC'97 Modem
ALPS Touch Pad Driver
Apple Mobile Device Support
Apple Software Update
ATI - Software Uninstall Utility
ATI Control Panel
ATI Display Driver
Bluetooth by hp
Broadcom 802.11 Driver
C-Force
DivX Codec
DivX Converter
DivX Player
DivX Web Player
DriverAgent by TouchStone Software
Easy Video Joiner 5.01
HijackThis 2.0.2
Hotfix for Windows Internet Explorer 7 (KB947864)
Hotfix for Windows XP (KB952287)
HP Product Detection
InterVideo WinDVD
iTunes
Java 2 Runtime Environment, SE v1.4.2_03
Java(TM) 6 Update 4
Java(TM) 6 Update 5
LimeWire 4.16.6
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Hotfix (KB928366)
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft National Language Support Downlevel APIs
Microsoft Office XP Professional with FrontPage
Microsoft User-Mode Driver Framework Feature Pack 1.0
muvee autoProducer DVD Edition - HPH
PCI 1620 Cardbus Controller and Software
Quick Launch Buttons 4.20 E1
Quicken 2004
QuickTime
RealPlayer
Realtek RTL8139/810x Fast Ethernet NIC Driver Setup
RecordNow!
Security Update for Windows Internet Explorer 7 (KB938127)
Security Update for Windows Internet Explorer 7 (KB942615)
Security Update for Windows Internet Explorer 7 (KB944533)
Security Update for Windows Internet Explorer 7 (KB950759)
Security Update for Windows Internet Explorer 7 (KB953838)
Security Update for Windows Media Player 9 (KB917734)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950760)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951698)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB953839)
Sonic Update Manager
SoundMAX
Update for Windows XP (KB951072-v2)
Ventrilo Client
VeohTV BETA
WC3Banlist
Windows Media Format 11 runtime
Windows Media Format 11 runtime
Windows Media Player 11
Windows Media Player 11
Windows XP Service Pack 3
WinPcap 3.1
WinRAR archiver
World of Warcraft
Zone Deluxe Games

kalyco
Novice
Novice

Posts Posts : 22
Joined Joined : 2008-12-18
OS OS : Windows XP
Points Points : 29278
# Likes # Likes : 0

View user profile

Back to top Go down

Solved Re: About to fix this with a hammer, help pls

Post by Belahzur on 24th December 2008, 7:16 pm

Hello.
I suggest you copy these instructions into a notepad file, because we need to use safe mode and you won't have internet access to read from here.

Please then reboot your computer in Safe Mode by doing the following :

  • Restart your computer
  • After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
  • Instead of Windows loading as normal, the Advanced Options Menu should appear;
  • Select the first option, to run Windows in Safe Mode, then press Enter.
  • Choose your usual account.


Once in safe mode.

Delete this folder in bold:
C:\Program Files\tintinyproxyy

Delete these files in bold:
C:\windows\kenny**.exe <== the ** are two random numbers, so it maybe named kenny17.exe
C:\windows\fmark2.dat

Now we need to fix the proxy hijack.

Remove the Proxy setting in Internet explorer and/or in FireFox.

In IE: Tools Menu -> Internet Options -> Connections Tab ->Lan Settings > uncheck "use a proxy server" or reconfigure the Proxy server again in case you have set it previously.

In Firefox in Tools Menu -> Options... -> Advanced Tab -> Network Tab -> "Settings" under Connection.

Click the apply button and restart that computer back to normal mode.
Once back in normal mode, lets carry on with the fix.


  • Open HijackThis
  • Choose "Do a system scan only"
  • Check the boxes in front of these lines:


    R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = [You must be registered and logged in to see this link.]
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:9090
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local;
    O2 - BHO: (no name) - {6D794CB4-C7CD-4c6f-BFDC-9B77AFBDC02C} - C:\WINDOWS\system32\opnnlKaA.dll
    O2 - BHO: (no name) - {77AB59B4-55A3-4737-9FD5-B93C64307F78} - C:\WINDOWS\system32\huajljtq.dll
    O2 - BHO: (no name) - {CCB12D0B-3186-41CC-8FC8-D231F57D6FB8} - C:\WINDOWS\system32\cbXOIyXR.dll
    O4 - HKLM\..\Run: [prunnet] "C:\WINDOWS\system32\prunnet.exe"
    O4 - HKLM\..\Run: [Eyoxofeseduz] rundll32.exe "C:\WINDOWS\Idecireyiluyi.dll",e
    O4 - HKLM\..\Run: [Ohebugebudaxub] rundll32.exe "C:\WINDOWS\ewiwukatiyuwa.dll",e
    O4 - HKLM\..\Run: [54784200] rundll32.exe "C:\WINDOWS\system32\hdwnoqbd.dll",b
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [prunnet] "C:\WINDOWS\system32\prunnet.exe"
    O4 - HKCU\..\Run: [gadcom] "C:\Documents and Settings\Robert\Application Data\gadcom\gadcom.exe" 61A847B5BBF728173599284503996897C881250221C8670836AC4FA7C8833201749139
    O4 - HKCU\..\Run: [SpeedRunner] C:\Documents and Settings\Robert\Application Data\SpeedRunner\SpeedRunner.exe
    O4 - HKCU\..\Run: [SfKg6wIP] C:\Documents and Settings\Robert\Application Data\Microsoft\Windows\ticdrh.exe
    O20 - AppInit_DLLs: qropgp.dll ovykrz.dll svdhoh.dll hxqziu.dll bfczls.dll
    O20 - Winlogon Notify: opnnlKaA - C:\WINDOWS\SYSTEM32\opnnlKaA.dll


  • Press "Fix Checked"
  • Close Hijack This.



Please download and run this tool.

Download Malwarebytes' Anti-Malware from [You must be registered and logged in to see this link.]

Double Click mbam-setup.exe to install the application.

  • Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select "Perform Quick Scan", then click Scan.
  • The scan may take some time to finish,so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected.
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Note:
If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts.
Click OK to either and let MBAM proceed with the disinfection process.
If asked to restart the computer, please do so immediately.


Post the contents of the MBAM Log.

I know this is a big post, so take your time.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34916
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : XP SP3 Media Centre
Points Points : 245079
# Likes # Likes : 1

View user profile

Back to top Go down

Solved Re: About to fix this with a hammer, help pls

Post by kalyco on 30th December 2008, 9:47 am

Hey here is the data log.


Malwarebytes' Anti-Malware 1.31
Database version: 1456
Windows 5.1.2600 Service Pack 3

12/30/2008 1:46:15 AM
mbam-log-2008-12-30 (01-46-15).txt

Scan type: Quick Scan
Objects scanned: 55886
Time elapsed: 6 minute(s), 58 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 7
Registry Values Infected: 2
Registry Data Items Infected: 2
Folders Infected: 1
Files Infected: 16

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CLASSES_ROOT\xml.xml (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{500bca15-57a7-4eaf-8143-8c619470b13d} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{500bca15-57a7-4eaf-8143-8c619470b13d} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{500bca15-57a7-4eaf-8143-8c619470b13d} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\xml.xml.1 (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{9233c3c0-1472-4091-a505-5580a23bb4ac} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\MSFox (Trojan.Agent) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSFox (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Cognac (Trojan.FakeAlert) -> Quarantined and deleted successfully.

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Trojan.Agent) -> Data: c:\windows\system32\userinit.exe -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Trojan.Agent) -> Data: system32\userinit.exe -> Quarantined and deleted successfully.

Folders Infected:
C:\resycled (Trojan.DNSChanger) -> Quarantined and deleted successfully.

Files Infected:
C:\WINDOWS\system32\msxml71.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Documents and Settings\Robert\Local Settings\temp\~tmpe.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\resycled\boot.com (Trojan.DNSChanger) -> Quarantined and deleted successfully.
C:\Documents and Settings\Robert\Local Settings\temp\a.exe (Trojan.FakeAlert) -> Delete on reboot.
C:\Documents and Settings\Robert\Local Settings\temp\46.tmp.exe (Trojan.FakeAlert) -> Delete on reboot.
C:\WINDOWS\temp\tempo-5B.tmp (Trojan.DNSChanger) -> Quarantined and deleted successfully.
C:\WINDOWS\temp\tempo-9B.tmp (Trojan.DNSChanger) -> Quarantined and deleted successfully.
C:\WINDOWS\temp\tempo-39D.tmp (Trojan.DNSChanger) -> Quarantined and deleted successfully.
C:\WINDOWS\temp\tempo-48B.tmp (Trojan.DNSChanger) -> Quarantined and deleted successfully.
C:\WINDOWS\temp\tempo-869.tmp (Trojan.DNSChanger) -> Quarantined and deleted successfully.
C:\WINDOWS\temp\tempo-C95.tmp (Trojan.DNSChanger) -> Quarantined and deleted successfully.
C:\WINDOWS\temp\tempo-DF1.tmp (Trojan.DNSChanger) -> Quarantined and deleted successfully.
C:\Documents and Settings\Robert\Local Settings\temp\~tmpa.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Documents and Settings\Robert\Local Settings\temp\~tmpb.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Documents and Settings\Robert\Local Settings\temp\~tmpc.exe (Trojan.FakeAlert) -> Delete on reboot.
C:\Documents and Settings\Robert\Local Settings\temp\~tmpd.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.

kalyco
Novice
Novice

Posts Posts : 22
Joined Joined : 2008-12-18
OS OS : Windows XP
Points Points : 29278
# Likes # Likes : 0

View user profile

Back to top Go down

Solved Re: About to fix this with a hammer, help pls

Post by Belahzur on 30th December 2008, 2:22 pm

Hello.
Is the machine any better now?


  • Download combofix from here, use the top links - [You must be registered and logged in to see this link.]
  • Please disable your local AV (Anti-virus) by right clicking it's icon in the tray, and exit it.
  • Double click on ComboFix.exe.
  • Follow the prompts. NOTE:
  • ComboFix will check to see if the Microsoft Windows Recovery Console is installed.
    ***It's strongly recommended to have the Recovery Console installed before doing any malware removal.***

    **Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will automatically proceed with its scan.


  • The Recovery Console provides a recovery/repair mode should a problem occur during a Combofix run.



  • Allow ComboFix to download the Recovery Console.
  • Accept the End-User License Agreement.
  • The Recovery Console will be installed.
  • You will then get this next prompt that asks if you want to continue the malware scan, select yes



  • Allow combofix to run
  • Post C:\combofix.txt back here.

    Note:
    Do not mouseclick combofix's window whilst it's running. That may cause it to stall.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34916
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : XP SP3 Media Centre
Points Points : 245079
# Likes # Likes : 1

View user profile

Back to top Go down

Solved Re: About to fix this with a hammer, help pls

Post by kalyco on 31st December 2008, 11:04 am

Well there are no more pop ups from what i see, but now i cant view any video online and when i turn on my computer it just locks up and i have to turn it off, turn it on, turn it off and on until it finally fully loads everything.

ComboFix 08-12-30.02 - Robert 2008-12-31 2:52:44.3 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.639.451 [GMT -8:00]
Running from: c:\documents and settings\Robert\Desktop\ComboFix.exe
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat
c:\documents and settings\Robert\Local Settings\Temporary Internet Files\fbk.sts
c:\program files\tintinyproxyy\tinyproxy.exe
C:\resycled
c:\windows\system32\bfczls.dll
c:\windows\system32\drivers\msqpdxbfasrfvc.sys
c:\windows\system32\drivers\msqpdxhbmltndg.sys
c:\windows\system32\drivers\msqpdxncbblwjo.sys
c:\windows\system32\drivers\msqpdxtstpqxvw.sys
c:\windows\system32\drivers\msqpdxwmtkibml.sys
c:\windows\system32\drivers\msqpdxxuwpseou.sys
c:\windows\system32\gtjkbsle.ini
c:\windows\system32\hxqziu.dll
c:\windows\system32\lixvbhhi.ini
c:\windows\system32\msqpdxewxnssin.dll
c:\windows\system32\ovykrz.dll
c:\windows\system32\pusstpum.dll
c:\windows\system32\qropgp.dll
c:\windows\system32\rfpamenf.ini
c:\windows\system32\svdhoh.dll
c:\windows\system32\vbtiwynm.dll
c:\windows\system32\vuicasnm.dll
c:\windows\system32\wyngdpxo.dll
c:\windows\system32\xusumtjm.dll

----- BITS: Possible infected sites -----

[You must be registered and logged in to see this link.]
Infected copy of c:\windows\system32\userinit.exe was found and disinfected
Restored copy from - c:\windows\$NtServicePackUninstall$\userinit.exe


.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_MSQPDXSERV.SYS
-------\Legacy_COM+_EVENT_SYSTEM_(EVENTSYSTEM)_
-------\Legacy_COMPUTER_BROWSER_(BROWSER)_
-------\Service_COM+ Event System (EventSystem)
-------\Service_Computer Browser (Browser)


((((((((((((((((((((((((( Files Created from 2008-11-28 to 2008-12-31 )))))))))))))))))))))))))))))))
.

2008-12-25 04:26 . 2008-12-25 04:26 d-------- c:\program files\Malwarebytes' Anti-Malware
2008-12-25 04:26 . 2008-12-25 04:26 d-------- c:\documents and settings\Robert\Application Data\Malwarebytes
2008-12-25 04:26 . 2008-12-25 04:26 d-------- c:\documents and settings\All Users\Application Data\Malwarebytes
2008-12-25 04:26 . 2008-12-03 19:59 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
2008-12-25 04:26 . 2008-12-03 19:59 15,504 --a------ c:\windows\system32\drivers\mbam.sys
2008-12-22 09:42 . 2008-04-13 16:12 26,112 --a------ c:\windows\system32\stu2.exe
2008-12-21 08:00 . 2008-12-21 08:00 41,984 --a------ c:\windows\Idecireyiluyi.dll
2008-12-20 20:47 . 2008-12-22 09:52 d-------- c:\program files\Common Files\mkok
2008-12-19 16:24 . 2008-12-19 16:24 d-------- c:\documents and settings\All Users\Application Data\Avg8
2008-12-11 18:06 . 2008-12-11 18:06 d-------- c:\program files\AVG
2008-12-08 10:27 . 2008-12-31 02:39 d-------- C:\Temp
2008-11-13 00:41 . 2008-11-13 00:41 23,600 --a------ c:\windows\system32\drivers\TVICHW32.SYS
2008-11-13 00:25 . 2008-11-13 00:25 d-------- c:\documents and settings\Robert\Application Data\InterVideo

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-12-28 00:02 --------- d-----w c:\program files\Warcraft III
2008-12-19 19:18 --------- d-----w c:\program files\World of Warcraft
2008-11-13 19:58 --------- d-----w c:\program files\Common Files\Blizzard Entertainment
2008-11-13 09:42 --------- d-----w c:\program files\InterVideo
2008-10-29 21:05 --------- d-----w c:\documents and settings\Dota\Application Data\Sonic
2008-10-24 18:36 71,976 ----a-w c:\documents and settings\Robert\Application Data\GDIPFONTCACHEV1.DAT
2008-08-31 17:40 32,768 --sha-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012008083120080901\index.dat
.

((((((((((((((((((((((((((((( [You must be registered and logged in to see this link.] )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-12-31 10:56:40 24,576 -c--a-w c:\windows\system32\dllcache\userinit.exe
- 2008-04-14 00:12:38 26,112 ----a-w c:\windows\system32\userinit.exe
+ 2008-12-31 10:56:40 24,576 ----a-w c:\windows\system32\userinit.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-03 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Apoint"="c:\program files\Apoint2K\Apoint.exe" [2003-10-07 159744]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-05-15 335872]
"Cpqset"="c:\program files\HPQ\Default Settings\cpqset.exe" [2004-03-01 200766]
"eabconfg.cpl"="c:\program files\HPQ\Quick Launch Buttons\EabServr.exe" [2004-01-13 245760]
"UpdateManager"="c:\program files\Common Files\Sonic\Update Manager\sgtray.exe" [2003-08-19 110592]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 144784]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-03-28 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-03-30 267048]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-08-31 185896]
"AGRSMMSG"="AGRSMMSG.exe" [2003-10-30 c:\windows\AGRSMMSG.exe]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
BTTray.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2003-11-10 507965]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-02-13 83360]
Quicken Scheduled Updates.lnk - c:\program files\Quicken\bagent.exe [2003-07-29 57344]

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Warcraft III\\war3.exe"=
"c:\\Program Files\\Veoh Networks\\Veoh\\VeohClient.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\World of Warcraft\\BackgroundDownloader.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3724:TCP"= 3724:TCP:Blizzard Downloader: 3724

R0 atiide;atiide;c:\windows\system32\DRIVERS\atiide.sys [2008-04-27 5632]
S1 aecc;aecc;c:\windows\system32\drivers\aecc.sys []
S2 mrtRate;mrtRate; []
S3 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [2005-08-02 32512]
.
Contents of the 'Scheduled Tasks' folder

2008-12-31 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-04-11 16:57]
.
.
------- Supplementary Scan -------
.
uStart Page = [You must be registered and logged in to see this link.]
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
IE: Send To &Bluetooth - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, [You must be registered and logged in to see this link.]
Rootkit scan 2008-12-31 02:58:54
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Cpqset = c:\program files\HPQ\Default Settings\cpqset.exe????????4?7?6?5??????? ???B???????????????B? ??????

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-1409082233-1482476501-682003330-1004\]f*NULL*t*NULL*w*NULL*a*NULL*r*NULL*e*NULL*]
@Security=(SE_DACL_PRESENT SE_SELF_RELATIVE (@Owner @Group @DACL)
@Owner=S-1-5-21-1409082233-1482476501-682003330-1004
@Allowed: (Full) (S-1-5-21-1409082233-1482476501-682003330-1004)
@Allowed: (Full) (S-1-5-21-1409082233-1482476501-682003330-1004)
@Allowed: (Full) (LocalSystem)
@Allowed: (Full) (LocalSystem)
@Allowed: (Full) (Administrators)
@Allowed: (Full) (Administrators)
@Allowed: (Read) (S-1-5-12)
@Allowed: (Read) (S-1-5-12)

[HKEY_USERS\S-1-5-21-1409082233-1482476501-682003330-1004\]f*NULL*t*NULL*w*NULL*a*NULL*r*NULL*e*NULL*\Microsoft]
@Security="Inherited"

[HKEY_USERS\S-1-5-21-1409082233-1482476501-682003330-1004\]f*NULL*t*NULL*w*NULL*a*NULL*r*NULL*e*NULL*\Microsoft\MediaPlayer]
@Security="Inherited"

[HKEY_USERS\S-1-5-21-1409082233-1482476501-682003330-1004\]f*NULL*t*NULL*w*NULL*a*NULL*r*NULL*e*NULL*\Microsoft\MediaPlayer\Health]
@Security="Inherited"

[HKEY_USERS\S-1-5-21-1409082233-1482476501-682003330-1004\]f*NULL*t*NULL*w*NULL*a*NULL*r*NULL*e*NULL*\Microsoft\MediaPlayer\Health\{DA6005AC-3D34-401B-98CF-1BA4C23880B6}]
@Security="Inherited"
DUMPHIVE0.003 (REGF)

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Reinstall\*NULL*@>*NULL*]
@Security="Inherited"
"DisplayName"="?\13?\13??"
"DeviceDesc"="?\13?\13??"
"ProviderName"="???\13? ?\13??"
"MFG"="?"
"ReinstallString"="6.14.10.6430"
"DeviceInstanceIds"=multi:"d:\\swsetup\\video\\driver\\2kxp_inf\\cx_14603.inf\00"
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\ati2evxx.exe
c:\program files\Lavasoft\Ad-Aware 2007\aawservice.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
c:\program files\Analog Devices\SoundMAX\SMAgent.exe
c:\program files\Apoint2K\ApntEx.exe
c:\program files\iPod\bin\iPodService.exe
.
**************************************************************************
.
Completion time: 2008-12-31 3:02:23 - machine was rebooted
ComboFix-quarantined-files.txt 2008-12-31 11:02:20
ComboFix2.txt 2008-12-31 10:44:57
ComboFix3.txt 2008-12-19 06:58:20

Pre-Run: 13,889,609,728 bytes free
Post-Run: 13,839,097,856 bytes free

187 --- E O F --- 2008-12-30 11:38:48

kalyco
Novice
Novice

Posts Posts : 22
Joined Joined : 2008-12-18
OS OS : Windows XP
Points Points : 29278
# Likes # Likes : 0

View user profile

Back to top Go down

Solved Re: About to fix this with a hammer, help pls

Post by Belahzur on 31st December 2008, 2:39 pm

Hello.
Do you have another machine you can use to talk to me through? we need to keep this machine offline, the infection you have is quite nasty and being online will contract more infections and we don't want that.

If you don't have another machine, use this but DON'T SURF THE WEB.

Can you check to see if this file in present?
Open Windows Explorer and follow the path:
C:\WINDOWS\system32\userinit.exe

Can you tell me if userinit is there?


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34916
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : XP SP3 Media Centre
Points Points : 245079
# Likes # Likes : 1

View user profile

Back to top Go down

Solved Re: About to fix this with a hammer, help pls

Post by kalyco on 31st December 2008, 5:15 pm

yes i do and yes it is there. the virus/malware appear to be gone or is this just a false sense of security?

kalyco
Novice
Novice

Posts Posts : 22
Joined Joined : 2008-12-18
OS OS : Windows XP
Points Points : 29278
# Likes # Likes : 0

View user profile

Back to top Go down

Solved Re: About to fix this with a hammer, help pls

Post by Belahzur on 31st December 2008, 5:19 pm

Hello.
No, the malware you have is new, it's was first seen last month so we are still looking into it.
The malware renames userinit.exe to stu2.exe.
Combofix put it right now, just needed to know if it wasn't there.

Now open a new notepad file.
Input this into the notepad file:

@echo off
attrib -h -r -s -a c:\windows\Idecireyiluyi.dll
del /q c:\windows\Idecireyiluyi.dll
del fix.bat
exit

Save this as fix.bat, save it to your Desktop. <== Important!!
Double click fix.bat and the black cmd window will open and close, this is normal.

What problems remain?


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34916
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : XP SP3 Media Centre
Points Points : 245079
# Likes # Likes : 1

View user profile

Back to top Go down

Solved Re: About to fix this with a hammer, help pls

Post by kalyco on 31st December 2008, 5:25 pm

okay, as i was posting another message you seem to upped that one. Before that one i was posting that after the previous instructions i went onto the microsoft page downloaded some updates and fixed the installer, video thing. since then there have not been any problems with start up either and no pop ups. "Seems" to be working fine. and i have done that last commend about the fix file. anything else i need to do? btw you guys have awsome response time

kalyco
Novice
Novice

Posts Posts : 22
Joined Joined : 2008-12-18
OS OS : Windows XP
Points Points : 29278
# Likes # Likes : 0

View user profile

Back to top Go down

Solved Re: About to fix this with a hammer, help pls

Post by Belahzur on 31st December 2008, 5:31 pm

Hello.
Yes, one last thing to make sure malware can't abuse your old version of Adobe Reader.

Go to Start > Control Panel > Add/Remove Programs and remove the following programs if present.

  • Adobe Reader 8.1.2


Download and install version 9 from here.
[You must be registered and logged in to see this link.]

From alittle while ago, did you update Java? See here:
[You must be registered and logged in to see this link.]

If you haven't please do so now, if you have, doesn't matter.

Please delete these folders in they exist:
C:\Avenger
C:\Qoobox
====

We need to make a new restore point.

To turn off System Restore, follow these steps:
1. Click Start, right-click My Computer, and then click Properties.
2. Click the System Restore tab.
3. Click the Turn off System Restore check box (or the Turn off System Restore on all drives check box), and then click OK.
4. Click Yes when you receive the prompt to the turn off System Restore.

Now we need to make a new restore point.
To turn on System Restore, follow these steps:
1. Click Start, right-click My Computer, and then click Properties.
2. Click the System Restore tab.
3. Click the Turn off System Restore check box (To turn on System Restore), and then click OK.

Below I have included a number of recommendations for how to protect your computer in order to prevent future malware infections. Please take these recommendations seriously; these few simple steps can stave off the vast majority of spyware problems. As happy as we are to help you, for your sake we would rather not have repeat customers. Goofy

1) Please navigate to [You must be registered and logged in to see this link.] and download all the "critical updates" for Windows. This can patch many of the security holes through which attackers can gain access to your computer.

Please either enable Automatic Updates under Start -> Control Panel -> Automatic Updates , or get into the habit of checking for Windows updates regularly. I cannot stress enough how important this is.

2) In order to protect yourself against spyware, you should consider installing and running the following free programs:

[You must be registered and logged in to see this link.]
A tutorial on using Ad-Aware to remove spyware from your computer may be found [You must be registered and logged in to see this link.].

[You must be registered and logged in to see this link.]
A tutorial on using Spybot to remove spyware from your computer may be found [You must be registered and logged in to see this link.]. Please also remember to enable Spybot's "Immunize" and "TeaTimer" features.

[You must be registered and logged in to see this link.]
A tutorial on using SpywareBlaster to prevent spyware from ever installing on your computer may be found [You must be registered and logged in to see this link.].

[You must be registered and logged in to see this link.]
A tutorial on using SpywareGuard for realtime protection against spyware and hijackers may be found [You must be registered and logged in to see this link.].

Make sure to keep these programs up-to-date and to run them regularly, as this can prevent a great deal of spyware hassle.

3) Please consider using an alternate browser. Mozilla's Firefox browser is fantastic; it is much more secure than Internet Explorer, immune to almost all known browser hijackers, and also has the best built-in popup blocker (as an added benefit!) that I have ever seen. If you are interested, Firefox may be downloaded from here:
[You must be registered and logged in to see this link.]
I also recommand the following add-ons for Firefox, they will help keep you safe from malicious scripts or activeX exploits.
[You must be registered and logged in to see this link.]
[You must be registered and logged in to see this link.]
[You must be registered and logged in to see this link.]

4) Also make sure to run your antivirus software regularly, and to keep it up-to-date.

To help you keep your software updated, please considering using this free software program that will check for program updates.
[You must be registered and logged in to see this link.]

5) Finally, consider maintaining a firewall. Some good free firewalls are [You must be registered and logged in to see this link.], or
[You must be registered and logged in to see this link.]
A tutorial on understanding and using firewalls may be found [You must be registered and logged in to see this link.].

Please also read Tony Klein's excellent article: [You must be registered and logged in to see this link.]

Hopefully this should take care of your problems! Good luck. Big Grin


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34916
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : XP SP3 Media Centre
Points Points : 245079
# Likes # Likes : 1

View user profile

Back to top Go down

Solved Re: About to fix this with a hammer, help pls

Post by kalyco on 31st December 2008, 5:55 pm

Done everything except the modzilla thing. i will check it out on another machine first and if i like it i will switch. Thank you so much for your help and advice. This site is great and your help is outstanding.

kalyco
Novice
Novice

Posts Posts : 22
Joined Joined : 2008-12-18
OS OS : Windows XP
Points Points : 29278
# Likes # Likes : 0

View user profile

Back to top Go down

Solved Re: About to fix this with a hammer, help pls

Post by Doctor Inferno on 21st February 2009, 9:50 am

Since this issue is resolved, this topic is closed.

If you need this topic reopened, please contact a staff member. This applies only to the original topic starter.

Everyone else, please open a new topic for your questions.


Please be a GeekPolice fan on [You must be registered and logged in to see this link.]



Have we helped you? [You must be registered and logged in to see this link.] | Doctor by day, ninja by night.

Doctor Inferno
Administrator
Administrator

Posts Posts : 12015
Joined Joined : 2007-12-26
Gender Gender : Male
OS OS : Windows 7 Home Premium and Ultimate X64
Protection Protection : Kaspersky PURE and Malwarebytes' Anti-Malware
Points Points : 104610
# Likes # Likes : 0

View user profile

Back to top Go down

View previous topic View next topic Back to top

- Similar topics

 
Permissions in this forum:
You cannot reply to topics in this forum