Re : Need help to remove Zlob.P0rn.ad trojan.

View previous topic View next topic Go down

Solved Re : Need help to remove Zlob.P0rn.ad trojan.

Post by kongfei on Fri Dec 19, 2008 12:50 am

Hi guys,

I need some help to remove a trojan.

1. Zlob.P0rn.ad.

I cant seems to get a solution for this.

Thanks.

------------
Guys, sorry that I missed out the "Read Before Posting" thread. I will post the HijackThis log in here again.

Apologize again. !!

kongfei
Novice
Novice

Posts Posts : 10
Joined Joined : 2008-12-19
OS OS : Window XP Professional
Points Points : 29090
# Likes # Likes : 0

View user profile

Back to top Go down

Solved Re: Re : Need help to remove Zlob.P0rn.ad trojan.

Post by Belahzur on Fri Dec 19, 2008 1:11 am

Awaiting a Hijack This log.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34916
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : XP SP3 Media Centre
Points Points : 245069
# Likes # Likes : 1

View user profile

Back to top Go down

Solved Here is my log file.

Post by kongfei on Fri Dec 19, 2008 5:45 pm

Hi guys,

Below is my log file.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:43:25 AM, on 12/20/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\RTHDCPL.EXE
E:\Nero 7\InCD\NBHGui.exe
E:\Nero 7\InCD\InCD.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\SAMSUNG\FW LiveUpdate\FWManager.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\WINDOWS\system32\ctfmon.exe
D:\Program Files\Internet Download Manager\IDMan.exe
F:\Business Demo\BIBLauncher.exe
C:\Documents and Settings\kongfei.KONGFEI-7BD3F16\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
C:\Program Files\TuneUp Utilities 2008\MemOptimizer.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\Program Files\Qlock\qlock.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
E:\Storm Code\Storm Codec\stormliv.exe
E:\Nero 7\InCD\InCDsrv.exe
E:\Storm Code\Storm Codec\stMgr.exe
C:\Program Files\Java\jre6\bin\jqs.exe
E:\STORMC~1\STORMC~1\Stormser.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\WINDOWS\System32\alg.exe
D:\Program Files\Internet Download Manager\IEMonitor.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = google.com/
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll
R3 - URLSearchHook: (no name) - - (no file)
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\sochost.exe,
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - D:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: WEB反病毒保护 - {523C33CB-510E-4857-9801-78F1D892879C} - C:\WINDOWS\system32\kavsys.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: (no name) - {D0F6605A-06B3-446F-A4AE-EF4F6FE171C1} - (no file)
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [SecurDisc] E:\Nero 7\InCD\NBHGui.exe
O4 - HKLM\..\Run: [InCD] E:\Nero 7\InCD\InCD.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup
O4 - HKLM\..\Run: [Name of App] C:\Program Files\SAMSUNG\FW LiveUpdate\FWManager.exe r
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [IDMan] D:\Program Files\Internet Download Manager\IDMan.exe /onboot
O4 - HKCU\..\Run: [updateMgr] "E:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_7 -reboot 1
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [BIBLauncher] F:\Business Demo\BIBLauncher.exe
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\kongfei.KONGFEI-7BD3F16\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [TuneUp MemOptimizer] "C:\Program Files\TuneUp Utilities 2008\MemOptimizer.exe" autostart
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
O4 - Startup: qlock.lnk = C:\Program Files\Qlock\qlock.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = E:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: Download all links with IDM - D:\Program Files\Internet Download Manager\IEGetAll.htm
O8 - Extra context menu item: Download FLV video content with IDM - D:\Program Files\Internet Download Manager\IEGetVL.htm
O8 - Extra context menu item: Download with IDM - D:\Program Files\Internet Download Manager\IEExt.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - [You must be registered and logged in to see this link.]
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - F:\PROGRA~1\MICROS~1\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - [You must be registered and logged in to see this link.]
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - [You must be registered and logged in to see this link.]
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - [You must be registered and logged in to see this link.]
O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (a-squared Scanner) - [You must be registered and logged in to see this link.]
O17 - HKLM\System\CCS\Services\Tcpip\..\{D6F8E87F-492C-45F4-B83E-0C1AA6076ACD}: NameServer = 202.188.0.133,202.188.1.5
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: tuvWmMDu - tuvWmMDu.dll (file missing)
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: Contrl Center of Storm Media (ccosm) - ???????????? - E:\Storm Code\Storm Codec\stormliv.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - E:\Nero 7\InCD\InCDsrv.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: NBService - Nero AG - E:\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - Unknown owner - C:\Program Files\Spyware Doctor\pctsAuxs.exe (file missing)
O23 - Service: PC Tools Security Service (sdCoreService) - Unknown owner - C:\Program Files\Spyware Doctor\pctsSvc.exe (file missing)
O23 - Service: Stormser - ???? - E:\STORMC~1\STORMC~1\Stormser.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software GmbH - C:\WINDOWS\System32\TuneUpDefragService.exe

--
End of file - 9760 bytes

kongfei
Novice
Novice

Posts Posts : 10
Joined Joined : 2008-12-19
OS OS : Window XP Professional
Points Points : 29090
# Likes # Likes : 0

View user profile

Back to top Go down

Solved Re: Re : Need help to remove Zlob.P0rn.ad trojan.

Post by Belahzur on Fri Dec 19, 2008 5:48 pm

Hello.
Bad news.

Your computer has multiple infections, including a backdoor. A backdoor gives intruders complete control of your computer, logs your keystrokes, steal personal information, etc.

You are strongly advised to do the following:

  • Disconnect the computer from the Internet and from any networked computers until it is cleaned.
  • Back up all your important data except programs. The programs can be reinstalled back from the original disc or from the Net.
  • Call all your banks, financial institutions, credit card companies and inform them that you may be a victim of identity theft and put a watch on your accounts. If you don't mind the hassle, change all your account numbers.
  • From a clean computer, change all your passwords (ISP login password, your email address(es) passwords, financial accounts, PayPal, eBay, Amazon, online groups and forums and any other online activities you carry out which require a username and password).

Do NOT change your passwords from this computer as the attacker will be able to get all the new passwords and transaction records.

Due to its backdoor functionality, your computer is very likely to have been compromised and there is no way that it can be trusted again. Many experts in the security community believe that once infected with this type of Trojan, the best course of action would be to do a reformat and reinstallation of the operating system (OS). However, if you do not have the resources to reinstall your OS and would like me to attempt to clean your machine, I will be happy to do so.

To help you understand more, please take some time to read the following articles:

[You must be registered and logged in to see this link.]
[You must be registered and logged in to see this link.]
[You must be registered and logged in to see this link.]
[You must be registered and logged in to see this link.]
[You must be registered and logged in to see this link.]
[You must be registered and logged in to see this link.]


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34916
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : XP SP3 Media Centre
Points Points : 245069
# Likes # Likes : 1

View user profile

Back to top Go down

Solved Re: Re : Need help to remove Zlob.P0rn.ad trojan.

Post by kongfei on Fri Dec 19, 2008 5:51 pm

Hi Belahzur,

I do no have the neccessary tools to backup my pc as for now. I just would like to clean up all the trojan and etc and then sort of like install protection software on my pc now. Would that be good?

kongfei
Novice
Novice

Posts Posts : 10
Joined Joined : 2008-12-19
OS OS : Window XP Professional
Points Points : 29090
# Likes # Likes : 0

View user profile

Back to top Go down

Solved Re: Re : Need help to remove Zlob.P0rn.ad trojan.

Post by Belahzur on Fri Dec 19, 2008 5:56 pm

Hello. Okay.


  • Open HijackThis
  • Choose "Do a system scan only"
  • Check the boxes in front of these lines:


    R3 - URLSearchHook: (no name) - - (no file)
    F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\sochost.exe,
    O2 - BHO: WEB反病毒保护 - {523C33CB-510E-4857-9801-78F1D892879C} - C:\WINDOWS\system32\kavsys.dll
    O20 - Winlogon Notify: tuvWmMDu - tuvWmMDu.dll (file missing)


  • Press "Fix Checked"
  • Close Hijack This.


Delete these two files in bold:
C:\WINDOWS\system32\sochost.exe <-- becareful of spelling, DO NOT delete svchost.exe
C:\WINDOWS\system32\kavsys.dll

Please disable AVG8 by right clicking the icon in the tray and select exit.


  • Download combofix from here, use the top links - [You must be registered and logged in to see this link.]
  • Double click on ComboFix.exe.
  • Follow the prompts. NOTE:
  • ComboFix will check to see if the Microsoft Windows Recovery Console is installed.
    ***It's strongly recommended to have the Recovery Console installed before doing any malware removal.***

    **Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will automatically proceed with its scan.


  • The Recovery Console provides a recovery/repair mode should a problem occur during a Combofix run.



  • Allow ComboFix to download the Recovery Console.
  • Accept the End-User License Agreement.
  • The Recovery Console will be installed.
  • You will this next prompt that asks if you want to continue the malware scan, select yes



  • Allow combofix to run
  • Post C:\combofix.txt back here.

    Note:
    Do not mouseclick combofix's window whilst it's running. That may cause it to stall.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34916
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : XP SP3 Media Centre
Points Points : 245069
# Likes # Likes : 1

View user profile

Back to top Go down

Solved Re: Re : Need help to remove Zlob.P0rn.ad trojan.

Post by kongfei on Fri Dec 19, 2008 6:15 pm

ComboFix 08-12-18.03 - kongfei 2008-12-20 2:05:31.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.2046.1475 [GMT 8:00]
Running from: c:\documents and settings\kongfei.KONGFEI-7BD3F16\My Documents\Downloads\Programs\ComboFix.exe
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\test.txt
c:\windows\system32\JPpsCcfe.ini
c:\windows\system32\JPpsCcfe.ini2
c:\windows\system32\macsoin.dll
c:\windows\system32\mcrh.tmp
c:\windows\system32\nxltttlb.ini
c:\windows\system32\SysDebug.dll
c:\windows\system32\vmkjwlpf.ini

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_CLBDRIVER
-------\Legacy_RESSDT
-------\Legacy_TDSSSERV.SYS
-------\Service_clbdriver


((((((((((((((((((((((((( Files Created from 2008-11-19 to 2008-12-19 )))))))))))))))))))))))))))))))
.

2008-12-20 01:42 . 2008-12-20 01:42 d-------- c:\program files\Trend Micro
2008-12-18 20:55 . 2008-12-18 20:55 d-------- c:\program files\SUPERAntiSpyware
2008-12-18 20:38 . 2008-12-18 20:38 d-------- c:\program files\Microsoft Silverlight
2008-12-18 20:12 . 2008-07-07 17:35 34,296 --a------ c:\windows\system32\drivers\mbamcatchme.sys
2008-12-18 20:08 . 2008-12-18 20:08 12,247,294 --------- C:\AVG7QT.DAT
2008-12-18 20:04 . 2008-12-18 20:04 d-------- c:\documents and settings\LocalService.NT AUTHORITY\Application Data\AVG7
2008-12-18 20:04 . 2008-12-19 08:00 d-------- c:\documents and settings\kongfei.KONGFEI-7BD3F16\Application Data\AVG7
2008-12-18 20:04 . 2008-12-18 20:04 d-------- c:\documents and settings\All Users.WINDOWS\Application Data\Grisoft
2008-12-18 19:49 . 2008-12-18 19:59 d-------- c:\program files\Common Files\PC Tools
2008-12-18 19:49 . 2008-07-28 12:29 160,792 --a------ c:\windows\system32\drivers\pctfw2.sys
2008-12-18 19:35 . 2008-12-18 19:35 d-------- c:\documents and settings\kongfei.KONGFEI-7BD3F16\Application Data\s_5849_MjV8fHx8MjV8fHwxMjQyMTgyODU0fA_
2008-12-18 19:21 . 2008-12-18 20:03 2,704 --a------ c:\windows\system32\TDSSlxwp.dll
2008-12-18 05:22 . 2008-12-18 19:22 183 --a------ c:\windows\aimpr.ini
2008-12-16 22:02 . 2008-12-18 05:22 d-------- c:\program files\ElcomSoft
2008-12-16 21:23 . 2008-12-16 21:23 d-------- c:\program files\FDRLab
2008-12-10 10:35 . 2008-10-16 14:07 23,576 --a------ c:\windows\system32\wuapi.dll.mui
2008-12-02 15:33 . 2008-12-02 15:33 268 --ah----- C:\sqmdata17.sqm
2008-12-02 15:33 . 2008-12-02 15:33 244 --ah----- C:\sqmnoopt17.sqm
2008-11-28 14:57 . 2008-11-28 14:58 d-------- c:\documents and settings\kongfei.KONGFEI-7BD3F16\Application Data\Red Alert 3
2008-11-28 14:43 . 2008-11-28 14:44 1,570,816 --a------ c:\documents and settings\kongfei.KONGFEI-7BD3F16\Application Data\tsdnwin.dll
2008-11-28 14:42 . 2008-11-28 14:42 d-------- c:\program files\SAMSUNG

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-12-19 18:08 --------- d-----w c:\documents and settings\kongfei.KONGFEI-7BD3F16\Application Data\DMCache
2008-12-19 17:40 --------- d-----w c:\program files\Enigma Software Group
2008-12-18 12:55 --------- d-----w c:\documents and settings\kongfei.KONGFEI-7BD3F16\Application Data\SUPERAntiSpyware.com
2008-12-18 12:54 --------- d-----w c:\program files\Common Files\Wise Installation Wizard
2008-12-18 12:12 --------- d-----w c:\program files\Malwarebytes' Anti-Malware
2008-12-18 12:05 --------- d-----w c:\documents and settings\All Users.WINDOWS\Application Data\Avg7
2008-12-18 11:59 --------- d---a-w c:\documents and settings\All Users.WINDOWS\Application Data\TEMP
2008-12-18 00:52 --------- d-----w c:\documents and settings\kongfei.KONGFEI-7BD3F16\Application Data\uTorrent
2008-12-10 02:51 410,984 ----a-w c:\windows\system32\deploytk.dll
2008-12-09 02:44 --------- d-----w c:\documents and settings\kongfei.KONGFEI-7BD3F16\Application Data\IDM
2008-11-28 06:42 --------- d--h--w c:\program files\InstallShield Installation Information
2008-11-18 15:57 28,672 ----a-w c:\windows\system32\kavsys.dll
2008-11-18 15:57 28,672 ----a-w c:\windows\system32\kavsel.dll
2008-11-18 15:57 20,480 ----a-w c:\windows\system32\kaceyl.exe
2008-11-18 15:57 20,480 ----a-w c:\windows\system32\comftm.exe
2008-11-17 03:32 355,584 ----a-w c:\windows\system32\TuneUpDefragService.exe
2008-11-17 03:32 --------- d-----w c:\program files\TuneUp Utilities 2008
2008-11-17 03:32 --------- d-----w c:\documents and settings\kongfei.KONGFEI-7BD3F16\Application Data\TuneUp Software
2008-11-17 03:32 --------- d-----w c:\documents and settings\All Users.WINDOWS\Application Data\TuneUp Software
2008-11-09 15:14 --------- d-----w c:\documents and settings\All Users.WINDOWS\Application Data\InstallShield
2008-11-09 14:55 --------- d-----w c:\program files\Common Files\InstallShield
2008-11-08 10:39 --------- d-----w c:\documents and settings\All Users.WINDOWS\Application Data\Storm
2008-11-07 13:17 --------- d-----w c:\program files\McAfee
2008-11-07 13:17 --------- d-----w c:\documents and settings\All Users.WINDOWS\Application Data\McAfee
2008-11-07 13:06 --------- d-----w c:\program files\Cheat Engine
2008-10-19 08:23 --------- d-----w c:\program files\Qlock
2008-10-19 08:23 --------- d-----w c:\documents and settings\kongfei.KONGFEI-7BD3F16\Application Data\Qlock
2008-10-16 06:13 1,809,944 ----a-w c:\windows\system32\wuaueng.dll
2008-10-16 06:12 561,688 ----a-w c:\windows\system32\wuapi.dll
2008-10-16 06:12 323,608 ----a-w c:\windows\system32\wucltui.dll
2008-10-16 06:12 202,776 ----a-w c:\windows\system32\wuweb.dll
2008-10-16 06:09 92,696 ----a-w c:\windows\system32\cdm.dll
2008-10-16 06:09 51,224 ----a-w c:\windows\system32\wuauclt.exe
2008-10-16 06:09 43,544 ----a-w c:\windows\system32\wups2.dll
2008-10-16 06:08 34,328 ----a-w c:\windows\system32\wups.dll
2008-10-16 06:07 208,744 ----a-w c:\windows\system32\muweb.dll
.

------- Sigcheck -------

2007-10-31 00:53 360832 64798ecfa43d78c7178375fcdd16d8c8 c:\windows\$hf_mig$\KB941644\SP2QFE\tcpip.sys
2008-06-20 18:44 360960 744e57c99232201ae98c49168b918f48 c:\windows\$hf_mig$\KB951748\SP2QFE\tcpip.sys
2008-06-20 19:51 361600 9aefa14bd6b182d61e3119fa5f436d3d c:\windows\$hf_mig$\KB951748\SP3GDR\tcpip.sys
2008-06-20 19:59 361600 ad978a1b783b5719720cff204b666c8e c:\windows\$hf_mig$\KB951748\SP3QFE\tcpip.sys
2004-08-07 04:00 359040 9f4b36614a0fc234525ba224957de55c c:\windows\$NtUninstallKB941644$\tcpip.sys
2007-10-31 01:20 360064 90caff4b094573449a0872a0f919b178 c:\windows\$NtUninstallKB951748$\tcpip.sys
2008-06-20 18:45 360320 1cc09561e21a48a7f649a40f18235860 c:\windows\system32\dllcache\tcpip.sys
2008-06-20 18:45 360320 1cc09561e21a48a7f649a40f18235860 c:\windows\system32\drivers\tcpip.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2007-06-01 153136]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-07 15360]
"IDMan"="d:\program files\Internet Download Manager\IDMan.exe" [2008-06-18 932864]
"updateMgr"="e:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2005-10-24 307200]
"Yahoo! Pager"="c:\program files\Yahoo!\Messenger\YahooMessenger.exe" [2007-08-30 4670704]
"BIBLauncher"="f:\business demo\BIBLauncher.exe" [2008-02-05 609496]
"Google Update"="c:\documents and settings\kongfei.KONGFEI-7BD3F16\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2008-10-13 133104]
"TuneUp MemOptimizer"="c:\program files\TuneUp Utilities 2008\MemOptimizer.exe" [2008-06-20 153856]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2008-12-04 1809648]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-03-01 153136]
"SecurDisc"="e:\nero 7\InCD\NBHGui.exe" [2007-06-01 1629744]
"InCD"="e:\nero 7\InCD\InCD.exe" [2007-06-01 1057328]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-08-01 13529088]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-06-07 185896]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2005-08-11 81920]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-08-01 86016]
"ISUSPM Startup"="c:\program files\Common Files\InstallShield\UpdateService\isuspm.exe" [2005-08-11 249856]
"Name of App"="c:\program files\SAMSUNG\FW LiveUpdate\FWManager.exe" [2008-07-07 675935]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-12-10 136600]
"AVG7_CC"="c:\progra~1\Grisoft\AVG7\avgcc.exe" [2008-12-18 406016]
"SkyTel"="SkyTel.EXE" [2006-05-16 c:\windows\SkyTel.exe]
"RTHDCPL"="RTHDCPL.EXE" [2006-09-12 c:\windows\RTHDCPL.exe]
"nwiz"="nwiz.exe" [2008-08-01 c:\windows\system32\nwiz.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"AVG7_Run"="c:\progra~1\Grisoft\AVG7\avgw.exe" [2008-12-18 146432]

c:\documents and settings\kongfei.KONGFEI-7BD3F16\Start Menu\Programs\Startup\
qlock.lnk - c:\program files\Qlock\qlock.exe [2008-10-16 4142080]

c:\documents and settings\All Users.WINDOWS\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - e:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 29696]
WinZip Quick Pick.lnk - c:\program files\WinZip\WZQKPICK.EXE [2008-04-28 415072]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-12-03 14:56 352256 c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.divxa32"= msaud32_divx.acm
"msacm.l3acm"= f:\movies\l3codeca.acm

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winlr41.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"e:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"e:\\Storm Code\\Storm Codec\\Storm.exe"=
"e:\\Storm Code\\Storm Codec\\stormliv.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"f:\\Program Files\\CABAL Online (SG MY)\\Launcher\\update\\ESTdnheadless.exe"=
"e:\\Valve\\Condition Zero\\hl.exe"=
"c:\\Program Files\\Common Files\\Ahead\\Nero Web\\SetupX.exe"=
"e:\\Storm Code\\Storm Codec\\Box\\Stline.exe"=
"e:\\Program Files\\AsiaSoft Online\\Rappelz\\Launcher.exe"=
"c:\\Program Files\\Grisoft\\AVG7\\avginet.exe"=
"c:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe"=
"c:\\Program Files\\Grisoft\\AVG7\\avgcc.exe"=
"c:\\Program Files\\Grisoft\\AVG7\\avgw.exe"=

R0 ALLOW-IO;ALLOW-IO;c:\windows\system32\Drivers\ALLOW-IO.sys [2008-02-27 6016]
R1 pctfw2;pctfw2;\??\c:\windows\system32\drivers\pctfw2.sys [2008-12-18 160792]
R2 ccosm;Contrl Center of Storm Media;e:\storm code\Storm Codec\stormliv.exe /asservice [2008-03-11 551008]
R2 Stormser;Stormser;e:\stormc~1\STORMC~1\Stormser.exe [2008-06-27 991232]
S0 Winlr41;Winlr41;c:\windows\system32\Drivers\Winlr41.sys []
S1 SASDIFSV;SASDIFSV;\??\e:\program files\SUPERAntiSpyware\SASDIFSV.SYS []
S1 SASKUTIL;SASKUTIL;\??\e:\program files\SUPERAntiSpyware\SASKUTIL.sys []
S2 sdAuxService;PC Tools Auxiliary Service;c:\program files\Spyware Doctor\pctsAuxs.exe []
S3 DFE528TX;D-Link DFE-528TX PCI Adapter;c:\windows\system32\DRIVERS\DLKRTL.SYS [2008-06-04 45568]
S3 jlock101;jlock101;\??\c:\windows\system32\jlock101.sys [2008-08-08 0]
S3 SASENUM;SASENUM;\??\e:\program files\SUPERAntiSpyware\SASENUM.SYS []
S3 XDva037;XDva037;\??\c:\windows\system32\XDva037.sys []
S3 XDva104;XDva104;\??\c:\windows\system32\XDva104.sys []
S3 XDva121;XDva121;\??\c:\windows\system32\XDva121.sys []
S3 XDva132;XDva132;\??\c:\windows\system32\XDva132.sys []
S3 XDva158;XDva158;\??\c:\windows\system32\XDva158.sys []
S3 XDva165;XDva165;\??\c:\windows\system32\XDva165.sys []
S3 XDva167;XDva167;\??\c:\windows\system32\XDva167.sys []
S3 XDva170;XDva170;\??\c:\windows\system32\XDva170.sys []
S3 XDva187;XDva187;\??\c:\windows\system32\XDva187.sys []
S3 XDva190;XDva190;\??\c:\windows\system32\XDva190.sys []
S3 XDva193;XDva193;\??\c:\windows\system32\XDva193.sys []
S3 XDva195;XDva195;\??\c:\windows\system32\XDva195.sys []
S3 XDva204;XDva204;\??\c:\windows\system32\XDva204.sys []
S3 XDva208;XDva208;\??\c:\windows\system32\XDva208.sys []
S3 XDva215;XDva215;\??\c:\windows\system32\XDva215.sys []

kongfei
Novice
Novice

Posts Posts : 10
Joined Joined : 2008-12-19
OS OS : Window XP Professional
Points Points : 29090
# Likes # Likes : 0

View user profile

Back to top Go down

Solved Re: Re : Need help to remove Zlob.P0rn.ad trojan.

Post by kongfei on Fri Dec 19, 2008 6:15 pm

Second Part of the log. Its too big to be posted up.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{310ad3b4-1d1a-11dd-af18-00003707259e}]
\Shell\AutoRun\command - wd_windows_tools\sMtup.exe
.
Contents of the 'Scheduled Tasks' folder

2008-12-19 c:\windows\Tasks\1-Click Maintenance.job
- c:\program files\TuneUp Utilities 2008\OneClickStarter.exe [2008-06-20 09:09]

2008-12-18 c:\windows\Tasks\GoogleUpdateTaskUser.job
- c:\documents and settings\kongfei.KONGFEI-7BD3F16\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2008-10-13 11:44]
.
- - - - ORPHANS REMOVED - - - -

BHO-{D0F6605A-06B3-446F-A4AE-EF4F6FE171C1} - (no file)
SafeBoot-Winek30.sys


.
------- Supplementary Scan -------
.
uStart Page = google.com/
IE: Download all links with IDM - d:\program files\Internet Download Manager\IEGetAll.htm
IE: Download FLV video content with IDM - d:\program files\Internet Download Manager\IEGetVL.htm
IE: Download with IDM - d:\program files\Internet Download Manager\IEExt.htm
IE: E&xport to Microsoft Excel - e:\progra~1\MICROS~1\Office12\EXCEL.EXE/3000
LSP: c:\program files\Common Files\PC Tools\LSP\PCTLsp.dll
TCP: {D6F8E87F-492C-45F4-B83E-0C1AA6076ACD} = 202.188.0.133,202.188.1.5
FF - ProfilePath -
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, [You must be registered and logged in to see this link.]
Rootkit scan 2008-12-20 02:07:56
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(732)
c:\program files\SUPERAntiSpyware\SASWINLO.dll
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'lsass.exe'(796)
c:\program files\Common Files\PC Tools\LSP\PCTLsp.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\savedump.exe
c:\windows\system32\ati2evxx.exe
c:\windows\system32\ati2evxx.exe
c:\progra~1\Grisoft\AVG7\avgamsvr.exe
c:\progra~1\Grisoft\AVG7\avgupsvc.exe
e:\storm code\Storm Codec\stormliv.exe
e:\nero 7\InCD\InCDsrv.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\progra~1\Yahoo!\MESSEN~1\Ymsgr_tray.exe
e:\storm code\Storm Codec\stMgr.exe
c:\windows\system32\wscntfy.exe
c:\program files\Common Files\Ahead\Lib\NMIndexingService.exe
c:\program files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
d:\program files\Internet Download Manager\IEMonitor.exe
.
**************************************************************************
.
Completion time: 2008-12-20 2:11:06 - machine was rebooted
ComboFix-quarantined-files.txt 2008-12-19 18:10:56

Pre-Run: 2,418,081,792 bytes free
Post-Run: 2,616,946,688 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect /usepmtimer /NoExecute=OptIn

264 --- E O F --- 2008-07-23 14:31:47

kongfei
Novice
Novice

Posts Posts : 10
Joined Joined : 2008-12-19
OS OS : Window XP Professional
Points Points : 29090
# Likes # Likes : 0

View user profile

Back to top Go down

Solved Re: Re : Need help to remove Zlob.P0rn.ad trojan.

Post by Belahzur on Fri Dec 19, 2008 6:29 pm

Now open a new notepad file.
Input this into the notepad file:

KILLALL::

Driver::
Winlr41

File::
c:\windows\system32\TDSSlxwp.dll
C:\sqmdata17.sqm
C:\sqmnoopt17.sqm
c:\documents and settings\kongfei.KONGFEI-7BD3F16\Application Data\tsdnwin.dll
c:\windows\system32\kavsys.dll
c:\windows\system32\kavsel.dll
c:\windows\system32\kaceyl.exe
c:\windows\system32\comftm.exe

Folder::
c:\program files\McAfee
c:\documents and settings\All Users.WINDOWS\Application Data\McAfee

Registry::
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winlr41.sys]

Save this as CFScript.txt, save it to your desktop also.
Then drag and drop CFScript.txt into combofix as seen below:


This will open combofix.exe again, agree to it's terms and allow it to run, it may want to reboot after it's done. Post the resulting log back here.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34916
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : XP SP3 Media Centre
Points Points : 245069
# Likes # Likes : 1

View user profile

Back to top Go down

Solved Re: Re : Need help to remove Zlob.P0rn.ad trojan.

Post by kongfei on Sat Dec 20, 2008 1:27 am

ComboFix 08-12-18.03 - kongfei 2008-12-20 6:00:23.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.2046.1485 [GMT 8:00]
Running from: c:\documents and settings\kongfei.KONGFEI-7BD3F16\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\kongfei.KONGFEI-7BD3F16\Desktop\CFscript.txt
* Created a new restore point

FILE ::
c:\documents and settings\kongfei.KONGFEI-7BD3F16\Application Data\tsdnwin.dll
C:\sqmdata17.sqm
C:\sqmnoopt17.sqm
c:\windows\system32\comftm.exe
c:\windows\system32\kaceyl.exe
c:\windows\system32\kavsel.dll
c:\windows\system32\kavsys.dll
c:\windows\system32\TDSSlxwp.dll
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users.WINDOWS\Application Data\McAfee
c:\documents and settings\All Users.WINDOWS\Application Data\McAfee\MSC\Cache\McSubDB.Bak
c:\documents and settings\All Users.WINDOWS\Application Data\McAfee\MSC\mcifolog.log
c:\documents and settings\All Users.WINDOWS\Application Data\McAfee\MSC\mcini.ini
c:\documents and settings\All Users.WINDOWS\Application Data\McAfee\MSC\McSubDB.Dat
c:\documents and settings\kongfei.KONGFEI-7BD3F16\Application Data\tsdnwin.dll
c:\program files\McAfee
c:\program files\McAfee\Temp\qxz332\mcpmain.inf
c:\program files\McAfee\Temp\qxz332\mscbkupd.inf
c:\program files\McAfee\Temp\qxz332\mscsbt.inf
c:\program files\McAfee\Temp\qxz332\oemcfg.inf
C:\sqmdata17.sqm
C:\sqmnoopt17.sqm
c:\windows\system32\comftm.exe
c:\windows\system32\kaceyl.exe
c:\windows\system32\kavsel.dll
c:\windows\system32\kavsys.dll
c:\windows\system32\TDSSlxwp.dll

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_RESSDT
-------\Legacy_WINLR41
-------\Service_Winlr41


((((((((((((((((((((((((( Files Created from 2008-11-20 to 2008-12-20 )))))))))))))))))))))))))))))))
.

2008-12-20 01:42 . 2008-12-20 01:42 d-------- c:\program files\Trend Micro
2008-12-18 20:55 . 2008-12-18 20:55 d-------- c:\program files\SUPERAntiSpyware
2008-12-18 20:38 . 2008-12-18 20:38 d-------- c:\program files\Microsoft Silverlight
2008-12-18 20:12 . 2008-07-07 17:35 34,296 --a------ c:\windows\system32\drivers\mbamcatchme.sys
2008-12-18 20:08 . 2008-12-18 20:08 12,247,294 --------- C:\AVG7QT.DAT
2008-12-18 20:04 . 2008-12-18 20:04 d-------- c:\documents and settings\LocalService.NT AUTHORITY\Application Data\AVG7
2008-12-18 20:04 . 2008-12-20 09:10 d-------- c:\documents and settings\kongfei.KONGFEI-7BD3F16\Application Data\AVG7
2008-12-18 20:04 . 2008-12-18 20:04 d-------- c:\documents and settings\All Users.WINDOWS\Application Data\Grisoft
2008-12-18 19:49 . 2008-12-18 19:59 d-------- c:\program files\Common Files\PC Tools
2008-12-18 19:49 . 2008-07-28 12:29 160,792 --a------ c:\windows\system32\drivers\pctfw2.sys
2008-12-18 19:35 . 2008-12-18 19:35 d-------- c:\documents and settings\kongfei.KONGFEI-7BD3F16\Application Data\s_5849_MjV8fHx8MjV8fHwxMjQyMTgyODU0fA_
2008-12-18 05:22 . 2008-12-18 19:22 183 --a------ c:\windows\aimpr.ini
2008-12-16 22:02 . 2008-12-18 05:22 d-------- c:\program files\ElcomSoft
2008-12-16 21:23 . 2008-12-16 21:23 d-------- c:\program files\FDRLab
2008-12-10 10:35 . 2008-10-16 14:07 23,576 --a------ c:\windows\system32\wuapi.dll.mui
2008-11-28 14:57 . 2008-11-28 14:58 d-------- c:\documents and settings\kongfei.KONGFEI-7BD3F16\Application Data\Red Alert 3
2008-11-28 14:42 . 2008-11-28 14:42 d-------- c:\program files\SAMSUNG

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-12-20 01:09 --------- d-----w c:\documents and settings\kongfei.KONGFEI-7BD3F16\Application Data\DMCache
2008-12-19 17:40 --------- d-----w c:\program files\Enigma Software Group
2008-12-18 12:55 --------- d-----w c:\documents and settings\kongfei.KONGFEI-7BD3F16\Application Data\SUPERAntiSpyware.com
2008-12-18 12:54 --------- d-----w c:\program files\Common Files\Wise Installation Wizard
2008-12-18 12:12 --------- d-----w c:\program files\Malwarebytes' Anti-Malware
2008-12-18 12:05 --------- d-----w c:\documents and settings\All Users.WINDOWS\Application Data\Avg7
2008-12-18 11:59 --------- d---a-w c:\documents and settings\All Users.WINDOWS\Application Data\TEMP
2008-12-18 00:52 --------- d-----w c:\documents and settings\kongfei.KONGFEI-7BD3F16\Application Data\uTorrent
2008-12-10 02:51 410,984 ----a-w c:\windows\system32\deploytk.dll
2008-12-09 02:44 --------- d-----w c:\documents and settings\kongfei.KONGFEI-7BD3F16\Application Data\IDM
2008-11-28 06:42 --------- d--h--w c:\program files\InstallShield Installation Information
2008-11-17 03:32 355,584 ----a-w c:\windows\system32\TuneUpDefragService.exe
2008-11-17 03:32 --------- d-----w c:\program files\TuneUp Utilities 2008
2008-11-17 03:32 --------- d-----w c:\documents and settings\kongfei.KONGFEI-7BD3F16\Application Data\TuneUp Software
2008-11-17 03:32 --------- d-----w c:\documents and settings\All Users.WINDOWS\Application Data\TuneUp Software
2008-11-09 15:14 --------- d-----w c:\documents and settings\All Users.WINDOWS\Application Data\InstallShield
2008-11-09 14:55 --------- d-----w c:\program files\Common Files\InstallShield
2008-11-08 10:39 --------- d-----w c:\documents and settings\All Users.WINDOWS\Application Data\Storm
2008-11-07 13:06 --------- d-----w c:\program files\Cheat Engine
2008-10-16 06:13 1,809,944 ----a-w c:\windows\system32\wuaueng.dll
2008-10-16 06:12 561,688 ----a-w c:\windows\system32\wuapi.dll
2008-10-16 06:12 323,608 ----a-w c:\windows\system32\wucltui.dll
2008-10-16 06:12 202,776 ----a-w c:\windows\system32\wuweb.dll
2008-10-16 06:09 92,696 ----a-w c:\windows\system32\cdm.dll
2008-10-16 06:09 51,224 ----a-w c:\windows\system32\wuauclt.exe
2008-10-16 06:09 43,544 ----a-w c:\windows\system32\wups2.dll
2008-10-16 06:08 34,328 ----a-w c:\windows\system32\wups.dll
2008-10-16 06:07 208,744 ----a-w c:\windows\system32\muweb.dll
.

------- Sigcheck -------

2007-10-31 00:53 360832 64798ecfa43d78c7178375fcdd16d8c8 c:\windows\$hf_mig$\KB941644\SP2QFE\tcpip.sys
2008-06-20 18:44 360960 744e57c99232201ae98c49168b918f48 c:\windows\$hf_mig$\KB951748\SP2QFE\tcpip.sys
2008-06-20 19:51 361600 9aefa14bd6b182d61e3119fa5f436d3d c:\windows\$hf_mig$\KB951748\SP3GDR\tcpip.sys
2008-06-20 19:59 361600 ad978a1b783b5719720cff204b666c8e c:\windows\$hf_mig$\KB951748\SP3QFE\tcpip.sys
2004-08-07 04:00 359040 9f4b36614a0fc234525ba224957de55c c:\windows\$NtUninstallKB941644$\tcpip.sys
2007-10-31 01:20 360064 90caff4b094573449a0872a0f919b178 c:\windows\$NtUninstallKB951748$\tcpip.sys
2008-06-20 18:45 360320 1cc09561e21a48a7f649a40f18235860 c:\windows\system32\dllcache\tcpip.sys
2008-06-20 18:45 360320 1cc09561e21a48a7f649a40f18235860 c:\windows\system32\drivers\tcpip.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2007-06-01 153136]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-07 15360]
"IDMan"="d:\program files\Internet Download Manager\IDMan.exe" [2008-06-18 932864]
"updateMgr"="e:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2005-10-24 307200]
"Yahoo! Pager"="c:\program files\Yahoo!\Messenger\YahooMessenger.exe" [2007-08-30 4670704]
"BIBLauncher"="f:\business demo\BIBLauncher.exe" [2008-02-05 609496]
"Google Update"="c:\documents and settings\kongfei.KONGFEI-7BD3F16\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2008-10-13 133104]
"TuneUp MemOptimizer"="c:\program files\TuneUp Utilities 2008\MemOptimizer.exe" [2008-06-20 153856]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2008-12-04 1809648]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-03-01 153136]
"SecurDisc"="e:\nero 7\InCD\NBHGui.exe" [2007-06-01 1629744]
"InCD"="e:\nero 7\InCD\InCD.exe" [2007-06-01 1057328]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-08-01 13529088]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-06-07 185896]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2005-08-11 81920]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-08-01 86016]
"ISUSPM Startup"="c:\program files\Common Files\InstallShield\UpdateService\isuspm.exe" [2005-08-11 249856]
"Name of App"="c:\program files\SAMSUNG\FW LiveUpdate\FWManager.exe" [2008-07-07 675935]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-12-10 136600]
"AVG7_CC"="c:\progra~1\Grisoft\AVG7\avgcc.exe" [2008-12-18 406016]
"SkyTel"="SkyTel.EXE" [2006-05-16 c:\windows\SkyTel.exe]
"RTHDCPL"="RTHDCPL.EXE" [2006-09-12 c:\windows\RTHDCPL.exe]
"nwiz"="nwiz.exe" [2008-08-01 c:\windows\system32\nwiz.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"AVG7_Run"="c:\progra~1\Grisoft\AVG7\avgw.exe" [2008-12-18 146432]

c:\documents and settings\kongfei.KONGFEI-7BD3F16\Start Menu\Programs\Startup\
qlock.lnk - c:\program files\Qlock\qlock.exe [2008-10-16 4142080]

c:\documents and settings\All Users.WINDOWS\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - e:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 29696]
WinZip Quick Pick.lnk - c:\program files\WinZip\WZQKPICK.EXE [2008-04-28 415072]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-12-03 14:56 352256 c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.divxa32"= msaud32_divx.acm
"msacm.l3acm"= f:\movies\l3codeca.acm

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"e:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"e:\\Storm Code\\Storm Codec\\Storm.exe"=
"e:\\Storm Code\\Storm Codec\\stormliv.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"f:\\Program Files\\CABAL Online (SG MY)\\Launcher\\update\\ESTdnheadless.exe"=
"e:\\Valve\\Condition Zero\\hl.exe"=
"c:\\Program Files\\Common Files\\Ahead\\Nero Web\\SetupX.exe"=
"e:\\Storm Code\\Storm Codec\\Box\\Stline.exe"=
"e:\\Program Files\\AsiaSoft Online\\Rappelz\\Launcher.exe"=
"c:\\Program Files\\Grisoft\\AVG7\\avginet.exe"=
"c:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe"=
"c:\\Program Files\\Grisoft\\AVG7\\avgcc.exe"=
"c:\\Program Files\\Grisoft\\AVG7\\avgw.exe"=

R0 ALLOW-IO;ALLOW-IO;c:\windows\system32\Drivers\ALLOW-IO.sys [2008-02-27 6016]
R1 pctfw2;pctfw2;\??\c:\windows\system32\drivers\pctfw2.sys [2008-12-18 160792]
R2 ccosm;Contrl Center of Storm Media;e:\storm code\Storm Codec\stormliv.exe /asservice [2008-03-11 551008]
R2 Stormser;Stormser;e:\stormc~1\STORMC~1\Stormser.exe [2008-06-27 991232]
S1 SASDIFSV;SASDIFSV;\??\e:\program files\SUPERAntiSpyware\SASDIFSV.SYS []
S1 SASKUTIL;SASKUTIL;\??\e:\program files\SUPERAntiSpyware\SASKUTIL.sys []
S2 sdAuxService;PC Tools Auxiliary Service;c:\program files\Spyware Doctor\pctsAuxs.exe []
S3 DFE528TX;D-Link DFE-528TX PCI Adapter;c:\windows\system32\DRIVERS\DLKRTL.SYS [2008-06-04 45568]
S3 jlock101;jlock101;\??\c:\windows\system32\jlock101.sys [2008-08-08 0]
S3 SASENUM;SASENUM;\??\e:\program files\SUPERAntiSpyware\SASENUM.SYS []
S3 XDva037;XDva037;\??\c:\windows\system32\XDva037.sys []
S3 XDva104;XDva104;\??\c:\windows\system32\XDva104.sys []
S3 XDva121;XDva121;\??\c:\windows\system32\XDva121.sys []
S3 XDva132;XDva132;\??\c:\windows\system32\XDva132.sys []
S3 XDva158;XDva158;\??\c:\windows\system32\XDva158.sys []
S3 XDva165;XDva165;\??\c:\windows\system32\XDva165.sys []
S3 XDva167;XDva167;\??\c:\windows\system32\XDva167.sys []
S3 XDva170;XDva170;\??\c:\windows\system32\XDva170.sys []
S3 XDva187;XDva187;\??\c:\windows\system32\XDva187.sys []
S3 XDva190;XDva190;\??\c:\windows\system32\XDva190.sys []
S3 XDva193;XDva193;\??\c:\windows\system32\XDva193.sys []
S3 XDva195;XDva195;\??\c:\windows\system32\XDva195.sys []
S3 XDva204;XDva204;\??\c:\windows\system32\XDva204.sys []
S3 XDva208;XDva208;\??\c:\windows\system32\XDva208.sys []
S3 XDva215;XDva215;\??\c:\windows\system32\XDva215.sys []

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{310ad3b4-1d1a-11dd-af18-00003707259e}]
\Shell\AutoRun\command - wd_windows_tools\sMtup.exe
.
Contents of the 'Scheduled Tasks' folder

2008-12-20 c:\windows\Tasks\1-Click Maintenance.job
- c:\program files\TuneUp Utilities 2008\OneClickStarter.exe [2008-06-20 09:09]

2008-12-19 c:\windows\Tasks\GoogleUpdateTaskUser.job
- c:\documents and settings\kongfei.KONGFEI-7BD3F16\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2008-10-13 11:44]
.
.

kongfei
Novice
Novice

Posts Posts : 10
Joined Joined : 2008-12-19
OS OS : Window XP Professional
Points Points : 29090
# Likes # Likes : 0

View user profile

Back to top Go down

Solved Re: Re : Need help to remove Zlob.P0rn.ad trojan.

Post by kongfei on Sat Dec 20, 2008 1:28 am

------- Supplementary Scan -------
.
uStart Page = google.com/
IE: Download all links with IDM - d:\program files\Internet Download Manager\IEGetAll.htm
IE: Download FLV video content with IDM - d:\program files\Internet Download Manager\IEGetVL.htm
IE: Download with IDM - d:\program files\Internet Download Manager\IEExt.htm
IE: E&xport to Microsoft Excel - e:\progra~1\MICROS~1\Office12\EXCEL.EXE/3000
LSP: c:\program files\Common Files\PC Tools\LSP\PCTLsp.dll
TCP: {D6F8E87F-492C-45F4-B83E-0C1AA6076ACD} = 202.188.0.133,202.188.1.5
FF - ProfilePath -
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, [You must be registered and logged in to see this link.]
Rootkit scan 2008-12-20 09:08:41
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...


c:\docume~1\KONGFE~1.KON\LOCALS~1\Temp\lucene-8f1fcbf021dcd382c7e990dd6e7ba569-commit.lock 0 bytes

scan completed successfully
hidden files: 1

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(728)
c:\program files\SUPERAntiSpyware\SASWINLO.dll
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'lsass.exe'(792)
c:\program files\Common Files\PC Tools\LSP\PCTLsp.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\ati2evxx.exe
c:\windows\system32\ati2evxx.exe
c:\progra~1\Grisoft\AVG7\avgamsvr.exe
c:\progra~1\Grisoft\AVG7\avgupsvc.exe
e:\storm code\Storm Codec\stormliv.exe
e:\nero 7\InCD\InCDsrv.exe
e:\storm code\Storm Codec\stMgr.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\progra~1\Yahoo!\MESSEN~1\Ymsgr_tray.exe
c:\program files\Common Files\Ahead\Lib\NMIndexingService.exe
c:\program files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
c:\windows\system32\wscntfy.exe
d:\program files\Internet Download Manager\IEMonitor.exe
.
**************************************************************************
.
Completion time: 2008-12-20 9:25:29 - machine was rebooted
ComboFix-quarantined-files.txt 2008-12-20 01:25:26
ComboFix2.txt 2008-12-19 18:11:07

Pre-Run: 2,605,367,296 bytes free
Post-Run: 2,596,540,416 bytes free

259 --- E O F --- 2008-07-23 14:31:47

kongfei
Novice
Novice

Posts Posts : 10
Joined Joined : 2008-12-19
OS OS : Window XP Professional
Points Points : 29090
# Likes # Likes : 0

View user profile

Back to top Go down

Solved Re: Re : Need help to remove Zlob.P0rn.ad trojan.

Post by Belahzur on Sat Dec 20, 2008 1:30 am

Looks okay now, what problems remain?


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34916
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : XP SP3 Media Centre
Points Points : 245069
# Likes # Likes : 1

View user profile

Back to top Go down

Solved Re: Re : Need help to remove Zlob.P0rn.ad trojan.

Post by kongfei on Sat Dec 20, 2008 1:35 am

Great. Just now I cant sign in to my MSN and the internet is like slow. But now i guess its back to normal. So, one thing ... my pc now is still not secure rite? As you mention earlier, the best way is still to reformat it. This means for now, its better that I do not access website like banking, or other important sites to prevent my password to be leaked out?

What else can i do if i do not want to reformat my pc. Change my IP address? Sorry as I'm not a very computer literate person. Btw, thank you very much for your hard work Smile. Its great to have you guys out there to help people around. Smile

kongfei
Novice
Novice

Posts Posts : 10
Joined Joined : 2008-12-19
OS OS : Window XP Professional
Points Points : 29090
# Likes # Likes : 0

View user profile

Back to top Go down

Solved Re: Re : Need help to remove Zlob.P0rn.ad trojan.

Post by Belahzur on Sat Dec 20, 2008 2:40 pm

Hello.
Yes, I advice don't do any online banking from this machine.
You can't really change your IP without changing your ISP. There are ways to change it, but they can cause problems and are just generally annoying to remember.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34916
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : XP SP3 Media Centre
Points Points : 245069
# Likes # Likes : 1

View user profile

Back to top Go down

Solved Re: Re : Need help to remove Zlob.P0rn.ad trojan.

Post by Doctor Inferno on Sat Jan 24, 2009 10:15 am

Since this issue is resolved, this topic is closed.

If you need this topic reopened, please contact a staff member. This applies only to the original topic starter.

Everyone else, please open a new topic for your questions.


Please be a GeekPolice fan on [You must be registered and logged in to see this link.]



Have we helped you? [You must be registered and logged in to see this link.] | Doctor by day, ninja by night.

Doctor Inferno
Administrator
Administrator

Posts Posts : 12015
Joined Joined : 2007-12-26
Gender Gender : Male
OS OS : Windows 7 Home Premium and Ultimate X64
Protection Protection : Kaspersky PURE and Malwarebytes' Anti-Malware
Points Points : 104600
# Likes # Likes : 0

View user profile

Back to top Go down

Solved Re: Re : Need help to remove Zlob.P0rn.ad trojan.

Post by Doctor Inferno on Sat Jan 24, 2009 10:15 am

Since this issue is resolved, this topic is closed.

If you need this topic reopened, please contact a staff member. This applies only to the original topic starter.

Everyone else, please open a new topic for your questions.


Please be a GeekPolice fan on [You must be registered and logged in to see this link.]



Have we helped you? [You must be registered and logged in to see this link.] | Doctor by day, ninja by night.

Doctor Inferno
Administrator
Administrator

Posts Posts : 12015
Joined Joined : 2007-12-26
Gender Gender : Male
OS OS : Windows 7 Home Premium and Ultimate X64
Protection Protection : Kaspersky PURE and Malwarebytes' Anti-Malware
Points Points : 104600
# Likes # Likes : 0

View user profile

Back to top Go down

View previous topic View next topic Back to top

- Similar topics

 
Permissions in this forum:
You cannot reply to topics in this forum