Infected with avirus/spyware and my system restarts every minute

View previous topic View next topic Go down

Solved Infected with avirus/spyware and my system restarts every minute

Post by amir on 21st December 2008, 11:38 pm

Hi there my laptop is infected with a virus and when I start the laptop it gives me a message about something that doesn't starts propaply then my laptop restarts again. I work now in safe mode here is the hijackthislog thanks

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 0:38:07, on 22-12-2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Safe mode with network support

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\WISPTIS.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = [You must be registered and logged in to see this link.]
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Packard Bell
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O3 - Toolbar: Veoh Browser Plug-in - {D0943516-5076-4020-A3B5-AEFAF26AB263} - C:\Program Files\Veoh Networks\Veoh\Plugins\reg\VeohToolbar.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [Icon] C:\WINDOWS\system32\drivers\Icon.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [UpdateManager] "c:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [HerculesCamService] C:\Program Files\Hercules\Hercules DualPix HD Webcam\CamService.exe
O4 - HKLM\..\Run: [LifeCam] "C:\Program Files\Microsoft LifeCam\LifeExp.exe"
O4 - HKLM\..\Run: [VX3000] C:\WINDOWS\vVX3000.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [iSecurity applet] rundll32.exe iSecurity.cpl,SecurityMonitor
O4 - HKLM\..\Run: [XP SecurityCenter] "C:\Program Files\XPSecurityCenter\xpsecuritycenter.exe" /hide
O4 - HKLM\..\Run: [ypops] C:\Program Files\Mypops\ypops.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [BM234c9a67] Rundll32.exe "C:\WINDOWS\system32\synuufvf.dll",s
O4 - HKLM\..\Run: [braviax] C:\WINDOWS\system32\braviax.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Veoh] "C:\Program Files\Veoh Networks\Veoh\VeohClient.exe" /VeohHide
O4 - HKCU\..\Run: [braviax] C:\WINDOWS\system32\braviax.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Amir\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Lokale service')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Netwerkservice')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: SANTIS USB and PC Card Utility.lnk = C:\Program Files\Siemens\SANTIS WLAN\WlanMonitor.exe
O4 - Global Startup: vtjl.exe
O8 - Extra context menu item: E&xporteren naar Microsoft Excel - [You must be registered and logged in to see this link.]
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: In weblog opnemen - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &In weblog opnemen met Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Onderzoek - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=file://C:\APPS\IE\offline\nl.htm
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - [You must be registered and logged in to see this link.]
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - [You must be registered and logged in to see this link.]
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - [You must be registered and logged in to see this link.]
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - [You must be registered and logged in to see this link.]
O16 - DPF: {7FC1B346-83E6-4774-8D20-1A6B09B0E737} (Windows Live Photo Upload Control) - [You must be registered and logged in to see this link.]
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - [You must be registered and logged in to see this link.]
O20 - AppInit_DLLs: iSecurity.cpl
O21 - SSODL: iSecurity - {A8311E8F-E459-4D22-89B4-CB9DCF10A425} - iSecurity.cpl (file missing)
O23 - Service: Mobiel Apple apparaat (Apple Mobile Device) - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: Bonjour-service (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod-service (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe

--
End of file - 7050 bytes

amir
Novice
Novice

Posts Posts : 6
Joined Joined : 2008-12-21
OS OS : Windows xp pro
Points Points : 29093
# Likes # Likes : 0

View user profile

Back to top Go down

Solved Re: Infected with avirus/spyware and my system restarts every minute

Post by Belahzur on 21st December 2008, 11:57 pm

Hello.


  • Open HijackThis
  • Choose "Do a system scan only"
  • Check the boxes in front of these lines:


    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = [You must be registered and logged in to see this link.]
    O4 - HKLM\..\Run: [Icon] C:\WINDOWS\system32\drivers\Icon.exe
    O4 - HKLM\..\Run: [iSecurity applet] rundll32.exe iSecurity.cpl,SecurityMonitor
    O4 - HKLM\..\Run: [XP SecurityCenter] "C:\Program Files\XPSecurityCenter\xpsecuritycenter.exe" /hide
    O4 - HKLM\..\Run: [BM234c9a67] Rundll32.exe "C:\WINDOWS\system32\synuufvf.dll",s
    O4 - HKLM\..\Run: [braviax] C:\WINDOWS\system32\braviax.exe
    O4 - HKCU\..\Run: [braviax] C:\WINDOWS\system32\braviax.exe
    O4 - Global Startup: vtjl.exe
    O20 - AppInit_DLLs: iSecurity.cpl
    O21 - SSODL: iSecurity - {A8311E8F-E459-4D22-89B4-CB9DCF10A425} - iSecurity.cpl (file missing)


  • Press "Fix Checked"
  • Close Hijack This.


I think you may have the tdss rootkit.
I want to run a test for it, while taking out some of the garbage as well.

1. Please download The Avenger by Swandog46 to your Desktop
Link: [You must be registered and logged in to see this link.].

  • Click on Avenger.zip to open the file
  • Extract avenger.exe to your desktop
2. Copy all the text contained in the code box below to your Clipboard by highlighting it and pressing (Ctrl+CCrying


Files to delete:
C:\WINDOWS\system32\drivers\Icon.exe
C:\WINDOWS\system32\braviax.exe
C:\WINDOWS\system32\synuufvf.dll
C:\Program Files\XPSecurityCenter\xpsecuritycenter.exe
c:\WINDOWS\system32\iSecurity.cpl

Folders to delete:
C:\Program Files\XPSecurityCenter

Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.


3. Now, start The Avenger program by clicking on its icon on your desktop.

  • Under "Input script here:", paste in the script from the quote box above.
  • Leave the ticked box "Scan for rootkit" ticked.
  • Then tick "Disable any rootkits found"
  • Now click on the Execute to begin execution of the script.
  • Answer "Yes" twice when prompted.

    The Avenger will automatically do the following:

  • It will Restart your computer.
  • On reboot, it will briefly open a black command window on your desktop, this is normal.
  • After the restart, it creates a log file that should open with the results of Avenger’s actions. This log file will be located at C:\avenger.txt
  • The Avenger will also have backed up all the files, etc., that you asked it to delete, and will have zipped them and moved the zip archives to C:\avenger\backup.zip.
5. Please copy/paste the content of c:\avenger.txt into your reply.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34918
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : 7 Home Premium x64
Points Points : 245091
# Likes # Likes : 1

View user profile

Back to top Go down

Solved Re: Infected with avirus/spyware and my system restarts every minute

Post by amir on 22nd December 2008, 1:09 pm

I keep getting messages of antivirus 2009 Here's the avengerlog:

Logfile of The Avenger Version 2.0, (c) by Swandog46
[You must be registered and logged in to see this link.]

Platform: Windows XP

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.
No rootkits found!

File "C:\WINDOWS\system32\drivers\Icon.exe" deleted successfully.

Error: file "C:\WINDOWS\system32\braviax.exe" not found!
Deletion of file "C:\WINDOWS\system32\braviax.exe" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist


Error: file "C:\WINDOWS\system32\synuufvf.dll" not found!
Deletion of file "C:\WINDOWS\system32\synuufvf.dll" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist


Error: could not open file "C:\Program Files\XPSecurityCenter\xpsecuritycenter.exe"
Deletion of file "C:\Program Files\XPSecurityCenter\xpsecuritycenter.exe" failed!
Status: 0xc000003a (STATUS_OBJECT_PATH_NOT_FOUND)
--> bad path / the parent directory does not exist

File "c:\WINDOWS\system32\iSecurity.cpl" deleted successfully.

Error: folder "C:\Program Files\XPSecurityCenter" not found!
Deletion of folder "C:\Program Files\XPSecurityCenter" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist


Completed script processing.

*******************

Finished! Terminate.

amir
Novice
Novice

Posts Posts : 6
Joined Joined : 2008-12-21
OS OS : Windows xp pro
Points Points : 29093
# Likes # Likes : 0

View user profile

Back to top Go down

Solved Re: Infected with avirus/spyware and my system restarts every minute

Post by Belahzur on 22nd December 2008, 4:28 pm

It's okay, keep ignoring the warning, we'll get rid of whatever is still present now.


  • Download combofix from here, use the top links - [You must be registered and logged in to see this link.]
  • Double click on ComboFix.exe.
  • Follow the prompts. NOTE:
  • ComboFix will check to see if the Microsoft Windows Recovery Console is installed.
    ***It's strongly recommended to have the Recovery Console installed before doing any malware removal.***

    **Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will automatically proceed with its scan.


  • The Recovery Console provides a recovery/repair mode should a problem occur during a Combofix run.



  • Allow ComboFix to download the Recovery Console.
  • Accept the End-User License Agreement.
  • The Recovery Console will be installed.
  • You will then get this next prompt that asks if you want to continue the malware scan, select yes



  • Allow combofix to run
  • Post C:\combofix.txt back here.

    Note:
    Do not mouseclick combofix's window whilst it's running. That may cause it to stall.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34918
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : 7 Home Premium x64
Points Points : 245091
# Likes # Likes : 1

View user profile

Back to top Go down

Solved Re: Infected with avirus/spyware and my system restarts every minute

Post by amir on 22nd December 2008, 6:55 pm

ComboFix 08-12-21.04 - Amir 2008-12-22 18:00:57.2 - NTFSx86 NETWORK
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1043.18.511.376 [GMT 1:00]
Gestart vanuit: c:\documents and settings\Amir\Bureaublad\ComboFix.exe
.

(((((((((((((((((((((((((((((((((( Andere Verwijderingen )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\acowejnq.ini
c:\windows\system32\adefvsgj.dll
c:\windows\system32\almdpdwo.ini
c:\windows\system32\aomxapxj.ini
c:\windows\system32\aqiosrpl.ini
c:\windows\system32\Ati2evxx.dll
c:\windows\system32\avwuhmvg.ini
c:\windows\system32\bcwqbdfk.ini
c:\windows\system32\bficxedc.ini
c:\windows\system32\biylvxio.dll
c:\windows\system32\bscbxrsj.ini
c:\windows\system32\cfhhk.ini
c:\windows\system32\cfhhk.ini2
c:\windows\system32\chnnpvco.ini
c:\windows\system32\chtcbnkm.ini
c:\windows\system32\ckqudsra.ini
c:\windows\system32\cmjeryrk.ini
c:\windows\system32\cnpgmnav.ini
c:\windows\system32\cvqobgkw.ini
c:\windows\system32\cwwxjabi.ini
c:\windows\system32\dcfawokn.ini
c:\windows\system32\dgqbxlse.ini
c:\windows\system32\dlvhqtkb.ini
c:\windows\system32\dnaasigt.ini
c:\windows\system32\dnyhfokt.ini
c:\windows\system32\dusodyhe.ini
c:\windows\system32\ebpvsuid.ini
c:\windows\system32\edkedatf.ini
c:\windows\system32\edsqyhyy.ini
c:\windows\system32\eejusshd.ini
c:\windows\system32\ehoadaaq.ini
c:\windows\system32\ehucscgr.ini
c:\windows\system32\epyhymwf.ini
c:\windows\system32\eqaiqwgo.ini
c:\windows\system32\etoqklya.ini
c:\windows\system32\evvraefq.ini
c:\windows\system32\fabratbv.ini
c:\windows\system32\frmeorxv.ini
c:\windows\system32\frslonfq.ini
c:\windows\system32\fukpepgp.ini
c:\windows\system32\fuqrktnm.ini
c:\windows\system32\gaadsgdl.ini
c:\windows\system32\gagiioju.ini
c:\windows\system32\ghmtmwnx.ini
c:\windows\system32\giaygnmc.ini
c:\windows\system32\gmkgteen.ini
c:\windows\system32\gqbhwgkn.ini
c:\windows\system32\haehwfyl.ini
c:\windows\system32\hcmkctpj.ini
c:\windows\system32\hdheeldl.ini
c:\windows\system32\hfrgxqnr.ini
c:\windows\system32\hggeecd.dll
c:\windows\system32\hhkcahqi.ini
c:\windows\system32\hkwsailb.ini
c:\windows\system32\hpqmaula.ini
c:\windows\system32\hqgtavko.ini
c:\windows\system32\hsgvggoc.ini
c:\windows\system32\ifdyukpw.ini
c:\windows\system32\ikmgadmv.ini
c:\windows\system32\ipkvnhmm.ini
c:\windows\system32\ipltqnel.ini
c:\windows\system32\ishcvfoa.ini
c:\windows\system32\ivkjljro.ini
c:\windows\system32\ivmyftrn.ini
c:\windows\system32\ixtnmerp.ini
c:\windows\system32\jcyracul.ini
c:\windows\system32\jefjrgem.ini
c:\windows\system32\jfwkkkow.ini
c:\windows\system32\jgsvfeda.ini
c:\windows\system32\jkbhxqei.ini
c:\windows\system32\jqhngycd.ini
c:\windows\system32\jstgglci.ini
c:\windows\system32\juarewnp.ini
c:\windows\system32\juhyaduy.ini
c:\windows\system32\kcvdikpu.ini
c:\windows\system32\kddgqjeo.ini
c:\windows\system32\khhfc.dll
c:\windows\system32\kkbhvwdo.ini
c:\windows\system32\kwelciyf.ini
c:\windows\system32\kwkyvocd.ini
c:\windows\system32\kxtjdurr.ini
c:\windows\system32\kyjaupyx.ini
c:\windows\system32\lbylasfo.ini
c:\windows\system32\lfbhobcy.ini
c:\windows\system32\lgvexmog.ini
c:\windows\system32\ljkdnbpu.ini
c:\windows\system32\mbdpbnqp.ini
c:\windows\system32\mgfcbfkv.ini
c:\windows\system32\mkfrjwir.ini
c:\windows\system32\mtjeqaaa.ini
c:\windows\system32\mvdteygy.ini
c:\windows\system32\ncobnfrb.ini
c:\windows\system32\neufhqlp.ini
c:\windows\system32\nimwpuua.ini
c:\windows\system32\nriyoojr.ini
c:\windows\system32\nvqtfvqr.ini
c:\windows\system32\nwigjbmt.ini
c:\windows\system32\nwqrkrcp.ini
c:\windows\system32\odackdrd.ini
c:\windows\system32\ofyijyoj.ini
c:\windows\system32\ohvdewfh.ini
c:\windows\system32\ojwcisll.ini
c:\windows\system32\pjmgnxhn.ini
c:\windows\system32\pnuahnei.ini
c:\windows\system32\ppbaitew.ini
c:\windows\system32\ptcbrcyp.ini
c:\windows\system32\qcnfvbhl.ini
c:\windows\system32\qdqssvgu.ini
c:\windows\system32\qkbhajon.ini
c:\windows\system32\qmidngkf.ini
c:\windows\system32\qvsygvqg.ini
c:\windows\system32\qxedbggs.ini
c:\windows\system32\rdrwfx.dll
c:\windows\system32\rhqooiey.ini
c:\windows\system32\rmeoyuff.ini
c:\windows\system32\roxxxgin.ini
c:\windows\system32\ruqbhfco.ini
c:\windows\system32\rvajptqi.ini
c:\windows\system32\rvgqdxax.ini
c:\windows\system32\rwpcacba.ini
c:\windows\system32\rywvxlkm.ini
c:\windows\system32\scwmqmxy.ini
c:\windows\system32\snjogluf.ini
c:\windows\system32\soaatmug.ini
c:\windows\system32\soqoawim.ini
c:\windows\system32\tflttmou.ini
c:\windows\system32\tfushuyd.ini
c:\windows\system32\tifflmey.ini
c:\windows\system32\tiorloga.ini
c:\windows\system32\tjhvcunl.ini
c:\windows\system32\trdfyedf.ini
c:\windows\system32\tttwa.ini
c:\windows\system32\tttwa.ini2
c:\windows\system32\tvixabku.ini
c:\windows\system32\uagpjbav.ini
c:\windows\system32\udxqokts.ini
c:\windows\system32\ulajlpiy.ini
c:\windows\system32\uouegoes.ini
c:\windows\system32\urasqcpu.ini
c:\windows\system32\uwkcikqg.ini
c:\windows\system32\vabfvwtu.ini
c:\windows\system32\vbragbts.ini
c:\windows\system32\vfmjapfr.ini
c:\windows\system32\vguefoyx.ini
c:\windows\system32\viuoniwt.ini
c:\windows\system32\vjqmqbcw.ini
c:\windows\system32\wbavnspg.ini
c:\windows\system32\wdnvfmwe.ini
c:\windows\system32\wdufjkfw.ini
c:\windows\system32\whqvshad.ini
c:\windows\system32\wmmhrbmu.ini
c:\windows\system32\wpkuydfi.dll
c:\windows\system32\wqwsnjyt.ini
c:\windows\system32\wrkljoed.dll
c:\windows\system32\wstyqdaq.ini
c:\windows\system32\wxxbc.ini
c:\windows\system32\wxxbc.ini2
c:\windows\system32\xbcadsac.ini
c:\windows\system32\xbclktdi.ini
c:\windows\system32\xhueufvq.ini
c:\windows\system32\xiwawfqa.ini
c:\windows\system32\xjmtofxo.ini
c:\windows\system32\xlbcnwbc.ini
c:\windows\system32\xlequuqu.ini
c:\windows\system32\xnhyhkyq.ini
c:\windows\system32\xnugcmak.ini
c:\windows\system32\xvrmmcam.ini
c:\windows\system32\xvufaafe.ini
c:\windows\system32\yjayyvqs.ini
c:\windows\system32\yjruoqpi.ini
c:\windows\system32\ylucwnxa.ini
c:\windows\system32\ytisdpfk.ini
c:\windows\system32\yxhewugg.ini
c:\windows\system32\yywdrqmo.ini
c:\windows\system32\zijell.dll
.

amir
Novice
Novice

Posts Posts : 6
Joined Joined : 2008-12-21
OS OS : Windows xp pro
Points Points : 29093
# Likes # Likes : 0

View user profile

Back to top Go down

Solved Re: Infected with avirus/spyware and my system restarts every minute

Post by amir on 22nd December 2008, 6:55 pm

---- Previous Run -------
.
C:\Advanced XP Defender.lnk
C:\Advanced XP Fixer.lnk
c:\docume~1\Amir\LOCALS~1\Temp\install_flash_player.exe
c:\docume~1\Amir\LOCALS~1\Temp\snapsnet.exe
c:\documents and settings\Amir\Bureaublad\Advanced XP Defender.lnk
c:\documents and settings\Amir\Bureaublad\Advanced XP Fixer.lnk
c:\documents and settings\Amir\Bureaublad\SystemDefender.lnk
c:\documents and settings\Amir\Local Settings\Tempmbroit.exe
C:\iSecurity
c:\program files\AntiSpywareMaster
c:\program files\iSecurity
c:\program files\iSecurity\axpdefender.bmp
c:\program files\iSecurity\axpdefender.ico
c:\program files\iSecurity\axpdefenderi.bmp
c:\program files\iSecurity\axpfixer.bmp
c:\program files\iSecurity\axpfixer.ico
c:\program files\iSecurity\axpfixeri.bmp
c:\program files\iSecurity\iSecurity.dat
c:\program files\iSecurity\iSecurity.html
c:\program files\iSecurity\systemdefender.bmp
c:\program files\iSecurity\systemdefender.ico
c:\program files\iSecurity\systemdefenderi.bmp
c:\program files\iSecurity\v12\iSecurity.cpl
C:\SystemDefender.lnk
c:\windows\17PHolmes572.exe
c:\windows\BM234c9a67.txt
c:\windows\BM234c9a67.xml
c:\windows\cookies.ini
c:\windows\pskt.ini
c:\windows\system32\mcrh.tmp
c:\windows\system32\nwourvqm.dll
c:\windows\system32\UpMedia
c:\windows\system32\winivstr.exe

.
(((((((((((((((((((( Bestanden Gemaakt van 2008-11-22 to 2008-12-22 ))))))))))))))))))))))))))))))
.

2008-12-22 00:37 . 2008-12-22 00:37 d-------- c:\program files\Trend Micro
2008-12-22 00:11 . 2008-12-22 00:11 d-------- c:\program files\Classic Menu for Office
2008-12-22 00:11 . 2008-12-22 00:11 d-a------ c:\documents and settings\All Users\Application Data\TEMP
2008-12-22 00:09 . 2008-12-22 00:56 664 --a------ c:\windows\system32\d3d9caps.dat
2008-12-06 19:24 . 2008-12-06 19:24 d-------- c:\documents and settings\Amir\Application Data\Kazaa Lite

.
((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-12-21 23:13 216 ----a-w c:\documents and settings\Amir\delself.bat
2008-12-21 23:11 --------- d-----w c:\documents and settings\Amir\Application Data\uTorrent
2008-12-11 19:00 --------- d-----w c:\program files\uTorrent
2008-12-06 18:35 --------- d-----w c:\documents and settings\Amir\Application Data\Apple Computer
2008-12-06 18:34 --------- d-----w c:\documents and settings\Amir\Application Data\LimeWire
2008-11-25 18:38 --------- d-----w c:\program files\Mypops
2008-11-19 16:36 --------- d-----w c:\documents and settings\All Users\Application Data\FLEXnet
2008-11-13 22:00 --------- d-----w c:\program files\DivX
2008-11-07 21:08 --------- d-----w c:\program files\Apple Software Update
2008-11-06 21:54 --------- d-----w c:\program files\iTunes
2008-11-06 21:54 --------- d-----w c:\documents and settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2008-11-06 21:52 --------- d-----w c:\program files\iPod
2008-11-06 21:43 --------- d-----w c:\program files\QuickTime
2008-11-06 21:40 --------- d-----w c:\program files\Common Files\Apple
2008-11-06 21:14 --------- d-----w c:\program files\Safari
2008-11-06 21:08 --------- d-----w c:\program files\Bonjour
2008-11-01 12:41 --------- d-----w c:\program files\LimeWire
2008-02-13 20:08 9 ----a-w c:\documents and settings\Amir\Application Data\mdb.bin
.

((((((((((((((((((((((((((((((((((((( Reg Opstartpunten )))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]
"msnmsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184]
"Veoh"="c:\program files\Veoh Networks\Veoh\VeohClient.exe" [2008-02-07 3497984]
"Google Update"="c:\documents and settings\Amir\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2008-09-03 133104]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPLpr"="c:\program files\Synaptics\SynTP\SynTPLpr.exe" [2003-09-26 98304]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2003-09-26 503808]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-03-22 335872]
"UpdateManager"="c:\program files\Common Files\Sonic\Update Manager\sgtray.exe" [2003-08-19 110592]
"nod32kui"="c:\program files\Eset\nod32kui.exe" [2008-01-07 949376]
"LifeCam"="c:\program files\Microsoft LifeCam\LifeExp.exe" [2007-05-17 279912]
"VX3000"="c:\windows\vVX3000.exe" [2007-04-10 709992]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-02-03 185896]
"ypops"="c:\program files\Mypops\ypops.exe" [2008-11-25 92672]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-09-06 413696]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-10-01 111936]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-10-01 289576]
"ATIModeChange"="Ati2mdxx.exe" [2001-09-04 c:\windows\system32\Ati2mdxx.exe]
"SoundMan"="SOUNDMAN.EXE" [2004-02-26 c:\windows\SOUNDMAN.EXE]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2004-08-04 15360]

c:\documents and settings\All Users\Menu Start\Programma's\Opstarten\
SANTIS USB and PC Card Utility.lnk - c:\program files\Siemens\SANTIS WLAN\WlanMonitor.exe [2003-04-02 491520]

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\\Program Files\\Microsoft LifeCam\\LifeCam.exe"=
"c:\\Program Files\\Microsoft LifeCam\\LifeExp.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Documents and Settings\\Amir\\Application Data\\Thinstall\\Adobe Photoshop CS3\\4000005700003h\\mDNSResponder.exe"=
"c:\\Program Files\\Veoh Networks\\Veoh\\VeohClient.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=

R1 Asapi;Asapi;c:\windows\system32\drivers\Asapi.sys [2004-09-15 11264]
R1 nod32drv;nod32drv;c:\windows\system32\drivers\nod32drv.sys [2008-01-07 15424]
R2 MTC0005_MTCDIO;Wireless HotKey Driver;c:\windows\system32\drivers\MTCDIO.sys [2004-09-15 11316]
R3 EMCR;EMCR;c:\windows\system32\DRIVERS\EMCR7SK.sys [1979-12-31 68224]
S2 MTCDIO;MTCDIO;c:\windows\system32\DRIVERS\MTCDIO.sys [2004-09-15 11316]
S3 APL531;Hercules Dualpix HD Webcam;c:\windows\system32\Drivers\HDvid.sys []
S3 ATMEL FVNETusbASKEY (AR)(R);ATMEL FVNETusbASKEY (AR)(R) Service for SANTIS WLAN USB Adapter;c:\windows\system32\DRIVERS\vnetusbk.sys [2003-02-20 93184]
S3 ATMEL WinXP PCMCIAFVNETR (2ARC)(R);ATMEL WinXP PCMCIAFVNETR (2ARC)(R) Service for SANTIS WLAN PC Card;c:\windows\system32\DRIVERS\fvnetr51.sys [2003-01-14 91648]
S3 camfilt;camfilt;c:\windows\system32\Drivers\camfilt.sys []
.
Inhoud van de 'Gedeelde Taken' map

2008-11-06 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 12:34]

2008-12-19 c:\windows\Tasks\GoogleUpdateTaskUser.job
- c:\documents and settings\Amir\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2008-09-03 11:31]

2007-05-24 c:\windows\Tasks\Herinnering voor registratie 1.job
- c:\windows\System32\OOBE\oobebaln.exe [2004-08-04 01:03]

2007-05-24 c:\windows\Tasks\Herinnering voor registratie 2.job
- c:\windows\System32\OOBE\oobebaln.exe [2004-08-04 01:03]

2007-05-24 c:\windows\Tasks\Herinnering voor registratie 3.job
- c:\windows\System32\OOBE\oobebaln.exe [2004-08-04 01:03]
.
- - - - ORPHANS VERWIJDERD - - - -

BHO-{25D5BD41-0268-4A92-A75D-B0053B0EF3A4} - c:\windows\system32\khhfc.dll
BHO-{25f241c6-d435-427e-9b7d-5102711629c7} - c:\windows\system32\zijell.dll
HKCU-Run-swg - c:\program files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
HKCU-Run-Sonic RecordNow! - (no file)
HKLM-Run-HerculesCamService - c:\program files\Hercules\Hercules DualPix HD Webcam\CamService.exe
MSConfigStartUp-MsnMsgr - c:\program files\MSN Messenger\MsnMsgr.Exe


.
------- Bijkomende Scan -------
.
uStart Page = [You must be registered and logged in to see this link.]
mStart Page = [You must be registered and logged in to see this link.]
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = [You must be registered and logged in to see this link.]
IE: E&xporteren naar Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
LSP: c:\windows\System32\imon.dll

O16 -: DirectAnimation Java Classes - [You must be registered and logged in to see this link.]
c:\windows\Downloaded Program Files\DirectAnimation Java Classes.osd

O16 -: Microsoft XML Parser for Java - [You must be registered and logged in to see this link.]
c:\windows\Downloaded Program Files\Microsoft XML Parser for Java.osd
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, [You must be registered and logged in to see this link.]
Rootkit scan 2008-12-22 18:12:53
Windows 5.1.2600 Service Pack 2 NTFS

scannen van verborgen processen ...

scannen van verborgen autostart items ...

scannen van verborgen bestanden ...

Scan succesvol afgerond
verborgen bestanden: 0

**************************************************************************
.
--------------------- DLLs Geladen Onder Lopende Processen ---------------------

- - - - - - - > 'lsass.exe'(576)
c:\windows\System32\imon.dll
.
------------------------ Andere Aktieve Processen ------------------------
.
c:\windows\system32\ati2evxx.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Microsoft LifeCam\MSCamS32.exe
c:\program files\ESET\nod32krn.exe
c:\program files\iPod\bin\iPodService.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Voltooingstijd: 2008-12-22 18:16:11 - machine werd herstart [Amir]
ComboFix-quarantined-files.txt 2008-12-22 17:16:08

Pre-Run: 5,289,918,464 bytes beschikbaar
Post-Run: 5,776,310,272 bytes beschikbaar

370

amir
Novice
Novice

Posts Posts : 6
Joined Joined : 2008-12-21
OS OS : Windows xp pro
Points Points : 29093
# Likes # Likes : 0

View user profile

Back to top Go down

Solved Re: Infected with avirus/spyware and my system restarts every minute

Post by Belahzur on 22nd December 2008, 8:34 pm

Hello.
Looks good, what problems remain?


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34918
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : 7 Home Premium x64
Points Points : 245091
# Likes # Likes : 1

View user profile

Back to top Go down

Solved Re: Infected with avirus/spyware and my system restarts every minute

Post by amir on 28th December 2008, 1:02 am

everything looks good now thanks a lot for you're help

amir
Novice
Novice

Posts Posts : 6
Joined Joined : 2008-12-21
OS OS : Windows xp pro
Points Points : 29093
# Likes # Likes : 0

View user profile

Back to top Go down

Solved Re: Infected with avirus/spyware and my system restarts every minute

Post by Belahzur on 28th December 2008, 1:12 am

Your version of Java is outdated and needs to be updated to take advantage of fixes that have eliminated security vulnerabilities.
Updating Java:

  • Download the latest version of [You must be registered and logged in to see this link.].
  • Select the first option where it says "Java SE Runtime Environment (JRE) 6 Update 11".
  • Click the "Download" button to the right.
  • In the Window that opens, select your platform and language, check the "agree" box, and click Continue.
  • Click on the link to download Windows Offline Installation and save to your desktop.
  • Close any programs you may have running - especially your web browser.
  • Go to Start > Control Panel double-click on Add or Remove Programs and remove all older versions of Java.
  • Check any item with Java Runtime Environment (JRE or J2SE) in the name.
    - Examples of older versions in Add or Remove Programs:
    - Java 2 Runtime Environment, SE v1.4.2
    - J2SE Runtime Environment 5.0
    - J2SE Runtime Environment 5.0 Update 2
  • Click the Remove or Change/Remove button.
  • Repeat as many times as necessary to remove each Java versions.
  • Reboot your computer once all Java components are removed.
  • Then from your desktop double-click on jre-6u11-windows-i586-p.exe that you downloaded to install the newest version.
Please make sure the new version of Java is installed before you run JavaRa.

Please download JavaRa from [You must be registered and logged in to see this link.]

  • First, unzip it.
  • Then run JavaRa.
  • Select English from the drop down menu and press Select.
  • This will open JavaRa.
  • Press Remove older versions
  • Press yes to the prompt.
  • It will make a log file of what it's removed.
  • Copy and paste the log back here.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34918
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : 7 Home Premium x64
Points Points : 245091
# Likes # Likes : 1

View user profile

Back to top Go down

Solved Re: Infected with avirus/spyware and my system restarts every minute

Post by Doctor Inferno on 8th February 2009, 9:38 am

Since this issue is resolved, this topic is closed.

If you need this topic reopened, please contact a staff member. This applies only to the original topic starter.

Everyone else, please open a new topic for your questions.


Please be a GeekPolice fan on [You must be registered and logged in to see this link.]



Have we helped you? [You must be registered and logged in to see this link.] | Doctor by day, ninja by night.

Doctor Inferno
Administrator
Administrator

Posts Posts : 12015
Joined Joined : 2007-12-26
Gender Gender : Male
OS OS : Windows 7 Home Premium and Ultimate X64
Protection Protection : Kaspersky PURE and Malwarebytes' Anti-Malware
Points Points : 104620
# Likes # Likes : 0

View user profile

Back to top Go down

View previous topic View next topic Back to top

- Similar topics

 
Permissions in this forum:
You cannot reply to topics in this forum