Win32/Cryptor, can't install HijackThis, frequent freezing

View previous topic View next topic Go down

Re: Win32/Cryptor, can't install HijackThis, frequent freezing

Post by Belahzur on 9th April 2009, 7:21 pm

Hello.

Now open a new notepad file.
Input this into the notepad file:

KILLALL::

Driver::
TmPfw
tmcfw

Folder::
c:\documents and settings\All Users\Application Data\Viewpoint

Registry::
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=-
"UpdatesDisableNotify"=-
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\TrendFirewall]
"DisableMonitoring"=-
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{361ac05d-0e0d-11da-9aa9-806d6172696f}]

Save this as CFScript.txt, save it to your desktop also.
Then drag and drop CFScript.txt into combofix as seen below:


This will open combofix.exe again, agree to it's terms and allow it to run, it may want to reboot after it's done. Post the resulting log back here.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34918
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : 7 Home Premium x64
Points Points : 245121
# Likes # Likes : 1

View user profile

Back to top Go down

Re: Win32/Cryptor, can't install HijackThis, frequent freezing

Post by dblume on 9th April 2009, 7:36 pm

Whew. Here we go.

ComboFix 09-04-04.01 - Laura Kelley 2009-04-09 15:25:35.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1014.536 [GMT -4:00]
Running from: c:\documents and settings\Laura Kelley\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Laura Kelley\Desktop\CFscript.txt
AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated)
FW: PC-cillin Internet Security - Firewall *disabled*
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users\Application Data\Viewpoint

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_TMCFW
-------\Legacy_TMPFW
-------\Service_tmcfw
-------\Service_TmPfw


((((((((((((((((((((((((( Files Created from 2009-03-09 to 2009-04-09 )))))))))))))))))))))))))))))))
.

2009-04-09 13:32 . 2009-04-09 13:32 d-------- c:\program files\Malwarebytes' Anti-Malware
2009-04-09 13:32 . 2009-04-09 13:32 d-------- c:\documents and settings\Laura Kelley\Application Data\Malwarebytes
2009-04-09 13:32 . 2009-04-09 13:32 d-------- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-04-09 13:32 . 2009-04-06 15:32 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
2009-04-09 13:32 . 2009-04-06 15:32 15,504 --a------ c:\windows\system32\drivers\mbam.sys
2009-04-09 09:59 . 2009-04-09 10:09 d-------- c:\documents and settings\Laura Kelley\.SunDownloadManager
2009-04-09 08:57 . 2009-04-09 08:57 d-------- c:\windows\system32\XPSViewer
2009-04-09 08:57 . 2009-04-09 08:57 d-------- c:\program files\Reference Assemblies
2009-04-09 08:57 . 2009-04-09 08:57 d-------- c:\program files\MSBuild
2009-04-09 08:56 . 2008-07-06 08:06 1,676,288 --------- c:\windows\system32\xpssvcs.dll
2009-04-09 08:56 . 2008-07-06 08:06 1,676,288 --------- c:\windows\system32\dllcache\xpssvcs.dll
2009-04-09 08:56 . 2008-07-06 06:50 597,504 --------- c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2009-04-09 08:56 . 2008-07-06 08:06 575,488 --------- c:\windows\system32\xpsshhdr.dll
2009-04-09 08:56 . 2008-07-06 08:06 575,488 --------- c:\windows\system32\dllcache\xpsshhdr.dll
2009-04-09 08:56 . 2008-07-06 08:06 117,760 --------- c:\windows\system32\prntvpt.dll
2009-04-09 08:56 . 2008-07-06 08:06 89,088 --------- c:\windows\system32\dllcache\filterpipelineprintproc.dll
2009-04-09 08:50 . 2008-12-20 19:15 6,066,688 --------- c:\windows\system32\dllcache\ieframe.dll
2009-04-09 08:50 . 2007-04-17 05:32 2,455,488 --------- c:\windows\system32\dllcache\ieapfltr.dat
2009-04-09 08:50 . 2007-03-08 01:10 991,232 --------- c:\windows\system32\dllcache\ieframe.dll.mui
2009-04-09 08:50 . 2008-12-20 19:15 459,264 --------- c:\windows\system32\dllcache\msfeeds.dll
2009-04-09 08:50 . 2008-12-20 19:15 383,488 --------- c:\windows\system32\dllcache\ieapfltr.dll
2009-04-09 08:50 . 2008-12-20 19:15 267,776 --------- c:\windows\system32\dllcache\iertutil.dll
2009-04-09 08:50 . 2008-12-20 19:15 63,488 --------- c:\windows\system32\dllcache\icardie.dll
2009-04-09 08:50 . 2008-12-20 19:15 52,224 --------- c:\windows\system32\dllcache\msfeedsbs.dll
2009-04-09 08:50 . 2008-12-19 05:10 13,824 --------- c:\windows\system32\dllcache\ieudinit.exe
2009-04-09 08:11 . 2009-04-09 08:51 1,355 --a------ c:\windows\imsins.BAK
2009-04-08 17:40 . 2009-04-08 17:58 d---s---- c:\documents and settings\Administrator\UserData
2009-04-08 13:00 . 2009-04-08 13:00 d-------- c:\program files\CCleaner
2009-04-08 11:33 . 2009-03-09 15:06 15,688 --a------ c:\windows\system32\lsdelete.exe
2009-04-07 22:44 . 2009-03-09 15:06 64,160 --a------ c:\windows\system32\drivers\Lbd.sys
2009-04-07 22:43 . 2009-04-07 22:43 d-------- c:\program files\Lavasoft
2009-04-07 22:43 . 2009-04-07 22:43 d-------- c:\documents and settings\All Users\Application Data\Lavasoft
2009-04-07 21:26 . 2009-04-09 09:13 d--h----- C:\$AVG8.VAULT$
2009-04-07 21:24 . 2009-04-09 09:42 d-------- c:\windows\system32\drivers\Avg
2009-04-07 21:24 . 2009-04-07 21:24 d-------- c:\program files\AVG
2009-04-07 21:24 . 2009-04-07 22:26 d-------- c:\documents and settings\All Users\Application Data\avg8
2009-04-07 21:24 . 2009-04-07 21:24 325,640 --a------ c:\windows\system32\drivers\avgldx86.sys
2009-04-07 21:24 . 2009-04-07 21:24 108,552 --a------ c:\windows\system32\drivers\avgtdix.sys
2009-04-07 21:24 . 2009-04-07 21:24 10,520 --a------ c:\windows\system32\avgrsstx.dll
2009-04-02 19:25 . 2009-04-02 19:25 d-------- c:\documents and settings\All Users\Application Data\WEBREG
2009-04-02 19:19 . 2009-04-02 19:19 d-------- c:\documents and settings\All Users\Application Data\HP
2009-04-02 19:18 . 2009-04-02 19:18 d-------- c:\program files\Common Files\Hewlett-Packard
2009-04-02 19:15 . 2009-04-02 19:15 d-------- c:\documents and settings\All Users\Application Data\Hewlett-Packard
2009-04-02 19:14 . 2007-12-03 18:57 118,272 --a------ c:\windows\system32\hpz3l5mu.dll
2009-04-02 19:14 . 2001-08-17 13:53 6,784 --a------ c:\windows\system32\drivers\serscan.sys
2009-04-02 19:14 . 2001-08-17 13:53 6,784 --a------ c:\windows\system32\dllcache\serscan.sys
2009-04-02 19:08 . 2009-04-04 20:14 d-------- c:\program files\HP
2009-04-02 19:08 . 2007-11-06 22:04 1,373,528 -ra------ c:\windows\hpzshl01.exe
2009-04-02 19:08 . 2007-11-06 22:15 1,140,056 -ra------ c:\windows\hpzmsi01.exe
2009-04-02 19:08 . 2008-04-13 13:45 32,128 --a------ c:\windows\system32\drivers\usbccgp.sys
2009-04-02 19:08 . 2008-04-13 13:45 32,128 --a------ c:\windows\system32\dllcache\usbccgp.sys
2009-04-02 19:08 . 2008-04-13 13:47 25,856 --a------ c:\windows\system32\drivers\usbprint.sys
2009-04-02 19:08 . 2008-04-13 13:47 25,856 --a------ c:\windows\system32\dllcache\usbprint.sys
2009-04-02 19:08 . 2008-01-08 08:44 12,054 -ra------ c:\windows\hpwscr20.dat
2009-03-29 10:09 . 2009-03-29 10:09 d-------- c:\program files\Common Files\Adobe AIR
2009-03-29 10:07 . 2009-03-29 10:08 d-------- c:\program files\Common Files\Adobe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-04-09 18:18 --------- d-----w c:\program files\Trend Micro
2009-04-09 17:29 --------- d-----w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-04-09 14:16 --------- d-----w c:\program files\Java
2009-04-08 01:43 --------- d-----w c:\program files\DIGStream
2009-04-05 01:43 --------- d-----w c:\program files\Google
2009-04-05 01:36 --------- d-----w c:\program files\Spybot - Search & Destroy
2008-11-14 02:05 2,120 ----a-w c:\documents and settings\Laura Kelley\Application Data\wklnhst.dat
2007-04-17 05:16 88 --sh--r c:\windows\system32\73DA083153.sys
2007-04-17 05:19 2,828 --sha-w c:\windows\system32\KGyGaAvL.sys
.

((((((((((((((((((((((((((((( [You must be registered and logged in to see this link.] )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-04-09 19:29:27 16,384 ----atw c:\windows\temp\Perflib_Perfdata_1e4.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray"="c:\windows\ehome\ehtray.exe" [2005-09-29 67584]
"igfxtray"="c:\windows\system32\igfxtray.exe" [2005-12-14 98304]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2005-12-14 77824]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2005-12-14 118784]
"Broadcom Wireless Manager UI"="c:\windows\system32\WLTRAY.exe" [2006-11-23 1392640]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-03-08 761947]
"dla"="c:\windows\system32\dla\tfswctrl.exe" [2004-12-06 127035]
"ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-27 221184]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2004-07-27 81920]
"PCMService"="c:\program files\Dell\MediaDirect\PCMService.exe" [2006-08-22 184320]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-04-07 1932568]
"Ad-Watch"="c:\program files\Lavasoft\Ad-Aware\AAWTray.exe" [2009-03-09 515416]
"SigmatelSysTrayApp"="stsystra.exe" [2006-03-25 c:\windows\stsystra.exe]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-04-07 21:24 10520 c:\windows\system32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
--a------ 2009-02-27 17:10 35696 c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Dell QuickSet]
--a------ 2006-08-03 20:51 1032192 c:\program files\Dell\QuickSet\quickset.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Monitor]
--a------ 2006-11-03 11:01 319488 c:\windows\PixArt\PAC207\Monitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2007-04-05 18:07 98304 c:\program files\QuickTime\qttask.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"SpybotSD TeaTimer"=c:\program files\Spybot - Search & Destroy\TeaTimer.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Dell\\MediaDirect\\PCMService.exe"=
"c:\\Program Files\\Kodak\\KODAK Software Updater\\7288971\\Program\\Kodak Software Updater.exe"=
"c:\\Program Files\\Kodak\\Kodak EasyShare software\\bin\\EasyShare.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\WINDOWS\\system32\\mmc.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgnsx.exe"=

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2009-04-07 64160]
R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2009-04-07 325640]
R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2009-04-07 108552]
R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2009-04-07 298264]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [2009-03-09 951632]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
.
Contents of the 'Scheduled Tasks' folder

2009-04-08 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-03-09 15:06]
.
.
------- Supplementary Scan -------
.
uStart Page = [You must be registered and logged in to see this link.]
uSearchMigratedDefaultURL = [You must be registered and logged in to see this link.]
mSearch Bar = [You must be registered and logged in to see this link.]
uSearchURL,(Default) = [You must be registered and logged in to see this link.]
IE: E&xport to Microsoft Excel - c:\progra~1\MI1933~1\Office12\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\Laura Kelley\Application Data\Mozilla\Firefox\Profiles\fi97w4qe.default\
.

**************************************************************************

catchme 0.3.1375 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, [You must be registered and logged in to see this link.]
Rootkit scan 2009-04-09 15:29:43
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(912)
c:\windows\System32\BCMLogon.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\WLTRYSVC.EXE
c:\windows\system32\BCMWLTRY.EXE
c:\windows\ehome\ehrecvr.exe
c:\windows\ehome\ehSched.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\program files\Microsoft SQL Server\MSSQL$MICROSOFTSMLBIZ\Binn\sqlservr.exe
c:\program files\AVG\AVG8\avgrsx.exe
c:\progra~1\AVG\AVG8\avgnsx.exe
c:\windows\system32\igfxsrvc.exe
c:\windows\ehome\mcrdsvc.exe
c:\windows\system32\wbem\unsecapp.exe
c:\windows\system32\dllhost.exe
c:\windows\system32\wscntfy.exe
c:\windows\ehome\ehmsas.exe
.
**************************************************************************
.
Completion time: 2009-04-09 15:34:45 - machine was rebooted
ComboFix-quarantined-files.txt 2009-04-09 19:34:41
ComboFix2.txt 2009-04-09 19:05:31

Pre-Run: 55,378,825,216 bytes free
Post-Run: 55,350,759,424 bytes free

200 --- E O F --- 2009-04-09 18:09:01

dblume
Intermediate
Intermediate

Posts Posts : 54
Joined Joined : 2009-04-09
OS OS : Windows Vista
Points Points : 28220
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Win32/Cryptor, can't install HijackThis, frequent freezing

Post by Belahzur on 9th April 2009, 7:39 pm

Hello.
Has My Computer stopped appearing at startup?

If not, I think I have a brief idea what's causing it from a quick Google search who had a log like yours and looking through my registry.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34918
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : 7 Home Premium x64
Points Points : 245121
# Likes # Likes : 1

View user profile

Back to top Go down

Re: Win32/Cryptor, can't install HijackThis, frequent freezing

Post by dblume on 9th April 2009, 7:44 pm

It stopped appearing. I can finally move on with my life! Thanks again!!!

dblume
Intermediate
Intermediate

Posts Posts : 54
Joined Joined : 2009-04-09
OS OS : Windows Vista
Points Points : 28220
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Win32/Cryptor, can't install HijackThis, frequent freezing

Post by Belahzur on 9th April 2009, 7:48 pm

Click Start > Run and copy/paste the following bolded text into the Run box and click OK:

ComboFix /u



This will also reset your restore points.

Below I have included a number of recommendations for how to protect your computer in order to prevent future malware infections. Please take these recommendations seriously; these few simple steps can stave off the vast majority of spyware problems. As happy as we are to help you, for your sake we would rather not have repeat customers. Goofy

1) Please navigate to [You must be registered and logged in to see this link.] and download all the "critical updates" for Windows. This can patch many of the security holes through which attackers can gain access to your computer.

Please either enable Automatic Updates under Start -> Control Panel -> Automatic Updates , or get into the habit of checking for Windows updates regularly. I cannot stress enough how important this is.

2) In order to protect yourself against spyware, you should consider installing and running the following free programs:

[You must be registered and logged in to see this link.]
A tutorial on using Ad-Aware to remove spyware from your computer may be found [You must be registered and logged in to see this link.].

[You must be registered and logged in to see this link.]
A tutorial on using Spybot to remove spyware from your computer may be found [You must be registered and logged in to see this link.]. Please also remember to enable Spybot's "Immunize" and "TeaTimer" features.

[You must be registered and logged in to see this link.]
A tutorial on using SpywareBlaster to prevent spyware from ever installing on your computer may be found [You must be registered and logged in to see this link.].

[You must be registered and logged in to see this link.]
A tutorial on using SpywareGuard for realtime protection against spyware and hijackers may be found [You must be registered and logged in to see this link.].

Make sure to keep these programs up-to-date and to run them regularly, as this can prevent a great deal of spyware hassle.

3) Please consider using an alternate browser. Mozilla's Firefox browser is fantastic; it is much more secure than Internet Explorer, immune to almost all known browser hijackers, and also has the best built-in popup blocker (as an added benefit!) that I have ever seen. If you are interested, Firefox may be downloaded from here:
[You must be registered and logged in to see this link.]
I also recommand the following add-ons for Firefox, they will help keep you safe from malicious scripts or activeX exploits.
[You must be registered and logged in to see this link.]
[You must be registered and logged in to see this link.]
[You must be registered and logged in to see this link.]

4) Also make sure to run your antivirus software regularly, and to keep it up-to-date.

To help you keep your software updated, please considering using this free software program that will check for program updates.
[You must be registered and logged in to see this link.]

5) Finally, consider maintaining a firewall. Some good free firewalls are [You must be registered and logged in to see this link.], or
[You must be registered and logged in to see this link.]
A tutorial on understanding and using firewalls may be found [You must be registered and logged in to see this link.].

Please also read Tony Klein's excellent article: [You must be registered and logged in to see this link.]

If you would take a moment to fill out our feedback form, we would appreciate it.
The link can be found [You must be registered and logged in to see this link.].

Hopefully this should take care of your problems! Good luck. Big Grin


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34918
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : 7 Home Premium x64
Points Points : 245121
# Likes # Likes : 1

View user profile

Back to top Go down

View previous topic View next topic Back to top

- Similar topics

 
Permissions in this forum:
You cannot reply to topics in this forum