win32/cryptor + fakealert + trojans + rootkit......=***(

View previous topic View next topic Go down

win32/cryptor + fakealert + trojans + rootkit......=***(

Post by BasicBrain on Fri May 15, 2009 5:22 am

My computer, despite all of it' infections, is running rather smoothly and efficiently overall. Of course, that changes upon opening my internet explorer browser which results in all of hell being sent loose on my PC. Symptoms of my infections include numerous/relentless pop-ups that multiply over and over and over and over again until I have like 25+ windows of the same pop-up. When this occurs, I usually try to execute my "task manager" in a desperate attempt to manually close these windows, but then the task manager itself also begins to copy itself over and over and over and over again until I have about 25+ task managers running at once. My AVG virus protection was unable to update itself anymore as well; only recently was I able to uninstall it which was also disabled at one time. What changed that, I haven't the slightest clue. Only thing that has saved me from having a useless computer is that firefox and opera browsers seem immune to these infections(except for the occasionally crash haha)........I think. At least I havn't encountered any of the problems that I have w/ Internet Explorer browser. Oh, not sure if this related to infections, but I'm no longer able to open my C:/drive via the double click method. It gives me some error message and the only way for me to open it is to right click and select "explore". Thanks for helping

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:13:21 AM, on 5/15/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Common Files\Lanovation\PrismXL\PRISMXL.SYS
C:\WINDOWS\system32\slserv.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe
C:\WINDOWS\System32\hkcmd.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\AVG\AVG8\avgcsrvx.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\WiFiConnector\NintendoWFCReg.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Brian\Desktop\hijackgpthis.exe
C:\WINDOWS\system32\notepad.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = [You must be registered and logged in to see this link.]
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = [You must be registered and logged in to see this link.]
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = [You must be registered and logged in to see this link.]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = [You must be registered and logged in to see this link.]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = [You must be registered and logged in to see this link.]
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = [You must be registered and logged in to see this link.]
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = [You must be registered and logged in to see this link.]
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = [You must be registered and logged in to see this link.]
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (file missing)
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\YTSingleInstance.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll
O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O4 - HKLM\..\Run: [PRONoMgr.exe] C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Search Protection] C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe
O4 - HKCU\..\Run: [Messenger (Yahoo!)] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')
O4 - Global Startup: Run Nintendo Wi-Fi USB Connector Registration Tool.lnk = C:\Program Files\WiFiConnector\NintendoWFCReg.exe
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - [You must be registered and logged in to see this link.]
O17 - HKLM\System\CCS\Services\Tcpip\..\{28B31A0C-891F-4B15-8861-1E27F9A859D7}: NameServer = 85.255.112.39,85.255.112.40
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.112.39,85.255.112.40
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 85.255.112.39,85.255.112.40
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.112.39,85.255.112.40
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O20 - Winlogon Notify: __c003B61A - C:\WINDOWS\system32\__c003B61A.dat (file missing)
O20 - Winlogon Notify: __c00CE446 - C:\WINDOWS\system32\__c00CE446.dat (file missing)
O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: PrismXL - Lanovation - C:\Program Files\Common Files\Lanovation\PrismXL\PRISMXL.SYS
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe

--
End of file - 7426 bytes

BasicBrain
Novice
Novice

Status :
Online
Offline

Posts : 9
Joined : 2009-05-15
OS : xp

View user profile

Back to top Go down

Re: win32/cryptor + fakealert + trojans + rootkit......=***(

Post by Origin on Fri May 15, 2009 6:01 am


  • Open HijackThis
  • Choose "Do a system scan only"
  • Check the boxes in front of these lines:


    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
    O17 - HKLM\System\CCS\Services\Tcpip\..\{28B31A0C-891F-4B15-8861-1E27F9A859D7}: NameServer = 85.255.112.39,85.255.112.40
    O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.112.39,85.255.112.40
    O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 85.255.112.39,85.255.112.40
    O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.112.39,85.255.112.40



  • Press "Fix Checked"
  • Close Hijack This.





1. Please download The Avenger by Swandog46 to your Desktop
Link: [You must be registered and logged in to see this link.] or [You must be registered and logged in to see this link.].

  • Click on Avenger.zip to open the file
  • Extract avenger.exe to your desktop

Note: This tool was posted specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.


2. Now, start The Avenger program by clicking on its icon on your desktop.

  • Leave the script box empty.
  • Leave the ticked box "Scan for rootkit" ticked.
  • Then tick "Disable any rootkits found"
  • Now click on the Execute to begin execution of the script.
  • Answer "Yes" twice when prompted.

    The Avenger will automatically do the following:

  • It will Restart your computer.
  • On reboot, it will briefly open a black command window on your desktop, this is normal.
  • After the restart, it creates a log file that should open with the results of Avengerís actions. This log file will be located at C:\avenger.txt
  • The Avenger will also have backed up all the files, etc., that you asked it to delete, and will have zipped them and moved the zip archives to C:\avenger\backup.zip.
3. Please copy/paste the content of c:\avenger.txt into your reply.

Origin
Master
Master

Status :
Online
Offline

Posts : 2685
Joined : 2009-05-05
Gender : Male
OS : Windows Xp Sp3

View user profile

Back to top Go down

Re: win32/cryptor + fakealert + trojans + rootkit......=***(

Post by BasicBrain on Fri May 15, 2009 7:03 am

Logfile of The Avenger Version 2.0, (c) by Swandog46
[You must be registered and logged in to see this link.]

Platform: Windows XP

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.

Hidden driver "gaopdxserv.sys" found!
ImagePath: \systemroot\system32\drivers\gaopdxopxstqad.sys
Driver disabled successfully.

Rootkit scan completed.


Completed script processing.

*******************

Finished! Terminate.

BasicBrain
Novice
Novice

Status :
Online
Offline

Posts : 9
Joined : 2009-05-15
OS : xp

View user profile

Back to top Go down

Re: win32/cryptor + fakealert + trojans + rootkit......=***(

Post by Origin on Sat May 16, 2009 12:12 am

1. Copy all the text contained in the code box below to your Clipboard by highlighting it and pressing (Ctrl+CCrying


Drivers to delete:
gaopdxserv.sys

Files to delete:
C:\WINDOWS\system32\drivers\gaopdxopxstqad.sys

Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.


2. Now, start The Avenger program by clicking on its icon on your desktop.

  • Under "Input script here:", paste in the script from the quote box above.
  • Leave the ticked box "Scan for rootkit" ticked.
  • Then tick "Disable any rootkits found"
  • Now click on the Execute to begin execution of the script.
  • Answer "Yes" twice when prompted.

    The Avenger will automatically do the following:

  • It will Restart your computer.
  • On reboot, it will briefly open a black command window on your desktop, this is normal.
  • After the restart, it creates a log file that should open with the results of Avenger’s actions. This log file will be located at C:\avenger.txt
  • The Avenger will also have backed up all the files, etc., that you asked it to delete, and will have zipped them and moved the zip archives to C:\avenger\backup.zip.
3. Please copy/paste the content of c:\avenger.txt into your reply.

Origin
Master
Master

Status :
Online
Offline

Posts : 2685
Joined : 2009-05-05
Gender : Male
OS : Windows Xp Sp3

View user profile

Back to top Go down

Re: win32/cryptor + fakealert + trojans + rootkit......=***(

Post by BasicBrain on Sat May 16, 2009 7:28 am

Logfile of The Avenger Version 2.0, (c) by Swandog46
[You must be registered and logged in to see this link.]

Platform: Windows XP

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.
No rootkits found!


Error: registry key "\Registry\Machine\System\CurrentControlSet\Services\gaopdxserv.sys" not found!
Deletion of driver "gaopdxserv.sys" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist


Error: file "C:\WINDOWS\system32\drivers\gaopdxopxstqad.sys" not found!
Deletion of file "C:\WINDOWS\system32\drivers\gaopdxopxstqad.sys" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist


Completed script processing.

*******************

Finished! Terminate.

BasicBrain
Novice
Novice

Status :
Online
Offline

Posts : 9
Joined : 2009-05-15
OS : xp

View user profile

Back to top Go down

Re: win32/cryptor + fakealert + trojans + rootkit......=***(

Post by Origin on Sat May 16, 2009 8:06 pm

Please close all anti virus, anti malware and any other open programs/windows so they do not interfere with the running of RootRepeal.

  • Please download RootRepeal.zip from [You must be registered and logged in to see this link.].
  • Extract the program file to your Desktop.
  • Run the program RootRepeal.exe and go to the Report tab and click on the Scan button.


  • Select ALL of the checkboxes and then click OK and it will start scanning your system.

  • If you have multiple drives you only need to check the C: drive or the one Windows is installed on.
  • When done, click on Save Report
  • Save it to the Desktop.
  • Please copy/paste the contents of the report in your next reply.

Origin
Master
Master

Status :
Online
Offline

Posts : 2685
Joined : 2009-05-05
Gender : Male
OS : Windows Xp Sp3

View user profile

Back to top Go down

Re: win32/cryptor + fakealert + trojans + rootkit......=***(

Post by BasicBrain on Sun May 17, 2009 5:50 am

ROOTREPEAL (c) AD, 2007-2008
==================================================
Scan Time: 2009/05/17 01:49
Program Version: Version 1.2.3.0
Windows Version: Windows XP SP3
==================================================

Drivers
-------------------
Name: dump_atapi.sys
Image Path: C:\WINDOWS\System32\Drivers\dump_atapi.sys
Address: 0xF0B23000 Size: 98304 File Visible: No
Status: -

Name: dump_WMILIB.SYS
Image Path: C:\WINDOWS\System32\Drivers\dump_WMILIB.SYS
Address: 0xF9ADD000 Size: 8192 File Visible: No
Status: -

Name: rootrepeal.sys
Image Path: C:\WINDOWS\system32\drivers\rootrepeal.sys
Address: 0xEFA16000 Size: 45056 File Visible: No
Status: -

Hidden/Locked Files
-------------------
Path: C:\Documents and Settings\Brian\Local Settings\Temp\etilqs_29OVeJcM53XfCp9JJGPc
Status: Allocation size mismatch (API: 65536, Raw: 0)

BasicBrain
Novice
Novice

Status :
Online
Offline

Posts : 9
Joined : 2009-05-15
OS : xp

View user profile

Back to top Go down

Re: win32/cryptor + fakealert + trojans + rootkit......=***(

Post by Origin on Sun May 17, 2009 1:57 pm

Please download and run this tool.

Download Malwarebytes' Anti-Malware from [You must be registered and logged in to see this link.]

Double Click mbam-setup.exe to install the application.

  • Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select "Perform Quick Scan", then click Scan.
  • The scan may take some time to finish,so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected.
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Note:
If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts.
Click OK to either and let MBAM proceed with the disinfection process.
If asked to restart the computer, please do so immediately.


Post the contents of the MBAM Log.

Origin
Master
Master

Status :
Online
Offline

Posts : 2685
Joined : 2009-05-05
Gender : Male
OS : Windows Xp Sp3

View user profile

Back to top Go down

Re: win32/cryptor + fakealert + trojans + rootkit......=***(

Post by BasicBrain on Sun May 17, 2009 2:48 pm

Malwarebytes' Anti-Malware 1.36
Database version: 2145
Windows 5.1.2600 Service Pack 3

5/17/2009 10:40:37 AM
mbam-log-2009-05-17 (10-40-37).txt

Scan type: Quick Scan
Objects scanned: 83431
Time elapsed: 9 minute(s), 36 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 6
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 1

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{a072ec12-a40b-41dd-9a1a-cdb848b70f3c} (Rogue.Installer) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{bd4f7a6d-0107-4bdf-b72b-021b717b06ce} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\coolplay (Trojan.DNSChanger) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\__c003b61a (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\__c00ce446 (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\{NSINAME} (Trojan.Agent) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\WINDOWS\system32\gaopdxcounter (Trojan.Agent) -> Quarantined and deleted successfully.

BasicBrain
Novice
Novice

Status :
Online
Offline

Posts : 9
Joined : 2009-05-15
OS : xp

View user profile

Back to top Go down

Re: win32/cryptor + fakealert + trojans + rootkit......=***(

Post by Origin on Sun May 17, 2009 5:10 pm


  • Please download DDS by sUBs to your Desktop (Important!!) from one of these locations:
    [You must be registered and logged in to see this link.]
    [You must be registered and logged in to see this link.]
  • Double click DDS.scr to run.
  • When complete, two logs will open. Save both of the report to your Desktop.
  • Copy and paste DDS.txt back here, I don't need to see attach.txt.

Origin
Master
Master

Status :
Online
Offline

Posts : 2685
Joined : 2009-05-05
Gender : Male
OS : Windows Xp Sp3

View user profile

Back to top Go down

Re: win32/cryptor + fakealert + trojans + rootkit......=***(

Post by BasicBrain on Mon May 18, 2009 4:24 am

DDS (Ver_09-05-14.01) - NTFSx86
Run by Brian at 0:25:47.70 on Mon 05/18/2009
Internet Explorer: 7.0.5730.11
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.247.87 [GMT -7:00]

AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\Explorer.EXE
svchost.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Common Files\Lanovation\PrismXL\PRISMXL.SYS
C:\WINDOWS\system32\slserv.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\Program Files\AVG\AVG8\avgcsrvx.exe
C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\WiFiConnector\NintendoWFCReg.exe
C:\WINDOWS\System32\svchost.exe -k HTTPFilter
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\Documents and Settings\Brian\Desktop\dds.scr

============== Pseudo HJT Report ===============

uStart Page =
uSearch Page = [You must be registered and logged in to see this link.]
uSearch Bar = [You must be registered and logged in to see this link.]
uSearchMigratedDefaultURL = [You must be registered and logged in to see this link.]
mDefault_Page_URL = [You must be registered and logged in to see this link.]
mStart Page = [You must be registered and logged in to see this link.]
uInternet Connection Wizard,ShellNext = [You must be registered and logged in to see this link.]
uSearchAssistant = [You must be registered and logged in to see this link.]
uSearchURL,(Default) = [You must be registered and logged in to see this link.]
mSearchAssistant = [You must be registered and logged in to see this link.]
uURLSearchHooks: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\progra~1\yahoo!\companion\installs\cpn0\yt.dll
BHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\progra~1\yahoo!\companion\installs\cpn0\yt.dll
BHO: AcroIEHlprObj Class: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 5.0\reader\activex\AcroIEHelper.ocx
BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg8\avgssie.dll
BHO: AVG Security Toolbar: {a057a204-bacc-4d26-9990-79a187e2698e} - c:\progra~1\avg\avg8\AVGTOO~1.DLL
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: SingleInstance Class: {fdad4da1-61a2-4fd8-9c17-86f7ac245081} - c:\progra~1\yahoo!\companion\installs\cpn0\YTSingleInstance.dll
TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\progra~1\yahoo!\companion\installs\cpn0\yt.dll
TB: AVG Security Toolbar: {a057a204-bacc-4d26-9990-79a187e2698e} - c:\progra~1\avg\avg8\AVGTOO~1.DLL
EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [MsnMsgr] "c:\program files\msn messenger\MsnMsgr.Exe" /background
uRun: [Search Protection] c:\program files\yahoo!\search protection\SearchProtection.exe
uRun: [Messenger (Yahoo!)] "c:\program files\yahoo!\messenger\YahooMessenger.exe" -quiet
mRun: [PRONoMgr.exe] c:\program files\intel\ncs\proset\PRONoMgr.exe
mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
mRun: [PMR]
mRun: [TkBellExe] "c:\program files\common files\real\update_ob\realsched.exe" -osboot
mRun: [Windows Defender] "c:\program files\windows defender\MSASCui.exe" -hide
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [AVG8_TRAY] c:\progra~1\avg\avg8\avgtray.exe
dRun: [DWQueuedReporting] "c:\progra~1\common~1\micros~1\dw\dwtrig20.exe" -t
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\runnin~1.lnk - c:\program files\wificonnector\NintendoWFCReg.exe
IE: {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
DPF: DirectAnimation Java Classes - [You must be registered and logged in to see this link.]
DPF: Microsoft XML Parser for Java - [You must be registered and logged in to see this link.]
DPF: {17492023-C23A-453E-A040-C7C580BBF700} - [You must be registered and logged in to see this link.]
DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} - [You must be registered and logged in to see this link.]
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - [You must be registered and logged in to see this link.]
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg8\avgpp.dll
Notify: avgrsstarter - avgrsstx.dll
Notify: igfxcui - igfxsrvc.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SEH: Microsoft AntiMalware ShellExecuteHook: {091eb208-39dd-417d-a5dd-7e2c2d8fb9cb} - c:\progra~1\wifd1f~1\MpShHook.dll

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\brian\applic~1\mozilla\firefox\profiles\br03b5z6.default\
FF - prefs.js: browser.search.defaulturl - [You must be registered and logged in to see this link.]
FF - prefs.js: browser.search.selectedEngine - Yahoo
FF - prefs.js: keyword.URL - [You must be registered and logged in to see this link.]
FF - component: c:\program files\avg\avg8\firefox\components\avgssff.dll
FF - component: c:\program files\avg\avg8\toolbarff\components\vmAVGConnector.dll

============= SERVICES / DRIVERS ===============

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2009-5-7 325896]
R1 AvgMfx86;AVG Free On-access Scanner Minifilter Driver x86;c:\windows\system32\drivers\avgmfx86.sys [2009-5-7 27784]
R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2009-5-7 108552]
S3 cheetah1;cheetah1;\??\c:\documents and settings\brian\desktop\cheetahengine\cheetah.sys --> c:\documents and settings\brian\desktop\cheetahengine\cheetah.sys [?]
S3 CookieCow1;CookieCow1;\??\c:\documents and settings\brian\desktop\cookiecow engine\cookiecow.sys --> c:\documents and settings\brian\desktop\cookiecow engine\CookieCow.sys [?]
S3 DADriv1;DADriv1;\??\c:\documents and settings\brian\desktop\daengine\dak32.sys --> c:\documents and settings\brian\desktop\daengine\DAK32.sys [?]
S3 geebers12;geebers12;\??\c:\documents and settings\brian\desktop\xterminator engine\xterminator.sys --> c:\documents and settings\brian\desktop\xterminator engine\Xterminator.sys [?]
S3 iCheat1;iCheat1;\??\c:\documents and settings\brian\desktop\v39 by kazu\nvid999.sys --> c:\documents and settings\brian\desktop\v39 by kazu\nvid999.sys [?]
S3 kaspersky1;kaspersky1;\??\c:\documents and settings\brian\desktop\kaspersky3[1].3\kaspersky.sys --> c:\documents and settings\brian\desktop\kaspersky3[1].3\kaspersky.sys [?]
S3 memxers12;memxers12;\??\c:\documents and settings\brian\desktop\v.39 hack pack\icheat (rev1021)\nvid999.sys --> c:\documents and settings\brian\desktop\v.39 hack pack\icheat (rev1021)\nvid999.sys [?]
S3 Revolution1;Revolution1;\??\c:\documents and settings\brian\desktop\revolution engine 6.2\shak3.sys --> c:\documents and settings\brian\desktop\revolution engine 6.2\SHAK3.sys [?]
S3 xp1;xp1;\??\c:\documents and settings\brian\desktop\all you need for rev .37 gg 1007\xp.sys --> c:\documents and settings\brian\desktop\all you need for rev .37 gg 1007\xp.sys [?]
S3 Yakir1;Yakir1;\??\c:\documents and settings\brian\desktop\log evasion engine\zenx.sys --> c:\documents and settings\brian\desktop\log evasion engine\ZenX.Sys [?]

=============== Created Last 30 ================

2009-05-17 10:25 --d----- c:\docume~1\brian\applic~1\Malwarebytes
2009-05-17 10:25 15,504 a------- c:\windows\system32\drivers\mbam.sys
2009-05-17 10:25 38,496 a------- c:\windows\system32\drivers\mbamswissarmy.sys
2009-05-17 10:25 --d----- c:\docume~1\alluse~1\applic~1\Malwarebytes
2009-05-17 10:25 --d----- c:\program files\Malwarebytes' Anti-Malware
2009-05-15 04:20 197 a------- c:\windows\system32\MRT.INI
2009-05-15 03:54 284,160 -c------ c:\windows\system32\dllcache\pdh.dll
2009-05-15 03:54 401,408 -c------ c:\windows\system32\dllcache\rpcss.dll
2009-05-15 03:54 110,592 -c------ c:\windows\system32\dllcache\services.exe
2009-05-15 03:54 473,600 -c------ c:\windows\system32\dllcache\fastprox.dll
2009-05-15 03:54 227,840 -c------ c:\windows\system32\dllcache\wmiprvse.exe
2009-05-15 03:54 453,120 -c------ c:\windows\system32\dllcache\wmiprvsd.dll
2009-05-15 03:54 729,088 -c------ c:\windows\system32\dllcache\lsasrv.dll
2009-05-15 03:54 617,472 -c------ c:\windows\system32\dllcache\advapi32.dll
2009-05-15 03:54 714,752 -c------ c:\windows\system32\dllcache\ntdll.dll
2009-05-15 03:51 2,560 -------- c:\windows\system32\xpsp4res.dll
2009-05-15 03:51 1,203,922 -c------ c:\windows\system32\dllcache\sysmain.sdb
2009-05-15 03:50 215,552 -c------ c:\windows\system32\dllcache\wordpad.exe
2009-05-07 13:32 98,304 a------- c:\windows\system32\viscomtran.dll
2009-05-07 13:32 81,920 a------- c:\windows\system32\viscomwave.dll
2009-05-07 13:32 249,856 a------- c:\windows\system32\ptf.ocx
2009-05-07 13:32 241,664 a------- c:\windows\system32\VideoEdit.ocx
2009-05-07 13:32 224,016 a------- c:\windows\system32\tabctl32.ocx
2009-05-07 13:32 147,456 a------- c:\windows\system32\viscomqtenc.dll
2009-05-07 13:32 139,264 a------- c:\windows\system32\viscomqtde.dll
2009-05-07 13:32 90,112 a------- c:\windows\system32\viscomframe.dll
2009-05-07 13:32 856,064 a------- c:\windows\system32\mpgfiltr.ax
2009-05-07 13:32 --d----- c:\program files\FLV Encoder Ver 3.00
2009-05-07 13:31 --d-h--- C:\$AVG8.VAULT$
2009-05-07 12:46 11,952 a------- c:\windows\system32\avgrsstx.dll
2009-05-07 12:46 108,552 a------- c:\windows\system32\drivers\avgtdix.sys
2009-05-07 12:46 325,896 a------- c:\windows\system32\drivers\avgldx86.sys
2009-05-07 12:46 --d----- c:\windows\system32\drivers\Avg
2009-05-07 12:46 --d----- c:\docume~1\brian\applic~1\AVGTOOLBAR
2009-05-07 12:45 --d----- c:\program files\AVG
2009-05-07 12:45 --d----- c:\docume~1\alluse~1\applic~1\avg8
2009-05-03 12:27 410,984 a------- c:\windows\system32\deploytk.dll

==================== Find3M ====================

2009-03-06 07:22 284,160 a------- c:\windows\system32\pdh.dll
2009-03-02 17:18 826,368 a------- c:\windows\system32\wininet.dll
2009-02-20 11:09 78,336 a------- c:\windows\system32\ieencode.dll
2008-08-02 12:39 32,768 a--sh--- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012008080220080803\index.dat
2008-08-03 18:10 32,768 a--sh--- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012008080320080804\index.dat

============= FINISH: 0:27:22.65 ===============

BasicBrain
Novice
Novice

Status :
Online
Offline

Posts : 9
Joined : 2009-05-15
OS : xp

View user profile

Back to top Go down

Re: win32/cryptor + fakealert + trojans + rootkit......=***(

Post by Origin on Tue May 19, 2009 2:40 am


  • Download combofix from here
    [You must be registered and logged in to see this link.]
    [You must be registered and logged in to see this link.]
  • We need to disable your local AV (Anti-virus) before running Combofix.
  • See [You must be registered and logged in to see this link.] for how to disable your AV.
  • Double click on ComboFix.exe.
  • Follow the prompts. NOTE:
  • ComboFix will check to see if the Microsoft Windows Recovery Console is installed.
    ***It's strongly recommended to have the Recovery Console installed before doing any malware removal.***

    **Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will automatically proceed with its scan.


  • The Recovery Console provides a recovery/repair mode should a problem occur during a Combofix run.



  • Allow ComboFix to download the Recovery Console.
  • Accept the End-User License Agreement.
  • The Recovery Console will be installed.
  • You will then get this next prompt that asks if you want to continue the malware scan, select yes



  • Allow combofix to run
  • Post C:\combofix.txt back here.

    Note:
    Do not mouseclick combofix's window whilst it's running. That may cause it to stall.

Origin
Master
Master

Status :
Online
Offline

Posts : 2685
Joined : 2009-05-05
Gender : Male
OS : Windows Xp Sp3

View user profile

Back to top Go down

Re: win32/cryptor + fakealert + trojans + rootkit......=***(

Post by BasicBrain on Tue May 19, 2009 6:00 pm

ComboFix 09-05-19.04 - Brian 05/19/2009 13:56.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.247.128 [GMT -7:00]
Running from: c:\documents and settings\Brian\Desktop\ComboFix.exe
AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\docume~1\Brian\LOCALS~1\Temp\tmp2.tmp
C:\xcrashdump.dat

.
((((((((((((((((((((((((( Files Created from 2009-04-19 to 2009-05-19 )))))))))))))))))))))))))))))))
.

2009-05-17 17:25 . 2009-05-17 17:25 -------- d-----w c:\documents and settings\Brian\Application Data\Malwarebytes
2009-05-17 17:25 . 2009-04-06 22:32 15504 ----a-w c:\windows\system32\drivers\mbam.sys
2009-05-17 17:25 . 2009-04-06 22:32 38496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys
2009-05-17 17:25 . 2009-05-17 17:25 -------- d-----w c:\documents and settings\All Users\Application Data\Malwarebytes
2009-05-17 17:25 . 2009-05-17 17:25 -------- d-----w c:\program files\Malwarebytes' Anti-Malware
2009-05-15 10:54 . 2009-03-06 14:22 284160 -c----w c:\windows\system32\dllcache\pdh.dll
2009-05-15 10:54 . 2009-02-09 12:10 401408 -c----w c:\windows\system32\dllcache\rpcss.dll
2009-05-15 10:54 . 2009-02-06 11:11 110592 -c----w c:\windows\system32\dllcache\services.exe
2009-05-15 10:54 . 2009-02-09 12:10 473600 -c----w c:\windows\system32\dllcache\fastprox.dll
2009-05-15 10:54 . 2009-02-06 10:10 227840 -c----w c:\windows\system32\dllcache\wmiprvse.exe
2009-05-15 10:54 . 2009-02-09 12:10 453120 -c----w c:\windows\system32\dllcache\wmiprvsd.dll
2009-05-15 10:54 . 2009-02-09 12:10 729088 -c----w c:\windows\system32\dllcache\lsasrv.dll
2009-05-15 10:54 . 2009-02-09 12:10 617472 -c----w c:\windows\system32\dllcache\advapi32.dll
2009-05-15 10:54 . 2009-02-09 12:10 714752 -c----w c:\windows\system32\dllcache\ntdll.dll
2009-05-15 10:51 . 2008-05-03 11:55 2560 ------w c:\windows\system32\xpsp4res.dll
2009-05-15 10:50 . 2008-04-21 12:08 215552 -c----w c:\windows\system32\dllcache\wordpad.exe
2009-05-07 20:32 . 2003-08-19 11:31 81920 ----a-w c:\windows\system32\viscomwave.dll
2009-05-07 20:32 . 2006-05-03 05:16 98304 ----a-w c:\windows\system32\viscomtran.dll
2009-05-07 20:32 . 2006-01-17 10:59 147456 ----a-w c:\windows\system32\viscomqtenc.dll
2009-05-07 20:32 . 2006-07-30 08:18 139264 ----a-w c:\windows\system32\viscomqtde.dll
2009-05-07 20:32 . 2006-05-04 08:24 90112 ----a-w c:\windows\system32\viscomframe.dll
2009-05-07 20:32 . 2009-05-09 12:51 -------- d-----w c:\program files\FLV Encoder Ver 3.00
2009-05-07 20:31 . 2009-05-16 08:44 -------- d--h--w C:\$AVG8.VAULT$
2009-05-07 19:46 . 2009-05-07 19:46 11952 ----a-w c:\windows\system32\avgrsstx.dll
2009-05-07 19:46 . 2009-05-07 19:46 108552 ----a-w c:\windows\system32\drivers\avgtdix.sys
2009-05-07 19:46 . 2009-05-07 19:46 325896 ----a-w c:\windows\system32\drivers\avgldx86.sys
2009-05-07 19:46 . 2009-05-19 20:38 -------- d-----w c:\windows\system32\drivers\Avg
2009-05-07 19:46 . 2009-05-07 19:46 -------- d-----w c:\documents and settings\Brian\Application Data\AVGTOOLBAR
2009-05-07 19:45 . 2009-05-07 19:45 -------- d-----w c:\program files\AVG
2009-05-07 19:45 . 2009-05-07 19:45 -------- d-----w c:\documents and settings\All Users\Application Data\avg8
2009-05-03 19:27 . 2009-05-03 19:27 410984 ----a-w c:\windows\system32\deploytk.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-07 19:22 . 2007-09-10 00:16 -------- d-----w c:\program files\Real
2009-05-07 19:21 . 2008-10-02 02:54 -------- d-----w c:\program files\Opera
2009-03-06 14:22 . 2003-04-15 13:00 284160 ----a-w c:\windows\system32\pdh.dll
2009-03-03 00:18 . 2006-06-23 18:33 826368 ----a-w c:\windows\system32\wininet.dll
2009-02-20 18:09 . 2004-08-04 07:56 78336 ----a-w c:\windows\system32\ieencode.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"Messenger (Yahoo!)"="c:\program files\Yahoo!\Messenger\YahooMessenger.exe" [2009-02-05 4363504]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PRONoMgr.exe"="c:\program files\Intel\NCS\PROSet\PRONoMgr.exe" [2003-03-11 86016]
"IgfxTray"="c:\windows\System32\igfxtray.exe" [2007-04-26 155648]
"HotKeysCmds"="c:\windows\System32\hkcmd.exe" [2007-04-26 114688]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-08-08 185896]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-09-06 413696]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-05-07 1947928]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-03-13 39264]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Run Nintendo Wi-Fi USB Connector Registration Tool.lnk - c:\program files\WiFiConnector\NintendoWFCReg.exe [2008-2-29 1073152]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-05-07 19:46 11952 ----a-w c:\windows\system32\avgrsstx.dll

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\WINDOWS\\system32\\LEXPPS.EXE"=
"c:\\Program Files\\Black Isle\\BGII - SoA\\BGMain.exe"=
"c:\\WINDOWS\\system32\\dplaysvr.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\WiFiConnector\\NintendoWFCReg.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgnsx.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgemc.exe"=

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [5/7/2009 12:46 PM 325896]
R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [5/7/2009 12:46 PM 108552]
R2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [5/7/2009 12:45 PM 908568]
R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [5/7/2009 12:45 PM 298776]
R2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [11/3/2006 7:19 PM 13592]
S3 cheetah1;cheetah1;\??\c:\documents and settings\Brian\Desktop\cheetahengine\cheetah.sys --> c:\documents and settings\Brian\Desktop\cheetahengine\cheetah.sys [?]
S3 CookieCow1;CookieCow1;\??\c:\documents and settings\Brian\Desktop\CookieCow Engine\CookieCow.sys --> c:\documents and settings\Brian\Desktop\CookieCow Engine\CookieCow.sys [?]
S3 DADriv1;DADriv1;\??\c:\documents and settings\Brian\Desktop\DAengine\DAK32.sys --> c:\documents and settings\Brian\Desktop\DAengine\DAK32.sys [?]
S3 geebers12;geebers12;\??\c:\documents and settings\Brian\Desktop\Xterminator Engine\Xterminator.sys --> c:\documents and settings\Brian\Desktop\Xterminator Engine\Xterminator.sys [?]
S3 iCheat1;iCheat1;\??\c:\documents and settings\Brian\Desktop\v39 by kazu\nvid999.sys --> c:\documents and settings\Brian\Desktop\v39 by kazu\nvid999.sys [?]
S3 kaspersky1;kaspersky1;\??\c:\documents and settings\Brian\Desktop\Kaspersky3[1].3\kaspersky.sys --> c:\documents and settings\Brian\Desktop\Kaspersky3[1].3\kaspersky.sys [?]
S3 memxers12;memxers12;\??\c:\documents and settings\Brian\Desktop\V.39 Hack Pack\iCheat (rev1021)\nvid999.sys --> c:\documents and settings\Brian\Desktop\V.39 Hack Pack\iCheat (rev1021)\nvid999.sys [?]
S3 Revolution1;Revolution1;\??\c:\documents and settings\Brian\Desktop\Revolution Engine 6.2\SHAK3.sys --> c:\documents and settings\Brian\Desktop\Revolution Engine 6.2\SHAK3.sys [?]
S3 xp1;xp1;\??\c:\documents and settings\Brian\Desktop\ALL YOU NEED FOR REV .37 GG 1007\xp.sys --> c:\documents and settings\Brian\Desktop\ALL YOU NEED FOR REV .37 GG 1007\xp.sys [?]
S3 Yakir1;Yakir1;\??\c:\documents and settings\Brian\Desktop\Log Evasion Engine\ZenX.Sys --> c:\documents and settings\Brian\Desktop\Log Evasion Engine\ZenX.Sys [?]
.
Contents of the 'Scheduled Tasks' folder

2009-04-23 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 20:34]

2009-05-19 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Windows Defender\MpCmdRun.exe [2006-11-04 02:20]
.
- - - - ORPHANS REMOVED - - - -

HKCU-Run-MsnMsgr - c:\program files\MSN Messenger\MsnMsgr.Exe
HKCU-Run-Search Protection - c:\program files\Yahoo!\Search Protection\SearchProtection.exe
HKLM-Run-PMR - (no file)


.
------- Supplementary Scan -------
.
uStart Page =
uSearchMigratedDefaultURL = [You must be registered and logged in to see this link.]
mStart Page = [You must be registered and logged in to see this link.]
uInternet Connection Wizard,ShellNext = [You must be registered and logged in to see this link.]
uSearchURL,(Default) = [You must be registered and logged in to see this link.]
DPF: DirectAnimation Java Classes - [You must be registered and logged in to see this link.]
DPF: Microsoft XML Parser for Java - [You must be registered and logged in to see this link.]
FF - ProfilePath - c:\documents and settings\Brian\Application Data\Mozilla\Firefox\Profiles\br03b5z6.default\
FF - prefs.js: browser.search.defaulturl - [You must be registered and logged in to see this link.]
FF - prefs.js: browser.search.selectedEngine - Yahoo
FF - prefs.js: keyword.URL - [You must be registered and logged in to see this link.]
FF - component: c:\program files\AVG\AVG8\Firefox\components\avgssff.dll
FF - component: c:\program files\AVG\AVG8\ToolbarFF\components\vmAVGConnector.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, [You must be registered and logged in to see this link.]
Rootkit scan 2009-05-19 14:01
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
"ImagePath"="\??\c:\documents and settings\Brian\Desktop\Kaspersky3
[1].3\kaspersky.sys"


[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\kaspersky1]
"ImagePath"="\??\c:\documents and settings\Brian\Desktop\Kaspersky3
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-790525478-2147084891-682003330-1004\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{0DCCF127-EA89-389A-56C7-6F185ADDD336}*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
"nappakoplnbgjabklppgeikdfgmc"=hex:6a,61,6c,63,68,6b,6e,66,65,62,67,6e,6c,6a,
64,68,6c,6d,6f,63,00,00
"majikicfdmdkklncckldeboodd"=hex:6a,61,61,64,61,6b,6b,65,66,6d,62,6e,68,69,62,
64,6c,69,68,66,00,c2
.
Completion time: 2009-05-19 14:03
ComboFix-quarantined-files.txt 2009-05-19 21:03

Pre-Run: 4,226,670,592 bytes free
Post-Run: 4,539,174,912 bytes free

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /fastdetect /NoExecute=OptIn

166 --- E O F --- 2009-05-18 21:30

BasicBrain
Novice
Novice

Status :
Online
Offline

Posts : 9
Joined : 2009-05-15
OS : xp

View user profile

Back to top Go down

Re: win32/cryptor + fakealert + trojans + rootkit......=***(

Post by Origin on Thu May 21, 2009 1:17 am

Now open a new notepad file.
Input this into the notepad file:

KILLALL::

Driver::
cheetah1
CookieCow1
DADriv1
geebers12
iCheat1
kaspersky1
memxers12
Revolution1
xp1
Yakir1

RegNull::
[HKEY_USERS\S-1-5-21-790525478-2147084891-682003330-1004\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{0DCCF127-EA89-389A-56C7-6F185ADDD336}*]

Registry:
[-HKEY_LOCAL_MACHINE\System\ControlSet001\Services\kaspersky1]

Save this as CFScript.txt, save it to your desktop also.
Then drag and drop CFScript.txt into combofix as seen below:


This will open combofix again, agree to it's terms and allow it to run.
It may want to reboot after it's done. (It will warn you if it wants to)
Post the resulting log back here.

Origin
Master
Master

Status :
Online
Offline

Posts : 2685
Joined : 2009-05-05
Gender : Male
OS : Windows Xp Sp3

View user profile

Back to top Go down

Re: win32/cryptor + fakealert + trojans + rootkit......=***(

Post by BasicBrain on Fri May 22, 2009 5:12 am

ComboFix 09-05-19.04 - Brian 05/22/2009 0:58.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.247.116 [GMT -7:00]
Running from: c:\documents and settings\Brian\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Brian\Desktop\CFScript.txt
AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_COOKIECOW1
-------\Legacy_DADRIV1
-------\Legacy_GEEBERS12
-------\Legacy_ICHEAT1
-------\Legacy_KASPERSKY1
-------\Legacy_MEMXERS12
-------\Legacy_REVOLUTION1
-------\Legacy_XP1
-------\Legacy_YAKIR1
-------\Service_cheetah1
-------\Service_CookieCow1
-------\Service_DADriv1
-------\Service_geebers12
-------\Service_iCheat1
-------\Service_kaspersky1
-------\Service_memxers12
-------\Service_Revolution1
-------\Service_xp1
-------\Service_Yakir1


((((((((((((((((((((((((( Files Created from 2009-04-22 to 2009-05-22 )))))))))))))))))))))))))))))))
.

2009-05-17 17:25 . 2009-05-17 17:25 -------- d-----w c:\documents and settings\Brian\Application Data\Malwarebytes
2009-05-17 17:25 . 2009-04-06 22:32 15504 ----a-w c:\windows\system32\drivers\mbam.sys
2009-05-17 17:25 . 2009-04-06 22:32 38496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys
2009-05-17 17:25 . 2009-05-17 17:25 -------- d-----w c:\documents and settings\All Users\Application Data\Malwarebytes
2009-05-17 17:25 . 2009-05-17 17:25 -------- d-----w c:\program files\Malwarebytes' Anti-Malware
2009-05-15 10:54 . 2009-03-06 14:22 284160 -c----w c:\windows\system32\dllcache\pdh.dll
2009-05-15 10:54 . 2009-02-09 12:10 401408 -c----w c:\windows\system32\dllcache\rpcss.dll
2009-05-15 10:54 . 2009-02-06 11:11 110592 -c----w c:\windows\system32\dllcache\services.exe
2009-05-15 10:54 . 2009-02-09 12:10 473600 -c----w c:\windows\system32\dllcache\fastprox.dll
2009-05-15 10:54 . 2009-02-06 10:10 227840 -c----w c:\windows\system32\dllcache\wmiprvse.exe
2009-05-15 10:54 . 2009-02-09 12:10 453120 -c----w c:\windows\system32\dllcache\wmiprvsd.dll
2009-05-15 10:54 . 2009-02-09 12:10 729088 -c----w c:\windows\system32\dllcache\lsasrv.dll
2009-05-15 10:54 . 2009-02-09 12:10 617472 -c----w c:\windows\system32\dllcache\advapi32.dll
2009-05-15 10:54 . 2009-02-09 12:10 714752 -c----w c:\windows\system32\dllcache\ntdll.dll
2009-05-15 10:51 . 2008-05-03 11:55 2560 ------w c:\windows\system32\xpsp4res.dll
2009-05-15 10:50 . 2008-04-21 12:08 215552 -c----w c:\windows\system32\dllcache\wordpad.exe
2009-05-07 20:32 . 2003-08-19 11:31 81920 ----a-w c:\windows\system32\viscomwave.dll
2009-05-07 20:32 . 2006-05-03 05:16 98304 ----a-w c:\windows\system32\viscomtran.dll
2009-05-07 20:32 . 2006-01-17 10:59 147456 ----a-w c:\windows\system32\viscomqtenc.dll
2009-05-07 20:32 . 2006-07-30 08:18 139264 ----a-w c:\windows\system32\viscomqtde.dll
2009-05-07 20:32 . 2006-05-04 08:24 90112 ----a-w c:\windows\system32\viscomframe.dll
2009-05-07 20:32 . 2009-05-09 12:51 -------- d-----w c:\program files\FLV Encoder Ver 3.00
2009-05-07 20:31 . 2009-05-19 21:39 -------- d--h--w C:\$AVG8.VAULT$
2009-05-07 19:46 . 2009-05-07 19:46 11952 ----a-w c:\windows\system32\avgrsstx.dll
2009-05-07 19:46 . 2009-05-07 19:46 108552 ----a-w c:\windows\system32\drivers\avgtdix.sys
2009-05-07 19:46 . 2009-05-07 19:46 325896 ----a-w c:\windows\system32\drivers\avgldx86.sys
2009-05-07 19:46 . 2009-05-21 19:54 -------- d-----w c:\windows\system32\drivers\Avg
2009-05-07 19:46 . 2009-05-21 21:29 -------- d-----w c:\documents and settings\Brian\Application Data\AVGTOOLBAR
2009-05-07 19:45 . 2009-05-07 19:45 -------- d-----w c:\program files\AVG
2009-05-07 19:45 . 2009-05-07 19:45 -------- d-----w c:\documents and settings\All Users\Application Data\avg8
2009-05-03 19:27 . 2009-05-03 19:27 410984 ----a-w c:\windows\system32\deploytk.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-07 19:22 . 2007-09-10 00:16 -------- d-----w c:\program files\Real
2009-05-07 19:21 . 2008-10-02 02:54 -------- d-----w c:\program files\Opera
2009-03-06 14:22 . 2003-04-15 13:00 284160 ----a-w c:\windows\system32\pdh.dll
2009-03-03 00:18 . 2006-06-23 18:33 826368 ----a-w c:\windows\system32\wininet.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"Messenger (Yahoo!)"="c:\program files\Yahoo!\Messenger\YahooMessenger.exe" [2009-02-05 4363504]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PRONoMgr.exe"="c:\program files\Intel\NCS\PROSet\PRONoMgr.exe" [2003-03-11 86016]
"IgfxTray"="c:\windows\System32\igfxtray.exe" [2007-04-26 155648]
"HotKeysCmds"="c:\windows\System32\hkcmd.exe" [2007-04-26 114688]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-08-08 185896]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-09-06 413696]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-05-07 1947928]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-03-13 39264]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Run Nintendo Wi-Fi USB Connector Registration Tool.lnk - c:\program files\WiFiConnector\NintendoWFCReg.exe [2008-2-29 1073152]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-05-07 19:46 11952 ----a-w c:\windows\system32\avgrsstx.dll

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\WINDOWS\\system32\\LEXPPS.EXE"=
"c:\\Program Files\\Black Isle\\BGII - SoA\\BGMain.exe"=
"c:\\WINDOWS\\system32\\dplaysvr.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\WiFiConnector\\NintendoWFCReg.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgnsx.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgemc.exe"=

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [5/7/2009 12:46 PM 325896]
R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [5/7/2009 12:46 PM 108552]
R2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [5/7/2009 12:45 PM 908568]
R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [5/7/2009 12:45 PM 298776]
R2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [11/3/2006 7:19 PM 13592]
.
Contents of the 'Scheduled Tasks' folder

2009-04-23 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 20:34]

2009-05-22 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Windows Defender\MpCmdRun.exe [2006-11-04 02:20]
.
.
------- Supplementary Scan -------
.
uStart Page =
uSearchMigratedDefaultURL = [You must be registered and logged in to see this link.]
mStart Page = [You must be registered and logged in to see this link.]
uInternet Connection Wizard,ShellNext = [You must be registered and logged in to see this link.]
uSearchURL,(Default) = [You must be registered and logged in to see this link.]
DPF: DirectAnimation Java Classes - [You must be registered and logged in to see this link.]
DPF: Microsoft XML Parser for Java - [You must be registered and logged in to see this link.]
FF - ProfilePath - c:\documents and settings\Brian\Application Data\Mozilla\Firefox\Profiles\br03b5z6.default\
FF - prefs.js: browser.search.defaulturl - [You must be registered and logged in to see this link.]
FF - prefs.js: browser.search.selectedEngine - Yahoo
FF - prefs.js: keyword.URL - [You must be registered and logged in to see this link.]
FF - component: c:\program files\AVG\AVG8\Firefox\components\avgssff.dll
FF - component: c:\program files\AVG\AVG8\ToolbarFF\components\vmAVGConnector.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, [You must be registered and logged in to see this link.]
Rootkit scan 2009-05-22 01:08
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(804)
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\LEXBCES.EXE
c:\windows\system32\LEXPPS.EXE
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Common Files\Lanovation\PrismXL\PRISMXL.SYS
c:\program files\AVG\AVG8\avgrsx.exe
c:\progra~1\AVG\AVG8\avgnsx.exe
c:\program files\AVG\AVG8\avgcsrvx.exe
c:\windows\system32\wscntfy.exe
c:\program files\Yahoo!\Messenger\Ymsgr_tray.exe
.
**************************************************************************
.
Completion time: 2009-05-22 1:17 - machine was rebooted
ComboFix-quarantined-files.txt 2009-05-22 08:17
ComboFix2.txt 2009-05-19 21:04

Pre-Run: 3,971,756,032 bytes free
Post-Run: 4,028,047,360 bytes free

172 --- E O F --- 2009-05-21 20:24

BasicBrain
Novice
Novice

Status :
Online
Offline

Posts : 9
Joined : 2009-05-15
OS : xp

View user profile

Back to top Go down

Re: win32/cryptor + fakealert + trojans + rootkit......=***(

Post by Belahzur on Fri May 22, 2009 9:15 am

This looks fine now.

Click Start > Run and copy/paste the following bolded text into the Run box and click OK:

ComboFix /u



This will also reset your restore points.

How is the machine running now?


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Status :
Online
Offline

Posts : 34916
Joined : 2008-08-03
Gender : Male
OS : XP SP3 Media Centre

View user profile

Back to top Go down

Re: win32/cryptor + fakealert + trojans + rootkit......=***(

Post by BasicBrain on Fri May 22, 2009 4:02 pm

Wow, you guys are truly amazing! My computer is performing the best it has in years, almost as if it is brand new again. It is hard to believe that you guys are able to provide this level of excellent service....and for FREE at that! Thank you very much and I'll be sure to spread the news of your site to my other friends and all others of need of immediate computer "911" response. Thanks again! Big Grin

Thank You! Thank You! Thank You! Thank You! Thank You! Thank You! Thank You! Thank You! Thank You! Thank You! Thank You! Thank You! Thank You! Thank You! Thank You! Thank You!

BasicBrain
Novice
Novice

Status :
Online
Offline

Posts : 9
Joined : 2009-05-15
OS : xp

View user profile

Back to top Go down

View previous topic View next topic Back to top

- Similar topics

 
Permissions in this forum:
You cannot reply to topics in this forum