Malware Doctor, Regedit and Task Manager Blocked

View previous topic View next topic Go down

Malware Doctor, Regedit and Task Manager Blocked

Post by Saxuri on 27th May 2009, 1:31 am

Basically, Malware Doctor somehow came to my computer and hasn't left since.
I have used Spybot Search and Destroy AND Malwarebytes' Anti-Malware to scan my computer, but it keeps coming back. Also, when I try to open task manager or regedit it says that it has been locked (I'm the admin on this computer and did not do it).

I have also looked at general guides to removing Malware Doctor and, after running Spybot S&D in safe mode (and temporarily fixing the regedit and task manager problem) have deleted some registry entries related to it (but haven't found any of the mentioned files) and this also hasn't permanently solved the problem.

Here is my hijackthis log:


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:25:23 PM, on 5/26/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\windows\System32\smss.exe
C:\windows\system32\winlogon.exe
C:\windows\system32\services.exe
C:\windows\system32\lsass.exe
C:\windows\system32\Ati2evxx.exe
C:\windows\system32\svchost.exe
C:\windows\System32\svchost.exe
C:\windows\system32\Ati2evxx.exe
C:\windows\system32\spoolsv.exe
C:\windows\Explorer.EXE
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\windows\System32\avast!Antivirus.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\windows\system32\svchost.exe
C:\windows\RTHDCPL.EXE
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\ASUS\EPU-6 Engine\SixEngine.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Documents and Settings\Evelyn\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
C:\Program Files\ASUS\SmartDoctor\SmartDoctor.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Electronic Arts\EADM\Core.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\windows\system32\wscntfy.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\LocalService\Application Data\691447002.exe
C:\WINDOWS\system32\msiexec.exe
c:\windows\ld08.exe
\?\globalroot\C:\windows\system32\cmd.exe
C:\Documents and Settings\Evelyn\Desktop\Hijack(GP)This.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = [You must be registered and logged in to see this link.]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = [You must be registered and logged in to see this link.]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = [You must be registered and logged in to see this link.]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = [You must be registered and logged in to see this link.]
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = [You must be registered and logged in to see this link.]
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost;*.local
O1 - Hosts: # Copyright (c) 1993-1999 Microsoft Corp.
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O3 - Toolbar: Ask Toolbar - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Program Files\AskBarDis\bar\bin\askBar.dll
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Six Engine] "C:\Program Files\ASUS\EPU-6 Engine\SixEngine.exe" -r
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [AdobeCS4ServiceManager] "C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [sysldtray] c:\windows\ld08.exe
O4 - HKLM\..\Run: [Malware Doctor] C:\Documents and Settings\LocalService\Application Data\691447002.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
O4 - HKLM\..\RunOnce: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Evelyn\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [ASUS SmartDoctor] C:\Program Files\ASUS\SmartDoctor\SmartDoctor.exe /start
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [EA Core] "C:\Program Files\Electronic Arts\EADM\Core.exe" -silent
O4 - HKCU\..\Run: [Malware Doctor] C:\Documents and Settings\LocalService\Application Data\691447002.exe
O4 - S-1-5-18 Startup: ChkDisk.lnk = ? (User 'SYSTEM')
O4 - .DEFAULT Startup: ChkDisk.lnk = ? (User 'Default user')
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: hp psc 2000 Series.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
O4 - Global Startup: hpoddt01.exe.lnk = ?
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O8 - Extra context menu item: E&xport to Microsoft Excel - [You must be registered and logged in to see this link.]
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\windows\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\windows\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O20 - AppInit_DLLs: xobhqf , ,c:\progra~1\ThunMail\testabd.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: ASKUpgrade - Unknown owner - C:\Program Files\AskBarDis\bar\bin\ASKUpgrade.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\windows\system32\Ati2evxx.exe
O23 - Service: avast!Antivirus - Unknown owner - C:\windows\System32\avast!Antivirus.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe

--
End of file - 8600 bytes

Thanks in advance!

Saxuri
Novice
Novice

Posts Posts : 19
Joined Joined : 2009-05-27
OS OS : XP
Points Points : 27673
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Malware Doctor, Regedit and Task Manager Blocked

Post by Origin on 27th May 2009, 2:32 am

I see you have Viewpoint software installed.

Viewpoint Manager is considered as foistware instead of malware since it is installed without users approval but doesn't spy or do anything "bad". Read this article: [You must be registered and logged in to see this link.] and [You must be registered and logged in to see this link.]

I suggest you remove the program now.

Go to Start > Control Panel > Add/Remove Programs and remove the following programs if present.

  • Viewpoint Manager (remove only)
  • Viewpoint Media Player
  • Viewpoint Toolbar
Next, please download ViewpointKiller by Prm753 from [You must be registered and logged in to see this link.].
Save it to a permanent folder (such as C:\ViewpointKiller) and unzip it there.
Open ViewpointKiller, and press the Start button.
A log will be produced in the same folder where you unzipped it to. Please post the contents of that log in your reply.



I notice that you have Spybot's TeaTimer running. While this is normally a wonderful tool to protect against hijackers, it can also interfere with HijackThis fixes. So please disable TeaTimer by doing the following:
1) Run Spybot-S&D
2) Go to the Mode menu, and make sure "Advanced Mode" is selected
3) On the left hand side, choose Tools -> Resident
4) Uncheck "Resident TeaTimer" and OK any prompts
You can reenable TeaTimer once your system is clean.

Please make sure Teatimer is disable before we do this, otherwise this fix will fail.




  • Open HijackThis
  • Choose "Do a system scan only"
  • Check the boxes in front of these lines:


    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost;*.local
    O1 - Hosts: # Copyright (c) 1993-1999 Microsoft Corp.
    O3 - Toolbar: Ask Toolbar - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Program Files\AskBarDis\bar\bin\askBar.dll
    O4 - HKLM\..\Run: [Malware Doctor] C:\Documents and Settings\LocalService\Application Data\691447002.exe
    O4 - HKCU\..\Run: [Malware Doctor] C:\Documents and Settings\LocalService\Application Data\691447002.exe
    O4 - S-1-5-18 Startup: ChkDisk.lnk = ? (User 'SYSTEM')
    O4 - .DEFAULT Startup: ChkDisk.lnk = ? (User 'Default user')
    O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe



  • Press "Fix Checked"
  • Close Hijack This.




1. If you are using Firefox, make sure that your download settings are as follows:

* Tools->Options->Main tab
* Set to "Always ask me where to Save the files".

2. During the download, rename Combofix to Combo-Fix as follows:





3. It is important you rename Combofix during the download, but not after.
4. Please do not rename Combofix to other names, but only to the one indicated.
5. Close any open browsers.
6. We need to disable your local AV (Anti-virus) before running Combofix.
See [You must be registered and logged in to see this link.] for how to disable your AV..

  • Double click on ComboFix.exe.
  • Follow the prompts. NOTE:
  • ComboFix will check to see if the Microsoft Windows Recovery Console is installed.
    ***It's strongly recommended to have the Recovery Console installed before doing any malware removal.***
  • Allow combofix to run
  • Post C:\combofix.txt back here.

    Note:
    Do not mouseclick combofix's window whilst it's running. That may cause it to stall.


While my help is always free, please consider donating to keep this site alive: [You must be registered and logged in to see this link.]

[You must be registered and logged in to see this link.]

Origin
Master
Master

Posts Posts : 2685
Joined Joined : 2009-05-05
Gender Gender : Male
OS OS : Windows Xp Sp3
Points Points : 31533
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Malware Doctor, Regedit and Task Manager Blocked

Post by Saxuri on 27th May 2009, 3:23 am

Here is the log from ViewpointKiller:

----------------------------------
ViewpointKiller Version 1.30 (beta)

The removal process was started on Tue May 26 22:43:08 2009

Preparing to remove Viewpoint Media Player...

Warning accepted, beginning removal process....

ViewpointKiller determined that "aim.exe" was not running.
ViewpointKiller determined that "aim6.exe" was not running.
ViewpointKiller determined that "aolsoftware.exe" was not running.
ViewpointKiller determined that "aol.exe" was not running.
ViewpointKiller determined that "MtsAxInstaller.exe" was not running.

Preparing to close the Viewpoint Manager Service if it is running...
Closing "Viewpoint Manager Service" failed, or the service is not running.

Searching for all known Viewpoint Media Player registry values and keys...
Found and removed: SOFTWARE\Viewpoint
Finished searching for and removing all known Viewpoint Media Player registry values and keys.

Searching for all known Viewpoint Media Player files and folders...
Found and removed: C:\Documents and Settings\All Users\Application Data\Viewpoint
Finished searching for and removing all known Viewpoint Media Player files and folders.

Finished reporting.
----------------------------------
----------------------------------
ViewpointKiller Version 1.30 (beta)

The removal process was started on Tue May 26 22:43:13 2009

Preparing to remove Viewpoint Manager...

ViewpointKiller determined that "viewmgr.exe" was not running.
Searching for all known Viewpoint Manager registry values and keys...
Found and removed: Software\Microsoft\Windows\CurrentVersion\Uninstall\Viewpoint Manager
Finished searching for and removing all known Viewpoint Manager registry values and keys.

Searching for all known Viewpoint Manager files and folders...
Finished searching for and removing all known Viewpoint Manager files and folders.

Finished reporting.
----------------------------------
----------------------------------
ViewpointKiller Version 1.30 (beta)

The removal process was started on Tue May 26 22:43:14 2009

Preparing to remove Viewpoint Toolbar...

ViewpointKiller determined that "FotomatDeviceConnect.exe" was not running.
ViewpointKiller determined that "iexplore.exe" was not running.

Searming for all known Viewpoint Toolbar registry values and keys...
Finished searching for and removing all known Viewpoint Toolbar registry values and keys.

Searching for all known Viewpoint Toolbar files and folders...
Finished searching for and removing all known Viewpoint Toolbar files and folders.

Finished reporting.
----------------------------------



I took note of the prompt to install recovery console and approved it, but for some reason it failed. (I forgot to write down the message).

Anyways, here is the ComboFix log:
--------------------------


ComboFix 09-05-26.02 - Evelyn 05/26/2009 23:05.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3327.2940 [GMT -4:00]
Running from: c:\documents and settings\Evelyn\Desktop\Combo-Fix.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users\Application Data\Microsoft\Internet Explorer\DLLs\c.cgm
c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat
c:\documents and settings\LocalService\Application Data\691447002.exe
c:\documents and settings\LocalService\Application Data\916653139.exe
c:\temp\DIV55
c:\temp\DIV55\xDb.log
c:\windows\st_1243387490.exe
c:\windows\st_1243405939.exe
c:\windows\system32\avast!Antivirus.exe
c:\windows\system32\drivers\ovfsthtkioevpapqjautenklydnbgikhosdjno.sys
c:\windows\system32\hefihiru.dll
c:\windows\system32\jayosuto.dll
c:\windows\system32\jhxm32.dll
c:\windows\system32\op4
c:\windows\system32\ovfsthbkumxqtvtynytjlwwwcrbtjhvgdlusat.dll
c:\windows\system32\ovfsthityqpmhlmoqxhkniyknvnxsxnrsdkaqy.dat
c:\windows\system32\ovfsthoysmswuiwvqrrdaivhxibrmcjwngbpxe.dll
c:\windows\system32\ovfsthrnlvvbdpdriwppnhvmiidknbbphjkopf.dll
c:\windows\system32\ovfsthwwdfumwrgqmojqlodhsoveufpxaixbsw.dat
c:\windows\system32\sft.res
c:\windows\system32\TDSSosvd.dat
c:\windows\system32\vos
c:\windows\system32\vp_setup.exe
c:\windows\system32\vp_setup.exe.bat
c:\windows\system32\win32hlp.cnf
C:\xcrashdump.dat

----- BITS: Possible infected sites -----

[You must be registered and logged in to see this link.] Update
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_ovfsthwrqxorudupwaivrqlmqhwpdsffubqhkl
-------\Legacy_ASHEVTSVC
-------\Legacy_AVAST!ANTIVIRUS
-------\Service_avast!Antivirus


((((((((((((((((((((((((( Files Created from 2009-04-27 to 2009-05-27 )))))))))))))))))))))))))))))))
.

2009-05-27 02:18 . 2009-05-27 02:18 -------- d-----w c:\program files\Alwil Software
2009-05-27 01:26 . 2009-05-27 01:26 2 ---h--w c:\windows\sonce122730.dat
2009-05-23 18:23 . 2009-05-23 18:23 -------- d-----w c:\documents and settings\All Users\Application Data\Apple Computer
2009-05-22 00:38 . 2009-05-27 01:10 3371383 ----a-w c:\documents and settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe
2009-05-21 03:10 . 2009-05-21 03:10 -------- d-----w c:\documents and settings\All Users\Application Data\ATI
2009-05-18 01:59 . 2009-05-18 01:59 -------- d-----w c:\documents and settings\All Users\Application Data\McAfee
2009-05-17 04:31 . 2009-05-17 04:31 -------- d-----w c:\program files\Audacity
2009-05-17 04:23 . 2009-05-17 04:26 -------- d-----w c:\documents and settings\Evelyn\Application Data\Broad Intelligence
2009-05-16 16:58 . 2009-05-16 16:58 -------- d-----w c:\program files\AskBarDis
2009-05-13 04:33 . 2009-05-13 04:33 -------- d-sh--w c:\documents and settings\Default User\IETldCache
2009-05-10 17:40 . 2009-05-10 17:40 -------- d-----w c:\documents and settings\Evelyn\Application Data\Geniesoft
2009-05-10 17:40 . 2009-05-10 17:40 -------- d-----w c:\program files\VSTPlugins
2009-05-10 17:17 . 2009-05-10 17:19 -------- d-----w c:\documents and settings\LocalService\Local Settings\Application Data\Adobe
2009-05-10 17:16 . 2009-05-10 17:16 -------- d-sh--w c:\documents and settings\LocalService\IETldCache
2009-05-10 16:39 . 2009-04-24 02:55 176235 ----a-w c:\windows\system32\Primomonnt.dll
2009-05-10 16:39 . 2009-05-10 16:39 -------- d-----w c:\program files\Nitro PDF
2009-05-09 18:48 . 2009-05-09 18:48 -------- d-----w c:\documents and settings\Evelyn\Application Data\uTorrent
2009-05-09 03:15 . 2009-03-23 21:56 38208 ----a-w c:\documents and settings\Evelyn\Application Data\Macromedia\Flash Player\[You must be registered and logged in to see this link.]
2009-05-08 02:18 . 2009-03-24 18:43 43008 ----a-w c:\documents and settings\Evelyn\Application Data\Mozilla\Firefox\Profiles\2e5unjkd.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\metricsloader.dll
2009-05-08 02:18 . 2009-03-24 18:43 43008 ----a-w c:\documents and settings\Evelyn\Application Data\Mozilla\Firefox\Profiles\2e5unjkd.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\googletoolbarloader.dll
2009-05-08 02:18 . 2009-03-24 18:43 235520 ----a-w c:\documents and settings\Evelyn\Application Data\Mozilla\Firefox\Profiles\2e5unjkd.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\libraries\metrics-ff2.dll
2009-05-08 02:18 . 2009-03-24 18:43 338432 ----a-w c:\documents and settings\Evelyn\Application Data\Mozilla\Firefox\Profiles\2e5unjkd.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\libraries\googletoolbar-ff2.dll
2009-05-08 02:18 . 2009-03-24 18:42 235008 ----a-w c:\documents and settings\Evelyn\Application Data\Mozilla\Firefox\Profiles\2e5unjkd.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\libraries\metrics-ff3.dll
2009-05-08 02:18 . 2009-03-24 18:42 345088 ----a-w c:\documents and settings\Evelyn\Application Data\Mozilla\Firefox\Profiles\2e5unjkd.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\libraries\googletoolbar-ff3.dll
2009-05-05 01:47 . 2009-05-05 01:47 -------- d-sh--w c:\documents and settings\Evelyn\IECompatCache
2009-05-04 01:18 . 2009-05-04 01:18 -------- d-sh--w c:\documents and settings\NetworkService\IETldCache
2009-05-04 00:48 . 2009-05-04 00:48 -------- d-sh--w c:\windows\system32\config\systemprofile\PrivacIE
2009-05-01 01:48 . 2009-05-01 01:48 -------- d-sh--w c:\documents and settings\Evelyn\PrivacIE
2009-04-30 22:20 . 2009-04-30 22:20 -------- d-----w c:\program files\Trend Micro
2009-04-29 02:51 . 2009-04-29 02:51 -------- d-----w c:\windows\system32\NtmsData
2009-04-29 02:17 . 2009-04-29 02:17 -------- d-sh--w c:\documents and settings\Evelyn\IETldCache
2009-04-29 01:45 . 2009-04-29 01:45 -------- d-sh--w c:\windows\system32\config\systemprofile\IETldCache
2009-04-29 01:20 . 2009-04-29 01:20 -------- d-----w c:\windows\ie8updates
2009-04-29 01:20 . 2009-02-28 04:55 105984 -c----w c:\windows\system32\dllcache\iecompat.dll
2009-04-29 01:18 . 2009-04-29 01:19 -------- dc-h--w c:\windows\ie8
2009-04-29 01:07 . 2009-04-29 01:07 -------- d-----w c:\windows\system32\XPSViewer
2009-04-29 01:07 . 2008-07-06 12:06 89088 -c----w c:\windows\system32\dllcache\filterpipelineprintproc.dll
2009-04-29 01:07 . 2008-07-06 12:06 575488 -c----w c:\windows\system32\dllcache\xpsshhdr.dll
2009-04-29 01:07 . 2008-07-06 12:06 575488 ------w c:\windows\system32\xpsshhdr.dll
2009-04-29 01:07 . 2008-07-06 12:06 1676288 -c----w c:\windows\system32\dllcache\xpssvcs.dll
2009-04-29 01:07 . 2008-07-06 12:06 1676288 ------w c:\windows\system32\xpssvcs.dll
2009-04-29 01:07 . 2008-07-06 12:06 117760 ------w c:\windows\system32\prntvpt.dll
2009-04-29 01:07 . 2008-07-06 10:50 597504 -c----w c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2009-04-29 01:07 . 2009-04-29 01:44 -------- d-----w c:\windows\SxsCaPendDel
2009-04-28 22:40 . 2009-04-28 22:40 -------- d-----w c:\program files\Microsoft
2009-04-28 02:32 . 2009-04-28 20:36 -------- d-----w c:\program files\iPod
2009-04-27 23:56 . 2009-05-27 02:48 -------- d-----w c:\documents and settings\All Users\Application Data\avg8
2009-04-27 23:56 . 2009-04-27 23:56 -------- d-----w c:\program files\AVG
2009-04-27 04:40 . 2009-05-08 01:32 -------- d-----w c:\documents and settings\Evelyn\Local Settings\Application Data\FLVService
2009-04-27 04:39 . 2009-05-16 17:00 -------- d-----w c:\program files\Ask & Record Toolbar
2009-04-27 04:39 . 2009-04-27 04:39 -------- d-----w c:\windows\Ask & Record Toolbar

.

Saxuri
Novice
Novice

Posts Posts : 19
Joined Joined : 2009-05-27
OS OS : XP
Points Points : 27673
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Malware Doctor, Regedit and Task Manager Blocked

Post by Saxuri on 27th May 2009, 3:23 am

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-27 02:06 . 2009-04-08 02:37 -------- d-----w c:\documents and settings\All Users\Application Data\FLEXnet
2009-05-27 01:58 . 2009-01-29 07:39 -------- d-----w c:\program files\LimeWire
2009-05-27 01:22 . 2008-09-06 16:14 -------- d-----w c:\program files\Common Files\Adobe
2009-05-27 01:14 . 2008-09-21 16:44 -------- d-----w c:\program files\Java
2009-05-27 01:10 . 2008-12-17 04:11 -------- d-----w c:\program files\Malwarebytes' Anti-Malware
2009-05-26 23:30 . 2008-12-17 04:10 -------- d-----w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-05-26 17:20 . 2008-12-17 04:11 40160 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys
2009-05-26 17:19 . 2008-12-17 04:11 19096 ----a-w c:\windows\system32\drivers\mbam.sys
2009-05-21 03:39 . 2009-04-21 03:53 -------- d-----w c:\documents and settings\Evelyn\Application Data\GetRightToGo
2009-05-18 02:02 . 2008-12-18 23:12 -------- d-----w c:\program files\CCleaner
2009-05-17 23:39 . 2008-09-06 04:13 1324 ----a-w c:\windows\system32\d3d9caps.dat
2009-05-17 04:23 . 2009-02-18 00:41 -------- d-----w c:\program files\AoA Audio Extractor
2009-05-17 04:14 . 2008-09-19 01:20 -------- d---a-w c:\documents and settings\All Users\Application Data\TEMP
2009-05-15 21:41 . 2008-12-17 04:10 -------- d-----w c:\program files\Spybot - Search & Destroy
2009-05-13 04:33 . 2008-09-06 21:59 -------- d-----w c:\documents and settings\All Users\Application Data\Microsoft Help
2009-05-10 22:12 . 2008-09-06 01:26 46816 ----a-w c:\documents and settings\Evelyn\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-05-10 04:51 . 2008-09-25 03:04 -------- d-----w c:\documents and settings\Evelyn\Application Data\LimeWire
2009-05-08 02:06 . 2008-09-06 03:25 -------- d--h--w c:\program files\InstallShield Installation Information
2009-04-29 01:14 . 2008-11-30 19:35 -------- d-----w c:\program files\Microsoft Works
2009-04-29 00:06 . 2008-09-06 03:49 -------- d-----w c:\program files\iTunes
2009-04-29 00:02 . 2009-03-26 02:44 -------- d-----w c:\program files\MSN Messenger
2009-04-28 22:40 . 2008-09-06 03:38 -------- d-----w c:\program files\Windows Live
2009-04-28 20:36 . 2008-09-06 03:48 -------- d-----w c:\program files\Common Files\Apple
2009-04-28 04:23 . 2009-01-18 20:16 -------- d-----w c:\program files\Windows Media Connect 2
2009-04-28 02:57 . 2009-03-21 02:34 -------- d-----w c:\program files\QuickTime
2009-04-28 02:50 . 2008-12-02 02:22 -------- d-----w c:\program files\Oberon Media
2009-04-28 02:50 . 2008-09-24 03:18 -------- d-----w c:\program files\DivX
2009-04-27 21:15 . 2008-04-14 12:00 104960 ----a-w c:\windows\system32\userinit.exe
2009-04-25 00:15 . 2009-04-25 00:15 -------- d-----w c:\documents and settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
2009-04-19 05:29 . 2009-01-09 16:48 -------- d-----w c:\documents and settings\Evelyn\Application Data\mIRC
2009-04-14 03:39 . 2008-12-14 05:02 -------- d-----w c:\program files\The KMPlayer
2009-04-12 04:25 . 2008-09-06 03:53 -------- d-----w c:\program files\Messenger Plus! Live
2009-04-11 20:29 . 2008-09-06 14:35 46424 ----a-w c:\documents and settings\Wei\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-04-07 22:08 . 2009-04-07 22:08 -------- d-----w c:\program files\Common Files\Macrovision Shared
2009-04-07 21:44 . 2009-04-07 15:59 -------- d-----w c:\documents and settings\Evelyn\Application Data\Download Manager
2009-03-28 04:55 . 2008-09-15 20:27 -------- d-----w c:\program files\Last.fm
2009-03-19 20:32 . 2009-03-19 20:32 23400 ----a-w c:\documents and settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}\x86\x86\GEARAspiWDM.sys
2009-03-19 20:32 . 2008-01-29 16:01 23400 ----a-w c:\windows\system32\drivers\GEARAspiWDM.sys
2009-03-08 08:34 . 2008-04-14 12:00 914944 ----a-w c:\windows\system32\wininet.dll
2009-03-08 08:34 . 2008-04-14 12:00 43008 ----a-w c:\windows\system32\licmgr10.dll
2009-03-08 08:33 . 2008-04-14 12:00 18944 ----a-w c:\windows\system32\corpol.dll
2009-03-08 08:33 . 2008-04-14 12:00 420352 ----a-w c:\windows\system32\vbscript.dll
2009-03-08 08:32 . 2008-04-14 12:00 72704 ----a-w c:\windows\system32\admparse.dll
2009-03-08 08:32 . 2008-04-14 12:00 71680 ----a-w c:\windows\system32\iesetup.dll
2009-03-08 08:31 . 2008-04-14 12:00 34816 ----a-w c:\windows\system32\imgutil.dll
2009-03-08 08:31 . 2008-04-14 12:00 48128 ----a-w c:\windows\system32\mshtmler.dll
2009-03-08 08:31 . 2008-04-14 12:00 45568 ----a-w c:\windows\system32\mshta.exe
2009-03-08 08:22 . 2008-04-14 12:00 156160 ----a-w c:\windows\system32\msls31.dll
2009-03-06 14:22 . 2008-04-14 12:00 284160 ----a-w c:\windows\system32\pdh.dll
.

------- Sigcheck -------

[-] 2009-04-27 21:15 104960 7A18B8DE4B1BF4ABD43A71C583CC846D c:\windows\system32\userinit.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Google Update"="c:\documents and settings\Evelyn\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2008-09-06 133104]
"ASUS SmartDoctor"="c:\program files\ASUS\SmartDoctor\SmartDoctor.exe" [2008-05-29 1150976]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-01-01 39408]
"EA Core"="c:\program files\Electronic Arts\EADM\Core.exe" [2009-04-29 3338240]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-01-21 61440]
"Six Engine"="c:\program files\ASUS\EPU-6 Engine\SixEngine.exe" [2008-06-03 5964800]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-11-01 136600]
"LVCOMSX"="c:\windows\system32\LVCOMSX.EXE" [2004-02-25 221184]
"LogitechVideoRepair"="c:\program files\Logitech\Video\ISStart.exe" [2004-02-25 454656]
"LogitechVideoTray"="c:\program files\Logitech\Video\LogiTray.exe" [2004-02-25 212992]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-01-05 413696]
"AdobeCS4ServiceManager"="c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" [2008-08-14 611712]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-04-02 342312]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.exe [2008-05-16 16862720]

c:\documents and settings\Evelyn\Start Menu\Programs\Startup\
Adobe Gamma.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-3-16 113664]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
hp psc 2000 Series.lnk - c:\program files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe [2003-4-9 323646]
hpoddt01.exe.lnk - c:\program files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe [2003-4-9 28672]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoSetActiveDesktop"= 1 (0x1)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Electronic Arts\\EADM\\Core.exe"=
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"c:\\Program Files\\AIM6\\aim6.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Common Files\\Adobe\\CS4ServiceManager\\CS4ServiceManager.exe"=
"c:\\Program Files\\ASUS\\EPU-6 Engine\\SixEngine.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\MSN Messenger\\livecall.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5353:TCP"= 5353:TCP:Adobe CSI CS4

R0 mv61xx;mv61xx;c:\windows\system32\drivers\mv61xx.sys [6/23/2008 6:21 PM 150568]
R3 AtiHdmiService;ATI Function Driver for HDMI Service;c:\windows\system32\drivers\AtiHdmi.sys [9/6/2008 12:18 AM 84992]
R3 L1e;Miniport Driver for Atheros AR8121/AR8113 PCI-E Ethernet Controller;c:\windows\system32\drivers\l1e51x86.sys [9/5/2008 11:25 PM 36864]
S2 ASKUpgrade;ASKUpgrade;c:\program files\AskBarDis\bar\bin\ASKUpgrade.exe [5/16/2009 12:58 PM 234888]
S3 CrystalSysInfo;CrystalSysInfo;\??\c:\program files\MediaCoder\SysInfo.sys --> c:\program files\MediaCoder\SysInfo.sys [?]
S3 XDva212;XDva212;\??\c:\windows\system32\XDva212.sys --> c:\windows\system32\XDva212.sys [?]
S3 XDva215;XDva215;\??\c:\windows\system32\XDva215.sys --> c:\windows\system32\XDva215.sys [?]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
Contents of the 'Scheduled Tasks' folder

2008-09-20 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-04-11 16:34]

2008-12-17 c:\windows\Tasks\FRU Task 2003-04-10 00:56ewlett-Packard2003-04-10 00:56p psc 2200 series272A572217594EBCF1CEE215E352B92AD073FDE4221015199.job
- c:\program files\Hewlett-Packard\Digital Imaging\Bin\hpqfrucl.exe [2003-04-09 21:56]

2009-05-26 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1417001333-2111687655-2147034123-1003.job
- c:\documents and settings\Evelyn\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2008-09-06 03:28]

2009-05-26 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1417001333-2111687655-2147034123-1004.job
- c:\documents and settings\Wei\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2008-09-06 16:09]

2008-12-28 c:\windows\Tasks\NSSstub.job
- c:\windows\system32\Adobe\Shockwave 11\nssstub.exe [2008-12-28 15:33]
.
- - - - ORPHANS REMOVED - - - -

BHO-{F30B5E7E-CFBB-44fb-A947-226E5A7A4290} - jhxm32.dll
HKCU-Run-Aim6 - (no file)
SafeBoot-procexp90.Sys


.
------- Supplementary Scan -------
.
uStart Page = [You must be registered and logged in to see this link.]
uInternet Settings,ProxyOverride = localhost;*.local
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
Trusted Zone: clubbox.co.kr
Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - c:\program files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
FF - ProfilePath - c:\documents and settings\Evelyn\Application Data\Mozilla\Firefox\Profiles\2e5unjkd.default\
FF - component: c:\program files\Mozilla Firefox\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}\components\NPComponent.dll
FF - plugin: c:\documents and settings\Evelyn\Local Settings\Application Data\Google\Update\1.2.145.5\npGoogleOneClick8.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, [You must be registered and logged in to see this link.]
Rootkit scan 2009-05-26 23:08
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (LocalSystem)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,86,78,28,5c,6f,df,03,4d,83,d4,07,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,86,78,28,5c,6f,df,03,4d,83,d4,07,\
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(760)
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'explorer.exe'(4024)
c:\windows\system32\ieframe.dll
c:\windows\system32\OneX.DLL
c:\windows\system32\eappprxy.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\ati2evxx.exe
c:\windows\system32\ati2evxx.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\wscntfy.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
c:\program files\Logitech\Video\FxSvr2.exe
c:\program files\iPod\bin\iPodService.exe
c:\program files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
c:\program files\Hewlett-Packard\Digital Imaging\bin\hposts08.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
.
**************************************************************************
.
Completion time: 2009-05-27 23:12 - machine was rebooted
ComboFix-quarantined-files.txt 2009-05-27 03:12

Pre-Run: 406,525,124,608 bytes free
Post-Run: 406,670,852,096 bytes free

290 --- E O F --- 2009-05-13 04:33

Saxuri
Novice
Novice

Posts Posts : 19
Joined Joined : 2009-05-27
OS OS : XP
Points Points : 27673
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Malware Doctor, Regedit and Task Manager Blocked

Post by Origin on 27th May 2009, 4:59 am

I see that you are running Limewire.
P2P(Peer to peer) applications are designed to help you easily share and distribute files between you and a group of people. But they can also be used to distribute malware, and thus are not considered safe.
The removal of these programs is optional, but highly recommended.

If Limewire is not removed, then I won't help you.

Go to Start > Control Panel > Add/Remove Programs and remove the following programs.

  • Limewire 4.18.8



I see that you are running µTorrent.
P2P(Peer to peer) applications are designed to help you easily share and distribute files between you and a group of people. But they can also be used to distribute malware, and thus are not considered safe.
The removal of these programs is optional, but highly recommended.

If µTorrent is not removed, then I won't help you.

Go to Start > Control Panel > Add/Remove Programs and remove the following programs.

  • µTorrent




Now open a new notepad file.
Input this into the notepad file:

File::
c:\windows\sonce122730.dat
c:\program files\AskBarDis
c:\documents and settings\Evelyn\Application Data\uTorrent
c:\program files\LimeWire
c:\windows\system32\d3d9caps.dat
c:\documents and settings\Evelyn\Application Data\LimeWire

Driver::
ASKUpgrade

Save this as CFScript.txt, save it to your desktop also.
Then drag and drop CFScript.txt into combofix as seen below:


This will open combofix again, agree to it's terms and allow it to run.
It may want to reboot after it's done. (It will warn you if it wants to)
Post the resulting log back here.


While my help is always free, please consider donating to keep this site alive: [You must be registered and logged in to see this link.]

[You must be registered and logged in to see this link.]

Origin
Master
Master

Posts Posts : 2685
Joined Joined : 2009-05-05
Gender Gender : Male
OS OS : Windows Xp Sp3
Points Points : 31533
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Malware Doctor, Regedit and Task Manager Blocked

Post by Saxuri on 27th May 2009, 1:40 pm

I previously deleted those programs, but it appears that there were leftover folders.

Here is the log from the scan:

ComboFix 09-05-26.02 - Evelyn 05/27/2009 9:29.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3327.2729 [GMT -4:00]
Running from: c:\documents and settings\Evelyn\Desktop\Combo-Fix.exe
Command switches used :: c:\documents and settings\Evelyn\Desktop\CFScript.txt
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::
"c:\documents and settings\Evelyn\Application Data\LimeWire"
"c:\documents and settings\Evelyn\Application Data\uTorrent"
"c:\program files\AskBarDis"
"c:\program files\LimeWire"
"c:\windows\sonce122730.dat"
"c:\windows\system32\d3d9caps.dat"
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\sonce122730.dat
c:\windows\system32\d3d9caps.dat

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_ASKUPGRADE
-------\Service_ASKUpgrade


((((((((((((((((((((((((( Files Created from 2009-04-27 to 2009-05-27 )))))))))))))))))))))))))))))))
.

2009-05-27 02:18 . 2009-05-27 02:18 -------- d-----w c:\program files\Alwil Software
2009-05-23 18:23 . 2009-05-23 18:23 -------- d-----w c:\documents and settings\All Users\Application Data\Apple Computer
2009-05-22 00:38 . 2009-05-27 01:10 3371383 ----a-w c:\documents and settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe
2009-05-21 03:10 . 2009-05-21 03:10 -------- d-----w c:\documents and settings\All Users\Application Data\ATI
2009-05-18 01:59 . 2009-05-18 01:59 -------- d-----w c:\documents and settings\All Users\Application Data\McAfee
2009-05-17 04:31 . 2009-05-17 04:31 -------- d-----w c:\program files\Audacity
2009-05-17 04:23 . 2009-05-17 04:26 -------- d-----w c:\documents and settings\Evelyn\Application Data\Broad Intelligence
2009-05-16 16:58 . 2009-05-16 16:58 -------- d-----w c:\program files\AskBarDis
2009-05-13 04:33 . 2009-05-13 04:33 -------- d-sh--w c:\documents and settings\Default User\IETldCache
2009-05-10 17:40 . 2009-05-10 17:40 -------- d-----w c:\documents and settings\Evelyn\Application Data\Geniesoft
2009-05-10 17:40 . 2009-05-10 17:40 -------- d-----w c:\program files\VSTPlugins
2009-05-10 17:17 . 2009-05-10 17:19 -------- d-----w c:\documents and settings\LocalService\Local Settings\Application Data\Adobe
2009-05-10 17:16 . 2009-05-10 17:16 -------- d-sh--w c:\documents and settings\LocalService\IETldCache
2009-05-10 16:39 . 2009-04-24 02:55 176235 ----a-w c:\windows\system32\Primomonnt.dll
2009-05-10 16:39 . 2009-05-10 16:39 -------- d-----w c:\program files\Nitro PDF
2009-05-09 03:15 . 2009-03-23 21:56 38208 ----a-w c:\documents and settings\Evelyn\Application Data\Macromedia\Flash Player\[You must be registered and logged in to see this link.]
2009-05-08 02:18 . 2009-03-24 18:43 43008 ----a-w c:\documents and settings\Evelyn\Application Data\Mozilla\Firefox\Profiles\2e5unjkd.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\metricsloader.dll
2009-05-08 02:18 . 2009-03-24 18:43 43008 ----a-w c:\documents and settings\Evelyn\Application Data\Mozilla\Firefox\Profiles\2e5unjkd.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\googletoolbarloader.dll
2009-05-08 02:18 . 2009-03-24 18:43 235520 ----a-w c:\documents and settings\Evelyn\Application Data\Mozilla\Firefox\Profiles\2e5unjkd.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\libraries\metrics-ff2.dll
2009-05-08 02:18 . 2009-03-24 18:43 338432 ----a-w c:\documents and settings\Evelyn\Application Data\Mozilla\Firefox\Profiles\2e5unjkd.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\libraries\googletoolbar-ff2.dll
2009-05-08 02:18 . 2009-03-24 18:42 235008 ----a-w c:\documents and settings\Evelyn\Application Data\Mozilla\Firefox\Profiles\2e5unjkd.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\libraries\metrics-ff3.dll
2009-05-08 02:18 . 2009-03-24 18:42 345088 ----a-w c:\documents and settings\Evelyn\Application Data\Mozilla\Firefox\Profiles\2e5unjkd.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\libraries\googletoolbar-ff3.dll
2009-05-05 01:47 . 2009-05-05 01:47 -------- d-sh--w c:\documents and settings\Evelyn\IECompatCache
2009-05-04 01:18 . 2009-05-04 01:18 -------- d-sh--w c:\documents and settings\NetworkService\IETldCache
2009-05-04 00:48 . 2009-05-04 00:48 -------- d-sh--w c:\windows\system32\config\systemprofile\PrivacIE
2009-05-01 01:48 . 2009-05-01 01:48 -------- d-sh--w c:\documents and settings\Evelyn\PrivacIE
2009-04-30 22:20 . 2009-04-30 22:20 -------- d-----w c:\program files\Trend Micro
2009-04-29 02:51 . 2009-04-29 02:51 -------- d-----w c:\windows\system32\NtmsData
2009-04-29 02:17 . 2009-04-29 02:17 -------- d-sh--w c:\documents and settings\Evelyn\IETldCache
2009-04-29 01:45 . 2009-04-29 01:45 -------- d-sh--w c:\windows\system32\config\systemprofile\IETldCache
2009-04-29 01:20 . 2009-04-29 01:20 -------- d-----w c:\windows\ie8updates
2009-04-29 01:20 . 2009-02-28 04:55 105984 -c----w c:\windows\system32\dllcache\iecompat.dll
2009-04-29 01:18 . 2009-04-29 01:19 -------- dc-h--w c:\windows\ie8
2009-04-29 01:07 . 2009-04-29 01:07 -------- d-----w c:\windows\system32\XPSViewer
2009-04-29 01:07 . 2008-07-06 12:06 89088 -c----w c:\windows\system32\dllcache\filterpipelineprintproc.dll
2009-04-29 01:07 . 2008-07-06 12:06 575488 -c----w c:\windows\system32\dllcache\xpsshhdr.dll
2009-04-29 01:07 . 2008-07-06 12:06 575488 ------w c:\windows\system32\xpsshhdr.dll
2009-04-29 01:07 . 2008-07-06 12:06 1676288 -c----w c:\windows\system32\dllcache\xpssvcs.dll
2009-04-29 01:07 . 2008-07-06 12:06 1676288 ------w c:\windows\system32\xpssvcs.dll
2009-04-29 01:07 . 2008-07-06 12:06 117760 ------w c:\windows\system32\prntvpt.dll
2009-04-29 01:07 . 2008-07-06 10:50 597504 -c----w c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2009-04-29 01:07 . 2009-04-29 01:44 -------- d-----w c:\windows\SxsCaPendDel
2009-04-28 22:40 . 2009-04-28 22:40 -------- d-----w c:\program files\Microsoft
2009-04-28 02:32 . 2009-04-28 20:36 -------- d-----w c:\program files\iPod
2009-04-27 23:56 . 2009-05-27 02:48 -------- d-----w c:\documents and settings\All Users\Application Data\avg8
2009-04-27 23:56 . 2009-04-27 23:56 -------- d-----w c:\program files\AVG

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-27 02:06 . 2009-04-08 02:37 -------- d-----w c:\documents and settings\All Users\Application Data\FLEXnet
2009-05-27 01:22 . 2008-09-06 16:14 -------- d-----w c:\program files\Common Files\Adobe
2009-05-27 01:14 . 2008-09-21 16:44 -------- d-----w c:\program files\Java
2009-05-27 01:10 . 2008-12-17 04:11 -------- d-----w c:\program files\Malwarebytes' Anti-Malware
2009-05-26 23:30 . 2008-12-17 04:10 -------- d-----w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-05-26 17:20 . 2008-12-17 04:11 40160 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys
2009-05-26 17:19 . 2008-12-17 04:11 19096 ----a-w c:\windows\system32\drivers\mbam.sys
2009-05-21 03:39 . 2009-04-21 03:53 -------- d-----w c:\documents and settings\Evelyn\Application Data\GetRightToGo
2009-05-18 02:02 . 2008-12-18 23:12 -------- d-----w c:\program files\CCleaner
2009-05-17 04:23 . 2009-02-18 00:41 -------- d-----w c:\program files\AoA Audio Extractor
2009-05-17 04:14 . 2008-09-19 01:20 -------- d---a-w c:\documents and settings\All Users\Application Data\TEMP
2009-05-16 17:00 . 2009-04-27 04:39 -------- d-----w c:\program files\Ask & Record Toolbar
2009-05-15 21:41 . 2008-12-17 04:10 -------- d-----w c:\program files\Spybot - Search & Destroy
2009-05-13 04:33 . 2008-09-06 21:59 -------- d-----w c:\documents and settings\All Users\Application Data\Microsoft Help
2009-05-10 22:12 . 2008-09-06 01:26 46816 ----a-w c:\documents and settings\Evelyn\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-05-08 02:06 . 2008-09-06 03:25 -------- d--h--w c:\program files\InstallShield Installation Information
2009-04-29 01:14 . 2008-11-30 19:35 -------- d-----w c:\program files\Microsoft Works
2009-04-29 00:06 . 2008-09-06 03:49 -------- d-----w c:\program files\iTunes
2009-04-29 00:02 . 2009-03-26 02:44 -------- d-----w c:\program files\MSN Messenger
2009-04-28 22:40 . 2008-09-06 03:38 -------- d-----w c:\program files\Windows Live
2009-04-28 20:36 . 2008-09-06 03:48 -------- d-----w c:\program files\Common Files\Apple
2009-04-28 04:23 . 2009-01-18 20:16 -------- d-----w c:\program files\Windows Media Connect 2
2009-04-28 02:57 . 2009-03-21 02:34 -------- d-----w c:\program files\QuickTime
2009-04-28 02:50 . 2008-12-02 02:22 -------- d-----w c:\program files\Oberon Media
2009-04-28 02:50 . 2008-09-24 03:18 -------- d-----w c:\program files\DivX
2009-04-27 21:15 . 2008-04-14 12:00 104960 ----a-w c:\windows\system32\userinit.exe
2009-04-25 00:15 . 2009-04-25 00:15 -------- d-----w c:\documents and settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
2009-04-19 05:29 . 2009-01-09 16:48 -------- d-----w c:\documents and settings\Evelyn\Application Data\mIRC
2009-04-14 03:39 . 2008-12-14 05:02 -------- d-----w c:\program files\The KMPlayer
2009-04-12 04:25 . 2008-09-06 03:53 -------- d-----w c:\program files\Messenger Plus! Live
2009-04-11 20:29 . 2008-09-06 14:35 46424 ----a-w c:\documents and settings\Wei\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-04-07 22:08 . 2009-04-07 22:08 -------- d-----w c:\program files\Common Files\Macrovision Shared
2009-04-07 21:44 . 2009-04-07 15:59 -------- d-----w c:\documents and settings\Evelyn\Application Data\Download Manager
2009-03-19 20:32 . 2009-03-19 20:32 23400 ----a-w c:\documents and settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}\x86\x86\GEARAspiWDM.sys
2009-03-19 20:32 . 2008-01-29 16:01 23400 ----a-w c:\windows\system32\drivers\GEARAspiWDM.sys
2009-03-08 08:34 . 2008-04-14 12:00 914944 ----a-w c:\windows\system32\wininet.dll
2009-03-08 08:34 . 2008-04-14 12:00 43008 ----a-w c:\windows\system32\licmgr10.dll
2009-03-08 08:33 . 2008-04-14 12:00 18944 ----a-w c:\windows\system32\corpol.dll
2009-03-08 08:33 . 2008-04-14 12:00 420352 ----a-w c:\windows\system32\vbscript.dll
2009-03-08 08:32 . 2008-04-14 12:00 72704 ----a-w c:\windows\system32\admparse.dll
2009-03-08 08:32 . 2008-04-14 12:00 71680 ----a-w c:\windows\system32\iesetup.dll
2009-03-08 08:31 . 2008-04-14 12:00 34816 ----a-w c:\windows\system32\imgutil.dll
2009-03-08 08:31 . 2008-04-14 12:00 48128 ----a-w c:\windows\system32\mshtmler.dll
2009-03-08 08:31 . 2008-04-14 12:00 45568 ----a-w c:\windows\system32\mshta.exe
2009-03-08 08:22 . 2008-04-14 12:00 156160 ----a-w c:\windows\system32\msls31.dll
2009-03-06 14:22 . 2008-04-14 12:00 284160 ----a-w c:\windows\system32\pdh.dll
.

Saxuri
Novice
Novice

Posts Posts : 19
Joined Joined : 2009-05-27
OS OS : XP
Points Points : 27673
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Malware Doctor, Regedit and Task Manager Blocked

Post by Saxuri on 27th May 2009, 1:40 pm

------- Sigcheck -------

[-] 2009-04-27 21:15 104960 7A18B8DE4B1BF4ABD43A71C583CC846D c:\windows\system32\userinit.exe
.
((((((((((((((((((((((((((((( [You must be registered and logged in to see this link.] )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-05-27 13:32 . 2009-05-27 13:32 16384 c:\windows\Temp\Perflib_Perfdata_218.dat
- 2008-04-14 12:00 . 2009-05-27 02:54 68360 c:\windows\system32\perfc009.dat
+ 2008-04-14 12:00 . 2009-05-27 03:12 68360 c:\windows\system32\perfc009.dat
+ 2008-04-14 12:00 . 2009-05-27 03:12 435590 c:\windows\system32\perfh009.dat
- 2008-04-14 12:00 . 2009-05-27 02:54 435590 c:\windows\system32\perfh009.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Google Update"="c:\documents and settings\Evelyn\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2008-09-06 133104]
"ASUS SmartDoctor"="c:\program files\ASUS\SmartDoctor\SmartDoctor.exe" [2008-05-29 1150976]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-01-01 39408]
"EA Core"="c:\program files\Electronic Arts\EADM\Core.exe" [2009-04-29 3338240]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-01-21 61440]
"Six Engine"="c:\program files\ASUS\EPU-6 Engine\SixEngine.exe" [2008-06-03 5964800]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-11-01 136600]
"LVCOMSX"="c:\windows\system32\LVCOMSX.EXE" [2004-02-25 221184]
"LogitechVideoRepair"="c:\program files\Logitech\Video\ISStart.exe" [2004-02-25 454656]
"LogitechVideoTray"="c:\program files\Logitech\Video\LogiTray.exe" [2004-02-25 212992]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-01-05 413696]
"AdobeCS4ServiceManager"="c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" [2008-08-14 611712]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-04-02 342312]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.exe [2008-05-16 16862720]

c:\documents and settings\Evelyn\Start Menu\Programs\Startup\
Adobe Gamma.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-3-16 113664]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
hp psc 2000 Series.lnk - c:\program files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe [2003-4-9 323646]
hpoddt01.exe.lnk - c:\program files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe [2003-4-9 28672]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoSetActiveDesktop"= 1 (0x1)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Electronic Arts\\EADM\\Core.exe"=
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"c:\\Program Files\\AIM6\\aim6.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Common Files\\Adobe\\CS4ServiceManager\\CS4ServiceManager.exe"=
"c:\\Program Files\\ASUS\\EPU-6 Engine\\SixEngine.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\MSN Messenger\\livecall.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5353:TCP"= 5353:TCP:Adobe CSI CS4

R0 mv61xx;mv61xx;c:\windows\system32\drivers\mv61xx.sys [6/23/2008 6:21 PM 150568]
R3 AtiHdmiService;ATI Function Driver for HDMI Service;c:\windows\system32\drivers\AtiHdmi.sys [9/6/2008 12:18 AM 84992]
R3 L1e;Miniport Driver for Atheros AR8121/AR8113 PCI-E Ethernet Controller;c:\windows\system32\drivers\l1e51x86.sys [9/5/2008 11:25 PM 36864]
S3 CrystalSysInfo;CrystalSysInfo;\??\c:\program files\MediaCoder\SysInfo.sys --> c:\program files\MediaCoder\SysInfo.sys [?]
S3 XDva212;XDva212;\??\c:\windows\system32\XDva212.sys --> c:\windows\system32\XDva212.sys [?]
S3 XDva215;XDva215;\??\c:\windows\system32\XDva215.sys --> c:\windows\system32\XDva215.sys [?]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
Contents of the 'Scheduled Tasks' folder

2008-09-20 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-04-11 16:34]

2008-12-17 c:\windows\Tasks\FRU Task 2003-04-10 00:56ewlett-Packard2003-04-10 00:56p psc 2200 series272A572217594EBCF1CEE215E352B92AD073FDE4221015199.job
- c:\program files\Hewlett-Packard\Digital Imaging\Bin\hpqfrucl.exe [2003-04-09 21:56]

2009-05-27 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1417001333-2111687655-2147034123-1003.job
- c:\documents and settings\Evelyn\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2008-09-06 03:28]

2009-05-27 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1417001333-2111687655-2147034123-1004.job
- c:\documents and settings\Wei\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2008-09-06 16:09]

2008-12-28 c:\windows\Tasks\NSSstub.job
- c:\windows\system32\Adobe\Shockwave 11\nssstub.exe [2008-12-28 15:33]
.
.
------- Supplementary Scan -------
.
uStart Page = [You must be registered and logged in to see this link.]
uInternet Settings,ProxyOverride = localhost;*.local
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
Trusted Zone: clubbox.co.kr
Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - c:\program files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
FF - ProfilePath - c:\documents and settings\Evelyn\Application Data\Mozilla\Firefox\Profiles\2e5unjkd.default\
FF - component: c:\program files\Mozilla Firefox\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}\components\NPComponent.dll
FF - plugin: c:\documents and settings\Evelyn\Local Settings\Application Data\Google\Update\1.2.145.5\npGoogleOneClick8.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, [You must be registered and logged in to see this link.]
Rootkit scan 2009-05-27 09:33
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (LocalSystem)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,86,78,28,5c,6f,df,03,4d,83,d4,07,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,86,78,28,5c,6f,df,03,4d,83,d4,07,\
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(760)
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'explorer.exe'(368)
c:\windows\system32\ieframe.dll
c:\windows\system32\OneX.DLL
c:\windows\system32\eappprxy.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\ati2evxx.exe
c:\windows\system32\ati2evxx.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\wscntfy.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
c:\program files\Logitech\Video\FxSvr2.exe
c:\program files\iPod\bin\iPodService.exe
c:\program files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
c:\program files\Hewlett-Packard\Digital Imaging\bin\hposts08.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
.
**************************************************************************
.
Completion time: 2009-05-27 9:36 - machine was rebooted
ComboFix-quarantined-files.txt 2009-05-27 13:36
ComboFix2.txt 2009-05-27 03:12

Pre-Run: 406,660,386,816 bytes free
Post-Run: 406,644,858,880 bytes free

266 --- E O F --- 2009-05-13 04:33

Saxuri
Novice
Novice

Posts Posts : 19
Joined Joined : 2009-05-27
OS OS : XP
Points Points : 27673
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Malware Doctor, Regedit and Task Manager Blocked

Post by Origin on 28th May 2009, 1:12 am

Please download and run this tool.

Download Malwarebytes' Anti-Malware from [You must be registered and logged in to see this link.]

Double Click mbam-setup.exe to install the application.

  • Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select "Perform Quick Scan", then click Scan.
  • The scan may take some time to finish,so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected.
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Note:
If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts.
Click OK to either and let MBAM proceed with the disinfection process.
If asked to restart the computer, please do so immediately.


Post the contents of the MBAM Log.


While my help is always free, please consider donating to keep this site alive: [You must be registered and logged in to see this link.]

[You must be registered and logged in to see this link.]

Origin
Master
Master

Posts Posts : 2685
Joined Joined : 2009-05-05
Gender Gender : Male
OS OS : Windows Xp Sp3
Points Points : 31533
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Malware Doctor, Regedit and Task Manager Blocked

Post by Saxuri on 28th May 2009, 1:18 am

Here's the log from the Malwarebytes scan:

Malwarebytes' Anti-Malware 1.37
Database version: 2186
Windows 5.1.2600 Service Pack 3

27/05/2009 9:17:52 PM
mbam-log-2009-05-27 (21-17-52).txt

Scan type: Quick Scan
Objects scanned: 85368
Time elapsed: 2 minute(s), 26 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 1
Folders Infected: 0
Files Infected: 2

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Trojan.FakeAlert) -> Data: c:\windows\system32\userinit.exe -> Quarantined and deleted successfully.

Folders Infected:
(No malicious items detected)

Files Infected:
C:\WINDOWS\system32\win32hlp.cnf (Trojan.Agent) -> Quarantined and deleted successfully.
c:\WINDOWS\9g2234wesdf3dfgjf23 (Worm.KoobFace) -> Quarantined and deleted successfully.

Saxuri
Novice
Novice

Posts Posts : 19
Joined Joined : 2009-05-27
OS OS : XP
Points Points : 27673
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Malware Doctor, Regedit and Task Manager Blocked

Post by Origin on 28th May 2009, 1:25 am

Click Start > Run and copy/paste the following bolded text into the Run box and click OK:

ComboFix /u



This will also reset your restore points.

How is the machine running now?


While my help is always free, please consider donating to keep this site alive: [You must be registered and logged in to see this link.]

[You must be registered and logged in to see this link.]

Origin
Master
Master

Posts Posts : 2685
Joined Joined : 2009-05-05
Gender Gender : Male
OS OS : Windows Xp Sp3
Points Points : 31533
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Malware Doctor, Regedit and Task Manager Blocked

Post by Saxuri on 28th May 2009, 4:29 am

Great! I don't see any problems left.
Thank you for replying so quickly and solving my problem so fast.

Saxuri
Novice
Novice

Posts Posts : 19
Joined Joined : 2009-05-27
OS OS : XP
Points Points : 27673
# Likes # Likes : 0

View user profile

Back to top Go down

View previous topic View next topic Back to top

- Similar topics

 
Permissions in this forum:
You cannot reply to topics in this forum