Welcome Guest ( Log In | Click here to Register a free account now! )
Welcome to Bleeping Computer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.When posting your problem, do not run and post a ComboFix logs. ComboFix is a tool that should only be run under the supervision of someone who has been trained in its use. Using it on your own can cause problems with your computer. Any posts containing CF Logs will be ignored.
To receive help, you should instead provide a detailed description of your problem, detailed word-for-word error messages that you are receiving, screenshots of strange behaviour, and your operating system. This information is much more useful to our helpers than a ComboFix log.
![]() ![]() |
Dec 4 2007, 04:51 PM
Post
#16
|
|
|
Member ![]() ![]() Group: Members Posts: 18 Joined: 3-December 07 Member No.: 174,207 |
Here's the results: SDFix: Version 1.116 Run by Administrator on Tue 12/04/2007 at 04:21 PM Microsoft Windows XP [Version 5.1.2600] Running From: C:\DOCUME~1\ADMINI~1\Desktop\SDFix Safe Mode: Checking Services: Restoring Windows Registry Values Restoring Windows Default Hosts File Rebooting... Normal Mode: Checking Files: No Trojan Files Found Removing Temp Files... ADS Check: C:\WINDOWS No streams found. C:\WINDOWS\system32 No streams found. C:\WINDOWS\system32\svchost.exe No streams found. C:\WINDOWS\system32\ntoskrnl.exe No streams found. Final Check: catchme 0.3.1262.1 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-12-04 16:30:40 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden services & system hive ... scanning hidden registry entries ... scanning hidden files ... scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 Remaining Services: ------------------ Authorized Application Key Export: [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "C:\\Program Files\\AIM\\aim.exe"="C:\\Program Files\\AIM\\aim.exe:*:Enabled:AOL Instant Messenger" "C:\\Program Files\\Kodak\\KODAK Software Updater\\7288971\\Program\\Kodak Software Updater.exe"="C:\\Program Files\\Kodak\\KODAK Software Updater\\7288971\\Program\\Kodak Software Updater.exe:*:Enabled:Kodak Software Updater" "C:\\Program Files\\Internet Explorer\\iexplore.exe"="C:\\Program Files\\Internet Explorer\\iexplore.exe:*:Enabled:Internet Explorer" "C:\\Program Files\\Bonjour\\mDNSResponder.exe"="C:\\Program Files\\Bonjour\\mDNSResponder.exe:*:Enabled:Bonjour" "C:\\Program Files\\Kodak\\Kodak EasyShare software\\bin\\EasyShare.exe"="C:\\Program Files\\Kodak\\Kodak EasyShare software\\bin\\EasyShare.exe:*:Enabled:EasyShare" "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" Remaining Files: --------------- Files with Hidden Attributes: Fri 28 Apr 2006 4,348 ..SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak" Mon 25 Sep 2006 0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp" Sat 2 Dec 2006 0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv02.tmp" Sun 3 Dec 2006 0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv03.tmp" Finished! |
|
|
|
Dec 4 2007, 04:53 PM
Post
#17
|
|
|
Member ![]() ![]() Group: Members Posts: 18 Joined: 3-December 07 Member No.: 174,207 |
Sorry...double post.
This post has been edited by Speedway73: Dec 4 2007, 04:57 PM |
|
|
|
Dec 4 2007, 05:31 PM
Post
#18
|
|
![]() Bleepin' Janitor ![]() ![]() ![]() ![]() ![]() ![]() Group: Global Moderator Posts: 18,039 Joined: 9-July 05 From: Virginia, USA Member No.: 26,513 |
One or more of the identified infections is a backdoor Trojan. Backdoor Trojans, IRCBots and Infostealers are very dangerous because they provide a means of accessing a computer system that bypasses security mechanisms and steal sensitive information like passwords, personal and financial data which they send back to the hacker. Remote attackers use backdoor Trojans as part of an exploit to to gain unauthorized access to a computer and take control of it without your knowledge. Read the Danger: Remote Access Trojans.
Although the backdoor Trojan was identified and removed, your PC has likely been compromised and there is no way to be sure the computer can ever be trusted again. It is dangerous and incorrect to assume that because the backdoor Trojan has been removed the computer is now secure. Many experts in the security community believe that once infected with this type of malware, the best course of action is to reformat and reinstall the OS - "When should I re-format?". Should you decide not to follow that advice, we will do our best to help clean the computer of any infections but we cannot guarantee it to be trustworthy or that the removal will be successful. Please print out and follow the generic instructions for using SmitfraudFix in BC's self-help tutorial "How to remove the Smitfraud/Generic Zlob". (scroll down to Removal Instructions; ignore the part showing symptoms in a HijackThis log as they may not apply in your case.) If you have downloaded SmitfraudFix previously, please delete that version and download it again as the tool is frequently updated! -------------------- "THE BAD GUYS DON'T NEED A SEARCH WARRANT. ARE YOU PROTECTED?"
Microsoft MVP - Windows Security 2007-2009 ![]() Member of UNITE, Unified Network of Instructors and Trusted Eliminators |
|
|
|
Dec 5 2007, 11:36 AM
Post
#19
|
|
|
Member ![]() ![]() Group: Members Posts: 18 Joined: 3-December 07 Member No.: 174,207 |
One or more of the identified infections is a backdoor Trojan. Backdoor Trojans, IRCBots and Infostealers are very dangerous because they provide a means of accessing a computer system that bypasses security mechanisms and steal sensitive information like passwords, personal and financial data which they send back to the hacker. Remote attackers use backdoor Trojans as part of an exploit to to gain unauthorized access to a computer and take control of it without your knowledge. Read the Danger: Remote Access Trojans. Although the backdoor Trojan was identified and removed, your PC has likely been compromised and there is no way to be sure the computer can ever be trusted again. It is dangerous and incorrect to assume that because the backdoor Trojan has been removed the computer is now secure. Many experts in the security community believe that once infected with this type of malware, the best course of action is to reformat and reinstall the OS - "When should I re-format?". Should you decide not to follow that advice, we will do our best to help clean the computer of any infections but we cannot guarantee it to be trustworthy or that the removal will be successful. Please print out and follow the generic instructions for using SmitfraudFix in BC's self-help tutorial "How to remove the Smitfraud/Generic Zlob". (scroll down to Removal Instructions; ignore the part showing symptoms in a HijackThis log as they may not apply in your case.) If you have downloaded SmitfraudFix previously, please delete that version and download it again as the tool is frequently updated! Thank you quietman7...After I ran the last test....everything is back to normal. No more Windows Security Alert pop ups...no more alert bubbles...the black screen w/warnings is gone too. My computer seems quite a bit faster too. I use Webroot's Spy Sweeper and it only finds 1 or 2 issues after several hours of surfing. Both were spy cookies...lowest threat according to Spy Sweeper. I tried to run the last test....Smitfraud/Generic Zlob....and I'm not sure I did it correctly. It seemed to work alright ...and I did get a log at the end,but it never gave me the "Red" screen and never rebooted on it's own. Do you have a different link or at least a step by step tutorial yourself?? Your instructions were very easy for me to understand. I'm a newbie when it comes to getting this deep into this computer. Thank You greatly!! |
|
|
|
Dec 5 2007, 11:46 AM
Post
#20
|
|
![]() Bleepin' Janitor ![]() ![]() ![]() ![]() ![]() ![]() Group: Global Moderator Posts: 18,039 Joined: 9-July 05 From: Virginia, USA Member No.: 26,513 |
After running smitfraudfix, it should have created a text file named rapport.txt. That file is automatically saved to the root of the system drive, usually at C:\rapport.txt.
Please copy/paste the contents of that report into your next reply back here. -------------------- "THE BAD GUYS DON'T NEED A SEARCH WARRANT. ARE YOU PROTECTED?"
Microsoft MVP - Windows Security 2007-2009 ![]() Member of UNITE, Unified Network of Instructors and Trusted Eliminators |
|
|
|
Dec 5 2007, 12:20 PM
Post
#21
|
|
|
Member ![]() ![]() Group: Members Posts: 18 Joined: 3-December 07 Member No.: 174,207 |
quietman7...Here's the rapport:
SmitFraudFix v2.258 Scan done at 12:08:09.18, Wed 12/05/2007 Run from C:\Documents and Settings\Administrator\Desktop\SmitfraudFix OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT The filesystem type is NTFS Fix run in safe mode »»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Before SmitFraudFix !!!Attention, following keys are not inevitably infected!!! SrchSTS.exe by S!Ri Search SharedTaskScheduler's .dll »»»»»»»»»»»»»»»»»»»»»»»» Killing process »»»»»»»»»»»»»»»»»»»»»»»» hosts 127.0.0.1 localhost »»»»»»»»»»»»»»»»»»»»»»»» Winsock2 Fix S!Ri's WS2Fix: LSP not Found. »»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix GenericRenosFix by S!Ri »»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files »»»»»»»»»»»»»»»»»»»»»»»» DNS HKLM\SYSTEM\CCS\Services\Tcpip\..\{5390A2B6-57F8-4BEF-B919-FAD70BBA8FA7}: DhcpNameServer=192.168.254.254 192.168.254.254 HKLM\SYSTEM\CS1\Services\Tcpip\..\{5390A2B6-57F8-4BEF-B919-FAD70BBA8FA7}: DhcpNameServer=192.168.254.254 192.168.254.254 HKLM\SYSTEM\CS3\Services\Tcpip\..\{5390A2B6-57F8-4BEF-B919-FAD70BBA8FA7}: DhcpNameServer=192.168.254.254 192.168.254.254 HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.254.254 192.168.254.254 HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.254.254 192.168.254.254 HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=192.168.254.254 192.168.254.254 »»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files »»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System !!!Attention, following keys are not inevitably infected!!! [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] "System"="" »»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning Registry Cleaning done. »»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler After SmitFraudFix !!!Attention, following keys are not inevitably infected!!! SrchSTS.exe by S!Ri Search SharedTaskScheduler's .dll »»»»»»»»»»»»»»»»»»»»»»»» End |
|
|
|
Dec 5 2007, 12:39 PM
Post
#22
|
|
![]() Bleepin' Janitor ![]() ![]() ![]() ![]() ![]() ![]() Group: Global Moderator Posts: 18,039 Joined: 9-July 05 From: Virginia, USA Member No.: 26,513 |
It ran ok.
Now you should Create a New Restore Point to prevent possible reinfection from an old one. Some of the malware you picked up could have been saved in System Restore. Since this is a protected directory your tools cannot access to delete these files, they sometimes can reinfect your system if you accidentally use an old restore point. Setting a new restore point AFTER cleaning your system will help prevent this and enable your computer to "roll-back" to a clean working state. The easiest and safest way to do this is:
-------------------- "THE BAD GUYS DON'T NEED A SEARCH WARRANT. ARE YOU PROTECTED?"
Microsoft MVP - Windows Security 2007-2009 ![]() Member of UNITE, Unified Network of Instructors and Trusted Eliminators |
|
|
|
Dec 5 2007, 05:53 PM
Post
#23
|
|
|
Member ![]() ![]() Group: Members Posts: 18 Joined: 3-December 07 Member No.: 174,207 |
Quietman7 ....Done. All seems to be well now. I THANK YOU GREATLY for all your help. I have 2 other issues that I hope you can help me with yet they are not infection related...I think.
1. When I turn on my computor from off...and I log on from the log on screen....when it starts to load,I get a small alert that pops up. It says in the title: Smart Bridge Alerts: Motive SB.exe-Entry Point Not Found In the body it says: The procedure entry point GetProcessImageFileNameW could not be found in the dynamic link library PSAPI.DLL It's done this for a long time...long before the recent issues. It only pops up once right after the log on screen. What is it and can I make it go away?? The other is a Defender issue....not loading updates from the Defender program after I prompt it to. It just sits there. |
|
|
|
Dec 5 2007, 06:05 PM
Post
#24
|
|
![]() Bleepin' Janitor ![]() ![]() ![]() ![]() ![]() ![]() Group: Global Moderator Posts: 18,039 Joined: 9-July 05 From: Virginia, USA Member No.: 26,513 |
Problems Arising from PSAPI.DLL Dynamic Link Library File
As for Defender, download and install the Windows Installer CleanUp Utility - (it will list all programs that use Windows Installer).
"Windows Defender Support & Training" "Troubleshooting Windows Defender in XP" Until you get the issue resolved you can manually download Windows Defender Definition updates from the Microsoft Malware Protection Center Portal -------------------- "THE BAD GUYS DON'T NEED A SEARCH WARRANT. ARE YOU PROTECTED?"
Microsoft MVP - Windows Security 2007-2009 ![]() Member of UNITE, Unified Network of Instructors and Trusted Eliminators |
|
|
|
![]() ![]() |
| Lo-Fi Version | Time is now: 21st November 2009 - 02:27 PM |