 Malware Problems! Combo Fix Logs ! Can Any One Help?:s, Had cpu viruses for ages, getting worse and worse. |
Welcome Guest ( Log In | Click here to Register a free account now! )
Register a free account to unlock additional features at BleepingComputer.com
Welcome to Bleeping Computer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.  |
 Jul 3 2008, 07:19 AM
Post
#1
|
|
|
New Member  Group: Members Posts: 2 Joined: 3-July 08 Member No.: 220,178  |
I have had fake adverts that get through my firewall asking if i would like to apply for a loan, asking me to register at adult sites(known as sex-world or something)ECT, or FAKE windows error messages trying to get me to download fake anti virus programmes ect... i also recently got a weird background saying your infected please download this software. Also i deleted a programme called my sex world registration found in my add/remove programmes. this is a family computer and needs to be used alot, but it has got so slow, it is almost un-usable, especially with the popups.(By the way im usuing XP sp2, if thats helpull?) PLEASE can any one give me any more help on what to do now!! many thanks for taking the time to read the post! I ran combo fx , and here is my log: ComboFix 08-07-02.5 - Liam 2008-07-03 12:52:19.1 - FAT32x86 Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.208 [GMT 1:00] Running from: C:\Documents and Settings\Liam\Desktop\ComboFix.exe Command switches used :: C:\Documents and Settings\Liam\Desktop\WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe * Created a new restore point . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\All Users\Start Menu\Programs\InternetGameBox C:\Documents and Settings\All Users\Start Menu\Programs\InternetGameBox\InternetGameBox.lnk C:\Documents and Settings\All Users\Start Menu\Programs\InternetGameBox\Privacy Policy.url C:\Documents and Settings\All Users\Start Menu\Programs\InternetGameBox\Terms and Conditions.url C:\Documents and Settings\All Users\Start Menu\Programs\InternetGameBox\Uninstall.lnk C:\Documents and Settings\All Users\Start Menu\Programs\InternetGameBox\Website.url C:\Documents and Settings\Liam\Local Settings\Application Data\gaakamy.dat C:\Documents and Settings\Liam\Local Settings\Application Data\gaakamy.exe C:\Documents and Settings\Liam\Local Settings\Application Data\gaakamy_nav.dat C:\Documents and Settings\Liam\Local Settings\Application Data\gaakamy_navps.dat C:\WINDOWS\system32\_000003_.tmp.dll C:\WINDOWS\system32\_000006_.tmp.dll C:\WINDOWS\system32\_000008_.tmp.dll C:\WINDOWS\system32\_000013_.tmp.dll C:\WINDOWS\system32\_000111_.tmp.dll C:\WINDOWS\system32\my sex world.ico C:\WINDOWS\system32\u2g.f C:\WINDOWS\system32\winiconmon.ico C:\WINDOWS\system32\winiconmon.ico.bak0 C:\WINDOWS\Web\def.htm . ((((((((((((((((((((((((( Files Created from 2008-06-03 to 2008-07-03 ))))))))))))))))))))))))))))))) . 2008-07-03 00:11 . 2008-07-03 00:11 <DIR> d-------- C:\Documents and Settings\Liam\Application Data\Malwarebytes 2008-07-03 00:10 . 2008-07-03 00:10 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware 2008-07-03 00:10 . 2008-07-03 00:11 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes 2008-07-03 00:10 . 2008-06-28 14:16 34,296 --a------ C:\WINDOWS\system32\drivers\mbamcatchme.sys 2008-07-03 00:10 . 2008-06-28 14:16 17,144 --a------ C:\WINDOWS\system32\drivers\mbam.sys 2008-07-02 20:55 . 2008-07-02 20:55 <DIR> d-------- C:\Documents and Settings\Liam\white noise 2008-06-25 21:12 . 2008-06-25 21:12 268 --ah----- C:\sqmdata03.sqm 2008-06-25 21:12 . 2008-06-25 21:12 244 --ah----- C:\sqmnoopt03.sqm 2008-06-16 21:11 . 2008-06-16 21:11 <DIR> d--hs---- C:\FOUND.079 2008-06-15 21:41 . 2006-02-20 17:59 94,064 -ra------ C:\WINDOWS\system32\drivers\w810mdm.sys 2008-06-15 21:41 . 2006-02-20 17:59 85,408 -ra------ C:\WINDOWS\system32\drivers\w810mgmt.sys 2008-06-15 21:41 . 2006-02-20 17:59 83,344 -ra------ C:\WINDOWS\system32\drivers\w810obex.sys 2008-06-15 21:41 . 2006-02-20 17:59 8,336 -ra------ C:\WINDOWS\system32\drivers\w810mdfl.sys 2008-06-15 21:41 . 2006-02-20 17:59 6,176 -ra------ C:\WINDOWS\system32\drivers\w810cmnt.sys 2008-06-15 21:41 . 2006-02-20 17:59 6,176 -ra------ C:\WINDOWS\system32\drivers\w810cm.sys 2008-06-15 21:40 . 2006-02-20 17:59 58,288 -ra------ C:\WINDOWS\system32\drivers\w810bus.sys 2008-06-15 21:40 . 2006-02-20 17:59 5,808 -ra------ C:\WINDOWS\system32\drivers\w810whnt.sys 2008-06-15 21:40 . 2006-02-20 17:59 5,808 -ra------ C:\WINDOWS\system32\drivers\w810wh.sys 2008-06-12 18:34 . 2008-06-12 18:34 <DIR> d--hs---- C:\FOUND.078 2008-06-10 20:40 . 2008-06-13 14:10 272,128 --------- C:\WINDOWS\system32\dllcache\bthport.sys . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-06-13 13:10 272,128 ------w C:\WINDOWS\system32\drivers\bthport.sys 2008-05-31 14:20 805 ----a-w C:\WINDOWS\system32\drivers\SYMEVENT.INF 2008-05-31 14:20 60,800 ----a-w C:\WINDOWS\system32\S32EVNT1.DLL 2008-05-31 14:20 123,952 ----a-w C:\WINDOWS\system32\drivers\SYMEVENT.SYS 2008-05-31 14:20 10,671 ----a-w C:\WINDOWS\system32\drivers\SYMEVENT.CAT 2008-05-11 22:58 --------- d-----w C:\Documents and Settings\All Users\Application Data\Logishrd 2008-05-08 12:28 202,752 ----a-w C:\WINDOWS\system32\drivers\RMCast.sys 2008-05-08 12:28 202,752 ----a-w C:\WINDOWS\system32\dllcache\rmcast.sys 2008-05-07 05:18 1,287,680 ----a-w C:\WINDOWS\system32\quartz.dll 2008-05-07 05:18 1,287,680 ------w C:\WINDOWS\system32\dllcache\quartz.dll 2008-04-23 21:16 3,591,680 ----a-w C:\WINDOWS\system32\dllcache\mshtml.dll 2008-04-22 07:40 625,664 ------w C:\WINDOWS\system32\dllcache\iexplore.exe 2008-04-22 07:39 70,656 ------w C:\WINDOWS\system32\dllcache\ie4uinit.exe 2008-04-22 07:39 13,824 ------w C:\WINDOWS\system32\dllcache\ieudinit.exe 2008-04-20 05:07 161,792 ----a-w C:\WINDOWS\system32\dllcache\ieakui.dll 2008-02-26 14:15 5,914,648 ----a-w C:\Program Files\SUPERAntiSpyware.exe . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:56 15360] "\\Darren\EPSON Stylus Photo R340 Series"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAJE.EXE" [2006-12-26 05:00 177664] "msnmsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 11:34 5724184] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-10 20:17 68856] "SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2008-07-02 14:26 1506544] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-10-22 12:22 7700480] "ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2007-07-18 01:54 116072] "D-Link AirPlus G"="C:\Program Files\D-Link\AirPlus G\AirGCFG.exe" [2005-04-22 17:51 1236992] "Sony Ericsson PC Suite"="C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [2005-10-26 16:17 159744] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-01-17 22:03 282624] "Symantec PIF AlertEng"="C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2008-01-29 17:38 583048] "LogitechCommunicationsManager"="C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe" [2007-10-25 16:33 563984] "LogitechQuickCamRibbon"="C:\Program Files\Logitech\QuickCam\Quickcam.exe" [2007-10-25 16:37 2178832] "nwiz"="nwiz.exe" [2006-10-22 12:22 1622016 C:\WINDOWS\system32\nwiz.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-04 00:56 15360] [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks] "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "C:\Program Files\SUPERAntiSpyware\SASSEH.DLL" [2008-07-02 14:26 77824] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon] 2007-04-19 12:41 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "msacm.clmp3enc"= C:\PROGRA~1\CYBERL~1\Power2Go\CLMP3Enc.ACM [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "C:\\Program Files\\LimeWire\\LimeWire.exe"= "C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"= "C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"= "C:\\Program Files\\Skype\\Phone\\Skype.exe"= "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"= "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "67:UDP"= 67:UDP:DHCP Discovery Service R3 Tunx00;FunTV Video Capture;C:\WINDOWS\system32\DRIVERS\Tunx00.sys [2004-08-13 06:57] R3 TxTuner;FunTV TV Tuner;C:\WINDOWS\system32\DRIVERS\TxTuner.sys [2004-08-13 07:33] S3 SetupNTGLM7X;SetupNTGLM7X;D:\NTGLM7X.sys [] S3 Vsp;Vsp;C:\WINDOWS\System32\drivers\Vsp.sys [2003-05-27 16:45] S3 w200bus;Sony Ericsson W200 driver (WDM);C:\WINDOWS\system32\DRIVERS\w200bus.sys [2006-11-07 09:42] S3 w200mdfl;Sony Ericsson W200 USB WMC Modem Filter;C:\WINDOWS\system32\DRIVERS\w200mdfl.sys [2006-11-07 09:42] S3 w200mdm;Sony Ericsson W200 USB WMC Modem Driver;C:\WINDOWS\system32\DRIVERS\w200mdm.sys [2006-11-07 09:42] S3 w200mgmt;Sony Ericsson W200 USB WMC Device Management Drivers (WDM);C:\WINDOWS\system32\DRIVERS\w200mgmt.sys [2006-11-07 09:42] S3 w200obex;Sony Ericsson W200 USB WMC OBEX Interface;C:\WINDOWS\system32\DRIVERS\w200obex.sys [2006-11-07 09:42] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c5ef5b10-b5ce-11db-a483-00134697caa0}] \Shell\AutoRun\command - F:\setupSNK.exe *Newly Created Service* - CATCHME *Newly Created Service* - COMHOST . Contents of the 'Scheduled Tasks' folder "2007-01-15 10:17:38 C:\WINDOWS\Tasks\Microsoft_Hardware_Launch_IType_exe.job" - c:\Program Files\Microsoft IntelliType Pro\itype.exe "2008-05-30 19:00:02 C:\WINDOWS\Tasks\Norton Internet Security - Run Full System Scan - Liam.job" - C:\PROGRA~1\NORTON~1\NORTON~1\Navw32.exeh/TASK: "2008-07-03 11:22:02 C:\WINDOWS\Tasks\Check Updates for Windows Live Toolbar.job" - C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE . - - - - ORPHANS REMOVED - - - - HKCU-Run-emboltrc - C:\WINDOWS\system32\nshodank.exe SSODL-KbdAlrt-{96120215-57e7-482a-b5da-25f34e6f17d3} - C:\WINDOWS\Resources\KbdAlrt.dll Notify-hgGwWnmK - hgGwWnmK.dll ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-07-03 12:56:51 Windows 5.1.2600 Service Pack 2 FAT NTAPI scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "\\\\Darren\\EPSON Stylus Photo R340 Series"="C:\\WINDOWS\\System32\\spool\\DRIVERS\\W32X86\\3\\E_FATIAJE.EXE /FU \"C:\\WINDOWS\\TEMP\\E_SDA.tmp\" /EF \"HKCU\"" . Completion time: 2008-07-03 12:58:24 ComboFix-quarantined-files.txt 2008-07-03 11:58:16 Pre-Run: 134,210,813,952 bytes free Post-Run: 134,318,325,760 bytes free WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems] multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /fastdetect /NoExecute=OptIn C:\CMDCONS\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons 169 --- E O F --- 2008-06-20 20:24:07 |
 |
 
|
|
Jul 3 2008, 07:57 AM
Post
#2
|
|
|
New Member Group: Members Posts: 2 Joined: 3-July 08 Member No.: 220,178 |
by the way! after running this, all the popups seemed to have disappeared, for now, but my Ad-aware keeps finding infections(55 usually), am i still infected or what? :S
|
|
|
|
|
Jul 3 2008, 09:34 AM
Post
#3
|
|
|
arachibutyrophobia Group: BC Advisor Posts: 4,377 Joined: 4-March 05 From: Northern CA. Member No.: 13,532 |
ComboFix logs should not to be posted outside the HijackThis forums. It is an extremely powerful tool which should only be used when instructed to do so by someone who has been properly trained. ComboFix is intended by its creator to be "used under the guidance and supervision of an expert", NOT for private use. Please read Combofix's Disclaimer. Using this tool incorrectly could lead to disastrous problems with your operating system such as preventing it from ever starting again.
Please create a new topic explaining the nature of your problem. Describe pop-ups and system tray or desktop icons that have appeared. Explain what is "going wrong" with your computer. Note any tools you have used and their respective results. If needed, we will direct you to our HJT Preparation Guide. Thank you for using BleepingComputer as your malware removal source. I will notify a moderator and have this topic closed. dc3 -------------------- Supposing is good, but finding out is better. -Mark Twain
|
|
|
|
|
1 User(s) are reading this topic (1 Guests and 0 Anonymous Users)
0 Members:
| Lo-Fi Version | Time is now: 8th October 2008 - 04:16 AM |
© 2003-2008 All Rights Reserved Bleeping Computer LLC.