 Infected - Fraudtool.win32.spywareisolator.al & Possible Trojan Sheur.bomg, Don't know how to remove |
Welcome Guest ( Log In | Click here to Register a free account now! )
Register a free account to unlock additional features at BleepingComputer.com
Welcome to Bleeping Computer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.
Forum Guidelines
Read this topic before posting a log. DO NOT post a ComboFix log unless requested to. Only members of the HijackThis Team or Moderators are allowed to help people with logs. Anyone else should refrain from posting to another user's log. When posting a log please put the type of infection you have in the topic title. IE: Winfixer, Virtumonde, WinTools, WebSearch, Home Search Assistant, etc. Do not bump your topic. We try to resolve logs on a first come/first served basis. By bumping your log you will be pushed back in line due to the new date of your bump.
  |
  Jul 5 2008, 04:58 PM
Post
#1
|
|
|
New Member  Group: Members Posts: 14 Joined: 5-July 08 Member No.: 220,627  |
QUOTE O23 - Service: Task Scheduler (Schedule) - Unknown owner - C:\WINDOWS\system32\drivers\spools.exe (file missing) And everytime I reboot SpyBot S&D resident finds changes to my system Reg that I haven't caused (at least I don't know I've caused) And I feel like I am still infected... I've ran both Kaspersky and Deckard's System Scanner as per the Prep Guide (before posting), and you can see the attached log files. Kaspersky found: AdTool.Win32.MyWebSearch.bm & Fraudtool.win32.spywareisolator.al Thanks in advance for any/all help, -BassKozz This post has been edited by BassKozz: Jul 5 2008, 05:21 PM
Attached File(s)
kaspersky.txt ( 2.35k )
Number of downloads: 2
main.txt ( 15.55k )
Number of downloads: 3
extra.txt ( 8.19k )
Number of downloads: 1
moved.txt ( 49.84k )
Number of downloads: 2 |
 |
 
|
|
Jul 6 2008, 06:43 PM
Post
#2
|
|
|
Malware Expert Group: HJT Team Posts: 9,576 Joined: 23-December 04 Member No.: 7,762 |
Hi and welcome to Bleeping Computer! My name is Sam and I will be helping you.  Please download ComboFix and save it to your desktop. Prior to running Combofix.exe you should disable your antivirus program and disconnect from the internet. Double click combofix.exe and follow the prompts. When it's done running it will produce a log for you. Please post that log in your next reply. Important Note - Do not mouseclick combofix's window whilst it's running. That may cause it to stall. --------------------  If I have helped you in any way, please consider a donation to help me continue the fight against malware.[ Start Here ] [ Adaware 2008 ] [ Spybot ] [ AVG Antivirus ] [ Superantispyware ] [ MalwareBytes ] [ Spyware Blaster ] [ Windows Update ] [ How to install Windows XP Recovery Console ] |
|
|
|
|
Jul 7 2008, 08:57 AM
Post
#3
|
|
|
New Member Group: Members Posts: 14 Joined: 5-July 08 Member No.: 220,627 |
Hi Sam,
Thank you for your help with this .I did as you said and closed down everything and disabled my Ethernet adapter and ran ComboFix.exe (see attached log). One thing I should note however is that I wasn't counting on ComboFix to reboot my computer; the reason I mention this is because AVG and SpyBot S&D Resident both ran upon reboot while ComboFix was still running... I hope that wasn't an issue, if so let me know and I'll re-run after I disable AVG and SpyBot S&D Resident from loading on startup. Thanks again for your help Sam, -BassKozz ComboFix 08-07-05.1 - user 2008-07-07 9:36:44.1 - NTFSx86 Running from: C:\Documents and Settings\user\Desktop\ComboFix.exe * Created a new restore point WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !! . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\user\Application Data\install.dat C:\Documents and Settings\user\Application Data\SpamBlockerUtility_Icons C:\Documents and Settings\user\Application Data\SpamBlockerUtility_Icons\Software_Online_8.ico C:\Documents and Settings\user\Favorites\.url C:\Program Files\SpywareIsolator C:\Program Files\SpywareIsolator\success.wav C:\Program Files\WinAntivirusPro3.8 C:\WINDOWS\cookies.ini C:\WINDOWS\system32\abLknUtv.ini C:\WINDOWS\system32\abLknUtv.ini2 C:\WINDOWS\system32\clbinit.dll C:\WINDOWS\system32\cxxnqtrv.ini C:\WINDOWS\system32\edusvcww.ini C:\WINDOWS\system32\k86.bin C:\WINDOWS\system32\mcrh.tmp C:\WINDOWS\system32\rdqvwrcu.ini C:\WINDOWS\system32\spywarewarning2.mht C:\WINDOWS\system32\uncnffgk.ini C:\WINDOWS\system32\vvgmvsti.ini C:\WINDOWS\system32\wskifppp.ini C:\WINDOWS\system32\yrehejvl.ini C:\xcrashdump.dat . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_CLBDRIVER -------\Service_clbdriver ((((((((((((((((((((((((( Files Created from 2008-06-07 to 2008-07-07 ))))))))))))))))))))))))))))))) . 2008-07-07 01:16 . 2007-07-30 19:19 271,224 --a------ C:\WINDOWS\system32\mucltui.dll 2008-07-07 01:16 . 2007-07-30 19:19 30,072 --a------ C:\WINDOWS\system32\mucltui.dll.mui 2008-07-07 01:11 . 2004-08-04 08:00 221,184 --a------ C:\WINDOWS\system32\wmpns.dll 2008-07-05 19:15 . 2008-07-05 19:20 <DIR> d-------- C:\WINDOWS\ServicePackFiles 2008-07-05 19:11 . 2008-04-13 22:04 25,471 --------- C:\WINDOWS\system32\drivers\watv10nt.sys 2008-07-05 19:11 . 2008-04-13 22:04 22,271 --------- C:\WINDOWS\system32\drivers\watv06nt.sys 2008-07-05 19:09 . 2006-12-29 00:31 19,569 --a------ C:\WINDOWS\003063_.tmp 2008-07-05 17:45 . 2008-07-05 17:45 <DIR> d-------- C:\Deckard 2008-07-05 14:55 . 2008-07-05 14:55 <DIR> d-------- C:\WINDOWS\Sun 2008-07-05 14:54 . 2008-03-25 02:37 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl 2008-07-05 14:52 . 2008-07-05 14:54 <DIR> d-------- C:\Program Files\Java 2008-07-05 14:52 . 2008-07-05 14:52 <DIR> d-------- C:\Program Files\Common Files\Java 2008-07-05 14:25 . 2008-06-13 07:05 272,128 --------- C:\WINDOWS\system32\drivers\bthport.sys 2008-07-05 14:25 . 2008-06-13 07:05 272,128 -----c--- C:\WINDOWS\system32\dllcache\bthport.sys 2008-07-05 14:24 . 2008-05-08 10:02 203,136 -----c--- C:\WINDOWS\system32\dllcache\rmcast.sys 2008-07-05 14:20 . 2008-07-05 14:20 <DIR> d-------- C:\Program Files\Trend Micro 2008-07-04 15:14 . 2008-07-04 21:12 1,082 --a------ C:\WINDOWS\wininit.ini 2008-07-04 13:19 . 2008-07-04 13:20 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy 2008-07-04 13:19 . 2008-07-04 15:27 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2008-07-04 00:20 . 2008-07-04 00:20 <DIR> d--h----- C:\WINDOWS\system32\GroupPolicy 2008-07-03 22:35 . 2008-07-05 14:43 <DIR> d--h----- C:\$AVG8.VAULT$ 2008-07-03 22:33 . 2008-07-03 22:42 10,520 --a------ C:\WINDOWS\system32\avgrsstx.dll 2008-07-03 22:32 . 2008-07-07 01:14 <DIR> d-------- C:\WINDOWS\system32\drivers\Avg 2008-07-03 22:32 . 2008-07-03 22:32 <DIR> d-------- C:\Program Files\AVG 2008-07-03 22:32 . 2008-07-05 18:26 <DIR> d-------- C:\Documents and Settings\user\Application Data\AVGTOOLBAR 2008-07-03 22:32 . 2008-07-03 22:32 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\avg8 2008-07-03 22:32 . 2008-07-03 22:42 96,520 --a------ C:\WINDOWS\system32\drivers\avgldx86.sys 2008-07-03 22:32 . 2008-07-03 22:42 76,040 --a------ C:\WINDOWS\system32\drivers\avgtdix.sys 2008-07-03 22:29 . 2008-07-03 22:29 0 --a------ C:\WINDOWS\nsreg.dat 2008-07-03 22:22 . 2008-07-03 22:22 0 --a------ C:\WINDOWS\system32\wlite.sys 2008-07-01 12:40 . 2008-07-04 10:35 <DIR> d-------- C:\Documents and Settings\Administrator 2008-07-01 12:33 . 2004-08-04 08:00 82,944 --a------ C:\WINDOWS\system32\sockets.dll 2008-07-01 12:33 . 2008-07-05 14:30 41,984 --ahs---- C:\WINDOWS\system32\Crypt_16.dll 2008-06-12 07:40 . 2008-06-19 07:40 294 --ahs---- C:\WINDOWS\system32\myipenqv.ini 2008-06-10 19:00 . 2008-06-10 19:00 1,409 --a------ C:\WINDOWS\system32\tmpB917B.FOT 2008-06-10 19:00 . 2008-06-10 19:00 1,409 --a------ C:\WINDOWS\system32\tmp8127B.FOT 2008-06-10 19:00 . 2008-06-10 19:00 1,409 --a------ C:\WINDOWS\system32\tmp7427B.FOT 2008-06-10 19:00 . 2008-06-10 19:00 1,409 --a------ C:\WINDOWS\system32\tmp6827B.FOT 2008-06-10 19:00 . 2008-06-10 19:00 1,409 --a------ C:\WINDOWS\system32\tmp4D27B.FOT 2008-06-10 18:57 . 2008-06-10 18:57 0 --a------ C:\C.tmp 2008-06-10 18:57 . 2008-06-10 18:57 0 --a------ C:\B.tmp 2008-06-10 18:57 . 2008-06-10 18:57 0 --a------ C:\A.tmp 2008-06-10 18:57 . 2008-06-10 18:57 0 --a------ C:\9.tmp . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-07-04 05:01 --------- d-----w C:\Program Files\Registry Defender Platinum 2008-05-31 23:25 --------- d-----w C:\Documents and Settings\user\Application Data\Walgreens 2008-05-31 22:13 --------- d-----w C:\Documents and Settings\All Users\Application Data\Kodak 2008-05-31 22:09 --------- d-----w C:\Program Files\Kodak 2008-05-20 00:41 --------- d-----w C:\Documents and Settings\user\Application Data\Nero 2008-05-08 14:02 203,136 ----a-w C:\WINDOWS\system32\drivers\rmcast.sys 2008-05-07 05:12 1,288,192 ----a-w C:\WINDOWS\system32\quartz.dll 2008-04-23 04:16 826,368 ----a-w C:\WINDOWS\system32\wininet.dll 2008-04-14 09:55 1,804 ----a-w C:\WINDOWS\system32\dcache.bin 2008-04-14 09:46 329,728 ----a-w C:\WINDOWS\system32\netsetup.exe 2008-04-14 09:43 92,424 ----a-w C:\WINDOWS\system32\rdpdd.dll 2008-04-14 09:43 87,176 ----a-w C:\WINDOWS\system32\rdpwsx.dll 2008-04-14 09:43 299,520 ----a-w C:\WINDOWS\system32\drmclien.dll 2008-04-14 09:43 12,168 ----a-w C:\WINDOWS\system32\tsddd.dll 2008-04-14 09:41 98,304 ----a-w C:\WINDOWS\system32\actxprxy.dll 2008-04-14 09:40 53,279 ----a-w C:\WINDOWS\system32\odbcji32.dll 2008-04-14 09:40 4,126 ----a-w C:\WINDOWS\system32\msdxmlc.dll 2008-04-14 09:40 3,584 ----a-w C:\WINDOWS\system32\msafd.dll 2008-04-14 09:40 102,912 ----a-w C:\WINDOWS\system32\dpcdll.dll 2008-04-14 05:00 1,845,632 ----a-w C:\WINDOWS\system32\win32k.sys 2008-04-14 04:57 2,188,928 ----a-w C:\WINDOWS\system32\ntoskrnl.exe 2008-04-14 04:15 17,664 ----a-w C:\WINDOWS\system32\watchdog.sys 2008-04-14 04:13 9,728 ------w C:\WINDOWS\system32\comsdupd.exe 2008-04-14 04:13 12,800 ----a-w C:\WINDOWS\system32\spiisupd.exe 2008-04-14 04:01 7,424 ----a-w C:\WINDOWS\system32\kd1394.dll 2008-04-14 04:01 2,065,792 ----a-w C:\WINDOWS\system32\ntkrnlpa.exe 2008-04-14 04:00 61,440 ----a-w C:\WINDOWS\system32\msvcrt40.dll 2008-04-14 03:45 76,800 ------w C:\WINDOWS\system32\msshavmsg.dll 2008-04-14 03:09 438,784 ----a-w C:\WINDOWS\system32\xpob2res.dll 2008-04-14 03:09 2,897,920 ----a-w C:\WINDOWS\system32\xpsp2res.dll 2008-04-14 03:09 187,392 ----a-w C:\WINDOWS\system32\xpsp1res.dll 2008-04-14 03:07 208,384 ----a-w C:\WINDOWS\system32\rsaenh.dll 2008-04-14 03:07 138,752 ----a-w C:\WINDOWS\system32\dssenh.dll 2008-04-14 02:57 79,872 ------w C:\WINDOWS\system32\msxml6r.dll 2008-04-14 02:56 94,208 ----a-w C:\WINDOWS\system32\odbcint.dll 2008-04-14 02:56 12,288 ----a-w C:\WINDOWS\system32\odbcp32r.dll 2008-04-14 02:56 12,288 ----a-w C:\WINDOWS\system32\mscpx32r.dll 2008-04-14 02:54 20,480 ----a-w C:\WINDOWS\system32\msorc32r.dll 2008-04-14 02:51 733,696 ----a-w C:\WINDOWS\system32\qedwipes.dll 2008-04-14 02:39 4,096 ----a-w C:\WINDOWS\system32\dsprpres.dll 2008-04-14 02:33 63,488 ----a-w C:\WINDOWS\system32\browselc.dll 2008-04-14 02:33 549,376 ----a-w C:\WINDOWS\system32\shdoclc.dll 2008-04-14 02:18 1,647,616 ----a-w C:\WINDOWS\system32\winbrand.dll 2008-04-14 02:15 216,064 ----a-w C:\WINDOWS\system32\moricons.dll 2008-04-14 01:53 48,128 ----a-w C:\WINDOWS\system32\msprivs.dll 2008-04-14 01:52 48,128 ----a-w C:\WINDOWS\system32\inetres.dll 2008-04-14 01:09 884,736 ----a-w C:\WINDOWS\system32\msimsg.dll 2004-08-04 12:00 4,096 --sha-w C:\WINDOWS\system32\1112.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Walgreens PhotoShow Media Manager"="C:\PROGRA~1\WALGRE~1\WALGRE~1\data\xtras\mssysmgr.exe" [2006-04-20 02:35 237568] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-14 05:42 15360] "Nero PhotoShow Media Manager"="C:\PROGRA~1\Nero\PHOTOS~1\data\xtras\mssysmgr.exe" [2008-02-12 11:02 353544] "SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-01-28 11:43 2097488] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "AVG8_TRAY"="C:\PROGRA~1\AVG\AVG8\avgtray.exe" [2008-07-03 22:42 1232152] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe" [2008-03-25 04:28 144784] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=avgrsstx.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "aux"= ctwdm32.dll [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\clbdriver.sys] @="" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\wlite.sys] @="Driver" [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "C:\\Program Files\\AVG\\AVG8\\avgupd.exe"= "C:\\Program Files\\AVG\\AVG8\\avgemc.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009 R1 AvgLdx86;AVG AVI Loader Driver x86;C:\WINDOWS\system32\Drivers\avgldx86.sys [2008-07-03 22:42] R2 avg8emc;AVG8 E-mail Scanner;C:\PROGRA~1\AVG\AVG8\avgemc.exe [2008-07-03 22:42] R2 avg8wd;AVG8 WatchDog;C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe [2008-07-03 22:42] R2 AvgTdiX;AVG8 Network Redirector;C:\WINDOWS\system32\Drivers\avgtdix.sys [2008-07-03 22:42] R3 ati2mtaa;ati2mtaa;C:\WINDOWS\system32\DRIVERS\ati2mtaa.sys [2004-08-03 18:29] S1 wlite;WMV9 Codec;C:\WINDOWS\system32\wlite.sys [2008-07-03 22:22] . - - - - ORPHANS REMOVED - - - - WebBrowser-{74CC49F7-EB32-4A08-B204-948962A6E3DB} - (no file) ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-07-07 09:43:47 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . ------------------------ Other Running Processes ------------------------ . C:\Program Files\Network Associates\Common Framework\FrameworkService.exe C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe C:\PROGRA~1\NETWOR~1\COMMON~1\naPrdMgr.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\WINDOWS\system32\devldr32.exe C:\Program Files\AVG\AVG8\avgrsx.exe C:\Program Files\AVG\AVG8\avgrsx.exe . ************************************************************************** . Completion time: 2008-07-07 9:49:31 - machine was rebooted ComboFix-quarantined-files.txt 2008-07-07 13:48:51 Pre-Run: 148,516,159,488 bytes free Post-Run: 148,490,887,168 bytes free 195 --- E O F --- 2008-07-05 18:41:04 This post has been edited by Buckeye_Sam: Jul 7 2008, 10:50 AM
Reason for edit: copied log text into post
Attached File(s)
|
|
|
|
|
Jul 7 2008, 10:54 AM
Post
#4
|
|
|
Malware Expert Group: HJT Team Posts: 9,576 Joined: 23-December 04 Member No.: 7,762 |
No problems on the reboot. The log looks fine.
Download SDFix and save it to your Desktop. Double click SDFix.exe and it will extract the files to %systemdrive% (Drive that contains the Windows Directory, typically C:\SDFix) Please then reboot your computer in Safe Mode by doing the following :
-------------------- If I have helped you in any way, please consider a donation to help me continue the fight against malware.[ Start Here ] [ Adaware 2008 ] [ Spybot ] [ AVG Antivirus ] [ Superantispyware ] [ MalwareBytes ] [ Spyware Blaster ] [ Windows Update ] [ How to install Windows XP Recovery Console ] |
|
|
|
|
Jul 7 2008, 11:39 AM
Post
#5
|
|
|
New Member Group: Members Posts: 14 Joined: 5-July 08 Member No.: 220,627 |
Here is the SDFix Log, I will post the DSS log next...
SDFix: Version 1.202 Run by user on Mon 07/07/2008 at 12:22 PM Microsoft Windows XP [Version 5.1.2600] Running From: C:\SDFix Checking Services : Restoring Default Security Values Restoring Default Hosts File Rebooting Checking Files : Trojan Files Found: C:\1.TMP - Deleted C:\2.TMP - Deleted C:\3.TMP - Deleted C:\4.TMP - Deleted C:\5.TMP - Deleted C:\6.TMP - Deleted C:\7.TMP - Deleted C:\8.TMP - Deleted C:\8A.TMP - Deleted C:\8B.TMP - Deleted C:\8C.TMP - Deleted C:\8D.TMP - Deleted C:\9.TMP - Deleted C:\A.TMP - Deleted C:\B.TMP - Deleted C:\C.TMP - Deleted C:\A.tmp - Deleted Removing Temp Files ADS Check : Final Check : catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-07-07 12:31:36 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... scanning hidden services & system hive ... scanning hidden registry entries ... scanning hidden files ... scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 Remaining Services : Authorized Application Key Export: [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" "C:\\Program Files\\AVG\\AVG8\\avgupd.exe"="C:\\Program Files\\AVG\\AVG8\\avgupd.exe:*:Enabled:avgupd.exe" "C:\\Program Files\\AVG\\AVG8\\avgemc.exe"="C:\\Program Files\\AVG\\AVG8\\avgemc.exe:*:Enabled:avgemc.exe" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" Remaining Files : File Backups: - C:\SDFix\backups\backups.zip Files with Hidden Attributes : Sun 9 Sep 2007 4 A..H. --- "C:\WINDOWS\uccspecb.sys" Mon 28 Jan 2008 1,404,240 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\SDUpdate.exe" Mon 28 Jan 2008 5,146,448 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe" Mon 28 Jan 2008 2,097,488 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" Sat 5 Jul 2008 41,984 A.SH. --- "C:\WINDOWS\system32\Crypt_16.dll" Sun 16 Mar 2008 0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp" Tue 25 Sep 2007 87,919 ...H. --- "C:\Program Files\Nero\PhotoShow 5\data\Nero PhotoShow Deluxe.exe" Wed 19 Apr 2006 95,892 ...H. --- "C:\Program Files\Walgreens\Walgreens PhotoShow 4\data\Walgreens PhotoShow Express.exe" Mon 7 Jul 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\d9f6fad75dbdac35a8ef8c60acfcb1a4\BIT1.tmp" Finished! |
|
|
|
|
Jul 7 2008, 11:44 AM
Post
#6
|
|
|
New Member Group: Members Posts: 14 Joined: 5-July 08 Member No.: 220,627 |
p.s. After SDFix was run I got the following popup from SpyBot S&D Resident:
 <---Click to see larger versionI clicked Deny change... Will post DSS logs in the next reply. This post has been edited by BassKozz: Jul 7 2008, 11:46 AM |
|
|
|
|
Jul 7 2008, 11:57 AM
Post
#7
|
|
|
New Member Group: Members Posts: 14 Joined: 5-July 08 Member No.: 220,627 |
Here is the DSS Log...
Deckard's System Scanner v20071014.68 Run by user on 2008-07-07 12:49:08 Computer is in Normal Mode. -------------------------------------------------------------------------------- Total Physical Memory: 256 MiB (512 MiB recommended). -- HijackThis (run as user.exe) ------------------------------------------------ Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 12:50:06 PM, on 7/7/2008 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16674) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe C:\Program Files\Network Associates\Common Framework\FrameworkService.exe C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\WINDOWS\system32\svchost.exe C:\PROGRA~1\AVG\AVG8\avgrsx.exe C:\PROGRA~1\AVG\AVG8\avgemc.exe C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe C:\PROGRA~1\WALGRE~1\WALGRE~1\data\xtras\mssysmgr.exe C:\WINDOWS\system32\ctfmon.exe C:\PROGRA~1\Nero\PHOTOS~1\data\xtras\mssysmgr.exe C:\WINDOWS\system32\devldr32.exe C:\Documents and Settings\user\Desktop\CHR - Log Files Etc\dss.exe C:\PROGRA~1\TRENDM~1\HIJACK~1\user.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\logonui.exe C:\WINDOWS\system32\rdpclip.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe" O4 - HKCU\..\Run: [Walgreens PhotoShow Media Manager] C:\PROGRA~1\WALGRE~1\WALGRE~1\data\xtras\mssysmgr.exe O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Nero PhotoShow Media Manager] C:\PROGRA~1\Nero\PHOTOS~1\data\xtras\mssysmgr.exe O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu...b?1215296986531 O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll O20 - AppInit_DLLs: avgrsstx.dll O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: McAfee Framework Service (McAfeeFramework) - Network Associates, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe -- End of file - 5021 bytes -- Files created between 2008-06-07 and 2008-07-07 ----------------------------- 2008-07-07 12:18:06 0 d-------- C:\WINDOWS\ERUNT 2008-07-07 09:42:40 0 d-------- C:\WINDOWS\Prefetch 2008-07-07 09:35:02 68096 --a------ C:\WINDOWS\zip.exe 2008-07-07 09:35:02 49152 --a------ C:\WINDOWS\VFind.exe 2008-07-07 09:35:02 212480 --a------ C:\WINDOWS\swxcacls.exe <Not Verified; SteelWerX; SteelWerX Extended Configurator ACLists> 2008-07-07 09:35:02 136704 --a------ C:\WINDOWS\swsc.exe <Not Verified; SteelWerX; SteelWerX Service Controller> 2008-07-07 09:35:02 161792 --a------ C:\WINDOWS\swreg.exe <Not Verified; SteelWerX; SteelWerX Registry Editor> 2008-07-07 09:35:02 98816 --a------ C:\WINDOWS\sed.exe 2008-07-07 09:35:02 80412 --a------ C:\WINDOWS\grep.exe 2008-07-07 09:35:02 89504 --a------ C:\WINDOWS\fdsv.exe <Not Verified; Smallfrogs Studio; > 2008-07-05 19:20:02 0 d-------- C:\WINDOWS\system32\scripting 2008-07-05 19:20:02 0 d-------- C:\WINDOWS\l2schemas 2008-07-05 19:20:00 0 d-------- C:\WINDOWS\system32\en 2008-07-05 19:20:00 0 d-------- C:\WINDOWS\system32\bits 2008-07-05 19:15:18 0 d-------- C:\WINDOWS\ServicePackFiles 2008-07-05 19:09:20 0 d-------- C:\WINDOWS\system32\ReinstallBackups 2008-07-05 14:55:33 0 d-------- C:\WINDOWS\Sun 2008-07-05 14:55:33 0 d-------- C:\Documents and Settings\user\Application Data\Sun 2008-07-05 14:52:47 0 d-------- C:\Program Files\Java 2008-07-05 14:52:36 0 d-------- C:\Program Files\Common Files\Java 2008-07-05 14:20:44 0 d-------- C:\Program Files\Trend Micro 2008-07-04 13:19:50 0 d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2008-07-04 00:20:24 0 d--h----- C:\WINDOWS\system32\GroupPolicy 2008-07-03 22:35:04 0 d--h----- C:\$AVG8.VAULT$ 2008-07-03 22:32:47 0 d-------- C:\WINDOWS\system32\drivers\Avg 2008-07-03 22:32:46 0 d-------- C:\Documents and Settings\user\Application Data\AVGTOOLBAR 2008-07-03 22:32:26 0 d-------- C:\Program Files\AVG 2008-07-03 22:32:25 0 d-------- C:\Documents and Settings\All Users\Application Data\avg8 2008-07-03 22:29:57 0 --a------ C:\WINDOWS\nsreg.dat 2008-07-03 22:29:46 0 d-------- C:\Documents and Settings\user\Application Data\Mozilla 2008-07-03 22:22:44 0 --a------ C:\WINDOWS\system32\wlite.sys 2008-07-01 12:40:56 0 d--h----- C:\Documents and Settings\Administrator\Templates 2008-07-01 12:40:56 0 dr------- C:\Documents and Settings\Administrator\Start Menu 2008-07-01 12:40:56 0 dr-h----- C:\Documents and Settings\Administrator\SendTo 2008-07-01 12:40:56 0 d--h----- C:\Documents and Settings\Administrator\Recent 2008-07-01 12:40:56 0 d--h----- C:\Documents and Settings\Administrator\PrintHood 2008-07-01 12:40:56 1835008 --a------ C:\Documents and Settings\Administrator\NTUSER.DAT 2008-07-01 12:40:56 0 d--h----- C:\Documents and Settings\Administrator\NetHood 2008-07-01 12:40:56 0 d-------- C:\Documents and Settings\Administrator\My Documents 2008-07-01 12:40:56 0 d--h----- C:\Documents and Settings\Administrator\Local Settings 2008-07-01 12:40:56 0 d-------- C:\Documents and Settings\Administrator\Favorites 2008-07-01 12:40:56 0 d-------- C:\Documents and Settings\Administrator\Desktop 2008-07-01 12:40:56 0 d--hs---- C:\Documents and Settings\Administrator\Cookies 2008-07-01 12:40:56 0 dr-h----- C:\Documents and Settings\Administrator\Application Data 2008-07-01 12:40:56 0 d---s---- C:\Documents and Settings\Administrator\Application Data\Microsoft 2008-07-01 12:40:15 0 d--hs---- C:\WINDOWS\CSC 2008-07-01 12:33:59 41984 --ahs---- C:\WINDOWS\system32\Crypt_16.dll -- Find3M Report --------------------------------------------------------------- 2008-07-05 19:20:47 0 d-------- C:\Program Files\Messenger 2008-07-05 19:19:59 0 d-------- C:\Program Files\Movie Maker 2008-07-05 19:14:52 0 d-------- C:\Program Files\Windows NT 2008-07-05 14:52:36 0 d-------- C:\Program Files\Common Files 2008-07-04 01:01:01 0 d-------- C:\Program Files\Registry Defender Platinum 2008-05-31 19:25:40 0 d-------- C:\Documents and Settings\user\Application Data\Walgreens 2008-05-31 18:09:14 0 d-------- C:\Program Files\Kodak 2008-05-31 18:00:12 124 --a------ C:\Documents and Settings\user\Application Data\Walgreens PhotoShow Express.txt 2008-05-28 03:39:51 78750 --a------ C:\logfile 2008-05-19 20:41:19 0 d-------- C:\Documents and Settings\user\Application Data\Nero 2008-05-17 22:11:32 2 --a------ C:\Documents and Settings\user\Application Data\7zip_progress_8D35082E-F84F-427E-932F-5AD1B28D833C.txt 2008-04-30 10:46:25 2 --a------ C:\Documents and Settings\user\Application Data\7zip_progress_63EFFDDB-B35E-455C-A51C-69ADBCA4F8FE.txt 2008-04-30 10:46:11 2 --a------ C:\Documents and Settings\user\Application Data\7zip_progress_D6E7176E-99C4-4582-8C78-1436A00AF35D.txt -- Registry Dump --------------------------------------------------------------- *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A057A204-BACC-4D26-9990-79A187E2698E}] 07/03/2008 10:42 PM 2055960 --a------ C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser] "{A057A204-BACC-4D26-9990-79A187E2698E}"= C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL [07/03/2008 10:42 PM 2055960] [-HKEY_CLASSES_ROOT\CLSID\{A057A204-BACC-4D26-9990-79A187E2698E}] [HKEY_CLASSES_ROOT\avgtoolbar.AVGTOOLBAR] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "AVG8_TRAY"="C:\PROGRA~1\AVG\AVG8\avgtray.exe" [07/03/2008 10:42 PM] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe" [03/25/2008 04:28 AM] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Walgreens PhotoShow Media Manager"="C:\PROGRA~1\WALGRE~1\WALGRE~1\data\xtras\mssysmgr.exe" [04/20/2006 02:35 AM] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [04/14/2008 05:42 AM] "Nero PhotoShow Media Manager"="C:\PROGRA~1\Nero\PHOTOS~1\data\xtras\mssysmgr.exe" [02/12/2008 11:02 AM] "SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [01/28/2008 11:43 AM] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "HideLegacyLogonScripts"=0 (0x0) "HideLogoffScripts"=0 (0x0) "RunLogonScriptSync"=1 (0x1) "RunStartupScriptSync"=0 (0x0) "HideStartupScripts"=0 (0x0) [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system] "HideLegacyLogonScripts"=0 (0x0) "HideLogoffScripts"=0 (0x0) "RunLogonScriptSync"=1 (0x1) "RunStartupScriptSync"=0 (0x0) "HideStartupScripts"=0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\dimsntfy] C:\WINDOWS\System32\dimsntfy.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "appinit_dlls"=avgrsstx.dll [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\clbdriver.sys" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vds] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\wlite.sys] @="Driver" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}] @="Volume shadow copy" [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] eapsvcs eaphost dot3svc dot3svc HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs napagent hkmsvc -- End of Deckard's System Scanner: finished at 2008-07-07 12:55:29 ------------ |
|
|
|
|
Jul 7 2008, 02:45 PM
Post
#8
|
|
|
Malware Expert Group: HJT Team Posts: 9,576 Joined: 23-December 04 Member No.: 7,762 |
Copy and paste ALL the following text in the Quote box below into Notepad.
Click on File(in the menu at the top)>Save as../Save as Type: 'All Files' /File name: CFScript to your desktop. CODE Suspect::[52] C:\WINDOWS\uccspecb.sys C:\WINDOWS\system32\Crypt_16.dll This time Combofix will submit sample files to BleepingComputer to be scanned, so you will need to stay connected. Now drag then drop the CFScript file onto ComboFix.exe as seen in the image below.  This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply. How is your computer behaving now? -------------------- If I have helped you in any way, please consider a donation to help me continue the fight against malware.[ Start Here ] [ Adaware 2008 ] [ Spybot ] [ AVG Antivirus ] [ Superantispyware ] [ MalwareBytes ] [ Spyware Blaster ] [ Windows Update ] [ How to install Windows XP Recovery Console ] |
|
|
|
|
Jul 7 2008, 03:23 PM
Post
#9
|
|
|
New Member Group: Members Posts: 14 Joined: 5-July 08 Member No.: 220,627 |
QUOTE(Buckeye_Sam @ Jul 7 2008, 03:45 PM)  This time Combofix will submit sample files to BleepingComputer to be scanned, so you will need to stay connected. File Submitted QUOTE(Buckeye_Sam @ Jul 7 2008, 03:45 PM) How is your computer behaving now? My computer seems to be behaving fine, but I want to make sure I've gotten rid of everything. QUOTE(Buckeye_Sam @ Jul 7 2008, 03:45 PM) post the contents of Combofix.txt in your next reply. ComboFix 08-07-05.1 - user 2008-07-07 16:06:56.2 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.72 [GMT -4:00] Running from: C:\Documents and Settings\user\Desktop\ComboFix.exe Command switches used :: C:\Documents and Settings\user\Desktop\CFScript.txt * Created a new restore point WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !! . ((((((((((((((((((((((((( Files Created from 2008-06-07 to 2008-07-07 ))))))))))))))))))))))))))))))) . 2008-07-07 12:18 . 2008-07-07 12:18 <DIR> d-------- C:\WINDOWS\ERUNT 2008-07-07 12:10 . 2008-07-07 12:35 <DIR> d-------- C:\SDFix 2008-07-07 01:16 . 2007-07-30 19:19 271,224 --a------ C:\WINDOWS\system32\mucltui.dll 2008-07-07 01:16 . 2007-07-30 19:19 30,072 --a------ C:\WINDOWS\system32\mucltui.dll.mui 2008-07-07 01:11 . 2004-08-04 08:00 221,184 --a------ C:\WINDOWS\system32\wmpns.dll 2008-07-05 19:15 . 2008-07-05 19:20 <DIR> d-------- C:\WINDOWS\ServicePackFiles 2008-07-05 19:11 . 2008-04-13 22:04 25,471 --------- C:\WINDOWS\system32\drivers\watv10nt.sys 2008-07-05 19:11 . 2008-04-13 22:04 22,271 --------- C:\WINDOWS\system32\drivers\watv06nt.sys 2008-07-05 19:09 . 2006-12-29 00:31 19,569 --a------ C:\WINDOWS\003063_.tmp 2008-07-05 17:45 . 2008-07-05 17:45 <DIR> d-------- C:\Deckard 2008-07-05 14:55 . 2008-07-05 14:55 <DIR> d-------- C:\WINDOWS\Sun 2008-07-05 14:54 . 2008-03-25 02:37 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl 2008-07-05 14:52 . 2008-07-05 14:54 <DIR> d-------- C:\Program Files\Java 2008-07-05 14:52 . 2008-07-05 14:52 <DIR> d-------- C:\Program Files\Common Files\Java 2008-07-05 14:25 . 2008-06-13 07:05 272,128 --------- C:\WINDOWS\system32\drivers\bthport.sys 2008-07-05 14:25 . 2008-06-13 07:05 272,128 -----c--- C:\WINDOWS\system32\dllcache\bthport.sys 2008-07-05 14:24 . 2008-05-08 10:02 203,136 -----c--- C:\WINDOWS\system32\dllcache\rmcast.sys 2008-07-05 14:20 . 2008-07-05 14:20 <DIR> d-------- C:\Program Files\Trend Micro 2008-07-04 15:14 . 2008-07-04 21:12 1,082 --a------ C:\WINDOWS\wininit.ini 2008-07-04 13:19 . 2008-07-04 13:20 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy 2008-07-04 13:19 . 2008-07-04 15:27 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2008-07-04 00:20 . 2008-07-04 00:20 <DIR> d--h----- C:\WINDOWS\system32\GroupPolicy 2008-07-03 22:35 . 2008-07-05 14:43 <DIR> d--h----- C:\$AVG8.VAULT$ 2008-07-03 22:33 . 2008-07-03 22:42 10,520 --a------ C:\WINDOWS\system32\avgrsstx.dll 2008-07-03 22:32 . 2008-07-07 12:06 <DIR> d-------- C:\WINDOWS\system32\drivers\Avg 2008-07-03 22:32 . 2008-07-03 22:32 <DIR> d-------- C:\Program Files\AVG 2008-07-03 22:32 . 2008-07-05 18:26 <DIR> d-------- C:\Documents and Settings\user\Application Data\AVGTOOLBAR 2008-07-03 22:32 . 2008-07-03 22:32 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\avg8 2008-07-03 22:32 . 2008-07-03 22:42 96,520 --a------ C:\WINDOWS\system32\drivers\avgldx86.sys 2008-07-03 22:32 . 2008-07-03 22:42 76,040 --a------ C:\WINDOWS\system32\drivers\avgtdix.sys 2008-07-03 22:29 . 2008-07-03 22:29 0 --a------ C:\WINDOWS\nsreg.dat 2008-07-03 22:22 . 2008-07-03 22:22 0 --a------ C:\WINDOWS\system32\wlite.sys 2008-07-01 12:40 . 2008-07-04 10:35 <DIR> d-------- C:\Documents and Settings\Administrator 2008-07-01 12:33 . 2004-08-04 08:00 82,944 --a------ C:\WINDOWS\system32\sockets.dll 2008-07-01 12:33 . 2008-07-05 14:30 41,984 --ahs---- C:\WINDOWS\system32\Crypt_16.dll 2008-06-12 07:40 . 2008-06-19 07:40 294 --ahs---- C:\WINDOWS\system32\myipenqv.ini 2008-06-10 19:00 . 2008-06-10 19:00 1,409 --a------ C:\WINDOWS\system32\tmpB917B.FOT 2008-06-10 19:00 . 2008-06-10 19:00 1,409 --a------ C:\WINDOWS\system32\tmp8127B.FOT 2008-06-10 19:00 . 2008-06-10 19:00 1,409 --a------ C:\WINDOWS\system32\tmp7427B.FOT 2008-06-10 19:00 . 2008-06-10 19:00 1,409 --a------ C:\WINDOWS\system32\tmp6827B.FOT 2008-06-10 19:00 . 2008-06-10 19:00 1,409 --a------ C:\WINDOWS\system32\tmp4D27B.FOT . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-07-04 05:01 --------- d-----w C:\Program Files\Registry Defender Platinum 2008-05-31 23:25 --------- d-----w C:\Documents and Settings\user\Application Data\Walgreens 2008-05-31 22:13 --------- d-----w C:\Documents and Settings\All Users\Application Data\Kodak 2008-05-31 22:09 --------- d-----w C:\Program Files\Kodak 2008-05-20 00:41 --------- d-----w C:\Documents and Settings\user\Application Data\Nero 2008-05-08 14:02 203,136 ----a-w C:\WINDOWS\system32\drivers\rmcast.sys 2008-05-07 05:12 1,288,192 ----a-w C:\WINDOWS\system32\quartz.dll 2008-04-23 04:16 826,368 ----a-w C:\WINDOWS\system32\wininet.dll 2008-04-14 09:55 1,804 ----a-w C:\WINDOWS\system32\dcache.bin 2008-04-14 09:46 329,728 ----a-w C:\WINDOWS\system32\netsetup.exe 2008-04-14 09:43 92,424 ----a-w C:\WINDOWS\system32\rdpdd.dll 2008-04-14 09:43 87,176 ----a-w C:\WINDOWS\system32\rdpwsx.dll 2008-04-14 09:43 299,520 ----a-w C:\WINDOWS\system32\drmclien.dll 2008-04-14 09:43 12,168 ----a-w C:\WINDOWS\system32\tsddd.dll 2008-04-14 09:41 98,304 ----a-w C:\WINDOWS\system32\actxprxy.dll 2008-04-14 09:40 53,279 ----a-w C:\WINDOWS\system32\odbcji32.dll 2008-04-14 09:40 4,126 ----a-w C:\WINDOWS\system32\msdxmlc.dll 2008-04-14 09:40 3,584 ----a-w C:\WINDOWS\system32\msafd.dll 2008-04-14 09:40 102,912 ----a-w C:\WINDOWS\system32\dpcdll.dll 2008-04-14 05:00 1,845,632 ----a-w C:\WINDOWS\system32\win32k.sys 2008-04-14 04:57 2,188,928 ----a-w C:\WINDOWS\system32\ntoskrnl.exe 2008-04-14 04:15 17,664 ----a-w C:\WINDOWS\system32\watchdog.sys 2008-04-14 04:13 9,728 ------w C:\WINDOWS\system32\comsdupd.exe 2008-04-14 04:13 12,800 ----a-w C:\WINDOWS\system32\spiisupd.exe 2008-04-14 04:01 7,424 ----a-w C:\WINDOWS\system32\kd1394.dll 2008-04-14 04:01 2,065,792 ----a-w C:\WINDOWS\system32\ntkrnlpa.exe 2008-04-14 04:00 61,440 ----a-w C:\WINDOWS\system32\msvcrt40.dll 2008-04-14 03:45 76,800 ------w C:\WINDOWS\system32\msshavmsg.dll 2008-04-14 03:09 438,784 ----a-w C:\WINDOWS\system32\xpob2res.dll 2008-04-14 03:09 2,897,920 ----a-w C:\WINDOWS\system32\xpsp2res.dll 2008-04-14 03:09 187,392 ----a-w C:\WINDOWS\system32\xpsp1res.dll 2008-04-14 03:07 208,384 ----a-w C:\WINDOWS\system32\rsaenh.dll 2008-04-14 03:07 138,752 ----a-w C:\WINDOWS\system32\dssenh.dll 2008-04-14 02:57 79,872 ------w C:\WINDOWS\system32\msxml6r.dll 2008-04-14 02:56 94,208 ----a-w C:\WINDOWS\system32\odbcint.dll 2008-04-14 02:56 12,288 ----a-w C:\WINDOWS\system32\odbcp32r.dll 2008-04-14 02:56 12,288 ----a-w C:\WINDOWS\system32\mscpx32r.dll 2008-04-14 02:54 20,480 ----a-w C:\WINDOWS\system32\msorc32r.dll 2008-04-14 02:51 733,696 ----a-w C:\WINDOWS\system32\qedwipes.dll 2008-04-14 02:39 4,096 ----a-w C:\WINDOWS\system32\dsprpres.dll 2008-04-14 02:33 63,488 ----a-w C:\WINDOWS\system32\browselc.dll 2008-04-14 02:33 549,376 ----a-w C:\WINDOWS\system32\shdoclc.dll 2008-04-14 02:18 1,647,616 ----a-w C:\WINDOWS\system32\winbrand.dll 2008-04-14 02:15 216,064 ----a-w C:\WINDOWS\system32\moricons.dll 2008-04-14 01:53 48,128 ----a-w C:\WINDOWS\system32\msprivs.dll 2008-04-14 01:52 48,128 ----a-w C:\WINDOWS\system32\inetres.dll 2008-04-14 01:09 884,736 ----a-w C:\WINDOWS\system32\msimsg.dll 2004-08-04 12:00 4,096 --sha-w C:\WINDOWS\system32\1112.dat . ((((((((((((((((((((((((((((( snapshot@2008-07-07_ 9.47.48.04 ))))))))))))))))))))))))))))))))))))))))) . - 2008-07-07 13:42:28 2,048 --s-a-w C:\WINDOWS\bootstat.dat + 2008-07-07 19:50:49 2,048 --s-a-w C:\WINDOWS\bootstat.dat + 2008-07-06 19:18:12 163,328 ----a-w C:\WINDOWS\ERUNT\SDFIX\ERDNT.EXE + 2008-07-07 16:18:28 4,612,096 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\00000001\NTUSER.DAT + 2008-07-07 16:18:28 159,744 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\00000002\UsrClass.dat + 2008-07-06 19:18:12 163,328 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\ERDNT.EXE + 2008-07-07 16:18:18 4,612,096 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\00000001\NTUSER.DAT + 2008-07-07 16:18:18 159,744 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\00000002\UsrClass.dat + 2003-07-07 17:36:00 2,058,343 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\9040110900063D11C8EF10054038389C\11.0.5614\OUTLFLTR.DAT + 2003-07-08 15:48:00 115,288 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\9040110900063D11C8EF10054038389C\11.0.5614\OUTLFLTR.DLL - 2007-05-22 17:47:11 593,920 ----a-r C:\WINDOWS\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\accicons.exe + 2008-07-07 14:07:12 593,920 ----a-r C:\WINDOWS\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\accicons.exe - 2007-05-22 17:47:11 12,288 ----a-r C:\WINDOWS\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\cagicon.exe + 2008-07-07 14:07:12 12,288 ----a-r C:\WINDOWS\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\cagicon.exe - 2007-05-22 17:47:11 86,016 ----a-r C:\WINDOWS\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\inficon.exe + 2008-07-07 14:07:12 86,016 ----a-r C:\WINDOWS\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\inficon.exe - 2007-05-22 17:47:11 135,168 ----a-r C:\WINDOWS\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\misc.exe + 2008-07-07 14:07:12 135,168 ----a-r C:\WINDOWS\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\misc.exe - 2007-05-22 17:47:11 11,264 ----a-r C:\WINDOWS\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\mspicons.exe + 2008-07-07 14:07:12 11,264 ----a-r C:\WINDOWS\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\mspicons.exe - 2007-05-22 17:47:11 27,136 ----a-r C:\WINDOWS\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\oisicon.exe + 2008-07-07 14:07:12 27,136 ----a-r C:\WINDOWS\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\oisicon.exe - 2007-05-22 17:47:11 4,096 ----a-r C:\WINDOWS\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\opwicon.exe + 2008-07-07 14:07:12 4,096 ----a-r C:\WINDOWS\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\opwicon.exe - 2007-05-22 17:47:11 794,624 ----a-r C:\WINDOWS\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\outicon.exe + 2008-07-07 14:07:13 794,624 ----a-r C:\WINDOWS\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\outicon.exe - 2007-05-22 17:47:11 249,856 ----a-r C:\WINDOWS\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\pptico.exe + 2008-07-07 14:07:12 249,856 ----a-r C:\WINDOWS\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\pptico.exe - 2007-05-22 17:47:11 61,440 ----a-r C:\WINDOWS\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\pubs.exe + 2008-07-07 14:07:12 61,440 ----a-r C:\WINDOWS\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\pubs.exe - 2007-05-22 17:47:12 23,040 ----a-r C:\WINDOWS\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\unbndico.exe + 2008-07-07 14:07:13 23,040 ----a-r C:\WINDOWS\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\unbndico.exe - 2007-05-22 17:47:11 286,720 ----a-r C:\WINDOWS\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\wordicon.exe + 2008-07-07 14:07:12 286,720 ----a-r C:\WINDOWS\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\wordicon.exe - 2007-05-22 17:47:11 409,600 ----a-r C:\WINDOWS\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\xlicons.exe + 2008-07-07 14:07:11 409,600 ----a-r C:\WINDOWS\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\xlicons.exe . -- Snapshot reset to current date -- . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Walgreens PhotoShow Media Manager"="C:\PROGRA~1\WALGRE~1\WALGRE~1\data\xtras\mssysmgr.exe" [2006-04-20 02:35 237568] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-14 05:42 15360] "Nero PhotoShow Media Manager"="C:\PROGRA~1\Nero\PHOTOS~1\data\xtras\mssysmgr.exe" [2008-02-12 11:02 353544] "SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-01-28 11:43 2097488] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "AVG8_TRAY"="C:\PROGRA~1\AVG\AVG8\avgtray.exe" [2008-07-03 22:42 1232152] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe" [2008-03-25 04:28 144784] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=avgrsstx.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "aux"= ctwdm32.dll [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\wlite.sys] @="Driver" [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "C:\\Program Files\\AVG\\AVG8\\avgupd.exe"= "C:\\Program Files\\AVG\\AVG8\\avgemc.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009 R1 AvgLdx86;AVG AVI Loader Driver x86;C:\WINDOWS\system32\Drivers\avgldx86.sys [2008-07-03 22:42] R2 avg8emc;AVG8 E-mail Scanner;C:\PROGRA~1\AVG\AVG8\avgemc.exe [2008-07-03 22:42] R2 avg8wd;AVG8 WatchDog;C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe [2008-07-03 22:42] R2 AvgTdiX;AVG8 Network Redirector;C:\WINDOWS\system32\Drivers\avgtdix.sys [2008-07-03 22:42] R3 ati2mtaa;ati2mtaa;C:\WINDOWS\system32\DRIVERS\ati2mtaa.sys [2004-08-03 18:29] S1 wlite;WMV9 Codec;C:\WINDOWS\system32\wlite.sys [2008-07-03 22:22] . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-07-07 16:10:58 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... sc |