Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Virtumonde Can't Get Rid Of


  • Please log in to reply
16 replies to this topic

#1 crowdedisland

crowdedisland

  • Members
  • 27 posts
  • OFFLINE
  •  
  • Local time:07:11 PM

Posted 28 January 2008 - 08:45 PM

I got notified by Symantec Anti Virus 10.2 that the system was infected. It said it need to reboot to elimniante biut coudl nto get rid of it.

I confirmed the infectyion with Panda Scan.

I then ran Virtumondefix and it said it needed to reboot to get rid of it but it couldn't even after reboot.

I then ran virtomondebegone and it never found the problem.

Below is the hijackthis log:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:22:02 PM, on 2008-01-28
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\WINDOWS\system32\basfipm.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Conversions Plus\FORMATM.EXE
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Symantec AntiVirus\SavRoam.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\rdpclip.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\logon.scr
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [runner1] C:\WINDOWS\mrofinu572.exe 61A847B5BBF728173599284503996897C881250221C8670836AC4FA7C8833201749139
O4 - HKLM\..\Run: [6cf2af2c] rundll32.exe "C:\WINDOWS\system32\aqbindtf.dll",b
O4 - HKLM\..\Run: [EPSON Stylus Photo R200 Series (from PI-SBS-1)] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2H1.EXE /P46 "EPSON Stylus Photo R200 Series (from PI-SBS-1)" /O5 "TS001" /M "Stylus Photo R200"
O4 - HKCU\..\Run: [Dot1XCfg] C:\Program Files\Dot1XCfg\Dot1XCfg.exe
O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.dell.com/systemprofiler/SysPro.CAB
O16 - DPF: {485D813E-EE26-4DF8-9FAF-DEDF2885306E} (NSHelp Class) - http://pi-sbs-1/ConnectComputer/nshelp.dll
O16 - DPF: {60EFC337-15C2-4369-B2A0-3429B071D8B8} (Hewlett-Packard Printer Diagnostics) - http://h50203.www5.hp.com/HPISWeb/Customer...SWebManager.CAB
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5co...b?1114711748640
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1149812285897
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {E856B973-45FD-4559-8F82-EAB539144667} (Dell PC Checkup Installer Control) - http://pccheckup.dellfix.com/rel/41/install/gtdownde.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = primeinteriors.local
O17 - HKLM\Software\..\Telephony: DomainName = primeinteriors.local
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = primeinteriors.local
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
O23 - Service: AOL Spyware Protection Service (AOLService) - Unknown owner - C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\\aolserv.exe (file missing)
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Broadcom ASF IP monitoring service v6.0.4 (BAsfIpM) - Broadcom Corp. - C:\WINDOWS\system32\basfipm.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: MacFormatService - DataViz Inc. - C:\Program Files\Conversions Plus\FORMATM.EXE
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

--
End of file - 5290 bytes


I would appreciate any help you can provide.

BC AdBot (Login to Remove)

 


#2 Rosty

Rosty

    Skydive junkie


  • Malware Response Team
  • 1,220 posts
  • OFFLINE
  •  
  • Local time:01:11 AM

Posted 04 February 2008 - 03:18 AM

Hi,
sorry for the delay. Welcome to BleepingComputer. My name is Rosty and I'm going to help you with your log.

Download ComboFix from Here or Here to your Desktop.
  • Double click combofix.exe and follow the prompts.
  • When finished, it shall produce a log for you. Post that log and a HiJackthis log in your next reply
Note: Do not mouseclick combofix's window while its running. That may cause it to stall
Posted Image
Proud member of ASAP since 2007

#3 crowdedisland

crowdedisland
  • Topic Starter

  • Members
  • 27 posts
  • OFFLINE
  •  
  • Local time:07:11 PM

Posted 04 February 2008 - 07:45 AM

Thank you so much fro finally gettinng back to me. Since I didn't hear from anyone I took things into my own hands based on other incidents and may have cleaned up the rpoblem.

Can you please review the newest hijack log and let me know what I shoudl do to close this out.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 07:43, on 2008-02-04
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0 SOS\avp.exe
C:\WINDOWS\system32\basfipm.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Conversions Plus\FORMATM.EXE
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Symantec AntiVirus\SavRoam.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\rdpclip.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0 SOS\avp.exe
C:\Program Files\AIM\aim.exe
C:\WINDOWS\system32\logon.scr
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2H1.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\internet explorer\iexplore.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

O2 - BHO: (no name) - {09A8316E-F5E3-4770-81F3-3E8FB99E7D64} - C:\WINDOWS\system32\ddaya.dll (file missing)
O2 - BHO: (no name) - {2A8970E2-1061-401A-956C-867B3A5E963E} - C:\WINDOWS\system32\geeda.dll (file missing)
O2 - BHO: (no name) - {4D2E4DB7-007F-49E2-A895-1E7FD58AED71} - C:\WINDOWS\system32\vtstr.dll (file missing)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: (no name) - {5FE047E9-2074-4CB4-AB6D-3C8BD7EFA726} - C:\WINDOWS\system32\vtsqq.dll (file missing)
O2 - BHO: (no name) - {BFF00B2D-9DEF-4C1D-9228-E74D9B64AE44} - C:\WINDOWS\system32\vtutq.dll (file missing)
O2 - BHO: {009b1638-5a35-a068-63a4-385e661f3b2f} - {f2b3f166-e583-4a36-860a-53a58361b900} - C:\WINDOWS\system32\hbyqysdm.dll (file missing)
O4 - HKLM\..\Run: [EPSON Stylus Photo R200 Series (from PI-SBS-1)] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2H1.EXE /P46 "EPSON Stylus Photo R200 Series (from PI-SBS-1)" /O5 "TS001" /M "Stylus Photo R200"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0 SOS\avp.exe"
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd...b?1202076029991
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = primeinteriors.local
O17 - HKLM\Software\..\Telephony: DomainName = primeinteriors.local
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = primeinteriors.local
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
O23 - Service: AOL Spyware Protection Service (AOLService) - Unknown owner - C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\\aolserv.exe (file missing)
O23 - Service: Kaspersky Anti-Virus 6.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0 SOS\avp.exe
O23 - Service: Broadcom ASF IP monitoring service v6.0.4 (BAsfIpM) - Broadcom Corp. - C:\WINDOWS\system32\basfipm.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: MacFormatService - DataViz Inc. - C:\Program Files\Conversions Plus\FORMATM.EXE
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

--
End of file - 5527 bytes

#4 Rosty

Rosty

    Skydive junkie


  • Malware Response Team
  • 1,220 posts
  • OFFLINE
  •  
  • Local time:01:11 AM

Posted 04 February 2008 - 07:59 AM

Hi,

open HijackThis, click do a scan only and place a check next to the following entries:

O2 - BHO: (no name) - {09A8316E-F5E3-4770-81F3-3E8FB99E7D64} - C:\WINDOWS\system32\ddaya.dll (file missing)
O2 - BHO: (no name) - {2A8970E2-1061-401A-956C-867B3A5E963E} - C:\WINDOWS\system32\geeda.dll (file missing)
O2 - BHO: (no name) - {4D2E4DB7-007F-49E2-A895-1E7FD58AED71} - C:\WINDOWS\system32\vtstr.dll (file missing)
O2 - BHO: (no name) - {5FE047E9-2074-4CB4-AB6D-3C8BD7EFA726} - C:\WINDOWS\system32\vtsqq.dll (file missing)
O2 - BHO: (no name) - {BFF00B2D-9DEF-4C1D-9228-E74D9B64AE44} - C:\WINDOWS\system32\vtutq.dll (file missing)
O2 - BHO: {009b1638-5a35-a068-63a4-385e661f3b2f} - {f2b3f166-e583-4a36-860a-53a58361b900} - C:\WINDOWS\system32\hbyqysdm.dll (file missing)

Close all other windows and browsers, except HijackThis, and click Fix Checked. Close HijackkThis.

Can ou please run Combofix with the instructions I give you in my first post?

Post that log and a new HijackThis log in your next reply.

Edited by Rosty, 04 February 2008 - 07:59 AM.

Posted Image
Proud member of ASAP since 2007

#5 crowdedisland

crowdedisland
  • Topic Starter

  • Members
  • 27 posts
  • OFFLINE
  •  
  • Local time:07:11 PM

Posted 04 February 2008 - 08:54 AM

ComboFix 08-02.03.1 - mmurray 2008-02-04 8:33:59.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.230 [GMT -5:00]
Running from: C:\Documents and Settings\Margo\Desktop\ComboFix.exe
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Program Files\Temporary
C:\WINDOWS\b122.exe
C:\WINDOWS\cookies.ini
C:\WINDOWS\mrofinu572.exe
C:\WINDOWS\system32\adeeg.bak1
C:\WINDOWS\system32\adeeg.ini
C:\WINDOWS\SYSTEM32\aubielwp.ini
C:\WINDOWS\SYSTEM32\colbtias.ini
C:\WINDOWS\SYSTEM32\ggjlm.bak1
C:\WINDOWS\SYSTEM32\ggjlm.ini
C:\WINDOWS\SYSTEM32\iitfgwwm.ini
C:\WINDOWS\SYSTEM32\lrtxauyw.ini
C:\WINDOWS\system32\mcrh.tmp
C:\WINDOWS\system32\pac.txt
C:\WINDOWS\SYSTEM32\rtstv.bak1
C:\WINDOWS\SYSTEM32\rtstv.bak2
C:\WINDOWS\SYSTEM32\rtstv.ini
C:\WINDOWS\SYSTEM32\ueqpukha.ini
C:\WINDOWS\SYSTEM32\ymtsgpax.ini
C:\WINDOWS\SYSTEM32\yxaiafar.ini

.
((((((((((((((((((((((((( Files Created from 2008-01-04 to 2008-02-04 )))))))))))))))))))))))))))))))
.

2008-02-03 17:21 . 2008-02-03 17:21 <DIR> d-------- C:\Program Files\Microsoft Silverlight
2008-02-03 17:16 . 2008-02-03 17:16 <DIR> d-------- C:\Program Files\MSXML 6.0
2008-02-03 17:16 . 2006-10-04 09:06 1,197,294 --------- C:\WINDOWS\SYSTEM32\DLLCACHE\sysmain.sdb
2008-02-03 17:16 . 2006-10-04 09:06 764,868 --------- C:\WINDOWS\SYSTEM32\DLLCACHE\apph_sp.sdb
2008-02-03 17:16 . 2006-10-04 09:06 217,118 --------- C:\WINDOWS\SYSTEM32\DLLCACHE\apphelp.sdb
2008-02-03 17:11 . 2008-02-03 17:11 <DIR> d-------- C:\WINDOWS\SYSTEM32\LogFiles
2008-02-03 17:11 . 2008-02-03 17:12 <DIR> d-------- C:\WINDOWS\SYSTEM32\DRIVERS\UMDF
2008-02-03 17:08 . 2008-02-03 17:16 1,355 --a------ C:\WINDOWS\imsins.BAK
2008-02-03 17:04 . 2006-11-13 01:02 288,768 --------- C:\WINDOWS\SYSTEM32\rhttpaa.dll
2008-02-03 17:04 . 2006-11-13 01:02 116,736 --------- C:\WINDOWS\SYSTEM32\aaclient.dll
2008-02-03 17:04 . 2006-11-13 01:02 36,352 --------- C:\WINDOWS\SYSTEM32\tsgqec.dll
2008-02-03 09:40 . 2008-02-03 18:17 2,591,264 --ahs---- C:\WINDOWS\SYSTEM32\DRIVERS\fidbox.dat
2008-02-03 09:40 . 2008-02-04 08:36 357,920 --ahs---- C:\WINDOWS\SYSTEM32\DRIVERS\fidbox2.dat
2008-02-03 09:40 . 2008-02-03 18:17 35,168 --ahs---- C:\WINDOWS\SYSTEM32\DRIVERS\fidbox2.idx
2008-02-03 09:40 . 2008-02-03 18:17 34,652 --ahs---- C:\WINDOWS\SYSTEM32\DRIVERS\fidbox.idx
2008-02-03 09:38 . 2008-02-03 09:38 <DIR> d-------- C:\Program Files\Kaspersky Lab
2008-02-03 09:38 . 2008-02-03 18:18 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-02-03 09:37 . 2008-02-03 09:37 <DIR> d-------- C:\KAV
2008-01-31 02:26 . 2007-07-30 19:19 207,736 --a------ C:\WINDOWS\SYSTEM32\muweb.dll
2008-01-29 09:55 . 2008-01-29 09:56 <DIR> d-------- C:\Documents and Settings\Margo\Application Data\AdwareAlert
2008-01-26 04:44 . 2008-01-28 08:53 2,059,173 ---hs---- C:\WINDOWS\SYSTEM32\csbagtwy.ini
2008-01-25 16:34 . 2008-01-25 16:34 <DIR> d-------- C:\Program Files\Dot1XCfg
2008-01-25 16:30 . 2008-01-25 16:30 <DIR> d-------- C:\WINDOWS\SYSTEM32\nGpxx01
2008-01-25 16:30 . 2008-01-25 16:30 <DIR> d-------- C:\temp\cXzz9
2008-01-17 11:21 . 2008-01-17 11:21 47 --a------ C:\tmp.bat
2008-01-10 07:38 . 2007-06-05 10:56 44,928 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\SDTHOOK.SYS
2008-01-09 21:56 . 2007-06-08 09:44 8,576 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\mgqjmbevwydf.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-03 22:14 --------- d-----w C:\Program Files\Windows Media Connect 2
2008-02-03 21:26 --------- d-----w C:\Program Files\Windows Defender
2008-02-03 21:26 --------- d-----w C:\Program Files\Symantec AntiVirus
2008-02-03 21:26 --------- d-----w C:\Program Files\Spybot - Search & Destroy
2008-02-03 21:09 --------- d-----w C:\Program Files\Conversions Plus
2008-02-03 21:08 --------- d-----w C:\Program Files\Common Files\Symantec Shared
2008-02-03 21:08 --------- d-----w C:\Program Files\Common Files\Autodesk Shared
2008-02-03 21:06 --------- d-----w C:\Program Files\AIM
2008-02-03 14:26 --------- d-----w C:\Program Files\QuickTime
2008-02-02 23:41 524,288 ---ha-w C:\Documents and Settings\__sbs_netsetup__\NTUSER.DAT
2008-02-02 23:14 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-02-01 17:35 --------- d-----w C:\Documents and Settings\Margo\Application Data\AdobeUM
2008-01-28 23:17 --------- d-----w C:\Program Files\CCleaner
2008-01-10 13:02 --------- d-----w C:\Program Files\iTunes
2008-01-10 12:57 --------- d-----w C:\Program Files\Google
2008-01-10 12:57 --------- d-----w C:\Program Files\Digital Line Detect
2008-01-10 12:55 --------- d-----w C:\Program Files\AOL Toolbar
2008-01-10 12:55 --------- d-----w C:\Program Files\AOL Companion
2008-01-10 12:55 --------- d-----w C:\Program Files\America Online 9.0
2008-01-10 02:33 --------- d-----w C:\Program Files\Common Files\Scanner
2007-11-07 09:26 721,920 ----a-w C:\WINDOWS\SYSTEM32\lsasrv.dll
2007-11-07 09:26 721,920 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\lsasrv.dll
2007-08-14 21:00 6,421 --sha-w C:\WINDOWS\SYSTEM32\edeeg.bak1
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AIM"="C:\Program Files\AIM\aim.exe" [2004-03-12 15:22 61440]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"EPSON Stylus Photo R200 Series (from PI-SBS-1)"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2H1.exe" [2003-07-08 02:00 99840]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2007-06-29 05:24 286720]
"AVP"="C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0 SOS\avp.exe" [2007-11-19 14:40 231952]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoWelcomeScreen"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\6cf2af2c]
C:\WINDOWS\system32\pgwtmnwy.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdwareAlert]
C:\Program Files\AdwareAlert\AdwareAlert.exe

R0 MacOpen;MacOpen;C:\WINDOWS\system32\drivers\MacOpen.sys [2002-07-02 14:04]

.
Contents of the 'Scheduled Tasks' folder
"2008-02-04 08:00:00 C:\WINDOWS\Tasks\AdwareAlert Scheduled Scan.job"
- C:\Program Files\AdwareAlert\AdwareAlert.ex
- C:\Program Files\AdwareAlert
"2008-02-04 06:54:28 C:\WINDOWS\Tasks\MP Scheduled Scan.job"
- C:\Program Files\Windows Defender\MpCmdRun.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-04 08:36:29
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-02-04 8:37:05
ComboFix-quarantined-files.txt 2008-02-04 13:37:00
.
2008-02-03 23:13:12 --- E O F ---

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 08:54, on 2008-02-04
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0 SOS\avp.exe
C:\WINDOWS\system32\basfipm.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Conversions Plus\FORMATM.EXE
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Symantec AntiVirus\SavRoam.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\rdpclip.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0 SOS\avp.exe
C:\Program Files\AIM\aim.exe
C:\WINDOWS\system32\logon.scr
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2H1.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\explorer.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O4 - HKLM\..\Run: [EPSON Stylus Photo R200 Series (from PI-SBS-1)] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2H1.EXE /P46 "EPSON Stylus Photo R200 Series (from PI-SBS-1)" /O5 "TS002" /M "Stylus Photo R200"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0 SOS\avp.exe"
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd...b?1202076029991
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = primeinteriors.local
O17 - HKLM\Software\..\Telephony: DomainName = primeinteriors.local
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = primeinteriors.local
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
O23 - Service: AOL Spyware Protection Service (AOLService) - Unknown owner - C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\\aolserv.exe (file missing)
O23 - Service: Kaspersky Anti-Virus 6.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0 SOS\avp.exe
O23 - Service: Broadcom ASF IP monitoring service v6.0.4 (BAsfIpM) - Broadcom Corp. - C:\WINDOWS\system32\basfipm.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: MacFormatService - DataViz Inc. - C:\Program Files\Conversions Plus\FORMATM.EXE
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

--
End of file - 4808 bytes

#6 Rosty

Rosty

    Skydive junkie


  • Malware Response Team
  • 1,220 posts
  • OFFLINE
  •  
  • Local time:01:11 AM

Posted 04 February 2008 - 09:14 AM

1. Please open Notepad
  • Click Start , then Run
  • Type notepad .exe in the Run Box.
2. Now copy/paste the entire content of the codebox below into the Notepad window:

File::
C:\WINDOWS\imsins.BAK
C:\WINDOWS\SYSTEM32\rhttpaa.dll
C:\WINDOWS\SYSTEM32\aaclient.dll
C:\WINDOWS\SYSTEM32\tsgqec.dll
C:\WINDOWS\SYSTEM32\csbagtwy.ini
C:\WINDOWS\SYSTEM32\DRIVERS\mgqjmbevwydf.sys
C:\WINDOWS\SYSTEM32\edeeg.bak1

Folder::
C:\WINDOWS\SYSTEM32\nGpxx01
C:\temp\cXzz9
C:\tmp.bat

Driver::
mgqjmbevwydf.sys

Registry::
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\6cf2af2c]
C:\WINDOWS\system32\pgwtmnwy.dll"=-



3. Save the above as CFScript.txt

4. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.

Posted Image


5. After reboot, (in case it asks to reboot), please post the following reports/logs into your next reply:
  • Combofix.txt
  • A new HijackThis log.

Posted Image
Proud member of ASAP since 2007

#7 crowdedisland

crowdedisland
  • Topic Starter

  • Members
  • 27 posts
  • OFFLINE
  •  
  • Local time:07:11 PM

Posted 04 February 2008 - 10:24 AM

ComboFix 08-02.03.1 - mmurray 2008-02-04 10:18:39.3 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.196 [GMT -5:00]
Running from: C:\Documents and Settings\Margo\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Margo\Desktop\CFScript.txt
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE
C:\WINDOWS\imsins.BAK
C:\WINDOWS\SYSTEM32\aaclient.dll
C:\WINDOWS\SYSTEM32\csbagtwy.ini
C:\WINDOWS\SYSTEM32\DRIVERS\mgqjmbevwydf.sys
C:\WINDOWS\SYSTEM32\edeeg.bak1
C:\WINDOWS\SYSTEM32\rhttpaa.dll
C:\WINDOWS\SYSTEM32\tsgqec.dll
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\temp\cXzz9
C:\tmp.bat\
C:\WINDOWS\imsins.BAK
C:\WINDOWS\SYSTEM32\aaclient.dll
C:\WINDOWS\SYSTEM32\csbagtwy.ini
C:\WINDOWS\SYSTEM32\DRIVERS\mgqjmbevwydf.sys
C:\WINDOWS\SYSTEM32\edeeg.bak1
C:\WINDOWS\SYSTEM32\nGpxx01
C:\WINDOWS\SYSTEM32\rhttpaa.dll
C:\WINDOWS\SYSTEM32\tsgqec.dll

.
((((((((((((((((((((((((( Files Created from 2008-01-04 to 2008-02-04 )))))))))))))))))))))))))))))))
.

2008-02-03 17:21 . 2008-02-03 17:21 <DIR> d-------- C:\Program Files\Microsoft Silverlight
2008-02-03 17:16 . 2008-02-03 17:16 <DIR> d-------- C:\Program Files\MSXML 6.0
2008-02-03 17:16 . 2006-10-04 09:06 1,197,294 --------- C:\WINDOWS\SYSTEM32\DLLCACHE\sysmain.sdb
2008-02-03 17:16 . 2006-10-04 09:06 764,868 --------- C:\WINDOWS\SYSTEM32\DLLCACHE\apph_sp.sdb
2008-02-03 17:16 . 2006-10-04 09:06 217,118 --------- C:\WINDOWS\SYSTEM32\DLLCACHE\apphelp.sdb
2008-02-03 17:11 . 2008-02-03 17:11 <DIR> d-------- C:\WINDOWS\SYSTEM32\LogFiles
2008-02-03 17:11 . 2008-02-03 17:12 <DIR> d-------- C:\WINDOWS\SYSTEM32\DRIVERS\UMDF
2008-02-03 09:40 . 2008-02-03 18:17 2,725,664 --ahs---- C:\WINDOWS\SYSTEM32\DRIVERS\fidbox.dat
2008-02-03 09:40 . 2008-02-04 10:20 376,352 --ahs---- C:\WINDOWS\SYSTEM32\DRIVERS\fidbox2.dat
2008-02-03 09:40 . 2008-02-03 18:17 35,168 --ahs---- C:\WINDOWS\SYSTEM32\DRIVERS\fidbox2.idx
2008-02-03 09:40 . 2008-02-03 18:17 34,652 --ahs---- C:\WINDOWS\SYSTEM32\DRIVERS\fidbox.idx
2008-02-03 09:38 . 2008-02-03 09:38 <DIR> d-------- C:\Program Files\Kaspersky Lab
2008-02-03 09:38 . 2008-02-03 18:18 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-02-03 09:37 . 2008-02-03 09:37 <DIR> d-------- C:\KAV
2008-01-31 02:26 . 2007-07-30 19:19 207,736 --a------ C:\WINDOWS\SYSTEM32\muweb.dll
2008-01-29 09:55 . 2008-01-29 09:56 <DIR> d-------- C:\Documents and Settings\Margo\Application Data\AdwareAlert
2008-01-25 16:34 . 2008-01-25 16:34 <DIR> d-------- C:\Program Files\Dot1XCfg
2008-01-17 11:21 . 2008-01-17 11:21 47 --a------ C:\tmp.bat
2008-01-10 07:38 . 2007-06-05 10:56 44,928 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\SDTHOOK.SYS

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-03 22:14 --------- d-----w C:\Program Files\Windows Media Connect 2
2008-02-03 21:26 --------- d-----w C:\Program Files\Windows Defender
2008-02-03 21:26 --------- d-----w C:\Program Files\Symantec AntiVirus
2008-02-03 21:26 --------- d-----w C:\Program Files\Spybot - Search & Destroy
2008-02-03 21:09 --------- d-----w C:\Program Files\Conversions Plus
2008-02-03 21:08 --------- d-----w C:\Program Files\Common Files\Symantec Shared
2008-02-03 21:08 --------- d-----w C:\Program Files\Common Files\Autodesk Shared
2008-02-03 21:06 --------- d-----w C:\Program Files\AIM
2008-02-03 14:26 --------- d-----w C:\Program Files\QuickTime
2008-02-02 23:41 524,288 ---ha-w C:\Documents and Settings\__sbs_netsetup__\NTUSER.DAT
2008-02-02 23:14 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-02-01 17:35 --------- d-----w C:\Documents and Settings\Margo\Application Data\AdobeUM
2008-01-28 23:17 --------- d-----w C:\Program Files\CCleaner
2008-01-10 13:02 --------- d-----w C:\Program Files\iTunes
2008-01-10 12:57 --------- d-----w C:\Program Files\Google
2008-01-10 12:57 --------- d-----w C:\Program Files\Digital Line Detect
2008-01-10 12:55 --------- d-----w C:\Program Files\AOL Toolbar
2008-01-10 12:55 --------- d-----w C:\Program Files\AOL Companion
2008-01-10 12:55 --------- d-----w C:\Program Files\America Online 9.0
2008-01-10 02:33 --------- d-----w C:\Program Files\Common Files\Scanner
2007-11-07 09:26 721,920 ----a-w C:\WINDOWS\SYSTEM32\lsasrv.dll
2007-11-07 09:26 721,920 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\lsasrv.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AIM"="C:\Program Files\AIM\aim.exe" [2004-03-12 15:22 61440]
"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2006-10-18 20:05 204288]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"EPSON Stylus Photo R200 Series (from PI-SBS-1)"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2H1.exe" [2003-07-08 02:00 99840]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2007-06-29 05:24 286720]
"AVP"="C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0 SOS\avp.exe" [2007-11-19 14:40 231952]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoWelcomeScreen"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\6cf2af2c]
C:\WINDOWS\system32\pgwtmnwy.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdwareAlert]
C:\Program Files\AdwareAlert\AdwareAlert.exe

R0 MacOpen;MacOpen;C:\WINDOWS\system32\drivers\MacOpen.sys [2002-07-02 14:04]

.
Contents of the 'Scheduled Tasks' folder
"2008-02-04 08:00:00 C:\WINDOWS\Tasks\AdwareAlert Scheduled Scan.job"
- C:\Program Files\AdwareAlert\AdwareAlert.ex
- C:\Program Files\AdwareAlert
"2008-02-04 06:54:28 C:\WINDOWS\Tasks\MP Scheduled Scan.job"
- C:\Program Files\Windows Defender\MpCmdRun.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-04 10:20:58
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-02-04 10:21:39
ComboFix-quarantined-files.txt 2008-02-04 15:21:29
ComboFix2.txt 2008-02-04 13:37:06
.
2008-02-03 23:13:12 --- E O F ---

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:23, on 2008-02-04
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0 SOS\avp.exe
C:\WINDOWS\system32\basfipm.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Conversions Plus\FORMATM.EXE
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Symantec AntiVirus\SavRoam.exe
C:\WINDOWS\wanmpsvc.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0 SOS\avp.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\rdpclip.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2H1.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O4 - HKLM\..\Run: [EPSON Stylus Photo R200 Series (from PI-SBS-1)] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2H1.EXE /P46 "EPSON Stylus Photo R200 Series (from PI-SBS-1)" /O5 "TS001" /M "Stylus Photo R200"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0 SOS\avp.exe"
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd...b?1202076029991
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = primeinteriors.local
O17 - HKLM\Software\..\Telephony: DomainName = primeinteriors.local
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = primeinteriors.local
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
O23 - Service: AOL Spyware Protection Service (AOLService) - Unknown owner - C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\\aolserv.exe (file missing)
O23 - Service: Kaspersky Anti-Virus 6.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0 SOS\avp.exe
O23 - Service: Broadcom ASF IP monitoring service v6.0.4 (BAsfIpM) - Broadcom Corp. - C:\WINDOWS\system32\basfipm.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: MacFormatService - DataViz Inc. - C:\Program Files\Conversions Plus\FORMATM.EXE
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

--
End of file - 4861 bytes

#8 Rosty

Rosty

    Skydive junkie


  • Malware Response Team
  • 1,220 posts
  • OFFLINE
  •  
  • Local time:01:11 AM

Posted 04 February 2008 - 12:17 PM

Hi, just one thing to fix!!

1. Please open Notepad
  • Click Start , then Run
  • Type notepad .exe in the Run Box.
2. Now copy/paste the entire content of the codebox below into the Notepad window:

Registry::
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\6cf2af2c]



3. Save the above as CFScript.txt

4. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.

Posted Image


5. After reboot, (in case it asks to reboot), please post the following reports/logs into your next reply:
  • Combofix.txt
  • A new HijackThis log.
Let me know how things are running.

Edited by Rosty, 04 February 2008 - 12:17 PM.

Posted Image
Proud member of ASAP since 2007

#9 crowdedisland

crowdedisland
  • Topic Starter

  • Members
  • 27 posts
  • OFFLINE
  •  
  • Local time:07:11 PM

Posted 04 February 2008 - 05:54 PM

The system seems to be working fine. We did get a BSOD Stop Error c000021a Windows Logon processs but on reboot everything seemed fine.



ComboFix 08-02.03.1 - mmurray 2008-02-04 17:38:40.4 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.179 [GMT -5:00]
Running from: C:\Documents and Settings\Margo\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Margo\Desktop\CFScript.txt
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\byxvvwv.dll
C:\WINDOWS\system32\pac.txt
C:\WINDOWS\system32\ssttt.dll
C:\WINDOWS\SYSTEM32\tttss.bak1
C:\WINDOWS\SYSTEM32\tttss.ini

.
((((((((((((((((((((((((( Files Created from 2008-01-04 to 2008-02-04 )))))))))))))))))))))))))))))))
.

2008-02-04 04:26 . 2008-02-04 04:26 <DIR> d-------- C:\WINDOWS\SYSTEM32\nGpxx01
2008-02-04 04:26 . 2008-02-04 04:26 <DIR> d-------- C:\temp\isgTi19
2008-02-03 17:21 . 2008-02-03 17:21 <DIR> d-------- C:\Program Files\Microsoft Silverlight
2008-02-03 17:16 . 2008-02-03 17:16 <DIR> d-------- C:\Program Files\MSXML 6.0
2008-02-03 17:16 . 2006-10-04 09:06 1,197,294 --------- C:\WINDOWS\SYSTEM32\DLLCACHE\sysmain.sdb
2008-02-03 17:16 . 2006-10-04 09:06 764,868 --------- C:\WINDOWS\SYSTEM32\DLLCACHE\apph_sp.sdb
2008-02-03 17:16 . 2006-10-04 09:06 217,118 --------- C:\WINDOWS\SYSTEM32\DLLCACHE\apphelp.sdb
2008-02-03 17:11 . 2008-02-03 17:11 <DIR> d-------- C:\WINDOWS\SYSTEM32\LogFiles
2008-02-03 17:11 . 2008-02-03 17:12 <DIR> d-------- C:\WINDOWS\SYSTEM32\DRIVERS\UMDF
2008-02-03 09:40 . 2008-02-04 17:46 3,202,336 --ahs---- C:\WINDOWS\SYSTEM32\DRIVERS\fidbox.dat
2008-02-03 09:40 . 2008-02-04 17:46 450,336 --ahs---- C:\WINDOWS\SYSTEM32\DRIVERS\fidbox2.dat
2008-02-03 09:40 . 2008-02-04 17:46 44,312 --ahs---- C:\WINDOWS\SYSTEM32\DRIVERS\fidbox2.idx
2008-02-03 09:40 . 2008-02-04 17:46 43,940 --ahs---- C:\WINDOWS\SYSTEM32\DRIVERS\fidbox.idx
2008-02-03 09:38 . 2008-02-03 09:38 <DIR> d-------- C:\Program Files\Kaspersky Lab
2008-02-03 09:38 . 2008-02-04 17:49 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-02-03 09:37 . 2008-02-03 09:37 <DIR> d-------- C:\KAV
2008-01-31 02:26 . 2007-07-30 19:19 207,736 --a------ C:\WINDOWS\SYSTEM32\muweb.dll
2008-01-29 09:55 . 2008-01-29 09:56 <DIR> d-------- C:\Documents and Settings\Margo\Application Data\AdwareAlert
2008-01-25 16:34 . 2008-01-25 16:34 <DIR> d-------- C:\Program Files\Dot1XCfg
2008-01-17 11:21 . 2008-01-17 11:21 47 --a------ C:\tmp.bat
2008-01-10 07:38 . 2007-06-05 10:56 44,928 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\SDTHOOK.SYS

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-04 17:00 --------- d-----w C:\Documents and Settings\Margo\Application Data\AdobeUM
2008-02-04 09:27 524,288 ---ha-w C:\Documents and Settings\__sbs_netsetup__\NTUSER.DAT
2008-02-03 22:14 --------- d-----w C:\Program Files\Windows Media Connect 2
2008-02-03 21:26 --------- d-----w C:\Program Files\Windows Defender
2008-02-03 21:26 --------- d-----w C:\Program Files\Symantec AntiVirus
2008-02-03 21:26 --------- d-----w C:\Program Files\Spybot - Search & Destroy
2008-02-03 21:09 --------- d-----w C:\Program Files\Conversions Plus
2008-02-03 21:08 --------- d-----w C:\Program Files\Common Files\Symantec Shared
2008-02-03 21:08 --------- d-----w C:\Program Files\Common Files\Autodesk Shared
2008-02-03 21:06 --------- d-----w C:\Program Files\AIM
2008-02-03 14:26 --------- d-----w C:\Program Files\QuickTime
2008-02-02 23:14 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-01-28 23:17 --------- d-----w C:\Program Files\CCleaner
2008-01-10 13:02 --------- d-----w C:\Program Files\iTunes
2008-01-10 12:57 --------- d-----w C:\Program Files\Google
2008-01-10 12:57 --------- d-----w C:\Program Files\Digital Line Detect
2008-01-10 12:55 --------- d-----w C:\Program Files\AOL Toolbar
2008-01-10 12:55 --------- d-----w C:\Program Files\AOL Companion
2008-01-10 12:55 --------- d-----w C:\Program Files\America Online 9.0
2008-01-10 02:33 --------- d-----w C:\Program Files\Common Files\Scanner
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AIM"="C:\Program Files\AIM\aim.exe" [2004-03-12 15:22 61440]
"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2006-10-18 20:05 204288]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"EPSON Stylus Photo R200 Series (from PI-SBS-1)"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2H1.exe" [2003-07-08 02:00 99840]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2007-06-29 05:24 286720]
"AVP"="C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0 SOS\avp.exe" [2007-11-19 14:40 231952]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoWelcomeScreen"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdwareAlert]
C:\Program Files\AdwareAlert\AdwareAlert.exe

R0 MacOpen;MacOpen;C:\WINDOWS\system32\drivers\MacOpen.sys [2002-07-02 14:04]

.
Contents of the 'Scheduled Tasks' folder
"2008-02-04 08:00:00 C:\WINDOWS\Tasks\AdwareAlert Scheduled Scan.job"
- C:\Program Files\AdwareAlert\AdwareAlert.ex
- C:\Program Files\AdwareAlert
"2008-02-04 22:50:20 C:\WINDOWS\Tasks\MP Scheduled Scan.job"
- C:\Program Files\Windows Defender\MpCmdRun.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-04 17:49:09
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Windows Defender\MsMpEng.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
C:\WINDOWS\system32\basfipm.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Conversions Plus\FORMATM.EXE
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Symantec AntiVirus\SavRoam.exe
C:\WINDOWS\wanmpsvc.exe
C:\Program Files\Windows Media Player\WMPNetwk.exe
C:\WINDOWS\system32\rdpclip.exe
.
**************************************************************************
.
Completion time: 2008-02-04 17:50:47 - machine was rebooted
ComboFix-quarantined-files.txt 2008-02-04 22:50:42
ComboFix2.txt 2008-02-04 15:21:40
ComboFix3.txt 2008-02-04 13:37:06
.
2008-02-03 23:13:12 --- E O F ---

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:52, on 2008-02-04
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0 SOS\avp.exe
C:\WINDOWS\system32\basfipm.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Conversions Plus\FORMATM.EXE
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Symantec AntiVirus\SavRoam.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\rdpclip.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2H1.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0 SOS\avp.exe
C:\Program Files\AIM\aim.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O4 - HKLM\..\Run: [EPSON Stylus Photo R200 Series (from PI-SBS-1)] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2H1.EXE /P46 "EPSON Stylus Photo R200 Series (from PI-SBS-1)" /O5 "TS005" /M "Stylus Photo R200"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0 SOS\avp.exe"
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd...b?1202076029991
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = primeinteriors.local
O17 - HKLM\Software\..\Telephony: DomainName = primeinteriors.local
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = primeinteriors.local
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
O23 - Service: AOL Spyware Protection Service (AOLService) - Unknown owner - C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\\aolserv.exe (file missing)
O23 - Service: Kaspersky Anti-Virus 6.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0 SOS\avp.exe
O23 - Service: Broadcom ASF IP monitoring service v6.0.4 (BAsfIpM) - Broadcom Corp. - C:\WINDOWS\system32\basfipm.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: MacFormatService - DataViz Inc. - C:\Program Files\Conversions Plus\FORMATM.EXE
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

--
End of file - 5010 bytes

#10 Rosty

Rosty

    Skydive junkie


  • Malware Response Team
  • 1,220 posts
  • OFFLINE
  •  
  • Local time:01:11 AM

Posted 05 February 2008 - 03:09 AM

Those logs looks clean.
How are things running?
Posted Image
Proud member of ASAP since 2007

#11 crowdedisland

crowdedisland
  • Topic Starter

  • Members
  • 27 posts
  • OFFLINE
  •  
  • Local time:07:11 PM

Posted 12 February 2008 - 09:21 AM

Thanks for all the help but the user now tells me theya re getting pop ups again.

I ran a bunch of scans including PAnda and AVG but they don't show anything. Here is the Hijack log i hope you can find something.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 09:17, on 2008-02-12
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\system32\basfipm.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Conversions Plus\FORMATM.EXE
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Symantec AntiVirus\SavRoam.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\rdpclip.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2H1.EXE
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

O4 - HKLM\..\Run: [EPSON Stylus Photo R200 Series (from PI-SBS-1)] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2H1.EXE /P46 "EPSON Stylus Photo R200 Series (from PI-SBS-1)" /O5 "TS001" /M "Stylus Photo R200"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [6cf2af2c] rundll32.exe "C:\WINDOWS\system32\swvxvkxu.dll",b
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = primeinteriors.local
O17 - HKLM\Software\..\Telephony: DomainName = primeinteriors.local
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = primeinteriors.local
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
O23 - Service: AOL Spyware Protection Service (AOLService) - Unknown owner - C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\\aolserv.exe (file missing)
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Broadcom ASF IP monitoring service v6.0.4 (BAsfIpM) - Broadcom Corp. - C:\WINDOWS\system32\basfipm.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: MacFormatService - DataViz Inc. - C:\Program Files\Conversions Plus\FORMATM.EXE
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

--
End of file - 3906 bytes

#12 Rosty

Rosty

    Skydive junkie


  • Malware Response Team
  • 1,220 posts
  • OFFLINE
  •  
  • Local time:01:11 AM

Posted 12 February 2008 - 12:17 PM

Hi,

sorry to hear that.

please remove Combofix from your system and redownload it with the instructions given you before.
Post that log and a new HijackThis log.
Posted Image
Proud member of ASAP since 2007

#13 crowdedisland

crowdedisland
  • Topic Starter

  • Members
  • 27 posts
  • OFFLINE
  •  
  • Local time:07:11 PM

Posted 12 February 2008 - 01:32 PM

Thanks for the response.

A couple of comemnts before the logs. From thsi amchien I was not ablt to downlaod the first combofix link it never appears like a exe. The second link works but if I try to save it to the desktop it doesn't give me the save option just the open. SO I saved to c:\tempa dn then cut and paste to the desktop. Also I noticed a couple of times prior to running combofix that the clock was set for 24 hour time.

ComboFix 08-02-13.1 - mmurray 2008-02-12 13:02:54.5 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.96 [GMT -5:00]
Running from: C:\Documents and Settings\Margo\Desktop\ComboFix.exe
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\check_LSA7.txt
C:\WINDOWS\system32\mljge.dll
C:\WINDOWS\system32\ssqqppo.dll
C:\check_LSA7.txt
C:\Temp\isgTi19
C:\WINDOWS\cookies.ini
C:\WINDOWS\SYSTEM32\adnknurj.ini
C:\WINDOWS\system32\amuqtugf.dll
C:\WINDOWS\SYSTEM32\bnkuhokw.ini
C:\WINDOWS\SYSTEM32\bucwyoog.ini
C:\WINDOWS\SYSTEM32\cmmfgycn.ini
C:\WINDOWS\SYSTEM32\dlsysrqn.ini
C:\WINDOWS\SYSTEM32\dnmnwnth.ini
C:\WINDOWS\system32\dtxxekxn.dll
C:\WINDOWS\SYSTEM32\egjlm.bak1
C:\WINDOWS\SYSTEM32\egjlm.bak2
C:\WINDOWS\SYSTEM32\egjlm.ini
C:\WINDOWS\SYSTEM32\egjlm.ini2
C:\WINDOWS\SYSTEM32\egjlm.tmp
C:\WINDOWS\SYSTEM32\farxqfih.ini
C:\WINDOWS\system32\ffneoiel.dll
C:\WINDOWS\SYSTEM32\ghsmykja.ini
C:\WINDOWS\SYSTEM32\gryoqytr.ini
C:\WINDOWS\system32\hsnjieiq.dll
C:\WINDOWS\SYSTEM32\iyroiifi.ini
C:\WINDOWS\SYSTEM32\leioenff.ini
C:\WINDOWS\system32\lxbkcphh.dll
C:\WINDOWS\system32\mcrh.tmp
C:\WINDOWS\system32\mdjibgqr.dll
C:\WINDOWS\system32\mfvqlduy.dll
C:\WINDOWS\system32\mhlmevfx.dll
C:\WINDOWS\system32\mljge.dll
C:\WINDOWS\system32\ncygfmmc.dll
C:\WINDOWS\system32\nGpxx01
C:\WINDOWS\system32\nqrsysld.dll
C:\WINDOWS\system32\nsysswtd.dll
C:\WINDOWS\system32\nxbivyco.dll
C:\WINDOWS\system32\pac.txt
C:\WINDOWS\system32\pbhrfjus.dll
C:\WINDOWS\SYSTEM32\pwhabuxm.ini
C:\WINDOWS\system32\qdlwoiui.dll
C:\WINDOWS\SYSTEM32\qieijnsh.ini
C:\WINDOWS\system32\rfjxreng.dll
C:\WINDOWS\system32\rlyqfkgy.dll
C:\WINDOWS\SYSTEM32\rvntlnbt.ini
C:\WINDOWS\system32\sbtrychy.dll
C:\WINDOWS\system32\ssqqppo.dll
C:\WINDOWS\system32\swvxvkxu.dll
C:\WINDOWS\system32\tbnltnvr.dll
C:\WINDOWS\system32\tmptwcsw.dll
C:\WINDOWS\system32\ustfyxoc.dll
C:\WINDOWS\SYSTEM32\uxkvxvws.ini
C:\WINDOWS\system32\vyanjlux.dll
C:\WINDOWS\SYSTEM32\wcfduljc.ini
C:\WINDOWS\SYSTEM32\wscwtpmt.ini
C:\WINDOWS\SYSTEM32\xdifradi.ini
C:\WINDOWS\system32\yjworpxw.dll
C:\WINDOWS\system32\yoixxikr.dll

.
((((((((((((((((((((((((( Files Created from 2008-01-12 to 2008-02-12 )))))))))))))))))))))))))))))))
.

2008-02-12 09:32 . 2008-02-12 09:39 <DIR> d-------- C:\Program Files\BHODemon 2
2008-02-12 07:21 . 2008-02-12 07:21 <DIR> d-------- C:\Documents and Settings\Margo\Application Data\Grisoft
2008-02-12 07:20 . 2008-02-12 07:20 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
2008-02-12 07:20 . 2007-05-30 07:10 10,872 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\AvgAsCln.sys
2008-02-11 20:39 . 2007-06-08 09:44 8,576 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\eepsdotpfkko.sys
2008-02-11 19:58 . 2007-06-08 09:44 8,576 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\xjkogwvnomqg.sys
2008-02-03 17:21 . 2008-02-03 17:21 <DIR> d-------- C:\Program Files\Microsoft Silverlight
2008-02-03 17:16 . 2008-02-03 17:16 <DIR> d-------- C:\Program Files\MSXML 6.0
2008-02-03 17:16 . 2006-10-04 09:06 1,197,294 --------- C:\WINDOWS\SYSTEM32\DLLCACHE\sysmain.sdb
2008-02-03 17:16 . 2006-10-04 09:06 764,868 --------- C:\WINDOWS\SYSTEM32\DLLCACHE\apph_sp.sdb
2008-02-03 17:16 . 2006-10-04 09:06 217,118 --------- C:\WINDOWS\SYSTEM32\DLLCACHE\apphelp.sdb
2008-02-03 17:11 . 2008-02-03 17:11 <DIR> d-------- C:\WINDOWS\SYSTEM32\LogFiles
2008-02-03 17:11 . 2008-02-03 17:12 <DIR> d-------- C:\WINDOWS\SYSTEM32\DRIVERS\UMDF
2008-02-03 09:40 . 2008-02-11 20:18 7,988,768 --ahs---- C:\WINDOWS\SYSTEM32\DRIVERS\fidbox.dat
2008-02-03 09:40 . 2008-02-11 20:18 852,768 --ahs---- C:\WINDOWS\SYSTEM32\DRIVERS\fidbox2.dat
2008-02-03 09:40 . 2008-02-11 20:18 108,068 --ahs---- C:\WINDOWS\SYSTEM32\DRIVERS\fidbox.idx
2008-02-03 09:40 . 2008-02-11 20:18 82,064 --ahs---- C:\WINDOWS\SYSTEM32\DRIVERS\fidbox2.idx
2008-02-03 09:37 . 2008-02-03 09:37 <DIR> d-------- C:\KAV
2008-01-31 02:26 . 2007-07-30 19:19 207,736 --a------ C:\WINDOWS\SYSTEM32\muweb.dll
2008-01-29 09:55 . 2008-01-29 09:56 <DIR> d-------- C:\Documents and Settings\Margo\Application Data\AdwareAlert
2008-01-25 16:34 . 2008-01-25 16:34 <DIR> d-------- C:\Program Files\Dot1XCfg
2008-01-17 11:21 . 2008-01-17 11:21 47 --a------ C:\tmp.bat

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-12 16:19 --------- d-----w C:\Documents and Settings\Margo\Application Data\AdobeUM
2008-02-12 02:58 --------- d-----w C:\Program Files\Windows Defender
2008-02-12 02:57 --------- d-----w C:\Program Files\Symantec AntiVirus
2008-02-12 02:57 --------- d-----w C:\Program Files\Spybot - Search & Destroy
2008-02-12 02:22 --------- d-----w C:\Program Files\Conversions Plus
2008-02-12 02:22 --------- d-----w C:\Program Files\Common Files\Symantec Shared
2008-02-12 02:21 --------- d-----w C:\Program Files\Common Files\Autodesk Shared
2008-02-04 09:27 524,288 ---ha-w C:\Documents and Settings\__sbs_netsetup__\NTUSER.DAT
2008-02-03 22:14 --------- d-----w C:\Program Files\Windows Media Connect 2
2008-02-03 21:06 --------- d-----w C:\Program Files\AIM
2008-02-03 14:26 --------- d-----w C:\Program Files\QuickTime
2008-02-02 23:14 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-01-28 23:17 --------- d-----w C:\Program Files\CCleaner
2008-01-10 13:02 --------- d-----w C:\Program Files\iTunes
2008-01-10 12:57 --------- d-----w C:\Program Files\Google
2008-01-10 12:57 --------- d-----w C:\Program Files\Digital Line Detect
2008-01-10 12:55 --------- d-----w C:\Program Files\AOL Toolbar
2008-01-10 12:55 --------- d-----w C:\Program Files\AOL Companion
2008-01-10 12:55 --------- d-----w C:\Program Files\America Online 9.0
2008-01-10 02:33 --------- d-----w C:\Program Files\Common Files\Scanner
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"EPSON Stylus Photo R200 Series (from PI-SBS-1)"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2H1.exe" [2003-07-08 02:00 99840]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 04:25 6731312]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableRegistryTools"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoWelcomeScreen"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdwareAlert]
C:\Program Files\AdwareAlert\AdwareAlert.exe

R0 MacOpen;MacOpen;C:\WINDOWS\system32\drivers\MacOpen.sys [2002-07-02 14:04]

.
Contents of the 'Scheduled Tasks' folder
"2008-02-12 08:00:00 C:\WINDOWS\Tasks\AdwareAlert Scheduled Scan.job"
- C:\Program Files\AdwareAlert\AdwareAlert.ex
- C:\Program Files\AdwareAlert
"2008-02-12 18:21:48 C:\WINDOWS\Tasks\MP Scheduled Scan.job"
- C:\Program Files\Windows Defender\MpCmdRun.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-12 13:20:42
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Windows Defender\MsMpEng.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
C:\WINDOWS\system32\basfipm.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Conversions Plus\FORMATM.EXE
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Symantec AntiVirus\SavRoam.exe
C:\WINDOWS\wanmpsvc.exe
C:\Program Files\Windows Media Player\WMPNetwk.exe
C:\WINDOWS\system32\rdpclip.exe
.
**************************************************************************
.
Completion time: 2008-02-12 13:22:50 - machine was rebooted
ComboFix-quarantined-files.txt 2008-02-12 18:22:44
ComboFix2.txt 2008-02-04 22:50:48
ComboFix3.txt 2008-02-04 15:21:40
ComboFix4.txt 2008-02-04 13:37:06
.
2008-02-06 01:41:34 --- E O F ---



Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:24, on 2008-02-12
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\system32\basfipm.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Conversions Plus\FORMATM.EXE
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Symantec AntiVirus\SavRoam.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\rdpclip.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2H1.EXE
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O4 - HKLM\..\Run: [EPSON Stylus Photo R200 Series (from PI-SBS-1)] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2H1.EXE /P46 "EPSON Stylus Photo R200 Series (from PI-SBS-1)" /O5 "TS006" /M "Stylus Photo R200"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = primeinteriors.local
O17 - HKLM\Software\..\Telephony: DomainName = primeinteriors.local
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = primeinteriors.local
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
O23 - Service: AOL Spyware Protection Service (AOLService) - Unknown owner - C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\\aolserv.exe (file missing)
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Broadcom ASF IP monitoring service v6.0.4 (BAsfIpM) - Broadcom Corp. - C:\WINDOWS\system32\basfipm.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: MacFormatService - DataViz Inc. - C:\Program Files\Conversions Plus\FORMATM.EXE
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

--
End of file - 3911 bytes

#14 Rosty

Rosty

    Skydive junkie


  • Malware Response Team
  • 1,220 posts
  • OFFLINE
  •  
  • Local time:01:11 AM

Posted 12 February 2008 - 02:00 PM

Hi,

Also I noticed a couple of times prior to running combofix that the clock was set for 24 hour time.

This will be Fixed if we delete Combofix in an other way.


1. Please open Notepad
  • Click Start , then Run
  • Type notepad .exe in the Run Box.
2. Now copy/paste the entire content of the codebox below into the Notepad window:

File::
C:\tmp.bat

Folder::
C:\Program Files\Dot1XCfg



3. Save the above as CFScript.txt

4. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.

Posted Image


5. After reboot, (in case it asks to reboot), please post the following reports/logs into your next reply:
  • Combofix.txt
  • A new HijackThis log.

Posted Image
Proud member of ASAP since 2007

#15 crowdedisland

crowdedisland
  • Topic Starter

  • Members
  • 27 posts
  • OFFLINE
  •  
  • Local time:07:11 PM

Posted 12 February 2008 - 08:29 PM

ComboFix 08-02-13.1 - mmurray 2008-02-12 20:21:41.6 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.220 [GMT -5:00]
Running from: C:\Documents and Settings\Margo\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Margo\Desktop\CFScript.txt
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE
C:\tmp.bat
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Program Files\Dot1XCfg
C:\tmp.bat

.
((((((((((((((((((((((((( Files Created from 2008-01-13 to 2008-02-13 )))))))))))))))))))))))))))))))
.

2008-02-12 09:32 . 2008-02-12 09:39 <DIR> d-------- C:\Program Files\BHODemon 2
2008-02-12 07:21 . 2008-02-12 07:21 <DIR> d-------- C:\Documents and Settings\Margo\Application Data\Grisoft
2008-02-12 07:20 . 2008-02-12 07:20 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
2008-02-12 07:20 . 2007-05-30 07:10 10,872 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\AvgAsCln.sys
2008-02-11 20:39 . 2007-06-08 09:44 8,576 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\eepsdotpfkko.sys
2008-02-11 19:58 . 2007-06-08 09:44 8,576 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\xjkogwvnomqg.sys
2008-02-03 17:21 . 2008-02-03 17:21 <DIR> d-------- C:\Program Files\Microsoft Silverlight
2008-02-03 17:16 . 2008-02-03 17:16 <DIR> d-------- C:\Program Files\MSXML 6.0
2008-02-03 17:16 . 2006-10-04 09:06 1,197,294 --------- C:\WINDOWS\SYSTEM32\DLLCACHE\sysmain.sdb
2008-02-03 17:16 . 2006-10-04 09:06 764,868 --------- C:\WINDOWS\SYSTEM32\DLLCACHE\apph_sp.sdb
2008-02-03 17:16 . 2006-10-04 09:06 217,118 --------- C:\WINDOWS\SYSTEM32\DLLCACHE\apphelp.sdb
2008-02-03 17:11 . 2008-02-03 17:11 <DIR> d-------- C:\WINDOWS\SYSTEM32\LogFiles
2008-02-03 17:11 . 2008-02-03 17:12 <DIR> d-------- C:\WINDOWS\SYSTEM32\DRIVERS\UMDF
2008-02-03 09:40 . 2008-02-11 20:18 7,988,768 --ahs---- C:\WINDOWS\SYSTEM32\DRIVERS\fidbox.dat
2008-02-03 09:40 . 2008-02-11 20:18 852,768 --ahs---- C:\WINDOWS\SYSTEM32\DRIVERS\fidbox2.dat
2008-02-03 09:40 . 2008-02-11 20:18 108,068 --ahs---- C:\WINDOWS\SYSTEM32\DRIVERS\fidbox.idx
2008-02-03 09:40 . 2008-02-11 20:18 82,064 --ahs---- C:\WINDOWS\SYSTEM32\DRIVERS\fidbox2.idx
2008-02-03 09:37 . 2008-02-03 09:37 <DIR> d-------- C:\KAV
2008-01-31 02:26 . 2007-07-30 19:19 207,736 --a------ C:\WINDOWS\SYSTEM32\muweb.dll
2008-01-29 09:55 . 2008-01-29 09:56 <DIR> d-------- C:\Documents and Settings\Margo\Application Data\AdwareAlert

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-12 20:53 --------- d-----w C:\Documents and Settings\Margo\Application Data\AdobeUM
2008-02-12 02:58 --------- d-----w C:\Program Files\Windows Defender
2008-02-12 02:57 --------- d-----w C:\Program Files\Symantec AntiVirus
2008-02-12 02:57 --------- d-----w C:\Program Files\Spybot - Search & Destroy
2008-02-12 02:22 --------- d-----w C:\Program Files\Conversions Plus
2008-02-12 02:22 --------- d-----w C:\Program Files\Common Files\Symantec Shared
2008-02-12 02:21 --------- d-----w C:\Program Files\Common Files\Autodesk Shared
2008-02-04 09:27 524,288 ---ha-w C:\Documents and Settings\__sbs_netsetup__\NTUSER.DAT
2008-02-03 22:14 --------- d-----w C:\Program Files\Windows Media Connect 2
2008-02-03 21:06 --------- d-----w C:\Program Files\AIM
2008-02-03 14:26 --------- d-----w C:\Program Files\QuickTime
2008-02-02 23:14 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-01-28 23:17 --------- d-----w C:\Program Files\CCleaner
2008-01-10 13:02 --------- d-----w C:\Program Files\iTunes
2008-01-10 12:57 --------- d-----w C:\Program Files\Google
2008-01-10 12:57 --------- d-----w C:\Program Files\Digital Line Detect
2008-01-10 12:55 --------- d-----w C:\Program Files\AOL Toolbar
2008-01-10 12:55 --------- d-----w C:\Program Files\AOL Companion
2008-01-10 12:55 --------- d-----w C:\Program Files\America Online 9.0
2008-01-10 02:33 --------- d-----w C:\Program Files\Common Files\Scanner
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"EPSON Stylus Photo R200 Series (from PI-SBS-1)"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2H1.exe" [2003-07-08 02:00 99840]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 04:25 6731312]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoWelcomeScreen"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdwareAlert]
C:\Program Files\AdwareAlert\AdwareAlert.exe

R0 MacOpen;MacOpen;C:\WINDOWS\system32\drivers\MacOpen.sys [2002-07-02 14:04]

.
Contents of the 'Scheduled Tasks' folder
"2008-02-12 08:00:00 C:\WINDOWS\Tasks\AdwareAlert Scheduled Scan.job"
- C:\Program Files\AdwareAlert\AdwareAlert.ex
- C:\Program Files\AdwareAlert
"2008-02-12 18:21:48 C:\WINDOWS\Tasks\MP Scheduled Scan.job"
- C:\Program Files\Windows Defender\MpCmdRun.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-12 20:24:35
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-02-12 20:25:26
ComboFix-quarantined-files.txt 2008-02-13 01:25:16
ComboFix2.txt 2008-02-12 18:22:50
ComboFix3.txt 2008-02-04 22:50:48
ComboFix4.txt 2008-02-04 15:21:40
ComboFix5.txt 2008-02-04 13:37:06
.
2008-02-06 01:41:34 --- E O F ---
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:26, on 2008-02-12
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\system32\basfipm.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Conversions Plus\FORMATM.EXE
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Symantec AntiVirus\SavRoam.exe
C:\WINDOWS\wanmpsvc.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\WINDOWS\system32\WISPTIS.EXE
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\rdpclip.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2H1.EXE
C:\WINDOWS\explorer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O4 - HKLM\..\Run: [EPSON Stylus Photo R200 Series (from PI-SBS-1)] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2H1.EXE /P46 "EPSON Stylus Photo R200 Series (from PI-SBS-1)" /O5 "TS001" /M "Stylus Photo R200"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = primeinteriors.local
O17 - HKLM\Software\..\Telephony: DomainName = primeinteriors.local
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = primeinteriors.local
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
O23 - Service: AOL Spyware Protection Service (AOLService) - Unknown owner - C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\\aolserv.exe (file missing)
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Broadcom ASF IP monitoring service v6.0.4 (BAsfIpM) - Broadcom Corp. - C:\WINDOWS\system32\basfipm.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: MacFormatService - DataViz Inc. - C:\Program Files\Conversions Plus\FORMATM.EXE
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

--
End of file - 3911 bytes




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users