Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Win32 Nsanti


  • Please log in to reply
2 replies to this topic

#1 basket311077

basket311077

  • Members
  • 2 posts
  • OFFLINE
  •  
  • Local time:02:28 PM

Posted 06 March 2008 - 02:35 AM

Hello, recently my computer got infected with this virus Win32 NSanti. I`m using avg free edition and it detected it a few times, moving it to the vaults and emptying it did not seem to help as it kept comming back. After reading a few threads with similar problems i used superantispyware to scan my computer and it detected kavo.exe which it removed. As the problem still presisted, i used combofix and it automatically removed kavo0.exe, kavo1.exe and the autorun.inf's. My computer has 5 different partitions(4 internal drives and 1 external drive) and while hijackthis does not detect the kavo.exe anymore, recently avg detected nsanti in the system32/restore and moved it to the vault. so could i get some help in comfirming whether my computer is clean? i`m not sure if the other 3 partitions other than C: is clear as well since only the autorun.inf was removed from those drives, is there anything i need to delete from the drives? The thumbdrive that infected my com might be infected and i`m not too sure what i should do about it since plugging it back in to do anything might infect my computer. below is my hijack this log file and combofix log, any help is appreciated thanks.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 4:28:35 PM, on 3/6/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\UStorSrv.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe
C:\WINDOWS\system32\CTHELPER.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Imation\ImationFlashDetect.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [SBDrvDet] C:\Program Files\Creative\SB Drive Det\SBDrvDet.exe /r
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe /r
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'Default user')
O4 - Startup: ImationFlashDetect.lnk = C:\Program Files\Imation\ImationFlashDetect.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/...b?1166506776453
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: UStorage Server Service - OTi - C:\WINDOWS\system32\UStorSrv.exe
O23 - Service: USBest Service Zero (UTSCSI) - Unknown owner - C:\WINDOWS\system32\UTSCSI.EXE

--
End of file - 6171 bytes


ComboFix 08-03-04.5 - andrew 2008-03-06 16:22:53.4 - NTFSx86
Running from: C:\Documents and Settings\andrew\Desktop\ComboFix.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((( Files Created from 2008-02-06 to 2008-03-06 )))))))))))))))))))))))))))))))
.

2008-02-29 05:30 . 2008-03-04 19:02 4,933,048 --a------ C:\WINDOWS\{00000004-00000000-00000001-00001102-00000008-10011102}.CDF
2008-02-29 05:30 . 2008-02-29 05:30 4,933,048 --a------ C:\WINDOWS\{00000004-00000000-00000001-00001102-00000008-10011102}.BAK
2008-02-29 05:29 . 2008-03-04 18:08 30,624 --a------ C:\WINDOWS\system32\BMXStateBkp-{00000004-00000000-00000001-00001102-00000008-10011102}.rfx
2008-02-29 05:29 . 2008-03-04 18:08 30,624 --a------ C:\WINDOWS\system32\BMXState-{00000004-00000000-00000001-00001102-00000008-10011102}.rfx
2008-02-29 05:29 . 2008-03-04 18:08 29,772 --a------ C:\WINDOWS\system32\BMXCtrlState-{00000004-00000000-00000001-00001102-00000008-10011102}.rfx
2008-02-29 05:29 . 2008-03-04 18:08 29,772 --a------ C:\WINDOWS\system32\BMXBkpCtrlState-{00000004-00000000-00000001-00001102-00000008-10011102}.rfx
2008-02-29 05:29 . 2008-03-04 18:08 2,796 --a------ C:\WINDOWS\system32\DVCState-{00000004-00000000-00000001-00001102-00000008-10011102}.rfx
2008-02-29 05:29 . 2008-03-04 18:08 1,080 --a------ C:\WINDOWS\system32\settingsbkup.sfm
2008-02-29 05:29 . 2008-03-04 18:08 1,080 --a------ C:\WINDOWS\system32\settings.sfm
2008-02-29 05:27 . 2008-02-29 05:27 <DIR> d-------- C:\WINDOWS\system32\Defaults
2008-02-29 05:27 . 1998-01-08 09:00 1,048,576 --------- C:\WINDOWS\system32\SFMAN.DAT
2008-02-29 05:27 . 2000-05-11 01:00 90,112 --------- C:\WINDOWS\Updreg.EXE
2008-02-29 05:27 . 1998-06-05 10:00 84,992 --------- C:\WINDOWS\system32\SFCVRT32.DLL
2008-02-29 05:27 . 1995-08-30 10:02 82,432 --------- C:\WINDOWS\system32\CTWFLT32.DLL
2008-02-29 05:27 . 1998-10-20 16:05 54,784 --------- C:\WINDOWS\system32\INETWH32.DLL
2008-02-29 05:27 . 1994-12-05 11:11 53,552 --------- C:\WINDOWS\CTCCW.DLL
2008-02-29 05:27 . 1995-07-13 10:01 26,768 --------- C:\WINDOWS\system32\CTL3D.DLL
2008-02-29 05:27 . 1996-05-23 10:24 24,976 --------- C:\WINDOWS\CTRES.DLL
2008-02-29 05:27 . 1999-01-14 14:04 231 --------- C:\WINDOWS\AC3API.INI
2008-02-29 05:25 . 2000-12-05 09:11 4,174,814 --a------ C:\WINDOWS\system32\CT4MGM.SF2
2008-02-29 05:25 . 1999-09-22 23:18 2,167,684 --a------ C:\WINDOWS\system32\CT2MGM.SF2
2008-02-29 05:25 . 2000-02-25 12:49 1,048,576 --a------ C:\WINDOWS\system32\CT1MGM.ROM
2008-02-29 05:25 . 2004-03-16 10:37 118,868 --a------ C:\WINDOWS\system32\commonfx.dll
2008-02-26 01:20 . 2008-03-04 18:03 <DIR> d-------- C:\Program Files\SUPERAntiSpyware
2008-02-26 01:20 . 2008-02-26 01:20 <DIR> d-------- C:\Documents and Settings\andrew\Application Data\SUPERAntiSpyware.com
2008-02-26 01:20 . 2008-02-26 01:20 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2008-02-26 00:04 . 2008-02-26 00:04 <DIR> d-------- C:\Program Files\Trend Micro
2008-02-25 23:32 . 2008-02-25 23:33 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\AVG7
2008-02-25 23:21 . 2008-02-25 23:21 8,192 --ahs---- C:\WINDOWS\system32\Thumbs.db

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-03-06 08:22 --------- d-----w C:\Documents and Settings\andrew\Application Data\Azureus
2008-03-06 07:33 --------- d-----w C:\Documents and Settings\andrew\Application Data\AVG7
2008-03-05 19:07 --------- d-----w C:\Program Files\DC++
2008-03-05 19:06 --------- d-----w C:\Program Files\Warcraft III
2008-02-28 21:34 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-02-28 21:27 --------- d-----w C:\Program Files\Creative
2008-02-28 21:26 --------- d-----w C:\Documents and Settings\andrew\Application Data\Creative
2008-02-26 20:29 --------- d-----w C:\Program Files\mIRC
2008-02-25 15:44 102,664 ----a-w C:\WINDOWS\system32\drivers\tmcomm.sys
2007-12-29 10:31 729,088 ----a-w C:\WINDOWS\iun6002.exe
2007-12-29 09:01 139,264 ----a-w C:\WINDOWS\War3Unin.exe
2007-12-07 02:21 824,832 ----a-w C:\WINDOWS\system32\wininet.dll
2007-03-24 14:34 38,664 ----a-w C:\Documents and Settings\andrew\Application Data\GDIPFONTCACHEV1.DAT
2006-07-30 15:20 959 --sha-r C:\WINDOWS\system32\autorun.bin
2001-10-29 14:00 61,440 --sha-r C:\WINDOWS\system32\Autorun.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 20:00 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SBDrvDet"="C:\Program Files\Creative\SB Drive Det\SBDrvDet.exe" [2002-12-03 18:06 45056]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-03-22 10:50 8425472]
"nwiz"="nwiz.exe" [2007-03-22 10:50 1622016 C:\WINDOWS\system32\nwiz.exe]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50 155648]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496]
"IMJPMIG8.1"="C:\WINDOWS\IME\imjp8_1\IMJPMIG.exe" [2004-08-04 20:00 208952]
"MSPY2002"="C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-04 20:00 59392]
"PHIME2002ASync"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-04 20:00 455168]
"PHIME2002A"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-04 20:00 455168]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe" [2007-12-21 23:49 579072]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2007-05-14 11:41 180269]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-03-22 10:50 81920]
"CTSysVol"="C:\Program Files\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe" [2003-09-17 10:43 57344]
"CTHelper"="CTHELPER.EXE" [2004-03-19 16:33 24576 C:\WINDOWS\system32\CTHELPER.EXE]
"UpdReg"="C:\WINDOWS\UpdReg.EXE" [2000-05-11 01:00 90112]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 22:16 39792]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"AVG7_Run"="C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe" [2007-10-26 10:49 219136]

C:\Documents and Settings\andrew\Start Menu\Programs\Startup\
ImationFlashDetect.lnk - C:\Program Files\Imation\ImationFlashDetect.exe [2007-03-16 22:46:12 806912]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"C:\\Program Files\\MSN Messenger\\livecall.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\DC++\\DCPlusPlus.exe"=
"C:\\Program Files\\Azureus\\Azureus.exe"=
"C:\\Program Files\\mIRC\\mirc.exe"=
"C:\\Program Files\\Warcraft III\\Warcraft III.exe"=
"C:\\Program Files\\Internet Explorer\\iexplore.exe"=
"C:\\Program Files\\GRISOFT\\AVG Free\\avginet.exe"=
"C:\\Program Files\\GRISOFT\\AVG Free\\avgamsvr.exe"=
"C:\\Program Files\\GRISOFT\\AVG Free\\avgcc.exe"=
"C:\\Program Files\\GRISOFT\\AVG Free\\avgemc.exe"=
"C:\\WINDOWS\\system32\\dplaysvr.exe"=
"C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"C:\\WINDOWS\\pchealth\\helpctr\\binaries\\HelpCtr.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"13579:UDP"= 13579:UDP:azureus

S3 WUSB54GPV4SRV;Linksys Home Wireless-G USB Adaptor Driver;C:\WINDOWS\system32\DRIVERS\rt2500usb.sys [2005-10-17 19:50]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\E]
\Shell\AutoRun\command - E:\
\Shell\explore\Command - WScript.exe .\autorun.vbs
\Shell\open\Command - WScript.exe .\autorun.vbs

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{433eb8c8-e341-11db-898d-0014850bef3a}]
\Shell\AutoRun\command - G:\tmf3w3g0.com
\Shell\explore\Command - G:\tmf3w3g0.com
\Shell\open\Command - G:\tmf3w3g0.com

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9751dae8-637a-11dc-ac3a-0014850bef3a}]
\Shell\AutoRun\command - I:\Launch.exe

.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-06 16:24:52
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

**************************************************************************
.
Completion time: 2008-03-06 16:26:31
.
2008-02-15 02:04:56 --- E O F ---

BC AdBot (Login to Remove)

 


#2 basket311077

basket311077
  • Topic Starter

  • Members
  • 2 posts
  • OFFLINE
  •  
  • Local time:02:28 PM

Posted 06 March 2008 - 09:40 AM

i connected my external hard drive and avg detected and removed win32 nsanti again, so i redid everything i did before to clear it up again. Namely running superantispyware and combofix. So heres a new hijackthis and combofix log

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:35:15 PM, on 3/6/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\UStorSrv.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe
C:\WINDOWS\system32\CTHELPER.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Imation\ImationFlashDetect.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\WINDOWS\explorer.exe
C:\Program Files\DC++\DCPlusPlus.exe
C:\Program Files\Winamp\winamp.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Azureus\Azureus.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [SBDrvDet] C:\Program Files\Creative\SB Drive Det\SBDrvDet.exe /r
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe /r
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'Default user')
O4 - Startup: ImationFlashDetect.lnk = C:\Program Files\Imation\ImationFlashDetect.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/...b?1166506776453
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: UStorage Server Service - OTi - C:\WINDOWS\system32\UStorSrv.exe
O23 - Service: USBest Service Zero (UTSCSI) - Unknown owner - C:\WINDOWS\system32\UTSCSI.EXE

--
End of file - 6496 bytes

ComboFix 08-03-04.5 - andrew 2008-03-06 22:56:38.6 - NTFSx86
Running from: C:\Documents and Settings\andrew\Desktop\ComboFix.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((( Files Created from 2008-02-06 to 2008-03-06 )))))))))))))))))))))))))))))))
.

2008-03-06 22:31 . 2008-03-06 22:31 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-02-29 05:30 . 2008-03-06 16:45 4,933,048 --a------ C:\WINDOWS\{00000004-00000000-00000001-00001102-00000008-10011102}.CDF
2008-02-29 05:30 . 2008-02-29 05:30 4,933,048 --a------ C:\WINDOWS\{00000004-00000000-00000001-00001102-00000008-10011102}.BAK
2008-02-29 05:29 . 2008-03-06 16:44 30,624 --a------ C:\WINDOWS\system32\BMXStateBkp-{00000004-00000000-00000001-00001102-00000008-10011102}.rfx
2008-02-29 05:29 . 2008-03-06 16:44 30,624 --a------ C:\WINDOWS\system32\BMXState-{00000004-00000000-00000001-00001102-00000008-10011102}.rfx
2008-02-29 05:29 . 2008-03-06 16:44 29,772 --a------ C:\WINDOWS\system32\BMXCtrlState-{00000004-00000000-00000001-00001102-00000008-10011102}.rfx
2008-02-29 05:29 . 2008-03-06 16:44 29,772 --a------ C:\WINDOWS\system32\BMXBkpCtrlState-{00000004-00000000-00000001-00001102-00000008-10011102}.rfx
2008-02-29 05:29 . 2008-03-06 16:44 2,796 --a------ C:\WINDOWS\system32\DVCState-{00000004-00000000-00000001-00001102-00000008-10011102}.rfx
2008-02-29 05:29 . 2008-03-06 16:44 1,080 --a------ C:\WINDOWS\system32\settingsbkup.sfm
2008-02-29 05:29 . 2008-03-06 16:44 1,080 --a------ C:\WINDOWS\system32\settings.sfm
2008-02-29 05:27 . 2008-02-29 05:27 <DIR> d-------- C:\WINDOWS\system32\Defaults
2008-02-29 05:27 . 1998-01-08 09:00 1,048,576 --------- C:\WINDOWS\system32\SFMAN.DAT
2008-02-29 05:27 . 2000-05-11 01:00 90,112 --------- C:\WINDOWS\Updreg.EXE
2008-02-29 05:27 . 1998-06-05 10:00 84,992 --------- C:\WINDOWS\system32\SFCVRT32.DLL
2008-02-29 05:27 . 1995-08-30 10:02 82,432 --------- C:\WINDOWS\system32\CTWFLT32.DLL
2008-02-29 05:27 . 1998-10-20 16:05 54,784 --------- C:\WINDOWS\system32\INETWH32.DLL
2008-02-29 05:27 . 1994-12-05 11:11 53,552 --------- C:\WINDOWS\CTCCW.DLL
2008-02-29 05:27 . 1995-07-13 10:01 26,768 --------- C:\WINDOWS\system32\CTL3D.DLL
2008-02-29 05:27 . 1996-05-23 10:24 24,976 --------- C:\WINDOWS\CTRES.DLL
2008-02-29 05:27 . 1999-01-14 14:04 231 --------- C:\WINDOWS\AC3API.INI
2008-02-29 05:25 . 2000-12-05 09:11 4,174,814 --a------ C:\WINDOWS\system32\CT4MGM.SF2
2008-02-29 05:25 . 1999-09-22 23:18 2,167,684 --a------ C:\WINDOWS\system32\CT2MGM.SF2
2008-02-29 05:25 . 2000-02-25 12:49 1,048,576 --a------ C:\WINDOWS\system32\CT1MGM.ROM
2008-02-29 05:25 . 2004-03-16 10:37 118,868 --a------ C:\WINDOWS\system32\commonfx.dll
2008-02-26 01:20 . 2008-03-06 22:31 <DIR> d-------- C:\Program Files\SUPERAntiSpyware
2008-02-26 01:20 . 2008-03-06 22:31 <DIR> d-------- C:\Documents and Settings\andrew\Application Data\SUPERAntiSpyware.com
2008-02-26 01:20 . 2008-02-26 01:20 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2008-02-26 00:04 . 2008-02-26 00:04 <DIR> d-------- C:\Program Files\Trend Micro
2008-02-25 23:32 . 2008-02-25 23:33 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\AVG7
2008-02-25 23:21 . 2008-02-25 23:21 8,192 --ahs---- C:\WINDOWS\system32\Thumbs.db

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-03-06 14:56 --------- d-----w C:\Documents and Settings\andrew\Application Data\Azureus
2008-03-06 14:28 --------- d-----w C:\Program Files\Warcraft III
2008-03-06 07:33 --------- d-----w C:\Documents and Settings\andrew\Application Data\AVG7
2008-03-05 19:07 --------- d-----w C:\Program Files\DC++
2008-02-28 21:34 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-02-28 21:27 --------- d-----w C:\Program Files\Creative
2008-02-28 21:26 --------- d-----w C:\Documents and Settings\andrew\Application Data\Creative
2008-02-26 20:29 --------- d-----w C:\Program Files\mIRC
2008-02-25 15:44 102,664 ----a-w C:\WINDOWS\system32\drivers\tmcomm.sys
2007-12-29 10:31 729,088 ----a-w C:\WINDOWS\iun6002.exe
2007-12-29 09:01 139,264 ----a-w C:\WINDOWS\War3Unin.exe
2007-12-07 02:21 824,832 ----a-w C:\WINDOWS\system32\wininet.dll
2007-03-24 14:34 38,664 ----a-w C:\Documents and Settings\andrew\Application Data\GDIPFONTCACHEV1.DAT
2006-07-30 15:20 959 --sha-r C:\WINDOWS\system32\autorun.bin
2001-10-29 14:00 61,440 --sha-r C:\WINDOWS\system32\Autorun.exe
.

((((((((((((((((((((((((((((( snapshot@2008-03-06_16.25.16.07 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-03-06 14:31:39 18,944 ----a-r C:\WINDOWS\Installer\{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}\IconCDDCBBF13.exe
+ 2008-03-06 14:31:39 65,024 ----a-r C:\WINDOWS\Installer\{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}\IconCDDCBBF15.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 20:00 15360]
"SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2008-02-29 16:03 1481968]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SBDrvDet"="C:\Program Files\Creative\SB Drive Det\SBDrvDet.exe" [2002-12-03 18:06 45056]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-03-22 10:50 8425472]
"nwiz"="nwiz.exe" [2007-03-22 10:50 1622016 C:\WINDOWS\system32\nwiz.exe]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50 155648]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496]
"IMJPMIG8.1"="C:\WINDOWS\IME\imjp8_1\IMJPMIG.exe" [2004-08-04 20:00 208952]
"MSPY2002"="C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-04 20:00 59392]
"PHIME2002ASync"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-04 20:00 455168]
"PHIME2002A"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-04 20:00 455168]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe" [2007-12-21 23:49 579072]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2007-05-14 11:41 180269]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-03-22 10:50 81920]
"CTSysVol"="C:\Program Files\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe" [2003-09-17 10:43 57344]
"CTHelper"="CTHELPER.EXE" [2004-03-19 16:33 24576 C:\WINDOWS\system32\CTHELPER.EXE]
"UpdReg"="C:\WINDOWS\UpdReg.EXE" [2000-05-11 01:00 90112]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 22:16 39792]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"AVG7_Run"="C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe" [2007-10-26 10:49 219136]

C:\Documents and Settings\andrew\Start Menu\Programs\Startup\
ImationFlashDetect.lnk - C:\Program Files\Imation\ImationFlashDetect.exe [2007-03-16 22:46:12 806912]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2006-12-20 12:55 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
C:\Program Files\SUPERAntiSpyware\SASWINLO.dll 2007-04-19 12:41 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"C:\\Program Files\\MSN Messenger\\livecall.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\DC++\\DCPlusPlus.exe"=
"C:\\Program Files\\Azureus\\Azureus.exe"=
"C:\\Program Files\\mIRC\\mirc.exe"=
"C:\\Program Files\\Warcraft III\\Warcraft III.exe"=
"C:\\Program Files\\Internet Explorer\\iexplore.exe"=
"C:\\Program Files\\GRISOFT\\AVG Free\\avginet.exe"=
"C:\\Program Files\\GRISOFT\\AVG Free\\avgamsvr.exe"=
"C:\\Program Files\\GRISOFT\\AVG Free\\avgcc.exe"=
"C:\\Program Files\\GRISOFT\\AVG Free\\avgemc.exe"=
"C:\\WINDOWS\\system32\\dplaysvr.exe"=
"C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"C:\\WINDOWS\\pchealth\\helpctr\\binaries\\HelpCtr.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"13579:UDP"= 13579:UDP:azureus

S3 WUSB54GPV4SRV;Linksys Home Wireless-G USB Adaptor Driver;C:\WINDOWS\system32\DRIVERS\rt2500usb.sys [2005-10-17 19:50]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\E]
\Shell\AutoRun\command - E:\
\Shell\explore\Command - WScript.exe .\autorun.vbs
\Shell\open\Command - WScript.exe .\autorun.vbs

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{433eb8c8-e341-11db-898d-0014850bef3a}]
\Shell\AutoRun\command - G:\tmf3w3g0.com
\Shell\explore\Command - G:\tmf3w3g0.com
\Shell\open\Command - G:\tmf3w3g0.com

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9751dae8-637a-11dc-ac3a-0014850bef3a}]
\Shell\AutoRun\command - I:\Launch.exe

*Newly Created Service* - SASDIFSV
*Newly Created Service* - SASENUM
*Newly Created Service* - SASKUTIL
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-06 22:58:47
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-03-06 22:59:55
ComboFix2.txt 2008-03-06 08:40:56
ComboFix3.txt 2008-03-06 08:26:32
.
2008-02-15 02:04:56 --- E O F ---

#3 rookie147

rookie147

  • Members
  • 5,321 posts
  • OFFLINE
  •  
  • Local time:07:28 AM

Posted 24 March 2008 - 05:13 PM

Hello there and welcome to BleepingComputer. My name is Charles and I will be dealing with your log today.
As you can probably see our HijackThis Team is incredibly busy at the moment, but I apologise for the delay you have experienced. If you are still having problems please post a brand new HijackThis log as a reply to this topic. Before posting the log, please make sure you follow all the steps found in this topic:
Preparation Guide For Use Before Posting A HijackThis Log
Thanks,
Charles

If you are pleased with the service I have offered, you may like to consider making a donation. Posted Image
Posted Image





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users