Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Smitfraud C Core Service Removal


  • This topic is locked This topic is locked
27 replies to this topic

#1 mr2face

mr2face

  • Members
  • 14 posts
  • OFFLINE
  •  
  • Local time:10:31 AM

Posted 24 May 2008 - 12:17 AM

ok this one could be weird; i know i have malware cos i am getting avg notifications about win32/agent infection in winnt32.dll. actually it could be both malware and spyware.
also, whenever i run spybot (usually in safe mode), i always get a notification about the smitfraud c core service running. I remove it everytime and every time i run a scan it pops up. Worse still, if i go to another user profile and login in safe mode, it shows the same problem, even if i've just removed it.

i'm running avg 8 anti virus with webshield disabled, and comodo free firewall cos i thought it's nice and light. i've posted the hijackthis log as well for some kind expert to review.

now what i've done: i've already used the smitfraudfix from S!ri in both regular and safe mode. and in both profiles- no luck. also done spybot as mentioned with the current updates.

Thanks in advance for all your kind help.

Attached Files


Edited by mr2face, 24 May 2008 - 01:10 AM.


BC AdBot (Login to Remove)

 


#2 chryssi2001

chryssi2001

  • Members
  • 1,930 posts
  • OFFLINE
  •  
  • Local time:06:31 PM

Posted 24 May 2008 - 01:47 AM

Hello mr2face,

I will be assisting you with your malware issues.
  • Whatever repairs we make, are for fixing your computer problems only and by no means should be used on another computer.
  • Continue to respond to this thread until I give you the All Clean! If you have any question or you're stuck in there please reply it to me. I will try my best to help you!
  • Please bookmark or favourite this page. In case you need it as reference or etc.
IMPORTANT NOTE:
If you are using Windows Vista you must right click on the desktop icon and choose Run as Administrator all tools.
----------------------------------------------
Please visit this webpage for instructions for downloading ComboFix at your DESKTOP :
http://www.bleepingcomputer.com/combofix/how-to-use-combofix
Please ensure you read this guide carefully and install the Recovery Console first.

Additional links to download the tool:
http://download.bleepingcomputer.com/sUBs/ComboFix.exe
http://www.forospyware.com/sUBs/ComboFix.exe
http://subs.geekstogo.com/ComboFix.exe

Note: The Windows Recovery Console will allow you to boot up into a special recovery (repair) mode. This allows us to more easily help you should your computer have a problem after an attempted removal of malware. It is a simple procedure that will only take a few moments of your time.

Once installed, you should see a blue screen prompt that says:

The Recovery Console was successfully installed.

Please continue as follows:
  • Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
  • Click Yes to allow ComboFix to continue scanning for malware.
  • When the tool is finished, it will produce a report for you.
  • Please post the C:\ComboFix.txt .
----------------------------------------------
Post back:
Combofix report.
A new HijackThis log.
Posted Image
Private Messages for personal support will be ignored. If you need help post in the forum.

#3 mr2face

mr2face
  • Topic Starter

  • Members
  • 14 posts
  • OFFLINE
  •  
  • Local time:10:31 AM

Posted 25 May 2008 - 10:53 PM

hi Chrissy,
thanks a ton. I didn't get a notification that i had a reply to my post, so i apologize for the delay in responding. I will download these tools and come back to you ASAP. Thanks again.

#4 chryssi2001

chryssi2001

  • Members
  • 1,930 posts
  • OFFLINE
  •  
  • Local time:06:31 PM

Posted 26 May 2008 - 02:23 AM

Hello mr2face,

That's fine, i'll be here.

Be sure you activate your emails in your profile so you won't miss them. :thumbsup:
Posted Image
Private Messages for personal support will be ignored. If you need help post in the forum.

#5 mr2face

mr2face
  • Topic Starter

  • Members
  • 14 posts
  • OFFLINE
  •  
  • Local time:10:31 AM

Posted 26 May 2008 - 11:57 PM

hi Chrissy,
So i ran Combofix in safe mode (i figured it would be better). So now im not getting a winnt.dll AVG notification on startup, but i don't see the log file anywhere. Did i miss the location or an option? Please let me know. Also, i should mention that i've seen some strange looking emails in my junk mail folders marked as bounced messages.

#6 chryssi2001

chryssi2001

  • Members
  • 1,930 posts
  • OFFLINE
  •  
  • Local time:06:31 PM

Posted 27 May 2008 - 01:49 AM

Hello mr2face,

You will find the report here:

C:\ComboFix.txt
Posted Image
Private Messages for personal support will be ignored. If you need help post in the forum.

#7 mr2face

mr2face
  • Topic Starter

  • Members
  • 14 posts
  • OFFLINE
  •  
  • Local time:10:31 AM

Posted 27 May 2008 - 02:09 AM

thanks Chrissy. I found this at c:\combofix\combofix.txt

Attached Files



#8 chryssi2001

chryssi2001

  • Members
  • 1,930 posts
  • OFFLINE
  •  
  • Local time:06:31 PM

Posted 27 May 2008 - 02:19 AM

Hi, thanks i will check it out.

Please visit again my Combofix link, and install Recovery Console.

When the tool ask you to run again, just say No, and exit the tool.

I will be back as soon as i check your report.

Can you also please post a new HijackThis log?
Posted Image
Private Messages for personal support will be ignored. If you need help post in the forum.

#9 chryssi2001

chryssi2001

  • Members
  • 1,930 posts
  • OFFLINE
  •  
  • Local time:06:31 PM

Posted 27 May 2008 - 02:26 AM

mr2face,

Your Combofix report was cut off.

Please repost it, but not as an attachment please.

I do need all the reports to posted properly. Not as attachments.
Posted Image
Private Messages for personal support will be ignored. If you need help post in the forum.

#10 mr2face

mr2face
  • Topic Starter

  • Members
  • 14 posts
  • OFFLINE
  •  
  • Local time:10:31 AM

Posted 27 May 2008 - 02:48 AM

hi Chrissy,
here's the new hijackthis log. I have also installed the recovery console. Please advise next steps.

Attached Files



#11 mr2face

mr2face
  • Topic Starter

  • Members
  • 14 posts
  • OFFLINE
  •  
  • Local time:10:31 AM

Posted 27 May 2008 - 02:51 AM

hi Chrissy, just saw your post about the log getting cut off.
here is the combofix log.
ComboFix 08-05-25.3 - House 2008-05-26 13:09:06.1 - NTFSx86 MINIMAL
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.787 [GMT 5.5:30]
Running from: C:\Documents and Settings\House\Desktop\ComboFix.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\temp\tn3
C:\WINDOWS\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Windows Media\10.0\WMSDKNSD.XML
C:\WINDOWS\system32\drivers\core.cache.dsk
C:\WINDOWS\system32\drivers\Ovd75.sys
C:\WINDOWS\system32\drivers\serscann.sys
C:\WINDOWS\system32\lsprst7.dll
C:\WINDOWS\system32\oledb32.dll
C:\WINDOWS\system32\pmnli.dll
C:\WINDOWS\system32\setup.ini
C:\WINDOWS\system32\ssprs.dll
C:\WINDOWS\system32\WinNt32.dll
C:\WINDOWS\system32\WLCtrl32.dll

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_FCI
-------\Legacy_NNSERV
-------\Legacy_NPF
-------\Legacy_OVD75
-------\Legacy_SERSCANN
-------\Legacy_TCPSR
-------\Service_FCI
-------\Service_NNServ
-------\Service_NPF
-------\Service_Ovd75
-------\Service_serscann
-------\Service_tcpsr


((((((((((((((((((((((((( Files Created from 2008-04-26 to 2008-05-26 )))))))))))))))))))))))))))))))
.

2008-05-24 10:29 . 2008-05-24 10:29 <DIR> d-------- C:\Deckard
2008-05-23 15:02 . 2008-04-02 14:58 676,224 --a------ C:\WINDOWS\system32\OGACheckControl.dll
2008-05-18 22:22 . 2008-05-18 22:22 <DIR> d-------- C:\WINDOWS\system32\LogFiles
2008-05-16 19:20 . 2008-05-16 19:20 <DIR> d-------- C:\Program Files\Common Files\Macrovision Shared
2008-05-16 19:20 . 2008-05-17 10:55 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\FLEXnet
2008-05-15 21:25 . 2008-05-26 11:58 <DIR> d--h----- C:\$AVG8.VAULT$
2008-05-15 21:22 . 2008-05-15 21:22 <DIR> d-------- C:\Program Files\COMODO
2008-05-15 21:22 . 2008-05-15 21:22 <DIR> d-------- C:\Documents and Settings\House\Application Data\Comodo
2008-05-15 21:22 . 2008-05-15 21:30 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\comodo
2008-05-15 21:22 . 2008-05-15 21:22 139,008 --a------ C:\WINDOWS\system32\guard32.dll
2008-05-15 21:22 . 2008-05-15 21:22 87,312 --a------ C:\WINDOWS\system32\drivers\cmdguard.sys
2008-05-15 21:22 . 2008-05-15 21:22 23,824 --a------ C:\WINDOWS\system32\drivers\cmdhlp.sys
2008-05-15 21:09 . 2008-05-26 12:13 <DIR> d-------- C:\WINDOWS\system32\drivers\Avg
2008-05-15 21:09 . 2008-05-15 21:09 <DIR> d-------- C:\Program Files\AVG
2008-05-15 21:09 . 2008-05-15 21:43 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\avg8
2008-05-15 21:09 . 2008-05-15 21:09 96,520 --a------ C:\WINDOWS\system32\drivers\avgldx86.sys
2008-05-15 21:09 . 2008-05-15 21:09 75,272 --a------ C:\WINDOWS\system32\drivers\avgtdix.sys
2008-05-15 21:09 . 2008-05-15 21:09 12,424 --a------ C:\WINDOWS\system32\drivers\avgrkx86.sys
2008-05-15 21:09 . 2008-05-15 21:09 10,520 --a------ C:\WINDOWS\system32\avgrsstx.dll
2008-05-15 17:58 . 2008-05-15 17:58 <DIR> d--h----- C:\Documents and Settings\Administrator\Application Data\GTek
2008-05-15 16:43 . 2008-05-15 16:43 17,408 --a------ C:\WINDOWS\system32\dxdllreg.exe
2008-05-14 18:34 . 2008-05-14 18:34 0 --a------ C:\law.sp
2008-05-14 18:32 . 2008-05-14 18:33 <DIR> d-------- C:\fd8188774c41cd0dd2586c41e457
2008-05-10 18:25 . 2008-05-16 16:49 <DIR> d-------- C:\Program Files\MXSkypeRec
2008-05-10 18:25 . 2008-05-10 18:25 133 --a------ C:\WINDOWS\MXSkypeRecorder.INI
2008-05-10 18:23 . 2008-05-10 18:23 <DIR> d-------- C:\temp\MX.Skype.Recorder.v3.5.WinAll.Incl.Keygen-CRD
2008-05-10 17:44 . 2008-05-10 17:44 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Bluetooth
2008-05-10 17:23 . 2008-05-10 17:23 <DIR> d-------- C:\Program Files\IVT Corporation
2008-05-10 17:23 . 2002-11-24 01:47 148,830 --------- C:\WINDOWS\system32\drivers\bcbthub.sys
2008-05-08 13:52 . 2008-05-08 13:52 405,208 --a------ C:\temp\btwinitialupdate.exe
2008-05-07 13:14 . 2008-05-07 13:14 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Hagel Technologies
2008-05-06 10:42 . 2008-05-06 10:43 3,332 --a------ C:\WINDOWS\wsnk.his
2008-05-06 10:42 . 2008-05-06 10:43 1,229 --a------ C:\WINDOWS\wsnk.ini
2008-05-06 10:20 . 2008-05-06 10:45 141,388 --------- C:\WINDOWS\hpwins05.dat.temp
2008-05-06 10:20 . 2006-09-08 01:11 3,953 --------- C:\WINDOWS\hpwmdl05.dat.temp
2008-05-02 12:06 . 2008-05-02 12:56 <DIR> d-------- C:\Program Files\HP Wireless Printer Adapter
2008-05-02 12:06 . 2006-12-19 16:00 37,248 --a------ C:\WINDOWS\system32\hpnuhub.sys
2008-05-02 12:06 . 2006-12-19 16:00 37,248 --a------ C:\WINDOWS\system32\drivers\hpnuhub.sys
2008-05-02 12:06 . 2006-12-19 16:00 11,648 --a------ C:\WINDOWS\system32\hpnucmp.sys
2008-05-02 12:06 . 2006-12-19 16:00 11,648 --a------ C:\WINDOWS\system32\drivers\hpnucmp.sys
2008-05-02 12:06 . 2006-12-19 16:00 11,136 --a------ C:\WINDOWS\system32\drivers\hpnuhst.sys
2008-05-02 12:06 . 2007-01-24 05:58 10,718 --a------ C:\WINDOWS\system32\hpnuhub.cat
2008-05-02 12:06 . 2007-01-23 22:27 10,698 --a------ C:\WINDOWS\system32\hpnucmp.cat
2008-05-02 12:06 . 2006-12-19 15:45 1,314 --a------ C:\WINDOWS\system32\hpnuhub.inf
2008-05-02 12:06 . 2006-12-19 15:45 1,310 --a------ C:\WINDOWS\system32\hpnucmp.inf
2008-05-02 12:02 . 2008-05-02 12:02 <DIR> d-------- C:\WINDOWS\OPTIONS
2008-05-02 12:02 . 2008-05-02 12:02 <DIR> d-------- C:\Program Files\HP Wireless Adapter
2008-05-02 12:02 . 2006-08-15 11:10 189,440 --a------ C:\WINDOWS\system32\drivers\HPL8187.SYS
2008-05-02 12:02 . 2006-05-12 13:31 68,864 --a------ C:\WINDOWS\system32\drivers\HPEAPPkt.sys
2008-05-02 12:02 . 2002-10-02 09:57 13,532 --a------ C:\WINDOWS\system32\drivers\SjyPkt.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-05-26 07:48 --------- d-----w C:\Documents and Settings\House\Application Data\Skype
2008-05-23 05:00 --------- d-----w C:\Documents and Settings\House\Application Data\uTorrent
2008-05-20 14:44 --------- d-----w C:\Documents and Settings\All Users\Application Data\Microsoft Help
2008-05-20 12:50 --------- d-----w C:\Program Files\SPSSEVAL
2008-05-20 12:34 --------- d-----w C:\Program Files\Microsoft ActiveSync
2008-05-16 13:50 --------- d-----w C:\Program Files\Common Files\Adobe
2008-05-15 16:23 --------- d-----w C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-05-15 14:33 1,950 ----a-w C:\WINDOWS\system32\tmp.reg
2008-05-15 12:00 --------- d-----w C:\Program Files\Spybot - Search & Destroy
2008-05-15 11:37 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-05-10 11:53 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-04-24 11:12 --------- d-----w C:\Program Files\Jyotisha
2008-04-21 14:04 --------- d-----w C:\Documents and Settings\House\Application Data\HP
2008-04-21 14:03 --------- d-----w C:\Program Files\HP
2008-04-21 14:03 --------- d-----w C:\Documents and Settings\All Users\Application Data\HP
2008-04-21 14:01 --------- d-----w C:\Program Files\Common Files\HP
2008-04-08 06:09 --------- d-----w C:\Program Files\Lavasoft
2008-04-08 03:51 8,464 ----a-w C:\WINDOWS\system32\sporder.dll
2008-04-08 03:51 14,336 ----a-w C:\WINDOWS\system32\svchost.exe
2008-04-05 13:48 --------- d-----w C:\Documents and Settings\All Users\Application Data\SSScanAppDataDir
2008-04-04 08:17 --------- d-----w C:\Program Files\Pamela
2008-04-04 08:17 --------- d-----w C:\Documents and Settings\House\Application Data\Pamela
2008-04-03 14:07 --------- d-----w C:\Documents and Settings\House\Application Data\MXSkypeRec
2008-04-02 14:52 --------- d-----w C:\Documents and Settings\House\Application Data\AdobeUM
2008-03-29 09:51 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-03-28 17:49 86,528 ----a-w C:\WINDOWS\system32\VACFix.exe
2008-03-26 03:20 82,432 ----a-w C:\WINDOWS\system32\IEDFix.exe
.


and here is the hijack this log.
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:51, on 2008-05-27
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\ZcfgSvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\COMODO\Firewall\cmdagent.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\AVG\AVG8\avgam.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Program Files\COMODO\Firewall\cfp.exe
C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\Program Files\Google\Google Talk\googletalk.exe
C:\Program Files\HP Wireless Printer Adapter\ConnectMgr.exe
C:\PROGRA~1\MI3AA1~1\rapimgr.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
\Desktop\software\security\AVG.Anti-Virus.v7.5.425.814.Multilingual.WinALL.Incl.Keygen-ViRiLiTY\HiJackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: (no name) - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [Apoint] -C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [IgfxTray] -C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] -C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [dla] -C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] -rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [HPWireless] -"C:\Program Files\HP Wireless Adapter\HPWLAN.exe"
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [COMODO Firewall Pro] "C:\Program Files\COMODO\Firewall\cfp.exe" -h
O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
O4 - HKCU\..\Run: [googletalk] C:\Program Files\Google\Google Talk\googletalk.exe /autostart
O4 - HKUS\S-1-5-18\..\Run: [RoboForm] "C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe" (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [RoboForm] "C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe" (User 'Default user')
O4 - Global Startup: connection manager.lnk = ?
O8 - Extra context menu item: Append to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Customize Menu - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Fill Forms - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O8 - Extra context menu item: RoboForm Toolbar - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O8 - Extra context menu item: Save Forms - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra 'Tools' menuitem: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra button: Save - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra 'Tools' menuitem: Save Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra 'Tools' menuitem: RoboForm Toolbar - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O15 - Trusted Zone: http://www.ventursol.com
O16 - DPF: {B1DE1BE4-AC89-407F-921F-C45C15C8FADB} (xingWebControl.Launcher) - https://www.xing.com/sync/xingWebControl.CAB
O17 - HKLM\System\CCS\Services\Tcpip\..\{E716C28E-75EF-41B3-83FD-E6A713AD1E9B}: NameServer = 202.56.215.54,202.56.215.55
O17 - HKLM\System\CCS\Services\Tcpip\..\{F5250B69-C485-44E3-83C8-006E19D0E61F}: NameServer = 202.56.215.6,202.56.230.6
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: COMODO Firewall Pro Helper Service (cmdAgent) - COMODO - C:\Program Files\COMODO\Firewall\cmdagent.exe
O23 - Service: DSBrokerService - Unknown owner - -"C:\Program Files\DellSupport\brkrsvc.exe" (file missing)
O23 - Service: EvtEng - Unknown owner - -C:\Program Files\Intel\Wireless\Bin\EvtEng.exe (file missing)
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: NICCONFIGSVC - Unknown owner - -C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe (file missing)
O23 - Service: Microsoft Office Diagnostics Service (odserv) - Unknown owner - -"C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE" (file missing)
O23 - Service: Office Source Engine (ose) - Unknown owner - -"C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE" (file missing)
O23 - Service: RegSrvc - Unknown owner - -C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe (file missing)
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Unknown owner - -C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe (file missing)
O23 - Service: Messenger Sharing Folders USN Journal Reader service (usnjsvc) - Unknown owner - -"C:\Program Files\Windows Live\Messenger\usnsvc.exe" (file missing)
O23 - Service: VNC Server Version 4 (WinVNC4) - Unknown owner - -"C:\Program Files\RealVNC\VNC4\WinVNC4.exe" -service (file missing)
O23 - Service: WLANKEEPER - Unknown owner - -C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe (file missing)
O23 - Service: Windows Live Setup Service (WLSetupSvc) - Unknown owner - -"C:\Program Files\Windows Live\installer\WLSetupSvc.exe" (file missing)

--
End of file - 10426 bytes


#12 chryssi2001

chryssi2001

  • Members
  • 1,930 posts
  • OFFLINE
  •  
  • Local time:06:31 PM

Posted 27 May 2008 - 04:07 AM

Hi,

The Combofix report you posted is the same. A big part is missing. Are you sure there is nothing more after this (last) line in your Combofix report?

2008-03-26 03:20 82,432 ----a-w C:\WINDOWS\system32\IEDFix.exe
Posted Image
Private Messages for personal support will be ignored. If you need help post in the forum.

#13 mr2face

mr2face
  • Topic Starter

  • Members
  • 14 posts
  • OFFLINE
  •  
  • Local time:10:31 AM

Posted 27 May 2008 - 04:51 AM

hi Chrissy,

I'm sure that that particular report was only that long. What i did is run Combofix again and i'm attaching that log here. You already have the new hijack log.
Hope this works.

ComboFix 08-05-25.3 - House 2008-05-27 15:11:30.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.538 [GMT 5.5:30]
Running from: C:\Documents and Settings\House\Desktop\ComboFix.exe
* Resident AV is active

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
---- Previous Run -------
.
C:\temp\tn3
C:\WINDOWS\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Windows Media\10.0\WMSDKNSD.XML
C:\WINDOWS\system32\drivers\core.cache.dsk
C:\WINDOWS\system32\drivers\Ovd75.sys
C:\WINDOWS\system32\drivers\serscann.sys
C:\WINDOWS\system32\lsprst7.dll
C:\WINDOWS\system32\oledb32.dll
C:\WINDOWS\system32\pmnli.dll
C:\WINDOWS\system32\setup.ini
C:\WINDOWS\system32\ssprs.dll
C:\WINDOWS\system32\WinNt32.dll
C:\WINDOWS\system32\WLCtrl32.dll

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_FCI
-------\Legacy_NNSERV
-------\Legacy_NPF
-------\Legacy_OVD75
-------\Legacy_SERSCANN
-------\Legacy_TCPSR
-------\Service_FCI
-------\Service_NNServ
-------\Service_NPF
-------\Service_Ovd75
-------\Service_serscann
-------\Service_tcpsr


((((((((((((((((((((((((( Files Created from 2008-04-27 to 2008-05-27 )))))))))))))))))))))))))))))))
.

2008-05-24 10:29 . 2008-05-24 10:29 <DIR> d-------- C:\Deckard
2008-05-23 15:02 . 2008-04-02 14:58 676,224 --a------ C:\WINDOWS\system32\OGACheckControl.dll
2008-05-18 22:22 . 2008-05-18 22:22 <DIR> d-------- C:\WINDOWS\system32\LogFiles
2008-05-16 19:20 . 2008-05-16 19:20 <DIR> d-------- C:\Program Files\Common Files\Macrovision Shared
2008-05-16 19:20 . 2008-05-17 10:55 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\FLEXnet
2008-05-15 21:25 . 2008-05-27 12:35 <DIR> d--h----- C:\$AVG8.VAULT$
2008-05-15 21:22 . 2008-05-15 21:22 <DIR> d-------- C:\Program Files\COMODO
2008-05-15 21:22 . 2008-05-15 21:22 <DIR> d-------- C:\Documents and Settings\House\Application Data\Comodo
2008-05-15 21:22 . 2008-05-15 21:30 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\comodo
2008-05-15 21:22 . 2008-05-15 21:22 139,008 --a------ C:\WINDOWS\system32\guard32.dll
2008-05-15 21:22 . 2008-05-15 21:22 87,312 --a------ C:\WINDOWS\system32\drivers\cmdguard.sys
2008-05-15 21:22 . 2008-05-15 21:22 23,824 --a------ C:\WINDOWS\system32\drivers\cmdhlp.sys
2008-05-15 21:09 . 2008-05-27 09:26 <DIR> d-------- C:\WINDOWS\system32\drivers\Avg
2008-05-15 21:09 . 2008-05-15 21:09 <DIR> d-------- C:\Program Files\AVG
2008-05-15 21:09 . 2008-05-15 21:43 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\avg8
2008-05-15 21:09 . 2008-05-15 21:09 96,520 --a------ C:\WINDOWS\system32\drivers\avgldx86.sys
2008-05-15 21:09 . 2008-05-15 21:09 75,272 --a------ C:\WINDOWS\system32\drivers\avgtdix.sys
2008-05-15 21:09 . 2008-05-15 21:09 12,424 --a------ C:\WINDOWS\system32\drivers\avgrkx86.sys
2008-05-15 21:09 . 2008-05-15 21:09 10,520 --a------ C:\WINDOWS\system32\avgrsstx.dll
2008-05-15 17:58 . 2008-05-15 17:58 <DIR> d--h----- C:\Documents and Settings\Administrator\Application Data\GTek
2008-05-15 16:43 . 2008-05-15 16:43 17,408 --a------ C:\WINDOWS\system32\dxdllreg.exe
2008-05-14 18:34 . 2008-05-14 18:34 0 --a------ C:\law.sp
2008-05-14 18:32 . 2008-05-14 18:33 <DIR> d-------- C:\fd8188774c41cd0dd2586c41e457
2008-05-10 18:25 . 2008-05-16 16:49 <DIR> d-------- C:\Program Files\MXSkypeRec
2008-05-10 18:25 . 2008-05-10 18:25 133 --a------ C:\WINDOWS\MXSkypeRecorder.INI
2008-05-10 18:23 . 2008-05-10 18:23 <DIR> d-------- C:\temp\MX.Skype.Recorder.v3.5.WinAll.Incl.Keygen-CRD
2008-05-10 17:44 . 2008-05-10 17:44 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Bluetooth
2008-05-10 17:23 . 2008-05-10 17:23 <DIR> d-------- C:\Program Files\IVT Corporation
2008-05-10 17:23 . 2002-11-24 01:47 148,830 --------- C:\WINDOWS\system32\drivers\bcbthub.sys
2008-05-08 13:52 . 2008-05-08 13:52 405,208 --a------ C:\temp\btwinitialupdate.exe
2008-05-07 13:14 . 2008-05-07 13:14 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Hagel Technologies
2008-05-06 10:42 . 2008-05-06 10:43 3,332 --a------ C:\WINDOWS\wsnk.his
2008-05-06 10:42 . 2008-05-06 10:43 1,229 --a------ C:\WINDOWS\wsnk.ini
2008-05-06 10:20 . 2008-05-06 10:45 141,388 --------- C:\WINDOWS\hpwins05.dat.temp
2008-05-06 10:20 . 2006-09-08 01:11 3,953 --------- C:\WINDOWS\hpwmdl05.dat.temp
2008-05-02 12:06 . 2008-05-02 12:56 <DIR> d-------- C:\Program Files\HP Wireless Printer Adapter
2008-05-02 12:06 . 2006-12-19 16:00 37,248 --a------ C:\WINDOWS\system32\hpnuhub.sys
2008-05-02 12:06 . 2006-12-19 16:00 37,248 --a------ C:\WINDOWS\system32\drivers\hpnuhub.sys
2008-05-02 12:06 . 2006-12-19 16:00 11,648 --a------ C:\WINDOWS\system32\hpnucmp.sys
2008-05-02 12:06 . 2006-12-19 16:00 11,648 --a------ C:\WINDOWS\system32\drivers\hpnucmp.sys
2008-05-02 12:06 . 2006-12-19 16:00 11,136 --a------ C:\WINDOWS\system32\drivers\hpnuhst.sys
2008-05-02 12:06 . 2007-01-24 05:58 10,718 --a------ C:\WINDOWS\system32\hpnuhub.cat
2008-05-02 12:06 . 2007-01-23 22:27 10,698 --a------ C:\WINDOWS\system32\hpnucmp.cat
2008-05-02 12:06 . 2006-12-19 15:45 1,314 --a------ C:\WINDOWS\system32\hpnuhub.inf
2008-05-02 12:06 . 2006-12-19 15:45 1,310 --a------ C:\WINDOWS\system32\hpnucmp.inf
2008-05-02 12:02 . 2008-05-02 12:02 <DIR> d-------- C:\WINDOWS\OPTIONS
2008-05-02 12:02 . 2008-05-02 12:02 <DIR> d-------- C:\Program Files\HP Wireless Adapter
2008-05-02 12:02 . 2006-08-15 11:10 189,440 --a------ C:\WINDOWS\system32\drivers\HPL8187.SYS
2008-05-02 12:02 . 2006-05-12 13:31 68,864 --a------ C:\WINDOWS\system32\drivers\HPEAPPkt.sys
2008-05-02 12:02 . 2002-10-02 09:57 13,532 --a------ C:\WINDOWS\system32\drivers\SjyPkt.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-05-27 09:40 --------- d-----w C:\Documents and Settings\House\Application Data\Skype
2008-05-23 05:00 --------- d-----w C:\Documents and Settings\House\Application Data\uTorrent
2008-05-20 14:44 --------- d-----w C:\Documents and Settings\All Users\Application Data\Microsoft Help
2008-05-20 12:50 --------- d-----w C:\Program Files\SPSSEVAL
2008-05-20 12:34 --------- d-----w C:\Program Files\Microsoft ActiveSync
2008-05-16 13:50 --------- d-----w C:\Program Files\Common Files\Adobe
2008-05-15 16:23 --------- d-----w C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-05-15 14:33 1,950 ----a-w C:\WINDOWS\system32\tmp.reg
2008-05-15 12:00 --------- d-----w C:\Program Files\Spybot - Search & Destroy
2008-05-15 11:37 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-05-10 11:53 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-04-24 11:12 --------- d-----w C:\Program Files\Jyotisha
2008-04-21 14:04 --------- d-----w C:\Documents and Settings\House\Application Data\HP
2008-04-21 14:03 --------- d-----w C:\Program Files\HP
2008-04-21 14:03 --------- d-----w C:\Documents and Settings\All Users\Application Data\HP
2008-04-21 14:01 --------- d-----w C:\Program Files\Common Files\HP
2008-04-08 06:09 --------- d-----w C:\Program Files\Lavasoft
2008-04-08 03:51 8,464 ----a-w C:\WINDOWS\system32\sporder.dll
2008-04-08 03:51 14,336 ----a-w C:\WINDOWS\system32\svchost.exe
2008-04-08 03:51 14,336 ----a-w C:\WINDOWS\system32\dllcache\svchost.exe
2008-04-05 13:48 --------- d-----w C:\Documents and Settings\All Users\Application Data\SSScanAppDataDir
2008-04-04 08:17 --------- d-----w C:\Program Files\Pamela
2008-04-04 08:17 --------- d-----w C:\Documents and Settings\House\Application Data\Pamela
2008-04-03 14:07 --------- d-----w C:\Documents and Settings\House\Application Data\MXSkypeRec
2008-04-02 14:52 --------- d-----w C:\Documents and Settings\House\Application Data\AdobeUM
2008-03-29 09:51 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-03-28 17:49 86,528 ----a-w C:\WINDOWS\system32\VACFix.exe
2008-03-26 03:20 82,432 ----a-w C:\WINDOWS\system32\IEDFix.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-10 15:30 15360]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 11:34 5724184]
"Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2007-08-31 17:40 22879528]
"H/PC Connection Agent"="C:\Program Files\Microsoft ActiveSync\wcescomm.exe" [2006-11-13 13:39 1289000]
"googletalk"="C:\Program Files\Google\Google Talk\googletalk.exe" [2007-01-02 02:52 3739648]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Apoint"="-C:\Program Files\Apoint\Apoint.exe" [ ]
"IgfxTray"="-C:\WINDOWS\system32\igfxtray.exe" [ ]
"HotKeysCmds"="-C:\WINDOWS\system32\hkcmd.exe" [ ]
"dla"="-C:\WINDOWS\system32\dla\tfswctrl.exe" [ ]
"BluetoothAuthenticationAgent"="-bthprops.cpl" []
"HPWireless"="-C:\Program Files\HP Wireless Adapter\HPWLAN.exe" [ ]
"AVG8_TRAY"="C:\PROGRA~1\AVG\AVG8\avgtray.exe" [2008-05-15 21:09 1177368]
"COMODO Firewall Pro"="C:\Program Files\COMODO\Firewall\cfp.exe" [2008-05-15 21:22 1572608]
"Acrobat Assistant 8.0"="C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe" [2007-05-10 22:46 624248]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"RoboForm"="C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe" [2007-09-10 09:58 144448]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
connection manager.lnk - C:\Program Files\HP Wireless Printer Adapter\ConnectMgr.exe [2008-05-02 12:06:09 1122304]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"InstallVisualStyle"= C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
"InstallTheme"= C:\WINDOWS\Resources\Themes\Royale.theme

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\IntelWireless]
C:\Program Files\Intel\Wireless\Bin\LgNotify.dll 2004-09-08 02:38 110592 C:\Program Files\Intel\Wireless\Bin\LgNotify.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=avgrsstx.dll C:\WINDOWS\system32\guard32.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Hou17.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acrobat Assistant 7.0]
C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\googletalk]
--a------ 2007-01-02 02:52 3739648 C:\Program Files\Google\Google Talk\googletalk.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\H/PC Connection Agent]
--a------ 2006-11-13 13:39 1289000 C:\Program Files\Microsoft ActiveSync\wcescomm.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
--a------ 2006-02-19 02:41 49152 C:\Program Files\HP\HP Software Update\HPWuSchd2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IntelWireless]
--a------ 2004-10-31 01:29 385024 C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]
--a------ 2004-07-28 03:20 81920 C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\mmtask]
--a------ 2004-09-14 19:20 53248 C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2006-01-13 03:10 155648 C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a------ 2003-11-20 04:18 32881 C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"C:\\WINDOWS\\system32\\sessmgr.exe"=
"C:\\Program Files\\Google\\Google Talk\\googletalk.exe"=
"C:\\Program Files\\uTorrent\\uTorrent.exe"=
"C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"C:\Program Files\Microsoft ActiveSync\rapimgr.exe"= C:\Program Files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
"C:\Program Files\Microsoft ActiveSync\wcescomm.exe"= C:\Program Files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
"C:\Program Files\Microsoft ActiveSync\WCESMgr.exe"= C:\Program Files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=
"\\\\Desktop\\E\\setup\\hpznet01.exe"=
"\\\\Desktop\\E\\setup\\hponicifs01.exe"=
"C:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"C:\\Program Files\\AVG\\AVG8\\avgnsx.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service

R0 AvgRkx86;avgrkx86.sys;C:\WINDOWS\system32\Drivers\avgrkx86.sys [2008-05-15 21:09]
R1 AvgLdx86;AVG AVI Loader Driver x86;C:\WINDOWS\system32\Drivers\avgldx86.sys [2008-05-15 21:09]
R1 cmdGuard;COMODO Firewall Pro Sandbox Driver;C:\WINDOWS\system32\DRIVERS\cmdguard.sys [2008-05-15 21:22]
R1 cmdHlp;COMODO Firewall Pro Helper Driver;C:\WINDOWS\system32\DRIVERS\cmdhlp.sys [2008-05-15 21:22]
R2 avg8wd;AVG8 WatchDog;C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe [2008-05-15 21:09]
R2 AvgTdiX;AVG8 Network Redirector;C:\WINDOWS\system32\Drivers\avgtdix.sys [2008-05-15 21:09]
R2 HPEAPPkt;Realtek EAPPkt Protocol(HP);C:\WINDOWS\system32\DRIVERS\HPEAPPkt.sys [2006-05-12 13:31]
R3 hpnuhst;HP NUSB Host;C:\WINDOWS\system32\DRIVERS\hpnuhst.sys [2006-12-19 16:00]
R3 HPNUHUB;HP NUSB Hub;C:\WINDOWS\system32\DRIVERS\hpnuhub.sys [2006-12-19 16:00]
S0 Hou17;Hou17;C:\WINDOWS\system32\Drivers\Hou17.sys []
S3 HPNUCMP;HP NUSB Composite;C:\WINDOWS\system32\DRIVERS\hpnucmp.sys [2006-12-19 16:00]
S3 RTLWUSB;Wireless Adapter;C:\WINDOWS\system32\DRIVERS\hpl8187.sys [2006-08-15 11:10]
S3 SjyPkt;SjyPkt;C:\WINDOWS\System32\Drivers\SjyPkt.sys [2002-10-02 09:57]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8031d0f6-4a86-11dc-8429-00038a000015}]
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Setup.pif

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b7977a50-3b81-11dc-8422-00038a000015}]
\Shell\AutoRun\command - ielp.exe
\Shell\explore\Command - ielp.exe
\Shell\open\Command - ielp.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c3e458fa-641c-11dc-843d-00123fe7afe1}]
\Shell\Open(&O)\command - RECYCLED\appmgmt.exe

.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-05-27 15:15:26
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\DSBrokerService]
"ImagePath"="-\"C:\Program Files\DellSupport\brkrsvc.exe\""

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\MDM]
"ImagePath"="-\"C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE\""

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\odserv]
"ImagePath"="-\"C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE\""

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\ose]
"ImagePath"="-\"C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE\""

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\usnjsvc]
"ImagePath"="-\"C:\Program Files\Windows Live\Messenger\usnsvc.exe\""

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\WinVNC4]
"ImagePath"="-\"C:\Program Files\RealVNC\VNC4\WinVNC4.exe\" -service"

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\WLSetupSvc]
"ImagePath"="-\"C:\Program Files\Windows Live\installer\WLSetupSvc.exe\""
.
Completion time: 2008-05-27 15:16:54
ComboFix-quarantined-files.txt 2008-05-27 09:46:20

Pre-Run: 37,102,682,112 bytes free
Post-Run: 37,109,018,624 bytes free

259 --- E O F --- 2007-08-13 08:00:57

Attached Files

  • Attached File  log.txt   17.66KB   4 downloads

Edited by chryssi2001, 27 May 2008 - 05:58 AM.
posting Combofix latest report


#14 chryssi2001

chryssi2001

  • Members
  • 1,930 posts
  • OFFLINE
  •  
  • Local time:06:31 PM

Posted 27 May 2008 - 05:13 AM

This time the report is ok. I need some time to check it.

Meanwhile i can see this on your desktop:

\Desktop\software\security\AVG.Anti-Virus.v7.5.425.814.Multilingual.WinALL.Incl.Keygen-ViRiLiTY\HiJackThis.exe

Keygens are illegal and as usual infected, so remove the whole folder, which is red coloured.
As HijackThis is installed inthere it will be removed too.

I need HijackThis to be in it's own folder to keep backups, so please install it using this:

Download HijackThis
Download HJTInstall.exe to your Desktop.
  • Doubleclick HJTInstall.exe to install it.
  • By default it will install to C:\Program Files\Trend Micro\HijackThis .
  • Click on Install.
  • It will create a HijackThis icon on the desktop.
  • Once installed, it will launch Hijackthis.
  • Exit HijackThis now.

Please tell me if your AVG8 Anti-Virus is working properly because i can't see any AVG8 services running.

I'll be back asap.
Posted Image
Private Messages for personal support will be ignored. If you need help post in the forum.

#15 mr2face

mr2face
  • Topic Starter

  • Members
  • 14 posts
  • OFFLINE
  •  
  • Local time:10:31 AM

Posted 27 May 2008 - 05:28 AM

hi chrissy,

noted abotu the keygen- though that is on a network drive (not my computer). i actually had to shut down the firewall and virus scanner (i disconnected from the network first), cos i believe the guide said you need to do that so they don't interfere with combofix. AVG is running fine.

done hijack install




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users