Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Malware Problems! Combo Fix Logs ! Can Any One Help?:s


  • This topic is locked This topic is locked
2 replies to this topic

#1 LiamKing2250

LiamKing2250

  • Members
  • 2 posts
  • OFFLINE
  •  
  • Local time:08:23 AM

Posted 03 July 2008 - 07:19 AM

Hey! im a brand new user on this forum, just wondering if any one could give me any help/advice!!

I have had fake adverts that get through my firewall asking if i would like to apply for a loan, asking me to register at adult sites(known as sex-world or something)ECT, or FAKE windows error messages trying to get me to download fake anti virus programmes ect...

i also recently got a weird background saying your infected please download this software. Also i deleted a programme called my sex world registration found in my add/remove programmes.

this is a family computer and needs to be used alot, but it has got so slow, it is almost un-usable, especially with the popups.(By the way im usuing XP sp2, if thats helpull?)

PLEASE can any one give me any more help on what to do now!!
many thanks for taking the time to read the post!
I ran combo fx , and here is my log:







ComboFix 08-07-02.5 - Liam 2008-07-03 12:52:19.1 - FAT32x86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.208 [GMT 1:00]
Running from: C:\Documents and Settings\Liam\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Liam\Desktop\WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\All Users\Start Menu\Programs\InternetGameBox
C:\Documents and Settings\All Users\Start Menu\Programs\InternetGameBox\InternetGameBox.lnk
C:\Documents and Settings\All Users\Start Menu\Programs\InternetGameBox\Privacy Policy.url
C:\Documents and Settings\All Users\Start Menu\Programs\InternetGameBox\Terms and Conditions.url
C:\Documents and Settings\All Users\Start Menu\Programs\InternetGameBox\Uninstall.lnk
C:\Documents and Settings\All Users\Start Menu\Programs\InternetGameBox\Website.url
C:\Documents and Settings\Liam\Local Settings\Application Data\gaakamy.dat
C:\Documents and Settings\Liam\Local Settings\Application Data\gaakamy.exe
C:\Documents and Settings\Liam\Local Settings\Application Data\gaakamy_nav.dat
C:\Documents and Settings\Liam\Local Settings\Application Data\gaakamy_navps.dat
C:\WINDOWS\system32\_000003_.tmp.dll
C:\WINDOWS\system32\_000006_.tmp.dll
C:\WINDOWS\system32\_000008_.tmp.dll
C:\WINDOWS\system32\_000013_.tmp.dll
C:\WINDOWS\system32\_000111_.tmp.dll
C:\WINDOWS\system32\my sex world.ico
C:\WINDOWS\system32\u2g.f
C:\WINDOWS\system32\winiconmon.ico
C:\WINDOWS\system32\winiconmon.ico.bak0
C:\WINDOWS\Web\def.htm

.
((((((((((((((((((((((((( Files Created from 2008-06-03 to 2008-07-03 )))))))))))))))))))))))))))))))
.

2008-07-03 00:11 . 2008-07-03 00:11 <DIR> d-------- C:\Documents and Settings\Liam\Application Data\Malwarebytes
2008-07-03 00:10 . 2008-07-03 00:10 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-07-03 00:10 . 2008-07-03 00:11 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-07-03 00:10 . 2008-06-28 14:16 34,296 --a------ C:\WINDOWS\system32\drivers\mbamcatchme.sys
2008-07-03 00:10 . 2008-06-28 14:16 17,144 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-07-02 20:55 . 2008-07-02 20:55 <DIR> d-------- C:\Documents and Settings\Liam\white noise
2008-06-25 21:12 . 2008-06-25 21:12 268 --ah----- C:\sqmdata03.sqm
2008-06-25 21:12 . 2008-06-25 21:12 244 --ah----- C:\sqmnoopt03.sqm
2008-06-16 21:11 . 2008-06-16 21:11 <DIR> d--hs---- C:\FOUND.079
2008-06-15 21:41 . 2006-02-20 17:59 94,064 -ra------ C:\WINDOWS\system32\drivers\w810mdm.sys
2008-06-15 21:41 . 2006-02-20 17:59 85,408 -ra------ C:\WINDOWS\system32\drivers\w810mgmt.sys
2008-06-15 21:41 . 2006-02-20 17:59 83,344 -ra------ C:\WINDOWS\system32\drivers\w810obex.sys
2008-06-15 21:41 . 2006-02-20 17:59 8,336 -ra------ C:\WINDOWS\system32\drivers\w810mdfl.sys
2008-06-15 21:41 . 2006-02-20 17:59 6,176 -ra------ C:\WINDOWS\system32\drivers\w810cmnt.sys
2008-06-15 21:41 . 2006-02-20 17:59 6,176 -ra------ C:\WINDOWS\system32\drivers\w810cm.sys
2008-06-15 21:40 . 2006-02-20 17:59 58,288 -ra------ C:\WINDOWS\system32\drivers\w810bus.sys
2008-06-15 21:40 . 2006-02-20 17:59 5,808 -ra------ C:\WINDOWS\system32\drivers\w810whnt.sys
2008-06-15 21:40 . 2006-02-20 17:59 5,808 -ra------ C:\WINDOWS\system32\drivers\w810wh.sys
2008-06-12 18:34 . 2008-06-12 18:34 <DIR> d--hs---- C:\FOUND.078
2008-06-10 20:40 . 2008-06-13 14:10 272,128 --------- C:\WINDOWS\system32\dllcache\bthport.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-13 13:10 272,128 ------w C:\WINDOWS\system32\drivers\bthport.sys
2008-05-31 14:20 805 ----a-w C:\WINDOWS\system32\drivers\SYMEVENT.INF
2008-05-31 14:20 60,800 ----a-w C:\WINDOWS\system32\S32EVNT1.DLL
2008-05-31 14:20 123,952 ----a-w C:\WINDOWS\system32\drivers\SYMEVENT.SYS
2008-05-31 14:20 10,671 ----a-w C:\WINDOWS\system32\drivers\SYMEVENT.CAT
2008-05-11 22:58 --------- d-----w C:\Documents and Settings\All Users\Application Data\Logishrd
2008-05-08 12:28 202,752 ----a-w C:\WINDOWS\system32\drivers\RMCast.sys
2008-05-08 12:28 202,752 ----a-w C:\WINDOWS\system32\dllcache\rmcast.sys
2008-05-07 05:18 1,287,680 ----a-w C:\WINDOWS\system32\quartz.dll
2008-05-07 05:18 1,287,680 ------w C:\WINDOWS\system32\dllcache\quartz.dll
2008-04-23 21:16 3,591,680 ----a-w C:\WINDOWS\system32\dllcache\mshtml.dll
2008-04-22 07:40 625,664 ------w C:\WINDOWS\system32\dllcache\iexplore.exe
2008-04-22 07:39 70,656 ------w C:\WINDOWS\system32\dllcache\ie4uinit.exe
2008-04-22 07:39 13,824 ------w C:\WINDOWS\system32\dllcache\ieudinit.exe
2008-04-20 05:07 161,792 ----a-w C:\WINDOWS\system32\dllcache\ieakui.dll
2008-02-26 14:15 5,914,648 ----a-w C:\Program Files\SUPERAntiSpyware.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:56 15360]
"\\Darren\EPSON Stylus Photo R340 Series"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAJE.EXE" [2006-12-26 05:00 177664]
"msnmsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 11:34 5724184]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-10 20:17 68856]
"SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2008-07-02 14:26 1506544]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-10-22 12:22 7700480]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2007-07-18 01:54 116072]
"D-Link AirPlus G"="C:\Program Files\D-Link\AirPlus G\AirGCFG.exe" [2005-04-22 17:51 1236992]
"Sony Ericsson PC Suite"="C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [2005-10-26 16:17 159744]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-01-17 22:03 282624]
"Symantec PIF AlertEng"="C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2008-01-29 17:38 583048]
"LogitechCommunicationsManager"="C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe" [2007-10-25 16:33 563984]
"LogitechQuickCamRibbon"="C:\Program Files\Logitech\QuickCam\Quickcam.exe" [2007-10-25 16:37 2178832]
"nwiz"="nwiz.exe" [2006-10-22 12:22 1622016 C:\WINDOWS\system32\nwiz.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-04 00:56 15360]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "C:\Program Files\SUPERAntiSpyware\SASSEH.DLL" [2008-07-02 14:26 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2007-04-19 12:41 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.clmp3enc"= C:\PROGRA~1\CYBERL~1\Power2Go\CLMP3Enc.ACM

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\LimeWire\\LimeWire.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"67:UDP"= 67:UDP:DHCP Discovery Service

R3 Tunx00;FunTV Video Capture;C:\WINDOWS\system32\DRIVERS\Tunx00.sys [2004-08-13 06:57]
R3 TxTuner;FunTV TV Tuner;C:\WINDOWS\system32\DRIVERS\TxTuner.sys [2004-08-13 07:33]
S3 SetupNTGLM7X;SetupNTGLM7X;D:\NTGLM7X.sys []
S3 Vsp;Vsp;C:\WINDOWS\System32\drivers\Vsp.sys [2003-05-27 16:45]
S3 w200bus;Sony Ericsson W200 driver (WDM);C:\WINDOWS\system32\DRIVERS\w200bus.sys [2006-11-07 09:42]
S3 w200mdfl;Sony Ericsson W200 USB WMC Modem Filter;C:\WINDOWS\system32\DRIVERS\w200mdfl.sys [2006-11-07 09:42]
S3 w200mdm;Sony Ericsson W200 USB WMC Modem Driver;C:\WINDOWS\system32\DRIVERS\w200mdm.sys [2006-11-07 09:42]
S3 w200mgmt;Sony Ericsson W200 USB WMC Device Management Drivers (WDM);C:\WINDOWS\system32\DRIVERS\w200mgmt.sys [2006-11-07 09:42]
S3 w200obex;Sony Ericsson W200 USB WMC OBEX Interface;C:\WINDOWS\system32\DRIVERS\w200obex.sys [2006-11-07 09:42]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c5ef5b10-b5ce-11db-a483-00134697caa0}]
\Shell\AutoRun\command - F:\setupSNK.exe

*Newly Created Service* - CATCHME
*Newly Created Service* - COMHOST
.
Contents of the 'Scheduled Tasks' folder
"2007-01-15 10:17:38 C:\WINDOWS\Tasks\Microsoft_Hardware_Launch_IType_exe.job"
- c:\Program Files\Microsoft IntelliType Pro\itype.exe
"2008-05-30 19:00:02 C:\WINDOWS\Tasks\Norton Internet Security - Run Full System Scan - Liam.job"
- C:\PROGRA~1\NORTON~1\NORTON~1\Navw32.exeh/TASK:
"2008-07-03 11:22:02 C:\WINDOWS\Tasks\Check Updates for Windows Live Toolbar.job"
- C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE
.
- - - - ORPHANS REMOVED - - - -

HKCU-Run-emboltrc - C:\WINDOWS\system32\nshodank.exe
SSODL-KbdAlrt-{96120215-57e7-482a-b5da-25f34e6f17d3} - C:\WINDOWS\Resources\KbdAlrt.dll
Notify-hgGwWnmK - hgGwWnmK.dll


**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-07-03 12:56:51
Windows 5.1.2600 Service Pack 2 FAT NTAPI

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"\\\\Darren\\EPSON Stylus Photo R340 Series"="C:\\WINDOWS\\System32\\spool\\DRIVERS\\W32X86\\3\\E_FATIAJE.EXE /FU \"C:\\WINDOWS\\TEMP\\E_SDA.tmp\" /EF \"HKCU\""
.
Completion time: 2008-07-03 12:58:24
ComboFix-quarantined-files.txt 2008-07-03 11:58:16

Pre-Run: 134,210,813,952 bytes free
Post-Run: 134,318,325,760 bytes free

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /fastdetect /NoExecute=OptIn
C:\CMDCONS\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

169 --- E O F --- 2008-06-20 20:24:07

BC AdBot (Login to Remove)

 


#2 LiamKing2250

LiamKing2250
  • Topic Starter

  • Members
  • 2 posts
  • OFFLINE
  •  
  • Local time:08:23 AM

Posted 03 July 2008 - 07:57 AM

by the way! after running this, all the popups seemed to have disappeared, for now, but my Ad-aware keeps finding infections(55 usually), am i still infected or what? :S

#3 dc3

dc3

    Bleeping Treehugger


  • Members
  • 30,601 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Sierra Foothills of Northern Ca.
  • Local time:07:23 AM

Posted 03 July 2008 - 09:34 AM

ComboFix logs should not to be posted outside the HijackThis forums. It is an extremely powerful tool which should only be used when instructed to do so by someone who has been properly trained. ComboFix is intended by its creator to be "used under the guidance and supervision of an expert", NOT for private use. Please read Combofix's Disclaimer. Using this tool incorrectly could lead to disastrous problems with your operating system such as preventing it from ever starting again.

Please create a new topic explaining the nature of your problem. Describe pop-ups and system tray or desktop icons that have appeared. Explain what is "going wrong" with your computer. Note any tools you have used and their respective results.

If needed, we will direct you to our HJT Preparation Guide.

Thank you for using BleepingComputer as your malware removal source.

I will notify a moderator and have this topic closed.

dc3

Family and loved ones will always be a priority in my daily life.  You never know when one will leave you.

 

 

 

 





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users