Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Analyze My Combofix Log


  • This topic is locked This topic is locked
2 replies to this topic

#1 crew42

crew42

  • Members
  • 1 posts
  • OFFLINE
  •  
  • Local time:07:40 AM

Posted 19 August 2008 - 05:19 PM

I had virtumonde and privavyremover.m64 on my PC. I ran combofix.exe. Here is my log. Is my problem fixed or is there anything else I need to do?

ComboFix 08-08-18.05 - Jen 2008-08-19 17:01:57.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1633 [GMT -5:00]
Running from: C:\Temp\ComboFix.exe
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\Jen\Application Data\macromedia\Flash Player\#SharedObjects\DWP7QCLT\interclick.com
C:\Documents and Settings\Jen\Application Data\macromedia\Flash Player\#SharedObjects\DWP7QCLT\interclick.com\ud.sol
C:\Documents and Settings\Jen\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#interclick.com
C:\Documents and Settings\Jen\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#interclick.com\settings.sol
C:\Documents and Settings\Jen\Cookies\jen@edge.ru4[1].txt
C:\Documents and Settings\Jen\Cookies\jen@insightexpressai[2].txt
C:\Documents and Settings\Jen\UserData
C:\Documents and Settings\Jen\UserData\index.dat
C:\Documents and Settings\Jen\UserData\ZYGJBTCL\sn[1].xml
C:\WINDOWS\system32\blphccufj0epbj.scr
C:\WINDOWS\system32\lphccufj0epbj.exe
C:\WINDOWS\system32\phccufj0epbj.bmp

.
((((((((((((((((((((((((( Files Created from 2008-07-19 to 2008-08-19 )))))))))))))))))))))))))))))))
.

2008-08-19 17:01 . 2008-08-19 17:01 2,719,688 -ra------ C:\Temp\ComboFix.exe
2008-08-19 16:51 . 2008-08-19 16:51 <DIR> d-------- C:\VundoFix Backups
2008-08-19 16:51 . 2008-08-19 16:51 119,808 --a------ C:\Temp\VundoFix(2).exe
2008-08-19 16:50 . 2008-08-19 16:50 137,728 --a------ C:\Temp\VundoFix.exe
2008-08-19 16:18 . 2008-08-19 16:19 <DIR> d-------- C:\Documents and Settings\Administrator\.housecall6.6
2008-08-19 13:37 . 2008-08-19 13:37 3,233,304 --a------ C:\Temp\XoftSpySE_Setup_RW.exe
2008-08-19 13:15 . 2008-08-19 16:18 102,664 --a------ C:\WINDOWS\system32\drivers\tmcomm.sys
2008-08-19 13:14 . 2008-08-19 13:15 <DIR> d-------- C:\Documents and Settings\Jen\.housecall6.6
2008-07-29 22:54 . 2008-07-29 22:54 <DIR> d-------- C:\Temp\Hellboy.2.The.Golden.Army.CAM.XViD-nDn
2008-07-27 18:27 . 2008-07-27 18:27 <DIR> d-------- C:\Temp\Bun_B_-_II_Trill-(Full_Album_2008)
2008-07-26 23:33 . 2008-07-26 23:34 <DIR> d-------- C:\Temp\Dead.Mans.Shoes.LiMiTED.DVDRip.XviD-DoNE
2008-07-21 18:37 . 2008-07-21 18:37 <DIR> d-------- C:\Documents and Settings\Jen\Application Data\Acreon

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-19 22:03 --------- d-----w C:\Program Files\Microsoft IntelliPoint
2008-08-19 17:53 --------- d-----w C:\Documents and Settings\All Users\Application Data\Avg7
2008-08-19 17:50 --------- d-----w C:\Program Files\mIRC
2008-07-16 01:40 --------- d-----w C:\Program Files\World of Warcraft
2008-06-25 17:18 --------- d-----w C:\Program Files\DivX
2008-06-20 10:44 360,960 ----a-w C:\WINDOWS\system32\drivers\tcpip.sys
2008-06-20 10:44 138,368 ----a-w C:\WINDOWS\system32\drivers\afd.sys
2008-06-20 09:32 225,920 ----a-w C:\WINDOWS\system32\drivers\tcpip6.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AdobeUpdater"="C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe" [2007-03-01 10:37 2321600]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2003-10-31 19:42 32768]
"IntelliPoint"="C:\Program Files\Microsoft IntelliPoint\ipoint.exe" [2005-12-04 16:39 461584]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50 155648]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 19:51 39792]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2008-04-15 08:56 579584]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2008-05-02 22:46 13529088]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2008-05-02 22:46 86016]
"HPHmon04"="C:\WINDOWS\system32\hphmon04.exe" [2006-01-06 14:07 348160]
"SoundMan"="SOUNDMAN.EXE" [2005-08-17 05:39 90112 C:\WINDOWS\soundman.exe]
"nwiz"="nwiz.exe" [2008-05-02 22:46 1630208 C:\WINDOWS\system32\nwiz.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2008-01-17 09:56 219136]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-12 19:01:04 83360]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
@=""

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\World of Warcraft\\WoW-1.12.0-enUS-downloader.exe"=
"C:\\Program Files\\mIRC\\mirc.exe"=
"C:\\WINDOWS\\system32\\dpvsetup.exe"=
"C:\\Program Files\\World of Warcraft\\WoW-1.12.0.5595-to-1.12.1.5875-enUS-downloader.exe"=
"C:\\Program Files\\World of Warcraft\\BackgroundDownloader.exe"=
"C:\\Program Files\\World of Warcraft\\WoW-1.12.x-to-2.0.1-enUS-patch-downloader.exe"=
"C:\\Program Files\\World of Warcraft\\WoW-2.0.3-enUS-downloader.exe"=
"C:\\Program Files\\World of Warcraft\\WoW-2.0.4.6314-to-2.0.5.6320-enUS-downloader.exe"=
"C:\\Program Files\\World of Warcraft\\WoW-2.0.3.6299-to-2.0.5.6320-enUS-downloader.exe"=
"C:\\Program Files\\World of Warcraft\\WoW-2.0.5.6320-to-2.0.6.6337-enUS-downloader.exe"=
"C:\\Program Files\\World of Warcraft\\WoW-2.0.6.6337-to-2.0.7.6383-enUS-downloader.exe"=
"C:\\Program Files\\World of Warcraft\\WoW-2.0.7.6383-to-2.0.8.6403-enUS-downloader.exe"=
"C:\\Program Files\\World of Warcraft\\WoW-2.0.8.6403-to-2.0.10.6448-enUS-downloader.exe"=
"C:\\Program Files\\World of Warcraft\\WoW-2.0.10.6448-to-2.0.12.6546-enUS-downloader.exe"=
"C:\\Program Files\\FlashFXP\\flashfxp.exe"=
"C:\\Program Files\\Warcraft III\\Warcraft III.exe"=
"C:\\Program Files\\Warcraft III\\War3.exe"=
"C:\\Program Files\\Grisoft\\AVG7\\avginet.exe"=
"C:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe"=
"C:\\Program Files\\Grisoft\\AVG7\\avgcc.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3724:TCP"= 3724:TCP:Blizzard Downloader: 3724

.
Contents of the 'Scheduled Tasks' folder

2008-08-19 C:\WINDOWS\Tasks\HP Usg Daily.job
- C:\Program Files\hp photosmart 11\printer\Hphusg04.exe [2006-01-06 14:07]

2008-08-19 C:\WINDOWS\Tasks\HP Usg Login.job
- C:\Program Files\hp photosmart 11\printer\Hphusg04.exe [2006-01-06 14:07]
.
- - - - ORPHANS REMOVED - - - -

HKLM-Run-HPHUPD04 - C:\Program Files\HP Photosmart 11\hphinstall\UniPatch\hphupd04.exe
HKLM-Run-lphccufj0epbj - C:\WINDOWS\system32\lphccufj0epbj.exe
HKLM-Run-Logitech Hardware Abstraction Layer - KHALMNPR.EXE
HKLM-Run-Kernel and Hardware Abstraction Layer - KHALMNPR.EXE
Notify-WgaLogon - (no file)


.
------- Supplementary Scan -------
.
FireFox -: Profile - C:\Documents and Settings\Jen\Application Data\Mozilla\Firefox\Profiles\w73b833z.default\
FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://en-us.start.mozilla.com/firefox?client=firefox-a&rls=org.mozilla:en-US:official
FF -: plugin - C:\Documents and Settings\Jen\Application Data\Mozilla\Firefox\Profiles\w73b833z.default\extensions\moveplayer@movenetworks.com\platform\WINNT_x86-msvc\plugins\npmnqmp07076007.dll
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-19 17:05:54
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\rundll32.exe
.
**************************************************************************
.
Completion time: 2008-08-19 17:09:53 - machine was rebooted
ComboFix-quarantined-files.txt 2008-08-19 22:09:51

Pre-Run: 62,275,289,088 bytes free
Post-Run: 62,537,179,136 bytes free

142 --- E O F --- 2008-08-15 14:44:02

BC AdBot (Login to Remove)

 


m

#2 Baabiouz

Baabiouz

    Finnish Malware Fighter


  • Members
  • 3,355 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Finland
  • Local time:03:40 PM

Posted 02 September 2008 - 11:30 PM

Hello

A word of warning: Please do not run ComboFix on your own. This tool is not a toy and not for everyday use.


Apologize for the delay in response we get overwhelmed at times but we are trying our best to keep up.
If you have since resolved the original problem you were having would appreciate you letting us know If not please perform the following below so I can have a look at the current condition of your machine.

Thanks and again sorry for the delay.
  • Download random's system information tool (RSIT) by random/random from here and save it to your desktop.
  • Double click on RSIT.exe to run RSIT.
  • Click Continue at the disclaimer screen.
  • Once it has finished, two logs will open. Please post the contents of both log.txt (<<will be maximized) and info.txt (<<will be minimized)
Next
Please do a scan with Kaspersky Online Scanner

Note: If you are using Windows Vista, open your browser by right-clicking on its icon and select 'Run as administrator' to perform this scan.

Click on the Accept button and install any components it needs.
  • The program will install and then begin downloading the latest definition files.
  • After the files have been downloaded on the left side of the page in the Scan section select My Computer
  • This will start the program and scan your system.
  • The scan will take a while, so be patient and let it run.
  • Once the scan is complete, click on View scan report
  • Now, click on the Save Report as button.
  • Save the file to your desktop.
  • Copy and paste that information in your next post.

Posted Image

#3 Baabiouz

Baabiouz

    Finnish Malware Fighter


  • Members
  • 3,355 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Finland
  • Local time:03:40 PM

Posted 08 September 2008 - 11:18 PM

This thread will now be closed.
If you need this topic reopened, please contact me.

This applies only to the original topic starter.
Everyone else please begin a New Topic.
Posted Image




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users