Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Nasty Virus - Popups/weird Sounds - Help!


  • Please log in to reply
2 replies to this topic

#1 TheGreatGonzo

TheGreatGonzo

  • Members
  • 2 posts
  • OFFLINE
  •  
  • Local time:04:45 AM

Posted 01 September 2008 - 05:44 PM

Over the past couple of weeks, my PC has been playing weird sounds, musical clips, and throwing up several popup windows. It happens every 15-20 minutes or so. It appeared to be a trojan virus of some kind.

I tried several programs (McAfee, SpyBot, online virus scans) and had no luck locating the culprit. I eventually stumbled across a thread on this site that sounded familiar. http://www.bleepingcomputer.com/forums/lof...hp/t166280.html

I downloaded and ran ComboFix. It generated the following log file:

-------------------BEGIN LOG FILE------------------------------

ComboFix 08-09-01.01 - UserName 2008-09-01 16:58:50.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.168 [GMT -5:00]
Running from: C:\Documents and Settings\UserName\Desktop\ComboFix.exe
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
The following files were disabled during the run:
C:\WINDOWS\system32\zordisa.dll
C:\WINDOWS\system32\dbi102.dll


((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\DOCUME~1\ASCHIS~1\LOCALS~1\Temp\WowInitcode.dll
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat
C:\Documents and Settings\UserName\Application Data\macromedia\Flash Player\#SharedObjects\CPR89FEE\bin.clearspring.com
C:\Documents and Settings\UserName\Application Data\macromedia\Flash Player\#SharedObjects\CPR89FEE\bin.clearspring.com\clearspring.sol
C:\Documents and Settings\UserName\Application Data\macromedia\Flash Player\#SharedObjects\CPR89FEE\interclick.com
C:\Documents and Settings\UserName\Application Data\macromedia\Flash Player\#SharedObjects\CPR89FEE\interclick.com\ud.sol
C:\Documents and Settings\UserName\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#bin.clearspring.com
C:\Documents and Settings\UserName\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#bin.clearspring.com\settings.sol
C:\Documents and Settings\UserName\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#interclick.com
C:\Documents and Settings\UserName\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#interclick.com\settings.sol
C:\test.txt
C:\WINDOWS\dcbdcatys32_080831a.dll
C:\WINDOWS\Install.txt
C:\WINDOWS\MSSqlServer.dll
C:\WINDOWS\smss.exe
C:\WINDOWS\system\proxy.exe
C:\WINDOWS\system\sgcxcxxaspf080831.exe
C:\WINDOWS\system32\afinding.exe
C:\WINDOWS\system32\afisicx.exe
C:\WINDOWS\system32\atsxyzd.sys
C:\WINDOWS\system32\comsa32.sys
C:\WINDOWS\system32\dbi102.dll.vir
C:\WINDOWS\system32\ef.exe
C:\WINDOWS\system32\inf\scsys16_080831.dll
C:\WINDOWS\system32\inf\sppdcrs080831.scr
C:\WINDOWS\system32\inf\svchoct.exe
C:\WINDOWS\system32\Install.txt
C:\WINDOWS\system32\macidwe.exe
C:\WINDOWS\system32\mdm.exe
C:\WINDOWS\system32\mmchost.dll
C:\WINDOWS\system32\mywfhit.ini
C:\WINDOWS\system32\mywfhit.ini.tmp
C:\WINDOWS\system32\noxtcyr.exe
C:\WINDOWS\system32\oduxftw.sys
C:\WINDOWS\system32\roxtctm.exe
C:\WINDOWS\system32\rtl60.bpl
C:\WINDOWS\system32\sobicyt.exe
C:\WINDOWS\system32\sotpeca.exe
C:\WINDOWS\system32\syspilog.pil
C:\WINDOWS\system32\tdxdowkc.exe
C:\WINDOWS\system32\WServing.exe
C:\WINDOWS\system32\wsldoekd.exe
C:\WINDOWS\system32\zordisa.dll.vir
C:\WINDOWS\tawisys.ini
C:\WINDOWS\wftadfi16_080831a.dll

----- BITS: Possible infected sites -----

http://txsus
Infected copy of C:\WINDOWS\system32\spoolsv.exe was found & disinfected
Restored copy from - C:\WINDOWS\$hf_mig$\KB896423\SP2QFE\spoolsv.exe


.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_AFINDING
-------\Legacy_AFISICX
-------\Legacy_INTERNET_SERVICE
-------\Legacy_MACIDWE
-------\Legacy_MSSERVICE
-------\Legacy_NOXTCYR
-------\Legacy_PANDRV
-------\Legacy_ROXTCTM
-------\Legacy_SEUICTOL
-------\Legacy_SOBICYT
-------\Legacy_SOTPECA
-------\Legacy_TDXDOWKC
-------\Legacy_WSERVING
-------\Legacy_WSLDOEKD
-------\Service_afinding
-------\Service_afisicx
-------\Service_Internet Service
-------\Service_macidwe
-------\Service_MsService
-------\Service_noxtcyr
-------\Service_roxtctm
-------\Service_seuictol
-------\Service_sobicyt
-------\Service_sotpeca
-------\Service_tdxdowkc
-------\Service_wserving
-------\Service_wsldoekd


((((((((((((((((((((((((( Files Created from 2008-08-01 to 2008-09-01 )))))))))))))))))))))))))))))))
.

2008-09-01 12:47 . 2008-09-01 12:48 <DIR> d-------- C:\Documents and Settings\UserName\.housecall6.6
2008-08-26 16:12 . 2008-08-26 16:12 <DIR> d-------- C:\Documents and Settings\LocalService\Application Data\AdobeUM
2008-08-24 22:44 . 2008-08-24 22:44 <DIR> d-------- C:\spoolerlogs
2008-08-24 21:36 . 2008-09-01 17:00 <DIR> d-------- C:\WINDOWS\system32\inf
2008-08-18 11:22 . 2008-06-24 11:23 74,240 --------- C:\WINDOWS\system32\dllcache\mscms.dll
2008-08-18 11:21 . 2008-07-07 15:32 253,952 --------- C:\WINDOWS\system32\dllcache\es.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-07-24 18:50 --------- d-----w C:\Program Files\Common Files\Adobe
2008-07-24 18:48 --------- d-----w C:\Documents and Settings\UserName\Application Data\AdobeUM
2008-07-17 07:13 --------- d-----w C:\Program Files\American Airlines DealFinder
2008-07-07 20:32 253,952 ----a-w C:\WINDOWS\system32\es.dll
2008-06-24 16:23 74,240 ----a-w C:\WINDOWS\system32\mscms.dll
2008-06-23 16:12 667,136 ----a-w C:\WINDOWS\system32\wininet.dll
2008-03-25 01:58 6,029,648 ----a-w C:\Program Files\Firefox Setup 2.0.0.12.exe
2008-01-03 17:08 6,026,816 ----a-w C:\Program Files\Firefox Setup 2.0.0.11.exe
1998-12-09 02:53 99,840 -c--a-w C:\Program Files\Common Files\IRAABOUT.DLL
1998-12-09 02:53 70,144 -c--a-w C:\Program Files\Common Files\IRAMDMTR.DLL
1998-12-09 02:53 48,640 -c--a-w C:\Program Files\Common Files\IRALPTTR.DLL
1998-12-09 02:53 31,744 -c--a-w C:\Program Files\Common Files\IRAWEBTR.DLL
1998-12-09 02:53 186,368 -c--a-w C:\Program Files\Common Files\IRAREG.DLL
1998-12-09 02:53 17,920 -c--a-w C:\Program Files\Common Files\IRASRIAL.DLL
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Yahoo! Pager"="C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" [2007-03-27 15:22 4670968]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 11:24 1694208]
"ibmmessages"="C:\Program Files\IBM\Messages By IBM\ibmmessages.exe" [2004-07-22 04:01 442368]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPLpr"="C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [2004-06-16 12:53 110592]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2004-06-16 12:53 512000]
"TPKMAPHELPER"="C:\Program Files\ThinkPad\Utilities\TpKmapAp.exe" [2004-02-04 20:39 897024]
"TPHOTKEY"="C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe" [2004-08-17 14:06 94208]
"ControlCenter"="C:\Program Files\IBM fingerprint software\ctlcntr.exe" [2004-09-24 18:11 284254]
"EZEJMNAP"="C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe" [2003-12-25 04:04 208896]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-08-25 14:52 339968]
"UC_Start"="C:\Program Files\IBM\Updater\\ucstartup.exe" [2004-07-14 18:34 36864]
"UpdateManager"="C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" [2003-08-19 03:01 110592]
"dla"="C:\WINDOWS\system32\dla\tfswctrl.exe" [2004-09-02 03:05 127035]
"IBMPRC"="C:\IBMTOOLS\UTILS\ibmprc.exe" [2004-03-19 14:12 90112]
"QCTRAY"="C:\Program Files\ThinkPad\ConnectUtilities\QCTRAY.EXE" [2004-11-09 05:53 712704]
"QCWLICON"="C:\Program Files\ThinkPad\ConnectUtilities\QCWLICON.EXE" [2004-11-09 05:53 81920]
"BMMGAG"="C:\PROGRA~1\ThinkPad\UTILIT~1\pwrmonit.dll" [2004-07-29 03:37 110592]
"BMMLREF"="C:\Program Files\ThinkPad\Utilities\BMMLREF.EXE" [2004-07-29 03:37 20480]
"BMMMONWND"="C:\PROGRA~1\ThinkPad\UTILIT~1\BatInfEx.dll" [2004-07-29 03:37 395776]
"SunJavaUpdateSched"="C:\Program Files\Java\j2re1.4.2_07\bin\jusched.exe" [2005-01-15 15:24 32881]
"ShStatEXE"="C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" [2004-09-22 20:00 94208]
"McAfeeUpdaterUI"="C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" [2005-08-18 16:50 139320]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2008-03-28 23:37 413696]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-03-30 10:36 267048]
"S3TRAY2"="S3Tray2.exe" [2001-10-12 01:32 69632 C:\WINDOWS\system32\S3Tray2.exe]
"TpShocks"="TpShocks.exe" [2004-03-26 20:16 102400 C:\WINDOWS\system32\TpShocks.exe]
"TP4EX"="tp4ex.exe" [2002-09-04 03:05 53248 C:\WINDOWS\system32\TP4EX.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"TSClientMSIUninstaller"="C:\WINDOWS\Installer\TSClientMsiTrans\tscuinst.vbs" [2006-11-07 03:06 12451]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2008-04-23 03:38:16 29696]
Digital Line Detect.lnk - C:\Program Files\Digital Line Detect\DLG.exe [2005-04-12 16:29:31 24576]
Microsoft Office.lnk - C:\Microsoft Office\Office\OSA9.EXE [2000-01-21 03:15:54 65588]
Siebel TrickleSync.lnk - C:\siebel_training\BIN\autosync.exe [2005-12-07 18:49:48 35328]
Symantec Fax Starter Edition Port.lnk - C:\Microsoft Office\Office\1033\OLFSNT40.EXE [1998-12-23 16:51:52 45568]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\psfus]
2004-09-24 18:15 108636 C:\Program Files\IBM fingerprint software\psfus.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\QConGina]
2004-11-09 05:53 262144 C:\WINDOWS\system32\QConGina.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-2992388110-3130016820-4053984001-1784\Scripts\Logon\0\0]
"Script"=TXTZ.bat

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\IBM\\Updater\\jre\\bin\\java.exe"=
"C:\\Program Files\\IBM\\Updater\\jre\\bin\\javaw.exe"=
"C:\\Program Files\\IBM\\Updater\\ucsmb.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009

R0 Shockprf;Shockprf;C:\WINDOWS\system32\drivers\Shockprf.sys [2004-07-06 18:50]
R1 ANC;ANC;C:\WINDOWS\system32\drivers\ANC.SYS [2004-11-09 05:53]
R1 IBMTPCHK;IBMTPCHK;C:\WINDOWS\system32\drivers\IBMBLDID.SYS [2004-11-09 05:53]
R1 ShockMgr;ShockMgr;C:\WINDOWS\system32\drivers\ShockMgr.sys [2004-05-14 14:59]
R1 TPPWR;TPPWR;C:\WINDOWS\system32\drivers\Tppwr.sys [2004-07-29 03:37]
R2 CcmExec;SMS Agent Host;C:\WINDOWS\system32\CCM\CcmExec.exe [2006-02-09 02:50]
R2 EPAService;EPAService;c:\epa.epa\EPAService.exe [2007-02-08 14:00]
R2 ibmfilter;ibmfilter;C:\WINDOWS\system32\drivers\ibmfilter.sys [2004-09-23 19:39]
S2 msdspsd;Windows Video Device Management Service;C:\WINDOWS\system32\msdsp.exe [2004-08-04 02:56]
S3 EracentARPC;EracentARPC;c:\epa.epa\arpcollector.sys [2007-02-08 14:00]
S3 prepdrvr;SMS Process Event Driver;C:\WINDOWS\system32\CCM\prepdrv.sys [2006-02-09 02:50]
S3 QCNDISIF;QCNDISIF;C:\WINDOWS\system32\drivers\qcndisif.SYS [2004-11-09 05:53]

*Newly Created Service* - ENTDRV51
.
Contents of the 'Scheduled Tasks' folder
.
- - - - ORPHANS REMOVED - - - -

HKLM-Run-UC_SMB - (no file)
HKLM-Explorer_Run-minyust - C:\WINDOWS\system32\inf\svchoct.exe


.
------- Supplementary Scan -------
.
FireFox -: Profile - C:\Documents and Settings\UserName\Application Data\Mozilla\Firefox\Profiles\4fgnbbtc.default\
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-09-01 17:06:24
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

PROCESS: C:\WINDOWS\system32\winlogon.exe
-> C:\WINDOWS\system32\Ati2evxx.dll
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Common Files\Virtual Token\vtserver.exe
C:\WINDOWS\system32\ibmpmsvc.exe
C:\WINDOWS\system32\ati2evxx.exe
C:\WINDOWS\system32\S24EvMon.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\IBM\IBM Rapid Restore Ultra\rrpcsb.exe
C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
C:\Program Files\Network Associates\VirusScan\Mcshield.exe
C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
C:\WINDOWS\system32\ati2evxx.exe
C:\Program Files\ThinkPad\PkgMgr\HOTKEY\TPONSCR.exe
C:\Program Files\ThinkPad\PkgMgr\HOTKEY_1\TpScrex.exe
C:\WINDOWS\system32\rundll32.exe
C:\Notes\ntmulti.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\QCONSVC.EXE
C:\WINDOWS\system32\RegSrvc.exe
C:\WINDOWS\system32\TpKmpSvc.exe
C:\WINDOWS\system32\CCM\clicomp\RemCtrl\Wuser32.exe
C:\Program Files\Yahoo!\Messenger\Ymsgr_tray.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\msiexec.exe
.
**************************************************************************
.
Completion time: 2008-09-01 17:11:17 - machine was rebooted
ComboFix-quarantined-files.txt 2008-09-01 22:11:13

Pre-Run: 13,052,678,144 bytes free
Post-Run: 13,275,873,280 bytes free

247 --- E O F --- 2008-08-19 15:46:22


-------------------------END LOG FILE-----------------------------

I have yet to see any problems since running ComboFix but was not sure whether there were some additional steps. Is there anything else I need to do, other that get my McAfee program updated (currently having trouble with the update utility, I think it needs to be reinstalled)?

Thanks in advance!

BC AdBot (Login to Remove)

 


#2 TheGreatGonzo

TheGreatGonzo
  • Topic Starter

  • Members
  • 2 posts
  • OFFLINE
  •  
  • Local time:04:45 AM

Posted 01 September 2008 - 05:47 PM

My apologies, I did not read the rules before posting the ComboFix log. Please forgive the newbie.

#3 Grinler

Grinler

    Lawrence Abrams


  • Admin
  • 43,664 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:USA
  • Local time:04:45 AM

Posted 18 September 2008 - 09:25 PM

Please download a new version of Combofix and rerun it. Post the log after as a reply to this topic if you still need help.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users