Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Need ComboFix Log Help


  • This topic is locked This topic is locked
3 replies to this topic

#1 sharpblade15

sharpblade15

  • Members
  • 1 posts
  • OFFLINE
  •  
  • Local time:01:07 AM

Posted 23 November 2008 - 07:05 PM

svchost.exe is infected it's slowing my computer with mutiple svshost.exe processes in task manager, but I don't know where to go from here. I have the win32.virtumonde virus. I managed to get rid of some of the virus but it's still buried in my system. I really want to get rid of this so i can play games, thanks for any help. Here's my log:


ComboFix 08-11-22.02 - Administrator 2008-11-23 14:34:54.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1735 [GMT -8:00]
Running from: c:\documents and settings\Administrator\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Administrator\Desktop\WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\INSTALL.LOG
c:\windows\system32\AutoRun.inf
c:\windows\system32\lphclm3j0ej65.exe

c:\windows\system32\lsass.exe . . . is infected!!

c:\windows\system32\winlogon.exe . . . is infected!!

c:\windows\system32\services.exe . . . is infected!!

c:\windows\system32\svchost.exe . . . is infected!!

c:\windows\system32\spoolsv.exe . . . is infected!!

c:\windows\explorer.exe . . . is infected!!

.
((((((((((((((((((((((((( Files Created from 2008-10-23 to 2008-11-23 )))))))))))))))))))))))))))))))
.

2008-11-23 13:47 . 2008-11-23 13:47 <DIR> d-------- c:\program files\Spyware Doctor
2008-11-23 13:47 . 2008-11-23 13:47 <DIR> d-------- c:\documents and settings\Administrator\Application Data\PC Tools
2008-11-23 13:47 . 2007-12-10 14:53 81,288 --a------ c:\windows\system32\drivers\iksyssec.sys
2008-11-23 13:47 . 2007-12-10 14:53 66,952 --a------ c:\windows\system32\drivers\iksysflt.sys
2008-11-23 13:47 . 2007-12-10 14:53 41,864 --a------ c:\windows\system32\drivers\ikfilesec.sys
2008-11-23 13:47 . 2007-12-10 14:53 29,576 --a------ c:\windows\system32\drivers\kcom.sys
2008-11-19 14:44 . 2008-11-19 14:44 <DIR> d-------- c:\windows\system32\xlive
2008-11-19 14:23 . 2008-11-19 14:25 <DIR> d-------- c:\program files\Winamp3
2008-11-19 14:04 . 2008-11-19 14:04 <DIR> d-------- c:\program files\Bethesda Softworks
2008-11-19 14:04 . 2008-11-19 14:04 <DIR> d-------- c:\documents and settings\All Users\Application Data\Fallout3
2008-11-18 13:07 . 2007-09-05 23:22 289,144 --a------ c:\windows\system32\VCCLSID.exe
2008-11-18 13:07 . 2006-04-27 16:49 288,417 --a------ c:\windows\system32\SrchSTS.exe
2008-11-18 13:07 . 2008-10-01 14:51 87,552 --a------ c:\windows\system32\VACFix.exe
2008-11-18 13:07 . 2008-10-10 07:58 82,944 --a------ c:\windows\system32\o4Patch.exe
2008-11-18 13:07 . 2008-05-18 20:40 82,944 --a------ c:\windows\system32\IEDFix.exe
2008-11-18 13:07 . 2008-10-10 07:58 82,944 --a------ c:\windows\system32\IEDFix.C.exe
2008-11-18 13:07 . 2008-08-18 11:19 82,432 --a------ c:\windows\system32\404Fix.exe
2008-11-18 13:07 . 2003-06-05 20:13 53,248 --a------ c:\windows\system32\Process.exe
2008-11-18 13:07 . 2004-07-31 17:50 51,200 --a------ c:\windows\system32\dumphive.exe
2008-11-18 13:07 . 2007-10-03 23:36 25,600 --a------ c:\windows\system32\WS2Fix.exe
2008-11-18 13:07 . 2008-11-23 14:18 1,408 --a------ c:\windows\system32\tmp.reg
2008-11-18 12:03 . 2008-11-18 12:11 <DIR> d-------- c:\program files\mIRC
2008-11-18 12:00 . 2008-11-18 12:00 <DIR> d-------- c:\program files\Lavasoft
2008-11-18 12:00 . 2008-11-18 12:00 <DIR> d-------- c:\program files\Common Files\Wise Installation Wizard
2008-11-18 11:11 . 2008-11-18 11:11 <DIR> d-------- c:\program files\BitLord
2008-11-18 10:25 . 2008-11-18 10:28 <DIR> d-------- c:\program files\Windows Live Safety Center
2008-11-13 15:47 . 2008-11-13 15:47 <DIR> d-------- c:\program files\AMD
2008-11-13 15:47 . 2006-07-01 22:39 36,864 --a------ c:\windows\system32\drivers\AmdK8.sys
2008-11-13 15:46 . 2008-11-13 15:46 <DIR> d-------- c:\documents and settings\Administrator\Application Data\InstallShield
2008-11-13 12:42 . 2008-11-13 12:42 <DIR> d-------- c:\documents and settings\All Users\Application Data\Blizzard
2008-11-12 11:05 . 2008-11-12 11:06 <DIR> d-------- c:\windows\aim95
2008-11-12 11:05 . 2008-11-12 11:05 63 --a------ c:\windows\wininit.ini
2008-11-02 18:41 . 2008-11-02 18:41 410,976 --a------ c:\windows\system32\deploytk.dll
2008-11-02 18:41 . 2008-11-02 18:41 73,728 --a------ c:\windows\system32\javacpl.cpl

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-11-23 21:57 --------- d-----w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2008-11-23 21:50 --------- d---a-w c:\documents and settings\All Users\Application Data\TEMP
2008-11-19 22:04 --------- d--h--w c:\program files\InstallShield Installation Information
2008-11-19 16:52 --------- d-----w c:\documents and settings\Administrator\Application Data\mIRC
2008-11-14 14:06 --------- d-----w c:\program files\World of Warcraft
2008-11-03 06:10 0 ----a-w c:\windows\system32\drivers\2fa91856.sys
2008-11-03 02:41 --------- d-----w c:\program files\Java
2008-10-02 18:07 453,152 ----a-w c:\windows\system32\NVUNINST.EXE
2008-09-27 18:57 --------- d-----w c:\documents and settings\Administrator\Application Data\.BitTornado
2008-09-27 16:12 --------- d-----w c:\program files\Soulseek
2008-09-27 00:52 --------- d-----w c:\documents and settings\Administrator\Application Data\streamripper
2008-09-27 00:50 --------- d-----w c:\program files\Ratajik Software
2008-09-27 00:49 --------- d-----w c:\program files\Winamp
2008-09-26 17:51 --------- d-----w c:\program files\Common Files\Real
2008-09-26 17:50 --------- d-----w c:\program files\Real
2008-09-25 20:05 --------- d-----w c:\program files\Spybot - Search & Destroy
2008-09-25 19:03 --------- d-----w c:\documents and settings\All Users\Application Data\Lavasoft
2008-09-24 17:32 --------- d-----w c:\program files\NCH Swift Sound
2008-09-24 07:29 279,712 ----a-w c:\windows\system32\drivers\atksgt.sys
2008-09-24 07:29 25,888 ----a-w c:\windows\system32\drivers\lirsgt.sys
2008-09-24 06:56 --------- d-----w c:\program files\HP
2008-09-23 19:06 --------- d-----w c:\program files\VideoLAN
2008-09-23 19:05 --------- d-----w c:\documents and settings\All Users\Application Data\Kodak
2008-09-23 19:04 --------- d-----w c:\program files\Kodak
2008-09-23 19:01 --------- d-----w c:\program files\Common Files\HP
2008-09-22 15:53 22,328 ----a-w c:\documents and settings\Administrator\Application Data\PnkBstrK.sys
2008-09-22 15:53 107,832 ----a-w c:\windows\system32\PnkBstrB.exe
2008-09-22 15:52 66,872 ----a-w c:\windows\system32\PnkBstrA.exe
2008-09-22 15:52 2,337,865 ----a-w c:\windows\system32\pbsvc.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-10-07 13574144]
"WinampAgent"="c:\program files\Winamp3\winampa.exe" [2002-07-23 12288]

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0]
Source= c:\documents and settings\Administrator\Favorites\m_5dcbee7be0101b31a3f12aeaeb8152d2.jpg
FriendlyName=

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\1]
Source= c:\documents and settings\Administrator\Favorites\m_649db145192b8d2c124ae2c0ad144c9d.jpg
FriendlyName=

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\2]
Source= c:\documents and settings\Administrator\Favorites\m_25a5fd707a67e3d96772af7029de0a60.jpg
FriendlyName=

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\3]
Source= c:\documents and settings\Administrator\Favorites\l_d7fc2398162e6cd6432bc4adbaa72b28.jpg
FriendlyName=

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\4]
Source= c:\documents and settings\Administrator\Favorites\l_49d07d7416734579e1347a9578210ac4.jpg
FriendlyName=

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\5]
Source= c:\documents and settings\Administrator\My Documents\My Pictures\untitled.bmp
FriendlyName=

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\6]
Source= c:\documents and settings\Administrator\Favorites\m_2e392574c20c8108af69da8b743bc6ba.jpg
FriendlyName=

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\7]
Source= c:\documents and settings\Administrator\Favorites\m_4db8584e6f937615108f23545cee5f36.jpg
FriendlyName=

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\8]
Source= c:\documents and settings\Administrator\Favorites\l_64a6de5b4dadad3fa6e46b0583216aa7.jpg
FriendlyName=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Soulseek\\slsk.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"c:\\Program Files\\Ubisoft\\Tom Clancy's Rainbow Six Vegas 2\\Binaries\\R6Vegas2_Game.exe"=
"c:\\Program Files\\Ubisoft\\Tom Clancy's Rainbow Six Vegas 2\\Binaries\\R6Vegas2_Launcher.exe"=
"c:\\Program Files\\BitLord\\BitLord.exe"=

R2 CTAudSvcService;Creative Audio Service;c:\program files\Creative\Shared Files\CTAudSvc.exe [2008-07-30 417792]
R3 AN983;ADMtek AN983/AN985/ADM951X 10/100Mbps Fast Ethernet Adapter;c:\windows\system32\DRIVERS\AN983.sys [2008-05-07 36224]
R3 ha20x2k;Creative 20X HAL Driver;c:\windows\system32\drivers\ha20x2k.sys [2008-02-25 1172504]
S1 2fa91856;2fa91856;c:\windows\system32\drivers\2fa91856.sys [2008-10-22 0]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08
.
.
------- Supplementary Scan -------
.
FireFox -: Profile - c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\o33pysou.default\
FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.google.com
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-11-23 14:37:05
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(536)
c:\windows\system32\rsaenh.dll

- - - - - - - > 'lsass.exe'(592)
c:\windows\system32\msprivs.dll
c:\windows\system32\rsaenh.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Lavasoft\Ad-Aware\aawservice.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\nvsvc32.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2008-11-23 14:38:42 - machine was rebooted
ComboFix-quarantined-files.txt 2008-11-23 22:38:32

Pre-Run: 6,941,114,368 bytes free
Post-Run: 6,922,170,368 bytes free

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect /NoExecute=OptIn

188

Edited by sharpblade15, 23 November 2008 - 07:06 PM.


BC AdBot (Login to Remove)

 


#2 extremeboy

extremeboy

  • Malware Response Team
  • 12,975 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:02:07 AM

Posted 09 December 2008 - 08:18 PM

Hi

My name is Extremeboy (or EB for short), and I will be helping you with your log.

I apologize for the delay in response. We get overwhelmed with logs at times, but we are trying our best to keep up. If you have since resolved the original problem you were having, we would appreciate you letting us know. If not please perform the following so I can have a look at the current condition of your machine.

If you do not make a reply in 5 days, we will need to close your topic.

You may want to keep the link to this topic in your favourites. Alternatively, you can click the Posted Image button at the top bar of this topic and Track this Topic. The topics you are tracking can be found here.

Please take note of some guidelines for this fix:
  • Refrain from making any changes to your computer including installing/uninstall programs, deleting files, modifying the registry, and running scanners or tools. Doing so could cause changes to the directions I have to give you and prolong the time required. Further more, you should not be taking any advice relating to this computer from any other source throughout the course of this fix.
  • If you do not understand any step(s) provided, please do not hesitate to ask before continuing. I would much rather clarify instructions or explain them differently than have something important broken.
  • Even if things appear to be better, it might not mean we are finished. Please continue to follow my instructions and reply back until I give you the "all clean". We do not want to clean you part-way, only to have the system re-infect itself.
  • Please reply using the Posted Image button in the lower right hand corner of your screen. Do not start a new topic. The logs that you post should be pasted directly into the reply. Only attach them if requested or if they do not fit into the post.
  • Old topics are closed after 3 days with no reply, and working topics are closed after 5 days. If for any reason you cannot complete instructions within that time, that's fine, just post back here so that we know you're still here.
Download and Run OTViewit
  • Please download OTViewIt by OldTimer.
  • Save it to your desktop.
  • Double click on the Posted Image icon on your desktop.
  • Click the "Scan All Users" checkbox.
  • Push the Posted Image button.
  • Two reports will open, copy and paste them in a reply here:
  • OTViewIt.txt <-- Will be opened
  • Extra.txt <-- Will be minimized
Run Kaspersky Online Scanner
Please do a scan with Kaspersky Online Scanner.

This scan is for Internet Explorer only.

If you are using Windows Vista, open your browser by right-clicking on its icon and select Run as administrator to perform this scan.
  • Open the Kaspersky Scanner page.
  • Click on Accept and install any components it needs.
  • The program will install and then begin downloading the latest definition files.
  • After the files have been downloaded on the left side of the page in the Scan section select My Computer
  • This will start the program and scan your system.
  • The scan will take a while, so be patient and let it run.
  • Once the scan is complete, click on View scan report
  • Now, click on the Save Report as button.
  • Save the file to your desktop.
  • Copy and paste that information in your next post.
You can refer to this animation by sundavis.

In your next reply please include the following:
  • OTViewIt.txt
  • Extra.txt
  • Kaspersky's Log

Important Note: For other users who are reading this topic,the instructions provided in this topic are for the original topic starter ONLY. Even if you have similar problems or even log entries to those given here, please do not follow the directions, especially those involving specific tools and scripts. Doing so can result in serious damage to your computer. Instead, please start your own topic and feel free to link to any relevant topics as needed.Please Do NOT follow the instructions provided for this topic.

With Regards,
Extremeboy
Note: Please do not PM me asking for help, instead please post it in the correct forum requesting for help. Help requests via the PM system will be ignored.

If I'm helping you and I don't reply within 48 hours please feel free to send me a PM.

The help you receive here is always free but if you wish to show your appreciation, you may wish to Posted Image.

#3 extremeboy

extremeboy

  • Malware Response Team
  • 12,975 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:02:07 AM

Posted 12 December 2008 - 06:59 PM

Hi.

Are you still there?

If you are please follow the instructions in my previous post.

If you still need help, follow the instructions I have given in my response. If you have since had your problem solved, we would appreciate you letting us know so we can close the topic.

Please reply back telling us so. If you don't reply within 5 days the topic will need to be closed.

Thanks for understanding. :thumbsup:

With Regards,
Extremeboy
Note: Please do not PM me asking for help, instead please post it in the correct forum requesting for help. Help requests via the PM system will be ignored.

If I'm helping you and I don't reply within 48 hours please feel free to send me a PM.

The help you receive here is always free but if you wish to show your appreciation, you may wish to Posted Image.

#4 miekiemoes

miekiemoes

    Malware Killer Dog


  • Malware Response Team
  • 19,420 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Belgium
  • Local time:08:07 AM

Posted 16 December 2008 - 08:26 AM

Due to the lack of feedback, this Topic is closed.
If you need this topic reopened for continuations of existing problems, please request this by sending me a PM with the address of the thread. This applies only to the original topic starter.

Everyone else please begin a New Topic.
AntispywareScanners---Antivirus Scanners---Firewalls---Online Scanners---Prevention---Help! My computer is slow---My Blog---Follow me on Twitter.
My help is ALWAYS FREE, but if you want to donate to help me continue my fight against malware -- click here!
Asking for help via Private Message or Mail will be ignored - So If you need help, post your problem in the forum.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users