Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

HELP VIRUS!


  • This topic is locked This topic is locked
2 replies to this topic

#1 crashpad

crashpad

  • Members
  • 2 posts
  • OFFLINE
  •  
  • Local time:06:08 PM

Posted 25 December 2008 - 08:40 AM

i downloaded a virus by the name Backdoor.Tidserv!inf. i searched the forums and read up on some removal instructions. ive used combo fix and the recovery console method and im posting both the hijack this and combo fix logs for guidance.i desperately need some help here....
my hijack this and combo logs are :

Combo fix:

ComboFix 08-12-24.01 - A MOUTHFUL 2008-12-25 15:49:53.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.3062.2444 [GMT 5:00]
Running from: c:\documents and settings\A MOUTHFUL\Desktop\New Folder (2)\ComboFix.exe
Command switches used :: c:\documents and settings\A MOUTHFUL\Desktop\New Folder (2)\WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Autorun.inf
C:\resycled
c:\resycled\boot.com
c:\windows\jestertb.dll
c:\windows\system32\drivers\msqpdxserv.sys
c:\windows\system32\hlvdd.dll
D:\Autorun.inf
D:\resycled
d:\resycled\boot.com
E:\Autorun.inf
E:\resycled
e:\resycled\boot.com
F:\Autorun.inf
F:\resycled
f:\resycled\boot.com
I:\Autorun.inf
I:\resycled
i:\resycled\boot.com
J:\Autorun.inf
J:\resycled
j:\resycled\boot.com

.
((((((((((((((((((((((((( Files Created from 2008-11-25 to 2008-12-25 )))))))))))))))))))))))))))))))
.

2008-12-25 15:27 . 2008-12-25 15:27 <DIR> d-------- c:\program files\Trend Micro
2008-12-25 02:07 . 2008-12-25 02:07 <DIR> d-------- c:\documents and settings\Administrator\Application Data\Malwarebytes
2008-12-25 02:05 . 2008-12-25 02:06 <DIR> d-------- c:\documents and settings\Administrator
2008-12-25 01:52 . 2008-12-25 01:52 <DIR> d-------- c:\program files\Malwarebytes' Anti-Malware
2008-12-25 01:52 . 2008-12-25 01:52 <DIR> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes
2008-12-25 01:52 . 2008-12-25 01:52 <DIR> d-------- c:\documents and settings\A MOUTHFUL\Application Data\Malwarebytes
2008-12-25 01:52 . 2008-12-03 19:52 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
2008-12-25 01:52 . 2008-12-03 19:52 15,504 --a------ c:\windows\system32\drivers\mbam.sys
2008-12-24 22:30 . 2008-12-24 22:30 <DIR> d-------- c:\program files\Burger Island 2
2008-12-24 22:29 . 2008-12-24 22:30 <DIR> d-------- c:\program files\Piggly Christmas Edition
2008-12-24 22:28 . 2008-12-24 22:28 <DIR> d-------- c:\documents and settings\All Users\Application Data\NevoSoft Games
2008-12-24 20:30 . 2008-12-24 22:28 <DIR> d-------- c:\program files\Farm Craft
2008-12-24 20:30 . 2008-12-24 22:39 <DIR> d-------- c:\program files\Alice Greenfingers 2
2008-12-24 09:38 . 2008-12-24 09:38 <DIR> d-------- c:\documents and settings\TWINKLER\Application Data\PlayFirst
2008-12-24 01:23 . 2008-12-24 14:51 <DIR> d-------- c:\documents and settings\TWINKLER\Application Data\MEGAUPLOADTOOLBAR
2008-12-24 01:23 . 2008-12-24 14:03 <DIR> d-------- c:\documents and settings\TWINKLER\Application Data\EmailNotifier
2008-12-24 01:18 . 2008-12-24 01:19 <DIR> d-------- c:\program files\The Great Chocolate Chase
2008-12-24 00:05 . 2008-12-24 01:19 <DIR> d-------- c:\documents and settings\All Users\Application Data\PlayFirst
2008-12-24 00:05 . 2008-12-24 01:19 <DIR> d-------- c:\documents and settings\A MOUTHFUL\Application Data\PlayFirst
2008-12-23 23:08 . 2008-12-24 00:05 <DIR> d-------- c:\program files\Chocolatier 2
2008-12-23 22:53 . 2008-12-23 22:53 <DIR> d-------- c:\documents and settings\All Users\Application Data\Sandlot Games
2008-12-23 22:50 . 2008-12-23 22:53 <DIR> d-------- c:\program files\Westward II Heroes Of The Frontier
2008-12-21 12:53 . 2008-12-21 12:53 <DIR> d-------- c:\documents and settings\A MOUTHFUL\Application Data\Megaupload
2008-12-21 12:52 . 2008-12-25 15:29 <DIR> d-------- c:\program files\MegauploadToolbar
2008-12-21 12:52 . 2008-12-21 12:52 <DIR> d-------- c:\program files\Megaupload
2008-12-21 12:52 . 2008-12-21 12:52 <DIR> d-------- c:\documents and settings\All Users\Application Data\Megaupload
2008-12-21 12:52 . 2008-12-21 12:52 <DIR> d-------- c:\documents and settings\All Users\Application Data\EmailNotifier
2008-12-21 12:52 . 2008-12-21 12:52 <DIR> d-------- c:\documents and settings\A MOUTHFUL\Application Data\MegauploadToolbar
2008-12-21 12:52 . 2008-12-21 12:52 <DIR> d-------- c:\documents and settings\A MOUTHFUL\Application Data\EmailNotifier
2008-12-20 21:03 . 2008-12-20 21:03 <DIR> d-------- c:\program files\Google
2008-12-18 21:56 . 2008-12-18 21:56 2 --a------ c:\windows\msdbc_9852851.dat
2008-12-17 16:29 . 2008-12-17 19:55 <DIR> d-------- c:\windows\system32\CatRoot_bak
2008-12-16 20:40 . 2008-12-16 20:40 4,096 --a------ c:\windows\d3dx.dat
2008-12-16 19:39 . 2008-12-17 21:23 <DIR> d-------- c:\documents and settings\All Users\Application Data\CaveDays
2008-12-12 20:42 . 2008-12-12 20:42 <DIR> d-------- c:\windows\MSSecurityNS
2008-12-12 20:42 . 2008-12-12 20:42 <DIR> d-------- c:\windows\MSSecurityNi
2008-12-12 20:42 . 2008-12-12 20:42 <DIR> d-------- c:\program files\onOne Software
2008-12-12 20:42 . 2008-12-12 20:42 <DIR> d-------- c:\documents and settings\All Users\Application Data\onOne Software
2008-12-12 20:42 . 2008-12-12 20:42 <DIR> d-------- c:\documents and settings\A MOUTHFUL\Application Data\onOne Software
2008-12-12 16:17 . 2008-12-12 16:17 <DIR> d-------- c:\program files\MSXML 6.0
2008-12-12 16:16 . 2004-08-04 03:56 221,184 --a------ c:\windows\system32\wmpns.dll
2008-12-12 15:16 . 2008-06-13 18:10 272,128 --------- c:\windows\system32\drivers\bthport.sys
2008-12-12 15:16 . 2008-06-13 18:10 272,128 -----c--- c:\windows\system32\dllcache\bthport.sys
2008-12-12 14:49 . 2008-08-14 15:00 2,180,352 -----c--- c:\windows\system32\dllcache\ntoskrnl.exe
2008-12-12 14:49 . 2008-08-14 14:58 2,136,064 -----c--- c:\windows\system32\dllcache\ntkrnlmp.exe
2008-12-12 14:49 . 2008-08-14 14:22 2,057,728 -----c--- c:\windows\system32\dllcache\ntkrnlpa.exe
2008-12-12 14:49 . 2008-08-14 14:22 2,015,744 -----c--- c:\windows\system32\dllcache\ntkrpamp.exe
2008-12-12 14:46 . 2008-10-24 16:10 453,632 -----c--- c:\windows\system32\dllcache\mrxsmb.sys
2008-12-11 16:07 . 2008-12-13 16:10 <DIR> d--h----- c:\windows\$hf_mig$
2008-12-11 11:05 . 2007-03-12 16:42 3,495,784 --a------ c:\windows\system32\d3dx9_33.dll
2008-12-11 11:05 . 2007-03-12 16:42 1,123,696 --a------ c:\windows\system32\D3DCompiler_33.dll
2008-12-11 11:05 . 2007-03-15 16:57 443,752 --a------ c:\windows\system32\d3dx10_33.dll
2008-12-11 11:05 . 2007-04-04 18:55 261,480 --a------ c:\windows\system32\xactengine2_7.dll
2008-12-11 11:01 . 2008-12-11 11:01 <DIR> d-------- c:\documents and settings\A MOUTHFUL\Application Data\InstallShield
2008-12-10 19:31 . 2008-12-10 19:32 <DIR> d-------- c:\program files\Common Files\Autodesk Shared
2008-12-10 19:31 . 2008-12-10 19:43 <DIR> d-------- c:\documents and settings\All Users\Application Data\Autodesk
2008-12-10 19:20 . 2008-12-10 19:32 <DIR> d-------- c:\program files\Autodesk
2008-12-10 18:26 . 2008-12-10 18:26 <DIR> d-------- c:\program files\Snapshot Adventures
2008-12-10 18:25 . 2008-12-10 18:25 <DIR> d-------- c:\program files\Vector Magic
2008-12-10 18:25 . 2008-12-10 18:25 <DIR> d-------- c:\program files\ReflexiveArcade
2008-12-10 18:08 . 2008-12-10 18:08 <DIR> d-------- c:\program files\FontLab
2008-12-10 18:08 . 2008-12-10 18:08 <DIR> d-------- c:\program files\Common Files\FontLab
2008-12-10 00:42 . 2008-12-10 00:42 <DIR> d-------- c:\documents and settings\All Users\Application Data\SpinTop Games
2008-12-09 23:52 . 2008-12-09 23:52 <DIR> d-------- c:\documents and settings\All Users\Application Data\Intenium
2008-12-09 23:21 . 2008-12-09 23:21 <DIR> d-------- c:\documents and settings\All Users\Application Data\MumboJumbo
2008-12-08 20:49 . 2008-12-08 20:49 433 --a------ c:\windows\Buildalot3.ini
2008-12-08 20:03 . 2008-12-25 00:27 <DIR> d-------- C:\Restaurant Rush
2008-12-08 20:03 . 2008-12-08 20:03 <DIR> d-------- C:\Green Valley Fun on the Farm
2008-12-08 18:33 . 2008-12-08 18:33 <DIR> d--hs---- c:\windows\ftpcache
2008-12-08 13:28 . 2008-12-08 13:28 <DIR> d-------- c:\documents and settings\A MOUTHFUL\Application Data\7Wonders
2008-12-08 10:48 . 2008-12-08 10:48 <DIR> d-------- c:\documents and settings\All Users\Application Data\HipSoft
2008-12-08 10:46 . 2008-12-24 14:33 <DIR> d-a------ c:\documents and settings\All Users\Application Data\TEMP
2008-12-08 10:32 . 2008-12-08 10:32 <DIR> d-------- c:\documents and settings\TWINKLER\Application Data\AlterLab
2008-12-08 00:46 . 2008-12-08 00:46 <DIR> d-------- c:\documents and settings\A MOUTHFUL\Application Data\AlterLab
2008-12-07 20:48 . 2008-12-07 20:48 <DIR> d-------- c:\program files\Sir Arthur in the Dragonland
2008-12-07 17:08 . 2008-12-07 17:08 <DIR> d-------- c:\program files\TwistingPixels
2008-12-07 14:14 . 2008-12-07 14:14 <DIR> d-------- c:\program files\Games
2008-12-07 13:39 . 2008-12-07 13:39 <DIR> d-------- C:\Lavender's Botanicals
2008-12-07 13:38 . 2008-12-10 12:57 <DIR> d-------- c:\documents and settings\A MOUTHFUL\Application Data\MysteryStudio
2008-12-07 13:37 . 2008-12-07 13:37 <DIR> d-------- c:\windows\7 Wonders Treasures of Seven
2008-12-07 13:37 . 2008-12-07 13:37 <DIR> d-------- c:\program files\7 Wonders Treasures of Seven
2008-12-07 01:53 . 2008-12-07 01:53 <DIR> d-------- c:\windows\Build a lot 3 Passport to Europe
2008-12-07 01:53 . 2008-12-07 01:54 <DIR> d-------- c:\program files\Build a lot 3 Passport to Europe
2008-12-07 01:04 . 2008-12-07 01:04 <DIR> d-------- c:\program files\Patriot Games
2008-12-06 22:59 . 2008-12-06 22:59 <DIR> d-------- C:\GameRival
2008-12-06 22:59 . 2008-12-06 22:59 827,392 --a------ c:\windows\system32\FLASH.OCX
2008-12-06 22:26 . 2008-12-06 22:39 <DIR> d-------- c:\windows\Reflexive Arcade Games - Strategy
2008-12-06 22:08 . 2008-12-06 22:08 <DIR> d-------- c:\program files\DAEMON Tools Lite
2008-12-06 20:55 . 2008-12-06 20:55 <DIR> d-------- c:\documents and settings\A MOUTHFUL\Application Data\DAEMON Tools
2008-12-06 20:55 . 2008-12-06 20:55 717,296 --a------ c:\windows\system32\drivers\sptd.sys
2008-12-06 17:45 . 2008-12-06 20:46 <DIR> d-------- c:\program files\Unlocker
2008-12-06 17:11 . 2008-12-06 17:11 <DIR> d-------- c:\documents and settings\A MOUTHFUL\Application Data\Nero
2008-12-06 14:26 . 2008-12-06 14:26 <DIR> d-------- c:\program files\Diskeeper Corporation
2008-12-06 14:26 . 2008-12-06 14:26 <DIR> d-------- c:\documents and settings\All Users\Application Data\Diskeeper Corporation
2008-12-06 11:52 . 2008-12-06 11:52 4,767 --a------ c:\windows\Irremote.ini
2008-12-06 11:38 . 2008-12-06 11:51 <DIR> d-------- c:\program files\Nero
2008-12-06 11:37 . 2008-12-06 12:03 <DIR> d-------- c:\program files\Common Files\Nero
2008-12-06 11:37 . 2008-12-06 11:44 <DIR> d-------- c:\documents and settings\All Users\Application Data\Nero
2008-12-04 18:47 . 2008-12-04 18:47 <DIR> d-------- c:\documents and settings\TWINKLER\Application Data\Games
2008-12-04 18:46 . 2008-12-25 15:07 <DIR> d-------- c:\documents and settings\TWINKLER\Application Data\WTablet
2008-12-04 18:46 . 2008-12-04 18:46 <DIR> d-------- c:\documents and settings\TWINKLER\Application Data\Symantec
2008-12-04 18:46 . 2008-12-04 18:46 <DIR> d-------- c:\documents and settings\TWINKLER\Application Data\Intel
2008-12-04 18:46 . 2008-12-24 17:07 <DIR> d-------- c:\documents and settings\TWINKLER
2008-12-04 00:10 . 2008-12-04 00:10 <DIR> d-------- c:\windows\Sun
2008-12-02 22:27 . 2008-12-02 22:27 <DIR> d-------- c:\documents and settings\A MOUTHFUL\Application Data\DivX
2008-12-02 17:08 . 2008-12-02 17:08 <DIR> d-------- c:\documents and settings\A MOUTHFUL\Application Data\Games
2008-12-01 18:55 . 2008-12-01 18:55 <DIR> d-------- c:\documents and settings\All Users\Application Data\InstallShield
2008-12-01 18:54 . 2006-11-29 13:06 3,426,072 --a------ c:\windows\system32\d3dx9_32.dll
2008-12-01 18:54 . 2006-09-28 16:05 2,414,360 --a------ c:\windows\system32\d3dx9_31.dll
2008-12-01 18:54 . 2007-01-24 15:27 255,848 --a------ c:\windows\system32\xactengine2_6.dll
2008-12-01 18:54 . 2006-12-08 12:02 251,672 --a------ c:\windows\system32\xactengine2_5.dll
2008-12-01 18:54 . 2006-09-28 16:05 237,848 --a------ c:\windows\system32\xactengine2_4.dll
2008-12-01 18:54 . 2007-04-04 18:53 81,768 --a------ c:\windows\system32\xinput1_3.dll
2008-12-01 18:54 . 2007-03-05 12:42 15,128 --a------ c:\windows\system32\x3daudio1_1.dll
2008-12-01 18:51 . 2008-12-01 18:51 <DIR> d-------- c:\windows\system32\AGEIA
2008-12-01 18:51 . 2008-12-01 18:52 <DIR> d-------- c:\program files\AGEIA Technologies
2008-12-01 18:51 . 2008-12-01 18:51 278,984 --a------ c:\windows\system32\drivers\atksgt.sys
2008-12-01 18:51 . 2008-12-01 18:51 25,416 --a------ c:\windows\system32\drivers\lirsgt.sys
2008-11-30 23:58 . 2008-12-21 14:55 805 --a------ c:\windows\INPAGE.INI
2008-11-30 23:58 . 2008-12-21 14:55 157 --a------ c:\windows\INPAGE2.INI
2008-11-30 23:27 . 2008-11-30 23:27 <DIR> d-------- c:\program files\Common Files\Aladdin Shared
2008-11-30 23:27 . 2008-07-17 16:37 2,549,248 --a------ c:\windows\system32\hasplms.exe
2008-11-30 23:27 . 2008-07-17 16:37 2,549,248 --a------ c:\windows\system32\aksllmtp.exe
2008-11-30 23:27 . 2008-02-11 16:55 586,240 --a------ c:\windows\system32\drivers\hardlock.sys
2008-11-30 23:27 . 2008-03-27 18:50 350,720 --a------ c:\windows\system32\drivers\aksfridge.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-12-25 10:51 --------- d-----w c:\program files\Common Files\Symantec Shared
2008-12-21 07:52 --------- d--h--w c:\program files\InstallShield Installation Information
2008-12-17 15:23 --------- d-----w c:\program files\Norton PC Checkup
2008-12-02 08:30 --------- d-----w c:\documents and settings\All Users\Application Data\Symantec
2008-12-01 13:46 --------- d-----w c:\program files\Common Files\InstallShield
2008-12-01 07:35 --------- d-----w c:\documents and settings\All Users\Application Data\Microsoft Help
2008-11-30 09:46 --------- d-----w c:\program files\Common Files\Adobe
2008-11-29 19:19 --------- d-----w c:\program files\Norton 360
2008-11-29 19:13 --------- d-----w c:\program files\Adobe Media Player
2008-11-29 19:11 --------- d-----w c:\program files\Common Files\Adobe AIR
2008-11-29 19:09 --------- d-----w c:\program files\Common Files\Macrovision Shared
2008-11-29 18:51 805 ----a-w c:\windows\system32\drivers\SYMEVENT.INF
2008-11-29 18:51 60,800 ----a-w c:\windows\system32\S32EVNT1.DLL
2008-11-29 18:51 123,952 ----a-w c:\windows\system32\drivers\SYMEVENT.SYS
2008-11-29 18:51 10,671 ----a-w c:\windows\system32\drivers\SYMEVENT.CAT
2008-11-29 18:51 --------- d-----w c:\program files\Symantec
2008-11-29 18:46 --------- d-----w c:\documents and settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2008-11-29 18:31 --------- d-----w c:\program files\Windows Sidebar
2008-11-29 17:54 --------- d-----w c:\program files\Microsoft Works
2008-11-29 17:24 --------- d-----w c:\documents and settings\All Users\Application Data\Avocent AdminWorks
2008-11-29 17:22 6,784 ----a-w c:\windows\system32\drivers\osaio.sys
2008-11-29 17:22 --------- d-----w c:\program files\Intel
2008-11-29 17:21 --------- d-----w c:\program files\DivX
2008-11-29 17:05 --------- d-----w c:\program files\Realtek
2008-11-29 15:59 315,392 ----a-w c:\windows\HideWin.exe
2008-11-29 15:57 --------- d-----w c:\program files\Intel Desktop Board
2008-11-29 15:52 --------- d-----w c:\program files\MSXML 4.0
2008-11-29 15:44 --------- d-----w c:\program files\microsoft frontpage
2008-11-04 04:35 499,712 ----a-w c:\windows\system32\msvcp71.dll
2008-11-04 04:35 348,160 ----a-w c:\windows\system32\msvcr71.dll
2008-10-23 13:01 283,648 ----a-w c:\windows\system32\gdi32.dll
2008-10-16 10:37 659,456 ----a-w c:\windows\system32\wininet.dll
2008-10-16 09:13 202,776 ----a-w c:\windows\system32\wuweb.dll
2008-10-16 09:13 1,809,944 ----a-w c:\windows\system32\wuaueng.dll
2008-10-16 09:12 561,688 ----a-w c:\windows\system32\wuapi.dll
2008-10-16 09:12 323,608 ----a-w c:\windows\system32\wucltui.dll
2008-10-16 09:09 92,696 ----a-w c:\windows\system32\cdm.dll
2008-10-16 09:09 51,224 ----a-w c:\windows\system32\wuauclt.exe
2008-10-16 09:09 43,544 ----a-w c:\windows\system32\wups2.dll
2008-10-16 09:08 34,328 ----a-w c:\windows\system32\wups.dll
2008-10-03 10:15 247,326 ----a-w c:\windows\system32\strmdll.dll
2008-09-30 11:43 1,286,152 ----a-w c:\windows\system32\msxml4.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\OverlayExcluded]
@="{4433A54A-1AC8-432F-90FC-85F045CF383C}"
[HKEY_CLASSES_ROOT\CLSID\{4433A54A-1AC8-432F-90FC-85F045CF383C}]
2008-10-31 12:24 576352 --a------ c:\program files\Common Files\Symantec Shared\Backup\buShell.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\OverlayPending]
@="{F17C0B1E-EF8E-4AD4-8E1B-7D7E8CB23225}"
[HKEY_CLASSES_ROOT\CLSID\{F17C0B1E-EF8E-4AD4-8E1B-7D7E8CB23225}]
2008-10-31 12:24 576352 --a------ c:\program files\Common Files\Symantec Shared\Backup\buShell.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\OverlayProtected]
@="{476D0EA3-80F9-48B5-B70B-05E677C9C148}"
[HKEY_CLASSES_ROOT\CLSID\{476D0EA3-80F9-48B5-B70B-05E677C9C148}]
2008-10-31 12:24 576352 --a------ c:\program files\Common Files\Symantec Shared\Backup\buShell.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Google Update"="c:\documents and settings\A MOUTHFUL\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2008-11-29 133104]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" [2008-08-08 490952]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-04-11 13524992]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-04-11 86016]
"ipTray.exe"="c:\program files\Intel\IDU\iptray.exe" [2006-12-28 2242328]
"ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2008-10-17 51048]
"osCheck"="c:\program files\Norton 360\osCheck.exe" [2008-02-26 988512]
"AdobeCS4ServiceManager"="c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" [2008-08-14 611712]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-11-10 136600]
"googletalk"="c:\program files\Google\Google Talk\googletalk.exe" [2007-01-02 3739648]
"RTHDCPL"="RTHDCPL.EXE" [2007-06-15 c:\windows\RTHDCPL.exe]
"nwiz"="nwiz.exe" [2008-04-11 c:\windows\system32\nwiz.exe]

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Common Files\\Adobe\\CS4ServiceManager\\CS4ServiceManager.exe"=
"c:\\Program Files\\Autodesk\\3dsMax8\\3dsmax.exe"=
"c:\\Program Files\\Autodesk\\backburner\\monitor.exe"=
"c:\\Program Files\\Autodesk\\backburner\\manager.exe"=
"c:\\Program Files\\Autodesk\\backburner\\server.exe"=
"f:\\Binaries\\BlackSite.exe"=
"c:\\Program Files\\Google\\Google Talk\\googletalk.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5353:TCP"= 5353:TCP:Adobe CSI CS4
"1947:TCP"= 1947:TCP:HASP SRM
"1947:UDP"= 1947:UDP:HASP SRM

R2 hasplms;HASP License Manager;c:\windows\system32\hasplms.exe -run []
R2 Nero BackItUp Scheduler 4.0;Nero BackItUp Scheduler 4.0;c:\program files\Common Files\Nero\Nero BackItUp 4\NBService.exe [2008-09-30 935208]
R2 osaio;osaio;\??\c:\windows\system32\drivers\osaio.sys [2008-11-29 6784]
R2 TabletServicePen;TabletServicePen;c:\windows\system32\Pen_Tablet.exe [2008-11-30 1373480]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;\??\c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2008-11-30 99376]
S3 COH_Mon;COH_Mon;\??\c:\windows\system32\Drivers\COH_Mon.sys [2008-01-13 23888]
S3 LiveUpdate Notice;LiveUpdate Notice;"c:\program files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon [2008-02-19 149352]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\C]
\Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL resycled\boot.com c:
\Shell\Open\command - resycled\boot.com c:

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\D]
\Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL resycled\boot.com d:
\Shell\Open\command - d:\resycled\boot.com d:

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\E]
\Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL resycled\boot.com e:
\Shell\Open\command - e:\resycled\boot.com e:

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\F]
\Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL resycled\boot.com f:
\Shell\Open\command - f:\resycled\boot.com f:

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\I]
\Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL resycled\boot.com i:
\Shell\Open\command - i:\resycled\boot.com i:

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\J]
\Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL resycled\boot.com j:
\Shell\Open\command - j:\resycled\boot.com j:

*Newly Created Service* - COMHOST
*Newly Created Service* - PROCEXP90
.
Contents of the 'Scheduled Tasks' folder

2008-12-25 c:\windows\Tasks\GoogleUpdateTaskUser.job
- c:\documents and settings\A MOUTHFUL\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2008-11-29 22:41]

2008-12-24 c:\windows\Tasks\Norton PC Checkup WeekDay Scanner.job
- c:\program files\norton pc checkup\PC_Checkup.exe [2008-12-17 20:23]

2008-12-21 c:\windows\Tasks\Norton PC Checkup Weekend Scanner.job
- c:\program files\norton pc checkup\PC_Checkup.exe [2008-12-17 20:23]
.
- - - - ORPHANS REMOVED - - - -

WebBrowser-{A057A204-BACC-4D26-C39E-35F1D2A32EC8} - (no file)
HKCU-Run-AdobeBridge - (no file)


.
------- Supplementary Scan -------
.
uInternet Connection Wizard,ShellNext = iexplore
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
TCP: {4D17B152-BF85-4FCC-9A55-2DE4F8DC0D5F} = 203.99.163.240,203.99.163.243
TCP: {6ED4BDC2-0368-4EB5-A8BD-EC5F6E31271F} = 203.99.163.240,203.99.163.243
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-12-25 15:51:13
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\msqpdxserv.sys]
"imagepath"="\systemroot\system32\drivers\msqpdxrrtirsip.sys"
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(1108)
c:\program files\Common Files\Adobe\Adobe Drive CS4\AdobeDriveCS4_NP.dll
.
Completion time: 2008-12-25 15:51:44
ComboFix-quarantined-files.txt 2008-12-25 10:51:34

Pre-Run: 24,376,696,832 bytes free
Post-Run: 24,417,611,776 bytes free

325 --- E O F --- 2008-12-17 11:40:41


Hijack this logs:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 3:52:44 PM, on 12/25/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe
C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
C:\Program Files\Intel\IDU\awServ.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Intel\IDU\iptray.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Documents and Settings\A MOUTHFUL\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\DAEMON Tools Lite\daemon.exe
C:\WINDOWS\system32\crypserv.exe
C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
C:\WINDOWS\system32\hasplms.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Autodesk\3dsMax8\mentalray\satellite\raysat_3dsmax8server.exe
C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PSIService.exe
c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe
C:\WINDOWS\system32\Pen_Tablet.exe
C:\WINDOWS\system32\WTablet\Pen_TabletUser.exe
C:\WINDOWS\system32\Pen_Tablet.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.6\coIEPlg.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dll
O2 - BHO: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Show Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.6\CoIEPlg.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [ipTray.exe] "C:\Program Files\Intel\IDU\iptray.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton 360\osCheck.exe"
O4 - HKLM\..\Run: [AdobeCS4ServiceManager] "C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [googletalk] C:\Program Files\Google\Google Talk\googletalk.exe /autostart
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\A MOUTHFUL\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Encarta Search Bar - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Common Files\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://fpdownload.macromedia.com/get/flash...ent/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{4D17B152-BF85-4FCC-9A55-2DE4F8DC0D5F}: NameServer = 203.99.163.240,203.99.163.243
O17 - HKLM\System\CCS\Services\Tcpip\..\{6ED4BDC2-0368-4EB5-A8BD-EC5F6E31271F}: NameServer = 203.99.163.240,203.99.163.243
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
O23 - Service: Admin Works Agent X8 (AWService) - OSA Technologies Inc., An Avocent Company - C:\Program Files\Intel\IDU\awServ.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: Crypkey License - Unknown owner - C:\WINDOWS\SYSTEM32\crypserv.exe
O23 - Service: Diskeeper - Diskeeper Corporation - C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: HASP License Manager (hasplms) - Aladdin Knowledge Systems Ltd. - C:\WINDOWS\system32\hasplms.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE
O23 - Service: LiveUpdate Notice - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: RaySat_3dsmax8 Server (mi-raysat_3dsmax8) - Unknown owner - C:\Program Files\Autodesk\3dsMax8\mentalray\satellite\raysat_3dsmax8server.exe
O23 - Service: Nero BackItUp Scheduler 4.0 - Nero AG - C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService.exe
O23 - Service: Protexis Licensing V2 (PSI_SVC_2) - Protexis Inc. - c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe
O23 - Service: TabletServicePen - Wacom Technology, Corp. - C:\WINDOWS\system32\Pen_Tablet.exe

--
End of file - 7995 bytes

BC AdBot (Login to Remove)

 


#2 KoanYorel

KoanYorel

    Bleepin' Conundrum


  • Members
  • 19,461 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:65 miles due East of the &quot;Logic Free Zone&quot;, in Md, USA
  • Local time:09:08 AM

Posted 07 January 2009 - 12:51 AM

Hello and welcome to Bleeping Computer

We apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help.

If you have since resolved the original problem you were having, we would appreciate you letting us know. If not please perform the following steps below so we can have a look at the current condition of your machine. If you have not done so, include a description of your problem, along with any steps you may have performed so far.

Upon completing the steps below a staff member will review and take the steps necessary with you to get your machine back in working order clean and free of malware.


Thanks and again sorry for the delay.

We need to see some information about what is happening in your machine. Please perform the following scan:
  • Download DDS by sUBs from one of the following links. Save it to your desktop.
  • Double click on the DDS icon, allow it to run.
  • A small box will open, with an explaination about the tool. No input is needed, the scan is running.
  • Notepad will open with the results, click no to the Optional_Scan
  • Follow the instructions that pop up for posting the results.
  • Close the program window, and delete the program from your desktop.
Please note: You may have to disable any script protection running if the scan fails to run. After downloading the tool, disconnect from the internet and disable all antivirus protection. Run the scan, enable your A/V and reconnect to the internet. Information on A/V control HERE


Please Hold on it may take us a day or so to get back with you.

R,
K
The only easy day was yesterday.

...some do, some don't; some will, some won't (WR)

#3 KoanYorel

KoanYorel

    Bleepin' Conundrum


  • Members
  • 19,461 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:65 miles due East of the &quot;Logic Free Zone&quot;, in Md, USA
  • Local time:09:08 AM

Posted 12 January 2009 - 08:46 AM

Due to the lack of feedback, this Topic is now closed.

If you still have problems, please Start a new topic.

R,
K
The only easy day was yesterday.

...some do, some don't; some will, some won't (WR)




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users