Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Symantec Email Proxy Popups


  • This topic is locked This topic is locked
8 replies to this topic

#1 GATES1580

GATES1580

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:11:19 AM

Posted 29 December 2008 - 04:04 PM

I have a IBM Thinkpad T42 laptop running Windows XP since April 2005.
A week ago, I downloaded AltoMP3 Gold software from Bit Torrents and installed it in the laptop. MY symantec anti-virus software immediately detected a a trojan and quarantined it. But Spyware Guard got installed in the system.
I removed spyware gaurd by going into the safe mode and running SpyBot.
But then, I started getting a lot of Symantec Email Proxy Popups whenever I had the wireless internet connection turned on. Running SpyBot, MalwareBytes didn't help and the problem still persists. I am still using the laptop without turning on the internet connection. I am posting this issue here hoping I would get some help. If I am unable to remove the virus/trojan, I am planning to format my disk and install linux. But I wanted to give this a try. Any help would be greatly appreciated.

The HiJackThis log file is attached.
Please let me know how to proceed in this case.
Thanks

Attached Files



BC AdBot (Login to Remove)

 


#2 GATES1580

GATES1580
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:11:19 AM

Posted 05 January 2009 - 03:01 PM

Could someone help me with this issue? I understand the resolutions go according to the priority.
If someone could help me in resolving this issue, I am sure a donation from me would be forthcoming.
Thanks

#3 Maurice Naggar

Maurice Naggar

    Eradicator de malware


  • Malware Response Team
  • 1,088 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:USA
  • Local time:11:19 AM

Posted 07 January 2009 - 11:53 PM

Hello GATES1580 .

You will want to print out or copy these instructions to Notepad for Safe Mode/offline reference!
These steps are for member GATES1580 only. If you are a lurker, do NOT try this on your system!
If you are not GATES1580 and have a similar problem, do NOT post here; start your own topic


Do not run or start any other programs while these utilities and tools are in use!
Posted Image Do NOT run any other tools on your own or do any fixes other than what is listed here.
If you have questions, please ask before you do something on your own.
But it is important that you get going on these following steps.
=

You have to turn off Tea Timer, otherwise any changes we make while cleaning the system will have not effect.
If you do not understand Tea Timer's function, keep it off permanently (and definitely off while we clean).
Launch Spybot S&D, go to the Mode menu and make sure "Advanced Mode" is selected.
On the left hand side, click on Tools, then click on the Resident Icon in the list.
Uncheck the "Resident "TeaTimer" (Protection of overall system settings) active." box.
Click on the "System Startup" icon in the List
Uncheck the "TeaTimer" box and "OK" any prompts.
If Teatimer gives you a warning that changes were made, click the "Allow Change" box when prompted.
Exit Spybot S&D when done.
=

Using Bit torrents obviously got you infected. Spywareguard (NOT the one by Javacool) malware is one of the current pests.
If you have any Bit torrent or other Peer-to-peer filesharing, de-install it now; before we get further down the road.
Downloading from unknown sources is one of the leading causes of transmission of malware.
"File-Sharing, otherwise known as Peer To Peer" and "Risks of File-Sharing Technology."

So much then, for blaming Windows and thinking Linux would do something better for you.

Download to your Desktop FixPolicies.exe, by Bill Castner, MS-MVP, a self-extracting ZIP archive from here:
http://cid-6aaab341ce47c5c2.skydrive.live....FixPolicies.exe
  • Double-click FixPolicies.exe.
  • Click the "Install" button on the bottom toolbar of the box that will open.
  • The program will create a new Folder called FixPolicies.
  • Double-click to Open the new Folder, and then double-click the file within: Fix_Policies.cmd.
  • A black box will briefly appear and then close.
  • This fix may prove temporary. Active malware may revert these changes at your next startup. You can safely run the utility again.
1. Set Windows to show all files and all folders.
On your Desktop, double click My Computer, from the menu options, select tools, then Folder Options, and then select VIEW Tab and look at all of settings listed.

"CHECK" (turn on) Display the contents of system folders.

Under column, Hidden files and folders----choose ( *select* ) Show hidden files and folders.
Next, un-check Hide extensions for known file types.
Next un-check Hide protected operating system files.

2. Take out the trash (temporary files & temporary internet files)
Please download ATF Cleaner by Atribune, saving it to your desktop. It is used to cleanout temporary files & temp areas used by internet browsers.
Start ATF-Cleaner.exe to run the program.

Under Main choose: Select All

Click the Empty Selected button.

If you use Firefox browser, do this also:
Click Firefox at the top and choose: Select All

Click the Empty Selected button.

NOTE: If you would like to keep your saved passwords, please click No at the prompt.

If you use Opera browser, do this also:
Click Opera at the top and choose: Select All

Click the Empty Selected button.

NOTE: If you would like to keep your saved passwords, please click No at the prompt.

Click Exit on the Main menu to close the program.
ATF-Cleaner should be run per the above in every user-login account {User Profile}

=
3. Important! => Open Notepad > Click on Format > Uncheck Word wrap, if checked. Exit Notepad.

Start your MBAM.
Click the Settings Tab. Make sure all option lines have a checkmark.
Click the Update tab. Press the "Check for Updates" button.
At this time, the current definitions are # 1629.

When done, click the Scanner tab.
Do a Quick Scan. Let it quarantine or remove tagged items. Get a copy of that log in your next reply.

I surely want to see this log.
=
You will want to print out or copy these instructions to Notepad for Safe Mode/offline reference!

Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools

Download The Avenger by Swandog46 from
http://swandog46.geekstogo.com/avenger2/download.php
  • Unzip/extract it to a folder on your Desktop.
  • Double click on avenger.exe to run The Avenger.
  • Click OK.
  • Make sure that the box next to Scan for rootkits has a tick in it and that the box next to Automatically disable any rootkits found does not have a tick in it.
  • Copy all of the text in the below textbox to the clibpboard by highlighting it and then pressing Ctrl+C.
    Drivers to delete:
    spywareguard
    MS AntiSpyware 2009
    
    Files to delete:
    C:\WINDOWS\system32\winscenter.exe
    c:\Documents and Settings\All Users\Application Data\CrucialSoft Ltd
    C:\Documents and Settings\All Users\Application Data\Microsoft\Internet Explorer\DLLs\uziaomdciu.dll
    C:\Documents and Settings\All Users\Application Data\Microsoft\Internet Explorer\DLLs\ieModule.dll
    C:\Documents and Settings\All Users\Application Data\Microsoft\Internet Explorer\DLLs\ayurdqwfqf.dll
    C:\WINDOWS\Jqexow.dll
    C:\WINDOWS\oyasuhel.dll
    C:\WINDOWS\TEMP\winlogin.exe
    C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\csrssc.exe
    C:\WINDOWS\SYSTEM32\crypts.dll
    C:\WINDOWS\system32\twext.exe
    C:\windows\system32\olesys.dll
    C:\windows\system32\moduleie.dll
    C:\windows\system32\iemodule.dll
    C:\windows\system32\fkxmstkbrb.dll
    C:\windows\system32\cwbddcjbpn.dll
    
    Folders to delete:
    C:\Program Files\Spyware Guard 2008
    C:\Program Files\Spyware Guard 2009
    C:\resycled
    D:\resycled
    E:\resycled
    F:\resycled
    g:\resycled
    h:\resycled
    
    Registry values to delete:
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run | spywareguard
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run | Hrimetecofiruji
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run | xsjfn83jkemfofght
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run | Jnskdfmf9eldfd
    
    Registry keys to delete:
    HKEY_LOCAL_MACHINE\software\spyware guard 
    HKEY_LOCAL_MACHINE\software\spyware guard 2008
  • In the avenger window, click the Paste Script from Clipboard icon, Posted Image button.
  • :!: Make sure that what appears in Avenger matches exactly what you were asked to Copy/Paste from the Code box above.
  • Click the Execute button.
  • You will be asked Are you sure you want to execute the current script?.
  • Click Yes.
  • You will now be asked First step completed --- The Avenger has been successfully set up to run on next boot. Reboot now?.
  • Click Yes.
  • Your PC will now be rebooted.
  • Note: If the above script contains Drivers to delete: or Drivers to disable:, then The Avenger will require two reboots to complete its operation.
  • If that is the case, it will force a BSOD on the first reboot. This is normal & expected behaviour.
  • After your PC has completed the necessary reboots, a log should automatically open. Please copy/paste the contents of c:\avenger.txt into your next reply.
=

If you have a prior copy of Combofix, delete it now :!:

If you have a prior copy of Combofix, delete it now !

Download ComboFix from one of these locations, saving to DESKTOP:

Link 1
Link 2
Link 3

Posted Image


Posted Image

* IMPORTANT !!! Save Combo-Fix.exe to your Desktop
If your I.E. browser shows a warning message at the top, do a Right-Click on the bar and select Download, saving it to the Desktop.
  • Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools

  • Double click on Combo-Fix.exe & follow the prompts.

  • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.


Posted Image


Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

Posted Image


Click on Yes, to continue scanning for malware.

Please watch Combofix as it runs, as you may see messages which require your response, or the pressing of OK button.

IF you should see a message like this:
Posted Image
then, be sure to write down fully and also copy that into your next reply here and then await for my response.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.
-------------------------------------------------------

A caution - Do not run Combofix more than once.
Do not touch your mouse/keyboard until the scan has completed, as this may cause the process to stall or your computer to lock.

The scan will temporarily disable your desktop, and if interrupted may leave your desktop disabled.
If this occurs, please reboot to restore the desktop.
Even when ComboFix appears to be doing nothing, look at your Drive light.
If it is flashing, Combofix is still at work.
=

RE-Enable your AntiVirus and AntiSpyware applications.

=
Next, Close all applications and windows.
If you have an older copy of SDFix, delete it now.
Download SDFix and save it to your Desktop.

Double click SDFix.exe and it will extract the files to %systemdrive%
(Drive that contains the Windows Directory, typically C:\SDFix)

Please then reboot your computer in Safe Mode by doing the following :
  • Restart your computer
  • After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
  • Instead of Windows loading as normal, the Advanced Options Menu should appear;
  • Select the first option, to run Windows in Safe Mode, then press Enter.
  • Choose your usual user account.
  • Open the extracted SDFix folder and double click RunThis.bat to start the script.
  • Type Y to begin the cleanup process.
  • It will remove any Trojan Services and Registry Entries that it finds then prompt you to press any key to Reboot.
  • Press any Key and it will restart the PC.
  • When the PC restarts the Fixtool will run again and complete the removal process then display Finished, press any key to end the script and load your desktop icons.
  • Once the desktop icons load the SDFix report will open on screen and also save into the SDFix folder as Report.txt
    (Report.txt will also be copied to Clipboard ready for posting back on the forum).
  • Finally paste the contents of the Report.txt back in a Reply here.
=
Next:
If you have a prior copy of SmitFraudFix, delete it now :!:
Please download SmitfraudFix (by S!Ri) :hand: Don't download SmitfraudFix until you're ready to run/use it. It's very important that you be using the most recent version (v2.388 as of this post).
Extract the contents of the exe file (a folder named SmitfraudFix) to your Desktop.

Please then reboot your computer in Safe Mode by doing the following :
  • Restart your computer
  • After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
  • Instead of Windows loading as normal, the Advanced Options Menu should appear;
  • Select the first option, to run Windows in Safe Mode, then press Enter.
  • Choose your usual user account.
1. Once in Safe Mode, open the SmitfraudFix folder and double-click smitfraudfix.cmd

2. Select option #2 - Clean by typing 2 and pressing Enter to delete infected files.

3. You will be prompted: "Registry cleaning - Do you want to clean the registry ?" Answer "Yes" by typing Y and pressing Enter in order to remove the desktop background and clean registry keys associated with the infection.

4. The tool will then check if wininet.dll is infected. If prompted to replace the infected file (if found), answer "Yes" by typing Y and pressing Enter.

5. The tool may need to restart your computer to finish the cleaning process; if it doesn't, please restart it into Normal Windows.

6. A text file will appear onscreen with results from the cleaning process. Please copy/paste the content of that report into your next reply along with the Report.txt from above.

The report also may be found at the root of the system drive, usually at C:\rapport.txt

Notes:
  • process.exe is detected by some antivirus programs (AntiVir, Dr.Web, Kaspersky) as a "RiskTool"; it is not a virus, but a program used to stop system processes. Antivirus programs cannot distinguish between "good" and "malicious" use of such programs, therefore they may alert the user. More on this at http://www.beyondlogic.org/consulting/proc...processutil.htm
  • Running option #2 on a non-infected computer will remove your Desktop background. No need to worry, you're infected
=

Reply back with copy of
  • the MBAM report,
  • C:\Avenger.txt
  • C:\Combofix.txt
  • the Report.txt from above,
  • C:\rapport.txt from SmitFraudFix run,
  • and, Tell me, How is your system now Posted Image
Be sure to do a Preview prior to pressing Submit because all reports may not fit into 1 single reply. You'll likely have to do more than 1 reply.

Edited by Maurice Naggar, 07 January 2009 - 11:56 PM.

~Maurice Naggar
MS-MVP (Oct 2002 - Sept 2010)

#4 GATES1580

GATES1580
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:11:19 AM

Posted 09 January 2009 - 02:18 PM

Hi Maurice
First of all, thanks for taking time to work on this issue.
I followed your suggestions step by step. The only problem I had was you said
"Click on the "System Startup" icon in the List
Uncheck the "TeaTimer" box and "OK" any prompts."
I couldn't find this box. So, I decided to uninstall spybot itself and proceed with the rest of your steps.

I retrieved the following log files through out this procedure:
1. the MBAM report,
2. C:\Avenger.txt
3. C:\Combofix.txt
4. the Report.txt
5. C:\rapport.txt from SmitFraudFix run

Below is the MBAM Report from the quick scan:
**********************************************************************
Malwarebytes' Anti-Malware 1.32
Database version: 1634
Windows 5.1.2600 Service Pack 2

1/9/2009 10:36:09 AM
mbam-log-2009-01-09 (10-36-09).txt

Scan type: Quick Scan
Objects scanned: 63315
Time elapsed: 6 minute(s), 30 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)
**********************************************************************
Given below is the stack trace from Avenger.txt:
**********************************************************************
Logfile of The Avenger Version 2.0, © by Swandog46
http://swandog46.geekstogo.com

Platform: Windows XP

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.
No rootkits found!


Error: registry key "\Registry\Machine\System\CurrentControlSet\Services\spywareguard" not found!
Deletion of driver "spywareguard" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist


Error: registry key "\Registry\Machine\System\CurrentControlSet\Services\MS AntiSpyware 2009" not found!
Deletion of driver "MS AntiSpyware 2009" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist


Error: file "C:\WINDOWS\system32\winscenter.exe" not found!
Deletion of file "C:\WINDOWS\system32\winscenter.exe" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist


Error: file "c:\Documents and Settings\All Users\Application Data\CrucialSoft Ltd" not found!
Deletion of file "c:\Documents and Settings\All Users\Application Data\CrucialSoft Ltd" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist


Error: file "C:\Documents and Settings\All Users\Application Data\Microsoft\Internet Explorer\DLLs\uziaomdciu.dll" not found!
Deletion of file "C:\Documents and Settings\All Users\Application Data\Microsoft\Internet Explorer\DLLs\uziaomdciu.dll" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist


Error: file "C:\Documents and Settings\All Users\Application Data\Microsoft\Internet Explorer\DLLs\ieModule.dll" not found!
Deletion of file "C:\Documents and Settings\All Users\Application Data\Microsoft\Internet Explorer\DLLs\ieModule.dll" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist


Error: file "C:\Documents and Settings\All Users\Application Data\Microsoft\Internet Explorer\DLLs\ayurdqwfqf.dll" not found!
Deletion of file "C:\Documents and Settings\All Users\Application Data\Microsoft\Internet Explorer\DLLs\ayurdqwfqf.dll" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist


Error: file "C:\WINDOWS\Jqexow.dll" not found!
Deletion of file "C:\WINDOWS\Jqexow.dll" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist


Error: file "C:\WINDOWS\oyasuhel.dll" not found!
Deletion of file "C:\WINDOWS\oyasuhel.dll" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist


Error: file "C:\WINDOWS\TEMP\winlogin.exe" not found!
Deletion of file "C:\WINDOWS\TEMP\winlogin.exe" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist


Error: file "C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\csrssc.exe" not found!
Deletion of file "C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\csrssc.exe" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist


Error: file "C:\WINDOWS\SYSTEM32\crypts.dll" not found!
Deletion of file "C:\WINDOWS\SYSTEM32\crypts.dll" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist


Error: file "C:\WINDOWS\system32\twext.exe" not found!
Deletion of file "C:\WINDOWS\system32\twext.exe" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist


Error: file "C:\windows\system32\olesys.dll" not found!
Deletion of file "C:\windows\system32\olesys.dll" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist


Error: file "C:\windows\system32\moduleie.dll" not found!
Deletion of file "C:\windows\system32\moduleie.dll" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist


Error: file "C:\windows\system32\iemodule.dll" not found!
Deletion of file "C:\windows\system32\iemodule.dll" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist


Error: file "C:\windows\system32\fkxmstkbrb.dll" not found!
Deletion of file "C:\windows\system32\fkxmstkbrb.dll" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist


Error: file "C:\windows\system32\cwbddcjbpn.dll" not found!
Deletion of file "C:\windows\system32\cwbddcjbpn.dll" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist


Error: folder "C:\Program Files\Spyware Guard 2008" not found!
Deletion of folder "C:\Program Files\Spyware Guard 2008" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist


Error: folder "C:\Program Files\Spyware Guard 2009" not found!
Deletion of folder "C:\Program Files\Spyware Guard 2009" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist


Error: folder "C:\resycled" not found!
Deletion of folder "C:\resycled" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist


Error: could not open folder "D:\resycled"
Deletion of folder "D:\resycled" failed!
Status: 0xc000003a (STATUS_OBJECT_PATH_NOT_FOUND)
--> bad path / the parent directory does not exist


Error: could not open folder "E:\resycled"
Deletion of folder "E:\resycled" failed!
Status: 0xc000003a (STATUS_OBJECT_PATH_NOT_FOUND)
--> bad path / the parent directory does not exist


Error: could not open folder "F:\resycled"
Deletion of folder "F:\resycled" failed!
Status: 0xc000003a (STATUS_OBJECT_PATH_NOT_FOUND)
--> bad path / the parent directory does not exist


Error: could not open folder "g:\resycled"
Deletion of folder "g:\resycled" failed!
Status: 0xc000003a (STATUS_OBJECT_PATH_NOT_FOUND)
--> bad path / the parent directory does not exist


Error: could not open folder "h:\resycled"
Deletion of folder "h:\resycled" failed!
Status: 0xc000003a (STATUS_OBJECT_PATH_NOT_FOUND)
--> bad path / the parent directory does not exist


Error: could not delete registry value "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|spywareguard"
Deletion of registry value "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|spywareguard" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist


Error: could not delete registry value "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|Hrimetecofiruji"
Deletion of registry value "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|Hrimetecofiruji" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist


Error: could not delete registry value "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|xsjfn83jkemfofght"
Deletion of registry value "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|xsjfn83jkemfofght" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist


Error: could not delete registry value "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|Jnskdfmf9eldfd"
Deletion of registry value "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|Jnskdfmf9eldfd" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist


Error: registry key "HKEY_LOCAL_MACHINE\software\spyware guard" not found!
Deletion of registry key "HKEY_LOCAL_MACHINE\software\spyware guard" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist


Error: registry key "HKEY_LOCAL_MACHINE\software\spyware guard 2008" not found!
Deletion of registry key "HKEY_LOCAL_MACHINE\software\spyware guard 2008" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist


Completed script processing.

*******************

Finished! Terminate.
**********************************************************************
The rest of the logs will follow in subsequent replies. I will have to post them into two more replies.

#5 GATES1580

GATES1580
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:11:19 AM

Posted 09 January 2009 - 02:22 PM

Here is the ComboFix.txt log:
****************************************************************************************************************************************************************
ComboFix 09-01-08.05 - Naveen 2009-01-09 11:56:25.3 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.511.95 [GMT -5:00]
Running from: c:\documents and settings\Naveen\Desktop\ComboFix.exe
.

((((((((((((((((((((((((( Files Created from 2008-12-09 to 2009-01-09 )))))))))))))))))))))))))))))))
.

2009-01-09 12:05 . 2009-01-09 12:05 4,474 --a------ c:\windows\GATHER.KM
2009-01-09 10:20 . 2009-01-09 10:20 <DIR> d-------- c:\documents and settings\Guest\Application Data\Bytemobile
2009-01-09 10:20 . 2009-01-09 10:20 <DIR> d-------- c:\documents and settings\Guest\Application Data\AT&T
2008-12-23 18:41 . 2008-12-23 18:41 <DIR> d-------- c:\program files\Trend Micro
2008-12-23 11:46 . 2008-12-23 12:20 <DIR> d-------- c:\documents and settings\Naveen\DoctorWeb
2008-12-23 11:32 . 2009-01-09 10:25 <DIR> d-------- c:\program files\Malwarebytes' Anti-Malware
2008-12-23 11:32 . 2008-12-23 11:32 <DIR> d-------- c:\documents and settings\Naveen\Application Data\Malwarebytes
2008-12-23 11:32 . 2008-12-23 11:32 <DIR> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes
2008-12-23 11:32 . 2009-01-04 18:38 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
2008-12-23 11:32 . 2009-01-04 18:38 15,504 --a------ c:\windows\system32\drivers\mbam.sys
2008-12-23 10:21 . 2008-12-23 10:21 <DIR> d-------- C:\VundoFix Backups
2008-12-22 20:57 . 2008-12-22 20:57 <DIR> d-------- c:\windows\system32\config\systemprofile\Application Data\Bytemobile
2008-12-22 20:44 . 2008-12-22 20:44 2 --a------ C:\-396002260
2008-12-12 22:57 . 2007-06-27 09:41 101,248 -ra------ c:\windows\system32\drivers\swnc8u56.sys
2008-12-12 22:56 . 2007-06-27 09:42 73,856 -ra------ c:\windows\system32\drivers\swumx56.sys
2008-12-12 22:53 . 2008-12-12 22:53 <DIR> d-------- c:\documents and settings\Naveen\Application Data\AT&T
2008-12-12 20:00 . 2008-12-12 20:00 <DIR> d-------- c:\documents and settings\NetworkService\Application Data\Bytemobile
2008-12-12 18:35 . 2008-12-12 18:35 <DIR> d-------- c:\documents and settings\Naveen\Application Data\DBUpdater
2008-12-12 18:35 . 2003-09-08 14:43 89,728 --a------ c:\windows\system32\drivers\usbvsp.sys
2008-12-12 18:33 . 2008-12-12 18:28 26,504 --a------ c:\windows\system32\drivers\swmsflt.sys
2008-12-12 18:32 . 2007-01-18 10:24 26,496 -ra------ c:\windows\system32\drivers\RimSerial.sys
2008-12-12 18:31 . 2008-12-12 18:31 <DIR> d-------- C:\Research in Motion
2008-12-12 18:31 . 2008-12-12 18:31 <DIR> d-------- c:\program files\Common Files\Research in Motion
2008-12-12 18:31 . 2008-12-12 18:31 <DIR> d-------- c:\program files\AT&T
2008-12-12 18:31 . 2008-12-12 18:31 <DIR> d-------- c:\documents and settings\All Users\Application Data\AT&T
2008-12-12 18:30 . 2008-12-12 18:30 <DIR> d-------- c:\program files\Option
2008-12-12 18:29 . 2008-12-12 18:29 <DIR> d-------- c:\program files\Common Files\Motorola Shared
2008-12-12 18:28 . 2008-12-12 18:28 <DIR> d-------- c:\program files\Sierra Wireless Inc
2008-12-12 18:28 . 2008-12-12 18:28 <DIR> d-------- c:\documents and settings\Naveen\Application Data\Sierra Wireless

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-01-09 17:06 --------- d-----w c:\program files\Symantec AntiVirus
2009-01-09 14:59 --------- d--h--w c:\program files\InstallShield Installation Information
2009-01-09 14:56 --------- d-----w c:\program files\Spybot - Search & Destroy
2009-01-09 14:56 --------- d-----w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2008-12-23 06:33 --------- d-----w c:\program files\Microsoft ActiveSync
2008-12-23 06:28 --------- d-----w c:\documents and settings\Naveen\Application Data\Lavasoft
2008-12-23 01:44 --------- d---a-w c:\documents and settings\All Users\Application Data\TEMP
2008-12-08 17:43 --------- d-----w c:\documents and settings\Naveen\Application Data\Juniper Networks
2008-12-08 17:38 --------- d-----w c:\program files\Juniper Networks
2008-12-08 17:36 --------- d-----w c:\documents and settings\All Users\Application Data\Juniper Networks
2008-12-05 18:19 --------- d-----w c:\documents and settings\Naveen\Application Data\AdobeUM
2008-11-24 22:22 --------- d-----w c:\program files\Lexmark Toolbar
2008-11-21 08:15 23,552 ----a-w c:\windows\system32\drivers\dsNcAdpt.sys
2008-11-16 16:42 --------- d-----w c:\documents and settings\Guest\Application Data\FaxCtr
2008-11-10 19:03 --------- d-----w c:\program files\Microsoft Silverlight
2008-11-09 17:03 --------- d-----w c:\documents and settings\All Users\Application Data\WinZip
2008-01-01 13:17 32 ----a-w c:\documents and settings\All Users\Application Data\ezsid.dat
2006-02-16 16:12 30,864 -c--a-w c:\documents and settings\Naveen\Application Data\GDIPFONTCACHEV1.DAT
2005-11-21 21:29 336 -c--a-w c:\program files\temp995.bat
2007-02-27 03:18 3,072 ----a-w c:\program files\mozilla firefox\plugins\ractrlkeyhook.dll
2007-02-27 03:18 245,408 ----a-w c:\program files\mozilla firefox\plugins\unicows.dll
2008-12-19 00:07 67,688 ----a-w c:\program files\mozilla firefox\components\jar50.dll
2008-12-19 00:07 54,368 ----a-w c:\program files\mozilla firefox\components\jsd3250.dll
2008-12-19 00:07 34,944 ----a-w c:\program files\mozilla firefox\components\myspell.dll
2008-12-19 00:07 46,712 ----a-w c:\program files\mozilla firefox\components\spellchk.dll
2008-12-19 00:07 172,136 ----a-w c:\program files\mozilla firefox\components\xpinstal.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2004-10-13 1694208]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]
"Yahoo! Pager"="c:\program files\Yahoo!\Messenger\YahooMessenger.exe" [2006-11-30 4662776]
"TPKMAPMN"="c:\program files\ThinkPad\Utilities\TpKmapMn.exe" [2004-02-04 32768]
"googletalk"="c:\program files\Google\Google Talk\googletalk.exe" [2007-01-01 3739648]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPLpr"="c:\program files\Synaptics\SynTP\SynTPLpr.exe" [2004-06-16 110592]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2004-06-16 512000]
"TPKMAPHELPER"="c:\program files\ThinkPad\Utilities\TpKmapAp.exe" [2004-02-04 897024]
"TPHOTKEY"="c:\progra~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe" [2004-08-17 94208]
"EZEJMNAP"="c:\progra~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe" [2003-12-25 208896]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-08-25 339968]
"UC_Start"="c:\program files\IBM\Updater\\ucstartup.exe" [2004-07-14 36864]
"dla"="c:\windows\system32\dla\tfswctrl.exe" [2004-09-02 127035]
"IBMPRC"="c:\ibmtools\UTILS\ibmprc.exe" [2004-03-19 90112]
"QCWLICON"="c:\program files\ThinkPad\ConnectUtilities\QCWLICON.EXE" [2004-11-09 81920]
"BMMGAG"="c:\progra~1\ThinkPad\UTILIT~1\pwrmonit.dll" [2004-07-29 110592]
"BMMLREF"="c:\program files\ThinkPad\Utilities\BMMLREF.EXE" [2004-07-29 20480]
"BMMMONWND"="c:\progra~1\ThinkPad\UTILIT~1\BatInfEx.dll" [2004-07-29 395776]
"PCSuiteTrayApplication"="c:\program files\Nokia\Nokia PC Suite 6\Launch Application 2.exe" [2004-11-25 143360]
"DataLayer"="c:\progra~1\COMMON~1\PCSuite\DATALA~1\DATALA~1.EXE" [2004-12-09 1068032]
"QCTray"="c:\progra~1\ThinkPad\CONNEC~1\QCTray.exe" [2004-11-09 712704]
"ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2004-02-29 66680]
"vptray"="c:\progra~1\SYMANT~1\VPTray.exe" [2004-03-12 124128]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"SunJavaUpdateSched"="c:\program files\Java\jre1.5.0_07\bin\jusched.exe" [2006-05-03 36975]
"Sony Ericsson PC Suite"="c:\program files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [2007-05-28 528384]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-03-28 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-03-30 267048]
"lxdnmon.exe"="c:\program files\Lexmark 2600 Series\lxdnmon.exe" [2008-03-27 660136]
"lxdnamon"="c:\program files\Lexmark 2600 Series\lxdnamon.exe" [2008-03-27 16040]
"FaxCenterServer"="c:\program files\Lexmark Fax Solutions\fm3032.exe" [2008-03-27 320168]
"AT&T Communication Manager"="c:\program files\AT&T\Communication Manager\ATTCM.exe" [2008-02-08 33280]
"S3TRAY2"="S3Tray2.exe" [2001-10-12 c:\windows\system32\S3Tray2.exe]
"TpShocks"="TpShocks.exe" [2004-03-26 c:\windows\system32\TpShocks.exe]
"TP4EX"="tp4ex.exe" [2002-09-04 c:\windows\system32\TP4EX.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Picasa Media Detector"="c:\program files\Picasa2\PicasaMediaDetector.exe" [2007-10-23 443968]

c:\documents and settings\Naveen\Start Menu\Programs\Startup\
Picture Motion Browser Media Check Tool.lnk - c:\program files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe [2007-11-28 368640]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Acrobat Assistant.lnk - c:\program files\Adobe\Acrobat 6.0\Distillr\acrotray.exe [2003-05-15 217193]
Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2005-03-25 24576]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-02-13 83360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\QConGina]
2004-11-09 06:53 262144 c:\windows\system32\QConGina.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"MSACM.CEGSM"= mobilev.acm

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Notification Packages REG_MULTI_SZ scecli pwdmon

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\IBM\\Updater\\jre\\bin\\java.exe"=
"c:\\Program Files\\IBM\\Updater\\jre\\bin\\javaw.exe"=
"c:\\Program Files\\IBM\\Updater\\ucsmb.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"c:\\Program Files\\Google\\Google Talk\\googletalk.exe"=
"c:\\aoe\\games\\AOE2AOK\\empires2.EXE"=
"c:\\StubInstaller.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\WINDOWS\\system32\\dplaysvr.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\NetMeeting\\conf.exe"=
"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\VideoLAN\\VLC\\vlc.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\WINDOWS\\system32\\lxdncoms.exe"=
"c:\\Program Files\\Lexmark 2600 Series\\lxdnamon.exe"=
"c:\\Program Files\\Lexmark 2600 Series\\frun.exe"=
"c:\\Program Files\\Abbyy FineReader 6.0 Sprint\\Scan\\ScanMan6.exe"=
"c:\\Program Files\\Lexmark Fax Solutions\\FaxCtr.exe"=
"c:\\Program Files\\Lexmark 2600 Series\\lxdnmon.exe"=
"c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\lxdnpswx.exe"=
"c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\lxdntime.exe"=
"c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\lxdnjswx.exe"=
"c:\\Program Files\\Lexmark 2600 Series\\lxdnlscn.exe"=
"c:\\Program Files\\AT&T\\Communication Manager\\SwiApiMux.exe"=

R0 Shockprf;Shockprf;c:\windows\system32\drivers\shockprf.sys [2005-03-25 59520]
R1 ANC;ANC;c:\windows\system32\drivers\ANC.sys [2005-03-25 11520]
R1 IBMTPCHK;IBMTPCHK;c:\windows\system32\drivers\IBMBLDID.SYS [2005-03-25 2432]
R1 ShockMgr;ShockMgr;c:\windows\system32\drivers\ShockMgr.sys [2005-03-25 4608]
R1 TPPWR;TPPWR;c:\windows\system32\drivers\TPPWR.SYS [2005-03-25 16384]
R3 urvpndrv;F5 Networks VPN Adapter;c:\windows\system32\drivers\urvpndrv.sys [2007-02-22 28160]
R4 ibmfilter;ibmfilter;c:\windows\system32\drivers\ibmfilter.sys [2004-09-23 64256]
R4 lxdn_device;lxdn_device;c:\windows\system32\lxdncoms.exe -service --> c:\windows\system32\lxdncoms.exe -service [?]
S3 ATTRcAppSvc;AT&T RcAppSvc;c:\program files\AT&T\Communication Manager\RcAppSvc.exe [2007-12-21 113176]
S3 f5ipfw;F5 Networks StoneWall Filter;c:\windows\system32\drivers\urfltw2k.sys [2007-06-30 10256]
S3 QCNDISIF;QCNDISIF;c:\windows\system32\drivers\qcndisif.sys [2005-03-25 12288]
S3 s125bus;Sony Ericsson Device 125 driver (WDM);c:\windows\system32\drivers\s125bus.sys [2008-06-10 83336]
S3 s125mdfl;Sony Ericsson Device 125 USB WMC Modem Filter;c:\windows\system32\drivers\s125mdfl.sys [2008-06-10 15112]
S3 s125mdm;Sony Ericsson Device 125 USB WMC Modem Driver;c:\windows\system32\drivers\s125mdm.sys [2008-06-10 108680]
S3 SWNC8U56;Sierra Wireless MUX NDIS Driver (UMTS56);c:\windows\system32\drivers\swnc8u56.sys [2008-12-12 101248]
S3 SWUMX56;Sierra Wireless USB MUX Driver (UMTS56);c:\windows\system32\drivers\swumx56.sys [2008-12-12 73856]
S4 lxdnCATSCustConnectService;lxdnCATSCustConnectService;c:\windows\system32\spool\drivers\w32x86\3\lxdnserv.exe [2008-10-17 98984]

--- Other Services/Drivers In Memory ---

*Deregistered* - RegSrvc
*Deregistered* - RemoteRegistry
*Deregistered* - RpcSs
*Deregistered* - S24EventMonitor
*Deregistered* - SamSs
*Deregistered* - seclogon
*Deregistered* - SENS
*Deregistered* - SharedAccess
*Deregistered* - ShellHWDetection
*Deregistered* - Spooler
*Deregistered* - srservice
*Deregistered* - SSDPSRV
*Deregistered* - stisvc
*Deregistered* - Symantec AntiVirus
*Deregistered* - SymWSC
*Deregistered* - TapiSrv
*Deregistered* - TermService
*Deregistered* - Themes
*Deregistered* - TpKmpSVC
*Deregistered* - TrkWks
*Deregistered* - W32Time
*Deregistered* - WebClient
*Deregistered* - winmgmt
*Deregistered* - wscsvc
*Deregistered* - wuauserv
*Deregistered* - WZCSVC

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{fcbcbbc9-6a61-11dd-b87c-00112585d2f6}]
\Shell\AutoRun\command - E:\Launch.exe /run
.
Contents of the 'Scheduled Tasks' folder

2008-11-22 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 14:57]

2007-07-28 c:\windows\Tasks\BMMTask.job
- c:\progra~1\ThinkPad\UTILIT~1\BMMTASK.EXE [2004-07-29 04:37]

2008-12-23 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Windows Defender\MpCmdRun.exe [2006-04-03 17:12]

2009-01-05 c:\windows\Tasks\Symantec NetDetect.job
- c:\program files\Symantec\LiveUpdate\NDETECT.EXE [2004-12-14 14:24]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}
mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: &Yahoo! Search - file:///c:\program files\Yahoo!\Common/ycsrch.htm
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\Office10\EXCEL.EXE/3000
IE: Yahoo! &Dictionary - file:///c:\program files\Yahoo!\Common/ycdict.htm
IE: Yahoo! &Maps - file:///c:\program files\Yahoo!\Common/ycmap.htm
IE: Yahoo! &SMS - file:///c:\program files\Yahoo!\Common/ycsms.htm
LSP: bmnet.dll
FF - ProfilePath - c:\documents and settings\Naveen\Application Data\Mozilla\Firefox\Profiles\xxa5s4ic.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - about:blank
FF - component: c:\program files\Mozilla Firefox\components\xpinstal.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-01-09 12:06:24
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(944)
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'lsass.exe'(1000)
c:\windows\system32\pwdmon.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\ati2evxx.exe
c:\windows\system32\S24EvMon.exe
c:\windows\system32\ati2evxx.exe
c:\program files\Common Files\Symantec Shared\ccSetMgr.exe
c:\program files\Common Files\Symantec Shared\ccEvtMgr.exe
c:\windows\system32\bmwebcfg.exe
c:\program files\Symantec AntiVirus\DefWatch.exe
c:\program files\Juniper Networks\Common Files\dsNcService.exe
c:\program files\ThinkPad\PkgMgr\HOTKEY\TPONSCR.exe
c:\program files\ThinkPad\PkgMgr\HOTKEY_1\TpScrex.exe
c:\program files\IBM\IBM Rapid Restore Ultra\rrpcsb.exe
c:\windows\system32\rundll32.exe
c:\windows\system32\rundll32.exe
c:\windows\system32\lxdncoms.exe
c:\windows\system32\QCONSVC.EXE
c:\windows\system32\RegSrvc.exe
c:\program files\Symantec AntiVirus\Rtvscan.exe
c:\windows\system32\TpKmpSvc.exe
c:\program files\Lexmark 2600 Series\lxdnmsdmon.exe
c:\program files\Yahoo!\Messenger\Ymsgr_tray.exe
c:\windows\system32\wscntfy.exe
c:\program files\iPod\bin\iPodService.exe
c:\program files\Common Files\Teleca Shared\Generic.exe
c:\program files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe
.
**************************************************************************
.
Completion time: 2009-01-09 12:13:45 - machine was rebooted [Naveen]
ComboFix-quarantined-files.txt 2009-01-09 17:13:41
ComboFix2.txt 2008-12-24 01:09:05

Pre-Run: 5,686,329,344 bytes free
Post-Run: 5,671,350,272 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect

283 --- E O F --- 2008-12-19 12:57:43

****************************************************************************************************************************************************************

The SDFix Report and Rapport log follow in the next reply.

#6 GATES1580

GATES1580
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:11:19 AM

Posted 09 January 2009 - 02:28 PM

SDFix Report is given below:
********************************************************************************

SDFix: Version 1.240
Run by Naveen on Fri 01/09/2009 at 12:39 PM

Microsoft Windows XP [Version 5.1.2600]
Running From: C:\SDFix

Checking Services :


Restoring Default Security Values
Restoring Default Hosts File

Rebooting


Checking Files :

Trojan Files Found:

C:\-39600~1 - Deleted





Removing Temp Files

ADS Check :



Final Check :

catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-01-09 12:50:31
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

scanning hidden registry entries ...

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


Remaining Services :




Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\IBM\\Updater\\jre\\bin\\java.exe"="C:\\Program Files\\IBM\\Updater\\jre\\bin\\java.exe:*:Enabled:IBM Update Connector"
"C:\\Program Files\\IBM\\Updater\\jre\\bin\\javaw.exe"="C:\\Program Files\\IBM\\Updater\\jre\\bin\\javaw.exe:*:Enabled:IBM Update Connector"
"C:\\Program Files\\IBM\\Updater\\ucsmb.exe"="C:\\Program Files\\IBM\\Updater\\ucsmb.exe:*:Enabled:IBM Update Connector"
"C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"="C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe:*:Enabled:Yahoo! FT Server"
"C:\\Program Files\\Google\\Google Talk\\googletalk.exe"="C:\\Program Files\\Google\\Google Talk\\googletalk.exe:*:Enabled:Google Talk"
"C:\\aoe\\games\\AOE2AOK\\empires2.EXE"="C:\\aoe\\games\\AOE2AOK\\empires2.EXE:*:Enabled:Age of Empires II"
"C:\\StubInstaller.exe"="C:\\StubInstaller.exe:*:Enabled:LimeWire swarmed installer"
"C:\\Program Files\\Messenger\\msmsgs.exe"="C:\\Program Files\\Messenger\\msmsgs.exe:*:Enabled:Windows Messenger"
"C:\\WINDOWS\\system32\\dplaysvr.exe"="C:\\WINDOWS\\system32\\dplaysvr.exe:*:Enabled:Microsoft DirectPlay Helper"
"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"="C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe:*:Enabled:Yahoo! Messenger"
"C:\\Program Files\\NetMeeting\\conf.exe"="C:\\Program Files\\NetMeeting\\conf.exe:*:Enabled:Windowsr NetMeetingr"
"C:\\Program Files\\Real\\RealPlayer\\realplay.exe"="C:\\Program Files\\Real\\RealPlayer\\realplay.exe:*:Enabled:RealPlayer"
"C:\\Program Files\\Mozilla Firefox\\firefox.exe"="C:\\Program Files\\Mozilla Firefox\\firefox.exe:*:Enabled:Firefox"
"C:\\Program Files\\VideoLAN\\VLC\\vlc.exe"="C:\\Program Files\\VideoLAN\\VLC\\vlc.exe:*:Enabled:VLC media player"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\\Program Files\\iTunes\\iTunes.exe"="C:\\Program Files\\iTunes\\iTunes.exe:*:Enabled:iTunes"
"C:\\WINDOWS\\system32\\lxdncoms.exe"="C:\\WINDOWS\\system32\\lxdncoms.exe:*:Enabled:Lexmark Communications System"
"C:\\Program Files\\Lexmark 2600 Series\\lxdnamon.exe"="C:\\Program Files\\Lexmark 2600 Series\\lxdnamon.exe:*:Enabled:Lexmark Device Monitor"
"C:\\Program Files\\Lexmark 2600 Series\\frun.exe"="C:\\Program Files\\Lexmark 2600 Series\\frun.exe:*:Enabled:Lexmark Productivity Studio"
"C:\\Program Files\\Abbyy FineReader 6.0 Sprint\\Scan\\ScanMan6.exe"="C:\\Program Files\\Abbyy FineReader 6.0 Sprint\\Scan\\ScanMan6.exe:*:Enabled:ABBYY FineReader"
"C:\\Program Files\\Lexmark Fax Solutions\\FaxCtr.exe"="C:\\Program Files\\Lexmark Fax Solutions\\FaxCtr.exe:*:Enabled:Fax software"
"C:\\Program Files\\Lexmark 2600 Series\\lxdnmon.exe"="C:\\Program Files\\Lexmark 2600 Series\\lxdnmon.exe:*:Enabled:Printer Device Monitor"
"C:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\lxdnpswx.exe"="C:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\lxdnpswx.exe:*:Enabled:Printer Status Window Interface"
"C:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\lxdntime.exe"="C:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\lxdntime.exe:*:Enabled:Lexmark Connect Time Executable"
"C:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\lxdnjswx.exe"="C:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\lxdnjswx.exe:*:Enabled:Job Status Window Interface"
"C:\\Program Files\\Lexmark 2600 Series\\lxdnlscn.exe"="C:\\Program Files\\Lexmark 2600 Series\\lxdnlscn.exe:*:Enabled: "
"C:\\Program Files\\AT&T\\Communication Manager\\SwiApiMux.exe"="C:\\Program Files\\AT&T\\Communication Manager\\SwiApiMux.exe:*:Enabled:SwiApiMux"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\IBM\\Updater\\jre\\bin\\java.exe"="C:\\Program Files\\IBM\\Updater\\jre\\bin\\java.exe:*:Enabled:IBM Update Connector"
"C:\\Program Files\\IBM\\Updater\\jre\\bin\\javaw.exe"="C:\\Program Files\\IBM\\Updater\\jre\\bin\\javaw.exe:*:Enabled:IBM Update Connector"
"C:\\Program Files\\IBM\\Updater\\ucsmb.exe"="C:\\Program Files\\IBM\\Updater\\ucsmb.exe:*:Enabled:IBM Update Connector"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

Remaining Files :


File Backups: - C:\SDFix\backups\backups.zip

Files with Hidden Attributes :

Wed 2 Jan 2008 6,219,320 A..H. --- "C:\Program Files\Picasa2\setup.exe"
Wed 22 Oct 2008 949,072 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\advcheck.dll"
Mon 15 Sep 2008 1,562,960 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\SDHelper.dll"
Wed 22 Oct 2008 962,896 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\Tools.dll"
Sat 7 Jan 2006 4,348 A.SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
Sun 15 Jan 2006 401 ..SH. --- "C:\Documents and Settings\All Users\DRM\DRMv11.bak"
Sat 22 Apr 2006 130,560 ...H. --- "C:\Documents and Settings\Guest\Desktop\~WRL0003.tmp"
Sat 22 Apr 2006 143,872 ...H. --- "C:\Documents and Settings\Guest\Desktop\~WRL0417.tmp"
Sat 22 Apr 2006 183,808 ...H. --- "C:\Documents and Settings\Guest\Desktop\~WRL0498.tmp"
Sat 22 Apr 2006 131,072 ...H. --- "C:\Documents and Settings\Guest\Desktop\~WRL0529.tmp"
Sat 22 Apr 2006 134,144 ...H. --- "C:\Documents and Settings\Guest\Desktop\~WRL1249.tmp"
Sat 22 Apr 2006 181,248 ...H. --- "C:\Documents and Settings\Guest\Desktop\~WRL1466.tmp"
Sat 22 Apr 2006 134,656 ...H. --- "C:\Documents and Settings\Guest\Desktop\~WRL2017.tmp"
Sat 22 Apr 2006 131,584 ...H. --- "C:\Documents and Settings\Guest\Desktop\~WRL2207.tmp"
Sat 22 Apr 2006 156,160 ...H. --- "C:\Documents and Settings\Guest\Desktop\~WRL2721.tmp"
Sat 22 Apr 2006 137,216 ...H. --- "C:\Documents and Settings\Guest\Desktop\~WRL3002.tmp"
Sat 22 Apr 2006 131,072 ...H. --- "C:\Documents and Settings\Guest\Desktop\~WRL3058.tmp"
Sat 22 Apr 2006 183,296 ...H. --- "C:\Documents and Settings\Guest\Desktop\~WRL3152.tmp"
Sat 22 Apr 2006 183,808 ...H. --- "C:\Documents and Settings\Guest\Desktop\~WRL3565.tmp"
Sat 22 Apr 2006 134,656 ...H. --- "C:\Documents and Settings\Guest\Desktop\~WRL3599.tmp"
Sat 22 Apr 2006 134,656 ...H. --- "C:\Documents and Settings\Guest\Desktop\~WRL3906.tmp"
Sat 22 Apr 2006 132,608 ...H. --- "C:\Documents and Settings\Guest\Desktop\~WRL4058.tmp"
Sat 16 Dec 2006 0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp"
Fri 12 Nov 2004 37,376 ...H. --- "C:\Program Files\Common Files\Adobe\ESD\DLMCleanup.exe"
Mon 13 Nov 2006 319,456 A..H. --- "C:\Program Files\Common Files\Motorola Shared\MotPCSDrivers\difxapi.dll"
Tue 31 Jan 2006 1,064,448 ...H. --- "C:\Documents and Settings\Naveen\Application Data\Microsoft\Word\~WRL0966.tmp"
Sat 7 Jan 2006 4,348 ...H. --- "C:\Documents and Settings\Naveen\My Documents\My Music\License Backup\drmv1key.bak"
Tue 18 Apr 2006 401 A..H. --- "C:\Documents and Settings\Naveen\My Documents\My Music\License Backup\drmv1lic.bak"
Sun 17 Apr 2005 312 A.SH. --- "C:\Documents and Settings\Naveen\My Documents\My Music\License Backup\drmv2key.bak"
Sun 18 Sep 2005 52,736 ...H. --- "C:\Documents and Settings\Naveen\My Documents\jobs\Duke\Qulacomm\~WRL1097.tmp"
Mon 19 Sep 2005 46,080 ...H. --- "C:\Documents and Settings\Naveen\My Documents\jobs\Duke\Qulacomm\~WRL2285.tmp"
Tue 21 Feb 2006 37,888 ...H. --- "C:\Documents and Settings\Naveen\My Documents\MEM\Development\Placements Section\~WRL0585.tmp"
Tue 21 Feb 2006 26,624 ...H. --- "C:\Documents and Settings\Naveen\My Documents\MEM\Development\Placements Section\~WRL1303.tmp"
Tue 21 Feb 2006 28,160 ...H. --- "C:\Documents and Settings\Naveen\My Documents\MEM\Development\Placements Section\~WRL2034.tmp"
Tue 21 Feb 2006 35,328 ...H. --- "C:\Documents and Settings\Naveen\My Documents\MEM\Development\Placements Section\~WRL2116.tmp"
Tue 21 Feb 2006 30,720 ...H. --- "C:\Documents and Settings\Naveen\My Documents\MEM\Development\Placements Section\~WRL3249.tmp"
Fri 14 Oct 2005 243,712 ...H. --- "C:\Documents and Settings\Naveen\My Documents\MEM\Fall 05\HM491\~WRL0405.tmp"
Sat 22 Apr 2006 30,720 ...H. --- "C:\Documents and Settings\Naveen\My Documents\MEM\Spring06\EGRMGMT240\~WRL0363.tmp"
Sat 22 Apr 2006 31,744 ...H. --- "C:\Documents and Settings\Naveen\My Documents\MEM\Spring06\EGRMGMT240\~WRL0461.tmp"
Sat 22 Apr 2006 32,256 ...H. --- "C:\Documents and Settings\Naveen\My Documents\MEM\Spring06\EGRMGMT240\~WRL0680.tmp"
Sat 22 Apr 2006 32,256 ...H. --- "C:\Documents and Settings\Naveen\My Documents\MEM\Spring06\EGRMGMT240\~WRL1120.tmp"
Sat 22 Apr 2006 33,792 ...H. --- "C:\Documents and Settings\Naveen\My Documents\MEM\Spring06\EGRMGMT240\~WRL1404.tmp"
Sat 22 Apr 2006 33,280 ...H. --- "C:\Documents and Settings\Naveen\My Documents\MEM\Spring06\EGRMGMT240\~WRL1661.tmp"
Sat 22 Apr 2006 31,232 ...H. --- "C:\Documents and Settings\Naveen\My Documents\MEM\Spring06\EGRMGMT240\~WRL1711.tmp"
Sat 22 Apr 2006 28,672 ...H. --- "C:\Documents and Settings\Naveen\My Documents\MEM\Spring06\EGRMGMT240\~WRL1768.tmp"
Sat 22 Apr 2006 29,184 ...H. --- "C:\Documents and Settings\Naveen\My Documents\MEM\Spring06\EGRMGMT240\~WRL1853.tmp"
Sat 22 Apr 2006 30,208 ...H. --- "C:\Documents and Settings\Naveen\My Documents\MEM\Spring06\EGRMGMT240\~WRL1878.tmp"
Sat 22 Apr 2006 30,208 ...H. --- "C:\Documents and Settings\Naveen\My Documents\MEM\Spring06\EGRMGMT240\~WRL2193.tmp"
Sat 22 Apr 2006 29,696 ...H. --- "C:\Documents and Settings\Naveen\My Documents\MEM\Spring06\EGRMGMT240\~WRL2339.tmp"
Sat 22 Apr 2006 26,624 ...H. --- "C:\Documents and Settings\Naveen\My Documents\MEM\Spring06\EGRMGMT240\~WRL2437.tmp"
Sat 22 Apr 2006 26,624 ...H. --- "C:\Documents and Settings\Naveen\My Documents\MEM\Spring06\EGRMGMT240\~WRL2529.tmp"
Sat 22 Apr 2006 32,256 ...H. --- "C:\Documents and Settings\Naveen\My Documents\MEM\Spring06\EGRMGMT240\~WRL2936.tmp"
Sat 22 Apr 2006 27,136 ...H. --- "C:\Documents and Settings\Naveen\My Documents\MEM\Spring06\EGRMGMT240\~WRL3049.tmp"
Sat 22 Apr 2006 30,720 ...H. --- "C:\Documents and Settings\Naveen\My Documents\MEM\Spring06\EGRMGMT240\~WRL3292.tmp"
Sat 22 Apr 2006 26,624 ...H. --- "C:\Documents and Settings\Naveen\My Documents\MEM\Spring06\EGRMGMT240\~WRL3331.tmp"
Sat 22 Apr 2006 33,792 ...H. --- "C:\Documents and Settings\Naveen\My Documents\MEM\Spring06\EGRMGMT240\~WRL3385.tmp"
Sat 22 Apr 2006 30,720 ...H. --- "C:\Documents and Settings\Naveen\My Documents\MEM\Spring06\EGRMGMT240\~WRL3552.tmp"
Sat 22 Apr 2006 31,744 ...H. --- "C:\Documents and Settings\Naveen\My Documents\MEM\Spring06\EGRMGMT240\~WRL3627.tmp"
Sat 22 Apr 2006 30,208 ...H. --- "C:\Documents and Settings\Naveen\My Documents\MEM\Spring06\EGRMGMT240\~WRL3643.tmp"
Sat 22 Apr 2006 29,184 ...H. --- "C:\Documents and Settings\Naveen\My Documents\MEM\Spring06\EGRMGMT240\~WRL3648.tmp"
Sat 15 Apr 2006 81,408 ...H. --- "C:\Documents and Settings\Naveen\My Documents\MEM\Spring06\Internship Report and Ppt\~WRL0740.tmp"
Sat 15 Apr 2006 459,264 ...H. --- "C:\Documents and Settings\Naveen\My Documents\MEM\Spring06\Internship Report and Ppt\~WRL1158.tmp"

Finished!
********************************************************************************

Below is the Rapport.txt log:
********************************************************************************
SmitFraudFix v2.388

Scan done at 13:36:50.25, Fri 01/09/2009
Run from C:\Documents and Settings\Naveen\Desktop\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
The filesystem type is NTFS
Fix run in safe mode

SharedTaskScheduler Before SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

Killing process


hosts

127.0.0.1 localhost

VACFix

VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


Winsock2 Fix

S!Ri's WS2Fix: LSP not Found.


Generic Renos Fix

GenericRenosFix by S!Ri


Deleting infected files

C:\Program Files\Google\googletoolbar1.dll Deleted

IEDFix

IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri



Agent.OMZ.Fix

Agent.OMZ.Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


404Fix

404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


RK


DNS

HKLM\SYSTEM\CCS\Services\Tcpip\..\{C58428A1-C2C4-498B-8B0A-323D574846C9}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\..\{C58428A1-C2C4-498B-8B0A-323D574846C9}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS2\Services\Tcpip\..\{C58428A1-C2C4-498B-8B0A-323D574846C9}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1


Deleting Temp Files


Winlogon.System
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""


Registry Cleaning

Registry Cleaning done.

SharedTaskScheduler After SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


End

********************************************************************************
********************************************************************************

The current status of the system: I haven't observed any symantec email proxy popups so far i.e. during the above troubleshooting process when the wireless connection was enabled (approximately for the last 5 hours), I will keep monitoring for the next 24 hours and let you know the status again.

Please let me know your observations from the above log files.
Thank you and I appreciate all your help.

#7 Maurice Naggar

Maurice Naggar

    Eradicator de malware


  • Malware Response Team
  • 1,088 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:USA
  • Local time:11:19 AM

Posted 10 January 2009 - 11:32 AM

Get and use MVP Mike Burgess' custom hosts file http://mvps.org/winhelp2002/hosts.htm
This will help to keep your browser from going to a large number of malicious sites.

Steps to follow for the MVP Hosts file:
1) Download and SAVE the zip file to a temporary folder
2) Unzip (extract the contents) in the same folder
3) After extract is complete, run mvps.bat batch file. This copies your pre-existing Hosts file to Hosts.mvp in the folder where Windows' Hosts resides
typically, C:\WINDOWS\system32\drivers\etc

and after that copy is saved, it replaces the old Hosts with the new one.

And you should see (in the blue background command window) the following:

_________________________________________________
+---+
THE MVPS HOSTS FILE IS NOW UPDATED v
+---+



Previous version saved and renamed to HOSTS.MVP
Press any key to continue . . .


Find the folder where you saved the original download. Delete hosts.zip and a file folder there named hosts
The latter is the same folder that had mvps.bat
=
I'd like for you to do one more online scan.

Scan the system with the Kaspersky Online Scanner
http://www.kaspersky.com/virusscanner

Attention: Kaspersky Online Scanner 7.0 may not run successfully while another antivirus program is running. If you have Anti-Virus software installed, please temporarily disable your AV protection before running the Kaspersky Online Scanner. Reenable it after the scan is finished.

During this run, make sure your browser does not block popup windows. Have patience while some screens populate.

1) Click the Kapersky Online Scanner button. You'll see a popup window.
2) Accept the agreement
3) Accept the installation of the required ActiveX object ( XP SP2-SP3 will show this in the Information Bar )
4) For XP SP2-SP3, click the Install button when prompted
5) The necessary files will be downloaded and installed. Please have plenty of patience.
6) After Kaspersky AntiVirus Database is updated, look at the Scan box.
7) Click the My Computer line
8 ) Be infinetely patient, the scan is comprehensive and, unlike other online antivirus scanners, will detect all malwares

9) When the scan is completed there will be an option to Save report as a .txt file. Click that button. Copy and paste the report into your reply.
Re-enable your antivirus program.
Kapersky Online Scanner can be uninstalled later on from Add or Remove Programs in the Control Panel, if desired.

Kaspersky is a report only and does not remove files.

Reply back with the Kaspersky report.
~Maurice Naggar
MS-MVP (Oct 2002 - Sept 2010)

#8 GATES1580

GATES1580
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:11:19 AM

Posted 11 January 2009 - 06:47 PM

Maurice
I used the mvp hosts file as per your instructions. And below is the report from Kaspersky online scan:
****************************************************************************************
--------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER 7 REPORT
Sunday, January 11, 2009
Operating System: Microsoft Windows XP Professional Service Pack 3 (build 2600)
Kaspersky Online Scanner 7 version: 7.0.25.0
Program database last update: Saturday, January 10, 2009 21:42:37
Records in database: 1599726
--------------------------------------------------------------------------------

Scan settings:
Scan using the following database: extended
Scan archives: yes
Scan mail databases: yes

Scan area - My Computer:
C:\
D:\

Scan statistics:
Files scanned: 95509
Threat name: 25
Infected objects: 78
Suspicious objects: 1
Duration of the scan: 03:02:35


File name / Threat name / Threats count
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\02400000.VBN Infected: Exploit.Java.ByteVerify 2

C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\02400000.VBN Infected: Trojan-Downloader.Java.OpenConnection.aa 1

C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\02400001.VBN Infected: Exploit.Java.ByteVerify 2

C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\02400001.VBN Infected: Trojan-Downloader.Java.OpenConnection.aa 1

C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\02400002.VBN Infected: Exploit.VBS.Phel.a 1

C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\02400003.VBN Infected: Trojan.Java.ClassLoader.c 1

C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\02400003.VBN Infected: Exploit.Java.ByteVerify 1

C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\02400003.VBN Infected: Trojan.Java.ClassLoader.Dummy.a 1

C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\02400003.VBN Infected: Trojan-Downloader.Java.OpenConnection.v 1

C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\02400004.VBN Infected: Exploit.HTML.Mht 1

C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\02400005.VBN Infected: Exploit.VBS.Phel.a 1

C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\02400006.VBN Infected: Exploit.VBS.Phel.a 1

C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\02400007.VBN Infected: Exploit.HTML.Mht 1

C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\02400008.VBN Infected: Exploit.Java.ByteVerify 2

C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\02400008.VBN Infected: Trojan-Downloader.Java.OpenConnection.aa 1

C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\02400009.VBN Infected: Trojan.Java.ClassLoader.c 1

C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\02400009.VBN Infected: Exploit.Java.ByteVerify 1

C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\02400009.VBN Infected: Trojan.Java.ClassLoader.Dummy.a 1

C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\02400009.VBN Infected: Trojan-Downloader.Java.OpenConnection.v 1

C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0240000A.VBN Infected: Exploit.Java.ByteVerify 2

C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0240000A.VBN Infected: Trojan-Downloader.Java.OpenConnection.aa 1

C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\047C0000.VBN Infected: Email-Worm.Win32.Nyxem.e 1

C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\05DC0000.VBN Infected: Trojan-Downloader.Java.OpenConnection.aj 2

C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\05DC0000.VBN Infected: Exploit.Java.ByteVerify 2

C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\05DC0002.VBN Infected: Trojan-Downloader.Java.OpenConnection.aj 2

C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\05DC0002.VBN Infected: Exploit.Java.ByteVerify 2

C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\05DC0004.VBN Infected: Exploit.Java.Gimsh.b 1

C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\05DC0006.VBN Infected: Exploit.Java.Gimsh.b 1

C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\05DC0008.VBN Infected: Exploit.Java.Gimsh.a 1

C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\05DC000A.VBN Infected: Exploit.Java.Gimsh.b 1

C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\05DC000C.VBN Infected: Exploit.Java.Gimsh.b 1

C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\05DC000E.VBN Infected: Exploit.Java.Gimsh.b 1

C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\08680000.VBN Infected: Trojan-Downloader.JS.Agent.hv 1

C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\092C0000.VBN Infected: Trojan-Downloader.Java.OpenStream.c 1

C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\092C0000.VBN Infected: Trojan.Java.ClassLoader.h 1

C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\092C0000.VBN Infected: Trojan.Java.ClassLoader.d 1

C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\092C0001.VBN Infected: Exploit.Java.ByteVerify 2

C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\092C0001.VBN Infected: Trojan-Downloader.Java.OpenConnection.aa 1

C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\092C0002.VBN Infected: Exploit.Java.ByteVerify 2

C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\092C0002.VBN Infected: Trojan-Downloader.Java.OpenConnection.aa 1

C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\09380002.VBN Infected: Backdoor.Win32.Hijack.e 1

C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\09440000.VBN Infected: Backdoor.Win32.Hijack.e 1

C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\096C0001.VBN Infected: Exploit.HTML.IESlice.d 1

C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0A040000.VBN Infected: Trojan.Java.ClassLoader.c 1

C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0A040000.VBN Infected: Exploit.Java.ByteVerify 1

C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0A040000.VBN Infected: Trojan.Java.ClassLoader.Dummy.a 1

C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0A040000.VBN Infected: Trojan-Downloader.Java.OpenConnection.v 1

C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0CCC0000.VBN Infected: Trojan-Downloader.Win32.Agent.acd 1

C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0ED80000.VBN Infected: Trojan-Downloader.Java.OpenConnection.ae 2

C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0ED80000.VBN Infected: Exploit.Java.ByteVerify 2

C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0ED80002.VBN Infected: Trojan-Downloader.Java.OpenStream.c 1

C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0ED80002.VBN Infected: Trojan.Java.ClassLoader.h 1

C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0ED80002.VBN Infected: Trojan.Java.ClassLoader.d 1

C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0FA80000.VBN Infected: Trojan-Downloader.Win32.Ani.c 1

C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0FA80001.VBN Infected: Exploit.Win32.MS05-002.b 1

C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0FA80002.VBN Infected: Trojan-Downloader.Win32.Ani.c 1

C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0FA80003.VBN Infected: Exploit.Win32.MS05-002.b 1

C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0FA80004.VBN Suspicious: Exploit.Win32.IMG-WMF 1

C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0FA80005.VBN Infected: Trojan-Downloader.Win32.Ani.c 1

C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0FA80006.VBN Infected: Trojan-Downloader.Win32.Ani.c 1

C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\15DC0000.VBN Infected: Backdoor.Win32.Hijack.e 1

C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\15DC0001.VBN Infected: Trojan-Mailfinder.Win32.Agent.wd 1

C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\15DC0002.VBN Infected: Trojan-Mailfinder.Win32.Agent.wd 1

C:\Qoobox\Quarantine\C\WINDOWS\system32\drivers\ati2swxx.sys.vir Infected: Rootkit.Win32.Protector.cd 1

C:\Qoobox\Quarantine\C\WINDOWS\system32\drivers\_ati2swxx_.sys.zip Infected: Rootkit.Win32.Protector.cd 1

C:\System Volume Information\_restore{DAAD8284-5896-4B40-A753-8454BDC2E5A5}\RP681\A0050981.exe Infected: Trojan-Banker.Win32.Banker.ackb 1

C:\System Volume Information\_restore{DAAD8284-5896-4B40-A753-8454BDC2E5A5}\RP682\A0052065.sys Infected: Rootkit.Win32.Protector.cd 1

The selected area was scanned.

#9 Maurice Naggar

Maurice Naggar

    Eradicator de malware


  • Malware Response Team
  • 1,088 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:USA
  • Local time:11:19 AM

Posted 11 January 2009 - 09:39 PM

Using My Computer (Windows Explorer) look at the root of the C drive
if you locate a file or a folder C:\-396002260 Posted Image
then delete it

If not found, that's that.

This system has an old version of Java Run-time.

Uninstall jre1.6 (or any earlier) + any other (JRE Runtime Environment ) Sun Java package via Add/Remove Programs.
If you see any other Java versions there,
such as
J2SE Runtime Environment 5.0
Java SE Runtime Environment
Java 6


uninstall all of them. After uninstalling, reboot if directed to do so.

In Windows Explorer, navigate to and delete C:\Program Files\Java <=this folder, if found.
Do NOT delete C:\Program Files\JavaVM <=this folder, if found!

Open an IE window and go to http://java.sun.com/javase/downloads/index.jsp
> In top of the page (first in the list), click on the Download button to the right of Java Runtime Environment (JRE) 6 Update 11
> If Information Bar pop-ups up, right-click on it and say it's OK to display the blocked content; You do not have to install the Java Web Start ActiveX Control
> Accept the license agreement
> Click on Windows Offline Installation, Multi-language and Save the file to your desktop; do not Run it.

When the download is complete, close all browser windows and double-click on the saved file to install the update.
  • Tip: Choose Custom install to select only the part(s) you need/want.
Delete the downloaded installation file after completing the above procedure and reboot if prompted to do so.

If you were /not/ prompted to reboot, please do so now.

To test your Java Run-time, you may go to this page http://www.javatester.org/version.html
When all is well, you should see Java Version: 1.6.0_11 from Sun Microsystems Inc.
=

Open your Symantec AntiVirus Corporate Edition. Locate the quarantine manage area.
Select for "all items" in the quarantine to be "permanently deleted".
When done, exit it.

Kaspersky only find items in quarantine already + 2 items in old system restore points.

We are now at the point of cleaning up after the tools we used.

The following few steps will remove tools we used; followed by advice on staying safer.

We have to remove Combofix and all its associated folders. By whichever name you named it, (either Combofix or Combo-fix), put that name in the RUN box stated just below. The "/u" in the Run line below is to start Combofix for it's cleanup & removal function.
The utility must be removed to prevent any un-intentional or accidental usage, PLUS, to free up much space on your hard disk.
  • Click Start, then click Run.

    In the command box that opens, type or copy/paste combofix /u and then click OK.

    Posted Image
  • If I did not have you do so before, then, Please download OTMoveIt3 by OldTimer: http://oldtimer.geekstogo.com/OTMoveIt3.exe
  • Save it to your desktop.
  • Please double-click OTMoveIt3.exe to run it.
  • Click on the CleanUp! button. When you do this a text file named cleanup.txt will be downloaded from the internet. If you get a warning from your firewall or other security programs regarding OTMoveIt attempting to contact the internet you should allow it to do so. After the list has been download you'll be asked if you want to Begin cleanup process? Select Yes.
  • This step removes the files, folders, and shortcuts created by the tools I had you download and run.
We are finsihed here. My best to you. Posted Image

I'll be closing this thread. So if you have issues related to these steps, send me a PM.
~Maurice Naggar
MS-MVP (Oct 2002 - Sept 2010)




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users