Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

SHeur2.GAS and Generic8.HPC - Cannot run MalWareBytes or ComboFix


  • This topic is locked This topic is locked
7 replies to this topic

#1 limpin

limpin

  • Members
  • 5 posts
  • OFFLINE
  •  
  • Local time:10:22 AM

Posted 03 January 2009 - 04:56 PM

Please help me!! Neither MalWareBytes Anti-Malware or ComboFix will run on my computer, even after closing all applications and many processes. I can't boot in Safe Mode either, Windows gets to the desktop but just freezes up. AVG says there are these trojan horses: SHeur2.GAS, Downloader.Generic8.HPC, and Downloader.Generic8.GWR. I went through the Preparation Guide, and attached you will find my Attach.txt and Hijackthis log. Below is the DDS Log. Thank you so much for any help!!!:



DDS (Version 1.1.0) - NTFSx86

Run by Alex at 13:44:45.07 on Sat 01/03/2009

Internet Explorer: 7.0.5730.13 BrowserJavaVersion: 1.6.0_10

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2047.1621 [GMT -8:00]



AV: AVG Anti-Virus Free *On-access scanning enabled* (Outdated)



============== Running Processes ===============



C:\WINDOWS\system32\svchost -k DcomLaunch

svchost.exe

C:\WINDOWS\System32\svchost.exe -k netsvcs

C:\WINDOWS\system32\acs.exe

svchost.exe

svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.EXE

C:\PROGRA~1\AVG\AVG8\avgtray.exe

C:\Program Files\Java\jre6\bin\jusched.exe

C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe

C:\WINDOWS\system32\ctfmon.exe

C:\DOCUME~1\ALEX~1.CIR\LOCALS~1\Temp\csrssc.exe

C:\WINDOWS\ALCFDRTM.EXE

C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe

C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\PROGRA~1\AVG\AVG8\avgrsx.exe

C:\WINDOWS\system32\svchost.exe -k imgsvc

C:\PROGRA~1\AVG\AVG8\avgemc.exe

C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

C:\WINDOWS\system32\rundll32.exe

C:\Documents and Settings\Alex.CIRCUITOUS\Desktop\dds.scr



============== Pseudo HJT Report ===============



uStart Page = hxxp://google.daemonsearch.com/intl/

uInternet Settings,ProxyOverride = *.local

BHO: {5c0559ba-26fa-463f-9890-0d956e2212fb} - c:\windows\system32\ripojopo.dll

BHO: {f42c9599-fa9b-fb88-3444-ac3c9121a0a6}: {6a0a1219-c3ca-4443-88bf-b9af9959c24f} - c:\windows\system32\eoeopu.dll

BHO: {6d794cb4-c7cd-4c6f-bfdc-9b77afbdc02c} - c:\windows\system32\tuvWQhEU.dll

BHO: {850a468f-c690-4513-9263-ebf1f0eec470} - c:\windows\system32\ljJBrQhg.dll

BHO: c:\windows\system32\tyshb36rfjdf.dll: {d5bf49a2-94f1-42bd-f434-3604812c807d} - c:\windows\system32\tyshb36rfjdf.dll

TB: Adobe PDF: {47833539-d0c5-4125-9fa8-0819e2eaac93} - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll

EB: Adobe PDF: {182ec0be-5110-49c8-a062-beb1d02a220b} - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll

uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe

uRun: [DAEMON Tools] "c:\program files\daemon tools\daemon.exe" -lang 1033

uRun: [AdVantage] "c:\program files\advantage\AdVantage.exe"

uRun: [Google Update] "c:\documents and settings\alex.circuitous\local settings\application data\google\update\GoogleUpdate.exe" /c

uRun: [Jnskdfmf9eldfd] c:\docume~1\alex~1.cir\locals~1\temp\csrssc.exe

mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup

mRun: [nwiz] nwiz.exe /install

mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit

mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 8.0\reader\Reader_sl.exe"

mRun: [AVG8_TRAY] c:\progra~1\avg\avg8\avgtray.exe

mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"

mRun: [RTHDCPL] RTHDCPL.EXE

mRun: [Alcmtr] ALCMTR.EXE

mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime

mRun: [WhenUSearch] "c:\program files\daemon tools searchbar\Search.exe"

mRun: [WhenUSearchWHSE] "c:\program files\daemon tools searchbar\whse.exe"

mRun: [Acrobat Assistant 8.0] "c:\program files\adobe\acrobat 8.0\acrobat\Acrotray.exe"

mRun: [<NO NAME>]

mRun: [vesofugane] Rundll32.exe "c:\windows\system32\yejedufi.dll",s

mRun: [3095b074] rundll32.exe "c:\windows\system32\amlotgdo.dll",b

mRunOnce: [WIAWizardMenu] RUNDLL32.EXE c:\windows\system32\sti_ci.dll,WiaCreateWizardMenu

dRun: [Jnskdfmf9eldfd] c:\windows\temp\csrssc.exe

StartupFolder: c:\docume~1\alex~1.cir\startm~1\programs\startup\warftp~1.lnk - c:\program files\war-ftpd\WarTrayIcon.exe

StartupFolder: c:\docume~1\alluse~1.win\startm~1\programs\startup\ypops.lnk - c:\program files\ypops\YPOPs.exe

uPolicies-explorer: NoFolderOptions = 1 (0x1)

uPolicies-system: DisableRegistryTools = 1 (0x1)

dPolicies-explorer: NoFolderOptions = 1 (0x1)

dPolicies-system: DisableRegistryTools = 1 (0x1)

IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200

IE: Append to existing PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIEAppend.html

IE: Convert link target to Adobe PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIECapture.html

IE: Convert link target to existing PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIEAppend.html

IE: Convert selected links to Adobe PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html

IE: Convert selected links to existing PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html

IE: Convert selection to Adobe PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIECapture.html

IE: Convert selection to existing PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIEAppend.html

IE: Convert to Adobe PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIECapture.html

IE: E&xport to Microsoft Excel - c:\progra~1\micros~3\office11\EXCEL.EXE/3000

IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe

IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~3\office11\REFIEBAR.DLL

Handler: belarc - {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - c:\program files\belarc\advisor\system\BAVoilaX.dll

Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg8\avgpp.dll

Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL

Notify: tuvWQhEU - tuvWQhEU.dll

AppInit_DLLs: avgrsstx.dll bjcahz.dll ickzrt.dll,qshqcg.dll wzeqql.dll,c:\windows\system32\pipibuju.dll eoeopu.dll

STS: c:\windows\system32\tyshb36rfjdf.dll: {d5bf49a2-94f1-42bd-f434-3604812c807d} - c:\windows\system32\tyshb36rfjdf.dll

SEH: {6d794cb4-c7cd-4c6f-bfdc-9b77afbdc02c} - c:\windows\system32\tuvWQhEU.dll

SecurityProviders: msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll,

LSA: Authentication Packages = msv1_0 c:\windows\system32\ljJBrQhg

LSA: Notification Packages = scecli c:\windows\system32\pipibuju.dll



================= FIREFOX ===================



FF - ProfilePath -



============= SERVICES / DRIVERS ===============



R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2008-5-28 97928]

R1 AvgMfx86;AVG On-access Scanner Minifilter Driver x86;c:\windows\system32\drivers\avgmfx86.sys [2008-5-28 26824]

R1 BIOS;BIOS;c:\windows\system32\drivers\BIOS.sys [2008-5-15 13696]

R1 BS_I2cIo;BS_I2cIo;c:\windows\system32\drivers\BS_I2cIo.sys [2008-5-15 8192]

R4 avg8emc;AVG8 E-mail Scanner;c:\progra~1\avg\avg8\avgemc.exe [2008-7-3 875288]

R4 avg8wd;AVG8 WatchDog;c:\progra~1\avg\avg8\avgwdsvc.exe [2008-7-3 231704]

R4 AvgTdiX;AVG8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2008-5-28 76040]

S3 KLIF;KLIF;c:\windows\system32\klif.sys [2007-12-28 195344]

S4 Tsddrowdet;Tsddrowdet; [x]



============== File Associations ===============



regfile=regedit.exe "%1" %*

scrfile="%1" %*



=============== Created Last 30 ================



2008-12-29 17:48 <DIR> --d----- c:\program files\AntiMalwar

2008-12-29 17:39 <DIR> --d----- c:\program files\Anti-Malware

2008-12-29 17:31 <DIR> --d----- c:\program files\Malwarebytes' Anti-Malware

2008-12-21 21:51 <DIR> --d----- c:\docume~1\alex~1.cir\applic~1\gadcom

2008-12-21 21:24 <DIR> --d----- c:\program files\MagicISO

2008-12-12 09:48 <DIR> --d----- c:\program files\common files\ODBC



==================== Find3M ====================



2008-05-27 20:37 354 ---sh--- c:\windows\system32\ckkjatpn.ini2

2008-05-28 15:57 781,054 a--sh--- c:\windows\system32\gggjQqru.ini2

0000-00-00 00:00 66,286 a--sh--- c:\windows\system32\pipibuju.dll

0000-00-00 00:00 43,008 a--sh--- c:\windows\system32\rafomife.dll

0000-00-00 00:00 66,286 a--sh--- c:\windows\system32\ripojopo.dll

0000-00-00 00:00 66,286 a--sh--- c:\windows\system32\yejedufi.dll

2008-05-31 14:49 4,919,328 a--sh--- c:\windows\system32\drivers\fidbox.dat

2008-05-31 14:49 16,928 a--sh--- c:\windows\system32\drivers\fidbox2.dat



============= FINISH: 13:47:02.54 ===============

Attached Files



BC AdBot (Login to Remove)

 


#2 PropagandaPanda

PropagandaPanda


  • Malware Response Team
  • 10,433 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:11:22 AM

Posted 10 January 2009 - 02:20 PM

Hello. I am PropagandaPanda (Panda or PP for short), and I will be helping you.

Let's try using a renamed version of ComboFix.

Disable Realtime Protection
Antimalware programs can interfere with ComboFix and other tools we need to run. Please temporarily disable all realtime protections you have enabled. Refer to this page, if you are unsure how.

To disable AVG:
  • Please navigate to the system tray on the bottom right hand corner and look for this Posted Image sign.
  • Right click it-> select Quit Control Center.
  • A warning will pop up, click Yes
Download and Run ComboFix
If you have already run ComboFix, delete your copy and download a new one. If the computer in question is unable to download ComboFix, transfer it using a removable media (CDs, flash drive).

Download Combofix by sUBs from here, and save it to your desktop.
  • Close/disable all anti-virus and anti-malware programs so they do not interfere with the running of ComboFix. Refer to this page if you are not sure how.
  • Double click on ComboFix.exe and follow the prompts. If you are using Windows Vista, right click the icon and select "Run as Administrator". You will not recieve the prompts below if you are not using Windows XP. ComboFix will check to see if you have the Windows Recovery Console installed.
  • If you did not have it installed, you will see the prompt below. Choose YES.
    Posted ImagePosted Image

  • When the Recovery Console has been installed, you will see the prompt below. Choose YES.
    Posted Image
  • When finished, ComboFix will produce a report for you. Please post the contents of the log (C:\ComboFix.txt).
Leave your computer alone while ComboFix is running. ComboFix will restart your computer if malware is found; allow it to do so.

In your next reply include:
-the ComboFix log
-a new HijackThis or DDS log

Please also tell me of any changes you have made to your computer since you started your topic.

With Regards,
The Panda

#3 limpin

limpin
  • Topic Starter

  • Members
  • 5 posts
  • OFFLINE
  •  
  • Local time:10:22 AM

Posted 10 January 2009 - 10:46 PM

I didn't change anything on the computer since posting. Been waiting for your kind help!

Your Combo-Fix rename appears to have worked

Attached are my ComboFix logs and HJT log

Let me know if I'm in the clear!

ComboFix 09-01-10.01 - Alex 2009-01-10 19:16:35.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2047.1667 [GMT -8:00]
Running from: c:\documents and settings\Alex.CIRCUITOUS\Desktop\Combo-Fix.exe
Command switches used :: c:\documents and settings\Alex.CIRCUITOUS\Desktop\WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
AV: AVG Anti-Virus Free *On-access scanning disabled* (Outdated)
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Alex.CIRCUITOUS\Application Data\gadcom
c:\documents and settings\Alex.CIRCUITOUS\Local Settings\Temporary Internet Files\fbk.sts
c:\documents and settings\All Users.WINDOWS\Application Data\Microsoft\Network\Downloader\qmgr0.dat
c:\documents and settings\All Users.WINDOWS\Application Data\Microsoft\Network\Downloader\qmgr1.dat
c:\windows\BM33a683e8.txt
c:\windows\BM33a683e8.xml
c:\windows\pskt.ini
c:\windows\system32\~.exe
c:\windows\system32\a.exe
c:\windows\system32\bakedosu.dll
c:\windows\system32\beeqxy.dll
c:\windows\system32\bjcahz.dll
c:\windows\system32\ckkjatpn.ini
c:\windows\system32\ckkjatpn.ini2
c:\windows\system32\ckkjatpn.tmp
c:\windows\system32\dasotegi.dll
c:\windows\system32\dcajchll.ini
c:\windows\system32\dmauebtl.ini
c:\windows\system32\drivers\TDSSmxfe.sys
c:\windows\system32\efcDvtUL.dll
c:\windows\system32\eoeopu.dll
c:\windows\system32\fccywwUo.dll
c:\windows\system32\gclrahsa.ini
c:\windows\system32\gggjQqru.ini
c:\windows\system32\gggjQqru.ini2
c:\windows\system32\ghQrBJjl.ini
c:\windows\system32\ghQrBJjl.ini2
c:\windows\system32\gumiviho.dll
c:\windows\system32\hagnthjs.dll
c:\windows\system32\ickzrt.dll
c:\windows\system32\ivegolat.ini
c:\windows\system32\java2.sys c:\windows\system32\snjava.dll
c:\windows\system32\jgrgpqtn.ini
c:\windows\system32\ljJBrQhg.dll
c:\windows\system32\msrdo20.dll
c:\windows\system32\ntqpgrgj.dll
c:\windows\system32\odgtolma.ini
c:\windows\system32\osituzov.ini
c:\windows\system32\povufuyu.dll
c:\windows\system32\qdldbkxh.dll
c:\windows\system32\qshqcg.dll
c:\windows\system32\rdocurs.dll
c:\windows\system32\tadagagu.dll
c:\windows\system32\TDSSakod.log
c:\windows\system32\TDSSehys.log
c:\windows\system32\TDSSixgp.dll
c:\windows\system32\TDSSkrxx.dll
c:\windows\system32\TDSSmtpe.dat
c:\windows\system32\TDSSnmxh.log
c:\windows\system32\TDSSnpur.dll
c:\windows\system32\TDSSoitu.dll
c:\windows\system32\TDSSsahc.dll
c:\windows\system32\TDSSyaqu.dll
c:\windows\system32\tfjubywb.dll
c:\windows\system32\tipifipo.dll
c:\windows\system32\tjtrjbpq.dll
c:\windows\system32\tknotojd.dll
c:\windows\system32\tpdtuxhj.dll
c:\windows\system32\ttmayrca.ini
c:\windows\system32\tuvWQhEU.dll
c:\windows\system32\tyshb36rfjdf.dll
c:\windows\system32\vozutiso.dll
c:\windows\system32\wvUOFYSm.dll
c:\windows\system32\wzeqql.dll
c:\windows\system32\xblghnok.ini

----- BITS: Possible infected sites -----

hxxp://childhe.com
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_TDSSserv.sys
-------\Legacy_TDSSserv.sys


((((((((((((((((((((((((( Files Created from 2008-12-11 to 2009-01-11 )))))))))))))))))))))))))))))))
.

2009-01-03 12:30 . 2009-01-03 12:30 <DIR> d-------- c:\documents and settings\Administrator
2009-01-03 12:21 . 2009-01-03 12:21 <DIR> d-------- C:\AntiMalwareBytes
2008-12-29 17:48 . 2008-12-29 22:14 <DIR> d-------- c:\program files\AntiMalwar
2008-12-29 17:39 . 2008-12-29 17:44 <DIR> d-------- c:\program files\Anti-Malware
2008-12-29 17:32 . 2008-12-03 19:52 15,504 --a------ c:\windows\system32\drivers\mbam.sys
2008-12-29 17:31 . 2008-12-29 17:37 <DIR> d-------- c:\program files\Malwarebytes' Anti-Malware
2008-12-29 17:31 . 2008-12-03 19:52 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
2008-12-21 21:24 . 2008-12-21 21:43 <DIR> d-------- c:\program files\MagicISO
2008-12-21 10:48 . 2008-12-21 10:48 410,976 --a------ c:\windows\system32\deploytk.dll
2008-12-16 20:23 . 2008-12-16 20:23 43,551 --a------ c:\windows\system32\xvid-uninstall.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-01-11 02:56 --------- d-----w c:\documents and settings\All Users.WINDOWS\Application Data\Avg8
2009-01-11 02:51 --------- d-----w c:\documents and settings\All Users.WINDOWS\Application Data\Google Updater
2009-01-11 02:43 --------- d-----w c:\program files\YPOPs
2009-01-03 21:04 --------- d-----w c:\documents and settings\Alex.CIRCUITOUS\Application Data\uTorrent
2008-12-30 17:35 --------- d-----w c:\documents and settings\Alex.CIRCUITOUS\Application Data\Skype
2008-12-30 17:02 --------- d-----w c:\documents and settings\Alex.CIRCUITOUS\Application Data\skypePM
2008-12-30 17:00 --------- d-----w c:\program files\Mozilla Thunderbird
2008-12-22 06:12 --------- d-----w c:\program files\mIRC
2008-12-22 05:21 --------- d--h--w c:\program files\InstallShield Installation Information
2008-12-21 18:48 --------- d-----w c:\program files\Java
2008-12-10 08:01 --------- d-----w c:\program files\Google
2008-12-01 16:08 --------- d-----w c:\program files\Audacity
2008-05-15 14:56 251,417,869 ----a-w c:\documents and settings\Alex\Application Data\emails.zip
1601-01-01 00:12 43,008 --sha-w c:\windows\system32\rafomife.dll
2008-05-31 22:49 4,919,328 --sha-w c:\windows\system32\drivers\fidbox.dat
2008-05-31 22:49 16,928 --sha-w c:\windows\system32\drivers\fidbox2.dat
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]
"DAEMON Tools"="c:\program files\DAEMON Tools\daemon.exe" [2007-09-18 171464]
"Google Update"="c:\documents and settings\Alex.CIRCUITOUS\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2008-12-15 133104]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-08-11 7630848]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-08-11 86016]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2008-12-04 1261336]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-12-21 136600]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-05-27 413696]
"Acrobat Assistant 8.0"="c:\program files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe" [2007-05-10 624248]
"nwiz"="nwiz.exe" [2006-08-11 c:\windows\system32\nwiz.exe]
"RTHDCPL"="RTHDCPL.EXE" [2008-05-16 c:\windows\RTHDCPL.exe]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"WIAWizardMenu"="c:\windows\system32\sti_ci.dll" [2008-04-13 136704]

c:\backup\Start menu\Startup\
YPOPs.lnk - c:\program files\YPOPs\YPOPs.exe [2008-05-15 1355776]

c:\documents and settings\All Users.WINDOWS\Start Menu\Programs\Startup\
YPOPs.lnk - c:\program files\YPOPs\YPOPs.exe [2008-05-15 1355776]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages REG_MULTI_SZ msv1_0 c:\windows\system32\ljJBrQhg
Notification Packages REG_MULTI_SZ scecli c:\windows\system32\povufuyu.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify"=dword:00000001
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgemc.exe"=
"c:\\Program Files\\mIRC\\mirc.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Documents and Settings\\Alex.CIRCUITOUS\\Desktop\\FoodPrint\\winscp406.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgwdsvc.exe"=
"c:\\Program Files\\Google\\Common\\Google Updater\\GoogleUpdaterService.exe"=
"c:\\Combo-Fix\\NirCmd.cfexe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"550:TCP"= 550:TCP:ftp

R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2008-05-28 97928]
R1 BIOS;BIOS;c:\windows\system32\drivers\BIOS.sys [2008-05-15 13696]
R1 BS_I2cIo;BS_I2cIo;c:\windows\system32\drivers\BS_I2cIo.sys [2008-05-15 8192]
R4 avg8emc;AVG8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [2008-07-03 875288]
R4 avg8wd;AVG8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2008-07-03 231704]
R4 AvgTdiX;AVG8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2008-05-28 76040]
S4 Tsddrowdet;Tsddrowdet; [x]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{53628b4a-3e54-11dd-8600-0040f4e22957}]
\Shell\AutoRun\command - E:\Autoplay.exe -auto
.
Contents of the 'Scheduled Tasks' folder

2009-01-03 c:\windows\Tasks\eiibrkda.job
- c:\windows\system32\rundll32.exe [2008-04-13 16:12]

2009-01-03 c:\windows\Tasks\GoogleUpdateTaskUser.job
- c:\documents and settings\Alex.CIRCUITOUS\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2008-12-15 22:42]
.
- - - - ORPHANS REMOVED - - - -

BHO-{33EDD7F6-4D67-4C45-9F45-66FEB09A290B} - c:\windows\system32\ljJBrQhg.dll
BHO-{5c0559ba-26fa-463f-9890-0d956e2212fb} - c:\windows\system32\dasotegi.dll
BHO-{6D794CB4-C7CD-4c6f-BFDC-9B77AFBDC02C} - c:\windows\system32\tuvWQhEU.dll
BHO-{D5BF49A2-94F1-42BD-F434-3604812C807D} - c:\windows\system32\tyshb36rfjdf.dll
HKCU-Run-AdVantage - c:\program files\AdVantage\AdVantage.exe
SharedTaskScheduler-{D5BF49A2-94F1-42BD-F434-3604812C807D} - c:\windows\system32\tyshb36rfjdf.dll
ShellExecuteHooks-{6D794CB4-C7CD-4c6f-BFDC-9B77AFBDC02C} - c:\windows\system32\tuvWQhEU.dll


.
------- Supplementary Scan -------
.
uStart Page = hxxp://google.daemonsearch.com/intl/
uInternet Settings,ProxyOverride = *.local
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: Append to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert link target to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert link target to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert selected links to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert selected links to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Convert selection to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert selection to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\Alex.CIRCUITOUS\Application Data\Mozilla\Firefox\Profiles\plkyg8xo.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.igoogle.com
FF - component: c:\documents and settings\Alex.CIRCUITOUS\Application Data\Mozilla\Firefox\Profiles\plkyg8xo.default\extensions\{a7c6cf7f-112c-4500-a7ea-39801a327e5f}\platform\WINNT_x86-msvc\components\ipc.dll
FF - component: c:\program files\AVG\AVG8\Firefox\components\avgssff.dll
FF - plugin: c:\program files\Google\Google Updater\2.4.1368.5602\npCIDetect13.dll
FF - plugin: c:\program files\Google\Picasa3\npPicasa2.dll
FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npOGAPlugin.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-01-10 19:33:02
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\acs.exe
c:\windows\ALCFDRTM.EXE
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\nvsvc32.exe
c:\program files\AVG\AVG8\avgrsx.exe
c:\program files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
.
**************************************************************************
.
Completion time: 2009-01-10 19:36:12 - machine was rebooted [Alex]
ComboFix-quarantined-files.txt 2009-01-11 03:36:09

Pre-Run: 211,571,056,640 bytes free
Post-Run: 212,136,181,760 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

241

Attached Files


Edited by PropagandaPanda, 11 January 2009 - 10:31 AM.


#4 PropagandaPanda

PropagandaPanda


  • Malware Response Team
  • 10,433 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:11:22 AM

Posted 11 January 2009 - 10:43 AM

Hello.

Looks like ComboFix took out most of it. Let's clean up what left.

Run ComboFix with CFScript
We will run ComboFix again with a script.
  • Close any open browsers.
  • Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix. Refer to this page if you are unsure how.
  • Open notepad (Start>Run>"notepad") and copy/paste the text in the box below into it:
    File::
    c:\windows\system32\rafomife.dll
    c:\windows\Tasks\eiibrkda.job
    
    Registry::
    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
    "Authentication Packages"=hex(7):6d,73,76,31,5f,30,00,00
    "Notification Packages"=hex(7):73,63,65,63,6c,69,00,00
    
    Driver::
    Tsddrowdet
    Save this as CFScript.txt, in the same location as ComboFix.exe. (This should be your desktop.)
    Posted Image
    Refering to the picture above, drag CFScript into ComboFix.exe.
When finished, it shall produce a log for you at "C:\ComboFix.txt". Post back with that log.

Do not mouseclick ComboFix's window while it's running. That may cause it to stall

F-Secure Online Scan
Please run F-Secure Online Scanner to check for anything remaining.
This scan is for Internet Explorer only.
  • It is suggested that you disable security programs and close any other windows during the scan. While your security is disabled, please refrain from surfing on other sites. Refer to this page if you are unsure how.
  • Go to F-Secure Online Scanner
  • Follow the instructions here for installation.
  • Accept the License Agreement.
  • Once the ActiveX installs, click Full System Scan
  • Once the download completes, the scan will begin automatically. The scan will take some time to finish, so please be patient.
  • When the scan completes, click the Automatic cleaning (recommended) button.
  • Click the Show Report button and copy the entire report in your next reply.
  • Be sure to re-enable any security programs.

Please post back with:
-the ComboFix log
-the F-Secure scan log

How is your computer running now?

With Regards,
The Panda

Edited by PropagandaPanda, 11 January 2009 - 10:52 AM.


#5 limpin

limpin
  • Topic Starter

  • Members
  • 5 posts
  • OFFLINE
  •  
  • Local time:10:22 AM

Posted 11 January 2009 - 05:10 PM

OKAY! Both of your suggestions cleaned a lot more stuff--excellent!

Here are the two logs you asked for. Are there any other precautions I should take at this point? Or should I be clean? What free software would you recommend to keep running? I am wary of AVG if it let all of this through, but as I remember I gave scan bypass permissions to a program when the problem started.

Thanks for your help Panda!

________________________________________



Scanning Report
Sunday, January 11, 2009 12:49:35 - 14:05:28

Computer name: CIRCUITOUS2
Scanning type: Scan system for malware, rootkits
Target: C:\
Result: 8 malware found
Client-IRC.Win32.mIRC (spyware)

* System

TrackingCookie.Atdmt (spyware)

* System

TrackingCookie.Doubleclick (spyware)

* System

TrackingCookie.Mediaplex (spyware)

* System

W32/Packed_PeX.B (virus)

* C:\CONTINUUM\CONTINUUM037.EXE (Submitted)
* C:\CONTINUUM\CONTINUUM038.EXE (Submitted)
* C:\CONTINUUM\CONTINUUM039PR1.EXE (Submitted)

WebToolbar.Win32.WhenU (spyware)

* System

Statistics
Scanned:

* Files: 79993
* System: 3175
* Not scanned: 7

Actions:

* Disinfected: 0
* Renamed: 0
* Deleted: 0
* None: 8
* Submitted: 3

Files not scanned:

* C:\PAGEFILE.SYS
* C:\WINDOWS\SYSTEM32\DRIVERS\SPTD.SYS
* C:\WINDOWS\SYSTEM32\CONFIG\DEFAULT
* C:\WINDOWS\SYSTEM32\CONFIG\SAM
* C:\WINDOWS\SYSTEM32\CONFIG\SECURITY
* C:\WINDOWS\SYSTEM32\CONFIG\SOFTWARE
* C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM

Options
Scanning engines:

* F-Secure USS: 2.40.0
* F-Secure Blacklight: 0.0.0
* F-Secure Hydra: 2.8.8110, 2009-01-11
* F-Secure Pegasus: 1.20.0, 2008-11-17
* F-Secure AVP: 7.0.171, 2009-01-11

Scanning options:

* Scan defined files: COM EXE SYS OV? BIN SCR DLL SHS HTM HTML HTT VBS JS INF VXD DO? XL? RTF CPL WIZ HTA PP? PWZ P?T MSO PIF . ACM ASP AX CNV CSC DRV INI MDB MPD MPP MPT OBD OBT OCX PCI TLB TSP WBK WBT WPC WSH VWP WML BOO HLP TD0 TT6 MSG ASD JSE VBE WSC CHM EML PRC SHB LNK WSF {* PDF ZL? XML ZIP XXX ANI AVB BAT CMD JPG LSP MAP MHT MIF PHP POT SWF WMF NWS TAR
* Use Advanced heuristics

Attached Files



#6 PropagandaPanda

PropagandaPanda


  • Malware Response Team
  • 10,433 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:11:22 AM

Posted 11 January 2009 - 05:15 PM

Hello limpin.

Are there any other precautions I should take at this point? Or should I be clean? What free software would you recommend to keep running? I am wary of AVG if it let all of this through, but as I remember I gave scan bypass permissions to a program when the problem started.

You logs look clean.

Spybot with TeaTimer is excellent for preventing infections, though it can be annoying having to disable it to install programs and such.

AVG is pretty solid in my opinion.

You can't rely on an AV to protect you if you run the files that infect you.

I'll give you some prevention tips after we clear out.

Uninstall ComboFix
Remove Combofix now that we're done with it.

If this tool has helped you, please consider making a donation to its author. Posted Image
  • Click on your Start Menu, then Run....
  • Now type combofix /u in the runbox and click OK. Notice the space between the "x" and "/".
    Posted Image
Uninstalling ComboFix will do the following:
  • Delete ComboFix and its components from your computer.
  • Delete other tools commonly used during the malware removal process.
  • Resets clock settings to standard format.
  • Hide file extensions and hidden/system files.
  • Clear System Restore cache and creates new restore point.
Preventing Malware Infection in the Future
Please take some time to look at the following links, giving some advice and suggestions for preventing future infections: For general slowness problems that you may have, take a look at Slow Computer/browser? It May Not Be Malware. Read How to use the Startup Database to identify and disable uneeded processes and increase the amount of available resources.

Do you have any further questions or concerns?

With Regards,
The Panda

#7 limpin

limpin
  • Topic Starter

  • Members
  • 5 posts
  • OFFLINE
  •  
  • Local time:10:22 AM

Posted 12 January 2009 - 10:08 PM

Thank you so much Panda! I cannot express what a relief it is to finally be able to use a normal computer again! And be able to get back to work!! :thumbsup: You are providing a very honorable service, thanks a million.

#8 PropagandaPanda

PropagandaPanda


  • Malware Response Team
  • 10,433 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:11:22 AM

Posted 13 January 2009 - 12:18 PM

Glad we could help.

Since this issue appears to be resolved, this topic is now closed.
If you are the topic starter and need this topic reopened, send me a message.

Everyone else, please begin a new topic.

With Regards,
The Panda




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users