Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Google searches being redirected


  • This topic is locked This topic is locked
18 replies to this topic

#1 incongruous

incongruous

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Local time:05:41 PM

Posted 04 January 2009 - 01:04 AM

My google searches are constantly being redirected to irrelevant pages at "www.ecata.info".
I'm quite sure this is due to malware, but after scanning and fixing with superantispyware, spybot s&d, malwarebytes, and sophos antivirus, the problem still isn't fixed.
I'm stumped :thumbsup:

Here's the dds file:



DDS (Version 1.1.0) - NTFSx86
Run by Mark at 21:57:00.56 on Sat 01/03/2009
Internet Explorer: 7.0.5730.13 BrowserJavaVersion: 1.6.0_11
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.503.188 [GMT -8:00]

AV: Sophos Anti-Virus *On-access scanning enabled* (Updated)
FW: COMODO Firewall *enabled*

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\Program Files\Ahead\InCD\InCDsrv.exe
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Sophos\Sophos Anti-Virus\SAVAdminService.exe
C:\Program Files\Sophos\AutoUpdate\ALsvc.exe
C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe
C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe
C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\AGRSMMSG.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Sony\VAIO Update 2\VAIOUpdt.exe
C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe
C:\Program Files\Ahead\InCD\InCD.exe
C:\Program Files\COMODO\COMODO Internet Security\cfp.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Stardock\CursorFX\CursorFX.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Documents and Settings\Mark\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
C:\Program Files\DAEMON Tools Lite\daemon.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\Sophos\AutoUpdate\ALMon.exe
C:\Program Files\Stardock\ObjectDock\ObjectDock.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\program files\mozilla firefox\firefox.exe
C:\Documents and Settings\Mark\My Documents\Downloads\Programs\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.sony.com/vaiopeople
uInternet Connection Wizard,ShellNext = hxxp://shop.trendmicro.com/tmasy/eolsony.html?X=300&Y=300&WIDTH=690&HEIGHT=480
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Sophos Web Content Scanner: {39ea7695-b3f2-4c44-a4bc-297ada8fd235} - c:\program files\sophos\sophos anti-virus\SophosBHO.dll
BHO: Java™ Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre6\bin\ssv.dll
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\googletoolbar1.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: &Google: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\googletoolbar1.dll
TB: {0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7} - No File
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [CursorFX] "c:\program files\stardock\cursorfx\CursorFX.exe"
uRun: [TransBar] c:\documents and settings\mark\local settings\application data\aksoftware\transbar\TransBar.exe /s
uRun: [MsnMsgr] "c:\program files\windows live\messenger\MsnMsgr.Exe" /background
uRun: [Google Update] "c:\documents and settings\mark\local settings\application data\google\update\GoogleUpdate.exe" /c
uRun: [DAEMON Tools Lite] "c:\program files\daemon tools lite\daemon.exe" -autorun
uRun: [SUPERAntiSpyware] c:\program files\superantispyware\SUPERAntiSpyware.exe
mRun: [AGRSMMSG] AGRSMMSG.exe
mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
mRun: [High Definition Audio Property Page Shortcut] HDAudPropShortcut.exe
mRun: [SoundMan] SOUNDMAN.EXE
mRun: [AlcWzrd] ALCWZRD.EXE
mRun: [Alcmtr] ALCMTR.EXE
mRun: [ATIPTA] c:\program files\ati technologies\ati control panel\atiptaxx.exe
mRun: [VAIO Update 2] "c:\program files\sony\vaio update 2\VAIOUpdt.exe" /Stationary
mRun: [VAIOSurvey] c:\program files\sony\vaio survey\surveysa.exe
mRun: [VAIO Recovery] c:\windows\sonysys\vaio recovery\PartSeal.exe
mRun: [RemoteControl] "c:\program files\cyberlink dvd solution\powerdvd\PDVDServ.exe"
mRun: [InCD] c:\program files\ahead\incd\InCD.exe
mRun: [NeroFilterCheck] c:\windows\system32\NeroCheck.exe
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [powerword 2007] "c:\program files\kingsoft\powerword 2007\xdict.exe" -s -nosplash
mRun: [COMODO Internet Security] "c:\program files\comodo\comodo internet security\cfp.exe" -h
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
IE: &Google Search - c:\program files\google\GoogleToolbar1.dll/cmsearch.html
IE: Backward Links - c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
IE: Cached Snapshot of Page - c:\program files\google\GoogleToolbar1.dll/cmcache.html
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000
IE: Similar Pages - c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
IE: Translate into English - c:\program files\google\GoogleToolbar1.dll/cmtrans.html
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL
TCP: {F2B32CCC-7CF9-48F9-9B24-9D35421F66EA} = 192.168.1.254
Notify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.dll
Notify: AtiExtEvent - Ati2evxx.dll
Notify: igfxcui - igfxsrvc.dll
SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLL

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\mark\applic~1\mozilla\firefox\profiles\4j8b7ayl.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/ig
FF - plugin: c:\documents and settings\mark\local settings\application data\google\update\1.2.133.33\npGoogleOneClick7.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npchime.dll

============= SERVICES / DRIVERS ===============


=============== Created Last 30 ================

2009-01-03 20:19 <DIR> --d----- c:\docume~1\alluse~1\applic~1\SUPERAntiSpyware.com
2009-01-03 20:19 <DIR> --d----- c:\program files\SUPERAntiSpyware
2009-01-03 20:19 <DIR> --d----- c:\docume~1\mark\applic~1\SUPERAntiSpyware.com
2009-01-03 18:21 <DIR> --d----- c:\docume~1\mark\applic~1\Malwarebytes
2009-01-03 18:21 15,504 a------- c:\windows\system32\drivers\mbam.sys
2009-01-03 18:21 38,496 a------- c:\windows\system32\drivers\mbamswissarmy.sys
2009-01-03 18:21 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Malwarebytes
2009-01-03 18:21 <DIR> --d----- c:\program files\Malwarebytes' Anti-Malware
2009-01-03 18:03 <DIR> --d----- c:\program files\Trend Micro
2009-01-03 17:57 <DIR> --d----- c:\program files\CCleaner
2009-01-03 17:17 389,120 a------- c:\windows\system32\cmd.execf
2009-01-03 16:49 <DIR> --d----- c:\docume~1\mark\applic~1\Grisoft
2009-01-03 16:48 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Grisoft
2009-01-03 16:36 410,984 a------- c:\windows\system32\deploytk.dll
2009-01-03 16:36 73,728 a------- c:\windows\system32\javacpl.cpl
2009-01-03 16:01 <DIR> --d----- c:\documents and settings\mark\.SunDownloadManager
2009-01-02 00:17 152 a------- c:\windows\wininit.ini
2008-12-27 16:57 <DIR> --d----- c:\docume~1\mark\applic~1\DAEMON Tools Pro
2008-12-27 16:55 <DIR> --d----- c:\docume~1\alluse~1\applic~1\DAEMON Tools Lite
2008-12-27 16:54 <DIR> --d----- c:\program files\DAEMON Tools Lite
2008-12-27 16:50 268 a---h--- C:\sqmdata09.sqm
2008-12-27 16:50 244 a---h--- C:\sqmnoopt09.sqm
2008-12-27 16:37 2,297,552 a------- c:\windows\system32\d3dx9_26.dll
2008-12-27 16:11 <DIR> --d----- c:\program files\SEGA
2008-12-27 15:11 717,296 a------- c:\windows\system32\drivers\sptd.sys
2008-12-27 15:10 <DIR> --d----- c:\docume~1\mark\applic~1\DAEMON Tools Lite
2008-12-23 22:26 <DIR> --d----- c:\program files\LIUtilities
2008-12-23 22:25 <DIR> --d----- c:\program files\common files\Wise Installation Wizard
2008-12-18 11:55 <DIR> --d----- c:\program files\Microsoft SQL Server
2008-12-18 11:46 <DIR> --d----- c:\program files\Microsoft Web Designer Tools
2008-12-18 11:43 <DIR> --d----- c:\windows\system32\XPSViewer
2008-12-18 11:39 1,676,288 -c------ c:\windows\system32\dllcache\xpssvcs.dll
2008-12-18 11:39 597,504 -c------ c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2008-12-18 11:39 575,488 -c------ c:\windows\system32\dllcache\xpsshhdr.dll
2008-12-18 11:39 89,088 -c------ c:\windows\system32\dllcache\filterpipelineprintproc.dll
2008-12-18 11:39 1,676,288 -------- c:\windows\system32\xpssvcs.dll
2008-12-18 11:39 575,488 -------- c:\windows\system32\xpsshhdr.dll
2008-12-18 11:39 117,760 -------- c:\windows\system32\prntvpt.dll
2008-12-18 11:39 <DIR> --d----- C:\b123f0c3f80bb108c23c
2008-12-15 19:22 <DIR> --d----- c:\docume~1\mark\applic~1\Elluminate
2008-12-15 17:09 <DIR> --d----- c:\program files\Spybot - Search & Destroy
2008-12-15 17:09 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Spybot - Search & Destroy
2008-12-13 16:08 <DIR> --d----- c:\windows\system32\scripting
2008-12-13 16:08 <DIR> --d----- c:\windows\l2schemas
2008-12-13 16:08 <DIR> --d----- c:\windows\system32\en
2008-12-13 16:08 <DIR> --d----- c:\windows\system32\bits
2008-12-13 16:04 <DIR> --d----- c:\windows\ServicePackFiles
2008-12-13 15:56 <DIR> --d----- c:\windows\EHome
2008-12-12 22:05 0 a------- c:\windows\VAIOUpdt.INI
2008-12-11 22:34 268 a---h--- C:\sqmdata08.sqm
2008-12-11 22:34 244 a---h--- C:\sqmnoopt08.sqm
2008-12-11 19:26 268 a---h--- C:\sqmdata07.sqm
2008-12-11 19:26 244 a---h--- C:\sqmnoopt07.sqm
2008-12-11 18:55 130,104 a------- c:\windows\system32\sdccoinstaller.dll
2008-12-11 18:52 <DIR> --d----- c:\program files\common files\Cisco Systems
2008-12-11 18:51 23,552 a------- c:\windows\system32\sophosboottasks.exe
2008-12-11 18:51 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Sophos
2008-12-11 18:33 14,976 a------- c:\windows\system32\drivers\SophosBootDriver.sys
2008-12-11 18:31 104,704 a------- c:\windows\system32\drivers\savonaccesscontrol.sys
2008-12-11 18:30 35,584 a------- c:\windows\system32\drivers\savonaccessfilter.sys
2008-12-11 18:16 <DIR> --d----- c:\program files\Sophos
2008-12-11 18:16 <DIR> --d----- C:\SAV7
2008-12-11 18:12 <DIR> --d----- c:\temp\SAV7
2008-12-11 18:08 <DIR> --d----- C:\Temp
2008-12-11 18:02 <DIR> --d----- c:\docume~1\alluse~1\applic~1\comodo
2008-12-11 18:02 147,192 a------- c:\windows\system32\guard32.dll
2008-12-11 18:02 101,776 a------- c:\windows\system32\drivers\cmdguard.sys
2008-12-11 18:02 31,504 a------- c:\windows\system32\drivers\cmdhlp.sys
2008-12-11 18:02 <DIR> --d----- c:\program files\COMODO
2008-12-11 17:53 120 a------- c:\windows\CIS_Setup_3.5.57173.439_XP_Vista_x32.INI
2008-12-11 02:04 268 a---h--- C:\sqmdata06.sqm
2008-12-11 02:04 244 a---h--- C:\sqmnoopt06.sqm
2008-12-10 17:29 <DIR> --d----- c:\program files\uTorrent
2008-12-10 17:29 <DIR> --d----- c:\docume~1\mark\applic~1\uTorrent
2008-12-10 17:03 <DIR> --d----- c:\program files\SystemRequirementsLab
2008-12-09 16:04 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Protexis
2008-12-09 16:04 80 ---shr-- c:\windows\system32\F41DFE3309.dll
2008-12-09 16:04 152,848 a------- c:\windows\system32\comdlg32.ocx
2008-12-09 13:15 <DIR> --d----- c:\program files\MSECache
2008-12-09 11:56 247,326 -c------ c:\windows\system32\dllcache\strmdll.dll

==================== Find3M ====================

2008-12-13 16:11 83,615 a------- c:\windows\pchealth\helpctr\offlinecache\index.dat
2008-11-09 13:17 0 a---hr-- c:\windows\system32\drivers\Sony_VGC-RB30.mrk
2008-10-23 04:36 286,720 a------- c:\windows\system32\gdi32.dll
2008-10-16 14:06 268,648 a------- c:\windows\system32\mucltui.dll
2008-10-16 14:06 208,744 a------- c:\windows\system32\muweb.dll
2008-10-16 12:38 826,368 a------- c:\windows\system32\wininet.dll
2005-03-31 22:17 40,960 a------- c:\program files\Uninstall_CDS.exe

============= FINISH: 21:58:38.56 ===============

Thanks in advance

Attached Files



BC AdBot (Login to Remove)

 


#2 PropagandaPanda

PropagandaPanda


  • Malware Response Team
  • 10,433 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:08:41 PM

Posted 10 January 2009 - 02:15 PM

Hello. I am PropagandaPanda (Panda or PP for short), and I will be helping you.

Disable Realtime Protection
Antimalware programs can interfere with ComboFix and other tools we need to run. Please temporarily disable all realtime protections you have enabled. Refer to this page, if you are unsure how.

Download and Run ComboFix
If you have already run ComboFix, delete your copy and download a new one. If the computer in question is unable to download ComboFix, transfer it using a removable media (CDs, flash drive).

Download Combofix by sUBs from any of the links below, and save it to your desktop.
Link 1, Link 2, Link 3
  • Close/disable all anti-virus and anti-malware programs so they do not interfere with the running of ComboFix. Refer to this page if you are not sure how.
  • Double click on ComboFix.exe and follow the prompts. If you are using Windows Vista, right click the icon and select "Run as Administrator". You will not recieve the prompts below if you are not using Windows XP. ComboFix will check to see if you have the Windows Recovery Console installed.
  • If you did not have it installed, you will see the prompt below. Choose YES.
    Posted ImagePosted Image

  • When the Recovery Console has been installed, you will see the prompt below. Choose YES.
    Posted Image
  • When finished, ComboFix will produce a report for you. Please post the contents of the log (C:\ComboFix.txt).
Leave your computer alone while ComboFix is running. ComboFix will restart your computer if malware is found; allow it to do so.

In your next reply include:
-the ComboFix log
-a new HijackThis or DDS log

Please also tell me of any changes you have made to your computer since you started your topic.

With Regards,
The Panda

#3 incongruous

incongruous
  • Topic Starter

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Local time:05:41 PM

Posted 10 January 2009 - 03:37 PM

Thanks for your reply, Panda.

I ran Combofix, but encountered a slight problem.
I did not have Recovery Console installed, so Combofix tried to download it, but the download failed and the scan proceeded without it.
Combofix then detected rootkit activity, and rebooted the computer.

[codebox]Combofix has detected the presence of rootkit activity and needs to reboot the machine.
Kindly, note down on paper, the name of each file. We may need it later.

C:\WINDOWS\system32\drivers\msqpdxujebyvpa.sys
C:\WINDOWS\system32\msqpdxvboygvml.dll[/codebox]

Upon restart, Combofix began the scan, deleting several files, but at stage 50 of deleting "C:\WINDOWS\system32\F41DFE3309.dll", it said [codebox]"C:\WINDOWS\system32\" is not recognized as an internal or external command, operable program or batch file[/codebox], and as far as I know, isn't doing anything.
I'm posting this from another computer; what should I do now?

Thanks again,

#4 PropagandaPanda

PropagandaPanda


  • Malware Response Team
  • 10,433 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:08:41 PM

Posted 10 January 2009 - 05:42 PM

Hello.

If you not have already, please click the X on ComboFix's window and close it.

Then, take a scan with GMER.

Download and Run Scan with GMER
We will use GMER to scan for rootkits.
  • Download gmer.zip and save to your desktop.
  • Unzip/extract the file to its own folder. (Click here for information on how to do this if not sure. Win 2000 users click here.
  • Close all other running programs. There is a small chance this application may crash your computer so save any work you have open.
  • Double-click on Gmer.exe to start the program.
  • Allow the gmer.sys driver to load if asked.
  • If it gives you a warning at program start about rootkit activity and asks if you want to run a scan...click NO.
  • Click the >>>.
  • Click on Settings, then check the first five settings:
    • System Protection and Tracing
    • Processes
    • Save created processes to the log
    • Drivers
    • Save loaded drivers to the log
  • Click OK.
  • You will be prompted to restart your computer. Please do so.
After the reboot, run Gmer again and click on the Rootkit tab.
  • Look at the right hand side (under Files) and uncheck all drives with the exception of your C drive.
  • Make sure all other boxes on the right of the screen are checked, EXCEPT for Show All.
  • Click on the Scan and wait for the scan to finish.
    Note: Before scanning, make sure all other running programs are closed and no other actions like a scheduled antivirus scan will occur while this scan completes. Also do not use your computer during the scan. You will know that the scan is done when the Stop buttons turns back to Scan.
  • When completed, click on the Copy button and right-click on your Desktop, choose New>Text document. Once the file is created, open it and right-click again and choose Paste. Save the file as gmer.txt and copy the information in your next reply.
  • Note: If you have any problems, try running GMER in Safe Mode. However, do not use the MsConfig method to edit the Boot.ini.
Important!:Please do not select the Show all checkbox during the scan..

Also include a new DDS log.

With Regards,
The Panda

#5 incongruous

incongruous
  • Topic Starter

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Local time:05:41 PM

Posted 10 January 2009 - 07:17 PM

Hi Panda,

I ran GMER, but the first time the computer suddenly rebooted without warning.
I tried again, this time in safe mode. The log is attached, as it's too long


Here is a new DDS log

DDS (Ver_09-01-07.01) - NTFSx86 Run by Mark at 16:08:09.39 on 2009-01-10Internet Explorer: 7.0.5730.13 BrowserJavaVersion: 1.6.0_11Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.503.115 [GMT -8:00]AV: Sophos Anti-Virus *On-access scanning enabled* (Updated)FW: COMODO Firewall *enabled*============== Running Processes ===============C:\WINDOWS\system32\svchost -k DcomLaunchsvchost.exeC:\WINDOWS\System32\svchost.exe -k netsvcsC:\Program Files\Ahead\InCD\InCDsrv.exesvchost.exesvchost.exeC:\Program Files\Lavasoft\Ad-Aware\aawservice.exeC:\WINDOWS\system32\spoolsv.exeC:\Program Files\Comodo\CBOClean\BOCORE.exeC:\Program Files\COMODO\COMODO Internet Security\cmdagent.exeC:\Program Files\Java\jre6\bin\jqs.exeC:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXEC:\Program Files\Sophos\Sophos Anti-Virus\SAVAdminService.exeC:\Program Files\Sophos\AutoUpdate\ALsvc.exeC:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exeC:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exeC:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exeC:\WINDOWS\Explorer.EXEC:\WINDOWS\AGRSMMSG.exeC:\WINDOWS\SOUNDMAN.EXEC:\Program Files\Sony\VAIO Update 2\VAIOUpdt.exeC:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exeC:\Program Files\COMODO\COMODO Internet Security\cfp.exeC:\Program Files\Java\jre6\bin\jusched.exeC:\WINDOWS\system32\ctfmon.exeC:\Program Files\Stardock\CursorFX\CursorFX.exeC:\Program Files\Windows Live\Messenger\MsnMsgr.ExeC:\Program Files\Sophos\AutoUpdate\ALMon.exeC:\Program Files\Stardock\ObjectDock\ObjectDock.exeC:\Program Files\Mozilla Firefox\firefox.exeC:\Program Files\Windows Live\Mail\wlmail.exeC:\Documents and Settings\Mark\Desktop\dds.scr============== Pseudo HJT Report ===============uStart Page = hxxp://www.sony.com/vaiopeopleuInternet Connection Wizard,ShellNext = hxxp://shop.trendmicro.com/tmasy/eolsony.html?X=300&Y=300&WIDTH=690&HEIGHT=480BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dllBHO: Sophos Web Content Scanner: {39ea7695-b3f2-4c44-a4bc-297ada8fd235} - c:\program files\sophos\sophos anti-virus\SophosBHO.dllBHO: Java™ Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre6\bin\ssv.dllBHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dllBHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\googletoolbar1.dllBHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dllBHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dllTB: &Google: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\googletoolbar1.dllTB: {0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7} - No FileuRun: [ctfmon.exe] c:\windows\system32\ctfmon.exeuRun: [CursorFX] "c:\program files\stardock\cursorfx\CursorFX.exe"uRun: [TransBar] c:\documents and settings\mark\local settings\application data\aksoftware\transbar\TransBar.exe /suRun: [MsnMsgr] "c:\program files\windows live\messenger\MsnMsgr.Exe" /backgroundmRun: [AGRSMMSG] AGRSMMSG.exemRun: [IgfxTray] c:\windows\system32\igfxtray.exemRun: [HotKeysCmds] c:\windows\system32\hkcmd.exemRun: [High Definition Audio Property Page Shortcut] HDAudPropShortcut.exemRun: [SoundMan] SOUNDMAN.EXEmRun: [AlcWzrd] ALCWZRD.EXEmRun: [ATIPTA] c:\program files\ati technologies\ati control panel\atiptaxx.exemRun: [VAIO Update 2] "c:\program files\sony\vaio update 2\VAIOUpdt.exe" /StationarymRun: [VAIO Recovery] c:\windows\sonysys\vaio recovery\PartSeal.exemRun: [RemoteControl] "c:\program files\cyberlink dvd solution\powerdvd\PDVDServ.exe"mRun: [NeroFilterCheck] c:\windows\system32\NeroCheck.exemRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"mRun: [COMODO Internet Security] "c:\program files\comodo\comodo internet security\cfp.exe" -hmRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottimemRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"StartupFolder: c:\docume~1\mark\startm~1\programs\startup\stardo~1.lnk - c:\program files\stardock\objectdock\ObjectDock.exeStartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\autoup~1.lnk - c:\program files\sophos\autoupdate\ALMon.exeIE: &Google Search - c:\program files\google\GoogleToolbar1.dll/cmsearch.htmlIE: Backward Links - c:\program files\google\GoogleToolbar1.dll/cmbacklinks.htmlIE: Cached Snapshot of Page - c:\program files\google\GoogleToolbar1.dll/cmcache.htmlIE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000IE: Similar Pages - c:\program files\google\GoogleToolbar1.dll/cmsimilar.htmlIE: Translate into English - c:\program files\google\GoogleToolbar1.dll/cmtrans.htmlIE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exeIE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exeIE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLLTrusted Zone: ketsujin.com\fighteraceTrusted Zone: ketsujin.com\primaryTrusted Zone: ketsujin.com\updateTrusted Zone: ketsujin.com\wwwTrusted Zone: stormofaces.com\wwwTCP: {F2B32CCC-7CF9-48F9-9B24-9D35421F66EA} = 192.168.1.254Notify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.dllNotify: AtiExtEvent - Ati2evxx.dllNotify: igfxcui - igfxsrvc.dllSEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLL================= FIREFOX ===================FF - ProfilePath - c:\docume~1\mark\applic~1\mozilla\firefox\profiles\4j8b7ayl.default\FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/ig============= SERVICES / DRIVERS ===============R1 cmdGuard;COMODO Internet Security Sandbox Driver;c:\windows\system32\drivers\cmdguard.sys [2008-12-11 101776]R1 cmdHlp;COMODO Internet Security Helper Driver;c:\windows\system32\drivers\cmdhlp.sys [2008-12-11 31504]R1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\sasdifsv.sys [2008-12-22 8944]R1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2008-12-22 55024]R1 SAVOnAccessControl;SAVOnAccessControl;c:\windows\system32\drivers\savonaccesscontrol.sys [2008-12-11 104704]R1 SAVOnAccessFilter;SAVOnAccessFilter;c:\windows\system32\drivers\savonaccessfilter.sys [2008-12-11 35584]R4 aawservice;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\aawservice.exe [2008-9-10 611664]R4 BOCore;BOCore;c:\program files\comodo\cboclean\BOCore.exe [2009-1-4 73464]R4 cmdAgent;COMODO Internet Security Helper Service;c:\program files\comodo\comodo internet security\cmdagent.exe [2008-12-11 618232]R4 MLPTDR_Q;MLPTDR_Q;c:\windows\system32\MLPTDR_Q.SYS [2003-7-23 18848]R4 SAVAdminService;Sophos Anti-Virus status reporter;c:\program files\sophos\sophos anti-virus\SAVAdminService.exe [2008-12-11 69632]R4 SAVService;Sophos Anti-Virus;c:\program files\sophos\sophos anti-virus\SavService.exe [2008-12-11 98304]R4 Sophos AutoUpdate Service;Sophos AutoUpdate Service;c:\program files\sophos\autoupdate\ALsvc.exe [2008-12-11 172032]S3 SASENUM;SASENUM;c:\program files\superantispyware\SASENUM.SYS [2008-12-22 7408]S4 SophosBootDriver;SophosBootDriver;c:\windows\system32\drivers\SophosBootDriver.sys [2008-12-11 14976]=============== Created Last 30 ================2009-01-10 15:16 345 a------- c:\windows\gmer.ini2009-01-10 12:08 <DIR> --d----- C:\ComboFix2009-01-10 12:08 389,120 a------- c:\windows\system32\CF2148.exe2009-01-10 12:04 389,120 a------- c:\windows\system32\CF1524.exe2009-01-10 12:02 389,120 a------- c:\windows\system32\CF1083.exe2009-01-05 20:22 <DIR> --d----- c:\program files\ViRC2009-01-04 21:38 <DIR> --d----- c:\program files\GPLGS2009-01-04 21:34 87,552 a------- c:\windows\system32\cpwmon2k.dll2009-01-04 20:33 <DIR> --d----- c:\program files\Air Attack2009-01-04 20:16 <DIR> --d----- c:\docume~1\mark\applic~1\WinPatrol2009-01-04 20:14 <DIR> --d----- c:\program files\BillP Studios2009-01-04 20:11 <DIR> --d----- c:\program files\SpywareGuard2009-01-04 20:08 22,528 a------- c:\windows\system32\wsock32.dlb2009-01-04 20:07 205,560 a------- c:\windows\UNBOC.EXE2009-01-04 20:07 212,728 a------- c:\windows\CMDLIC.DLL2009-01-04 20:07 <DIR> --d----- c:\docume~1\alluse~1\applic~1\BOC4272009-01-04 20:07 960 a------- c:\windows\BOC427.INI2009-01-04 20:03 <DIR> --d----- c:\program files\Acro Software2009-01-04 12:33 116,224 ac------ c:\windows\system32\dllcache\xrxwiadr.dll2009-01-04 12:33 23,040 ac------ c:\windows\system32\dllcache\xrxwbtmp.dll2009-01-04 12:33 18,944 ac------ c:\windows\system32\dllcache\xrxscnui.dll2009-01-04 12:33 27,648 ac------ c:\windows\system32\dllcache\xrxftplt.exe2009-01-04 12:33 4,608 ac------ c:\windows\system32\dllcache\xrxflnch.exe2009-01-04 12:33 99,865 ac------ c:\windows\system32\dllcache\xlog.exe2009-01-04 12:33 28,288 ac------ c:\windows\system32\dllcache\xjis.nls2009-01-04 12:33 16,970 ac------ c:\windows\system32\dllcache\xem336n5.sys2009-01-04 12:31 19,016 ac------ c:\windows\system32\dllcache\w926nd.sys2009-01-04 12:30 794,654 ac------ c:\windows\system32\dllcache\usr1801.sys2009-01-04 12:29 525,568 ac------ c:\windows\system32\dllcache\tridxp.dll2009-01-04 12:28 17,129 ac------ c:\windows\system32\dllcache\tdkcd31.sys2009-01-04 12:27 155,648 ac------ c:\windows\system32\dllcache\stlnprop.dll2009-01-04 12:26 10,240 ac------ c:\windows\system32\dllcache\snmpstup.dll2009-01-04 12:25 238,592 ac------ c:\windows\system32\dllcache\sisgrv.dll2009-01-04 12:24 23,936 ac------ c:\windows\system32\dllcache\sccmusbm.sys2009-01-04 12:23 20,992 ac------ c:\windows\system32\dllcache\rtl8139.sys2009-01-04 12:22 130,942 ac------ c:\windows\system32\dllcache\ptserlv.sys2009-01-04 12:21 27,296 ac------ c:\windows\system32\dllcache\perc2.sys2009-01-04 12:20 25,088 ac------ c:\windows\system32\dllcache\ovca.sys2009-01-04 12:19 15,872 ac------ c:\windows\system32\dllcache\ne2000.sys2009-01-04 12:18 2,944 ac------ c:\windows\system32\dllcache\msmpu401.sys2009-01-04 12:17 65,536 ac------ c:\windows\system32\dllcache\EXCH_mailmsg.dll2009-01-04 12:16 9,216 ac------ c:\windows\system32\dllcache\kbdnecat.dll2009-01-04 12:15 372,824 ac------ c:\windows\system32\dllcache\iconf32.dll2009-01-04 12:14 50,751 ac------ c:\windows\system32\dllcache\hsf_tone.sys2009-01-04 12:13 126,976 ac------ c:\windows\system32\dllcache\hpgt34tk.dll2009-01-04 12:12 444,416 ac------ c:\windows\system32\dllcache\fpcibase.sys2009-01-04 12:11 18,503 ac------ c:\windows\system32\dllcache\epro4.sys2009-01-04 12:10 6,216 ac------ c:\windows\system32\dllcache\divaci.dll2009-01-04 12:09 249,856 ac------ c:\windows\system32\dllcache\ctmasetp.dll2009-01-04 12:08 13,824 ac------ c:\windows\system32\dllcache\bulltlp3.sys2009-01-04 12:07 66,048 ac------ c:\windows\system32\dllcache\s3legacy.dll2009-01-04 11:53 <DIR> --d----- c:\program files\SpywareBlaster2009-01-04 00:09 <DIR> --d----- c:\program files\Cobian Backup 92009-01-03 22:25 <DIR> --d----- c:\program files\Lavasoft2009-01-03 20:19 <DIR> --d----- c:\docume~1\alluse~1\applic~1\SUPERAntiSpyware.com2009-01-03 20:19 <DIR> --d----- c:\program files\SUPERAntiSpyware2009-01-03 20:19 <DIR> --d----- c:\docume~1\mark\applic~1\SUPERAntiSpyware.com2009-01-03 18:21 <DIR> --d----- c:\docume~1\mark\applic~1\Malwarebytes2009-01-03 18:21 15,504 a------- c:\windows\system32\drivers\mbam.sys2009-01-03 18:21 38,496 a------- c:\windows\system32\drivers\mbamswissarmy.sys2009-01-03 18:21 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Malwarebytes2009-01-03 18:21 <DIR> --d----- c:\program files\Malwarebytes' Anti-Malware2009-01-03 18:03 <DIR> --d----- c:\program files\Trend Micro2009-01-03 17:57 <DIR> --d----- c:\program files\CCleaner2009-01-03 16:49 <DIR> --d----- c:\docume~1\mark\applic~1\Grisoft2009-01-03 16:48 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Grisoft2009-01-03 16:36 410,984 a------- c:\windows\system32\deploytk.dll2009-01-03 16:36 73,728 a------- c:\windows\system32\javacpl.cpl2009-01-03 16:01 <DIR> --d----- c:\documents and settings\mark\.SunDownloadManager2009-01-02 00:17 152 a------- c:\windows\wininit.ini2008-12-27 16:57 <DIR> --d----- c:\docume~1\mark\applic~1\DAEMON Tools Pro2008-12-27 16:55 <DIR> --d----- c:\docume~1\alluse~1\applic~1\DAEMON Tools Lite2008-12-27 16:54 <DIR> --d----- c:\program files\DAEMON Tools Lite2008-12-27 16:50 268 a---h--- C:\sqmdata09.sqm2008-12-27 16:50 244 a---h--- C:\sqmnoopt09.sqm2008-12-27 16:37 2,297,552 a------- c:\windows\system32\d3dx9_26.dll2008-12-27 16:11 <DIR> --d----- c:\program files\SEGA2008-12-27 15:11 717,296 a------- c:\windows\system32\drivers\sptd.sys2008-12-27 15:10 <DIR> --d----- c:\docume~1\mark\applic~1\DAEMON Tools Lite2008-12-23 22:26 <DIR> --d----- c:\program files\LIUtilities2008-12-23 22:25 <DIR> --d----- c:\program files\common files\Wise Installation Wizard2008-12-18 11:55 <DIR> --d----- c:\program files\Microsoft SQL Server2008-12-18 11:46 <DIR> --d----- c:\program files\Microsoft Web Designer Tools2008-12-18 11:43 <DIR> --d----- c:\windows\system32\XPSViewer2008-12-18 11:39 1,676,288 -c------ c:\windows\system32\dllcache\xpssvcs.dll2008-12-18 11:39 597,504 -c------ c:\windows\system32\dllcache\printfilterpipelinesvc.exe2008-12-18 11:39 575,488 -c------ c:\windows\system32\dllcache\xpsshhdr.dll2008-12-18 11:39 89,088 -c------ c:\windows\system32\dllcache\filterpipelineprintproc.dll2008-12-18 11:39 1,676,288 -------- c:\windows\system32\xpssvcs.dll2008-12-18 11:39 575,488 -------- c:\windows\system32\xpsshhdr.dll2008-12-18 11:39 117,760 -------- c:\windows\system32\prntvpt.dll2008-12-18 11:39 <DIR> --d----- C:\b123f0c3f80bb108c23c2008-12-15 19:22 <DIR> --d----- c:\docume~1\mark\applic~1\Elluminate2008-12-15 17:09 <DIR> --d----- c:\program files\Spybot - Search & Destroy2008-12-15 17:09 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Spybot - Search & Destroy2008-12-13 16:08 <DIR> --d----- c:\windows\system32\scripting2008-12-13 16:08 <DIR> --d----- c:\windows\l2schemas2008-12-13 16:08 <DIR> --d----- c:\windows\system32\en2008-12-13 16:08 <DIR> --d----- c:\windows\system32\bits2008-12-13 16:04 <DIR> --d----- c:\windows\ServicePackFiles2008-12-13 15:56 <DIR> --d----- c:\windows\EHome2008-12-12 22:05 0 a------- c:\windows\VAIOUpdt.INI2008-12-11 22:34 268 a---h--- C:\sqmdata08.sqm2008-12-11 22:34 244 a---h--- C:\sqmnoopt08.sqm2008-12-11 19:26 268 a---h--- C:\sqmdata07.sqm2008-12-11 19:26 244 a---h--- C:\sqmnoopt07.sqm2008-12-11 18:55 130,104 a------- c:\windows\system32\sdccoinstaller.dll2008-12-11 18:52 <DIR> --d----- c:\program files\common files\Cisco Systems2008-12-11 18:51 23,552 a------- c:\windows\system32\sophosboottasks.exe2008-12-11 18:51 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Sophos2008-12-11 18:33 14,976 a------- c:\windows\system32\drivers\SophosBootDriver.sys2008-12-11 18:31 104,704 a------- c:\windows\system32\drivers\savonaccesscontrol.sys2008-12-11 18:30 35,584 a------- c:\windows\system32\drivers\savonaccessfilter.sys2008-12-11 18:16 <DIR> --d----- c:\program files\Sophos2008-12-11 18:16 <DIR> --d----- C:\SAV72008-12-11 18:12 <DIR> --d----- c:\temp\SAV72008-12-11 18:08 <DIR> --d----- C:\Temp2008-12-11 18:02 <DIR> --d----- c:\docume~1\alluse~1\applic~1\comodo2008-12-11 18:02 147,192 a------- c:\windows\system32\guard32.dll2008-12-11 18:02 101,776 a------- c:\windows\system32\drivers\cmdguard.sys2008-12-11 18:02 31,504 a------- c:\windows\system32\drivers\cmdhlp.sys2008-12-11 18:02 <DIR> --d----- c:\program files\COMODO2008-12-11 17:53 120 a------- c:\windows\CIS_Setup_3.5.57173.439_XP_Vista_x32.INI==================== Find3M ====================2009-01-10 11:51 389,120 a------- c:\windows\system32\CF31644.exe2009-01-10 11:51 389,120 a------- c:\windows\system32\CF31637.exe2008-12-13 16:11 83,615 a------- c:\windows\pchealth\helpctr\offlinecache\index.dat2008-10-23 04:36 286,720 a------- c:\windows\system32\gdi32.dll2008-10-16 14:06 268,648 a------- c:\windows\system32\mucltui.dll2008-10-16 14:06 208,744 a------- c:\windows\system32\muweb.dll2008-10-16 12:38 826,368 a------- c:\windows\system32\wininet.dll2005-03-31 22:17 40,960 a------- c:\program files\Uninstall_CDS.exe============= FINISH: 16:09:11.20 ===============

Thanks again :thumbsup:

Attached Files


Edited by PropagandaPanda, 10 January 2009 - 07:56 PM.


#6 PropagandaPanda

PropagandaPanda


  • Malware Response Team
  • 10,433 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:08:41 PM

Posted 10 January 2009 - 07:58 PM

Hello.

Sorry, could you please post DDS.txt again? I tried to remove the code box, but.. then the log got messed up.

Leave the log in normal text please.

With Regards,
The Panda

#7 incongruous

incongruous
  • Topic Starter

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Local time:05:41 PM

Posted 10 January 2009 - 08:18 PM

Sorry about that

Here it is:


DDS (Ver_09-01-07.01) - NTFSx86
Run by Mark at 16:08:09.39 on 2009-01-10
Internet Explorer: 7.0.5730.13 BrowserJavaVersion: 1.6.0_11
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.503.115 [GMT -8:00]

AV: Sophos Anti-Virus *On-access scanning enabled* (Updated)
FW: COMODO Firewall *enabled*

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\Program Files\Ahead\InCD\InCDsrv.exe
svchost.exe
svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Comodo\CBOClean\BOCORE.exe
C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Sophos\Sophos Anti-Virus\SAVAdminService.exe
C:\Program Files\Sophos\AutoUpdate\ALsvc.exe
C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe
C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe
C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\AGRSMMSG.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Sony\VAIO Update 2\VAIOUpdt.exe
C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe
C:\Program Files\COMODO\COMODO Internet Security\cfp.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Stardock\CursorFX\CursorFX.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\Sophos\AutoUpdate\ALMon.exe
C:\Program Files\Stardock\ObjectDock\ObjectDock.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Windows Live\Mail\wlmail.exe
C:\Documents and Settings\Mark\Desktop\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.sony.com/vaiopeople
uInternet Connection Wizard,ShellNext = hxxp://shop.trendmicro.com/tmasy/eolsony.html?X=300&Y=300&WIDTH=690&HEIGHT=480
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Sophos Web Content Scanner: {39ea7695-b3f2-4c44-a4bc-297ada8fd235} - c:\program files\sophos\sophos anti-virus\SophosBHO.dll
BHO: Java™ Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre6\bin\ssv.dll
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\googletoolbar1.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: &Google: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\googletoolbar1.dll
TB: {0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7} - No File
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [CursorFX] "c:\program files\stardock\cursorfx\CursorFX.exe"
uRun: [TransBar] c:\documents and settings\mark\local settings\application data\aksoftware\transbar\TransBar.exe /s
uRun: [MsnMsgr] "c:\program files\windows live\messenger\MsnMsgr.Exe" /background
mRun: [AGRSMMSG] AGRSMMSG.exe
mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
mRun: [High Definition Audio Property Page Shortcut] HDAudPropShortcut.exe
mRun: [SoundMan] SOUNDMAN.EXE
mRun: [AlcWzrd] ALCWZRD.EXE
mRun: [ATIPTA] c:\program files\ati technologies\ati control panel\atiptaxx.exe
mRun: [VAIO Update 2] "c:\program files\sony\vaio update 2\VAIOUpdt.exe" /Stationary
mRun: [VAIO Recovery] c:\windows\sonysys\vaio recovery\PartSeal.exe
mRun: [RemoteControl] "c:\program files\cyberlink dvd solution\powerdvd\PDVDServ.exe"
mRun: [NeroFilterCheck] c:\windows\system32\NeroCheck.exe
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [COMODO Internet Security] "c:\program files\comodo\comodo internet security\cfp.exe" -h
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
StartupFolder: c:\docume~1\mark\startm~1\programs\startup\stardo~1.lnk - c:\program files\stardock\objectdock\ObjectDock.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\autoup~1.lnk - c:\program files\sophos\autoupdate\ALMon.exe
IE: &Google Search - c:\program files\google\GoogleToolbar1.dll/cmsearch.html
IE: Backward Links - c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
IE: Cached Snapshot of Page - c:\program files\google\GoogleToolbar1.dll/cmcache.html
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000
IE: Similar Pages - c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
IE: Translate into English - c:\program files\google\GoogleToolbar1.dll/cmtrans.html
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL
Trusted Zone: ketsujin.com\fighterace
Trusted Zone: ketsujin.com\primary
Trusted Zone: ketsujin.com\update
Trusted Zone: ketsujin.com\www
Trusted Zone: stormofaces.com\www
TCP: {F2B32CCC-7CF9-48F9-9B24-9D35421F66EA} = 192.168.1.254
Notify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.dll
Notify: AtiExtEvent - Ati2evxx.dll
Notify: igfxcui - igfxsrvc.dll
SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLL

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\mark\applic~1\mozilla\firefox\profiles\4j8b7ayl.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/ig

============= SERVICES / DRIVERS ===============

R1 cmdGuard;COMODO Internet Security Sandbox Driver;c:\windows\system32\drivers\cmdguard.sys [2008-12-11 101776]
R1 cmdHlp;COMODO Internet Security Helper Driver;c:\windows\system32\drivers\cmdhlp.sys [2008-12-11 31504]
R1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\sasdifsv.sys [2008-12-22 8944]
R1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2008-12-22 55024]
R1 SAVOnAccessControl;SAVOnAccessControl;c:\windows\system32\drivers\savonaccesscontrol.sys [2008-12-11 104704]
R1 SAVOnAccessFilter;SAVOnAccessFilter;c:\windows\system32\drivers\savonaccessfilter.sys [2008-12-11 35584]
R4 aawservice;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\aawservice.exe [2008-9-10 611664]
R4 BOCore;BOCore;c:\program files\comodo\cboclean\BOCore.exe [2009-1-4 73464]
R4 cmdAgent;COMODO Internet Security Helper Service;c:\program files\comodo\comodo internet security\cmdagent.exe [2008-12-11 618232]
R4 MLPTDR_Q;MLPTDR_Q;c:\windows\system32\MLPTDR_Q.SYS [2003-7-23 18848]
R4 SAVAdminService;Sophos Anti-Virus status reporter;c:\program files\sophos\sophos anti-virus\SAVAdminService.exe [2008-12-11 69632]
R4 SAVService;Sophos Anti-Virus;c:\program files\sophos\sophos anti-virus\SavService.exe [2008-12-11 98304]
R4 Sophos AutoUpdate Service;Sophos AutoUpdate Service;c:\program files\sophos\autoupdate\ALsvc.exe [2008-12-11 172032]
S3 SASENUM;SASENUM;c:\program files\superantispyware\SASENUM.SYS [2008-12-22 7408]
S4 SophosBootDriver;SophosBootDriver;c:\windows\system32\drivers\SophosBootDriver.sys [2008-12-11 14976]

=============== Created Last 30 ================

2009-01-10 15:16 345 a------- c:\windows\gmer.ini
2009-01-10 12:08 <DIR> --d----- C:\ComboFix
2009-01-10 12:08 389,120 a------- c:\windows\system32\CF2148.exe
2009-01-10 12:04 389,120 a------- c:\windows\system32\CF1524.exe
2009-01-10 12:02 389,120 a------- c:\windows\system32\CF1083.exe
2009-01-05 20:22 <DIR> --d----- c:\program files\ViRC
2009-01-04 21:38 <DIR> --d----- c:\program files\GPLGS
2009-01-04 21:34 87,552 a------- c:\windows\system32\cpwmon2k.dll
2009-01-04 20:33 <DIR> --d----- c:\program files\Air Attack
2009-01-04 20:16 <DIR> --d----- c:\docume~1\mark\applic~1\WinPatrol
2009-01-04 20:14 <DIR> --d----- c:\program files\BillP Studios
2009-01-04 20:11 <DIR> --d----- c:\program files\SpywareGuard
2009-01-04 20:08 22,528 a------- c:\windows\system32\wsock32.dlb
2009-01-04 20:07 205,560 a------- c:\windows\UNBOC.EXE
2009-01-04 20:07 212,728 a------- c:\windows\CMDLIC.DLL
2009-01-04 20:07 <DIR> --d----- c:\docume~1\alluse~1\applic~1\BOC427
2009-01-04 20:07 960 a------- c:\windows\BOC427.INI
2009-01-04 20:03 <DIR> --d----- c:\program files\Acro Software
2009-01-04 12:33 116,224 ac------ c:\windows\system32\dllcache\xrxwiadr.dll
2009-01-04 12:33 23,040 ac------ c:\windows\system32\dllcache\xrxwbtmp.dll
2009-01-04 12:33 18,944 ac------ c:\windows\system32\dllcache\xrxscnui.dll
2009-01-04 12:33 27,648 ac------ c:\windows\system32\dllcache\xrxftplt.exe
2009-01-04 12:33 4,608 ac------ c:\windows\system32\dllcache\xrxflnch.exe
2009-01-04 12:33 99,865 ac------ c:\windows\system32\dllcache\xlog.exe
2009-01-04 12:33 28,288 ac------ c:\windows\system32\dllcache\xjis.nls
2009-01-04 12:33 16,970 ac------ c:\windows\system32\dllcache\xem336n5.sys
2009-01-04 12:31 19,016 ac------ c:\windows\system32\dllcache\w926nd.sys
2009-01-04 12:30 794,654 ac------ c:\windows\system32\dllcache\usr1801.sys
2009-01-04 12:29 525,568 ac------ c:\windows\system32\dllcache\tridxp.dll
2009-01-04 12:28 17,129 ac------ c:\windows\system32\dllcache\tdkcd31.sys
2009-01-04 12:27 155,648 ac------ c:\windows\system32\dllcache\stlnprop.dll
2009-01-04 12:26 10,240 ac------ c:\windows\system32\dllcache\snmpstup.dll
2009-01-04 12:25 238,592 ac------ c:\windows\system32\dllcache\sisgrv.dll
2009-01-04 12:24 23,936 ac------ c:\windows\system32\dllcache\sccmusbm.sys
2009-01-04 12:23 20,992 ac------ c:\windows\system32\dllcache\rtl8139.sys
2009-01-04 12:22 130,942 ac------ c:\windows\system32\dllcache\ptserlv.sys
2009-01-04 12:21 27,296 ac------ c:\windows\system32\dllcache\perc2.sys
2009-01-04 12:20 25,088 ac------ c:\windows\system32\dllcache\ovca.sys
2009-01-04 12:19 15,872 ac------ c:\windows\system32\dllcache\ne2000.sys
2009-01-04 12:18 2,944 ac------ c:\windows\system32\dllcache\msmpu401.sys
2009-01-04 12:17 65,536 ac------ c:\windows\system32\dllcache\EXCH_mailmsg.dll
2009-01-04 12:16 9,216 ac------ c:\windows\system32\dllcache\kbdnecat.dll
2009-01-04 12:15 372,824 ac------ c:\windows\system32\dllcache\iconf32.dll
2009-01-04 12:14 50,751 ac------ c:\windows\system32\dllcache\hsf_tone.sys
2009-01-04 12:13 126,976 ac------ c:\windows\system32\dllcache\hpgt34tk.dll
2009-01-04 12:12 444,416 ac------ c:\windows\system32\dllcache\fpcibase.sys
2009-01-04 12:11 18,503 ac------ c:\windows\system32\dllcache\epro4.sys
2009-01-04 12:10 6,216 ac------ c:\windows\system32\dllcache\divaci.dll
2009-01-04 12:09 249,856 ac------ c:\windows\system32\dllcache\ctmasetp.dll
2009-01-04 12:08 13,824 ac------ c:\windows\system32\dllcache\bulltlp3.sys
2009-01-04 12:07 66,048 ac------ c:\windows\system32\dllcache\s3legacy.dll
2009-01-04 11:53 <DIR> --d----- c:\program files\SpywareBlaster
2009-01-04 00:09 <DIR> --d----- c:\program files\Cobian Backup 9
2009-01-03 22:25 <DIR> --d----- c:\program files\Lavasoft
2009-01-03 20:19 <DIR> --d----- c:\docume~1\alluse~1\applic~1\SUPERAntiSpyware.com
2009-01-03 20:19 <DIR> --d----- c:\program files\SUPERAntiSpyware
2009-01-03 20:19 <DIR> --d----- c:\docume~1\mark\applic~1\SUPERAntiSpyware.com
2009-01-03 18:21 <DIR> --d----- c:\docume~1\mark\applic~1\Malwarebytes
2009-01-03 18:21 15,504 a------- c:\windows\system32\drivers\mbam.sys
2009-01-03 18:21 38,496 a------- c:\windows\system32\drivers\mbamswissarmy.sys
2009-01-03 18:21 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Malwarebytes
2009-01-03 18:21 <DIR> --d----- c:\program files\Malwarebytes' Anti-Malware
2009-01-03 18:03 <DIR> --d----- c:\program files\Trend Micro
2009-01-03 17:57 <DIR> --d----- c:\program files\CCleaner
2009-01-03 16:49 <DIR> --d----- c:\docume~1\mark\applic~1\Grisoft
2009-01-03 16:48 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Grisoft
2009-01-03 16:36 410,984 a------- c:\windows\system32\deploytk.dll
2009-01-03 16:36 73,728 a------- c:\windows\system32\javacpl.cpl
2009-01-03 16:01 <DIR> --d----- c:\documents and settings\mark\.SunDownloadManager
2009-01-02 00:17 152 a------- c:\windows\wininit.ini
2008-12-27 16:57 <DIR> --d----- c:\docume~1\mark\applic~1\DAEMON Tools Pro
2008-12-27 16:55 <DIR> --d----- c:\docume~1\alluse~1\applic~1\DAEMON Tools Lite
2008-12-27 16:54 <DIR> --d----- c:\program files\DAEMON Tools Lite
2008-12-27 16:50 268 a---h--- C:\sqmdata09.sqm
2008-12-27 16:50 244 a---h--- C:\sqmnoopt09.sqm
2008-12-27 16:37 2,297,552 a------- c:\windows\system32\d3dx9_26.dll
2008-12-27 16:11 <DIR> --d----- c:\program files\SEGA
2008-12-27 15:11 717,296 a------- c:\windows\system32\drivers\sptd.sys
2008-12-27 15:10 <DIR> --d----- c:\docume~1\mark\applic~1\DAEMON Tools Lite
2008-12-23 22:26 <DIR> --d----- c:\program files\LIUtilities
2008-12-23 22:25 <DIR> --d----- c:\program files\common files\Wise Installation Wizard
2008-12-18 11:55 <DIR> --d----- c:\program files\Microsoft SQL Server
2008-12-18 11:46 <DIR> --d----- c:\program files\Microsoft Web Designer Tools
2008-12-18 11:43 <DIR> --d----- c:\windows\system32\XPSViewer
2008-12-18 11:39 1,676,288 -c------ c:\windows\system32\dllcache\xpssvcs.dll
2008-12-18 11:39 597,504 -c------ c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2008-12-18 11:39 575,488 -c------ c:\windows\system32\dllcache\xpsshhdr.dll
2008-12-18 11:39 89,088 -c------ c:\windows\system32\dllcache\filterpipelineprintproc.dll
2008-12-18 11:39 1,676,288 -------- c:\windows\system32\xpssvcs.dll
2008-12-18 11:39 575,488 -------- c:\windows\system32\xpsshhdr.dll
2008-12-18 11:39 117,760 -------- c:\windows\system32\prntvpt.dll
2008-12-18 11:39 <DIR> --d----- C:\b123f0c3f80bb108c23c
2008-12-15 19:22 <DIR> --d----- c:\docume~1\mark\applic~1\Elluminate
2008-12-15 17:09 <DIR> --d----- c:\program files\Spybot - Search & Destroy
2008-12-15 17:09 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Spybot - Search & Destroy
2008-12-13 16:08 <DIR> --d----- c:\windows\system32\scripting
2008-12-13 16:08 <DIR> --d----- c:\windows\l2schemas
2008-12-13 16:08 <DIR> --d----- c:\windows\system32\en
2008-12-13 16:08 <DIR> --d----- c:\windows\system32\bits
2008-12-13 16:04 <DIR> --d----- c:\windows\ServicePackFiles
2008-12-13 15:56 <DIR> --d----- c:\windows\EHome
2008-12-12 22:05 0 a------- c:\windows\VAIOUpdt.INI
2008-12-11 22:34 268 a---h--- C:\sqmdata08.sqm
2008-12-11 22:34 244 a---h--- C:\sqmnoopt08.sqm
2008-12-11 19:26 268 a---h--- C:\sqmdata07.sqm
2008-12-11 19:26 244 a---h--- C:\sqmnoopt07.sqm
2008-12-11 18:55 130,104 a------- c:\windows\system32\sdccoinstaller.dll
2008-12-11 18:52 <DIR> --d----- c:\program files\common files\Cisco Systems
2008-12-11 18:51 23,552 a------- c:\windows\system32\sophosboottasks.exe
2008-12-11 18:51 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Sophos
2008-12-11 18:33 14,976 a------- c:\windows\system32\drivers\SophosBootDriver.sys
2008-12-11 18:31 104,704 a------- c:\windows\system32\drivers\savonaccesscontrol.sys
2008-12-11 18:30 35,584 a------- c:\windows\system32\drivers\savonaccessfilter.sys
2008-12-11 18:16 <DIR> --d----- c:\program files\Sophos
2008-12-11 18:16 <DIR> --d----- C:\SAV7
2008-12-11 18:12 <DIR> --d----- c:\temp\SAV7
2008-12-11 18:08 <DIR> --d----- C:\Temp
2008-12-11 18:02 <DIR> --d----- c:\docume~1\alluse~1\applic~1\comodo
2008-12-11 18:02 147,192 a------- c:\windows\system32\guard32.dll
2008-12-11 18:02 101,776 a------- c:\windows\system32\drivers\cmdguard.sys
2008-12-11 18:02 31,504 a------- c:\windows\system32\drivers\cmdhlp.sys
2008-12-11 18:02 <DIR> --d----- c:\program files\COMODO
2008-12-11 17:53 120 a------- c:\windows\CIS_Setup_3.5.57173.439_XP_Vista_x32.INI

==================== Find3M ====================

2009-01-10 11:51 389,120 a------- c:\windows\system32\CF31644.exe
2009-01-10 11:51 389,120 a------- c:\windows\system32\CF31637.exe
2008-12-13 16:11 83,615 a------- c:\windows\pchealth\helpctr\offlinecache\index.dat
2008-10-23 04:36 286,720 a------- c:\windows\system32\gdi32.dll
2008-10-16 14:06 268,648 a------- c:\windows\system32\mucltui.dll
2008-10-16 14:06 208,744 a------- c:\windows\system32\muweb.dll
2008-10-16 12:38 826,368 a------- c:\windows\system32\wininet.dll
2005-03-31 22:17 40,960 a------- c:\program files\Uninstall_CDS.exe

============= FINISH: 16:09:11.20 ===============

#8 PropagandaPanda

PropagandaPanda


  • Malware Response Team
  • 10,433 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:08:41 PM

Posted 10 January 2009 - 08:30 PM

Hello incongruous.

Looks pretty good. Just some leftovers that I can see.

Download and Run ATFCleaner
Please download ATF Cleaner by Atribune. This program will clear out temporary files and settings. You will likely be logged out of the forum where you are recieving help.

This program is for XP and Windows 2000 only.
  • Double-click ATF-Cleaner.exe to run the program.
  • Under Main Select Files to Delete choose: Select All.
  • Click the Empty Selected button.
If you use Firefox browser also...
  • Click Firefox at the top and choose: Select All
  • Click the Empty Selected button.
    NOTE: If you would like to keep your saved passwords, please click No at the prompt.
If you use Opera browser also...
  • Click Opera at the top and choose: Select All
  • Click the Empty Selected button.
    NOTE: If you would like to keep your saved passwords, please click No at the prompt.
Download and Run OTMoveIT
  • Please download OTMoveIt3 by OldTimer to your desktop. If you have already used the program, there is no need to download a new one.
  • Double-click OTMoveIt3.exe to run it. If you are running on Vista, right click on the file and choose Run As Administrator.
  • Copy the lines in the codebox below. Do not copy the word "code".
    :files
    c:\program files\SpywareGuard\
    
    :commands
    [emptytemp]
  • Return to OTMoveIt3, right click in the Paste List Of Files/Patterns To Move window (under the yellow bar) and choose Paste.
  • Close all open windows expect OTMoveIt.
  • Click the Posted Image button.
  • Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
  • Close OTMoveIt3.
Note: If a file or folder cannot be moved immediately, you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes. In this case, after the reboot, open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key. Navigate to the C:\_OTMoveIt\MovedFiles folder, and open the newest ".log" file present, and copy/paste the contents of that document back here in your next post.

F-Secure Online Scan
Let's check for anything left.
This scan is for Internet Explorer only.
  • It is suggested that you disable security programs and close any other windows during the scan. While your security is disabled, please refrain from surfing on other sites. Refer to this page if you are unsure how.
  • Go to F-Secure Online Scanner
  • Follow the instructions here for installation.
  • Accept the License Agreement.
  • Once the ActiveX installs, click Full System Scan
  • Once the download completes, the scan will begin automatically. The scan will take some time to finish, so please be patient.
  • When the scan completes, click the Automatic cleaning (recommended) button.
  • Click the Show Report button and copy the entire report in your next reply.
  • Be sure to re-enable any security programs.

Please tell me of any problems you still have.

With Regards,
The Panda

#9 incongruous

incongruous
  • Topic Starter

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Local time:05:41 PM

Posted 10 January 2009 - 10:26 PM

Hi again, Panda.

Here is the OTmoveIt log:

========== FILES ==========
c:\program files\SpywareGuard moved successfully.
========== COMMANDS ==========
User's Temp folder emptied.
User's Temporary Internet Files folder emptied.
User's Internet Explorer cache folder emptied.
Local Service Temp folder emptied.
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
Local Service Temporary Internet Files folder emptied.
File delete failed. C:\WINDOWS\temp\JET8A6.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\JETFB09.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\Perflib_Perfdata_2a8.dat scheduled to be deleted on reboot.
Windows Temp folder emptied.
Java cache emptied.
FireFox cache emptied.
Opera cache emptied.
Temp folders emptied.

OTMoveIt3 by OldTimer - Version 1.0.8.0 log created on 01102009_174028

Files moved on Reboot...
File move failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\JET8A6.tmp scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\JETFB09.tmp scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\Perflib_Perfdata_2a8.dat scheduled to be moved on reboot.


Here is the F-Secure Report:

Scanning Report
Saturday, January 10, 2009 18:34:33 - 19:24:26

Computer name: E58AEB3F9A6342E
Scanning type: Scan system for malware, rootkits
Target: C:\
Result: 2 malware found
Backdoor.Win32.SubSeven (virus)

* System

Backdoor.Win32.SubSeven.asw (virus)

* C:\DOCUMENTS AND SETTINGS\MARK\DESKTOP\OTMOVEIT3.EXE

Statistics
Scanned:

* Files: 35437
* System: 3571
* Not scanned: 8

Actions:

* Disinfected: 0
* Renamed: 0
* Deleted: 0
* None: 2
* Submitted: 0

Files not scanned:

* C:\HIBERFIL.SYS
* C:\PAGEFILE.SYS
* C:\WINDOWS\SYSTEM32\DRIVERS\SPTD.SYS
* C:\WINDOWS\SYSTEM32\CONFIG\DEFAULT
* C:\WINDOWS\SYSTEM32\CONFIG\SAM
* C:\WINDOWS\SYSTEM32\CONFIG\SECURITY
* C:\WINDOWS\SYSTEM32\CONFIG\SOFTWARE
* C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM

Options
Scanning engines:

* F-Secure USS: 2.40.0
* F-Secure Hydra: 2.8.8110, 2009-01-10
* F-Secure AVP: 7.0.171, 2009-01-10
* F-Secure Pegasus: 1.20.0, 2008-11-17
* F-Secure Blacklight: 0.0.0

Scanning options:

* Scan defined files: COM EXE SYS OV? BIN SCR DLL SHS HTM HTML HTT VBS JS INF VXD DO? XL? RTF CPL WIZ HTA PP? PWZ P?T MSO PIF . ACM ASP AX CNV CSC DRV INI MDB MPD MPP MPT OBD OBT OCX PCI TLB TSP WBK WBT WPC WSH VWP WML BOO HLP TD0 TT6 MSG ASD JSE VBE WSC CHM EML PRC SHB LNK WSF {* PDF ZL? XML ZIP XXX ANI AVB BAT CMD JPG LSP MAP MHT MIF PHP POT SWF WMF NWS TAR
* Use Advanced heuristics

Copyright 1998-2007 Product support |Send virus sample to F-Secure
F-Secure assumes no responsibility for material created or published by third parties that F-Secure World Wide Web pages have a link to. Unless you have clearly stated otherwise, by submitting material to any of our servers, for example by E-mail or via our F-Secure's CGI E-mail, you agree that the material you make available may be published in the F-Secure World Wide Pages or hard-copy publications. You will reach F-Secure public web site by clicking on underlined links. While doing this, your access will be logged to our private access statistics with your domain name.This information will not be given to any third party. You agree not to take action against us in relation to material that you submit. Unless you have clearly stated otherwise, by submitting material you warrant that F-Secure may incorporate any concepts described in it in the F-Secure products/publications without liability.


Thanks for your continued support! :thumbsup:

#10 PropagandaPanda

PropagandaPanda


  • Malware Response Team
  • 10,433 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:08:41 PM

Posted 11 January 2009 - 10:30 AM

Hello.

Looks pretty good.

There are a couple files that I want to take a look at though.

Run ComboFix with CFScript
We will run ComboFix again. The instructions are slightly different from the initial run.
  • Close any open browsers.
  • Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix. Refer to this page if you are unsure how.
  • Open notepad (Start>Run>"notepad") and copy/paste the text in the box below into it:
    http://www.bleepingcomputer.com/forums/t/192031/google-searches-being-redirected/
    
    Suspect::[59]
    C:\WINDOWS\temp\JET8A6.tmp
    C:\WINDOWS\temp\JETFB09.tmp
    Save this as CFScript.txt, in the same location as ComboFix.exe. (This should be your desktop.)
    Posted Image
  • Close all windows at this point.
  • Refering to the picture above, drag CFScript into ComboFix.exe.
  • When finished, it shall produce a log for you at "C:\ComboFix.txt"
Upload Samples Collected by ComboFix
When CF finishes running, the ComboFix log will open along with a message box--do not be alarmed. With the above script, ComboFix will capture files to submit for analysis.
  • Ensure you are connected to the internet and click OK on the message box.
  • A browser will open.
  • Simply follow the instructions to copy/paste/send the requested file.
Please remind me in your next reply that you submitted a sample.

With Regards,
The Panda

#11 incongruous

incongruous
  • Topic Starter

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Local time:05:41 PM

Posted 11 January 2009 - 05:32 PM

Hi Panda,

I tried running combofix, but it once again stopped, saying:
""C:\WINDOWS\system32\" is not recognized as an internal or external command, operable program or batch file"

I'm not sure what is wrong.

Thanks again

#12 PropagandaPanda

PropagandaPanda


  • Malware Response Team
  • 10,433 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:08:41 PM

Posted 11 January 2009 - 06:04 PM

Hello.

There was a bug in the last version. Please delete your current version and download a new copy:
Link 1, Link 2, Link 3

Run the script again.

With Regards,
The Panda

#13 incongruous

incongruous
  • Topic Starter

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Local time:05:41 PM

Posted 11 January 2009 - 10:52 PM

Hi Panda,

I tried again, but the same problem still persists.

""C:\WINDOWS\system32\" is not recognized as an internal or external command, operable program or batch file"

Thanks.

#14 PropagandaPanda

PropagandaPanda


  • Malware Response Team
  • 10,433 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:08:41 PM

Posted 12 January 2009 - 08:21 AM

Hello.

Please delete the folder:
C:\QooBox\LastRun

and try again.

With Regards,
The Panda

#15 incongruous

incongruous
  • Topic Starter

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Local time:05:41 PM

Posted 13 January 2009 - 10:02 PM

Hi Panda,

I ran combofix, and this time it worked properly.
However, combofix was unable to connect to the server and upload the files, so I submitted it manually.
It is also attached.

Combofix also generated a log; it is as shown:


ComboFix 09-01-13.03 - Mark 2009-01-13 18:52:08.5 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.503.147 [GMT -8:00]
Running from: c:\documents and settings\Mark\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Mark\Desktop\CFScript.txt
AV: Sophos Anti-Virus *On-access scanning disabled* (Updated)
FW: COMODO Firewall *enabled*
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((( Files Created from 2008-12-14 to 2009-01-14 )))))))))))))))))))))))))))))))
.

2009-01-12 20:41 . 2008-05-30 14:11 3,850,760 --a------ c:\windows\system32\D3DX9_38.dll
2009-01-12 20:23 . 2009-01-12 20:39 <DIR> d--h----- c:\windows\msdownld.tmp
2009-01-12 20:23 . 2009-01-12 20:23 <DIR> d-------- c:\windows\Logs
2009-01-12 20:17 . 2009-01-12 20:17 <DIR> d-------- c:\program files\Alcohol Soft
2009-01-12 18:06 . 2009-01-12 18:06 <DIR> d-------- c:\program files\Total War
2009-01-10 15:16 . 2009-01-10 15:32 345 --a------ c:\windows\gmer.ini
2009-01-05 20:22 . 2009-01-05 20:43 <DIR> d-------- c:\program files\ViRC
2009-01-04 21:38 . 2009-01-04 21:38 <DIR> d-------- c:\program files\GPLGS
2009-01-04 21:34 . 2007-07-12 22:33 87,552 --a------ c:\windows\system32\cpwmon2k.dll
2009-01-04 20:33 . 2009-01-04 20:34 <DIR> d-------- c:\program files\Air Attack
2009-01-04 20:16 . 2009-01-04 20:16 <DIR> d-------- c:\documents and settings\Mark\Application Data\WinPatrol
2009-01-04 20:14 . 2009-01-04 20:14 <DIR> d-------- c:\program files\BillP Studios
2009-01-04 20:08 . 2008-04-13 16:12 22,528 --a------ c:\windows\system32\wsock32.dlb
2009-01-04 20:07 . 2009-01-04 20:07 <DIR> d-------- c:\documents and settings\All Users\Application Data\BOC427
2009-01-04 20:07 . 2008-07-14 05:09 212,728 --a------ c:\windows\CMDLIC.DLL
2009-01-04 20:07 . 2008-07-14 05:09 205,560 --a------ c:\windows\UNBOC.EXE
2009-01-04 20:07 . 2009-01-04 21:31 960 --a------ c:\windows\BOC427.INI
2009-01-04 20:03 . 2009-01-04 21:34 <DIR> d-------- c:\program files\Acro Software
2009-01-04 12:33 . 2008-04-13 16:12 116,224 --a--c--- c:\windows\system32\dllcache\xrxwiadr.dll
2009-01-04 12:33 . 2001-08-17 22:37 99,865 --a--c--- c:\windows\system32\dllcache\xlog.exe
2009-01-04 12:33 . 2004-08-04 04:00 28,288 --a--c--- c:\windows\system32\dllcache\xjis.nls
2009-01-04 12:33 . 2001-08-17 22:37 27,648 --a--c--- c:\windows\system32\dllcache\xrxftplt.exe
2009-01-04 12:33 . 2001-08-17 22:36 23,040 --a--c--- c:\windows\system32\dllcache\xrxwbtmp.dll
2009-01-04 12:33 . 2008-04-13 16:12 18,944 --a--c--- c:\windows\system32\dllcache\xrxscnui.dll
2009-01-04 12:33 . 2001-08-17 12:11 16,970 --a--c--- c:\windows\system32\dllcache\xem336n5.sys
2009-01-04 12:33 . 2001-08-17 22:37 4,608 --a--c--- c:\windows\system32\dllcache\xrxflnch.exe
2009-01-04 12:31 . 2001-08-17 13:28 794,399 --a--c--- c:\windows\system32\dllcache\usr1806v.sys
2009-01-04 12:30 . 2001-08-17 13:28 794,654 --a--c--- c:\windows\system32\dllcache\usr1801.sys
2009-01-04 12:29 . 2001-08-17 22:36 525,568 --a--c--- c:\windows\system32\dllcache\tridxp.dll
2009-01-04 12:28 . 2001-08-17 14:56 172,768 --a--c--- c:\windows\system32\dllcache\t2r4disp.dll
2009-01-04 12:26 . 2001-08-17 14:56 157,696 --a--c--- c:\windows\system32\dllcache\sisv256.dll
2009-01-04 12:25 . 2001-08-17 22:36 386,560 --a--c--- c:\windows\system32\dllcache\sgiul50.dll
2009-01-04 12:24 . 2001-08-17 22:36 495,616 --a--c--- c:\windows\system32\dllcache\sblfx.dll
2009-01-04 12:23 . 2001-08-17 13:28 899,146 --a--c--- c:\windows\system32\dllcache\r2mdkxga.sys
2009-01-04 12:22 . 2008-04-13 16:12 363,520 --a--c--- c:\windows\system32\dllcache\psisdecd.dll
2009-01-04 12:21 . 2001-08-17 14:05 351,616 --a--c--- c:\windows\system32\dllcache\ovcodek2.sys
2009-01-04 12:20 . 2001-08-17 12:50 198,144 --a--c--- c:\windows\system32\dllcache\nv3.sys
2009-01-04 12:19 . 2004-08-04 04:00 229,439 --a--c--- c:\windows\system32\dllcache\multibox.dll
2009-01-04 12:18 . 2004-08-04 04:00 1,875,968 --a--c--- c:\windows\system32\dllcache\msir3jp.lex
2009-01-04 12:17 . 2004-08-04 04:00 1,158,818 --a--c--- c:\windows\system32\dllcache\korwbrkr.lex
2009-01-04 12:16 . 2004-08-04 04:00 471,102 --a--c--- c:\windows\system32\dllcache\imskdic.dll
2009-01-04 12:15 . 2004-08-04 04:00 10,129,408 --a--c--- c:\windows\system32\dllcache\hwxkor.dll
2009-01-04 12:14 . 2001-08-17 13:28 542,879 --a--c--- c:\windows\system32\dllcache\hsf_msft.sys
2009-01-04 12:13 . 2001-08-17 14:56 1,733,120 --a--c--- c:\windows\system32\dllcache\g400d.dll
2009-01-04 12:12 . 2001-08-17 12:17 629,952 --a--c--- c:\windows\system32\dllcache\eqn.sys
2009-01-04 12:11 . 2001-08-17 12:14 952,007 --a--c--- c:\windows\system32\dllcache\diwan.sys
2009-01-04 12:10 . 2001-08-17 22:36 614,429 --a--c--- c:\windows\system32\dllcache\digiview.exe
2009-01-04 12:09 . 2004-08-04 04:00 1,677,824 --a--c--- c:\windows\system32\dllcache\chsbrkr.dll
2009-01-04 12:08 . 2001-08-17 13:28 871,388 --a--c--- c:\windows\system32\dllcache\bcmdm.sys
2009-01-04 12:07 . 2001-08-17 14:56 66,048 --a--c--- c:\windows\system32\dllcache\s3legacy.dll
2009-01-04 11:53 . 2009-01-04 11:53 <DIR> d-------- c:\program files\SpywareBlaster
2009-01-04 00:09 . 2009-01-04 00:10 <DIR> d-------- c:\program files\Cobian Backup 9
2009-01-03 22:25 . 2009-01-03 22:25 <DIR> d-------- c:\program files\Lavasoft
2009-01-03 22:25 . 2009-01-03 22:25 <DIR> d-------- c:\documents and settings\All Users\Application Data\Lavasoft
2009-01-03 20:19 . 2009-01-03 20:19 <DIR> d-------- c:\program files\SUPERAntiSpyware
2009-01-03 20:19 . 2009-01-03 20:19 <DIR> d-------- c:\documents and settings\Mark\Application Data\SUPERAntiSpyware.com
2009-01-03 20:19 . 2009-01-03 20:19 <DIR> d-------- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2009-01-03 18:21 . 2009-01-03 18:21 <DIR> d-------- c:\program files\Malwarebytes' Anti-Malware
2009-01-03 18:21 . 2009-01-03 18:21 <DIR> d-------- c:\documents and settings\Mark\Application Data\Malwarebytes
2009-01-03 18:21 . 2009-01-03 18:21 <DIR> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-01-03 18:21 . 2008-12-03 19:52 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
2009-01-03 18:21 . 2008-12-03 19:52 15,504 --a------ c:\windows\system32\drivers\mbam.sys
2009-01-03 18:03 . 2009-01-03 18:03 <DIR> d-------- c:\program files\Trend Micro
2009-01-03 17:57 . 2009-01-03 17:57 <DIR> d-------- c:\program files\CCleaner
2009-01-03 16:49 . 2009-01-03 16:49 <DIR> d-------- c:\documents and settings\Mark\Application Data\Grisoft
2009-01-03 16:48 . 2009-01-03 16:48 <DIR> d-------- c:\documents and settings\All Users\Application Data\Grisoft
2009-01-03 16:36 . 2009-01-03 16:36 410,984 --a------ c:\windows\system32\deploytk.dll
2009-01-03 16:36 . 2009-01-03 16:36 73,728 --a------ c:\windows\system32\javacpl.cpl
2009-01-03 16:01 . 2009-01-03 16:01 <DIR> d-------- c:\documents and settings\Mark\.SunDownloadManager
2009-01-02 00:17 . 2009-01-02 00:17 152 --a------ c:\windows\wininit.ini
2009-01-01 16:49 . 2009-01-01 16:51 <DIR> d-------- c:\program files\7-Zip
2008-12-27 16:57 . 2009-01-12 18:02 <DIR> d-------- c:\documents and settings\Mark\Application Data\DAEMON Tools Pro
2008-12-27 16:57 . 2008-12-27 16:57 <DIR> d-------- c:\documents and settings\Mark\Application Data\DAEMON Tools
2008-12-27 16:55 . 2008-12-27 16:55 <DIR> d-------- c:\documents and settings\All Users\Application Data\DAEMON Tools Lite
2008-12-27 16:54 . 2008-12-27 16:54 <DIR> d-------- c:\program files\DAEMON Tools Lite
2008-12-27 16:37 . 2005-05-26 15:34 2,297,552 --a------ c:\windows\system32\d3dx9_26.dll
2008-12-27 16:11 . 2008-12-27 16:11 <DIR> d-------- c:\program files\SEGA
2008-12-27 16:10 . 2008-12-27 16:10 <DIR> d-------- c:\documents and settings\Mark\Application Data\InstallShield
2008-12-27 15:17 . 2008-12-27 15:17 <DIR> d-------- c:\documents and settings\Mark\Application Data\Sonic
2008-12-27 15:16 . 2008-12-27 15:16 <DIR> d-------- c:\documents and settings\Mark\Application Data\Leadertech
2008-12-27 15:11 . 2008-12-27 15:11 717,296 --a------ c:\windows\system32\drivers\sptd.sys
2008-12-27 15:10 . 2008-12-27 17:03 <DIR> d-------- c:\documents and settings\Mark\Application Data\DAEMON Tools Lite
2008-12-26 12:10 . 2008-12-27 17:13 <DIR> d-------- c:\documents and settings\Mark\Application Data\Download Manager
2008-12-25 19:08 . 2008-12-25 20:07 <DIR> d-a------ c:\documents and settings\All Users\Application Data\TEMP
2008-12-23 22:26 . 2008-12-23 22:26 <DIR> d-------- c:\program files\LIUtilities
2008-12-23 22:25 . 2009-01-04 11:57 <DIR> d-------- c:\program files\Common Files\Wise Installation Wizard
2008-12-23 16:32 . 2008-12-23 16:33 <DIR> d-------- c:\program files\QuickTime
2008-12-23 16:32 . 2008-12-23 16:32 <DIR> d-------- c:\documents and settings\All Users\Application Data\Apple Computer
2008-12-18 11:55 . 2008-12-18 11:55 <DIR> d-------- c:\program files\Microsoft SQL Server
2008-12-18 11:48 . 2008-12-18 11:50 <DIR> d-------- c:\program files\Microsoft Visual Studio 9.0
2008-12-18 11:46 . 2008-12-18 11:46 <DIR> d-------- c:\program files\Microsoft Web Designer Tools
2008-12-18 11:45 . 2008-12-18 11:45 <DIR> d-------- c:\program files\Microsoft SDKs
2008-12-18 11:43 . 2008-12-18 11:43 <DIR> d-------- c:\windows\system32\XPSViewer
2008-12-18 11:42 . 2008-12-18 11:42 <DIR> d-------- c:\program files\Reference Assemblies
2008-12-18 11:42 . 2008-12-18 11:42 <DIR> d-------- c:\program files\MSBuild
2008-12-18 11:39 . 2008-12-18 11:42 <DIR> d-------- C:\b123f0c3f80bb108c23c
2008-12-18 11:39 . 2008-07-06 04:06 1,676,288 --------- c:\windows\system32\xpssvcs.dll
2008-12-18 11:39 . 2008-07-06 04:06 1,676,288 -----c--- c:\windows\system32\dllcache\xpssvcs.dll
2008-12-18 11:39 . 2008-07-06 02:50 597,504 -----c--- c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2008-12-18 11:39 . 2008-07-06 04:06 575,488 --------- c:\windows\system32\xpsshhdr.dll
2008-12-18 11:39 . 2008-07-06 04:06 575,488 -----c--- c:\windows\system32\dllcache\xpsshhdr.dll
2008-12-18 11:39 . 2008-07-06 04:06 117,760 --------- c:\windows\system32\prntvpt.dll
2008-12-18 11:39 . 2008-07-06 04:06 89,088 -----c--- c:\windows\system32\dllcache\filterpipelineprintproc.dll
2008-12-15 19:22 . 2008-12-15 20:00 <DIR> d-------- c:\documents and settings\Mark\Application Data\Elluminate
2008-12-15 17:09 . 2009-01-03 15:57 <DIR> d-------- c:\program files\Spybot - Search & Destroy
2008-12-15 17:09 . 2009-01-04 12:12 <DIR> d-------- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-01-14 02:52 --------- d-----w c:\documents and settings\Mark\Application Data\uTorrent
2009-01-13 05:59 --------- d-----w c:\documents and settings\Mark\Application Data\gtk-2.0
2009-01-12 04:32 --------- d-----w c:\documents and settings\Mark\Application Data\LimeWire
2009-01-05 04:07 --------- d-----w c:\program files\COMODO
2009-01-04 18:58 --------- d-----w c:\program files\Google
2009-01-04 00:36 --------- d-----w c:\program files\Java
2008-12-28 00:11 --------- d--h--w c:\program files\InstallShield Installation Information
2008-12-20 06:33 --------- d-----w c:\documents and settings\All Users\Application Data\Microsoft Help
2008-12-13 23:39 --------- d-----w c:\documents and settings\Mark\Application Data\Sony Corporation
2008-12-12 06:32 --------- d-----w c:\program files\Windows Live
2008-12-12 03:29 --------- d-----w c:\documents and settings\All Users\Application Data\comodo
2008-12-12 03:27 --------- d-----w c:\program files\Common Files\Symantec Shared
2008-12-12 03:27 --------- d-----w c:\documents and settings\All Users\Application Data\Symantec
2008-12-12 02:52 --------- d-----w c:\program files\Common Files\Cisco Systems
2008-12-12 02:51 --------- d-----w c:\program files\Sophos
2008-12-12 02:51 --------- d-----w c:\documents and settings\All Users\Application Data\Sophos
2008-12-12 02:33 14,976 ----a-w c:\windows\system32\drivers\SophosBootDriver.sys
2008-12-12 02:31 104,704 ----a-w c:\windows\system32\drivers\savonaccesscontrol.sys
2008-12-12 02:30 35,584 ----a-w c:\windows\system32\drivers\savonaccessfilter.sys
2008-12-12 02:26 130,104 ----a-w c:\windows\system32\sdccoinstaller.dll
2008-12-12 02:25 23,552 ----a-w c:\windows\system32\sophosboottasks.exe
2008-12-12 02:02 31,504 ----a-w c:\windows\system32\drivers\cmdhlp.sys
2008-12-12 02:02 147,192 ----a-w c:\windows\system32\guard32.dll
2008-12-12 02:02 101,776 ----a-w c:\windows\system32\drivers\cmdguard.sys
2008-12-11 01:29 --------- d-----w c:\program files\uTorrent
2008-12-11 01:03 --------- d-----w c:\program files\SystemRequirementsLab
2008-12-11 01:03 --------- d-----w c:\documents and settings\Mark\Application Data\SystemRequirementsLab
2008-12-10 00:07 --------- d-----w c:\program files\Common Files\Adobe
2008-12-10 00:04 --------- d-----w c:\documents and settings\All Users\Application Data\Protexis
2008-12-09 21:15 --------- d-----w c:\program files\MSECache
2008-12-04 03:37 --------- d-----w c:\program files\GIMP-2.0
2008-12-02 04:21 --------- d-----w c:\program files\Microsoft Visual Studio 8
2008-11-27 02:44 --------- d-----w c:\documents and settings\Mark\Application Data\Dev-Cpp
2008-11-26 16:14 --------- d-----w c:\documents and settings\Fenglei Sun\Application Data\Kingsoft
2008-11-23 22:51 --------- d-----w c:\program files\Opera
2008-11-17 01:41 --------- d-----w c:\program files\Microsoft Reader
2008-10-27 18:04 70,992 ----a-w c:\windows\system32\XAPOFX1_2.dll
2008-10-27 18:04 514,384 ----a-w c:\windows\system32\XAudio2_3.dll
2008-10-27 18:04 235,856 ----a-w c:\windows\system32\xactengine3_3.dll
2008-10-27 18:04 23,376 ----a-w c:\windows\system32\X3DAudio1_5.dll
2008-10-23 12:36 286,720 ----a-w c:\windows\system32\gdi32.dll
2008-10-16 22:13 202,776 ----a-w c:\windows\system32\wuweb.dll
2008-10-16 22:13 1,809,944 ----a-w c:\windows\system32\wuaueng.dll
2008-10-16 22:12 561,688 ----a-w c:\windows\system32\wuapi.dll
2008-10-16 22:12 323,608 ----a-w c:\windows\system32\wucltui.dll
2008-10-16 22:09 92,696 ----a-w c:\windows\system32\cdm.dll
2008-10-16 22:09 51,224 ----a-w c:\windows\system32\wuauclt.exe
2008-10-16 22:09 43,544 ----a-w c:\windows\system32\wups2.dll
2008-10-16 22:08 34,328 ----a-w c:\windows\system32\wups.dll
2008-10-16 22:06 268,648 ----a-w c:\windows\system32\mucltui.dll
2008-10-16 22:06 208,744 ----a-w c:\windows\system32\muweb.dll
2008-10-16 20:38 826,368 ----a-w c:\windows\system32\wininet.dll
2005-04-01 06:17 40,960 ----a-w c:\program files\Uninstall_CDS.exe
2007-07-27 00:01 114,688 ----a-w c:\program files\internet explorer\plugins\ChimeShim.dll
.

((((((((((((((((((((((((((((( snapshot@2009-01-13_18.34.45.75 )))))))))))))))))))))))))))))))))))))))))
.
- 2000-08-31 16:00:00 28,672 ----a-w c:\windows\NIRCMD.exe
+ 2000-08-31 16:00:00 29,696 ----a-w c:\windows\NIRCMD.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]
"CursorFX"="c:\program files\Stardock\CursorFX\CursorFX.exe" [2008-02-19 418632]
"TransBar"="c:\documents and settings\Mark\Local Settings\Application Data\AKSoftware\TransBar\TransBar.exe" [2005-06-01 65536]
"MsnMsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" [2008-12-10 216520]
"AlcoholAutomount"="c:\program files\Alcohol Soft\Alcohol 120\axcmd.exe" [2008-11-22 203720]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2004-10-08 155648]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2004-10-08 126976]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-09-09 344064]
"VAIO Update 2"="c:\program files\Sony\VAIO Update 2\VAIOUpdt.exe" [2004-09-21 151552]
"VAIO Recovery"="c:\windows\Sonysys\VAIO Recovery\PartSeal.exe" [2003-04-19 28672]
"RemoteControl"="c:\program files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe" [2003-12-08 32768]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"COMODO Internet Security"="c:\program files\COMODO\COMODO Internet Security\cfp.exe" [2008-12-11 1797880]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-05-27 413696]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-01-03 136600]
"AGRSMMSG"="AGRSMMSG.exe" [2004-06-29 c:\windows\AGRSMMSG.exe]
"High Definition Audio Property Page Shortcut"="HDAudPropShortcut.exe" [2004-03-17 c:\windows\system32\Hdaudpropshortcut.exe]
"SoundMan"="SOUNDMAN.EXE" [2004-10-21 c:\windows\SOUNDMAN.EXE]
"AlcWzrd"="ALCWZRD.EXE" [2004-10-21 c:\windows\ALCWZRD.EXE]

c:\documents and settings\Mark\Start Menu\Programs\Startup\
Stardock ObjectDock.lnk - c:\program files\Stardock\ObjectDock\ObjectDock.exe [2008-11-09 3450608]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
AutoUpdate Monitor.lnk - c:\program files\Sophos\AutoUpdate\ALMon.exe [2007-08-10 245760]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-12-22 11:05 356352 c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.dvsd"= c:\progra~1\COMMON~1\SONYSH~1\VideoLib\sonydv.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SAVService]
@="service"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" -autorun
"Google Update"="c:\documents and settings\Mark\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"powerword 2007"="c:\program files\Kingsoft\Powerword 2007\xdict.exe" -s -nosplash
"VAIOSurvey"=c:\program files\sony\vaio survey\surveysa.exe
"InCD"=c:\program files\Ahead\InCD\InCD.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SophosAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Kingsoft\\Powerword 2007\\xdict.exe"=
"c:\\Program Files\\Kingsoft\\Powerword 2007\\update.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"c:\\Program Files\\Air Attack\\rsync.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"9420:TCP"= 9420:TCP:Akamai NetSession Interface
"5000:UDP"= 5000:UDP:Akamai NetSession Interface

R1 cmdGuard;COMODO Internet Security Sandbox Driver;c:\windows\system32\drivers\cmdguard.sys [2008-12-11 101776]
R1 cmdHlp;COMODO Internet Security Helper Driver;c:\windows\system32\drivers\cmdhlp.sys [2008-12-11 31504]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [2008-12-22 8944]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [2008-12-22 55024]
R1 SAVOnAccessControl;SAVOnAccessControl;c:\windows\system32\drivers\savonaccesscontrol.sys [2008-12-11 104704]
R1 SAVOnAccessFilter;SAVOnAccessFilter;c:\windows\system32\drivers\savonaccessfilter.sys [2008-12-11 35584]
R4 BOCore;BOCore;c:\program files\COMODO\CBOClean\BOCore.exe [2009-01-04 73464]
R4 MLPTDR_Q;MLPTDR_Q;c:\windows\system32\MLPTDR_Q.SYS [2003-07-23 18848]
R4 SAVAdminService;Sophos Anti-Virus status reporter;c:\program files\Sophos\Sophos Anti-Virus\SAVAdminService.exe [2008-12-11 69632]
R4 SAVService;Sophos Anti-Virus;c:\program files\Sophos\Sophos Anti-Virus\SavService.exe [2008-12-11 98304]
S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [2008-12-22 7408]
S4 SophosBootDriver;SophosBootDriver;c:\windows\system32\drivers\SophosBootDriver.sys [2008-12-11 14976]

--- Other Services/Drivers In Memory ---

*Deregistered* - InCDrec
.
Contents of the 'Scheduled Tasks' folder

2009-01-14 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3136402486-3727597753-3231240026-1007.job
- c:\documents and settings\Mark\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2008-11-09 20:45]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.sony.com/vaiopeople
uInternet Connection Wizard,ShellNext = hxxp://shop.trendmicro.com/tmasy/eolsony.html?X=300&Y=300&WIDTH=690&HEIGHT=480
IE: &Google Search - c:\program files\Google\GoogleToolbar1.dll/cmsearch.html
IE: Backward Links - c:\program files\Google\GoogleToolbar1.dll/cmbacklinks.html
IE: Cached Snapshot of Page - c:\program files\Google\GoogleToolbar1.dll/cmcache.html
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Similar Pages - c:\program files\Google\GoogleToolbar1.dll/cmsimilar.html
IE: Translate into English - c:\program files\Google\GoogleToolbar1.dll/cmtrans.html
Trusted Zone: fighterace.ketsujin.com
Trusted Zone: primary.ketsujin.com
Trusted Zone: update.ketsujin.com
Trusted Zone: www.ketsujin.com
Trusted Zone: www.stormofaces.com
TCP: {F2B32CCC-7CF9-48F9-9B24-9D35421F66EA} = 192.168.1.254
FF - ProfilePath - c:\documents and settings\Mark\Application Data\Mozilla\Firefox\Profiles\4j8b7ayl.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/ig
FF - plugin: c:\documents and settings\Mark\Local Settings\Application Data\Google\Update\1.2.133.33\npGoogleOneClick7.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npchime.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-01-13 18:54:53
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(824)
c:\program files\SUPERAntiSpyware\SASWINLO.dll
c:\windows\system32\Ati2evxx.dll
.
Completion time: 2009-01-13 18:57:12
ComboFix-quarantined-files.txt 2009-01-14 02:57:08
ComboFix2.txt 2009-01-14 02:36:19

Pre-Run: 122,868,408,320 bytes free
Post-Run: 122,857,238,528 bytes free

306 --- E O F --- 2008-12-20 06:34:05

Attached Files






0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users