Jump to content


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.

Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.


Rootkit attack

  • This topic is locked This topic is locked
2 replies to this topic

#1 juandarias


  • Members
  • 1 posts
  • Local time:12:32 AM

Posted 30 January 2009 - 09:49 PM

Cant install any google application (Chrome, Gears, ....), the process googleupdate.exe hangs.

Cant install windows live messenger, internet explorer 7.

Cant access windowsupdate.microsoft.com, it redirects to google.com

Cant access <hxxp://g.msn.com/5meen_ms/19> and similar pages. All i get is as connection problem

Cant run msconfig.exe. It starts and appears on task manager but no visible window appears. On Safe Mode i can run it correctly.

My partitions filesystems appears as raw if i schedule a chkdsk /r at boot time.

Installed old messenger and cant connect.

It all happened after some installed bittorrent and started using it for downloading stuff.

DDS log:

DDS (Ver_09-01-19.01) - NTFSx86
Run by Administrador at 20:42:05,70 on 30/01/2009
Internet Explorer: 6.0.2900.5512 BrowserJavaVersion: 1.6.0_06
Microsoft Windows XP Professional 5.1.2600.3.1252.34.3082.18.1791.1174 [GMT -6:00]

AV: Avira AntiVir PersonalEdition *On-access scanning disabled* (Updated)

============== Running Processes ===============

C:\windows\system32\svchost -k DcomLaunch
C:\windows\system32\svchost -k rpcss
C:\windows\System32\svchost.exe -k netsvcs
C:\windows\system32\svchost.exe -k WudfServiceGroup
C:\windows\System32\svchost.exe -k HTTPFilter
G:\Archivos de programa\RocketDock\RocketDock.exe
C:\Archivos de programa\802.11 Wireless LAN\802.11g Wireless CardBus & PCI Adapter HW.15 V.1.00\WlanCU.exe
C:\Archivos de programa\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Administrador\Escritorio\dds.scr.com

============== Pseudo HJT Report ===============

uStart Page = hxxp://windowsgabo.es
mWindow Title = Diamond InTeRnEt XpLoReR
uInternet Connection Wizard,ShellNext = hxxp://windowsgabo.es/
mWinlogon: UIHost=vistaui.exe
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\archivos de programa\archivos comunes\adobe\acrobat\activex\AcroIEHelper.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\archivos de programa\archivos comunes\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: SSVHelper Class: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\archivos de programa\java\jre1.6.0_06\bin\ssv.dll
BHO: Adobe PDF Conversion Toolbar Helper: {ae7cd045-e861-484f-8273-0445ee161910} - c:\archivos de programa\archivos comunes\adobe\acrobat\activex\AcroIEFavClient.dll
BHO: FDMIECookiesBHO Class: {cc59e0f9-7e43-44fa-9faa-8377850bf205} - g:\archiv~1\freedo~1\iefdm2.dll
BHO: SmartSelect Class: {f4971ee7-daa0-4053-9964-665d8ee6a077} - c:\archivos de programa\archivos comunes\adobe\acrobat\activex\AcroIEFavClient.dll
TB: Adobe PDF: {47833539-d0c5-4125-9fa8-0819e2eaac93} - c:\archivos de programa\archivos comunes\adobe\acrobat\activex\AcroIEFavClient.dll
uRun: [ViStart] g:\archivos de programa\vistart\ViStart
uRun: [msnmsgr] "c:\archivos de programa\windows live\messenger\msnmsgr.exe" /background
uRun: [RocketDock] "g:\archivos de programa\rocketdock\RocketDock.exe"
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
mRun: [amd_dc_opt] g:\archivos de programa\amd\dual-core optimizer\amd_dc_opt.exe
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE
dRunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N
StartupFolder: c:\docume~1\administrador\menú inicio\programas\inicio\delayrun.lnk - g:\archivos de programa\delayrun\DelayRun.exe
StartupFolder: c:\docume~1\administrador\menú inicio\programas\inicio\vistart.lnk - c:\archivos de programa\vistart\ViStart.exe
StartupFolder: c:\docume~1\administrador\menú inicio\programas\inicio\winflip.lnk - c:\archivos de programa\winflip\WinFlip.exe
StartupFolder: c:\docume~1\alluse~1\menini~1\progra~1\inicio\wireless configuration utility hw.15.lnk - c:\archivos de programa\802.11 wireless lan\802.11g wireless cardbus & pci adapter hw.15 v.1.00\WlanCU.exe
uPolicies-explorer: NoResolveTrack = 1 (0x1)
mPolicies-explorer: ForceClassicControlPanel = 1 (0x1)
mPolicies-system: DisableCAD = 1 (0x1)
dPolicies-explorer: NoResolveTrack = 1 (0x1)
IE: Append Link Target to Existing PDF - c:\archivos de programa\archivos comunes\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Append to Existing PDF - c:\archivos de programa\archivos comunes\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert Link Target to Adobe PDF - c:\archivos de programa\archivos comunes\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert to Adobe PDF - c:\archivos de programa\archivos comunes\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIECapture.html
IE: Download all with Free Download Manager - file://g:\archivos de programa\free download manager\dlall.htm
IE: Download selected with Free Download Manager - file://g:\archivos de programa\free download manager\dlselected.htm
IE: Download video with Free Download Manager - file://g:\archivos de programa\free download manager\dlfvideo.htm
IE: Download with Free Download Manager - file://g:\archivos de programa\free download manager\dllink.htm
IE: E&xport to Microsoft Excel - g:\archiv~1\micros~1\office12\EXCEL.EXE/3000
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0016-0000-0006-ABCDEFFEDCBC} - c:\archivos de programa\java\jre1.6.0_06\bin\ssv.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - g:\archiv~1\micros~1\office12\REFIEBAR.DLL
Handler: belarc - {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - c:\archivos de programa\belarc\advisor\system\BAVoilaX.dll
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\archiv~1\archiv~1\skype\Skype4COM.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SSODL: IconPackager Repair - {1799460C-0BC8-4865-B9DF-4A36CD703FF0} - g:\archivos de programa\stardock\object desktop\iconpackager\iprepair.dll

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\administrador\datos de programa\mozilla\firefox\profiles\e129sgr8.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/ig
FF - component: g:\archivos de programa\free download manager\firefox\extension\components\vmsfdmff.dll
FF - plugin: c:\archivos de programa\mozilla firefox\plugins\npbittorrent.dll
FF - plugin: c:\archivos de programa\mozilla firefox\plugins\npdjvu.dll
FF - plugin: c:\archivos de programa\mozilla firefox\plugins\npqtplugin8.dll
FF - plugin: c:\archivos de programa\quicktime\plugins\npqtplugin8.dll
FF - plugin: c:\documents and settings\administrador\datos de programa\mozilla\firefox\profiles\e129sgr8.default\extensions\moveplayer@movenetworks.com\platform\winnt_x86-msvc\plugins\npmnqmp071101000055.dll
FF - plugin: g:\archivos de programa\cambridgesoft\chemoffice2008\chem3d\npChem3DPlugin.dll
FF - plugin: g:\archivos de programa\cambridgesoft\chemoffice2008\chemdraw\NPCDP32.DLL
FF - plugin: g:\archivos de programa\divx\divx content uploader\npUpload.dll
FF - plugin: g:\archivos de programa\divx\divx player\npDivxPlayerPlugin.dll
FF - plugin: g:\archivos de programa\divx\divx web player\npdivx32.dll

============= SERVICES / DRIVERS ===============

R1 avgio;avgio;g:\archivos de programa\avira\antivir personaledition classic\avgio.sys [2008-7-6 11840]
R3 3xHybrid;ASUSTek SAA713x PCI Card;c:\windows\system32\drivers\3xHybrid.sys [2008-8-9 2831232]
R3 AmdTools;AMD Special Tools Driver;c:\windows\system32\drivers\AmdTools.sys [2008-6-26 33792]
R4 PStrip;PStrip;c:\windows\system32\drivers\pstrip.sys [2007-7-14 27992]
S3 AntiVirScheduler;Avira AntiVir Personal – Free Antivirus Scheduler;g:\archivos de programa\avira\antivir personaledition classic\sched.exe [2008-7-6 68865]
S3 AntiVirService;Avira AntiVir Personal – Free Antivirus Guard;g:\archivos de programa\avira\antivir personaledition classic\avguard.exe [2008-7-6 149761]
S3 avgntflt;avgntflt;g:\archivos de programa\avira\antivir personaledition classic\avgntflt.sys [2008-7-6 52032]
S3 Cap713x;Cap713x Video Capture;c:\windows\system32\drivers\Cap713x.sys [2008-8-10 751104]
S3 ddsxeiservice;ddsxeiservice2;c:\archivos de programa\sxe injected\ddsxei.sys [2008-8-3 43264]
S4 MSSQL$CSSQL05;SQL Server (CSSQL05);c:\archivos de programa\microsoft sql server\mssql.1\mssql\binn\sqlservr.exe [2007-2-10 29178224]

=============== Created Last 30 ================

2009-01-30 09:36 <DIR> --ds---- c:\documents and settings\administrador\Favoritos
2009-01-30 09:36 <DIR> --d-hr-- c:\documents and settings\administrador\Datos de programa
2009-01-30 09:36 <DIR> --d-h--- c:\documents and settings\administrador\Plantillas
2009-01-30 09:36 <DIR> --d-h--- c:\documents and settings\administrador\Impresoras
2009-01-30 09:36 <DIR> --d-h--- c:\documents and settings\administrador\Entorno de red
2009-01-30 09:36 <DIR> --d-h--- c:\documents and settings\administrador\Configuración local
2009-01-30 09:36 <DIR> --d--r-- c:\documents and settings\administrador\Menú Inicio
2009-01-30 09:36 <DIR> --d----- c:\documents and settings\administrador\Escritorio
2009-01-30 09:36 <DIR> --d----- c:\documents and settings\Administrador
2009-01-30 09:13 <DIR> --d----- c:\documents and settings\administrador\dwhelper
2009-01-30 09:13 <DIR> --d----- c:\documents and settings\administrador\DSS DJ Data
2009-01-30 09:13 <DIR> --d----- c:\docume~1\administrador\datos de programa\Babylon
2009-01-30 09:13 <DIR> --d----- c:\docume~1\administrador\datos de programa\Free Download Manager
2009-01-30 09:13 <DIR> --d----- c:\docume~1\administrador\datos de programa\EndNote
2009-01-30 09:13 <DIR> --d----- c:\docume~1\administrador\datos de programa\DNA
2009-01-30 09:13 <DIR> --d----- c:\docume~1\administrador\datos de programa\CCDC
2009-01-30 09:13 <DIR> --d----- c:\docume~1\administrador\datos de programa\BSplayer PRO
2009-01-30 09:13 <DIR> --d----- c:\docume~1\administrador\datos de programa\BitTorrent
2009-01-30 09:13 <DIR> --d----- c:\docume~1\administrador\datos de programa\LabCognition Analytical Software GmbH & Co. KG
2009-01-30 09:13 <DIR> --d----- c:\docume~1\administrador\datos de programa\iTunes Agent
2009-01-30 09:13 <DIR> --d----- c:\docume~1\administrador\datos de programa\IconTweaker
2009-01-30 09:12 <DIR> --d----- c:\docume~1\administrador\datos de programa\RasWin
2009-01-30 09:12 <DIR> --d----- c:\docume~1\administrador\datos de programa\Styler
2009-01-30 09:12 <DIR> --d----- c:\docume~1\administrador\datos de programa\URSoft
2009-01-30 09:12 <DIR> --d----- c:\docume~1\administrador\datos de programa\TweakNow PowerPack
2009-01-30 09:12 <DIR> --d----- c:\docume~1\administrador\datos de programa\WaveMetrics
2009-01-30 09:12 <DIR> --d----- c:\documents and settings\administrador\Contacts
2009-01-30 08:49 <DIR> --d-h--- c:\windows\system32\GroupPolicy
2009-01-30 08:25 244 a---h--- C:\sqmnoopt15.sqm
2009-01-30 08:25 232 a---h--- C:\sqmdata15.sqm
2009-01-30 08:21 221,184 a------- c:\windows\system32\wmpns.dll
2009-01-28 09:07 <DIR> --d----- C:\Program Files
2009-01-18 21:25 4,096 a------- C:\pba2.exe
2009-01-18 21:22 180,224 a------- C:\quimica.dll
2009-01-18 21:22 36,864 a------- C:\chemistry.dll
2009-01-18 21:22 4,096 a------- C:\pba.exe
2009-01-10 16:33 122 a------- c:\windows\_vmtel.INI
2009-01-09 23:42 <DIR> --d----- c:\archivos de programa\CCDC
2009-01-09 22:17 <DIR> --d----- C:\wingx
2009-01-02 23:17 <DIR> --d----- c:\documents and settings\administrador\Tracing

==================== Find3M ====================

2008-12-31 05:50 1,518,298 a------- C:\testdisk-6.10.win.zip
2008-12-30 23:30 2,555,904 a--sh--- C:\gobackio.bin
2008-12-26 11:53 3,095 a------- c:\windows\ios.dat
2008-12-26 11:53 114,688 a------- c:\windows\system32\fkinjzg.dll
2008-12-13 19:09 327,008 a------- c:\windows\pchealth\helpctr\config\cache\Professional_32_3082.dat
2008-12-02 22:37 49,480 a------- c:\windows\system32\sirenacm.dll
2004-04-01 12:03 286,720 a------- c:\documents and settings\administrador\wcpuid.exe
2004-04-01 12:03 143,360 a------- c:\documents and settings\administrador\nrkctl32.dll
2004-04-01 12:03 45,056 a------- c:\documents and settings\administrador\wcpuclk.exe
2004-04-01 12:03 3,968 a------- c:\documents and settings\administrador\nrkctl32.sys

============= FINISH: 20:42:18,09 ===============

Attached Files

Edited by Orange Blossom, 11 February 2013 - 03:51 AM.
Deactivate link just to be on the safe side. ~ OB

BC AdBot (Login to Remove)


#2 KoanYorel


    Bleepin' Conundrum

  • Members
  • 19,461 posts
  • Gender:Male
  • Location:65 miles due East of the &quot;Logic Free Zone&quot;, in Md, USA
  • Local time:12:32 AM

Posted 11 February 2009 - 05:31 AM

Hello and welcome to Bleeping Computer

We apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help.

If you have since resolved the original problem you were having, we would appreciate you letting us know. If not please perform the following steps below so we can have a look at the current condition of your machine. If you have not done so, include a description of your problem, along with any steps you may have performed so far.

Upon completing the steps below another staff member will review and take the steps necessary with you to get your machine back in working order clean and free of malware.

If you have already posted a DDS log, please do so again, as your situation may have changed.
Use the 'Add Reply' and add the new log to this thread.

Thanks and again sorry for the delay.

We need to see some information about what is happening in your machine. Please perform the following scan:
  • Download DDS by sUBs from one of the following links. Save it to your desktop.
  • Double click on the DDS icon, allow it to run.
  • A small box will open, with an explaination about the tool. No input is needed, the scan is running.
  • Notepad will open with the results, click no to the Optional_Scan
  • Follow the instructions that pop up for posting the results.
  • Close the program window, and delete the program from your desktop.
Please note: You may have to disable any script protection running if the scan fails to run. After downloading the tool, disconnect from the internet and disable all antivirus protection. Run the scan, enable your A/V and reconnect to the internet.

Information on A/V control HERE

The only easy day was yesterday.

...some do, some don't; some will, some won't (WR)

#3 KoanYorel


    Bleepin' Conundrum

  • Members
  • 19,461 posts
  • Gender:Male
  • Location:65 miles due East of the &quot;Logic Free Zone&quot;, in Md, USA
  • Local time:12:32 AM

Posted 15 February 2009 - 03:35 AM

Due to the lack of feedback This Topic is closed.

Should you need it reopened, please contact a Forum Moderator. Include the address of this thread in your request.

If you have a new issue, please start a New Topic.

This applies only to the original poster. Everyone else please begin a New Topic.

The only easy day was yesterday.

...some do, some don't; some will, some won't (WR)

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users