Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Trojan Infection - "Spam Thru??"


  • This topic is locked This topic is locked
47 replies to this topic

#1 vang52

vang52

  • Members
  • 37 posts
  • OFFLINE
  •  
  • Local time:02:51 AM

Posted 01 April 2009 - 09:39 AM

Guys,
Been battling this one on my Dell lalaptop for a while now. A flash drive or other detachable media will get a m.bat and m.exe attached automatically that was caught by AVG as a vundo on one computer and on another, Norton said it was a Trojan.SpamThru. The worm's symtoms are that it hates anti spy websites including bleepingcomputer's hijack forum and thus I have been reluctant to bounce back and forth between the laptop and the desktop in fear of infection. Tried a few things on my own Malwarebytes, AA, etc. to no avail so I'm suspecting that we have a problem that is just beyond my limited knowledge. Thanks for the help!

VanG


DDS (Ver_09-03-16.01) - FAT32x86
Run by Administrator at 10:04:25.83 on Wed 04/01/2009
Internet Explorer: 6.0.2800.1106
Microsoft Windows 2000 Professional 5.0.2195.2.1252.1.1033.18.254.118 [GMT -5:00]


============== Running Processes ===============

C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\msdtc.exe
C:\WINNT\SYSTEM32\Brmfrmps.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\System32\tcpsvcs.exe
C:\WINNT\system32\stisvc.exe
C:\WINNT\System32\mqsvc.exe
C:\WINNT\Explorer.EXE
C:\WINNT\system32\PRPCUI.exe
C:\Program Files\DELL\AccessDirect\dadapp.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\DELL\AccessDirect\DadTray.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
C:\Program Files\Brother\ControlCenter2\brctrcen.exe
C:\Program Files\BellSouthWCC\McciTrayApp.exe
C:\WINNT\system32\ctfmon.exe
C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe
C:\Program Files\Brother\Brmfcmon\BrMfcmon.exe
E:\dds.scr
C:\WINNT\System32\WBEM\WinMgmt.exe

============== Pseudo HJT Report ===============

uStart Page = hxxp://news.yahoo.com/
uSearch Page = hxxp://www.google.com
uDefault_Page_URL = hxxp://smbusiness.dellnet.com/
uSearch Bar = hxxp://www.google.com/ie
mSearch Bar =
uInternet Settings,ProxyOverride = 127.0.0.1
uSearchURL,(Default) = hxxp://www.google.com/keyword/%s
BHO: AcroIEHlprObj Class: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 5.0\reader\activex\AcroIEHelper.ocx
BHO: BellSouth Toolbar: {4e7bd74f-2b8d-469e-8cbd-fd60bb9aae2e} - c:\progra~1\blstoo~1\BLSTOO~1.DLL
TB: BellSouth Toolbar: {4e7bd74f-2b8d-469e-8cbd-fd60bb9aae2e} - c:\progra~1\blstoo~1\BLSTOO~1.DLL
TB: {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No File
TB: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
TB: {5854FAC4-5BF0-47DD-B5A9-A5EA8CFF3CF4} - No File
EB: Media Band: {32683183-48a0-441b-a342-7c2a440a9478} - %SystemRoot%\system32\browseui.dll
uRun: [ctfmon.exe] ctfmon.exe
uRun: [H/PC Connection Agent] "c:\program files\microsoft activesync\WCESCOMM.EXE"
uRun: [SUPERAntiSpyware] c:\program files\superantispyware\SUPERAntiSpyware.exe
mRun: [Synchronization Manager] mobsync.exe /logon
mRun: [IgfxTray]
mRun: [HotKeysCmds]
mRun: [PRPCMonitor] PRPCUI.exe
mRun: [DadApp] c:\program files\dell\accessdirect\dadapp.exe
mRun: [SynTPLpr] c:\program files\synaptics\syntp\SynTPLpr.exe
mRun: [SynTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe
mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
mRun: [ZingSpooler] c:\progra~1\mgi\photos~1.1\ZingSpooler.exe
mRun: [SSBkgdUpdate] "c:\program files\common files\scansoft shared\ssbkgdupdate\SSBkgdupdate.exe" -Embedding -boot
mRun: [PaperPort PTD] c:\program files\scansoft\paperport\pptd40nt.exe
mRun: [IndexSearch] c:\program files\scansoft\paperport\IndexSearch.exe
mRun: [SetDefPrt] c:\program files\brother\brmfl04a\BrStDvPt.exe
mRun: [ControlCenter2.0] c:\program files\brother\controlcenter2\brctrcen.exe /autorun
mRun: [BellSouthWCC_McciTrayApp] c:\program files\bellsouthwcc\McciTrayApp.exe
mRun: [HelpCenter4.1] c:\program files\fastaccessdsl\helpcenter43\bin\sprtcmd.exe /P HelpCenter4.1
dRunOnce: [^SetupICWDesktop] c:\program files\internet explorer\connection wizard\icwconn1.exe /desktop
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\micros~1.lnk - c:\program files\microsoft office\office\OSA9.EXE
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\adobeg~1.lnk - c:\program files\common files\adobe\calibration\Adobe Gamma Loader.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\status~1.lnk - c:\program files\brother\brmfcmon\BrMfcWnd.exe
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office10\EXCEL.EXE/3000
IE: {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - c:\program files\microsoft activesync\inetrepl.dll
IE: {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - c:\program files\microsoft activesync\inetrepl.dll
DPF: DirectAnimation Java Classes - file://c:\winnt\java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\winnt\java\classes\xmldso.cab
DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} - hxxp://www.apple.com/qtactivex/qtplugin.cab
DPF: {31564D57-0000-0010-8000-00AA00389B71} - hxxp://codecs.microsoft.com/codecs/i386/wmvax.cab
DPF: {41F17733-B041-4099-A042-B518BB6A408C} - hxxp://a1540.g.akamai.net/7/1540/52/20021205/qtinstall.info.apple.com/borris/us/win/QuickTimeInstaller.exe
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
Handler: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - c:\program files\common files\microsoft shared\web folders\PKMCDO.DLL
Handler: mctp - {d7b95390-b1c5-11d0-b111-0080c712fe82} - c:\program files\microsoft activesync\aatp.dll
WinCE Filter: image/bmp - {86F59FAE-FB3A-11D1-AA72-00C04FAE2D4B} - c:\program files\microsoft activesync\cenetflt.dll
WinCE Filter: image/gif - {86F59FAE-FB3A-11D1-AA72-00C04FAE2D4B} - c:\program files\microsoft activesync\cenetflt.dll
WinCE Filter: image/jpeg - {86F59FAE-FB3A-11D1-AA72-00C04FAE2D4B} - c:\program files\microsoft activesync\cenetflt.dll
WinCE Filter: image/xbm - {86F59FAE-FB3A-11D1-AA72-00C04FAE2D4B} - c:\program files\microsoft activesync\cenetflt.dll
WinCE Filter: text/asp - {6C5C3074-FFAB-11d1-8EC4-00C04F98D57A} - c:\program files\microsoft activesync\cenetflt.dll
WinCE Filter: text/html - {6C5C3074-FFAB-11d1-8EC4-00C04F98D57A} - c:\program files\microsoft activesync\cenetflt.dll
Notify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.dll
Notify: bcafaecfdaedaab - c:\winnt\system32\bcafaecfdaedaab.dll
Notify: STEVE - c:\winnt\system32\STEVE.dll
AppInit_DLLs: iuedtq.dll ,
SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLL

============= SERVICES / DRIVERS ===============

R0 aaatimeo;aaatimeo;c:\winnt\system32\drivers\AAATIMEO.SYS [1980-1-1 4928]
R1 cmosa;cmosa;c:\winnt\system32\drivers\cmosa.sys [2001-8-15 29344]
R1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\sasdifsv.sys [2008-9-3 8944]
R1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2008-9-3 55024]
R2 BrSerial;Brother Serial Driver;c:\winnt\system32\drivers\brserial.sys [2006-11-4 56660]
R2 Iprip;RIP Listener;c:\winnt\system32\svchost.exe -k netsvcs [1980-1-1 7952]
R2 PRPC;PRPC;c:\winnt\system32\drivers\prpc.sys [2001-8-15 12838]
R3 ltmdmnt;LT Win Modem Driver;c:\winnt\system32\drivers\ltmdmnt.sys [1980-1-1 514744]
R3 SASENUM;SASENUM;c:\program files\superantispyware\SASENUM.SYS [2008-9-3 7408]
S0 cda1000;cda1000;c:\winnt\system32\drivers\CDA1000.SYS [1980-1-1 281024]
S3 el575nd5;3Com Megahertz 10/100 LAN CardBus PC Card Driver;c:\winnt\system32\drivers\el575ND5.sys [2001-8-15 77072]
S3 EL90BC;3Com EtherLink XL B/C Adapter Driver;c:\winnt\system32\drivers\EL90XBC5.SYS [1980-1-1 61712]

=============== Created Last 30 ================

2009-04-01 10:04 16,384 a------- c:\winnt\system32\Perflib_Perfdata_5dc.dat
2009-04-01 00:46 554,340 ----h--- c:\winnt\ShellIconCache
2009-03-31 23:48 <DIR> --d----- C:\Anti-Virus Help
2009-03-25 10:07 1 a------- c:\winnt\system32\uniq.tll
2009-03-25 08:54 11,168 a---h--- c:\winnt\system32\tumobepo

==================== Find3M ====================

2009-02-11 10:19 38,496 a------- c:\winnt\system32\drivers\mbamswissarmy.sys
2009-02-11 10:19 15,504 a------- c:\winnt\system32\drivers\mbam.sys
2008-08-24 20:50 26,941,368 a------- c:\documents and settings\administrator\setupeng.exe
2006-11-22 19:42 2,197 a------- c:\program files\INSTALL.LOG
2006-11-22 18:59 242,432 -------- c:\winnt\inf\rt2500usb.sys
2006-11-22 18:59 65,536 -------- c:\winnt\inf\copyinf.exe
2005-02-09 19:48 95,280 a------- c:\docume~1\admini~1\applic~1\GDIPFONTCACHEV1.DAT
2004-07-30 09:56 90,112 a------- c:\program files\common files\PCSBclean.exe
2004-07-26 15:30 291,840 a------- c:\program files\common files\PCSBoff.exe
2003-03-24 21:17 6,147 a------- c:\program files\PCLICSB.DAT
2003-03-24 21:17 258 ----hr-- c:\program files\common files\LMF.DAT
2002-02-01 20:56 1,803,848 a------- c:\program files\winzip81.exe
2001-04-10 07:58 21,952 a---h--- c:\program files\FOLDER.HTT
2001-04-10 07:58 271 a---h--- c:\program files\DESKTOP.INI
2000-10-31 21:27 81,920 a------- c:\winnt\inf\i386\Pmxusd.dll
2000-09-23 00:04 800 a------- c:\program files\readme.txt
2000-09-19 13:30 3,064,502 a------- c:\program files\ptedit17.exe
2000-07-26 07:00 32,528 a------- c:\winnt\inf\WBFIRDMA.SYS
1999-04-08 07:28 19,112 a------- c:\winnt\inf\i386\Pmxscan.sys

============= FINISH: 10:04:49.46 ===============

Attached Files


Thanks for your time and trouble!

Steve

BC AdBot (Login to Remove)

 


#2 KoanYorel

KoanYorel

    Bleepin' Conundrum


  • Members
  • 19,461 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:65 miles due East of the &quot;Logic Free Zone&quot;, in Md, USA
  • Local time:02:51 AM

Posted 08 April 2009 - 06:01 PM

Hello and welcome to Bleeping Computer

We apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help.

If you have since resolved the original problem you were having, we would appreciate you letting us know. If not please perform the following steps below so we can have a look at the current condition of your machine.

If you have not done so, include a clear description of the problems you're having, along with any steps you may have performed so far.

Upon completing the steps below another staff member will review and take the steps necessary with you to get your machine back in working order clean and free of malware.

If you have already posted a DDS log, please do so again, as your situation may have changed.
Use the 'Add Reply' and add the new log to this thread.


Thanks and again sorry for the delay.

We need to see some information about what is happening in your machine. Please perform the following scan:
  • Download DDS by sUBs from one of the following links. Save it to your desktop.
  • Double click on the DDS icon, allow it to run.
  • A small box will open, with an explaination about the tool. No input is needed, the scan is running.
  • Notepad will open with the results.
  • Follow the instructions that pop up for posting the results.
  • Close the program window, and delete the program from your desktop.
Please note: You may have to disable any script protection running if the scan fails to run. After downloading the tool, disconnect from the internet and disable all antivirus protection. Run the scan, enable your A/V and reconnect to the internet.

Information on A/V control HERE

R,
K
The only easy day was yesterday.

...some do, some don't; some will, some won't (WR)

#3 vang52

vang52
  • Topic Starter

  • Members
  • 37 posts
  • OFFLINE
  •  
  • Local time:02:51 AM

Posted 14 April 2009 - 11:01 AM

Thanks Guys,
Laptop is infected and I have tried a variety of fixes to no avail. It seems I am now able to stay on BC without getting bumped like I was before, but whenever a flash drive is used, a worm slithers on. Last NAV catch was spam-thru worm.


DDS (Ver_09-03-16.01) - FAT32x86
Run by Administrator at 11:54:58.43 on Tue 04/14/2009
Internet Explorer: 6.0.2800.1106
Microsoft Windows 2000 Professional 5.0.2195.2.1252.1.1033.18.254.60 [GMT -5:00]


============== Running Processes ===============

C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\msdtc.exe
C:\WINNT\SYSTEM32\Brmfrmps.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\System32\tcpsvcs.exe
C:\WINNT\system32\stisvc.exe
C:\WINNT\System32\mqsvc.exe
C:\WINNT\Explorer.EXE
C:\WINNT\system32\PRPCUI.exe
C:\Program Files\DELL\AccessDirect\dadapp.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\DELL\AccessDirect\DadTray.exe
C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
C:\Program Files\Brother\ControlCenter2\brctrcen.exe
C:\Program Files\BellSouthWCC\McciTrayApp.exe
C:\WINNT\system32\ctfmon.exe
C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe
C:\Program Files\Brother\Brmfcmon\BrMfcmon.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\Administrator\Desktop\dds.scr
C:\WINNT\System32\WBEM\WinMgmt.exe

============== Pseudo HJT Report ===============

uStart Page = hxxp://news.yahoo.com/
uSearch Page = hxxp://www.google.com
uDefault_Page_URL = hxxp://smbusiness.dellnet.com/
uSearch Bar = hxxp://www.google.com/ie
mSearch Bar =
uInternet Settings,ProxyOverride = 127.0.0.1
uSearchURL,(Default) = hxxp://www.google.com/keyword/%s
BHO: AcroIEHlprObj Class: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 5.0\reader\activex\AcroIEHelper.ocx
BHO: BellSouth Toolbar: {4e7bd74f-2b8d-469e-8cbd-fd60bb9aae2e} - c:\progra~1\blstoo~1\BLSTOO~1.DLL
TB: BellSouth Toolbar: {4e7bd74f-2b8d-469e-8cbd-fd60bb9aae2e} - c:\progra~1\blstoo~1\BLSTOO~1.DLL
TB: {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No File
TB: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
TB: {5854FAC4-5BF0-47DD-B5A9-A5EA8CFF3CF4} - No File
EB: Media Band: {32683183-48a0-441b-a342-7c2a440a9478} - %SystemRoot%\system32\browseui.dll
uRun: [ctfmon.exe] ctfmon.exe
uRun: [H/PC Connection Agent] "c:\program files\microsoft activesync\WCESCOMM.EXE"
uRun: [SUPERAntiSpyware] c:\program files\superantispyware\SUPERAntiSpyware.exe
mRun: [Synchronization Manager] mobsync.exe /logon
mRun: [IgfxTray]
mRun: [HotKeysCmds]
mRun: [PRPCMonitor] PRPCUI.exe
mRun: [DadApp] c:\program files\dell\accessdirect\dadapp.exe
mRun: [SynTPLpr] c:\program files\synaptics\syntp\SynTPLpr.exe
mRun: [SynTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe
mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
mRun: [ZingSpooler] c:\progra~1\mgi\photos~1.1\ZingSpooler.exe
mRun: [SSBkgdUpdate] "c:\program files\common files\scansoft shared\ssbkgdupdate\SSBkgdupdate.exe" -Embedding -boot
mRun: [PaperPort PTD] c:\program files\scansoft\paperport\pptd40nt.exe
mRun: [IndexSearch] c:\program files\scansoft\paperport\IndexSearch.exe
mRun: [SetDefPrt] c:\program files\brother\brmfl04a\BrStDvPt.exe
mRun: [ControlCenter2.0] c:\program files\brother\controlcenter2\brctrcen.exe /autorun
mRun: [BellSouthWCC_McciTrayApp] c:\program files\bellsouthwcc\McciTrayApp.exe
mRun: [HelpCenter4.1] c:\program files\fastaccessdsl\helpcenter43\bin\sprtcmd.exe /P HelpCenter4.1
dRunOnce: [^SetupICWDesktop] c:\program files\internet explorer\connection wizard\icwconn1.exe /desktop
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\micros~1.lnk - c:\program files\microsoft office\office\OSA9.EXE
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\adobeg~1.lnk - c:\program files\common files\adobe\calibration\Adobe Gamma Loader.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\status~1.lnk - c:\program files\brother\brmfcmon\BrMfcWnd.exe
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office10\EXCEL.EXE/3000
IE: {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - c:\program files\microsoft activesync\inetrepl.dll
IE: {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - c:\program files\microsoft activesync\inetrepl.dll
DPF: DirectAnimation Java Classes - file://c:\winnt\java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\winnt\java\classes\xmldso.cab
DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} - hxxp://www.apple.com/qtactivex/qtplugin.cab
DPF: {31564D57-0000-0010-8000-00AA00389B71} - hxxp://codecs.microsoft.com/codecs/i386/wmvax.cab
DPF: {41F17733-B041-4099-A042-B518BB6A408C} - hxxp://a1540.g.akamai.net/7/1540/52/20021205/qtinstall.info.apple.com/borris/us/win/QuickTimeInstaller.exe
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
Handler: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - c:\program files\common files\microsoft shared\web folders\PKMCDO.DLL
Handler: mctp - {d7b95390-b1c5-11d0-b111-0080c712fe82} - c:\program files\microsoft activesync\aatp.dll
WinCE Filter: image/bmp - {86F59FAE-FB3A-11D1-AA72-00C04FAE2D4B} - c:\program files\microsoft activesync\cenetflt.dll
WinCE Filter: image/gif - {86F59FAE-FB3A-11D1-AA72-00C04FAE2D4B} - c:\program files\microsoft activesync\cenetflt.dll
WinCE Filter: image/jpeg - {86F59FAE-FB3A-11D1-AA72-00C04FAE2D4B} - c:\program files\microsoft activesync\cenetflt.dll
WinCE Filter: image/xbm - {86F59FAE-FB3A-11D1-AA72-00C04FAE2D4B} - c:\program files\microsoft activesync\cenetflt.dll
WinCE Filter: text/asp - {6C5C3074-FFAB-11d1-8EC4-00C04F98D57A} - c:\program files\microsoft activesync\cenetflt.dll
WinCE Filter: text/html - {6C5C3074-FFAB-11d1-8EC4-00C04F98D57A} - c:\program files\microsoft activesync\cenetflt.dll
Notify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.dll
Notify: bcafaecfdaedaab - c:\winnt\system32\bcafaecfdaedaab.dll
Notify: STEVE - c:\winnt\system32\STEVE.dll
AppInit_DLLs: iuedtq.dll ,
SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLL

============= SERVICES / DRIVERS ===============

R0 aaatimeo;aaatimeo;c:\winnt\system32\drivers\AAATIMEO.SYS [1980-1-1 4928]
R1 cmosa;cmosa;c:\winnt\system32\drivers\cmosa.sys [2001-8-15 29344]
R1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\sasdifsv.sys [2008-9-3 8944]
R1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2008-9-3 55024]
R2 BrSerial;Brother Serial Driver;c:\winnt\system32\drivers\brserial.sys [2006-11-4 56660]
R2 Iprip;RIP Listener;c:\winnt\system32\svchost.exe -k netsvcs [1980-1-1 7952]
R2 PRPC;PRPC;c:\winnt\system32\drivers\prpc.sys [2001-8-15 12838]
R3 ltmdmnt;LT Win Modem Driver;c:\winnt\system32\drivers\ltmdmnt.sys [1980-1-1 514744]
R3 SASENUM;SASENUM;c:\program files\superantispyware\SASENUM.SYS [2008-9-3 7408]
S0 cda1000;cda1000;c:\winnt\system32\drivers\CDA1000.SYS [1980-1-1 281024]
S3 el575nd5;3Com Megahertz 10/100 LAN CardBus PC Card Driver;c:\winnt\system32\drivers\el575ND5.sys [2001-8-15 77072]
S3 EL90BC;3Com EtherLink XL B/C Adapter Driver;c:\winnt\system32\drivers\EL90XBC5.SYS [1980-1-1 61712]

=============== Created Last 30 ================

2009-04-14 11:55 16,384 a------- c:\winnt\system32\Perflib_Perfdata_550.dat
2009-04-08 17:41 742,312 ----h--- c:\winnt\ShellIconCache
2009-03-31 23:48 <DIR> --d----- C:\Anti-Virus Help
2009-03-25 10:07 1 a------- c:\winnt\system32\uniq.tll
2009-03-25 08:54 11,168 a---h--- c:\winnt\system32\tumobepo

==================== Find3M ====================

2009-03-26 16:49 38,496 a------- c:\winnt\system32\drivers\mbamswissarmy.sys
2009-03-26 16:49 15,504 a------- c:\winnt\system32\drivers\mbam.sys
2008-08-24 20:50 26,941,368 a------- c:\documents and settings\administrator\setupeng.exe
2006-11-22 19:42 2,197 a------- c:\program files\INSTALL.LOG
2006-11-22 18:59 242,432 -------- c:\winnt\inf\rt2500usb.sys
2006-11-22 18:59 65,536 -------- c:\winnt\inf\copyinf.exe
2005-02-09 19:48 95,280 a------- c:\docume~1\admini~1\applic~1\GDIPFONTCACHEV1.DAT
2004-07-30 09:56 90,112 a------- c:\program files\common files\PCSBclean.exe
2004-07-26 15:30 291,840 a------- c:\program files\common files\PCSBoff.exe
2003-03-24 21:17 6,147 a------- c:\program files\PCLICSB.DAT
2003-03-24 21:17 258 ----hr-- c:\program files\common files\LMF.DAT
2002-02-01 20:56 1,803,848 a------- c:\program files\winzip81.exe
2001-04-10 07:58 21,952 a---h--- c:\program files\FOLDER.HTT
2001-04-10 07:58 271 a---h--- c:\program files\DESKTOP.INI
2000-10-31 21:27 81,920 a------- c:\winnt\inf\i386\Pmxusd.dll
2000-09-23 00:04 800 a------- c:\program files\readme.txt
2000-09-19 13:30 3,064,502 a------- c:\program files\ptedit17.exe
2000-07-26 07:00 32,528 a------- c:\winnt\inf\WBFIRDMA.SYS
1999-04-08 07:28 19,112 a------- c:\winnt\inf\i386\Pmxscan.sys

============= FINISH: 11:55:45.77 ===============
Thanks for your time and trouble!

Steve

#4 PropagandaPanda

PropagandaPanda


  • Malware Response Team
  • 10,433 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:02:51 AM

Posted 14 April 2009 - 03:12 PM

Hello.

Please plug in your infected flash drives before we begin.

Disable Realtime Protection
Antimalware programs can interfere with ComboFix and other tools we need to run. Please temporarily disable all realtime protections you have enabled. Refer to this page, if you are unsure how.

Download and Run ComboFix
Download Combofix by sUBs from any of the links below, and save it to your desktop.
Link 1, Link 2, Link 3
  • Close/disable all anti-virus and anti-malware programs so they do not interfere with the running of ComboFix. Refer to this page if you are not sure how.
  • Double click on ComboFix.exe and follow the prompts. If you are using Windows Vista, right click the icon and select "Run as Administrator". You will not recieve the prompts below if you are not using Windows XP. ComboFix will check to see if you have the Windows Recovery Console installed.
  • If you did not have it installed, you will see the prompt below. Choose YES.
    Posted ImagePosted Image

  • When the Recovery Console has been installed, you will see the prompt below. Choose YES.
    Posted Image
  • When finished, ComboFix will produce a report for you. Please post the contents of the log (C:\ComboFix.txt).
Leave your computer alone while ComboFix is running. ComboFix will restart your computer if malware is found; allow it to do so.

Download and Run Scan with GMER
We will use GMER to scan for rootkits.

Please download GMER.zip to your desktop from any of the links below:
LINK1, LINK2
  • Right click on GMER.zip and select "Extract All".
  • Close all other open programs as there is a slight chance your computer will crash.
  • Double click GMER.exe. Your security programs may detect GMER's driver trying to load. Allow it.
  • You may see a warning saying "GMER has detected rootkit activity". If so, select NO.
  • Leaving the settings at default, click Scan.
  • When the scan is complete, click Save and save the log onto your desktop.
Please include the log in your next reply.
In your next reply include:
-the ComboFix log
-the GMER scan log
With Regards,
The Panda

#5 vang52

vang52
  • Topic Starter

  • Members
  • 37 posts
  • OFFLINE
  •  
  • Local time:02:51 AM

Posted 14 April 2009 - 07:01 PM

Panda,
Got some error messages using GMER. Both logs follow:



ComboFix 09-04-15.03 - Administrator 04/14/2009 19:34.1 - FAT32x86
Microsoft Windows 2000 Professional 5.0.2195.2.1252.1.1033.18.254.126 [GMT -5:00]
Running from: c:\documents and settings\Administrator\Desktop\ComboFix.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\log.udt
c:\program files\INSTALL.LOG
c:\winnt\a3kebook.ini


c:\winnt\akebook.ini
c:\winnt\ANS2000.INI
c:\winnt\system32\uniq.tll
c:\winnt\Web\default.htt
c:\winnt\system32\bcafaecfdaedaab.dll . . . . failed to delete

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_IPRIP
-------\Service_Iprip


((((((((((((((((((((((((( Files Created from 2009-03-15 to 2009-04-15 )))))))))))))))))))))))))))))))
.

2009-04-08 22:41 . 2009-04-13 02:26 742312 ---h--w c:\winnt\ShellIconCache
2009-04-01 04:48 . 2009-04-01 04:48 -------- d-----w C:\Anti-Virus Help
2009-03-25 13:54 . 2009-03-25 19:55 11168 ---ha-w c:\winnt\system32\tumobepo

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-03-26 21:49 . 2008-09-22 23:48 38496 ----a-w c:\winnt\system32\drivers\mbamswissarmy.sys
2009-03-26 21:49 . 2008-09-22 23:48 15504 ----a-w c:\winnt\system32\drivers\mbam.sys
2008-08-25 01:50 . 2008-08-27 00:18 26941368 ----a-w c:\documents and settings\Administrator\setupeng.exe
2006-12-01 00:59 . 2006-12-01 00:59 94896 ----a-w c:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2005-02-10 00:48 . 2002-01-11 20:35 95280 ----a-w c:\documents and settings\Administrator\Application Data\GDIPFONTCACHEV1.DAT
2004-07-30 14:56 . 2004-08-02 23:53 90112 ----a-w c:\program files\Common Files\PCSBclean.exe
2004-07-26 20:30 . 2003-06-22 21:45 291840 ----a-w c:\program files\Common Files\PCSBoff.exe
2003-03-25 02:17 . 2003-03-25 02:17 6147 ----a-w c:\program files\PCLICSB.DAT
2003-03-25 02:17 . 2003-03-25 02:17 258 ---h--r c:\program files\Common Files\LMF.DAT
2002-02-02 01:56 . 2002-02-02 01:56 1803848 ----a-w c:\program files\winzip81.exe
2001-04-10 12:58 . 1980-01-01 05:00 271 ---ha-w c:\program files\DESKTOP.INI
2001-04-10 12:58 . 1980-01-01 05:00 21952 ---ha-w c:\program files\FOLDER.HTT
2000-09-23 05:04 . 2000-09-23 05:04 800 ----a-w c:\program files\readme.txt
2000-09-19 18:30 . 2000-09-19 18:30 3064502 ----a-w c:\program files\ptedit17.exe
.

------- Sigcheck -------

[-] 2001-02-20 18:09 8192 D36A33C21EEED5A6C1DAECB7C80A1909 c:\winnt\SYSTEM32\CTFMON.EXE
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"H/PC Connection Agent"="c:\program files\Microsoft ActiveSync\WCESCOMM.EXE" [2005-01-04 405583]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2008-09-03 1576176]
"ctfmon.exe"="ctfmon.exe" - c:\winnt\SYSTEM32\CTFMON.EXE [2001-02-20 8192]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DadApp"="c:\program files\DELL\AccessDirect\dadapp.exe" [2001-03-29 188840]
"SynTPLpr"="c:\program files\Synaptics\SynTP\SynTPLpr.exe" [2001-04-13 94208]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2001-04-13 262144]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2006-09-01 282624]
"SSBkgdUpdate"="c:\program files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2003-10-14 155648]
"PaperPort PTD"="c:\program files\ScanSoft\PaperPort\pptd40nt.exe" [2004-04-14 57393]
"IndexSearch"="c:\program files\ScanSoft\PaperPort\IndexSearch.exe" [2004-04-14 40960]
"SetDefPrt"="c:\program files\Brother\Brmfl04a\BrStDvPt.exe" [2004-05-25 49152]
"ControlCenter2.0"="c:\program files\Brother\ControlCenter2\brctrcen.exe" [2004-07-20 851968]
"BellSouthWCC_McciTrayApp"="c:\program files\BellSouthWCC\McciTrayApp.exe" [2005-11-17 543232]
"HelpCenter4.1"="c:\program files\FastAccessDSL\HelpCenter43\bin\sprtcmd.exe" [2007-04-13 198184]
"Synchronization Manager"="mobsync.exe" - c:\winnt\SYSTEM32\MOBSYNC.EXE [2000-07-26 111376]
"PRPCMonitor"="PRPCUI.exe" - c:\winnt\SYSTEM32\prpcui.exe [2000-10-10 36352]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"^SetupICWDesktop"="c:\program files\Internet Explorer\Connection Wizard\icwconn1.exe" [2000-07-26 186640]

c:\documents and settings\Default User\Start Menu\Programs\Startup\
discfix.lnk - c:\dell\discfix.cmd [1980-1-1 75]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [2000-1-21 65588]
Adobe Gamma Loader.exe.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2004-6-21 113664]
Status Monitor.lnk - c:\program files\Brother\Brmfcmon\BrMfcWnd.exe [2006-11-4 819200]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-07-23 21:28 352256 ----a-w c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\bcafaecfdaedaab]
2007-03-14 09:24 302096 ------w c:\winnt\system32\bcafaecfdaedaab.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\STEVE]
2008-08-24 15:19 98833 ------w c:\winnt\system32\STEVE.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"= iuedtq.dll ,

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"= mmdrv.dll
"MSACM.CEGSM"= mobilev.acm
"vidc.dvsd"= dvc.dll
"VIDC.D263"= xl_x263dec.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"FirewallOverride"=dword:00000001

R0 cda1000;cda1000;c:\winnt\System32\DRIVERS\cda1000.sys [2000-12-14 281024]
R3 el575nd5;3Com Megahertz 10/100 LAN CardBus PC Card Driver;c:\winnt\system32\DRIVERS\el575nd5.sys [1999-10-19 77072]
R3 EL90BC;3Com EtherLink XL B/C Adapter Driver;c:\winnt\system32\DRIVERS\el90xbc5.sys [1999-10-23 61712]
S0 aaatimeo;aaatimeo;c:\winnt\System32\DRIVERS\aaatimeo.sys [2000-11-21 4928]
S1 cmosa;cmosa;c:\winnt\system32\DRIVERS\cmosa.sys [2000-11-30 29344]
S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV.SYS [2008-09-03 8944]
S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.sys [2008-09-03 55024]
S2 BrSerial;Brother Serial Driver;c:\winnt\system32\drivers\BrSerial.sys [2002-03-15 56660]
S2 PRPC;PRPC; [x]
S3 ltmdmnt;LT Win Modem Driver;c:\winnt\system32\DRIVERS\ltmdmnt.sys [2000-06-26 514744]
S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [2008-09-03 7408]


--- Other Services/Drivers In Memory ---

*NewlyCreated* - IPNAT
*NewlyCreated* - RASAUTO
*NewlyCreated* - SHAREDACCESS
.
Contents of the 'Scheduled Tasks' folder

2009-04-14 c:\winnt\Tasks\Symantec NetDetect.job
- c:\program files\Symantec\LiveUpdate\NDETECT.EXE [2001-10-13 17:24]
.
- - - - ORPHANS REMOVED - - - -

HKLM-Run-ZingSpooler - c:\progra~1\MGI\PHOTOS~1.1\ZingSpooler.exe
HKLM-Run-IgfxTray - (no file)
HKLM-Run-HotKeysCmds - (no file)


.
------- Supplementary Scan -------
.
uStart Page = hxxp://news.yahoo.com/
mSearch Bar =
uInternet Settings,ProxyOverride = 127.0.0.1
uSearchURL,(Default) = hxxp://www.google.com/keyword/%s
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
LSP: %SystemRoot%\system32\msafd.dll
DPF: DirectAnimation Java Classes - file://c:\winnt\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\winnt\Java\classes\xmldso.cab
.

**************************************************************************

catchme 0.3.1375 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-04-14 19:42
Windows 5.0.2195 Service Pack 2 FAT NTAPI

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(180)
c:\program files\SUPERAntiSpyware\SASWINLO.dll
c:\winnt\system32\bcafaecfdaedaab.dll
c:\winnt\system32\STEVE.dll
c:\winnt\system32\msv1_0.dll

- - - - - - - > 'explorer.exe'(848)
c:\winnt\system32\SHDOCVW.DLL
c:\winnt\system32\WININET.dll
.
Completion time: 2009-04-15 19:45 - machine was rebooted
ComboFix-quarantined-files.txt 2009-04-15 00:45

Pre-Run: 1,372,954,624 bytes free
Post-Run: 1,669,128,192 bytes free

155



GMER
GMER 1.0.15.14966 - http://www.gmer.net
Rootkit scan 2009-04-14 19:56:45
Windows 5.0.2195 Service Pack 2


---- System - GMER 1.0.15 ----

SSDT \??\C:\Program Files\SUPERAntiSpyware\SASKUTIL.sys (SASKUTIL.SYS/SUPERAdBlocker.com and SUPERAntiSpyware.com) ZwTerminateProcess [0xBBAC9F20]

---- Kernel code sections - GMER 1.0.15 ----

? C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\catchme.sys The system cannot find the file specified. !
? C:\WINNT\system32\Drivers\PROCEXP90.SYS The system cannot find the file specified. !

---- EOF - GMER 1.0.15 ----
Thanks for your time and trouble!

Steve

#6 PropagandaPanda

PropagandaPanda


  • Malware Response Team
  • 10,433 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:02:51 AM

Posted 15 April 2009 - 07:07 AM

Hello.

Let's see what we can do.

Run ComboFix with CFScript
We will run ComboFix again with a script.
  • Close any open browsers.
  • Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix. Refer to this page if you are unsure how.
  • Open notepad (Start>Run>"notepad") and copy/paste the text in the box below into it:
    KILLALL::
    File::
    c:\winnt\system32\tumobepo
    c:\winnt\system32\bcafaecfdaedaab.dll
    c:\winnt\system32\STEVE.dll
    
    Registry::
    [-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\bcafaecfdaedaab]
    [-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\STEVE]
    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
    "AppInit_DLLs"=""
    Save this as CFScript.txt, in the same location as ComboFix.exe. (This should be your desktop.)
    Posted Image
    Refering to the picture above, drag CFScript into ComboFix.exe.
When finished, it shall produce a log for you at "C:\ComboFix.txt". Post back with that log.

Do not mouseclick ComboFix's window while it's running. That may cause it to stall

Install From Windows Updates
Whenever a security problem in its software is found, Microsoft will create a patch for it. After the patch is installed, attackers can't use the vulnerability to install malicious software on your PC. Keeping up with these patches will help to prevent malware being installed on your computer.

Visit the Microsoft Update Website and follow the on screen instructions to setup Microsoft Update. Also follow the instructions to update your system. Please reboot and repeat this process until there are no more updates to install.

With Regards,
The Panda

#7 vang52

vang52
  • Topic Starter

  • Members
  • 37 posts
  • OFFLINE
  •  
  • Local time:02:51 AM

Posted 15 April 2009 - 08:01 AM

Panda,
I may have screwed up the process. Followed the instructions you gave in the last post, however, I neglected to disconnect the internet connection. At the beginning of the process a window popped up and said "There is a newer version of combofix available. Do you wish to run it?" I clicked no, because I wasn't sure what to do. After windows had rebooted, a window now displayed "Cannot import creg.dat: error accessing the registry." There was another message that followed shortly thereafter that said it couldn't find a particular file in a temp folder and I ended up with an empty notepad.

I apologize if I've made this more difficult in some way. What should I do next?

vanG
Thanks for your time and trouble!

Steve

#8 vang52

vang52
  • Topic Starter

  • Members
  • 37 posts
  • OFFLINE
  •  
  • Local time:02:51 AM

Posted 15 April 2009 - 08:06 AM

Panda,
I am again sorry. I happened to look at the C: drive and the log was there as follows:
ComboFix 09-04-15.03 - Administrator 04/15/2009 8:35.2 - FAT32x86
Microsoft Windows 2000 Professional 5.0.2195.2.1252.1.1033.18.254.119 [GMT -5:00]
Running from: c:\documents and settings\Administrator\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Administrator\Desktop\CFScript.txt

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::
c:\winnt\system32\bcafaecfdaedaab.dll
c:\winnt\system32\STEVE.dll
c:\winnt\system32\tumobepo
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\winnt\system32\tumobepo
c:\winnt\system32\bcafaecfdaedaab.dll . . . . failed to delete
c:\winnt\system32\STEVE.dll . . . . failed to delete

.
((((((((((((((((((((((((( Files Created from 2009-03-15 to 2009-04-15 )))))))))))))))))))))))))))))))
.

2009-04-08 22:41 . 2009-04-15 03:37 742418 ---h--w c:\winnt\ShellIconCache
2009-04-01 04:48 . 2009-04-01 04:48 -------- d-----w C:\Anti-Virus Help

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-03-26 21:49 . 2008-09-22 23:48 38496 ----a-w c:\winnt\system32\drivers\mbamswissarmy.sys
2009-03-26 21:49 . 2008-09-22 23:48 15504 ----a-w c:\winnt\system32\drivers\mbam.sys
2008-08-25 01:50 . 2008-08-27 00:18 26941368 ----a-w c:\documents and settings\Administrator\setupeng.exe
2006-12-01 00:59 . 2006-12-01 00:59 94896 ----a-w c:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2005-02-10 00:48 . 2002-01-11 20:35 95280 ----a-w c:\documents and settings\Administrator\Application Data\GDIPFONTCACHEV1.DAT
2004-07-30 14:56 . 2004-08-02 23:53 90112 ----a-w c:\program files\Common Files\PCSBclean.exe
2004-07-26 20:30 . 2003-06-22 21:45 291840 ----a-w c:\program files\Common Files\PCSBoff.exe
2003-03-25 02:17 . 2003-03-25 02:17 6147 ----a-w c:\program files\PCLICSB.DAT
2003-03-25 02:17 . 2003-03-25 02:17 258 ---h--r c:\program files\Common Files\LMF.DAT
2002-02-02 01:56 . 2002-02-02 01:56 1803848 ----a-w c:\program files\winzip81.exe
2001-04-10 12:58 . 1980-01-01 05:00 271 ---ha-w c:\program files\DESKTOP.INI
2001-04-10 12:58 . 1980-01-01 05:00 21952 ---ha-w c:\program files\FOLDER.HTT
2000-09-23 05:04 . 2000-09-23 05:04 800 ----a-w c:\program files\readme.txt
2000-09-19 18:30 . 2000-09-19 18:30 3064502 ----a-w c:\program files\ptedit17.exe
.

------- Sigcheck -------

[-] 2001-02-20 18:09 8192 D36A33C21EEED5A6C1DAECB7C80A1909 c:\winnt\SYSTEM32\CTFMON.EXE
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"H/PC Connection Agent"="c:\program files\Microsoft ActiveSync\WCESCOMM.EXE" [2005-01-04 405583]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2008-09-03 1576176]
"ctfmon.exe"="ctfmon.exe" - c:\winnt\SYSTEM32\CTFMON.EXE [2001-02-20 8192]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DadApp"="c:\program files\DELL\AccessDirect\dadapp.exe" [2001-03-29 188840]
"SynTPLpr"="c:\program files\Synaptics\SynTP\SynTPLpr.exe" [2001-04-13 94208]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2001-04-13 262144]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2006-09-01 282624]
"SSBkgdUpdate"="c:\program files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2003-10-14 155648]
"PaperPort PTD"="c:\program files\ScanSoft\PaperPort\pptd40nt.exe" [2004-04-14 57393]
"IndexSearch"="c:\program files\ScanSoft\PaperPort\IndexSearch.exe" [2004-04-14 40960]
"SetDefPrt"="c:\program files\Brother\Brmfl04a\BrStDvPt.exe" [2004-05-25 49152]
"ControlCenter2.0"="c:\program files\Brother\ControlCenter2\brctrcen.exe" [2004-07-20 851968]
"BellSouthWCC_McciTrayApp"="c:\program files\BellSouthWCC\McciTrayApp.exe" [2005-11-17 543232]
"HelpCenter4.1"="c:\program files\FastAccessDSL\HelpCenter43\bin\sprtcmd.exe" [2007-04-13 198184]
"Synchronization Manager"="mobsync.exe" - c:\winnt\SYSTEM32\MOBSYNC.EXE [2000-07-26 111376]
"PRPCMonitor"="PRPCUI.exe" - c:\winnt\SYSTEM32\prpcui.exe [2000-10-10 36352]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"^SetupICWDesktop"="c:\program files\Internet Explorer\Connection Wizard\icwconn1.exe" [2000-07-26 186640]

c:\documents and settings\Default User\Start Menu\Programs\Startup\
discfix.lnk - c:\dell\discfix.cmd [1980-1-1 75]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [2000-1-21 65588]
Adobe Gamma Loader.exe.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2004-6-21 113664]
Status Monitor.lnk - c:\program files\Brother\Brmfcmon\BrMfcWnd.exe [2006-11-4 819200]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-07-23 21:28 352256 ----a-w c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\bcafaecfdaedaab]
2007-03-14 09:24 302096 ------w c:\winnt\system32\bcafaecfdaedaab.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\STEVE]
2008-08-24 15:19 98833 ------w c:\winnt\system32\STEVE.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"= mmdrv.dll
"MSACM.CEGSM"= mobilev.acm
"vidc.dvsd"= dvc.dll
"VIDC.D263"= xl_x263dec.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"FirewallOverride"=dword:00000001

R0 cda1000;cda1000;c:\winnt\System32\DRIVERS\cda1000.sys [2000-12-14 281024]
R3 el575nd5;3Com Megahertz 10/100 LAN CardBus PC Card Driver;c:\winnt\system32\DRIVERS\el575nd5.sys [1999-10-19 77072]
R3 EL90BC;3Com EtherLink XL B/C Adapter Driver;c:\winnt\system32\DRIVERS\el90xbc5.sys [1999-10-23 61712]
S0 aaatimeo;aaatimeo;c:\winnt\System32\DRIVERS\aaatimeo.sys [2000-11-21 4928]
S1 cmosa;cmosa;c:\winnt\system32\DRIVERS\cmosa.sys [2000-11-30 29344]
S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV.SYS [2008-09-03 8944]
S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.sys [2008-09-03 55024]
S2 BrSerial;Brother Serial Driver;c:\winnt\system32\drivers\BrSerial.sys [2002-03-15 56660]
S2 PRPC;PRPC; [x]
S3 ltmdmnt;LT Win Modem Driver;c:\winnt\system32\DRIVERS\ltmdmnt.sys [2000-06-26 514744]
S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [2008-09-03 7408]

.
Contents of the 'Scheduled Tasks' folder

2009-04-15 c:\winnt\Tasks\Symantec NetDetect.job
- c:\program files\Symantec\LiveUpdate\NDETECT.EXE [2001-10-13 17:24]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://news.yahoo.com/
mSearch Bar =
uInternet Settings,ProxyOverride = 127.0.0.1
uSearchURL,(Default) = hxxp://www.google.com/keyword/%s
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
LSP: %SystemRoot%\system32\msafd.dll
DPF: DirectAnimation Java Classes - file://c:\winnt\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\winnt\Java\classes\xmldso.cab
.

**************************************************************************

catchme 0.3.1375 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-04-15 08:43
Windows 5.0.2195 Service Pack 2 FAT NTAPI

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(180)
c:\program files\SUPERAntiSpyware\SASWINLO.dll
c:\winnt\system32\bcafaecfdaedaab.dll
c:\winnt\system32\STEVE.dll
c:\winnt\system32\msv1_0.dll

- - - - - - - > 'explorer.exe'(1532)
c:\winnt\system32\SHDOCVW.DLL
c:\winnt\system32\WININET.dll
.
Completion time: 2009-04-15 8:46 - machine was rebooted
ComboFix-quarantined-files.txt 2009-04-15 13:46
ComboFix2.txt 2009-04-15 00:45

Pre-Run: 1,661,460,480 bytes free
Post-Run: 1,668,087,808 bytes free

141
Thanks for your time and trouble!

Steve

#9 PropagandaPanda

PropagandaPanda


  • Malware Response Team
  • 10,433 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:02:51 AM

Posted 15 April 2009 - 10:41 AM

Hello.

Please double click ComboFix.exe. When asked to update, do so.

Post back with the resulting log.

With Regards,
The Panda

#10 vang52

vang52
  • Topic Starter

  • Members
  • 37 posts
  • OFFLINE
  •  
  • Local time:02:51 AM

Posted 15 April 2009 - 02:02 PM

Latest:
ComboFix 09-04-15.08 - Administrator 04/15/2009 14:45.3 - FAT32x86
Microsoft Windows 2000 Professional 5.0.2195.2.1252.1.1033.18.254.140 [GMT -5:00]
Running from: c:\documents and settings\Administrator\Desktop\ComboFix.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\winnt\system32\bcafaecfdaedaab.dll . . . . failed to delete

.
((((((((((((((((((((((((( Files Created from 2009-03-15 to 2009-04-15 )))))))))))))))))))))))))))))))
.

2009-04-08 22:41 . 2009-04-15 03:37 742418 ---h--w c:\winnt\ShellIconCache
2009-04-01 04:48 . 2009-04-01 04:48 -------- d-----w C:\Anti-Virus Help

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-03-26 21:49 . 2008-09-22 23:48 38496 ----a-w c:\winnt\system32\drivers\mbamswissarmy.sys
2009-03-26 21:49 . 2008-09-22 23:48 15504 ----a-w c:\winnt\system32\drivers\mbam.sys
2008-08-25 01:50 . 2008-08-27 00:18 26941368 ----a-w c:\documents and settings\Administrator\setupeng.exe
2006-12-01 00:59 . 2006-12-01 00:59 94896 ----a-w c:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2005-02-10 00:48 . 2002-01-11 20:35 95280 ----a-w c:\documents and settings\Administrator\Application Data\GDIPFONTCACHEV1.DAT
2004-07-30 14:56 . 2004-08-02 23:53 90112 ----a-w c:\program files\Common Files\PCSBclean.exe
2004-07-26 20:30 . 2003-06-22 21:45 291840 ----a-w c:\program files\Common Files\PCSBoff.exe
2003-03-25 02:17 . 2003-03-25 02:17 6147 ----a-w c:\program files\PCLICSB.DAT
2003-03-25 02:17 . 2003-03-25 02:17 258 ---h--r c:\program files\Common Files\LMF.DAT
2002-02-02 01:56 . 2002-02-02 01:56 1803848 ----a-w c:\program files\winzip81.exe
2001-04-10 12:58 . 1980-01-01 05:00 271 ---ha-w c:\program files\DESKTOP.INI
2001-04-10 12:58 . 1980-01-01 05:00 21952 ---ha-w c:\program files\FOLDER.HTT
2000-09-23 05:04 . 2000-09-23 05:04 800 ----a-w c:\program files\readme.txt
2000-09-19 18:30 . 2000-09-19 18:30 3064502 ----a-w c:\program files\ptedit17.exe
.

------- Sigcheck -------

[-] 2001-02-20 18:09 8192 D36A33C21EEED5A6C1DAECB7C80A1909 c:\winnt\SYSTEM32\CTFMON.EXE
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"H/PC Connection Agent"="c:\program files\Microsoft ActiveSync\WCESCOMM.EXE" [2005-01-04 405583]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2008-09-03 1576176]
"ctfmon.exe"="ctfmon.exe" - c:\winnt\SYSTEM32\CTFMON.EXE [2001-02-20 8192]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DadApp"="c:\program files\DELL\AccessDirect\dadapp.exe" [2001-03-29 188840]
"SynTPLpr"="c:\program files\Synaptics\SynTP\SynTPLpr.exe" [2001-04-13 94208]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2001-04-13 262144]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2006-09-01 282624]
"SSBkgdUpdate"="c:\program files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2003-10-14 155648]
"PaperPort PTD"="c:\program files\ScanSoft\PaperPort\pptd40nt.exe" [2004-04-14 57393]
"IndexSearch"="c:\program files\ScanSoft\PaperPort\IndexSearch.exe" [2004-04-14 40960]
"SetDefPrt"="c:\program files\Brother\Brmfl04a\BrStDvPt.exe" [2004-05-25 49152]
"ControlCenter2.0"="c:\program files\Brother\ControlCenter2\brctrcen.exe" [2004-07-20 851968]
"BellSouthWCC_McciTrayApp"="c:\program files\BellSouthWCC\McciTrayApp.exe" [2005-11-17 543232]
"HelpCenter4.1"="c:\program files\FastAccessDSL\HelpCenter43\bin\sprtcmd.exe" [2007-04-13 198184]
"Synchronization Manager"="mobsync.exe" - c:\winnt\SYSTEM32\MOBSYNC.EXE [2000-07-26 111376]
"PRPCMonitor"="PRPCUI.exe" - c:\winnt\SYSTEM32\prpcui.exe [2000-10-10 36352]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"^SetupICWDesktop"="c:\program files\Internet Explorer\Connection Wizard\icwconn1.exe" [2000-07-26 186640]

c:\documents and settings\Default User\Start Menu\Programs\Startup\
discfix.lnk - c:\dell\discfix.cmd [1980-1-1 75]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [2000-1-21 65588]
Adobe Gamma Loader.exe.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2004-6-21 113664]
Status Monitor.lnk - c:\program files\Brother\Brmfcmon\BrMfcWnd.exe [2006-11-4 819200]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-07-23 21:28 352256 ----a-w c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\bcafaecfdaedaab]
2007-03-14 09:24 302096 ------w c:\winnt\system32\bcafaecfdaedaab.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\STEVE]
2008-08-24 15:19 98833 ------w c:\winnt\system32\STEVE.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"= mmdrv.dll
"MSACM.CEGSM"= mobilev.acm
"vidc.dvsd"= dvc.dll
"VIDC.D263"= xl_x263dec.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"FirewallOverride"=dword:00000001

R0 cda1000;cda1000;c:\winnt\System32\DRIVERS\cda1000.sys [2000-12-14 281024]
R3 el575nd5;3Com Megahertz 10/100 LAN CardBus PC Card Driver;c:\winnt\system32\DRIVERS\el575nd5.sys [1999-10-19 77072]
R3 EL90BC;3Com EtherLink XL B/C Adapter Driver;c:\winnt\system32\DRIVERS\el90xbc5.sys [1999-10-23 61712]
S0 aaatimeo;aaatimeo;c:\winnt\System32\DRIVERS\aaatimeo.sys [2000-11-21 4928]
S1 cmosa;cmosa;c:\winnt\system32\DRIVERS\cmosa.sys [2000-11-30 29344]
S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV.SYS [2008-09-03 8944]
S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.sys [2008-09-03 55024]
S2 BrSerial;Brother Serial Driver;c:\winnt\system32\drivers\BrSerial.sys [2002-03-15 56660]
S2 PRPC;PRPC; [x]
S3 ltmdmnt;LT Win Modem Driver;c:\winnt\system32\DRIVERS\ltmdmnt.sys [2000-06-26 514744]
S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [2008-09-03 7408]

.
Contents of the 'Scheduled Tasks' folder

2009-04-15 c:\winnt\Tasks\Symantec NetDetect.job
- c:\program files\Symantec\LiveUpdate\NDETECT.EXE [2001-10-13 17:24]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://news.yahoo.com/
mSearch Bar =
uInternet Settings,ProxyOverride = 127.0.0.1
uSearchURL,(Default) = hxxp://www.google.com/keyword/%s
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
LSP: %SystemRoot%\system32\msafd.dll
DPF: DirectAnimation Java Classes - file://c:\winnt\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\winnt\Java\classes\xmldso.cab
.

**************************************************************************

catchme 0.3.1375 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-04-15 14:51
Windows 5.0.2195 Service Pack 2 FAT NTAPI

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(180)
c:\program files\SUPERAntiSpyware\SASWINLO.dll
c:\winnt\system32\bcafaecfdaedaab.dll
c:\winnt\system32\STEVE.dll
c:\winnt\system32\msv1_0.dll

- - - - - - - > 'explorer.exe'(1696)
c:\winnt\system32\SHDOCVW.DLL
c:\winnt\system32\WININET.dll
.
Completion time: 2009-04-15 14:54 - machine was rebooted
ComboFix-quarantined-files.txt 2009-04-15 19:54
ComboFix2.txt 2009-04-15 13:46
ComboFix3.txt 2009-04-15 00:45

Pre-Run: 1,655,390,208 bytes free
Post-Run: 1,667,760,128 bytes free

135
Thanks for your time and trouble!

Steve

#11 PropagandaPanda

PropagandaPanda


  • Malware Response Team
  • 10,433 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:02:51 AM

Posted 15 April 2009 - 02:16 PM

Hello.

Let's try this.

Install ERUNT
This tool will create a complete backup of your registry. After every reboot, a new backup is created to ensure we have a safety net after each step. Do not delete these backups until we are finished.

Do not use the NTREGOPT that comes with the installation package.
  • Please download erunt-setup.exe to your desktop.
  • Double click erunt-setup.exe. If you are using Windows Vista, right click the icon and select "Run As Administrator." Follow the prompts and allow ERUNT to be installed with the settings at default. If you do not want a Desktop icon, feel free to uncheck that. When asked if you want to create an ERUNT entry in the startup folder, answer Yes. You can delete the installation file after use.
  • Erunt will open when the installation is finished. Check all items to be backed up in the default location and click OK.
You can find a complete guide to using the program here:
http://www.larshederer.homepage.t-online.de/erunt/erunt.txt

When we are finished, you may, remove ERUNT using Add/Remove Programs.

Download The Avenger and Run Script
Please download The Avenger by Swandog46 to your Desktop.
  • Right click avenger.zip and extract the contents to your desktop
  • Start the Avenger.exe.
  • Copy all the text contained in the qoute box below to your Clipboard by highlighting it, right clicking and selecting Copy:
    Registry keys to delete:
    HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\bcafaecfdaedaab
    HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\STEVE
    
    Files to delete:
    c:\winnt\system32\bcafaecfdaedaab.dll
    c:\winnt\system32\STEVE.dll
  • Click Posted Image to paste the script from the clipboard.
  • Click the Execute button
  • Answer Yes twice when prompted.
The process is completely automatic. Do not touch your computer until a log file opens.

The Avenger will do the following:
  • It will Restart your computer. (In cases where the code to execute contains "Drivers to Unload", the Avenger will actually restart your system twice.)
  • On reboot, it will briefly open a black command window on your desktop, this is normal.
  • After the restart, it creates a log file that should open with the results of Avengerís actions. This log file will be located at C:\avenger.txt (considering your operating drive is C:). Post back with it in your next reply.

After, click on ComboFix again to run it and post back with that log too.

With Regards,
The Panda

Edited by PropagandaPanda, 15 April 2009 - 02:16 PM.


#12 vang52

vang52
  • Topic Starter

  • Members
  • 37 posts
  • OFFLINE
  •  
  • Local time:02:51 AM

Posted 15 April 2009 - 03:27 PM

Panda,

First of all thanks for the help thus far. We have a problem. My machine was kicked offline when I tried to directly access the Avenger program for download. I used another computer to download and unzip to a flash drive, then connected the flash dive to the infected PC and copied Avenger.exe to the desktop. When I click on the avenger icon, an error message flashes on the screen too quickly to read and nothing happens. What next? Safe mode, maybe, or is that possible or even helpful? BTW, erunt seemed to work fine.

The Blind and Lost
vanG
Thanks for your time and trouble!

Steve

#13 PropagandaPanda

PropagandaPanda


  • Malware Response Team
  • 10,433 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:02:51 AM

Posted 15 April 2009 - 05:07 PM

Hello.

Delete the copy of the Avenger that is on the infected computer.

Rename the copy of the flast drive as Fluffybunny.exe. Transfer this copy of to the infected comptuer and try again.

With Regards,
The Panda

#14 vang52

vang52
  • Topic Starter

  • Members
  • 37 posts
  • OFFLINE
  •  
  • Local time:02:51 AM

Posted 15 April 2009 - 08:11 PM

Hi Panda,

More bad news! Tried renaming the file to Fluffybunny.exe, but it didn't work. As soon as the warning banner comes up the worm shuts it down. I took the flash drive to a NAV protected PC and it still indicates that the infection is "worm.trojan.Spam-Thru" and it resolves the flash drive infection by removing the m.exe file that the worm places onboard. No idea if there are other issues yet unknown [by me anyways].

vanG
Thanks for your time and trouble!

Steve

#15 PropagandaPanda

PropagandaPanda


  • Malware Response Team
  • 10,433 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:02:51 AM

Posted 16 April 2009 - 07:08 AM

Hello.
  • Close any open browsers.
  • Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix. Refer to this page if you are unsure how.
  • Open notepad (Start>Run>"notepad") and copy/paste the text in the box below into it:
    KILLALL::
    Rootkit::
    c:\winnt\system32\bcafaecfdaedaab.dll
    c:\winnt\system32\STEVE.dll
    
    Registry::
    [-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\bcafaecfdaedaab]
    
    [-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\STEVE]
    Save this as CFScript.txt, in the same location as ComboFix.exe. (This should be your desktop.)
    Posted Image
    Refering to the picture above, drag CFScript into ComboFix.exe.
When finished, it shall produce a log for you at "C:\ComboFix.txt". Post back with that log.

Do not mouseclick ComboFix's window while it's running. That may cause it to stall
With Regards,
The Panda

Edited by PropagandaPanda, 16 April 2009 - 07:09 AM.





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users