Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Fake "Warning! You have a security problem" pop up.


  • This topic is locked This topic is locked
8 replies to this topic

#1 Max91

Max91

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:11:22 PM

Posted 09 April 2009 - 07:39 AM

Every few minutes there will be a pop up right beside my clock saying "Warning! You have a security problem" and every 2 ~ 3 intervals of the pop up it comes out with another pop up - "Alert! You have a security problem! DO you want to scan your computer for viruses?" And when i click ok , it'll bring me to a site thats now reported attacked by google i think. But if i've guessed right the previous one is selling fake anti-virus which itself's a malware. Besides that every few minutes theres this pop up showing a fake anti-virus scan which is really annoying. Your Help is really appreciated. Thank you in advance.


DDS (Ver_09-03-16.01) - NTFSx86
Run by user at 20:30:47.98 on Thu 04/09/2009
Internet Explorer: 7.0.5730.13
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.767.244 [GMT 8:00]

AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated)

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
C:\WINDOWS\system32\userinit.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\Program Files\AVG\AVG8\avgcsrvx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\System32\svchost.exe -k HTTPFilter
C:\WINDOWS\system32\taskmgr.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\WINDOWS\system32\wuauclt.exe
svchost.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\user\Desktop\dds.scr

============== Pseudo HJT Report ===============

uSearch Page = hxxp://www.google.com
uSearch Bar = hxxp://www.google.com/ie
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
mSearchAssistant = hxxp://www.google.com/ie
uURLSearchHooks: Winamp Search Class: {57bca5fa-5dbb-45a2-b558-1755c3f6253b} - c:\program files\winamp toolbar\winamptb.dll
uURLSearchHooks: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn\yt.dll
mURLSearchHooks: Winamp Search Class: {57bca5fa-5dbb-45a2-b558-1755c3f6253b} - c:\program files\winamp toolbar\winamptb.dll
BHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\program files\yahoo!\companion\installs\cpn\yt.dll
BHO: AcroIEHlprObj Class: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 6.0\reader\activex\AcroIEHelper.dll
BHO: Winamp Toolbar Loader: {25cee8ec-5730-41bc-8b58-22ddc8ab8c20} - c:\program files\winamp toolbar\winamptb.dll
BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg8\avgssie.dll
BHO: {7E853D72-626A-48EC-A868-BA8D5E23E045} - No File
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.0.926.3450\swg.dll
BHO: Google Dictionary Compression sdch: {c84d72fe-e17d-4195-bb24-76c02e2e7c4e} - c:\program files\google\google toolbar\component\fastsearch_219B3E1547538286.dll
BHO: SingleInstance Class: {fdad4da1-61a2-4fd8-9c17-86f7ac245081} - c:\program files\yahoo!\companion\installs\cpn\YTSingleInstance.dll
TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn\yt.dll
TB: &Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar.dll
TB: Winamp Toolbar: {ebf2ba02-9094-4c5a-858b-bb198f3d8de2} - c:\program files\winamp toolbar\winamptb.dll
TB: {A057A204-BACC-4D26-9990-79A187E2698E} - No File
uRun: [swg] c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe
uRun: [MsnMsgr] "c:\program files\msn messenger\MsnMsgr.Exe" /background
uRun: [softaxis] c:\docume~1\user\applic~1\progra~1\filegrampart.exe
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [VoipBuster] "d:\voipbuster\VoipBuster.exe" -nosplash -minimized
uRun: [ares] "c:\program files\ares\Ares.exe" -h
uRun: [RegistryMechanic] c:\program files\registry mechanic\RegMech.exe /H
mRun: [NoooH] c:\windows\web\Sys.exe
mRun: [SoundMan] SOUNDMAN.EXE
mRun: [SunJavaUpdateSched] c:\program files\java\j2re1.4.2_03\bin\jusched.exe
mRun: [AVG8_TRAY] c:\progra~1\avg\avg8\avgtray.exe
mRun: [NeroFilterCheck] c:\windows\system32\NeroCheck.exe
mRun: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
IE: &Winamp Search - c:\documents and settings\all users\application data\winamp toolbar\ietoolbar\resources\en-us\local\search.html
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {08B0E5C0-4FCB-11CF-AAA5-00401C608501}
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/products/plugin/autodl/jinstall-142-windows-i586.cab
DPF: {CAFEEFAC-0014-0002-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/products/plugin/autodl/jinstall-142-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
TCP: {0A37C7B6-64A3-4194-A783-2BA4ED94C303} = 192.168.0.1
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg8\avgpp.dll
Notify: avgrsstarter - avgrsstx.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\user\applic~1\mozilla\firefox\profiles\2a2toib4.default\
FF - prefs.js: browser.search.defaulturl - hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2685&invocationType=tb50ffwinampie7&query=
FF - prefs.js: browser.search.selectedEngine - Winamp Search
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com.my/
FF - prefs.js: keyword.URL - hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2685&invocationType=tb50ffwinampab&query=
FF - component: c:\documents and settings\user\application data\mozilla\firefox\profiles\2a2toib4.default\extensions\{0b38152b-1b20-484d-a11f-5e04a9b0661f}\components\WinampTBPlayer.dll
FF - component: c:\program files\avg\avg8\firefox\components\avgssff.dll
FF - plugin: c:\program files\java\j2re1.4.2_03\bin\NPJava11.dll
FF - plugin: c:\program files\java\j2re1.4.2_03\bin\NPJava12.dll
FF - plugin: c:\program files\java\j2re1.4.2_03\bin\NPJava13.dll
FF - plugin: c:\program files\java\j2re1.4.2_03\bin\NPJava14.dll
FF - plugin: c:\program files\java\j2re1.4.2_03\bin\NPJava32.dll
FF - plugin: c:\program files\java\j2re1.4.2_03\bin\NPJPI142_03.dll
FF - plugin: c:\program files\java\j2re1.4.2_03\bin\NPOJI610.dll

============= SERVICES / DRIVERS ===============

R0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [2009-4-9 130424]
R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2005-1-1 325640]
R1 AvgMfx86;AVG On-access Scanner Minifilter Driver x86;c:\windows\system32\drivers\avgmfx86.sys [2005-1-1 27656]
R1 AvgTdiX;AVG8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2005-1-1 108552]
R2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\avg\avg8\avgemc.exe [2009-1-25 908056]
S2 avg8wd;AVG8 WatchDog;c:\progra~1\avg\avg8\avgwdsvc.exe [2009-1-25 298264]
S3 sdAuxService;PC Tools Auxiliary Service;c:\program files\spyware doctor\pctsAuxs.exe [2009-4-9 348752]
S3 sdCoreService;PC Tools Security Service;c:\program files\spyware doctor\pctsSvc.exe [2009-4-9 1095560]

=============== Created Last 30 ================

2009-04-09 05:00 <DIR> --d----- c:\docume~1\user\applic~1\Malwarebytes
2009-04-09 05:00 15,504 a------- c:\windows\system32\drivers\mbam.sys
2009-04-09 05:00 38,496 a------- c:\windows\system32\drivers\mbamswissarmy.sys
2009-04-09 05:00 <DIR> --d----- c:\program files\Malwarebytes' Anti-Malware
2009-04-09 05:00 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Malwarebytes
2009-04-09 01:08 159,600 a------- c:\windows\system32\drivers\pctgntdi.sys
2009-04-09 01:07 130,424 a------- c:\windows\system32\drivers\PCTCore.sys
2009-04-09 01:07 73,840 a------- c:\windows\system32\drivers\PCTAppEvent.sys
2009-04-09 01:07 <DIR> --d----- c:\program files\common files\PC Tools
2009-04-09 01:07 64,392 a------- c:\windows\system32\drivers\pctplsg.sys
2009-04-09 01:07 <DIR> --d----- c:\program files\Spyware Doctor
2009-04-09 01:07 <DIR> --d----- c:\docume~1\user\applic~1\PC Tools
2009-04-09 01:07 <DIR> --d----- c:\docume~1\alluse~1\applic~1\PC Tools
2009-04-05 22:58 <DIR> --d----- c:\program files\Program inside
2009-03-15 23:44 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Winamp Toolbar
2009-03-15 23:44 <DIR> --d----- c:\program files\Winamp Toolbar
2009-03-15 23:39 129,520 -------- c:\windows\system32\pxafs.dll
2009-03-15 23:39 9,200 -------- c:\windows\system32\drivers\cdralw2k.sys
2009-03-15 23:39 9,072 -------- c:\windows\system32\drivers\cdr4_xp.sys
2009-03-15 21:07 122 a------- c:\windows\WA.INI

==================== Find3M ====================

2009-04-09 05:25 108,552 a------- c:\windows\system32\drivers\avgtdix.sys
2009-04-09 05:25 325,640 a------- c:\windows\system32\drivers\avgldx86.sys
2009-04-09 05:24 10,520 a------- c:\windows\system32\avgrsstx.dll
2009-04-09 00:24 68,608 a------- c:\windows\system32\userinit.exe
2009-02-09 18:19 1,846,272 a------- c:\windows\system32\win32k.sys
2009-01-23 14:39 86,327 a------- c:\windows\pchealth\helpctr\offlinecache\index.dat
2009-01-19 08:57 21,640 a------- c:\windows\system32\emptyregdb.dat

============= FINISH: 20:31:07.54 ===============

Attached Files



BC AdBot (Login to Remove)

 


#2 KoanYorel

KoanYorel

    Bleepin' Conundrum


  • Members
  • 19,461 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:65 miles due East of the &quot;Logic Free Zone&quot;, in Md, USA
  • Local time:11:22 AM

Posted 24 April 2009 - 10:05 AM

Hello and welcome to Bleeping Computer

We apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help.

If you have since resolved the original problem you were having, we would appreciate you letting us know. If not please perform the following steps below so we can have a look at the current condition of your machine.

If you have not done so, include a clear description of the problems you're having, along with any steps you may have performed so far.

Upon completing the steps below another staff member will review and take the steps necessary with you to get your machine back in working order clean and free of malware.

If you have already posted a DDS log, please do so again, as your situation may have changed.
Use the 'Add Reply' and add the new log to this thread.


Thanks and again sorry for the delay.

We need to see some information about what is happening in your machine. Please perform the following scan:
  • Download DDS by sUBs from one of the following links. Save it to your desktop.
  • Double click on the DDS icon, allow it to run.
  • A small box will open, with an explaination about the tool. No input is needed, the scan is running.
  • Notepad will open with the results.
  • Follow the instructions that pop up for posting the results.
  • Close the program window, and delete the program from your desktop.
Please note: You may have to disable any script protection running if the scan fails to run. After downloading the tool, disconnect from the internet and disable all antivirus protection. Run the scan, enable your A/V and reconnect to the internet.

Information on A/V control HERE

R,
K
The only easy day was yesterday.

...some do, some don't; some will, some won't (WR)

#3 Max91

Max91
  • Topic Starter

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:11:22 PM

Posted 24 April 2009 - 12:23 PM

First of all , Thank you for getting back to me. Although it took 2 weeks for the reply but I really appreciate it! =]

I'm having this pop up saying "Warning! You have a security problem!"

Like i explained above when i started this topic. It leads me to a site where it has been reported dangerous.
Besides that every few mins it redirects my IE to a site where it is unavailable.

So is it possible to clear this virus/malware , its really really really Annoying.


DDS (Ver_09-03-16.01) - NTFSx86
Run by user at 23:27:15.70 on Fri 04/24/2009
Internet Explorer: 7.0.5730.13
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.767.365 [GMT 8:00]

AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated)

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
C:\WINDOWS\system32\userinit.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\Program Files\AVG\AVG8\avgcsrvx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\System32\svchost.exe -k HTTPFilter
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\user\Desktop\dds.scr

============== Pseudo HJT Report ===============

uSearch Page = hxxp://www.google.com
uSearch Bar = hxxp://www.google.com/ie
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
mSearchAssistant = hxxp://www.google.com/ie
uURLSearchHooks: Winamp Search Class: {57bca5fa-5dbb-45a2-b558-1755c3f6253b} - c:\program files\winamp toolbar\winamptb.dll
uURLSearchHooks: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn\yt.dll
mURLSearchHooks: Winamp Search Class: {57bca5fa-5dbb-45a2-b558-1755c3f6253b} - c:\program files\winamp toolbar\winamptb.dll
BHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\program files\yahoo!\companion\installs\cpn\yt.dll
BHO: AcroIEHlprObj Class: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 6.0\reader\activex\AcroIEHelper.dll
BHO: Winamp Toolbar Loader: {25cee8ec-5730-41bc-8b58-22ddc8ab8c20} - c:\program files\winamp toolbar\winamptb.dll
BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg8\avgssie.dll
BHO: {7E853D72-626A-48EC-A868-BA8D5E23E045} - No File
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.1.1309.3572\swg.dll
BHO: Google Dictionary Compression sdch: {c84d72fe-e17d-4195-bb24-76c02e2e7c4e} - c:\program files\google\google toolbar\component\fastsearch_219B3E1547538286.dll
BHO: SingleInstance Class: {fdad4da1-61a2-4fd8-9c17-86f7ac245081} - c:\program files\yahoo!\companion\installs\cpn\YTSingleInstance.dll
TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn\yt.dll
TB: &Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar.dll
TB: Winamp Toolbar: {ebf2ba02-9094-4c5a-858b-bb198f3d8de2} - c:\program files\winamp toolbar\winamptb.dll
TB: {A057A204-BACC-4D26-9990-79A187E2698E} - No File
uRun: [swg] c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe
uRun: [MsnMsgr] "c:\program files\msn messenger\MsnMsgr.Exe" /background
uRun: [softaxis] c:\docume~1\user\applic~1\progra~1\filegrampart.exe
uRun: [VoipBuster] "d:\voipbuster\VoipBuster.exe" -nosplash -minimized
uRun: [ares] "c:\program files\ares\Ares.exe" -h
uRun: [RegistryMechanic] c:\program files\registry mechanic\RegMech.exe /H
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
mRun: [NoooH] c:\windows\web\Sys.exe
mRun: [SoundMan] SOUNDMAN.EXE
mRun: [SunJavaUpdateSched] c:\program files\java\j2re1.4.2_03\bin\jusched.exe
mRun: [AVG8_TRAY] c:\progra~1\avg\avg8\avgtray.exe
mRun: [NeroFilterCheck] c:\windows\system32\NeroCheck.exe
mRun: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
IE: &Winamp Search - c:\documents and settings\all users\application data\winamp toolbar\ietoolbar\resources\en-us\local\search.html
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {08B0E5C0-4FCB-11CF-AAA5-00401C608501}
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/products/plugin/autodl/jinstall-142-windows-i586.cab
DPF: {CAFEEFAC-0014-0002-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/products/plugin/autodl/jinstall-142-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
TCP: {0A37C7B6-64A3-4194-A783-2BA4ED94C303} = 192.168.0.1
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg8\avgpp.dll
Notify: avgrsstarter - avgrsstx.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\user\applic~1\mozilla\firefox\profiles\2a2toib4.default\
FF - prefs.js: browser.search.defaulturl - hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2685&invocationType=tb50ffwinampie7&query=
FF - prefs.js: browser.search.selectedEngine - Winamp Search
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com.my/
FF - prefs.js: keyword.URL - hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2685&invocationType=tb50ffwinampab&query=
FF - component: c:\documents and settings\user\application data\mozilla\firefox\profiles\2a2toib4.default\extensions\{0b38152b-1b20-484d-a11f-5e04a9b0661f}\components\WinampTBPlayer.dll
FF - component: c:\program files\avg\avg8\firefox\components\avgssff.dll
FF - plugin: c:\program files\google\update\1.2.141.5\npGoogleOneClick7.dll
FF - plugin: c:\program files\java\j2re1.4.2_03\bin\NPJava11.dll
FF - plugin: c:\program files\java\j2re1.4.2_03\bin\NPJava12.dll
FF - plugin: c:\program files\java\j2re1.4.2_03\bin\NPJava13.dll
FF - plugin: c:\program files\java\j2re1.4.2_03\bin\NPJava14.dll
FF - plugin: c:\program files\java\j2re1.4.2_03\bin\NPJava32.dll
FF - plugin: c:\program files\java\j2re1.4.2_03\bin\NPJPI142_03.dll
FF - plugin: c:\program files\java\j2re1.4.2_03\bin\NPOJI610.dll

============= SERVICES / DRIVERS ===============

R0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [2009-4-9 130424]
R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2005-1-1 325640]
R1 AvgMfx86;AVG On-access Scanner Minifilter Driver x86;c:\windows\system32\drivers\avgmfx86.sys [2005-1-1 27656]
R1 AvgTdiX;AVG8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2005-1-1 108552]
R2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\avg\avg8\avgemc.exe [2009-1-25 908056]
R2 avg8wd;AVG8 WatchDog;c:\progra~1\avg\avg8\avgwdsvc.exe [2009-1-25 298264]
R3 VCSVADHWSer;Avnex Virtual Audio Device (WDM);c:\windows\system32\drivers\vcsvad.sys [2009-4-11 17792]
S2 gupdate1c9b95e9d9e1b3e;Google Update Service (gupdate1c9b95e9d9e1b3e);c:\program files\google\update\GoogleUpdate.exe [2009-4-10 133104]
S3 sdAuxService;PC Tools Auxiliary Service;c:\program files\spyware doctor\pctsAuxs.exe [2009-4-9 348752]
S3 sdCoreService;PC Tools Security Service;c:\program files\spyware doctor\pctsSvc.exe [2009-4-9 1095560]

=============== Created Last 30 ================

2009-04-18 03:17 89,448 a------- c:\windows\system32\drivers\80ffddf1.sys
2009-04-16 08:36 <DIR> --d----- c:\program files\BitLord
2009-04-11 18:45 <DIR> --d----- c:\windows\system32\NtmsData
2009-04-11 18:44 155 a------- c:\windows\system32\SelfDel.bat
2009-04-11 18:28 109,010 a------- c:\windows\system32\drivers\648e1653.sys
2009-04-11 03:44 <DIR> --d----- C:\AV_LOGS
2009-04-11 03:43 17,792 a------- c:\windows\system32\drivers\vcsvad.sys
2009-04-11 03:42 <DIR> --d----- c:\program files\AV Vcs 7.0 DIAMOND
2009-04-10 06:00 <DIR> --d----- c:\program files\common files\DivX Shared
2009-04-10 06:00 <DIR> --d----- c:\program files\DivX
2009-04-09 05:00 <DIR> --d----- c:\docume~1\user\applic~1\Malwarebytes
2009-04-09 05:00 15,504 a------- c:\windows\system32\drivers\mbam.sys
2009-04-09 05:00 38,496 a------- c:\windows\system32\drivers\mbamswissarmy.sys
2009-04-09 05:00 <DIR> --d----- c:\program files\Malwarebytes' Anti-Malware
2009-04-09 05:00 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Malwarebytes
2009-04-09 01:08 159,600 a------- c:\windows\system32\drivers\pctgntdi.sys
2009-04-09 01:07 130,424 a------- c:\windows\system32\drivers\PCTCore.sys
2009-04-09 01:07 73,840 a------- c:\windows\system32\drivers\PCTAppEvent.sys
2009-04-09 01:07 <DIR> --d----- c:\program files\common files\PC Tools
2009-04-09 01:07 64,392 a------- c:\windows\system32\drivers\pctplsg.sys
2009-04-09 01:07 <DIR> --d----- c:\program files\Spyware Doctor
2009-04-09 01:07 <DIR> --d----- c:\docume~1\user\applic~1\PC Tools
2009-04-09 01:07 <DIR> --d----- c:\docume~1\alluse~1\applic~1\PC Tools
2009-04-05 22:58 <DIR> --d----- c:\program files\Program inside

==================== Find3M ====================

2009-04-09 05:25 108,552 a------- c:\windows\system32\drivers\avgtdix.sys
2009-04-09 05:25 325,640 a------- c:\windows\system32\drivers\avgldx86.sys
2009-04-09 05:24 10,520 a------- c:\windows\system32\avgrsstx.dll
2009-04-09 00:24 68,608 a------- c:\windows\system32\userinit.exe
2009-02-09 18:19 1,846,272 a------- c:\windows\system32\win32k.sys

============= FINISH: 23:27:25.90 ===============

Attached Files



#4 JSntgRvr

JSntgRvr

    Master Surgeon General


  • Malware Response Team
  • 11,693 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto Rico
  • Local time:11:22 AM

Posted 24 April 2009 - 02:09 PM

Hi, Max91 :thumbup2:

Welcome.

Posted Image Please download Malwarebytes' Anti-Malware from Here.

Double Click mbam-setup.exe to install the application.
  • Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select "Perform Quick Scan", then click Scan.
  • The scan may take some time to finish,so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected.
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  • Copy&Paste the entire report in your next reply.
Extra Note:

If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediatly.

=====================================================================


Please download ComboFix from Here or Here to your Desktop.

**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**
  • Please, never rename Combofix unless instructed.
  • Close any open browsers.
  • Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

    -----------------------------------------------------------

    • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
    • Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.

      -----------------------------------------------------------

    • Close any open browsers.
    • WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
    • Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
    • If there is no internet connection after running Combofix, then restart your computer to restore back your connection.

    -----------------------------------------------------------

  • Double click on combofix.exe & follow the prompts.
  • If you receive a message that Combofix has detected the presence of rootkit activity and needs to reboot, kindly write down on paper the list of files present in the message before continuing, and post it in your next reply.
  • Install the Recovery Console upon request.
  • When finished, it will produce a report for you.
  • Please post the "C:\ComboFix.txt" along with a new HijackThis log for further review.
**Note: Do not mouseclick combofix's window while it's running. That may cause it to stall**

No request for help throughout private messaging will be attended.

If I have helped you, consider making a donation to help me continue the fight against Malware!
btn_donate_SM.gif


#5 Max91

Max91
  • Topic Starter

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:11:22 PM

Posted 25 April 2009 - 02:12 AM

Note : Did i make a mistake or.... Because I don't see a HijackThis log any where. Let me know if i've done anything wrong.


ComboFix 09-04-25.06 - user 04/25/2009 14:58.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.767.502 [GMT 8:00]
Running from: c:\documents and settings\user\Desktop\ComboFix.exe
AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated)
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Autorun.inf
c:\windows\AppPatch\Custom\{deb7008b-681e-4a4a-8aae-cc833e8216ce}.sdb
c:\windows\system32\drivers\ovfsthosspumstkbrlwmnrerfvpypuwawqxmmh.sys
c:\windows\system32\ovfsthlcukdksrjfiutsicimjlfrlwyqvflrqy.dat
c:\windows\system32\ovfsthofjmbphxabpoupajayojwcktigideaux.dll
c:\windows\system32\ovfsthrdiuiqxpumaxrabfinthhlfwnojwykvt.dat
c:\windows\system32\ovfsthveffhqncamilamwepihgvvlviotkwykg.dll
c:\windows\system32\ovfsthvpkbyriphxdpalsibarssrntymovnrjk.dll

Infected copy of c:\windows\system32\userinit.exe was found and disinfected
Restored copy from - c:\windows\system32\dllcache\userinit.exe


.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_ovfsthexvkllxfmqxnqqpxsyviybhxbqbdmett


((((((((((((((((((((((((( Files Created from 2009-05-25 to 2009-4-25 )))))))))))))))))))))))))))))))
.

2009-04-17 19:17 . 2009-04-25 07:04 89448 ----a-w c:\windows\system32\drivers\80ffddf1.sys
2009-04-11 10:45 . 2009-04-11 23:05 -------- d-----w c:\windows\system32\NtmsData
2009-04-11 10:44 . 2009-04-11 10:44 155 ----a-w c:\windows\system32\SelfDel.bat
2009-04-11 10:28 . 2009-04-25 07:04 109010 ----a-w c:\windows\system32\drivers\648e1653.sys
2009-04-10 19:44 . 2009-04-10 19:45 -------- d-----w C:\AV_LOGS
2009-04-10 19:43 . 2008-12-10 08:56 17792 ----a-w c:\windows\system32\drivers\vcsvad.sys
2009-04-10 04:26 . 2009-04-10 04:26 -------- d-----w c:\documents and settings\NetworkService\Local Settings\Application Data\Google
2009-04-09 22:00 . 2009-04-09 22:00 -------- d-----w c:\documents and settings\LocalService\Local Settings\Application Data\Google
2009-04-08 21:00 . 2009-04-08 21:00 -------- d-----w c:\documents and settings\user\Application Data\Malwarebytes
2009-04-08 21:00 . 2009-04-06 07:32 15504 ----a-w c:\windows\system32\drivers\mbam.sys
2009-04-08 21:00 . 2009-04-06 07:32 38496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys
2009-04-08 21:00 . 2009-04-08 21:00 -------- d-----w c:\documents and settings\All Users\Application Data\Malwarebytes
2009-04-08 17:08 . 2008-12-11 00:38 159600 ----a-w c:\windows\system32\drivers\pctgntdi.sys
2009-04-08 17:07 . 2009-03-06 08:45 130424 ----a-w c:\windows\system32\drivers\PCTCore.sys
2009-04-08 17:07 . 2008-12-18 04:16 73840 ----a-w c:\windows\system32\drivers\PCTAppEvent.sys
2009-04-08 17:07 . 2009-04-21 01:33 -------- d---a-w c:\documents and settings\All Users\Application Data\TEMP
2009-04-08 17:07 . 2008-12-10 04:36 64392 ----a-w c:\windows\system32\drivers\pctplsg.sys
2009-04-08 17:07 . 2009-04-08 17:07 -------- d-----w c:\documents and settings\user\Application Data\PC Tools
2009-04-08 17:07 . 2009-04-08 17:07 -------- d-----w c:\documents and settings\All Users\Application Data\PC Tools

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-04-24 17:34 . 2009-02-04 10:44 -------- d-----w c:\documents and settings\user\Application Data\uTorrent
2009-04-20 14:28 . 2009-04-09 22:00 -------- d-----w c:\program files\DivX
2009-04-16 00:37 . 2009-04-16 00:36 -------- d-----w c:\program files\BitLord
2009-04-10 19:47 . 2009-04-10 19:42 -------- d-----w c:\program files\AV Vcs 7.0 DIAMOND
2009-04-09 22:02 . 2009-01-22 10:32 -------- d-----w c:\program files\Google
2009-04-09 22:00 . 2009-04-09 22:00 -------- d-----w c:\program files\Common Files\DivX Shared
2009-04-08 21:36 . 2009-02-14 08:43 -------- d-----w c:\documents and settings\All Users\Application Data\Readme Live Axis Tons
2009-04-08 21:25 . 2004-12-31 16:16 108552 ----a-w c:\windows\system32\drivers\avgtdix.sys
2009-04-08 21:25 . 2004-12-31 16:15 325640 ----a-w c:\windows\system32\drivers\avgldx86.sys
2009-04-08 21:24 . 2004-12-31 16:16 10520 ----a-w c:\windows\system32\avgrsstx.dll
2009-04-08 21:24 . 2004-12-31 16:15 -------- d-----w c:\documents and settings\All Users\Application Data\avg8
2009-04-08 21:00 . 2009-04-08 21:00 -------- d-----w c:\program files\Malwarebytes' Anti-Malware
2009-04-08 17:15 . 2009-04-08 17:07 -------- d-----w c:\program files\Spyware Doctor
2009-04-08 17:08 . 2009-04-08 17:07 -------- d-----w c:\program files\Common Files\PC Tools
2009-04-05 15:02 . 2009-02-14 08:42 -------- d-----w c:\documents and settings\user\Application Data\Program inside
2009-04-05 14:58 . 2009-04-05 14:58 -------- d-----w c:\program files\Program inside
2009-04-05 14:56 . 2009-02-14 08:41 -------- d-----w c:\program files\Messenger Plus! Live
2009-04-05 14:56 . 2009-02-14 08:40 -------- d-----w c:\program files\MSN Messenger
2009-03-16 01:14 . 2009-02-10 14:56 -------- d-----w c:\documents and settings\user\Application Data\AdobeUM
2009-03-15 15:44 . 2004-12-31 16:30 -------- d-----w c:\program files\Winamp
2009-03-15 15:44 . 2009-03-15 15:44 -------- d-----w c:\program files\Winamp Toolbar
2009-03-15 15:44 . 2009-03-15 15:44 -------- d-----w c:\documents and settings\All Users\Application Data\Winamp Toolbar
2009-03-15 15:13 . 2009-03-15 15:13 -------- d-----w c:\program files\Windows Live Safety Center
2009-03-01 05:21 . 2009-03-01 05:21 -------- d--h--w c:\documents and settings\All Users\Application Data\CanonBJ
2009-02-26 22:40 . 2009-02-26 22:40 -------- d-----w c:\program files\Game Accelerator
2009-02-23 22:15 . 2009-01-23 06:21 42168 ----a-w c:\documents and settings\user\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-02-14 08:39 . 2009-02-14 08:39 268 ---ha-w C:\sqmdata00.sqm
2009-02-14 08:39 . 2009-02-14 08:39 244 ---ha-w C:\sqmnoopt00.sqm
2009-02-09 10:19 . 2004-08-04 12:00 1846272 ----a-w c:\windows\system32\win32k.sys
2009-02-24 19:2009-02-24 19:34 34:32 . c:\program files\mozilla firefox\plugins\libdivx.dll
2009-02-24 19:2009-02-24 19:34 34:32 . c:\program files\mozilla firefox\plugins\ssldivx.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-01-22 39408]
"MsnMsgr"="c:\program files\MSN Messenger\MsnMsgr.Exe" [2007-01-19 5674352]
"softaxis"="c:\docume~1\user\APPLIC~1\PROGRA~1\filegrampart.exe" [2009-04-05 659456]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="c:\program files\Java\j2re1.4.2_03\bin\jusched.exe" [2003-11-19 32881]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-04-08 1932568]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"SoundMan"="SOUNDMAN.EXE" - c:\windows\soundman.exe [2007-04-16 577536]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-04-08 21:24 10520 ----a-w c:\windows\system32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"FirewallOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgemc.exe"=
"d:\\Garena\\Garena.exe"=
"d:\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\MSN Messenger\\livecall.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Documents and Settings\\user\\Desktop\\Garenableeped =]\\Garena.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgnsx.exe"=
"d:\\GarenaJustGotbleeped!\\Garena.exe"=
"c:\\Documents and Settings\\user\\Desktop\\Pudge666V5.0\\Garena.exe"=
"c:\\Program Files\\BitLord\\BitLord.exe"=

R2 gupdate1c9b95e9d9e1b3e;Google Update Service (gupdate1c9b95e9d9e1b3e);c:\program files\Google\Update\GoogleUpdate.exe [2009-04-09 133104]
R3 garenapengine;garenapengine; [x]
R3 sdAuxService;PC Tools Auxiliary Service;c:\program files\Spyware Doctor\pctsAuxs.exe [2009-01-07 348752]
S0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [2009-03-06 130424]
S1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\System32\Drivers\avgldx86.sys [2009-04-08 325640]
S1 AvgTdiX;AVG8 Network Redirector;c:\windows\System32\Drivers\avgtdix.sys [2009-04-08 108552]
S2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [2009-04-08 908056]
S2 avg8wd;AVG8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2009-04-08 298264]
S3 VCSVADHWSer;Avnex Virtual Audio Device (WDM);c:\windows\system32\DRIVERS\vcsvad.sys [2008-12-10 17792]


[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6cf8cc09-5b49-11d9-89e7-000feaceb0df}]
\shell\autorun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Flash.10.Setup.exe
\shell\explore\command - Flash.10.Setup.exe
\shell\open\command - Flash.10.Setup.exe
\shell\scan for viruses\command - Scanner.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6cf8cc0a-5b49-11d9-89e7-000feaceb0df}]
\Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Flash.10.Setup.exe
\Shell\Explore\command - Flash.10.Setup.exe
\Shell\Open\command - Flash.10.Setup.exe
\Shell\Scan for Viruses\command - G:\Scanner.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{de74dbc9-faee-11dd-a905-000feaceb0df}]
\Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Flash.10.Setup.exe
\Shell\Explore\command - Flash.10.Setup.exe
\Shell\Open\command - Flash.10.Setup.exe
\Shell\Scan for Viruses\command - H:\Scanner.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{df084ef8-5b45-11d9-89de-e6cd0a79cc2b}]
\Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Sys.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{df084ef9-5b45-11d9-89de-e6cd0a79cc2b}]
\Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Sys.exe
.
Contents of the 'Scheduled Tasks' folder

2009-04-25 c:\windows\Tasks\A8F52A2E9192A05E.job
- c:\docume~1\user\applic~1\progra~1\Setupstylethe.exe [2009-02-14 15:02]

2009-04-25 c:\windows\Tasks\GoogleUpdateTaskMachine.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-04-09 22:00]
.
- - - - ORPHANS REMOVED - - - -

HKCU-Run-VoipBuster - d:\voipbuster\VoipBuster.exe
HKCU-Run-ares - c:\program files\Ares\Ares.exe
HKCU-Run-RegistryMechanic - c:\program files\Registry Mechanic\RegMech.exe


.
------- Supplementary Scan -------
.
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: &Winamp Search - c:\documents and settings\All Users\Application Data\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
TCP: {0A37C7B6-64A3-4194-A783-2BA4ED94C303} = 192.168.0.1
FF - ProfilePath - c:\documents and settings\user\Application Data\Mozilla\Firefox\Profiles\2a2toib4.default\
FF - prefs.js: browser.search.defaulturl - hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2685&invocationType=tb50ffwinampie7&query=
FF - prefs.js: browser.search.selectedEngine - Winamp Search
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com.my/
FF - prefs.js: keyword.URL - hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2685&invocationType=tb50ffwinampab&query=
FF - component: c:\documents and settings\user\Application Data\Mozilla\Firefox\Profiles\2a2toib4.default\extensions\{0b38152b-1b20-484d-a11f-5e04a9b0661f}\components\WinampTBPlayer.dll
FF - component: c:\program files\AVG\AVG8\Firefox\components\avgssff.dll
FF - plugin: c:\program files\Google\Update\1.2.141.5\npGoogleOneClick7.dll
FF - plugin: c:\program files\Java\j2re1.4.2_03\bin\NPJava11.dll
FF - plugin: c:\program files\Java\j2re1.4.2_03\bin\NPJava12.dll
FF - plugin: c:\program files\Java\j2re1.4.2_03\bin\NPJava13.dll
FF - plugin: c:\program files\Java\j2re1.4.2_03\bin\NPJava14.dll
FF - plugin: c:\program files\Java\j2re1.4.2_03\bin\NPJava32.dll
FF - plugin: c:\program files\Java\j2re1.4.2_03\bin\NPJPI142_03.dll
FF - plugin: c:\program files\Java\j2re1.4.2_03\bin\NPOJI610.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-04-25 15:04
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\garenapengine]
"ImagePath"="\??\c:\docume~1\user\LOCALS~1\Temp\HSMB0.tmp"

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\648e1653]
"ImagePath"="\SystemRoot\System32\drivers\648e1653.sys"

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\80ffddf1]
"ImagePath"="\SystemRoot\System32\drivers\80ffddf1.sys"
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\s-1-5-21-1644491937-1979792683-725345543-1003\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(4072)
c:\progra~1\WINDOW~2\wmpband.dll
c:\windows\system32\msi.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\AVG\AVG8\avgrsx.exe
c:\progra~1\AVG\AVG8\avgnsx.exe
c:\program files\AVG\AVG8\avgcsrvx.exe
c:\program files\Internet Explorer\iexplore.exe
c:\program files\MSN Messenger\usnsvc.exe
.
**************************************************************************
.
Completion time: 2009-04-25 15:06 - machine was rebooted
ComboFix-quarantined-files.txt 2009-04-25 07:05

Pre-Run: 15,756,713,984 bytes free
Post-Run: 15,906,799,616 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

225 --- E O F --- 2009-04-06 22:01

#6 JSntgRvr

JSntgRvr

    Master Surgeon General


  • Malware Response Team
  • 11,693 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto Rico
  • Local time:11:22 AM

Posted 25 April 2009 - 02:36 AM

Hi, Max91 :thumbup2:
  • Copy the entire contents of the Quote Box below to Notepad.
  • Name the file as CFScript.txt
  • Change the Save as Type to All Files
  • and Save it on the desktop

File::
c:\windows\system32\drivers\80ffddf1.sys
c:\windows\system32\NtmsData
c:\windows\system32\SelfDel.bat
c:\windows\system32\drivers\648e1653.sys
c:\docume~1\user\APPLIC~1\PROGRA~1\filegrampart.exe
c:\windows\Tasks\A8F52A2E9192A05E.job
c:\docume~1\user\applic~1\progra~1\Setupstylethe.exe

Driver::
garenapengine

Registry::
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"d:\\uTorrent\\uTorrent.exe"=-
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"softaxis"=-
[-HKEY_LOCAL_MACHINE\System\ControlSet003\Services\garenapengine]
[-HKEY_LOCAL_MACHINE\System\ControlSet003\Services\648e1653]
[-HKEY_LOCAL_MACHINE\System\ControlSet003\Services\80ffddf1]


Posted Image

Once saved, referring to the picture above, drag CFScript.txt into ComboFix.exe, and post back the resulting report along with a Hijackthis log.

Please do an online scan with Kaspersky WebScanner

Kaspersky online scanner uses JAVA tecnology to perform the scan. If you do not have the latest JAVA version, follow the instrutions below under Upgrading Java, to download and install the latest vesion.
  • Read through the requirements and privacy statement and click on Accept button.
  • It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
  • When the downloads have finished, click on Settings.
  • Make sure the following is checked.
    • Spyware, Adware, Dialers, and other potentially dangerous programs
      Archives
      Mail databases
  • Click on My Computer under Scan.
  • Once the scan is complete, it will display the results. Click on View Scan Report.
  • You will see a list of infected items there. Click on Save Report As....
  • Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button.
  • Please post this log in your next reply.
Upgrading Java:
  • Download the latest version of Java SE Runtime Environment (JRE)JRE 6 Update 13.
  • Click the "Download" button to the right.
  • Select your Platform and check the box that says: "I agree to the Java SE Runtime Environment 6 License Agreement.".
  • Click on Continue.
  • Click on the link to download Windows Offline Installation (jre-6u13-windows-i586-p.exe) and save it to your desktop. Do NOT use the Sun Download Manager..
  • Close any programs you may have running - especially your web browser.
  • Go to Start > Control Panel, double-click on Add/Remove programs and remove all older versions of Java.
  • Check any item with Java Runtime Environment (JRE or J2SE) in the name.
  • Click the Remove or Change/Remove button.
  • Repeat as many times as necessary to remove each Java version.
  • Reboot your computer once all Java components are removed.
  • Then from your desktop double-click on the download to install the newest version.(Vista users, right click on the jre-6u13-windows-i586-p.exe and select "Run as an Administrator.")

No request for help throughout private messaging will be attended.

If I have helped you, consider making a donation to help me continue the fight against Malware!
btn_donate_SM.gif


#7 Max91

Max91
  • Topic Starter

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:11:22 PM

Posted 26 April 2009 - 12:13 AM

I have a problem. After downloading Java installed (Version 6 Update 13). The Kaspersky Online Scanner 7.0 still says i don't have at least Ver.1.5 for Java. So because of that i cant run the Online Scan. Maybe i've done something wrong? Wrong step maybe?

#8 JSntgRvr

JSntgRvr

    Master Surgeon General


  • Malware Response Team
  • 11,693 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto Rico
  • Local time:11:22 AM

Posted 26 April 2009 - 05:15 PM

As an alternate scan, please run a free online scan with the ESET Online Scanner
Note: You will need to use Internet Explorer for this scan
  • Tick the box next to YES, I accept the Terms of Use
  • Click Start
  • When asked, allow the ActiveX control to install
  • Click Start
  • Make sure that the options Remove found threats and the option Scan unwanted applications is checked
  • Click Scan (This scan can take several hours, so please be patient)
  • Once the scan is completed, you may close the window
  • Use Notepad to open the logfile located at C:\Program Files\EsetOnlineScanner\log.txt
  • Copy and paste that log as a reply to this topic

No request for help throughout private messaging will be attended.

If I have helped you, consider making a donation to help me continue the fight against Malware!
btn_donate_SM.gif


#9 JSntgRvr

JSntgRvr

    Master Surgeon General


  • Malware Response Team
  • 11,693 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto Rico
  • Local time:11:22 AM

Posted 02 May 2009 - 10:29 AM

Due to lack of feedback, this topic has been closed.

If you need this topic reopened, please contact a staff member with address of this thread. This applies only to the original topic starter. Everyone else please begin a New Topic.

No request for help throughout private messaging will be attended.

If I have helped you, consider making a donation to help me continue the fight against Malware!
btn_donate_SM.gif





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users