Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

winpc defender, UACeybwdqbs.dll, and others


  • This topic is locked This topic is locked
7 replies to this topic

#1 alexhawz

alexhawz

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:05:55 PM

Posted 15 April 2009 - 07:47 PM

I am working on my friends computer, and her roommate downloaded i believe winpc defender. I have attempted (and failed) to install spybot S&D (it wont turn on, other than teatimer, which lags the system down), installed avg free, and lavasoft adaware free. the installed programs are current as of monday 4/13. i have run adaware and avg in safemode with networking enabled and normal windows, and both programs have found and attempted to remove several infections. i have a copy of ag's last safemode scan called avgrep.txt available. i hae taskmanager running and a copy of iexplore.exe randomly opens and sucks up about 32 MB of memory and a little bit of processing. i have done what i can, and would appreciate any help you can give me. dds follows and attach.zip, is...:


DDS (Ver_09-03-16.01) - NTFSx86
Run by GW2K at 19:29:07.82 on Wed 04/15/2009
Internet Explorer: 7.0.5730.13 BrowserJavaVersion: 1.6.0_13

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.ask.com/?o=101676&l=dis
uSearch Page =
uSearch Bar =
mDefault_Page_URL = hxxp://www.yahoo.com/
mDefault_Search_URL = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr9/*http://www.yahoo.com
mSearch Page = hxxp://us.rd.yahoo.com/customize/ie/defaults/sp/msgr9/*http://www.yahoo.com
mStart Page = hxxp://www.yahoo.com/
mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr9/*http://www.yahoo.com/ext/search/search.html
uInternet Connection Wizard,ShellNext = iexplore
uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr9/*http://www.yahoo.com
mSearchAssistant =
uURLSearchHooks: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\progra~1\yahoo!\companion\installs\cpn1\yt.dll
BHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\progra~1\yahoo!\companion\installs\cpn1\yt.dll
BHO: Gamevance: {0ed403e8-470a-4a8a-85a4-d7688cfe39a3} - c:\program files\gamevance\gamevancelib32.dll
BHO: AskBar BHO: {201f27d4-3704-41d6-89c1-aa35e39143ed} - c:\program files\askbardis\bar\bin\askBar.dll
BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - c:\program

files\real\realplayer\rpbrowserrecordplugin.dll
BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg8\avgssie.dll
BHO: AVG Security Toolbar: {a057a204-bacc-4d26-9990-79a187e2698e} - c:\progra~1\avg\avg8\AVGTOO~1.DLL
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program

files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
BHO: SingleInstance Class: {fdad4da1-61a2-4fd8-9c17-86f7ac245081} -

c:\progra~1\yahoo!\companion\installs\cpn1\YTSingleInstance.dll
TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\progra~1\yahoo!\companion\installs\cpn1\yt.dll
TB: Ask Toolbar: {3041d03e-fd4b-44e0-b742-2d9b88305f98} - c:\program files\askbardis\bar\bin\askBar.dll
TB: AVG Security Toolbar: {a057a204-bacc-4d26-9990-79a187e2698e} - c:\progra~1\avg\avg8\AVGTOO~1.DLL
TB: {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - No File
TB: {604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - No File
TB: {D0523BB4-21E7-11DD-9AB7-415B56D89593} - No File
EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File
uRun: [OM2_Monitor] "c:\program files\olympus\olympus master 2\MMonitor.exe" -NoStart
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
mRun: [CommunityTray] "c:\program files\vtech\community\system\Startup.exe"
mRun: [HP Software Update] c:\program files\hp\hp software update\HPWuSchd2.exe
mRun: [OM2_Monitor] "c:\program files\olympus\olympus master 2\FirstStart.exe" /OM
mRun: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
mRun: [Ad-Watch] c:\program files\lavasoft\ad-aware\AAWTray.exe
mRun: [AVG8_TRAY] c:\progra~1\avg\avg8\avgtray.exe
dRunOnce: [RunNarrator] Narrator.exe
IE: {53F6FCCD-9E22-4d71-86EA-6E43136192AB}
IE: {925DAB62-F9AC-4221-806A-057BFB1014AA}
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
DPF: DirectAnimation Java Classes - file://c:\windows\java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\java\classes\xmldso.cab
DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://go.microsoft.com/fwlink/?linkid=39204
DPF: {33564D57-0000-0010-8000-00AA00389B71} -

hxxp://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} -

hxxp://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1187053236302
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab
DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg8\avgpp.dll
Notify: avgrsstarter - avgrsstx.dll
AppInit_DLLs: c:\program,files\relevantknowledge\rlai.dll,c:\program files\relevantknowledge\rlai.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\gw2k\applic~1\mozilla\firefox\profiles\rp1tom21.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.yahoo.com/search?fr=ffsp1&p=
FF - prefs.js: browser.search.selectedEngine - MyWebSearch
FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com/
FF - prefs.js: keyword.URL -

hxxp://www.mywebsearch.com/jsp/cfg_redir2.jsp?id=ZRfox000&fl=0&ptb=q89itiVGC8mAb0ObDEohtg&st=kwd&o=kwd&url=http://edits.m

ywebsearch.com/toolbaredits/barsearch.jhtml&searchfor=
FF - component: c:\program files\avg\avg8\firefox\components\avgssff.dll
FF - component: c:\program files\avg\avg8\toolbarff\components\vmAVGConnector.dll
FF - component: c:\program files\real\realplayer\browserrecord\components\nprpbrowserrecordplugin.dll

---- FIREFOX POLICIES ----

pref(dom.disable_open_during_load, false);
============= SERVICES / DRIVERS ===============


=============== Created Last 30 ================

2009-04-09 20:56 <DIR> --d-h--- C:\$AVG8.VAULT$
2009-04-09 20:43 10,520 a------- c:\windows\system32\avgrsstx.dll
2009-04-09 20:43 108,552 a------- c:\windows\system32\drivers\avgtdix.sys
2009-04-09 20:42 325,640 a------- c:\windows\system32\drivers\avgldx86.sys
2009-04-09 20:42 <DIR> --d----- c:\windows\system32\drivers\Avg
2009-04-09 20:42 <DIR> --d----- c:\docume~1\gw2k\applic~1\AVGTOOLBAR
2009-04-09 20:42 <DIR> --d----- c:\program files\AVG
2009-04-09 20:42 <DIR> --d----- c:\docume~1\alluse~1\applic~1\avg8
2009-04-09 20:38 15,688 a------- c:\windows\system32\lsdelete.exe
2009-04-09 19:51 64,160 a------- c:\windows\system32\drivers\Lbd.sys
2009-04-09 19:50 <DIR> -cd-h--- c:\docume~1\alluse~1\applic~1\{7972B2E5-3E09-4E5E-81B7-FE5819D6772F}
2009-04-09 19:49 <DIR> --d----- c:\program files\Lavasoft
2009-04-08 19:29 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Spybot - Search & Destroy
2009-04-08 19:19 <DIR> --d----- c:\windows\pss
2009-04-07 20:58 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Ascentive
2009-03-24 13:43 <DIR> --d----- c:\program files\common files\muvee Technologies
2009-03-24 13:42 626,688 a----r-- c:\windows\system32\msvcr80.dll
2009-03-24 13:42 95,744 a----r-- c:\windows\system32\atl80.dll
2009-03-24 13:42 548,864 a----r-- c:\windows\system32\msvcp80.dll
2009-03-24 13:42 1,079,808 a----r-- c:\windows\system32\mfc80u.dll
2009-03-24 13:37 <DIR> --d----- c:\program files\OLYMPUS
2009-03-19 15:08 <DIR> --d----- c:\docume~1\gw2k\applic~1\GetRightToGo

==================== Find3M ====================

2009-04-09 19:37 1,744 a------- c:\windows\system32\d3d9caps.dat
2009-03-19 17:35 1,632 a------- c:\windows\system32\d3d8caps.dat
2009-03-09 05:19 410,984 a------- c:\windows\system32\deploytk.dll
2009-02-09 06:13 1,846,784 a------- c:\windows\system32\win32k.sys
2008-01-22 17:53 270 ac------ c:\docume~1\gw2k\applic~1\wklnhst.dat
2008-12-18 19:42 32,768 ac-sh--- c:\windows\system32\config\systemprofile\local

settings\history\history.ie5\mshist012008121820081219\index.dat

============= FINISH: 19:31:36.44 ===============

Attached Files



BC AdBot (Login to Remove)

 


#2 fenzodahl512

fenzodahl512

  • Members
  • 6,738 posts
  • OFFLINE
  •  
  • Local time:06:55 AM

Posted 17 April 2009 - 07:15 AM

Please download SDFix by Andy Manchesta and save it to your desktop.
Double click SDFix.exe and it will extract the files to %systemdrive%
(Drive that contains the Windows Directory, typically C:\SDFix)

Please reboot into Safe Mode
  • In Safe Mode, right click the SDFix.zip folder and choose Extract All,
  • A new folder will be extracted to your %systemdrive%, typically C:\SDFix
  • Open the extracted folder and double click RunThis.bat to start the script.
  • Type Y to begin the script.
  • It will remove the Trojan Services then make some repairs to the registry and prompt you to press any key to Reboot.
  • Press any Key and it will restart the PC.
  • Your system will take longer that normal to restart as the fixtool will be running and removing files.
  • When the desktop loads the Fixtool will complete the removal and display Finished, then press any key to end the script and load your desktop icons.
  • Finally open the SDFix folder on your desktop and copy and paste the contents of the results file Report.txt along with any other requested logs at the end of these instructions.




NEXT


Please make sure you disable ALL of your Antivirus/Antispyware/Firewall before running ComboFix.. Please visit HERE if you don't know how.. Please re-enable them back after performing all steps given..

Please download ComboFix by sUBs from one of the locations below, and save it to your Desktop.

Link 1
Link 2
Link 3

Double click combofix.exe and follow the prompts. Please, never rename Combofix unless instructed.

If ComboFix asked you to install Recovery Console, please do so.. It will be your best interest..

When finished, it shall produce a log for you. Post that log and a fresh HijackThis log in your next reply..

Note: DO NOT mouseclick combofix's window while its running. That may cause it to stall




Please post these logs in your next reply... Post each log in separate post

1. SDFix
2. ComboFix
3. A fresh HijackThis log

Keep calm, make it simple, use your brain, don't freak out, and you'll be just fine..
Awesomeness: When I get sad, I stop being sad and be awesome instead.. True story - Barney Stinson
Posted Image Posted Image
Its gonna be legen.. wait for it.. dary! Cherish the pain, it means you're still alive


#3 alexhawz

alexhawz
  • Topic Starter

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:05:55 PM

Posted 20 April 2009 - 07:29 PM

I apologize for the late reply, as I did not have access to the computer over the weekend.

SDFix.exe failed to start in normal mode and safe mode. Task Manager showed it running and then it stopped with no apparent effect (no directories created, no windows popped up) in both modes. The same happened with ComboFix.exe in normal mode. Notes on ComboFix are constant memory usage of 2,408 k memory usage with 1% or less processor usage. the following HJT log is with windows firewall, AVG8 and Adaware all still disabled.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:23:06 PM, on 4/20/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16827)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Program Files\VTech\Community\System\PCTray.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\AVG\AVG8\avgcsrvx.exe
C:\Program Files\AVG\AVG8\aAvgApi.exe
C:\WINDOWS\system32\taskmgr.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Internet Explorer\Iexplore.exe
C:\hjt\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.ask.com/?o=101676&l=dis
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://us.rd.yahoo.com/customize/ie/defaul...//www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul...rch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaul...//www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaul...//www.yahoo.com
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn1\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn1\yt.dll
O2 - BHO: Gamevance - {0ED403E8-470A-4a8a-85A4-D7688CFE39A3} - C:\Program Files\Gamevance\gamevancelib32.dll (file missing)
O2 - BHO: AskBar BHO - {201f27d4-3704-41d6-89c1-aa35e39143ed} - C:\Program Files\AskBarDis\bar\bin\askBar.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn1\YTSingleInstance.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn1\yt.dll
O3 - Toolbar: Ask Toolbar - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Program Files\AskBarDis\bar\bin\askBar.dll
O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O4 - HKLM\..\Run: [CommunityTray] "C:\Program Files\VTech\Community\System\Startup.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [OM2_Monitor] "C:\Program Files\OLYMPUS\OLYMPUS Master 2\FirstStart.exe" /OM
O4 - HKLM\..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [OM2_Monitor] "C:\Program Files\OLYMPUS\OLYMPUS Master 2\MMonitor.exe" -NoStart
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')
O9 - Extra button: (no name) - {53F6FCCD-9E22-4d71-86EA-6E43136192AB} - (no file)
O9 - Extra button: (no name) - {925DAB62-F9AC-4221-806A-057BFB1014AA} - (no file)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd...b?1187053236302
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: c:\program,files\relevantknowledge\rlai.dll,C:\program files\relevantknowledge\rlai.dll
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: LXDDCustomerConnect - Unknown owner - C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\\LXDDserv.exe (file missing)

--
End of file - 6806 bytes

#4 fenzodahl512

fenzodahl512

  • Members
  • 6,738 posts
  • OFFLINE
  •  
  • Local time:06:55 AM

Posted 20 April 2009 - 10:59 PM

rename ComboFix to Combo-Fun and run it.. Post the log here..

Edited by fenzodahl512, 20 April 2009 - 11:58 PM.
edit instruction

Keep calm, make it simple, use your brain, don't freak out, and you'll be just fine..
Awesomeness: When I get sad, I stop being sad and be awesome instead.. True story - Barney Stinson
Posted Image Posted Image
Its gonna be legen.. wait for it.. dary! Cherish the pain, it means you're still alive


#5 alexhawz

alexhawz
  • Topic Starter

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:05:55 PM

Posted 21 April 2009 - 08:01 PM

ComboFix informed me of rootkit activity, advised me to write it down, and is available on request. Log follows:

ComboFix 09-04-22.02 - GW2K 04/21/2009 19:28.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.256.39 [GMT -5:00]
Running from: c:\documents and settings\GW2K\Desktop\Combo-Fun.exe
AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated)
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\GW2K\Application Data\FunWebProducts
c:\documents and settings\GW2K\Application Data\FunWebProducts\Data\GW2K\avatar.dat
c:\program files\FunWebProducts
c:\program files\FunWebProducts\ScreenSaver\Images\09CA60BC.urr
c:\program files\FunWebProducts\ScreenSaver\Images\09CD4B0B.urr
c:\program files\FunWebProducts\ScreenSaver\Images\09CD843C.dat
c:\program files\FunWebProducts\ScreenSaver\Images\09D012F7.dat
c:\program files\FunWebProducts\ScreenSaver\Images\09DB956D.dat
c:\program files\FunWebProducts\ScreenSaver\Images\09DD2D98.dat
c:\program files\FunWebProducts\ScreenSaver\Images\wrkparam.lst
c:\program files\MyWebSearch
c:\program files\MyWebSearch\bar\History\search2
c:\program files\MyWebSearch\bar\History\search3
c:\program files\MyWebSearch\bar\Settings\s_pid.dat
c:\program files\XLGuarder
c:\program files\XLGuarder\gagent.exe
c:\windows\IE4 Error Log.txt
c:\windows\system32\drivers\UACxthemrst.sys
c:\windows\system32\rU024b2R.exe.a_a
c:\windows\system32\UACcpkkyvbx.log
c:\windows\system32\UACeybwdqbs.dll
c:\windows\system32\UAChogmyxvi.dll
c:\windows\system32\uacinit.dll
c:\windows\system32\UACiojroexn.log
c:\windows\system32\UACnkvybqvp.dll
c:\windows\system32\UACnqwwoewx.dll
c:\windows\system32\UACnsrumfxw.dll
c:\windows\system32\UACqxxptcqd.log
c:\windows\system32\UACvonqjwmt.dat

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_UACd.sys


((((((((((((((((((((((((( Files Created from 2009-03-22 to 2009-04-22 )))))))))))))))))))))))))))))))
.

2009-04-18 14:07 . 2009-04-18 14:07 118 ----a-w c:\windows\system32\MRT.INI
2009-04-16 01:02 . 2009-04-21 00:23 -------- d-----w C:\hjt
2009-04-15 12:22 . 2009-03-06 14:22 284160 -c----w c:\windows\system32\dllcache\pdh.dll
2009-04-15 12:22 . 2009-02-09 12:10 401408 -c----w c:\windows\system32\dllcache\rpcss.dll
2009-04-15 12:22 . 2009-02-06 11:11 110592 -c----w c:\windows\system32\dllcache\services.exe
2009-04-15 12:22 . 2009-02-09 12:10 473600 -c----w c:\windows\system32\dllcache\fastprox.dll
2009-04-15 12:22 . 2009-02-06 10:10 227840 -c----w c:\windows\system32\dllcache\wmiprvse.exe
2009-04-15 12:22 . 2009-02-09 12:10 453120 -c----w c:\windows\system32\dllcache\wmiprvsd.dll
2009-04-15 12:22 . 2009-02-09 12:10 729088 -c----w c:\windows\system32\dllcache\lsasrv.dll
2009-04-15 12:22 . 2009-02-09 12:10 617472 -c----w c:\windows\system32\dllcache\advapi32.dll
2009-04-15 12:22 . 2009-02-09 12:10 714752 -c----w c:\windows\system32\dllcache\ntdll.dll
2009-04-15 12:19 . 2008-05-03 11:55 2560 ------w c:\windows\system32\xpsp4res.dll
2009-04-15 12:19 . 2009-03-27 06:58 1203922 -c----w c:\windows\system32\dllcache\sysmain.sdb
2009-04-15 12:19 . 2008-04-21 12:08 215552 -c----w c:\windows\system32\dllcache\wordpad.exe
2009-04-10 01:56 . 2009-04-21 07:16 -------- d--h--w C:\$AVG8.VAULT$
2009-04-10 01:43 . 2009-04-10 01:43 10520 ----a-w c:\windows\system32\avgrsstx.dll
2009-04-10 01:43 . 2009-04-10 01:43 108552 ----a-w c:\windows\system32\drivers\avgtdix.sys
2009-04-10 01:42 . 2009-04-10 01:42 325640 ----a-w c:\windows\system32\drivers\avgldx86.sys
2009-04-10 01:42 . 2009-04-21 13:05 -------- d-----w c:\windows\system32\drivers\Avg
2009-04-10 01:42 . 2009-04-15 13:14 -------- d-----w c:\documents and settings\GW2K\Application Data\AVGTOOLBAR
2009-04-10 01:42 . 2009-04-10 01:42 -------- d-----w c:\documents and settings\All Users\Application Data\avg8
2009-04-10 01:38 . 2009-03-09 19:06 15688 ----a-w c:\windows\system32\lsdelete.exe
2009-04-10 00:51 . 2009-03-09 19:06 64160 ----a-w c:\windows\system32\drivers\Lbd.sys
2009-04-10 00:50 . 2009-04-10 00:50 -------- dc-h--w c:\documents and settings\All Users\Application Data\{7972B2E5-3E09-4E5E-81B7-FE5819D6772F}
2009-04-09 00:47 . 2009-04-10 00:49 -------- d-----w c:\documents and settings\All Users\Application Data\Lavasoft
2009-04-09 00:29 . 2009-04-10 01:17 -------- d-----w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-04-09 00:22 . 2009-04-09 00:22 -------- d-----w c:\documents and settings\Administrator\Local Settings\Application Data\Mozilla
2009-04-08 01:58 . 2009-04-08 01:58 -------- d-----w c:\documents and settings\All Users\Application Data\Ascentive
2009-03-24 23:55 . 2009-03-24 23:55 -------- d-----w c:\documents and settings\GW2K\Application Data\Apple Computer
2009-03-24 22:58 . 2009-03-24 22:58 -------- d-----w c:\documents and settings\GW2K\Local Settings\Application Data\Apple Computer
2009-03-24 18:42 . 2009-03-24 18:42 -------- d-----w c:\documents and settings\GW2K\Local Settings\Application Data\OLYMPUS
2009-03-24 18:42 . 2007-02-08 19:30 626688 ----a-r c:\windows\system32\msvcr80.dll
2009-03-24 18:42 . 2007-02-08 19:30 95744 ----a-r c:\windows\system32\atl80.dll
2009-03-24 18:42 . 2007-02-08 19:30 548864 ----a-r c:\windows\system32\msvcp80.dll
2009-03-24 18:42 . 2007-02-08 19:30 1079808 ----a-r c:\windows\system32\mfc80u.dll
2009-03-24 18:39 . 2009-04-07 18:51 -------- d-----w c:\documents and settings\All Users\Application Data\Apple Computer

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-04-22 00:42 . 2009-04-10 01:50 11717 ----a-w C:\aaw7boot.log
2009-04-20 18:21 . 2007-10-06 22:37 -------- d-----w c:\documents and settings\GW2K\Application Data\LimeWire
2009-04-20 18:19 . 2007-10-14 03:08 1744 ----a-w c:\windows\system32\d3d9caps.dat
2009-04-16 13:51 . 2007-10-06 22:29 -------- d-----w c:\program files\LimeWire
2009-04-10 02:17 . 2009-02-03 20:26 -------- d-----w c:\program files\Incomplete
2009-04-10 01:42 . 2009-04-10 01:42 -------- d-----w c:\program files\AVG
2009-04-10 00:49 . 2009-04-10 00:49 -------- d-----w c:\program files\Lavasoft
2009-04-07 18:53 . 2007-10-13 20:01 -------- d-----w c:\program files\Yahoo! Games
2009-04-07 18:52 . 2009-02-20 02:20 -------- d-----w c:\program files\NOS
2009-04-07 18:47 . 2007-10-06 22:31 -------- d-----w c:\program files\Java
2009-04-07 17:22 . 2009-04-07 17:22 0 ----a-w c:\documents and settings\GW2K\Application Data\~eu37.tmp
2009-04-07 00:38 . 2009-01-28 16:56 -------- d-----w c:\documents and settings\GW2K\Application Data\FrostWire
2009-04-02 13:38 . 2009-02-05 17:51 -------- d-----w c:\program files\My.Freeze.com Toolbar
2009-04-02 13:36 . 2009-02-18 23:10 -------- d-----w c:\program files\MumboJumbo
2009-03-24 18:44 . 2009-03-24 18:43 -------- d-----w c:\program files\Common Files\muvee Technologies
2009-03-24 18:37 . 2009-03-24 18:37 -------- d-----w c:\program files\OLYMPUS
2009-03-21 06:51 . 2009-03-19 20:08 -------- d-----w c:\documents and settings\GW2K\Application Data\GetRightToGo
2009-03-20 22:18 . 2009-02-20 02:20 -------- d-----w c:\documents and settings\All Users\Application Data\NOS
2009-03-19 22:49 . 2009-02-18 23:23 -------- d-----w c:\program files\Selectsoft
2009-03-19 22:35 . 2007-08-30 18:39 1632 ----a-w c:\windows\system32\d3d8caps.dat
2009-03-09 10:19 . 2008-11-23 14:38 410984 ----a-w c:\windows\system32\deploytk.dll
2009-03-06 14:22 . 2003-04-15 13:00 284160 ----a-w c:\windows\system32\pdh.dll
2009-03-03 00:18 . 2006-06-23 16:33 826368 ----a-w c:\windows\system32\wininet.dll
2009-02-20 18:09 . 2004-08-04 07:56 78336 ----a-w c:\windows\system32\ieencode.dll
2009-02-09 12:10 . 2003-04-15 13:00 729088 ----a-w c:\windows\system32\lsasrv.dll
2009-02-09 12:10 . 2005-07-26 04:31 401408 ----a-w c:\windows\system32\rpcss.dll
2009-02-09 12:10 . 2003-04-15 13:00 714752 ----a-w c:\windows\system32\ntdll.dll
2009-02-09 12:10 . 2003-04-15 13:00 617472 ----a-w c:\windows\system32\advapi32.dll
2009-02-09 11:13 . 2003-04-15 13:00 1846784 ----a-w c:\windows\system32\win32k.sys
2009-02-08 00:02 . 2002-08-29 01:04 2066048 ----a-w c:\windows\system32\ntkrnlpa.exe
2009-02-06 11:11 . 2003-04-15 13:00 110592 ----a-w c:\windows\system32\services.exe
2009-02-06 11:08 . 2003-04-15 13:00 2189056 ----a-w c:\windows\system32\ntoskrnl.exe
2009-02-06 10:39 . 2003-04-15 13:00 35328 ----a-w c:\windows\system32\sc.exe
2009-02-03 19:59 . 2003-04-15 13:00 56832 ----a-w c:\windows\system32\secur32.dll
2009-01-15 00:04 . 2007-08-15 16:55 51192 -c--a-w c:\documents and settings\GW2K\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2008-01-22 22:53 . 2007-08-14 15:16 270 -c--a-w c:\documents and settings\GW2K\Application Data\wklnhst.dat
2007-12-11 22:44 . 2007-12-11 22:44 192516 -c--a-w c:\documents and settings\All Users\SPL16.tmp
2007-12-11 06:31 . 2007-12-11 06:31 2475286 -c--a-w c:\documents and settings\All Users\SPL10.tmp
2007-12-10 19:26 . 2007-12-10 19:26 2475286 -c--a-w c:\documents and settings\All Users\SPL19.tmp
2007-12-09 23:02 . 2007-12-09 23:02 2553047 -c--a-w c:\documents and settings\All Users\SPLC9.tmp
2007-12-08 18:17 . 2007-12-08 18:17 1376137 -c--a-w c:\documents and settings\All Users\SPL51.tmp
2007-10-07 03:21 . 2007-10-07 03:20 6635520 -c--a-w c:\documents and settings\All Users\SPL14.tmp
2007-09-06 00:57 . 2007-09-06 00:57 943250 -c--a-w c:\documents and settings\All Users\SPLF.tmp
2007-09-05 23:31 . 2007-09-05 23:31 943250 -c--a-w c:\documents and settings\All Users\SPLE.tmp
2007-09-05 18:52 . 2007-09-05 18:52 943250 -c--a-w c:\documents and settings\All Users\SPLD.tmp
2007-09-05 17:20 . 2007-09-05 17:20 898662 -c--a-w c:\documents and settings\All Users\SPLC.tmp
2007-09-05 15:46 . 2007-09-05 15:46 898662 -c--a-w c:\documents and settings\All Users\SPLB.tmp
2007-09-05 15:25 . 2007-09-05 15:25 898662 -c--a-w c:\documents and settings\All Users\SPLA.tmp
2007-09-05 02:18 . 2007-09-05 02:18 898662 -c--a-w c:\documents and settings\All Users\SPL9.tmp
2007-09-05 00:49 . 2007-09-05 00:49 150393 -c--a-w c:\documents and settings\All Users\SPL8.tmp
2007-09-05 00:42 . 2007-09-05 00:42 150393 -c--a-w c:\documents and settings\All Users\SPL6.tmp
2007-09-02 18:35 . 2007-09-02 18:35 253675 -c--a-w c:\documents and settings\All Users\SPL5.tmp
2007-09-02 18:21 . 2007-09-02 18:21 253675 -c--a-w c:\documents and settings\All Users\SPL3.tmp
2007-09-02 18:09 . 2007-09-02 18:09 253675 -c--a-w c:\documents and settings\All Users\SPL1D.tmp
2007-09-02 01:30 . 2007-09-02 01:30 1614181 -c--a-w c:\documents and settings\All Users\SPL2.tmp
2007-09-01 23:55 . 2007-09-01 23:55 1614181 -c--a-w c:\documents and settings\All Users\SPL1.tmp
2007-08-31 14:25 . 2007-08-31 14:25 253675 -c--a-w c:\documents and settings\All Users\SPL20.tmp
2007-08-26 20:28 . 2007-08-26 20:28 15728521 -c--a-w c:\documents and settings\All Users\SPL13.tmp
2007-08-26 20:02 . 2007-08-26 20:02 1448384 -c--a-w c:\documents and settings\All Users\SPL7.tmp
2007-08-26 19:08 . 2007-08-26 19:08 1491045 -c--a-w c:\documents and settings\All Users\SPL4.tmp
2008-12-19 00:42 . 2008-12-19 00:43 32768 -csha-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012008121820081219\index.dat
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{201f27d4-3704-41d6-89c1-aa35e39143ed}]
2008-07-17 23:20 279944 ----a-w c:\program files\AskBarDis\bar\bin\askBar.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{3041d03e-fd4b-44e0-b742-2d9b88305f98}"= "c:\program files\AskBarDis\bar\bin\askBar.dll" [2008-07-17 279944]

[HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}]
[HKEY_CLASSES_ROOT\TypeLib\{4b1c1e16-6b34-430e-b074-5928eca4c150}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{3041D03E-FD4B-44E0-B742-2D9B88305F98}"= "c:\program files\AskBarDis\bar\bin\askBar.dll" [2008-07-17 279944]

[HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}]
[HKEY_CLASSES_ROOT\TypeLib\{4b1c1e16-6b34-430e-b074-5928eca4c150}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"OM2_Monitor"="c:\program files\OLYMPUS\OLYMPUS Master 2\MMonitor.exe" [2007-09-04 95536]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CommunityTray"="c:\program files\VTech\Community\System\Startup.exe" [2008-03-15 11776]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-03-12 49152]
"OM2_Monitor"="c:\program files\OLYMPUS\OLYMPUS Master 2\FirstStart.exe" [2007-09-04 54576]
"Ad-Watch"="c:\program files\Lavasoft\Ad-Aware\AAWTray.exe" [2009-03-09 515416]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-04-10 1932568]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-01-15 185872]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"RunNarrator"="Narrator.exe" - c:\windows\system32\narrator.exe [2008-04-14 53760]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-04-10 01:43 10520 ----a-w c:\windows\system32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^GW2K^Start Menu^Programs^Startup^FrostWire On Startup.lnk]
path=c:\documents and settings\GW2K\Start Menu\Programs\Startup\FrostWire On Startup.lnk
backup=c:\windows\pss\FrostWire On Startup.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgemc.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgnsx.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\VTech\\Community\\System\\PCTray.exe"=

R2 LXDDCustomerConnect;LXDDCustomerConnect; [x]
R3 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [2009-03-09 951632]
S0 Lbd;Lbd;c:\windows\system32\DRIVERS\Lbd.sys [2009-03-09 64160]
S1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\System32\Drivers\avgldx86.sys [2009-04-10 325640]
S1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\System32\Drivers\avgtdix.sys [2009-04-10 108552]
S2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [2009-04-10 908056]
S2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2009-04-10 298264]


[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
Contents of the 'Scheduled Tasks' folder

2009-04-21 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-03-09 19:06]
.
- - - - ORPHANS REMOVED - - - -

BHO-{0ED403E8-470A-4a8a-85A4-D7688CFE39A3} - c:\program files\Gamevance\gamevancelib32.dll
WebBrowser-{604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - (no file)
WebBrowser-{D0523BB4-21E7-11DD-9AB7-415B56D89593} - (no file)


.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.ask.com/?o=101676&l=dis
mStart Page = hxxp://www.yahoo.com/
mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr9/*http://www.yahoo.com/ext/search/search.html
uInternet Connection Wizard,ShellNext = iexplore
uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr9/*http://www.yahoo.com
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
FF - ProfilePath - c:\documents and settings\GW2K\Application Data\Mozilla\Firefox\Profiles\rp1tom21.default\
FF - component: c:\program files\AVG\AVG8\Firefox\components\avgssff.dll
FF - component: c:\program files\AVG\AVG8\ToolbarFF\components\vmAVGConnector.dll
FF - component: c:\program files\Real\RealPlayer\browserrecord\components\nprpbrowserrecordplugin.dll

---- FIREFOX POLICIES ----

pref(dom.disable_open_during_load, false);.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-04-21 19:43
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(3576)
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\AVG\AVG8\avgrsx.exe
c:\progra~1\AVG\AVG8\avgnsx.exe
c:\program files\AVG\AVG8\avgcsrvx.exe
c:\program files\VTech\Community\System\PCTray.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2009-04-22 19:50 - machine was rebooted
ComboFix-quarantined-files.txt 2009-04-22 00:50

Pre-Run: 8,177,577,984 bytes free
Post-Run: 8,812,736,512 bytes free

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /fastdetect /NoExecute=OptIn

270 --- E O F --- 2009-04-18 14:09


Updated HJT log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:57:34 PM, on 4/21/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16827)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\Program Files\AVG\AVG8\avgcsrvx.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\VTech\Community\System\PCTray.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\hjt\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.ask.com/?o=101676&l=dis
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul...rch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaul...//www.yahoo.com
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn1\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn1\yt.dll
O2 - BHO: AskBar BHO - {201f27d4-3704-41d6-89c1-aa35e39143ed} - C:\Program Files\AskBarDis\bar\bin\askBar.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn1\YTSingleInstance.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn1\yt.dll
O3 - Toolbar: Ask Toolbar - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Program Files\AskBarDis\bar\bin\askBar.dll
O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O4 - HKLM\..\Run: [CommunityTray] "C:\Program Files\VTech\Community\System\Startup.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [OM2_Monitor] "C:\Program Files\OLYMPUS\OLYMPUS Master 2\FirstStart.exe" /OM
O4 - HKLM\..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [OM2_Monitor] "C:\Program Files\OLYMPUS\OLYMPUS Master 2\MMonitor.exe" -NoStart
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')
O9 - Extra button: (no name) - {53F6FCCD-9E22-4d71-86EA-6E43136192AB} - (no file)
O9 - Extra button: (no name) - {925DAB62-F9AC-4221-806A-057BFB1014AA} - (no file)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd...b?1187053236302
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: LXDDCustomerConnect - Unknown owner - C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\\LXDDserv.exe (file missing)

--
End of file - 6325 bytes

#6 fenzodahl512

fenzodahl512

  • Members
  • 6,738 posts
  • OFFLINE
  •  
  • Local time:06:55 AM

Posted 22 April 2009 - 12:19 AM

Uninstall Ask Toolbar if you don't use it..

Please download the OTMoveIt3 by OldTimer
  • Save it to your Desktop.
  • Please double-click OTMoveIt3.exe to run it. (Vista users, please right click on OTMoveit3.exe and select "Run as an Administrator")
  • Let the Unregister Dll's and Ocx's remain ticked and Zip Files After Moves remain unticked..
  • Copy the codebox contents and paste it to the "Paste List of Files/Folders to Move" window (under the light Yellow bar)

    :processes
    explorer.exe
    
    :files
    c:\documents and settings\All Users\SPL*.tmp
    
    :commands
    [purity]
    [emptytemp]
    [start explorer]
    [reboot]
  • Click the red Moveit! button.
  • A log of files and folders moved will be created in the c:\_OTMoveIt\MovedFiles folder in the form of Date and Time (mmddyyyy_hhmmss.log). Please open this log in Notepad and post its contents in your next reply.
  • Close OTMoveIt3
If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes.




Please run a free online scan with the ESET Online Scanner
Note: You will need to use Internet Explorer for this scan.
  • Tick the box next to YES, I accept the Terms of Use.
  • Click Start
  • When asked, allow the ActiveX control to install
  • Click Start
  • Make sure that the options Remove found threats and the option Scan unwanted applications is checked
  • Click Scan
    Wait for the scan to finish
  • Use Notepad to open the logfile located at C:\Program Files\EsetOnlineScanner\log.txt
  • Copy and paste that log as a reply to this topic

Post me these logs in your next reply..

1. OTMoveIt3
2. ESET Online Scanner
3. How's the computer now? :thumbup2:

Keep calm, make it simple, use your brain, don't freak out, and you'll be just fine..
Awesomeness: When I get sad, I stop being sad and be awesome instead.. True story - Barney Stinson
Posted Image Posted Image
Its gonna be legen.. wait for it.. dary! Cherish the pain, it means you're still alive


#7 alexhawz

alexhawz
  • Topic Starter

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:05:55 PM

Posted 23 April 2009 - 06:27 PM

MoveIt log:

========== PROCESSES ==========
Process explorer.exe killed successfully.
========== FILES ==========
c:\documents and settings\All Users\SPL1.tmp moved successfully.
c:\documents and settings\All Users\SPL10.tmp moved successfully.
c:\documents and settings\All Users\SPL13.tmp moved successfully.
c:\documents and settings\All Users\SPL14.tmp moved successfully.
c:\documents and settings\All Users\SPL16.tmp moved successfully.
c:\documents and settings\All Users\SPL19.tmp moved successfully.
c:\documents and settings\All Users\SPL1D.tmp moved successfully.
c:\documents and settings\All Users\SPL2.tmp moved successfully.
c:\documents and settings\All Users\SPL20.tmp moved successfully.
c:\documents and settings\All Users\SPL3.tmp moved successfully.
c:\documents and settings\All Users\SPL4.tmp moved successfully.
c:\documents and settings\All Users\SPL5.tmp moved successfully.
c:\documents and settings\All Users\SPL51.tmp moved successfully.
c:\documents and settings\All Users\SPL6.tmp moved successfully.
c:\documents and settings\All Users\SPL7.tmp moved successfully.
c:\documents and settings\All Users\SPL8.tmp moved successfully.
c:\documents and settings\All Users\SPL9.tmp moved successfully.
c:\documents and settings\All Users\SPLA.tmp moved successfully.
c:\documents and settings\All Users\SPLB.tmp moved successfully.
c:\documents and settings\All Users\SPLC.tmp moved successfully.
c:\documents and settings\All Users\SPLC9.tmp moved successfully.
c:\documents and settings\All Users\SPLD.tmp moved successfully.
c:\documents and settings\All Users\SPLE.tmp moved successfully.
c:\documents and settings\All Users\SPLF.tmp moved successfully.
========== COMMANDS ==========
File delete failed. C:\DOCUME~1\GW2K\LOCALS~1\Temp\etilqs_Mn0Jtv0krvDKdBfyJDMY scheduled to be deleted on reboot.
User's Temp folder emptied.
User's Internet Explorer cache folder emptied.
File delete failed. C:\Documents and Settings\GW2K\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
User's Temporary Internet Files folder emptied.
Local Service Temp folder emptied.
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
Local Service Temporary Internet Files folder emptied.
Network Service Temp folder emptied.
Network Service Temporary Internet Files folder emptied.
File delete failed. C:\WINDOWS\temp\Perflib_Perfdata_6bc.dat scheduled to be deleted on reboot.
Windows Temp folder emptied.
Java cache emptied.
File delete failed. C:\Documents and Settings\GW2K\Local Settings\Application Data\Mozilla\Firefox\Profiles\rp1tom21.default\Cache\_CACHE_001_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\GW2K\Local Settings\Application Data\Mozilla\Firefox\Profiles\rp1tom21.default\Cache\_CACHE_002_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\GW2K\Local Settings\Application Data\Mozilla\Firefox\Profiles\rp1tom21.default\Cache\_CACHE_003_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\GW2K\Local Settings\Application Data\Mozilla\Firefox\Profiles\rp1tom21.default\Cache\_CACHE_MAP_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\GW2K\Local Settings\Application Data\Mozilla\Firefox\Profiles\rp1tom21.default\urlclassifier3.sqlite scheduled to be deleted on reboot.
FireFox cache emptied.
Temp folders emptied.
Explorer started successfully

OTMoveIt3 by OldTimer - Version 1.0.11.0 log created on 04222009_183002

Files moved on Reboot...
File C:\DOCUME~1\GW2K\LOCALS~1\Temp\etilqs_Mn0Jtv0krvDKdBfyJDMY not found!
File C:\WINDOWS\temp\Perflib_Perfdata_6bc.dat not found!
C:\Documents and Settings\GW2K\Local Settings\Application Data\Mozilla\Firefox\Profiles\rp1tom21.default\Cache\_CACHE_001_ moved successfully.
C:\Documents and Settings\GW2K\Local Settings\Application Data\Mozilla\Firefox\Profiles\rp1tom21.default\Cache\_CACHE_002_ moved successfully.
C:\Documents and Settings\GW2K\Local Settings\Application Data\Mozilla\Firefox\Profiles\rp1tom21.default\Cache\_CACHE_003_ moved successfully.
C:\Documents and Settings\GW2K\Local Settings\Application Data\Mozilla\Firefox\Profiles\rp1tom21.default\Cache\_CACHE_MAP_ moved successfully.
C:\Documents and Settings\GW2K\Local Settings\Application Data\Mozilla\Firefox\Profiles\rp1tom21.default\urlclassifier3.sqlite moved successfully.


ESET log:

# version=4
# OnlineScanner.ocx=1.0.0.635
# OnlineScannerDLLA.dll=1, 0, 0, 79
# OnlineScannerDLLW.dll=1, 0, 0, 78
# OnlineScannerUninstaller.exe=1, 0, 0, 49
# vers_standard_module=4029 (20090422)
# vers_arch_module=1.064 (20080214)
# vers_adv_heur_module=1.066 (20070917)
# EOSSerial=4c88e2d34cf0bf4c926645ba7ba60dc6
# end=finished
# remove_checked=true
# unwanted_checked=true
# utc_time=2009-04-23 02:34:00
# local_time=2009-04-22 09:34:00 (-0600, Central Daylight Time)
# country="United States"
# osver=5.1.2600 NT Service Pack 3
# scanned=237698
# found=18
# scan_time=10112
C:\Documents and Settings\GW2K\My Documents\LimeWire\Incomplete\T-4620425-project pac o j tha juiceman.mp3 a variant of WMA/TrojanDownloader.GetCodec.gen trojan (cleaned) 3914B9BD82C1AB40F7C90BC8B18AB31E
C:\Downloads\Wheel_of_Fortune_2_Setup-dm[1].exe Win32/Adware.Trymedia application (unable to clean - deleted) 00000000000000000000000000000000
C:\Program Files\Ascentive\PC SpeedScan Pro\PCSpeedScan.exe Win32/Adware.Ascentive application (unable to clean - deleted) 00000000000000000000000000000000
C:\Program Files\Ascentive\Performance Center\APCLang.dll Win32/Adware.Ascentive application (unable to clean - deleted) 00000000000000000000000000000000
C:\Program Files\Ascentive\Performance Center\ApcMain.exe Win32/Adware.Ascentive application (unable to clean - deleted) 00000000000000000000000000000000
D:\AOL Instant Messenger\AIM.exe Win32/Adware.WBug.A application (deleted) 00000000000000000000000000000000
D:\AOL Instant Messenger\AIM.exe »WISE »MiniBugTransporter.EXE Win32/Adware.WBug.A application (error while deleting - operation unavailable for this type of object - was a part of the deleted object) 00000000000000000000000000000000
D:\AOL Instant Messenger\AIM.exe »WISE »MiniBugTransporter.EXE »WISE »MiniBugTransporter.dll Win32/Adware.WBug.A application (error while cleaning - operation unavailable for this type of object - error while deleting - operation unavailable for this type of object - was a part of the deleted object) 00000000000000000000000000000000
D:\Documents and Settings\Djuan\Local Settings\Temp\UDC6_0001_D19M2808\installer.exe Win32/Adware.DriveCleaner application (unable to clean - deleted) 00000000000000000000000000000000
D:\Program Files\BitLord\Downloads\Real Player 10.5 Gold (with crack).rar probably a variant of Win32/TrojanDownloader.VB trojan (deleted) 00000000000000000000000000000000
D:\Program Files\BitLord\Downloads\Real Player 10.5 Gold (with crack).rar »RAR »Real Player 10.5 Gold (with crack)\Crack.exe probably a variant of Win32/TrojanDownloader.VB trojan (error while cleaning - operation unavailable for this type of object - error while deleting - operation unavailable for this type of object - was a part of the deleted object) 00000000000000000000000000000000
D:\WINDOWS\SYSTEM32\gsxnlpuf.ini Win32/Adware.Virtumonde.NEO~datafile application (unable to clean - deleted) 00000000000000000000000000000000
D:\WINDOWS\SYSTEM32\gsxnlpuf.tmp Win32/Adware.Virtumonde.NEO~datafile application (unable to clean - deleted) 00000000000000000000000000000000
D:\WINDOWS\SYSTEM32\twwvw.bak1 Win32/Adware.Virtumonde.NEO~datafile application (unable to clean - deleted) 00000000000000000000000000000000
D:\WINDOWS\SYSTEM32\twwvw.bak2 Win32/Adware.Virtumonde.NEO~datafile application (unable to clean - deleted) 00000000000000000000000000000000
D:\WINDOWS\SYSTEM32\twwvw.ini Win32/Adware.Virtumonde.NEO~datafile application (unable to clean - deleted) 00000000000000000000000000000000
D:\WINDOWS\SYSTEM32\twwvw.ini2 Win32/Adware.Virtumonde.NEO~datafile application (unable to clean - deleted) 00000000000000000000000000000000
D:\WINDOWS\SYSTEM32\twwvw.tmp Win32/Adware.Virtumonde.NEO~datafile application (unable to clean - deleted) 00000000000000000000000000000000



PC is doing better, boots up a bit faster. boss says its a lot better, but these scans tell me otherwise =-). Good luck on your exams!
EDIT: ask tool bar uninstalled.

Edited by alexhawz, 23 April 2009 - 06:27 PM.


#8 fenzodahl512

fenzodahl512

  • Members
  • 6,738 posts
  • OFFLINE
  •  
  • Local time:06:55 AM

Posted 24 April 2009 - 12:43 AM

Thank you.. Don't worry about the scan.. ESET Online has taken care of them..

Lets do some cleanup...


Please download OTCleanIt and save it to Desktop.
  • Make sure you have internet connection..
  • Double-click OTCleanIt.exe
  • Click the CleanUp! button.
  • Select Yes when the "Begin cleanup Process?" prompt appears.
  • If you are prompted to Reboot during the cleanup, select Yes


Please read these excellent articles by miekiemoes :
Help! My computer is slow!
How to prevent Malware



Read these links about safe internet surfing..

http://www.pcpitstop.com/spycheck/safesurfing.asp
http://bluefive.pair.com/practice_safe_surfing.htm



Please reply to this thread once more and tell us about the computer behaviour before we can close this thread :thumbup2:



Have a safe and happy computing day!


Regards
fenzodahl512

Keep calm, make it simple, use your brain, don't freak out, and you'll be just fine..
Awesomeness: When I get sad, I stop being sad and be awesome instead.. True story - Barney Stinson
Posted Image Posted Image
Its gonna be legen.. wait for it.. dary! Cherish the pain, it means you're still alive





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users