Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Help - can't see hidden folders, icons changed, dns errors on certain websites


  • This topic is locked This topic is locked
2 replies to this topic

#1 samanderson

samanderson

  • Members
  • 1 posts
  • OFFLINE
  •  
  • Local time:10:24 AM

Posted 17 April 2009 - 03:32 AM

Hi guys, I have a couple of days ago had some weird things start happening on my computer and I fear I have a virus / malware / a trojan! I think it happened after I updated windows xp and some of my other programs, which I had not done in a while, or possibly some files on a USB that I got from another pc.

I now can't see any of my hidden files / folders (when I go into folder options and click the show hidden files and folders radio button, when I hit apply, it reverts back to don't show hidden files and folders), the icons of my USB drives have been changed to folder icons, rather than the normal USB icon, and I now get a DNS error (internet explorer cannot display the web page), or certain websites - notedly microsoft and anti-virus related websites. I am now 99% sure I have a virus, because when I transferred some completely different files via the same USB to my other pc (also windows xp), it has now started to show the same symptoms.

I have done a complete scan with SuperAntiSpyware, and it has found nothing. Any help I can get to remove this virus would be greatly appreciated!

My DDS log is as follows:


DDS (Ver_09-03-16.01) - NTFSx86
Run by Samuel at 17:19:35.48 on Fri 17/04/2009
Internet Explorer: 8.0.6001.18702
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.510.96 [GMT 10:00]


============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\CDBurnerXP\NMSAccessU.exe
C:\WINDOWS\system32\tcpsvcs.exe
C:\WINDOWS\System32\snmp.exe
C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\WINDOWS\system32\dns\bin\named.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\mqsvc.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\QuickTime\QTTask.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\WINDOWS\system32\mqtgsvc.exe
C:\WINDOWS\System32\svchost.exe -k HTTPFilter
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\PROGRA~1\MICROS~2\OFFICE11\OUTLOOK.EXE
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
C:\Program Files\Microsoft\Office Live\OfficeLiveSignIn.exe
c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
C:\Documents and Settings\Samuel\My Documents\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.google.com.au/
uInternet Settings,ProxyOverride = *.local
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: ContributeBHO Class: {074c1dc5-9320-4a9a-947d-c042949c6216} - c:\program files\adobe\/Adobe Contribute CS3/contributeieplugin.dll
BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO: SSVHelper Class: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre1.6.0_05\bin\ssv.dll
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
TB: Contribute Toolbar: {517bdde4-e3a7-4570-b21e-2b52b6139fc7} - c:\program files\adobe\/Adobe Contribute CS3/contributeieplugin.dll
EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File
uRun: [CTFMON.EXE] c:\windows\system32\ctfmon.exe
uRun: [msnmsgr] "c:\program files\windows live\messenger\msnmsgr.exe" /background
mRun: [Adobe_ID0EYTHM] c:\progra~1\common~1\adobe\adobev~1\server\bin\VERSIO~2.EXE
mRun: [SunJavaUpdateSched] "c:\program files\java\jre1.6.0_05\bin\jusched.exe"
mRun: [LogitechVideoRepair] c:\program files\logitech\video\ISStart.exe
mRun: [MsmqIntCert] regsvr32 /s mqrt.dll
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE
uPolicies-explorer: NoViewOnDrive = 0 (0x0)
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBC} - c:\program files\java\jre1.6.0_05\bin\ssv.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1231809595655
DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1231810328269
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab
DPF: {F2A84794-EE6D-447B-8C21-3BA1DC77C5B4} - file://e:\controls\sdkinst.cab
TCP: {27F24D43-F0F2-4E2C-8F8C-B736CA10905E} = 127.0.0.1,10.0.0.138
TCP: {B169190E-B38A-4EF0-ACFD-33FB12CA858F} = 127.0.0.1
TCP: {BD8992E0-82D9-4FA5-AEB7-34E6C2D95311} = 127.0.0.1
Notify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SEH: Windows Desktop Search Namespace Manager: {56f9679e-7826-4c84-81f3-532071a8bcc5} - c:\program files\windows desktop search\MSNLNamespaceMgr.dll
SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLL

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\samuel\applic~1\mozilla\firefox\profiles\h4zu9n96.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com.au/

============= SERVICES / DRIVERS ===============

R1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\sasdifsv.sys [2009-3-23 9968]
R1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2009-3-23 72944]
R1 VBoxDrv;VirtualBox Service;c:\windows\system32\drivers\VBoxDrv.sys [2008-8-24 54896]
R1 VBoxUSBMon;VirtualBox USB Monitor Driver;c:\windows\system32\drivers\VBoxUSBMon.sys [2008-8-24 41616]
R2 Iprip;RIP Listener;c:\windows\system32\svchost.exe -k netsvcs [2004-8-4 14336]
R3 SASENUM;SASENUM;c:\program files\superantispyware\SASENUM.SYS [2009-3-23 7408]
S2 rswhtf;Update Boot;c:\windows\system32\svchost.exe -k netsvcs [2004-8-4 14336]
S3 VBoxTAP;VirtualBox TAP Adapter;c:\windows\system32\drivers\VBoxTAP.sys [2008-8-24 47152]
S4 msvsmon80;Visual Studio 2005 Remote Debugger;"c:\program files\microsoft visual studio 8\common7\ide\remote debugger\x86\msvsmon.exe" /service msvsmon80 --> c:\program files\microsoft visual studio 8\common7\ide\remote debugger\x86\msvsmon.exe [?]
S4 zidxsae;zidxsae;\??\c:\windows\system32\01.tmp --> c:\windows\system32\01.tmp [?]

=============== Created Last 30 ================

2009-04-16 10:47 <DIR> --d----- c:\docume~1\alluse~1\applic~1\SUPERAntiSpyware.com
2009-04-16 10:47 <DIR> --d----- c:\program files\SUPERAntiSpyware
2009-04-16 10:47 <DIR> --d----- c:\docume~1\samuel\applic~1\SUPERAntiSpyware.com
2009-04-16 10:46 <DIR> --d----- c:\program files\common files\Wise Installation Wizard
2009-04-16 10:23 <DIR> --d----- c:\program files\Defraggler
2009-04-16 09:52 <DIR> --dsh--- c:\documents and settings\samuel\IECompatCache
2009-04-16 09:48 <DIR> --dsh--- c:\documents and settings\samuel\PrivacIE
2009-04-16 09:45 <DIR> --dsh--- c:\documents and settings\samuel\IETldCache
2009-04-16 09:39 <DIR> -cd-h--- c:\windows\ie8
2009-04-16 09:31 <DIR> --d----- c:\documents and settings\samuel\Tracing
2009-04-16 09:30 <DIR> --d----- c:\program files\Microsoft Office Outlook Connector
2009-04-16 09:29 <DIR> --d----- c:\program files\Windows Live SkyDrive
2009-04-16 09:12 <DIR> --d----- c:\program files\iTunes
2009-04-16 09:12 <DIR> --d----- c:\docume~1\alluse~1\applic~1\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
2009-04-16 00:16 <DIR> --d----- c:\program files\common files\Windows Live
2009-04-15 23:36 <DIR> --d----- c:\windows\system32\XPSViewer
2009-04-15 23:34 89,088 -c------ c:\windows\system32\dllcache\filterpipelineprintproc.dll
2009-04-15 23:34 117,760 -------- c:\windows\system32\prntvpt.dll
2009-04-15 23:34 1,676,288 -c------ c:\windows\system32\dllcache\xpssvcs.dll
2009-04-15 23:34 597,504 -c------ c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2009-04-15 23:34 575,488 -c------ c:\windows\system32\dllcache\xpsshhdr.dll
2009-04-15 23:34 1,676,288 -------- c:\windows\system32\xpssvcs.dll
2009-04-15 23:34 575,488 -------- c:\windows\system32\xpsshhdr.dll
2009-04-15 23:34 <DIR> --d----- C:\6d7796c019316b7a5f182114a7de
2009-04-15 23:18 <DIR> --d----- c:\program files\Microsoft
2009-04-15 23:15 <DIR> --d----- c:\program files\MSXML 6.0
2009-04-15 23:02 <DIR> --d----- c:\docume~1\samuel\applic~1\Windows Desktop Search
2009-04-15 23:00 <DIR> --d----- c:\windows\system32\GroupPolicy
2009-04-15 23:00 <DIR> --d----- c:\program files\Windows Desktop Search
2009-04-15 22:08 <DIR> --d----- c:\windows\system32\URTTEMP
2009-04-15 21:11 272,128 -c------ c:\windows\system32\dllcache\bthport.sys
2009-04-15 15:01 <DIR> --d----- c:\windows\system32\CatRoot_bak
2009-04-15 14:54 <DIR> --d----- c:\windows\system32\PreInstall
2009-04-15 14:54 <DIR> --d-h--- c:\windows\$hf_mig$
2009-04-15 14:14 268,648 a------- c:\windows\system32\mucltui.dll
2009-04-15 14:14 27,496 a------- c:\windows\system32\mucltui.dll.mui
2009-04-15 14:07 <DIR> --d----- c:\windows\system32\dns
2009-04-15 12:48 <DIR> --d----- c:\program files\CCleaner
2009-04-15 12:47 <DIR> --d----- c:\docume~1\samuel\applic~1\RegistrySmart
2009-04-15 12:44 249,856 -------- c:\windows\Setup1.exe
2009-04-15 12:44 73,216 a------- c:\windows\ST6UNST.EXE

==================== Find3M ====================

2009-03-19 16:32 23,400 a------- c:\windows\system32\drivers\GEARAspiWDM.sys
2009-03-08 04:34 914,944 a------- c:\windows\system32\wininet.dll
2009-03-08 04:34 43,008 a------- c:\windows\system32\licmgr10.dll
2009-03-08 04:33 18,944 a------- c:\windows\system32\corpol.dll
2009-03-08 04:33 420,352 a------- c:\windows\system32\vbscript.dll
2009-03-08 04:32 72,704 a------- c:\windows\system32\admparse.dll
2009-03-08 04:32 71,680 a------- c:\windows\system32\iesetup.dll
2009-03-08 04:31 34,816 a------- c:\windows\system32\imgutil.dll
2009-03-08 04:31 48,128 a------- c:\windows\system32\mshtmler.dll
2009-03-08 04:31 45,568 a------- c:\windows\system32\mshta.exe
2009-03-08 04:22 156,160 a------- c:\windows\system32\msls31.dll
2009-02-09 20:19 1,846,272 a------- c:\windows\system32\win32k.sys
2009-02-06 18:52 49,504 a------- c:\windows\system32\sirenacm.dll
2008-07-19 12:05 94,208 a------- c:\docume~1\samuel\applic~1\ezplay.sys
2008-07-19 12:05 87,608 a------- c:\docume~1\samuel\applic~1\inst.exe
2008-07-19 12:05 47,360 a------- c:\docume~1\samuel\applic~1\pcouffin.sys
2004-08-04 22:00 170,956 a--shr-- c:\windows\system32\hfthahby.dll


Cheers in advance - sam.

Edited by samanderson, 17 April 2009 - 03:33 AM.


BC AdBot (Login to Remove)

 


#2 Dakeyras

Dakeyras

    Anti-Malware Mammoth


  • Malware Response Team
  • 370 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:The Tundra
  • Local time:01:24 AM

Posted 02 May 2009 - 03:27 PM

Hi,

I apoligise for the delay, the forum is very busy.

If you still require assistance post a new set of DDS Logs please, thank you.

#3 Dakeyras

Dakeyras

    Anti-Malware Mammoth


  • Malware Response Team
  • 370 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:The Tundra
  • Local time:01:24 AM

Posted 06 May 2009 - 06:22 PM

Due to inactivity, this topic is now be closed.

If you need this topic reopened, please contact a Staff member. Include the address of this thread in your request.

This applies only to the original topic starter. Should you have a new issue, please start a New Topic.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users