Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

I need help removing Hacktool.Rootkit


  • Please log in to reply
19 replies to this topic

#1 magnaman

magnaman

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Local time:10:34 AM

Posted 19 April 2009 - 09:54 AM

I'm running the 2002 Windows XP home Version. my computer has contracted a virus, I have tried numerous thngs to delete, clean, or quarantine, but none have worked. I have seen numerous fixes posted on this site, but I suspect all are contingent upon the specifics of individual error logs, so I thought I'd post a new thread. The only adverse effects I have witnessed are that when searching with google if I click on one of the search results, it redirects to a site that is totally irrevalent to the search. Here is a copy of the results from symantec antivirus, this window opens every time I click on internet explorer in my start menu. Please help me solve my problem as I am at my wits end. Any and all assistance will be greatly appreciated.

Scan type: Realtime Protection Scan
Event: Virus Found!
Virus name: Hacktool.Rootkit
File: C:\WINDOWS\system32\amstrea.dll
Location: C:\WINDOWS\system32
Computer: DELL4550
User:
Action taken: Clean failed : Quarantine failed : Access denied
Date found: Sun Apr 19 08:31:01 2009

(Moderator edit and note: post moved to more appropriate forum. jgw)

Edited by jgweed, 19 April 2009 - 10:03 AM.


BC AdBot (Login to Remove)

 


#2 DaChew

DaChew

    Visiting Alien


  • Members
  • 10,317 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:millenium falcon and rockytop
  • Local time:12:34 PM

Posted 19 April 2009 - 10:18 AM

Please download ATF Cleaner by Atribune & save it to your desktop.
  • Double-click ATF-Cleaner.exe to run the program.
  • Under Main "Select Files to Delete" choose: Select All.
  • Click the Empty Selected button.
  • If you use Firefox browser click Firefox at the top and choose: Select All
  • Click the Empty Selected button.
    If you would like to keep your saved passwords, please click No at the prompt.
  • If you use Opera browser click Opera at the top and choose: Select All
  • Click the Empty Selected button.
    If you would like to keep your saved passwords, please click No at the prompt.
  • Click Exit on the Main menu to close the program.
Note: On Vista, "Windows Temp" is disabled. To empty "Windows Temp" ATF-Cleaner must be "Run as an Administrator".


Please download Malwarebytes Anti-Malware (v1.36) and save it to your desktop.
alternate download link 1
alternate download link 2
If you have a previous version of MBAM, remove it via Add/Remove Programs and download a fresh copy.
  • Make sure you are connected to the Internet.
  • Double-click on mbam-setup.exe to install the application.
  • When the installation begins, follow the prompts and do not make any changes to default settings.
  • When installation has finished, make sure you leave both of these checked:
    • Update Malwarebytes' Anti-Malware
    • Launch Malwarebytes' Anti-Malware
  • Then click Finish.
MBAM will automatically start and you will be asked to update the program before performing a scan.
  • If an update is found, the program will automatically update itself.
  • Press the OK button to close that box and continue.
  • If you encounter any problems while downloading the updates, manually download them from here and just double-click on mbam-rules.exe to install. Alternatively, you can update through MBAM's interface from a clean computer, copy the definitions (rules.ref) located in C:\Documents and Settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware from that system to a usb stick or CD and then copy it to the infected machine.
On the Scanner tab:
  • Make sure the "Perform Quick Scan" option is selected.
  • Then click on the Scan button.
  • If asked to select the drives to scan, leave all the drives selected and click on the Start Scan button.
  • The scan will begin and "Scan in progress" will show at the top. It may take some time to complete so please be patient.
  • When the scan is finished, a message box will say "The scan completed successfully. Click 'Show Results' to display all objects found".
  • Click OK to close the message box and continue with the removal process.
Back at the main Scanner screen:
  • Click on the Show Results button to see a list of any malware that was found.
  • Make sure that everything is checked, and click Remove Selected.
  • When removal is completed, a log report will open in Notepad.
  • The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
  • Copy and paste the contents of that report in your next reply and exit MBAM.
Note: If MBAM encounters a file that is difficult to remove, you may be asked to reboot your computer so it can proceed with the disinfection process. Regardless if prompted to restart the computer or not, please do so immediately. Failure to reboot normally (not into safe mode) will prevent MBAM from removing all the malware. MBAM may "make changes to your registry" as part of its disinfection routine. If using other security programs that detect registry changes (ie Spybot's Teatimer), they may interfere or alert you after scanning with MBAM. Please temporarily disable such programs or permit them to allow the changes.

http://www.bleepingcomputer.com/forums/t/114351/how-to-temporarily-disable-your-anti-virus-firewall-and-anti-malware-programs/
Chewy

No. Try not. Do... or do not. There is no try.

#3 magnaman

magnaman
  • Topic Starter

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Local time:10:34 AM

Posted 19 April 2009 - 11:23 AM

(No malicious items detected)

Registry Keys Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02590f6e-e10c-46c8-9971-9bf1fc64a6c4} (Trojan.BHO.H) -> Delete on reboot.
HKEY_CLASSES_ROOT\CLSID\{02590f6e-e10c-46c8-9971-9bf1fc64a6c4} (Trojan.BHO.H) -> Delete on reboot.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{02590f6e-e10c-46c8-9971-9bf1fc64a6c4} (Trojan.Agent) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Settings\bf (Trojan.Agent) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Settings\bk (Trojan.Agent) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Settings\iu (Trojan.Agent) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Settings\mu (Trojan.Agent) -> Delete on reboot.

Registry Data Items Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowMyComputer (Hijack.StartMenu) -> Bad: (0) Good: (1) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Folders Infected:
(No malicious items detected)

Files Infected:
C:\WINDOWS\system32\amstrea.dll (Trojan.BHO.H) -> Delete on reboot.

#4 DaChew

DaChew

    Visiting Alien


  • Members
  • 10,317 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:millenium falcon and rockytop
  • Local time:12:34 PM

Posted 19 April 2009 - 11:46 AM

Please download and scan with SUPERAntiSpyware Free
  • Double-click SUPERAntiSypware.exe and use the default settings for installation.
  • An icon will be created on your desktop. Double-click that icon to launch the program.
  • If asked to update the program definitions, click "Yes". If not, update the definitions before scanning by selecting "Check for Updates". (If you encounter any problems while downloading the updates, manually download them from here. Double-click on the hyperlink for Download Installer and save SASDEFINITIONS.EXE to your desktop. Then double-click on SASDEFINITIONS.EXE to install the definitions.)
  • In the Main Menu, click the Preferences... button.
  • Click the "General and Startup" tab, and under Start-up Options, make sure "Start SUPERAntiSpyware when Windows starts" box is unchecked.
  • Click the "Scanning Control" tab, and under Scanner Options, make sure the following are checked (leave all others unchecked):
    • Close browsers before scanning.
    • Scan for tracking cookies.
    • Terminate memory threats before quarantining.
  • Click the "Close" button to leave the control center screen and exit the program.
  • Do not run a scan just yet.
Reboot your computer in "Safe Mode" using the F8 method. To do this, restart your computer and after hearing your computer beep once during startup (but before the Windows icon appears) press the F8 key repeatedly. A menu will appear with several options. Use the arrow keys to navigate and select the option to run Windows in "Safe Mode".

Scan with SUPERAntiSpyware as follows:
  • Launch the program and back on the main screen, under "Scan for Harmful Software" click Scan your computer.
  • On the left, make sure you check C:\Fixed Drive.
  • On the right, under "Complete Scan", choose Perform Complete Scan and click "Next".
  • After the scan is complete, a Scan Summary box will appear with potentially harmful items that were detected. Click "OK".
  • Make sure everything has a checkmark next to it and click "Next".
  • A notification will appear that "Quarantine and Removal is Complete". Click "OK" and then click the "Finish" button to return to the main menu.
  • If asked if you want to reboot, click "Yes" and reboot normally.
  • To retrieve the removal information after reboot, launch SUPERAntispyware again.
    • Click Preferences, then click the Statistics/Logs tab.
    • Under Scanner Logs, double-click SUPERAntiSpyware Scan Log.
    • If there are several logs, click the current dated log and press View log. A text file will open in your default text editor.
    • Please copy and paste the Scan Log results in your next reply.
  • Click Close to exit the program.
after the reboot into normal mode run MBAM again and post the whole log please
Chewy

No. Try not. Do... or do not. There is no try.

#5 magnaman

magnaman
  • Topic Starter

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Local time:10:34 AM

Posted 19 April 2009 - 04:16 PM

SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 04/19/2009 at 12:51 PM

Application Version : 4.26.1000

Core Rules Database Version : 3843
Trace Rules Database Version: 1798

Scan type : Complete Scan
Total Scan Time : 01:22:23

Memory items scanned : 272
Memory threats detected : 0
Registry items scanned : 6445
Registry threats detected : 5
File items scanned : 27066
File threats detected : 1

Trojan.Agent/Gen-AlcFakeAlert
HKLM\Software\Classes\CLSID\{02590F6E-E10C-46C8-9971-9BF1FC64A6C4}
HKCR\CLSID\{02590F6E-E10C-46C8-9971-9BF1FC64A6C4}
HKCR\CLSID\{02590F6E-E10C-46C8-9971-9BF1FC64A6C4}\InprocServer32
HKCR\CLSID\{02590F6E-E10C-46C8-9971-9BF1FC64A6C4}\InprocServer32#ThreadingModel
C:\WINDOWS\SYSTEM32\AMSTREA.DLL
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02590F6E-E10C-46C8-9971-9BF1FC64A6C4}

#6 DaChew

DaChew

    Visiting Alien


  • Members
  • 10,317 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:millenium falcon and rockytop
  • Local time:12:34 PM

Posted 19 April 2009 - 04:38 PM

after the reboot into normal mode run MBAM again and post the whole log please


update it first
Chewy

No. Try not. Do... or do not. There is no try.

#7 magnaman

magnaman
  • Topic Starter

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Local time:10:34 AM

Posted 19 April 2009 - 05:06 PM

Malwarebytes' Anti-Malware 1.36
Database version: 2012
Windows 5.1.2600 Service Pack 3

4/19/2009 4:04:42 PM
mbam-log-2009-04-19 (16-04-42).txt

Scan type: Quick Scan
Objects scanned: 91844
Time elapsed: 15 minute(s), 56 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 3
Registry Values Infected: 4
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 1

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02590f6e-e10c-46c8-9971-9bf1fc64a6c4} (Trojan.BHO.H) -> Delete on reboot.
HKEY_CLASSES_ROOT\CLSID\{02590f6e-e10c-46c8-9971-9bf1fc64a6c4} (Trojan.BHO.H) -> Delete on reboot.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{02590f6e-e10c-46c8-9971-9bf1fc64a6c4} (Trojan.Agent) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Settings\bf (Trojan.Agent) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Settings\bk (Trojan.Agent) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Settings\iu (Trojan.Agent) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Settings\mu (Trojan.Agent) -> Delete on reboot.

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\WINDOWS\system32\amstrea.dll (Trojan.BHO.H) -> Delete on reboot.

#8 DaChew

DaChew

    Visiting Alien


  • Members
  • 10,317 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:millenium falcon and rockytop
  • Local time:12:34 PM

Posted 19 April 2009 - 06:34 PM

Please download and run Processexplorer


http://technet.microsoft.com/en-us/sysinte...s/bb896653.aspx

Under file and save as, create a log and post here
Chewy

No. Try not. Do... or do not. There is no try.

#9 magnaman

magnaman
  • Topic Starter

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Local time:10:34 AM

Posted 19 April 2009 - 06:47 PM

sorry but its kind of jumbled up, let me know if you can or cant make heads or tails of it.

Process PID CPU Description Company Name
System Idle Process 0 95.45
Interrupts n/a Hardware Interrupts
DPCs n/a Deferred Procedure Calls
System 4
smss.exe 676 Windows NT Session Manager Microsoft Corporation
csrss.exe 736 Client Server Runtime Process Microsoft Corporation
winlogon.exe 760 Windows NT Logon Application Microsoft Corporation
services.exe 804 1.52 Services and Controller app Microsoft Corporation
svchost.exe 968 Generic Host Process for Win32 Services Microsoft Corporation
unsecapp.exe 3084 WMI Microsoft Corporation
wmiprvse.exe 3252 WMI Microsoft Corporation
svchost.exe 1024 Generic Host Process for Win32 Services Microsoft Corporation
MsMpEng.exe 1112 Service Executable Microsoft Corporation
svchost.exe 1160 Generic Host Process for Win32 Services Microsoft Corporation
wscntfy.exe 2828 Windows Security Center Notification App Microsoft Corporation
svchost.exe 1208 Generic Host Process for Win32 Services Microsoft Corporation
svchost.exe 1276 Generic Host Process for Win32 Services Microsoft Corporation
AAWService.exe 1524 Ad-Aware Service Application Lavasoft
AAWTray.exe 3800 Ad-Aware Tray Application Lavasoft
brsvc01a.exe 1604 brsvc01a brother Industries Ltd
brss01a.exe 1672 brss01a.exe brother Industries Ltd
spoolsv.exe 1680 Spooler SubSystem App Microsoft Corporation
svchost.exe 160 Generic Host Process for Win32 Services Microsoft Corporation
Brmfrmps.exe 192 Brother Popup Suspend service ( for R/M ) Brother Industries, Ltd.
CTSVCCDA.EXE 208 Creative Service for CDROM Access Creative Technology Ltd
DefWatch.exe 232 Virus Definition Daemon Symantec Corporation
svchost.exe 412 Generic Host Process for Win32 Services Microsoft Corporation
MDM.EXE 444 Machine Debug Manager Microsoft Corporation
Rtvscan.exe 540 Symantec AntiVirus Symantec Corporation
nvsvc32.exe 612 NVIDIA Driver Helper Service, Version 52.16 NVIDIA Corporation
svchost.exe 740 Generic Host Process for Win32 Services Microsoft Corporation
MsPMSPSv.exe 1284 WMDM PMSP Service Microsoft Corporation
searchindexer.exe 1404 Microsoft Windows Search Indexer Microsoft Corporation
wmpnetwk.exe 1328 Windows Media Player Network Sharing Service Microsoft Corporation
alg.exe 3152 Application Layer Gateway Service Microsoft Corporation
lsass.exe 816 LSA Shell (Export Version) Microsoft Corporation
GoogleUpdate.exe 568 Google Installer Google Inc.
explorer.exe 2236 Windows Explorer Microsoft Corporation
VPTray.exe 3044 Symantec AntiVirus Symantec Corporation
ctfmon.exe 3100 CTF Loader Microsoft Corporation
TeaTimer.exe 3108 1.52 System settings protector Safer-Networking Ltd.
iexplore.exe 2484 Internet Explorer Microsoft Corporation
procexp.exe 2056 1.52 Sysinternals Process Explorer Sysinternals - www.sysinternals.com

#10 DaChew

DaChew

    Visiting Alien


  • Members
  • 10,317 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:millenium falcon and rockytop
  • Local time:12:34 PM

Posted 19 April 2009 - 07:13 PM

Bingo

TeaTimer.exe 3108 1.52 System settings protector Safer-Networking Ltd.

You have probably told teatimer to remember denying the registry change for cleaning this infection


SPYBOT TEATIMER
Launch Spybot S&D, go to the Mode menu and make sure "Advanced Mode" is selected.
On the left hand side, click on Tools, then click on the Resident Icon in the list.
Uncheck the "Resident "TeaTimer" (Protection of overall system settings) active." box.
Click on the "System Startup" icon in the List
Uncheck the "TeaTimer" box and "OK" any prompts.
If Teatimer gives you a warning that changes were made, click the "Allow Change" box when prompted.
Exit Spybot S&D when done.
(When we are done, you can re-enable Teatimer using the same steps but this time place a check next to "Resident TeaTimer" and check the "TeaTimer" box in System Startup.]


leave it disabled, reboot and rerun all scans
Chewy

No. Try not. Do... or do not. There is no try.

#11 magnaman

magnaman
  • Topic Starter

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Local time:10:34 AM

Posted 19 April 2009 - 07:50 PM

okay, went to spybot . . . advanced mode, then resident icon, unchecked the "Resident "TeaTimer" (Protection of overall system settings) active.

HOWEVER, when I went to Click on the "System Startup" icon in the List and Uncheck the "TeaTimer" box and "OK" any prompts, I could not find teatimer on the list. I went back to resident . . . on the list on the left, and teatimer was mentioned as:

"4/19/2009 6:18:33 PM Allowed (based on user decision) value "SpybotSD TeaTimer" (new data: "") deleted in System Startup user entry!"

i'm gonna go ahead and reboot and rerun the scans anyhow. if i have to i'll just rerun them again.

#12 DaChew

DaChew

    Visiting Alien


  • Members
  • 10,317 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:millenium falcon and rockytop
  • Local time:12:34 PM

Posted 19 April 2009 - 08:29 PM

The one in system tray just unloads it till the next boot when it's back and then can interfer with a removal that requires a reboot

Turning it off in advanced mode leaves it off
Chewy

No. Try not. Do... or do not. There is no try.

#13 magnaman

magnaman
  • Topic Starter

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Local time:10:34 AM

Posted 19 April 2009 - 10:33 PM

The ball is in your court, as you are the expert, I do not intend to be argumentative nor ungrateful, but I looked again and "teatimer" was not to be found in the list of spybot's system startup. If it is beneficial, I will completely remove spybot. I went to system config utility > startup . . . and "teatimer" wasn't in there. likewise, it wasn't present in the processes running in the task manager. Just a little FYI, it takes almost 1.5 hours to do the superantispyware scan.


This is the "Startup entries list" from spybot


Located: HK_LM:Run, Adobe Reader Speed Launcher
command: "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
file: C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
size: 39792
MD5: 392845E8D49B5F0E81AAC4D795000A8C

Located: HK_LM:Run, NvCplDaemon
command: RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
file: C:\WINDOWS\System32\NvCpl.dll
size: 5058560
MD5: AA8B1B6AD9E721E2F0DBBC7D95D32EA4

Located: HK_LM:Run, vptray
command: C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
file: C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
size: 77824
MD5: 2C2C5C662E71A1EBEC6569BD05911237

Located: HK_CU:Run, ctfmon.exe
where: S-1-5-21-57989841-746137067-725345543-1004...
command: C:\WINDOWS\system32\ctfmon.exe
file: C:\WINDOWS\system32\ctfmon.exe
size: 15360
MD5: 5F1D5F88303D4A4DBC8E5F97BA967CC3

Located: HK_CU:Run, ctfmon.exe
where: S-1-5-21-57989841-746137067-725345543-1042...
command: C:\WINDOWS\system32\ctfmon.exe
file: C:\WINDOWS\system32\ctfmon.exe
size: 15360
MD5: 5F1D5F88303D4A4DBC8E5F97BA967CC3

Located: HK_CU:Run, QuickTime Task
where: S-1-5-21-57989841-746137067-725345543-1042...
command: "C:\Program Files\QuickTime\QTTask.exe" -atboottime
file: C:\Program Files\QuickTime\QTTask.exe
size: 0
MD5: D41D8CD98F00B204E9800998ECF8427E
Warning: if the file is actually larger than 0 bytes,
the checksum could not be properly calculated!

Located: HK_CU:Run, WMPNSCFG
where: S-1-5-21-57989841-746137067-725345543-1042...
command: C:\Program Files\Windows Media Player\WMPNSCFG.exe
file: C:\Program Files\Windows Media Player\WMPNSCFG.exe
size: 204288
MD5: 7EAED08CCCA4DDDE61A388C82598CFA9

Located: HK_CU:Run, Creative MediaSource Go
where: S-1-5-21-57989841-746137067-725345543-501...
command: C:\Program Files\Creative\MediaSource\Go\CTCMSGo.exe /SCB
file: C:\Program Files\Creative\MediaSource\Go\CTCMSGo.exe
size: 135168
MD5: E52049232EE2C84A3CB34D14F291B492

Located: HK_CU:Run, ctfmon.exe
where: S-1-5-21-57989841-746137067-725345543-501...
command: C:\WINDOWS\system32\ctfmon.exe
file: C:\WINDOWS\system32\ctfmon.exe
size: 15360
MD5: 5F1D5F88303D4A4DBC8E5F97BA967CC3

Located: HK_CU:Run, QuickTime Task
where: S-1-5-21-57989841-746137067-725345543-501...
command: "C:\Program Files\QuickTime\QTTask.exe" -atboottime
file: C:\Program Files\QuickTime\QTTask.exe
size: 0
MD5: D41D8CD98F00B204E9800998ECF8427E
Warning: if the file is actually larger than 0 bytes,
the checksum could not be properly calculated!

Located: HK_CU:Run, swg
where: S-1-5-21-57989841-746137067-725345543-501...
command: C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
file: C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
size: 39408
MD5: 5D61BE7DB55B026A5D61A3EED09D0EAD

Located: Startup (disabled), Adobe Reader Speed Launch (DISABLED)
command: C:\PROGRA~1\Adobe\READER~1.0\Reader\READER~1.EXE
file: C:\PROGRA~1\Adobe\READER~1.0\Reader\READER~1.EXE
size: 39792
MD5: 392845E8D49B5F0E81AAC4D795000A8C

Located: Startup (disabled), Adobe Reader Synchronizer (DISABLED)
command: C:\PROGRA~1\Adobe\READER~1.0\Reader\ADOBEC~1.EXE
file: C:\PROGRA~1\Adobe\READER~1.0\Reader\ADOBEC~1.EXE
size: 738968
MD5: 1C1C6ABBC3408A373C731EC3F41EAE16

Located: Startup (disabled), Microsoft Office (DISABLED)
command: C:\PROGRA~1\MICROS~4\Office10\OSA.EXE -b -l
file: C:\PROGRA~1\MICROS~4\Office10\OSA.EXE
size: 83360
MD5: 5BC65464354A9FD3BEAA28E18839734A

Located: Startup (disabled), Status Monitor (DISABLED)
command: C:\PROGRA~1\Brother\Brmfcmon\BrMfcWnd.exe Brother MFC-5440CN /STARTUP
file: C:\PROGRA~1\Brother\Brmfcmon\BrMfcWnd.exe
size: 819200
MD5: 01B036128CD786B8B2644B624CC9E7CD

Located: Startup (disabled), Windows Desktop Search (DISABLED)
command: C:\Program Files\MSN Toolbar Suite\DS\02.05.0001.1119\en-us\bin\WindowsSearch.exe /startup
file: C:\Program Files\MSN Toolbar Suite\DS\02.05.0001.1119\en-us\bin\WindowsSearch.exe
size: 0
MD5: D41D8CD98F00B204E9800998ECF8427E
Warning: if the file is actually larger than 0 bytes,
the checksum could not be properly calculated!

Located: Startup (disabled), Windows Search (DISABLED)
command: C:\PROGRA~1\WI459E~1\WINDOW~1.EXE /startup
file: C:\PROGRA~1\WI459E~1\WINDOW~1.EXE
size: 123904
MD5: B5C9F63C01FCFEC3F64EC6A0940A1825

Located: Startup (disabled), wkcalrem (DISABLED)
command: C:\PROGRA~1\COMMON~1\MICROS~1\WORKSS~1\WkCalRem.exe
file: C:\PROGRA~1\COMMON~1\MICROS~1\WORKSS~1\WkCalRem.exe
size: 24651
MD5: 07AA10F524D57CD6DF42E501F0C9D6F1

Located: WinLogon, !SASWinLogon
command: C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
file: C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
size: 356352
MD5: 972EDEDE23AC8D59AAC0C09799C6F18A

Located: WinLogon, crypt32chain
command: crypt32.dll
file: crypt32.dll
size: 0
MD5: D41D8CD98F00B204E9800998ECF8427E
Warning: if the file is actually larger than 0 bytes,
the checksum could not be properly calculated!

Located: WinLogon, cryptnet
command: cryptnet.dll
file: cryptnet.dll
size: 0
MD5: D41D8CD98F00B204E9800998ECF8427E
Warning: if the file is actually larger than 0 bytes,
the checksum could not be properly calculated!

Located: WinLogon, cscdll
command: cscdll.dll
file: cscdll.dll
size: 0
MD5: D41D8CD98F00B204E9800998ECF8427E
Warning: if the file is actually larger than 0 bytes,
the checksum could not be properly calculated!

Located: WinLogon, dimsntfy
command: %SystemRoot%\System32\dimsntfy.dll
file: %SystemRoot%\System32\dimsntfy.dll
size: 0
MD5: D41D8CD98F00B204E9800998ECF8427E
Warning: if the file is actually larger than 0 bytes,
the checksum could not be properly calculated!

Located: WinLogon, NavLogon
command: C:\WINDOWS\system32\NavLogon.dll
file: C:\WINDOWS\system32\NavLogon.dll
size: 45056
MD5: B33F5A94275A88B2BBD988549B699017

Located: WinLogon, ScCertProp
command: wlnotify.dll
file: wlnotify.dll
size: 0
MD5: D41D8CD98F00B204E9800998ECF8427E
Warning: if the file is actually larger than 0 bytes,
the checksum could not be properly calculated!

Located: WinLogon, Schedule
command: wlnotify.dll
file: wlnotify.dll
size: 0
MD5: D41D8CD98F00B204E9800998ECF8427E
Warning: if the file is actually larger than 0 bytes,
the checksum could not be properly calculated!

Located: WinLogon, sclgntfy
command: sclgntfy.dll
file: sclgntfy.dll
size: 0
MD5: D41D8CD98F00B204E9800998ECF8427E
Warning: if the file is actually larger than 0 bytes,
the checksum could not be properly calculated!

Located: WinLogon, SensLogn
command: WlNotify.dll
file: WlNotify.dll
size: 0
MD5: D41D8CD98F00B204E9800998ECF8427E
Warning: if the file is actually larger than 0 bytes,
the checksum could not be properly calculated!

Located: WinLogon, termsrv
command: wlnotify.dll
file: wlnotify.dll
size: 0
MD5: D41D8CD98F00B204E9800998ECF8427E
Warning: if the file is actually larger than 0 bytes,
the checksum could not be properly calculated!

Located: WinLogon, WgaLogon
command: WgaLogon.dll
file: WgaLogon.dll
size: 0
MD5: D41D8CD98F00B204E9800998ECF8427E
Warning: if the file is actually larger than 0 bytes,
the checksum could not be properly calculated!

Located: WinLogon, wlballoon
command: wlnotify.dll
file: wlnotify.dll
size: 0
MD5: D41D8CD98F00B204E9800998ECF8427E
Warning: if the file is actually larger than 0 bytes,
the checksum could not be properly calculated!
________________________________________________________________________

SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 04/19/2009 at 12:51 PM

Application Version : 4.26.1000

Core Rules Database Version : 3843
Trace Rules Database Version: 1798

Scan type : Complete Scan
Total Scan Time : 01:22:23

Memory items scanned : 272
Memory threats detected : 0
Registry items scanned : 6445
Registry threats detected : 5
File items scanned : 27066
File threats detected : 1

Trojan.Agent/Gen-AlcFakeAlert
HKLM\Software\Classes\CLSID\{02590F6E-E10C-46C8-9971-9BF1FC64A6C4}
HKCR\CLSID\{02590F6E-E10C-46C8-9971-9BF1FC64A6C4}
HKCR\CLSID\{02590F6E-E10C-46C8-9971-9BF1FC64A6C4}\InprocServer32
HKCR\CLSID\{02590F6E-E10C-46C8-9971-9BF1FC64A6C4}\InprocServer32#ThreadingModel
C:\WINDOWS\SYSTEM32\AMSTREA.DLL

-------------------------------------------------------------------------------------------------------------------------------------------------------------

Malwarebytes' Anti-Malware 1.36
Database version: 2013
Windows 5.1.2600 Service Pack 3

4/19/2009 9:19:37 PM
mbam-log-2009-04-19 (21-19-37).txt

Scan type: Quick Scan

Process Explorer

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 3
Registry Values Infected: 4
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 1

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02590f6e-e10c-46c8-9971-9bf1fc64a6c4} (Trojan.BHO.H) -> Delete on reboot.
HKEY_CLASSES_ROOT\CLSID\{02590f6e-e10c-46c8-9971-9bf1fc64a6c4} (Trojan.BHO.H) -> Delete on reboot.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{02590f6e-e10c-46c8-9971-9bf1fc64a6c4} (Trojan.Agent) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Settings\bf (Trojan.Agent) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Settings\bk (Trojan.Agent) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Settings\iu (Trojan.Agent) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Settings\mu (Trojan.Agent) -> Delete on reboot.

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\WINDOWS\system32\amstrea.dll (Trojan.BHO.H) -> Delete on reboot.

-------------------------------------------------------------------------------------------------------------------------------------------------------------

Process PID CPU Description Company Name
System Idle Process 0 98.46
Interrupts n/a Hardware Interrupts
DPCs n/a Deferred Procedure Calls
System 4
smss.exe 680 Windows NT Session Manager Microsoft Corporation
csrss.exe 740 Client Server Runtime Process Microsoft Corporation
winlogon.exe 764 Windows NT Logon Application Microsoft Corporation
services.exe 808 1.54 Services and Controller app Microsoft Corporation
svchost.exe 976 Generic Host Process for Win32 Services Microsoft Corporation
unsecapp.exe 3052 WMI Microsoft Corporation
wmiprvse.exe 3232 WMI Microsoft Corporation
svchost.exe 1032 Generic Host Process for Win32 Services Microsoft Corporation
MsMpEng.exe 1120 Service Executable Microsoft Corporation
svchost.exe 1168 Generic Host Process for Win32 Services Microsoft Corporation
wuauclt.exe 3416 Windows Update Automatic Updates Microsoft Corporation
wscntfy.exe 3420 Windows Security Center Notification App Microsoft Corporation
svchost.exe 1220 Generic Host Process for Win32 Services Microsoft Corporation
svchost.exe 1304 Generic Host Process for Win32 Services Microsoft Corporation
AAWService.exe 1528 Ad-Aware Service Application Lavasoft
AAWTray.exe 1352 Ad-Aware Tray Application Lavasoft
brsvc01a.exe 1612 brsvc01a brother Industries Ltd
brss01a.exe 1660 brss01a.exe brother Industries Ltd
spoolsv.exe 1652 Spooler SubSystem App Microsoft Corporation
svchost.exe 1828 Generic Host Process for Win32 Services Microsoft Corporation
Brmfrmps.exe 1864 Brother Popup Suspend service ( for R/M ) Brother Industries, Ltd.
CTSVCCDA.EXE 1876 Creative Service for CDROM Access Creative Technology Ltd
DefWatch.exe 1904 Virus Definition Daemon Symantec Corporation
svchost.exe 2000 Generic Host Process for Win32 Services Microsoft Corporation
MDM.EXE 2044 Machine Debug Manager Microsoft Corporation
Rtvscan.exe 232 Symantec AntiVirus Symantec Corporation
nvsvc32.exe 440 NVIDIA Driver Helper Service, Version 52.16 NVIDIA Corporation
svchost.exe 540 Generic Host Process for Win32 Services Microsoft Corporation
MsPMSPSv.exe 672 WMDM PMSP Service Microsoft Corporation
searchindexer.exe 1008 Microsoft Windows Search Indexer Microsoft Corporation
wmpnetwk.exe 2068 Windows Media Player Network Sharing Service Microsoft Corporation
alg.exe 3428 Application Layer Gateway Service Microsoft Corporation
lsass.exe 820 LSA Shell (Export Version) Microsoft Corporation
GoogleUpdate.exe 268 Google Installer Google Inc.
explorer.exe 2700 Windows Explorer Microsoft Corporation
VPTray.exe 3704 Symantec AntiVirus Symantec Corporation
reader_sl.exe 3716 Adobe Acrobat SpeedLauncher Adobe Systems Incorporated
ctfmon.exe 3736 CTF Loader Microsoft Corporation
procexp.exe 2528 Sysinternals Process Explorer Sysinternals - www.sysinternals.com

#14 magnaman

magnaman
  • Topic Starter

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Local time:10:34 AM

Posted 19 April 2009 - 10:37 PM

i give up for the night. if this didnt get it, i'll uninstall spybot and rerun the scans tommorrow. dont know if it matters but besides spybot, i'm also using ccleaner, adaware se, and norton antivirus corporate 8.0

#15 DaChew

DaChew

    Visiting Alien


  • Members
  • 10,317 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:millenium falcon and rockytop
  • Local time:12:34 PM

Posted 19 April 2009 - 10:57 PM

Keep spybot, just leave teatimer disabled for the time being

let's look for a rootkit

http://rootrepeal.googlepages.com/

http://rootrepeal.googlepages.com/RootRepeal.zip

Just use the file tab, scan and paste the report into a reply here please
Chewy

No. Try not. Do... or do not. There is no try.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users