Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

win32.TDSS.rtk, UAC, FakeAlert, winav, Cryptor, Vundo, etc


  • This topic is locked This topic is locked
13 replies to this topic

#1 metalmaiden

metalmaiden

  • Members
  • 48 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:South Australia
  • Local time:10:24 AM

Posted 28 June 2009 - 02:16 AM

Hi,
I've been directed here by rigel from the "Am I infected?" forum.
Please read here

The computer isn't playing up, but I know it is still infected.
Could I please have some assistance with finding and removing the problems?

Here are the DDS logs

DDS (Ver_09-06-26.01) - FAT32x86
Run by Tascha at 15:53:09.35 on Sun 06/28/2009
Internet Explorer: 8.0.6001.18702
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1503.1011 [GMT 9.5:30]

AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
SVCHOST.EXE
C:\WINDOWS\System32\svchost.exe -k netsvcs
SVCHOST.EXE
SVCHOST.EXE
C:\WINDOWS\system32\spoolsv.exe
SVCHOST.EXE
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
SVCHOST.EXE
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Documents and Settings\Tascha\Desktop\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.ninemsn.com.au/
uDefault_Page_URL = hxxp://www.ninemsn.com.au
uInternet Connection Wizard,ShellNext = hxxp://global.acer.com/
uInternet Settings,ProxyOverride = *.local
uURLSearchHooks: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - c:\program files\avg\avg8\toolbar\IEToolbar.dll
uURLSearchHooks: H - No File
BHO: AcroIEHlprObj Class: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 7.0\activex\AcroIEHelper.dll
BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg8\avgssie.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll
BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - c:\program files\avg\avg8\toolbar\IEToolbar.dll
BHO: MSN Toolbar Helper: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - c:\program files\msn\toolbar\3.0.1203.0\msneshellx.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: Easy-WebPrint: {327c2873-e90d-4c37-aa9d-10ac9baba46c} - c:\program files\canon\easy-webprint\Toolband.dll
TB: MSN Toolbar: {1e61ed7c-7cb8-49d6-b9e9-ab4c880c8414} - c:\program files\msn\toolbar\3.0.1203.0\msneshellx.dll
TB: AVG Security Toolbar: {ccc7a320-b3ca-4199-b1a6-9f516dd69829} - c:\program files\avg\avg8\toolbar\IEToolbar.dll
TB: {A057A204-BACC-4D26-9990-79A187E2698E} - No File
TB: {604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - No File
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [msnmsgr] "c:\program files\windows live\messenger\msnmsgr.exe" /background
mRun: [AVG8_TRAY] c:\progra~1\avg\avg8\avgtray.exe
mRun: [SiSPower] Rundll32.exe SiSPower.dll,ModeAgent
dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE
IE: E&xport to Microsoft Excel - c:\progra~1\micros~3\office12\EXCEL.EXE/3000
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBC} - c:\program files\java\jre6\bin\jp2iexp.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~3\office12\REFIEBAR.DLL
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll
DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} - hxxp://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab
DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} - hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
DPF: {F1D54B0B-B6EA-43B5-BD26-A79D3DBF47E3} - hxxps://bigpondmusic.com/activex/multidownx.cab
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg8\avgpp.dll
Notify: AtiExtEvent - Ati2evxx.dll
Notify: avgrsstarter - avgrsstx.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SEH: Windows Desktop Search Namespace Manager: {56f9679e-7826-4c84-81f3-532071a8bcc5} - c:\program files\windows desktop search\MSNLNamespaceMgr.dll

============= SERVICES / DRIVERS ===============

R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2008-6-1 327688]
R1 AvgMfx86;AVG On-access Scanner Minifilter Driver x86;c:\windows\system32\drivers\avgmfx86.sys [2007-3-3 27784]
R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2009-4-21 108552]
R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\avg\avg8\avgwdsvc.exe [2008-6-1 298776]
S3 C4C_BSC2;C4C_BSC2;c:\windows\system32\drivers\C4C_BSC2.sys [2005-8-4 84788]

=============== Created Last 30 ================

2009-06-21 17:57 337,320 a------- c:\windows\difxapi.dll
2009-06-21 12:31 0 a------- c:\documents and settings\tascha\settings.dat
2009-06-18 09:03 --d----- c:\docume~1\alluse~1\applic~1\AVG Security Toolbar
2009-06-17 10:34 --d----- c:\program files\Malwarebytes' Anti-Malware
2009-06-17 08:55 --dsh--- C:\FOUND.002
2009-06-15 13:34 8,192 a--sh--- c:\windows\Thumbs.db
2009-06-15 11:41 --d----- c:\windows\pss
2009-06-15 11:39 --d----- c:\program files\VS Revo Group
2009-06-15 11:37 246,272 -------- c:\windows\system32\dllcache\ieproxy.dll
2009-06-15 11:37 12,800 -------- c:\windows\system32\dllcache\xpshims.dll

==================== Find3M ====================

2009-06-18 09:04 327,688 a------- c:\windows\system32\drivers\avgldx86.sys
2009-06-17 11:27 38,160 a------- c:\windows\system32\drivers\mbamswissarmy.sys
2009-06-17 11:27 19,096 a------- c:\windows\system32\drivers\mbam.sys
2009-06-16 10:09 90,112 a------- c:\windows\DUMP3fd7.tmp
2009-06-16 10:08 90,112 a------- c:\windows\DUMP3f89.tmp
2009-06-16 10:07 90,112 a------- c:\windows\DUMP3e12.tmp
2009-06-16 10:05 90,112 a------- c:\windows\DUMP3cba.tmp
2009-06-16 10:02 90,112 a------- c:\windows\DUMP3de3.tmp
2009-06-11 15:46 90,112 a------- c:\windows\DUMP4788.tmp
2009-05-26 19:52 90,112 a------- c:\windows\DUMP470c.tmp
2009-05-26 19:45 90,112 a------- c:\windows\DUMP472a.tmp
2009-05-26 19:36 90,112 a------- c:\windows\DUMP47d6.tmp
2009-05-26 10:03 90,112 a------- c:\windows\DUMP47b7.tmp
2009-05-25 00:24 350,208 -------- c:\windows\system32\mssph.dll
2009-05-18 12:15 90,112 a------- c:\windows\DUMP470b.tmp
2009-05-13 14:45 5,936,128 a------- c:\windows\system32\dllcache\mshtml.dll
2009-05-13 14:45 915,456 a------- c:\windows\system32\wininet.dll
2009-05-13 14:45 915,456 a------- c:\windows\system32\dllcache\wininet.dll
2009-05-12 15:12 26,144 a------- c:\windows\system32\spupdsvc.exe
2009-05-08 01:02 345,600 a------- c:\windows\system32\localspl.dll
2009-05-08 01:02 345,600 -------- c:\windows\system32\dllcache\localspl.dll
2009-05-02 13:35 11,952 a------- c:\windows\system32\avgrsstx.dll
2009-05-02 13:34 108,552 a------- c:\windows\system32\drivers\avgtdix.sys
2009-05-01 06:52 1,985,024 a------- c:\windows\system32\dllcache\iertutil.dll
2009-05-01 06:52 11,064,832 a------- c:\windows\system32\dllcache\ieframe.dll
2009-05-01 06:52 1,207,808 a------- c:\windows\system32\dllcache\urlmon.dll
2009-05-01 06:52 385,536 a------- c:\windows\system32\dllcache\iedkcs32.dll
2009-05-01 06:52 25,600 a------- c:\windows\system32\dllcache\jsproxy.dll
2009-04-30 20:51 173,056 a------- c:\windows\system32\dllcache\ie4uinit.exe
2009-04-21 10:41 63,752,952 a------- C:\avg_free_stf_en_85_287a1483.exe
2009-04-17 21:56 1,847,168 a------- c:\windows\system32\win32k.sys
2009-04-17 21:56 1,847,168 -------- c:\windows\system32\dllcache\win32k.sys
2009-04-16 00:21 585,216 a------- c:\windows\system32\rpcrt4.dll
2009-04-16 00:21 585,216 -------- c:\windows\system32\dllcache\rpcrt4.dll
2009-04-13 10:46 0 a------- C:\u.bat
2009-04-01 03:55 1,571,001 a------- c:\windows\system32\sisgl.dll
2009-04-01 03:38 3,467,776 a------- c:\windows\system32\sisgrv.dll
2009-04-01 03:32 9,728 a------- c:\windows\system32\SiSPIns2.dll
2009-04-01 03:31 12,288 a------- c:\windows\InstFunc.dll
2009-04-01 03:30 172,032 a------- c:\windows\system32\SiSInst.dll
2009-04-01 03:30 258,048 a------- c:\windows\system32\SiSParse.dll
2009-04-01 03:30 49,152 a------- c:\windows\system32\SiSBase.dll
2008-12-06 14:39 3,720,910 a------- c:\program files\gmaker.exe
2007-06-11 17:44 0 a------- c:\docume~1\tascha\applic~1\wklnhst.dat
2008-10-25 12:50 32,768 a--sh--- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012008102520081026\index.dat

============= FINISH: 15:53:45.95 ===============


Attached File  Attach.txt   10KB   17 downloads



Do I start a new topic for my other computer or post here?

I answered this question in the topic in AII. ~ OB

Edited by Orange Blossom, 28 June 2009 - 11:15 AM.


BC AdBot (Login to Remove)

 


#2 Elise

Elise

    Bleepin' Blonde


  • Malware Study Hall Admin
  • 61,091 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Romania
  • Local time:03:54 AM

Posted 02 July 2009 - 04:31 AM

Hello and welcome to Bleeping Computer

We apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help. No one is ignored here.

If you have since resolved the original problem you were having, we would appreciate you letting us know. If not please perform the following steps below so we can have a look at the current condition of your machine.

If you have not done so, include a clear description of the problems you're having, along with any steps you may have performed so far.

Upon completing the steps below another staff member will review and take the steps necessary with you to get your machine back in working order clean and free of malware.

If you have already posted a DDS log, please do so again, as your situation may have changed.
Use the 'Add Reply' and add the new log to this thread.


Thanks and again sorry for the delay.

We need to see some information about what is happening in your machine. Please perform the following scan:
  • Download DDS by sUBs from one of the following links. Save it to your desktop.
  • Double click on the DDS icon, allow it to run.
  • A small box will open, with an explaination about the tool. No input is needed, the scan is running.
  • Notepad will open with the results.
  • Follow the instructions that pop up for posting the results.
  • Close the program window, and delete the program from your desktop.
Please note: You may have to disable any script protection running if the scan fails to run. After downloading the tool, disconnect from the internet and disable all antivirus protection. Run the scan, enable your A/V and reconnect to the internet.

Information on A/V control HERE

regards, Elise


"Now faith is the substance of things hoped for, the evidence of things not seen."

 

Follow BleepingComputer on: Facebook | Twitter | Google+ | lockerdome

 

Malware analyst @ Emsisoft


#3 metalmaiden

metalmaiden
  • Topic Starter

  • Members
  • 48 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:South Australia
  • Local time:10:24 AM

Posted 02 July 2009 - 04:57 AM

Hi elise,
Thanks for replying :thumbup2:

Here's a Spybot log from this morning

Attached File  SpybotSD.Report2July.zip   7.94KB   9 downloads


And here are the dds logs


DDS (Ver_09-06-26.01) - FAT32x86
Run by Tascha at 19:14:52.82 on Thu 07/02/2009
Internet Explorer: 8.0.6001.18702
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1503.1003 [GMT 9.5:30]

AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
SVCHOST.EXE
C:\WINDOWS\System32\svchost.exe -k netsvcs
SVCHOST.EXE
SVCHOST.EXE
C:\WINDOWS\system32\spoolsv.exe
SVCHOST.EXE
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
SVCHOST.EXE
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\WINDOWS\system32\SearchIndexer.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Program Files\Safari\Safari.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Documents and Settings\Tascha\Desktop\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.ninemsn.com.au/
uDefault_Page_URL = hxxp://www.ninemsn.com.au
uInternet Connection Wizard,ShellNext = hxxp://global.acer.com/
uInternet Settings,ProxyOverride = *.local
uURLSearchHooks: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - c:\program files\avg\avg8\toolbar\IEToolbar.dll
uURLSearchHooks: H - No File
BHO: AcroIEHlprObj Class: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 7.0\activex\AcroIEHelper.dll
BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg8\avgssie.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll
BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - c:\program files\avg\avg8\toolbar\IEToolbar.dll
BHO: MSN Toolbar Helper: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - c:\program files\msn\toolbar\3.0.1203.0\msneshellx.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: Easy-WebPrint: {327c2873-e90d-4c37-aa9d-10ac9baba46c} - c:\program files\canon\easy-webprint\Toolband.dll
TB: MSN Toolbar: {1e61ed7c-7cb8-49d6-b9e9-ab4c880c8414} - c:\program files\msn\toolbar\3.0.1203.0\msneshellx.dll
TB: AVG Security Toolbar: {ccc7a320-b3ca-4199-b1a6-9f516dd69829} - c:\program files\avg\avg8\toolbar\IEToolbar.dll
TB: {A057A204-BACC-4D26-9990-79A187E2698E} - No File
TB: {604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - No File
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [msnmsgr] "c:\program files\windows live\messenger\msnmsgr.exe" /background
mRun: [AVG8_TRAY] c:\progra~1\avg\avg8\avgtray.exe
mRun: [SiSPower] Rundll32.exe SiSPower.dll,ModeAgent
dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE
IE: E&xport to Microsoft Excel - c:\progra~1\micros~3\office12\EXCEL.EXE/3000
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBC} - c:\program files\java\jre6\bin\jp2iexp.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~3\office12\REFIEBAR.DLL
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll
DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} - hxxp://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab
DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} - hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
DPF: {F1D54B0B-B6EA-43B5-BD26-A79D3DBF47E3} - hxxps://bigpondmusic.com/activex/multidownx.cab
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg8\avgpp.dll
Notify: AtiExtEvent - Ati2evxx.dll
Notify: avgrsstarter - avgrsstx.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SEH: Windows Desktop Search Namespace Manager: {56f9679e-7826-4c84-81f3-532071a8bcc5} - c:\program files\windows desktop search\MSNLNamespaceMgr.dll

============= SERVICES / DRIVERS ===============

R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2008-6-1 327688]
R1 AvgMfx86;AVG On-access Scanner Minifilter Driver x86;c:\windows\system32\drivers\avgmfx86.sys [2007-3-3 27784]
R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2009-4-21 108552]
R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\avg\avg8\avgwdsvc.exe [2008-6-1 298776]
S3 C4C_BSC2;C4C_BSC2;c:\windows\system32\drivers\C4C_BSC2.sys [2005-8-4 84788]

=============== Created Last 30 ================

2009-06-21 17:57 337,320 a------- c:\windows\difxapi.dll
2009-06-21 12:31 0 a------- c:\documents and settings\tascha\settings.dat
2009-06-18 09:03 <DIR> --d----- c:\docume~1\alluse~1\applic~1\AVG Security Toolbar
2009-06-17 10:34 <DIR> --d----- c:\program files\Malwarebytes' Anti-Malware
2009-06-17 08:55 <DIR> --dsh--- C:\FOUND.002
2009-06-15 13:34 8,192 a--sh--- c:\windows\Thumbs.db
2009-06-15 11:41 <DIR> --d----- c:\windows\pss
2009-06-15 11:39 <DIR> --d----- c:\program files\VS Revo Group
2009-06-15 11:37 246,272 -------- c:\windows\system32\dllcache\ieproxy.dll
2009-06-15 11:37 12,800 -------- c:\windows\system32\dllcache\xpshims.dll

==================== Find3M ====================

2009-06-18 09:04 327,688 a------- c:\windows\system32\drivers\avgldx86.sys
2009-06-17 11:27 38,160 a------- c:\windows\system32\drivers\mbamswissarmy.sys
2009-06-17 11:27 19,096 a------- c:\windows\system32\drivers\mbam.sys
2009-06-16 10:09 90,112 a------- c:\windows\DUMP3fd7.tmp
2009-06-16 10:08 90,112 a------- c:\windows\DUMP3f89.tmp
2009-06-16 10:07 90,112 a------- c:\windows\DUMP3e12.tmp
2009-06-16 10:05 90,112 a------- c:\windows\DUMP3cba.tmp
2009-06-16 10:02 90,112 a------- c:\windows\DUMP3de3.tmp
2009-06-11 15:46 90,112 a------- c:\windows\DUMP4788.tmp
2009-05-26 19:52 90,112 a------- c:\windows\DUMP470c.tmp
2009-05-26 19:45 90,112 a------- c:\windows\DUMP472a.tmp
2009-05-26 19:36 90,112 a------- c:\windows\DUMP47d6.tmp
2009-05-26 10:03 90,112 a------- c:\windows\DUMP47b7.tmp
2009-05-25 00:24 350,208 -------- c:\windows\system32\mssph.dll
2009-05-18 12:15 90,112 a------- c:\windows\DUMP470b.tmp
2009-05-13 14:45 5,936,128 a------- c:\windows\system32\dllcache\mshtml.dll
2009-05-13 14:45 915,456 a------- c:\windows\system32\wininet.dll
2009-05-13 14:45 915,456 a------- c:\windows\system32\dllcache\wininet.dll
2009-05-12 15:12 26,144 a------- c:\windows\system32\spupdsvc.exe
2009-05-08 01:02 345,600 a------- c:\windows\system32\localspl.dll
2009-05-08 01:02 345,600 -------- c:\windows\system32\dllcache\localspl.dll
2009-05-02 13:35 11,952 a------- c:\windows\system32\avgrsstx.dll
2009-05-01 06:52 1,985,024 a------- c:\windows\system32\dllcache\iertutil.dll
2009-05-01 06:52 11,064,832 a------- c:\windows\system32\dllcache\ieframe.dll
2009-05-01 06:52 1,207,808 a------- c:\windows\system32\dllcache\urlmon.dll
2009-05-01 06:52 385,536 a------- c:\windows\system32\dllcache\iedkcs32.dll
2009-05-01 06:52 25,600 a------- c:\windows\system32\dllcache\jsproxy.dll
2009-04-30 20:51 173,056 a------- c:\windows\system32\dllcache\ie4uinit.exe
2009-04-21 10:41 63,752,952 a------- C:\avg_free_stf_en_85_287a1483.exe
2009-04-17 21:56 1,847,168 a------- c:\windows\system32\win32k.sys
2009-04-17 21:56 1,847,168 -------- c:\windows\system32\dllcache\win32k.sys
2009-04-16 00:21 585,216 a------- c:\windows\system32\rpcrt4.dll
2009-04-16 00:21 585,216 -------- c:\windows\system32\dllcache\rpcrt4.dll
2009-04-13 10:46 0 a------- C:\u.bat
2008-12-06 14:39 3,720,910 a------- c:\program files\gmaker.exe
2007-06-11 17:44 0 a------- c:\docume~1\tascha\applic~1\wklnhst.dat
2008-10-25 12:50 32,768 a--sh--- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012008102520081026\index.dat

============= FINISH: 19:15:20.78 ===============


Attached File  Attach.zip   3.06KB   6 downloads

#4 Farbar

Farbar

    Just Curious


  • Security Developer
  • 21,707 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:The Netherlands
  • Local time:02:54 AM

Posted 04 July 2009 - 05:22 AM

Hi metalmaiden,

Welcome to BC HijackThis forum. I am farbar. I am going to assist you with your problem.

Please refrain from making any changes to your system (updating Windows, installing applications, removing files, etc.) from now on as it might prolong handling your log and make the job for both of us more difficult.
  • Open your Malwarebytes' Anti-Malware, first update it, run a "quick scan", let reboot if needed and copy/paste the log to your reply.

    Note: The logs are saved by default under the Logs tab. If the log did not automatically open you can obtain the latest log from there.

  • Please make sure you run ComboFix just once. I need to see the log of the first run. Download ComboFix from one of these locations:

    Link 1
    Link 2
    Link 3

    * IMPORTANT !!! Save ComboFix.exe to your Desktop

  • Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. (Information on A/V control HERE)
  • Double click on ComboFix.exe & follow the prompts.
  • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

Posted Image


Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

Posted Image


Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please copy and paste the C:\ComboFix.txt in your next reply.
Please include in your next reply:
  • The log of MBAM.
  • The Combofix log.
  • Any comment or feedback about how it went.


#5 metalmaiden

metalmaiden
  • Topic Starter

  • Members
  • 48 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:South Australia
  • Local time:10:24 AM

Posted 05 July 2009 - 12:01 AM

Hi farbar

Thanks for your assistance :thumbup2:
I'm finding all this stuff interesting


First here's the mbam log

Malwarebytes' Anti-Malware 1.38
Database version: 2374
Windows 5.1.2600 Service Pack 3

7/5/2009 1:36:54 PM
mbam-log-2009-07-05 (13-36-54).txt

Scan type: Quick Scan
Objects scanned: 152248
Time elapsed: 19 minute(s), 7 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)


and here's the Combofix log


ComboFix 09-07-04.04 - Tascha 07/05/2009 13:50.1 - FAT32x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1503.800 [GMT 9.5:30]
Running from: c:\documents and settings\Tascha\Desktop\ComboFix.exe
AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\u.bat
c:\windows\Installer\1161aa4.msp
c:\windows\Installer\4ae8d1.msp
c:\windows\system32\autorun.ini
c:\windows\system32\mlfcache.dat

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_UACd.sys


((((((((((((((((((((((((( Files Created from 2009-06-05 to 2009-07-05 )))))))))))))))))))))))))))))))
.

2009-06-29 03:53 . 2009-06-17 23:33 2052888 ----a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\avgcorex.dll
2009-06-21 08:27 . 2006-03-22 04:23 337320 ----a-w- c:\windows\difxapi.dll
2009-06-21 03:01 . 2009-06-21 03:01 0 ----a-w- c:\documents and settings\Tascha\settings.dat
2009-06-18 11:39 . 2009-06-18 11:41 3561743 ----a-w- c:\documents and settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe
2009-06-18 00:01 . 2009-06-14 06:37 1004800 ----a-w- c:\documents and settings\All Users\Application Data\AVG Security Toolbar\IEToolbar.dll
2009-06-17 23:33 . 2009-06-17 23:33 -------- d-----w- c:\documents and settings\All Users\Application Data\AVG Security Toolbar
2009-06-17 01:04 . 2009-06-17 01:04 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-06-16 23:25 . 2009-06-16 23:25 -------- d-sh--w- C:\FOUND.002
2009-06-15 02:09 . 2009-06-15 02:09 -------- d-----w- c:\program files\VS Revo Group
2009-06-15 02:07 . 2009-04-30 21:22 12800 ------w- c:\windows\system32\dllcache\xpshims.dll
2009-06-15 02:07 . 2009-04-30 21:22 246272 ------w- c:\windows\system32\dllcache\ieproxy.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-07-05 04:25 . 2007-11-24 00:36 12 ----a-w- c:\windows\bthservsdp.dat
2009-06-17 23:34 . 2008-06-01 05:19 327688 ----a-w- c:\windows\system32\drivers\avgldx86.sys
2009-06-17 23:34 . 2007-03-03 06:26 27784 ----a-w- c:\windows\system32\drivers\avgmfx86.sys
2009-06-17 01:57 . 2009-01-19 10:42 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-06-17 01:57 . 2009-01-19 10:42 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-06-16 00:39 . 2005-09-27 05:25 90112 ----a-w- c:\windows\DUMP3fd7.tmp
2009-06-16 00:38 . 2005-09-27 05:25 90112 ----a-w- c:\windows\DUMP3f89.tmp
2009-06-16 00:37 . 2005-09-27 05:25 90112 ----a-w- c:\windows\DUMP3e12.tmp
2009-06-16 00:35 . 2005-09-27 05:25 90112 ----a-w- c:\windows\DUMP3cba.tmp
2009-06-16 00:32 . 2005-09-27 05:25 90112 ----a-w- c:\windows\DUMP3de3.tmp
2009-06-11 06:16 . 2005-09-27 05:25 90112 ----a-w- c:\windows\DUMP4788.tmp
2009-05-26 10:22 . 2005-09-27 05:25 90112 ----a-w- c:\windows\DUMP470c.tmp
2009-05-26 10:15 . 2005-09-27 05:25 90112 ----a-w- c:\windows\DUMP472a.tmp
2009-05-26 10:06 . 2005-09-27 05:25 90112 ----a-w- c:\windows\DUMP47d6.tmp
2009-05-26 00:33 . 2005-09-27 05:25 90112 ----a-w- c:\windows\DUMP47b7.tmp
2009-05-24 14:54 . 2008-05-26 12:48 350208 ------w- c:\windows\system32\mssph.dll
2009-05-22 11:06 . 2009-05-22 11:06 -------- d-----w- c:\documents and settings\Tascha\Application Data\Windows Search
2009-05-21 08:20 . 2009-05-21 08:20 -------- d-sh--w- c:\documents and settings\brat\Application Data\lowsec
2009-05-18 02:45 . 2005-09-27 05:25 90112 ----a-w- c:\windows\DUMP470b.tmp
2009-05-14 11:39 . 2009-05-14 11:39 -------- d-----w- c:\documents and settings\brat\Application Data\Windows Search
2009-05-13 05:15 . 2005-04-19 01:58 915456 ----a-w- c:\windows\system32\wininet.dll
2009-05-12 05:42 . 2007-03-03 07:37 26144 ----a-w- c:\windows\system32\spupdsvc.exe
2009-05-07 15:32 . 2005-04-19 01:58 345600 ----a-w- c:\windows\system32\localspl.dll
2009-05-02 04:05 . 2008-06-01 05:19 11952 ----a-w- c:\windows\system32\avgrsstx.dll
2009-05-02 04:04 . 2009-04-21 01:23 108552 ----a-w- c:\windows\system32\drivers\avgtdix.sys
2009-04-21 02:23 . 2009-04-21 02:23 152576 ----a-w- c:\documents and settings\Tascha\Application Data\Sun\Java\jre1.6.0_13\lzma.dll
2009-04-21 01:11 . 2009-04-21 01:11 63752952 ----a-w- C:\avg_free_stf_en_85_287a1483.exe
2009-04-17 12:26 . 2005-04-19 01:58 1847168 ----a-w- c:\windows\system32\win32k.sys
2009-04-15 14:51 . 2005-04-19 01:58 585216 ----a-w- c:\windows\system32\rpcrt4.dll
2008-12-06 05:09 . 2008-12-06 05:09 3720910 ----a-w- c:\program files\gmaker.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A3BC75A2-1F87-4686-AA43-5347D756017C}]
2009-06-14 06:37 1004800 ----a-w- c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-02-06 3885408]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-06-17 1948440]
"SiSPower"="SiSPower.dll" - c:\windows\system32\SiSPower.dll [2005-05-26 49152]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-24 304128]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-05-02 04:05 11952 ----a-w- c:\windows\system32\avgrsstx.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Exif Launcher.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Exif Launcher.lnk
backup=c:\windows\pss\Exif Launcher.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Utility Tray.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Utility Tray.lnk
backup=c:\windows\pss\Utility Tray.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Windows Search.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Windows Search.lnk
backup=c:\windows\pss\Windows Search.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"WMPNetworkSvc"=3 (0x3)
"RichVideo"=2 (0x2)
"ose"=3 (0x3)
"odserv"=3 (0x3)
"NVSvc"=2 (0x2)
"NMIndexingService"=3 (0x3)
"NBService"=3 (0x3)
"JavaQuickStarterService"=2 (0x2)
"iPod Service"=3 (0x3)
"InCDsrv"=2 (0x2)
"IDriverT"=3 (0x3)
"CCALib8"=2 (0x2)
"Bonjour Service"=2 (0x2)
"avg8wd"=2 (0x2)
"ATI Smart"=2 (0x2)
"Ati HotKey Poller"=2 (0x2)
"Apple Mobile Device"=2 (0x2)
"AgereModemAudio"=2 (0x2)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\System32\\mmc.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"c:\\Program Files\\CyberLink\\PowerDVD\\PowerDVD.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgnsx.exe"=

R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [6/1/2008 2:49 PM 327688]
R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [4/21/2009 10:53 AM 108552]
R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [6/1/2008 2:49 PM 298776]
S3 C4C_BSC2;C4C_BSC2;c:\windows\system32\drivers\C4C_BSC2.sys [8/4/2005 2:07 PM 84788]
.
Contents of the 'Scheduled Tasks' folder

2009-06-22 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 03:04]
.
- - - - ORPHANS REMOVED - - - -

SafeBoot-AVG Anti-Spyware Driver
SafeBoot-AVG Anti-Spyware Guard


.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.ninemsn.com.au/
uInternet Connection Wizard,ShellNext = hxxp://global.acer.com/
uInternet Settings,ProxyOverride = *.local
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
DPF: {F1D54B0B-B6EA-43B5-BD26-A79D3DBF47E3} - hxxps://bigpondmusic.com/activex/multidownx.cab
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-07-05 13:56
Windows 5.1.2600 Service Pack 3 FAT NTAPI

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(532)
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'explorer.exe'(1084)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\AVG\AVG8\AVGWDSVC.EXE
c:\windows\SYSTEM32\SEARCHINDEXER.EXE
c:\program files\AVG\AVG8\AVGRSX.EXE
c:\program files\AVG\AVG8\AVGNSX.EXE
c:\windows\system32\wscntfy.exe
c:\program files\AVG\AVG8\AVGTRAY.EXE
c:\program files\Windows Live\Contacts\wlcomm.exe
.
**************************************************************************
.
Completion time: 2009-07-05 13:59 - machine was rebooted
ComboFix-quarantined-files.txt 2009-07-05 04:29

Pre-Run: 49,495,605,248 bytes free
Post-Run: 51,483,443,200 bytes free

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect

Current=2 Default=2 Failed=3 LastKnownGood=4 Sets=1,2,3,4
193 --- E O F --- 2009-06-17 00:51



Everything appeared to run smoothly. My computer reverted back to IE as default browser when I came on the net after the scan. I changed the default back to Safari (I prefer it, It's faster and I've had less trouble with it). Is that ok?

#6 Farbar

Farbar

    Just Curious


  • Security Developer
  • 21,707 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:The Netherlands
  • Local time:02:54 AM

Posted 05 July 2009 - 05:51 AM

Everything appeared to run smoothly. My computer reverted back to IE as default browser when I came on the net after the scan. I changed the default back to Safari (I prefer it, It's faster and I've had less trouble with it). Is that ok?


Thanks for the feedback. Malware frequently changes the IE settings. ComboFix sets IE to its default setting. We will not need to run ComboFix. It did the job and removed the rootkit service.
  • Your Java is out of date. Older versions have vulnerabilities that malicious sites can use to exploit and infect your system. Please follow these steps to remove older version Java components and update:
    • Download the latest version of Java Runtime Environment (JRE) Version 6 and save it to your desktop.
    • Look for "Java SE Runtime Environment (JRE)" JRE 6 Update 14.
    • Click the Download button to the right.
    • Select your Platform: "Windows".
    • Select your Language: "Multi-language".
    • Read the License Agreement, and then check the box that says: "Accept License Agreement".
    • Click Continue and the page will refresh.
    • Under Required Files, check the box for Windows Offline Installation, click the link below it and save the file to your desktop.
    • Close any programs you may have running - especially your web browser.
    • Go to Start > Settings > Control Panel, double-click on Add/Remove Programs and remove all older versions of Java.
    • Check (highlight) any item with Java Runtime Environment (JRE or J2SE) in the name.
    • Click the Remove or Change/Remove button and follow the onscreen instructions for the Java uninstaller.
    • Repeat as many times as necessary to remove each Java versions.
    • Reboot your computer once all Java components are removed.
    • Then from your desktop double-click on jre-6u13-windows-i586-p.exe to install the newest version.
    -- If using Windows Vista and the installer refuses to launch due to insufficient user permissions, then Run As Administrator.
    -- If you choose to update via the Java applet in Control Panel, uncheck the option to install the Toolbar unless you want it.
    -- The uninstaller incorporated in this release removes previous Updates 10 and above, but does not remove older versions, so they still need to be removed manually.


    Note: The Java Quick Starter (JQS.exe) adds a service to improve the initial startup time of Java applets and applications. To disable the JQS service if you don't want to use it, go to Start > Control Panel > Java > Advanced > Miscellaneous and uncheck the box for Java Quick Starter. Click Ok and reboot your computer.

  • This small application you may want to keep and use to keep the computer clean.
    Download CCleaner from here http://www.ccleaner.com/
    • Run the installer to install the application.
    • When it gives you the option to install Yahoo toolbar uncheck the box next to it.
    • Run CCleaner. (make sure under Windows tab all the boxes of Internet Explorer and Windows explorer are checked. Under System check Empty Recycle Bin and Temporary Files. Under Application tab all the boxes should be checked).
    • Click Run Cleaner.
    • Close CCleaner.
  • Please tell me how is your computer running.


#7 metalmaiden

metalmaiden
  • Topic Starter

  • Members
  • 48 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:South Australia
  • Local time:10:24 AM

Posted 05 July 2009 - 09:05 AM

Hi thanks again :thumbup2:

I followed your directions and everything went well.

My computer is still running well. Do you think it is now safe to use for banking/paying bills online, etc?

Also, I found a folder named "kl.files" on my D: drive. It contains folders named "bases_rd", "data_rd", "dskm_rd", "qb" and "report" I think the computer shop may have put it there when they "cleaned" my computer. Do you know what this is and can I delete it?

#8 Farbar

Farbar

    Just Curious


  • Security Developer
  • 21,707 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:The Netherlands
  • Local time:02:54 AM

Posted 05 July 2009 - 09:19 AM

That folder should not be from Windows. You can rename the folder to old.kl.files and keep it for a while just in case some program asks for it. If no program asked for it it will do no harm and after sometime can remove it.

The computer is basically clean and there is no active or overt malware on it. However since you want to do banking with it an extra check does no harm. Better safe than sorry.

I'd like us to scan your machine with ESET OnlineScan
  • Hold down Control and click on the following link to open ESET OnlineScan in a new window.
    ESET OnlineScan
  • Click the Posted Image button.
  • For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
    • Click on Posted Image to download the ESET Smart Installer. Save it to your desktop.
    • Double click on the Posted Image icon on your desktop.
  • Check Posted Image
  • Click the Posted Image button.
  • Accept any security warnings from your browser.
  • Check Posted Image
  • Push the Start button.
  • ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
  • When the scan completes, push Posted Image
  • Push Posted Image, and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
  • Push the Posted Image button.
  • Push Posted Image

Edited by farbar, 06 July 2009 - 02:27 AM.


#9 metalmaiden

metalmaiden
  • Topic Starter

  • Members
  • 48 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:South Australia
  • Local time:10:24 AM

Posted 05 July 2009 - 09:37 AM

Ok I'll get on to that tomorrow. It's midnight here so I'm off to bed. Good night :thumbup2:

#10 Farbar

Farbar

    Just Curious


  • Security Developer
  • 21,707 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:The Netherlands
  • Local time:02:54 AM

Posted 05 July 2009 - 01:20 PM

Thanks for letting me know. Sleep well. :thumbup2:

#11 metalmaiden

metalmaiden
  • Topic Starter

  • Members
  • 48 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:South Australia
  • Local time:10:24 AM

Posted 05 July 2009 - 11:18 PM

Hi farbar,

I scanned with ESET and it reported "no threats found" :thumbup2:
There's no option to click on to see a list, so there's no report.
Does this mean we're all clear?

I've been reading about firewalls, I'm using the standard built in windows XP firewall. Do you recommend using a different one? Which one do you recommend?
Thanks again

#12 Farbar

Farbar

    Just Curious


  • Security Developer
  • 21,707 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:The Netherlands
  • Local time:02:54 AM

Posted 06 July 2009 - 02:33 AM

It looks good. :thumbup2:

Go to start > run and copy and paste or type next command in the field then hit enter:

ComboFix /u

Note: There's a space between Combofix and /

This will uninstall Combofix, delete its related folders and files, reset your clock settings, hide file extensions, hide the system/hidden files and resets System Restore again.

It makes a clean Restore Point and clears all the old restore points in order to prevent possible reinfection from an old one through system restore.


Optional Recommendations:
  • Your log looks clean. But your computer is still very much susceptible in particular to hacking and intrusion from outside. I strongly advise you to install a firewall before surfing. The windows firewall is not good enough. The Windows firewall provides protection from outside threats as long as the malware is not on your system. When the malware gets to your computer Windows firewall is no more effective. You find more information on firewalls below.
    Click for more information on:Understanding and Using Firewalls

    There are several good free programs available like:
    Sunbelt-Kerio

    Online Armor Free edition

  • The rule of thumb: One AntiVirus with real-time protection, one firewall (other than Windows firewall) and one antispyware with real-time protection. Any additional anti-malware shouldn't be running.
Happy Surfing!

#13 metalmaiden

metalmaiden
  • Topic Starter

  • Members
  • 48 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:South Australia
  • Local time:10:24 AM

Posted 06 July 2009 - 07:12 AM

I really appreciate your help farbar, you're awesome! :)

I think I'll go with a paid version of AVG internet security (it has a firewall, you probably knew that) I'm used to using AVG free and I've liked it so far. I tried to download the trial version (I have to wait til payday for a paid version :thumbup2: )
But the download failed, I'll call their customer support tomorrow for help.

Once again, thank you :)

#14 Farbar

Farbar

    Just Curious


  • Security Developer
  • 21,707 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:The Netherlands
  • Local time:02:54 AM

Posted 06 July 2009 - 10:40 AM

You are most welcome metalmaiden. :)

An antivirus with firewall (Internet Security) is a good choice. :thumbup2:

This thread will now be closed since the issue seems to be resolved.

If you need this topic reopened, please send me a PM and I will reopen it for you.

If you should have a new issue, please start a new topic.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users