Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Browser Hijack - IE opens multiple windows


  • This topic is locked This topic is locked
75 replies to this topic

#1 Angelfish

Angelfish

  • Members
  • 34 posts
  • OFFLINE
  •  
  • Local time:08:05 AM

Posted 30 August 2009 - 11:34 PM

Hey there, miracle workers.

I am a Firefox user. IE opened when I viewed a file for work, and everything blew up from there. My printer was uninstalled and my computer started to reboot itself at random. I ran several virus scans. The automatic shut downs have lessened in frequency, but still occur from time to time. What is happening now is IE opening itself and opening several tabs, one after the other, which are usually directed to gambling sites.

After a little research, I downloaded HiJackThis and tried to read my own results. This has been unsuccessful. I am hopeful that some kind soul here will take a look and help me. My HJT log reads as follows:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:33:52 PM, on 8/30/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
C:\Program Files\Microsoft SQL Server\MSSQL\Binn\sqlservr.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\WINDOWS\stsystra.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\Program Files\Dell\QuickSet\quickset.exe
C:\WINDOWS\OEM02Mon.exe
C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://pchs.angellearning.com/frames.aspx
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
F2 - REG:system.ini: Shell=
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet
O4 - HKLM\..\Run: [NVHotkey] rundll32.exe nvHotkey.dll,Start
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe
O4 - HKLM\..\Run: [OEM02Mon.exe] C:\WINDOWS\OEM02Mon.exe
O4 - HKLM\..\Run: [ISUSPM] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -scheduler
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\User\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-19\..\RunOnce: [ShowDeskFix] regsvr32 /s /n /i:u shell32 (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [IE7-11] rundll32 advpack.dll,LaunchINFSection NR_IE7en.inf,AfterUserStart (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [ShowDeskFix] regsvr32 /s /n /i:u shell32 (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\RunOnce: [ShowDeskFix] regsvr32 /s /n /i:u shell32 (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [ShowDeskFix] regsvr32 /s /n /i:u shell32 (User 'Default user')
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Service Manager.lnk = C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1188056219734
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1188056211890
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: IviRegMgr - InterVideo - C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\WINDOWS\system32\DRIVERS\xaudio.exe

--
End of file - 8330 bytes

Thank you so much for your time.

BC AdBot (Login to Remove)

 


#2 thewall

thewall

  • Malware Response Team
  • 6,425 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Florida
  • Local time:10:05 AM

Posted 31 August 2009 - 11:30 AM

Hello Angelfish :( Welcome to the BC HijackThis Log and Analysis forum. I will be assisting you in cleaning up your system.


I ask that you refrain from running tools other than those we suggest while we are cleaning up your computer. The reason for this is so we know what is going on with the machine at any time. Some programs can interfere with others and hamper the recovery process.



In the upper right hand corner of the topic you will see a button called Options. If you click on this in the drop-down menu you can choose Track this topic. By doing this and then choosing Immediate E-Mail notification and then clicking on Proceed you will be advised when we respond the your topic and facilitate the cleaning of your machine.

After 5 days if a topic is not replied to we assume it has been abandoned and it is closed.





Please perform the following:



We need to scan for Rootkits with GMER
  • Please download GMER from one of the following locations, and save it to your desktop:
    • Main Mirror
      This version will download a randomly named file (Recommended)
    • Zip Mirror
      This version will download a zip file you will need to extract first. If you use this mirror, please extract the zip file to your desktop.
  • Close any and all open programs, as this process may crash your computer.
  • Double click Posted Image or Posted Image on your desktop.
  • Allow the gmer.sys driver to load if asked.
  • You may see this window. If you do, click No.
    Posted Image
  • Click on Posted Image and wait for the scan to finish.
  • If you see a rootkit warning window, click OK.
  • Push Posted Image and save the logfile to your desktop.
  • Copy and Paste the contents of that file in your next post.



Please do not post any logs as an attachment unless asked to do so.





Thanks,



thewall
If I have helped you then please consider donating so I can continue the fight against malware Posted Image
All donations go directly to the helper

Posted Image

Due to the large amount of backlogs we have I cannot respond to PMs for help unless I am already working with you

#3 Angelfish

Angelfish
  • Topic Starter

  • Members
  • 34 posts
  • OFFLINE
  •  
  • Local time:08:05 AM

Posted 02 September 2009 - 07:43 PM

Hi thewall.

Thank you so much for your help! The GMER log is pasted below:



GMER 1.0.15.15077 [j440pxp1.exe] - http://www.gmer.net
Rootkit scan 2009-09-02 17:39:27
Windows 5.1.2600 Service Pack 2


---- System - GMER 1.0.15 ----

SSDT 866E8038 ZwAlertResumeThread
SSDT 8657C008 ZwAlertThread
SSDT 8662D290 ZwAllocateVirtualMemory
SSDT 86549350 ZwConnectPort
SSDT 865BC280 ZwCreateMutant
SSDT 866DB178 ZwCreateThread
SSDT \??\C:\Program Files\Symantec\SYMEVENT.SYS (Symantec Event Library/Symantec Corporation) ZwDeleteValueKey [0xF533C350]
SSDT 867654A0 ZwDeviceIoControlFile
SSDT 8647DE78 ZwFreeVirtualMemory
SSDT 8658CE30 ZwImpersonateAnonymousToken
SSDT 8658A068 ZwImpersonateThread
SSDT 8671A1D8 ZwMapViewOfSection
SSDT 86580280 ZwOpenEvent
SSDT 86599880 ZwOpenProcessToken
SSDT 8662B6B0 ZwOpenThreadToken
SSDT 86614C10 ZwQueryValueKey
SSDT 8671CDE8 ZwResumeThread
SSDT 866F7998 ZwSetContextThread
SSDT 8644F808 ZwSetInformationProcess
SSDT 86683320 ZwSetInformationThread
SSDT \??\C:\Program Files\Symantec\SYMEVENT.SYS (Symantec Event Library/Symantec Corporation) ZwSetValueKey [0xF533C580]
SSDT 865F0938 ZwSuspendProcess
SSDT 86756200 ZwSuspendThread
SSDT 86451438 ZwTerminateProcess
SSDT 8662B008 ZwTerminateThread
SSDT 8660CBF0 ZwUnmapViewOfSection
SSDT 8662CA70 ZwWriteVirtualMemory

Code 867647B0 pIofCompleteRequest

---- Kernel code sections - GMER 1.0.15 ----

.text ntkrnlpa.exe!ZwCallbackReturn + 2ECC 80503DA8 4 Bytes CALL FCD6AF7A

---- User code sections - GMER 1.0.15 ----

? C:\WINDOWS\System32\svchost.exe[3072] image checksum mismatch; number of sections mismatch; time/date stamp mismatch;

---- User IAT/EAT - GMER 1.0.15 ----

IAT C:\WINDOWS\System32\svchost.exe[3072] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!RegQueryValueExW] [77DD7883] C:\WINDOWS\system32\ADVAPI32.dll (Advanced Windows 32 Base API/Microsoft Corporation)
IAT C:\WINDOWS\System32\svchost.exe[3072] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!SetSecurityDescriptorDacl] [77DEADA7] C:\WINDOWS\system32\ADVAPI32.dll (Advanced Windows 32 Base API/Microsoft Corporation)
IAT C:\WINDOWS\System32\svchost.exe[3072] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!SetEntriesInAclW] [77E37071] C:\WINDOWS\system32\ADVAPI32.dll (Advanced Windows 32 Base API/Microsoft Corporation)
IAT C:\WINDOWS\System32\svchost.exe[3072] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!SetSecurityDescriptorGroup] [77DEB88C] C:\WINDOWS\system32\ADVAPI32.dll (Advanced Windows 32 Base API/Microsoft Corporation)
IAT C:\WINDOWS\System32\svchost.exe[3072] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!SetSecurityDescriptorOwner] [77DF3238] C:\WINDOWS\system32\ADVAPI32.dll (Advanced Windows 32 Base API/Microsoft Corporation)
IAT C:\WINDOWS\System32\svchost.exe[3072] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!InitializeSecurityDescriptor] [77DE5E4D] C:\WINDOWS\system32\ADVAPI32.dll (Advanced Windows 32 Base API/Microsoft Corporation)
IAT C:\WINDOWS\System32\svchost.exe[3072] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!GetTokenInformation] [77E0D52C] C:\WINDOWS\system32\ADVAPI32.dll (Advanced Windows 32 Base API/Microsoft Corporation)
IAT C:\WINDOWS\System32\svchost.exe[3072] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!OpenProcessToken] [77DD761B] C:\WINDOWS\system32\ADVAPI32.dll (Advanced Windows 32 Base API/Microsoft Corporation)
IAT C:\WINDOWS\System32\svchost.exe[3072] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!OpenThreadToken] [77DDEBE7] C:\WINDOWS\system32\ADVAPI32.dll (Advanced Windows 32 Base API/Microsoft Corporation)
IAT C:\WINDOWS\System32\svchost.exe[3072] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!SetServiceStatus] [77DD6BF0] C:\WINDOWS\system32\ADVAPI32.dll (Advanced Windows 32 Base API/Microsoft Corporation)
IAT C:\WINDOWS\System32\svchost.exe[3072] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!RegisterServiceCtrlHandlerW] [77DD7753] C:\WINDOWS\system32\ADVAPI32.dll (Advanced Windows 32 Base API/Microsoft Corporation)
IAT C:\WINDOWS\System32\svchost.exe[3072] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!RegCloseKey] [77DD7B76] C:\WINDOWS\system32\ADVAPI32.dll (Advanced Windows 32 Base API/Microsoft Corporation)
IAT C:\WINDOWS\System32\svchost.exe[3072] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!RegOpenKeyExW] 00000000
IAT C:\WINDOWS\System32\svchost.exe[3072] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!StartServiceCtrlDispatcherW] [7C809940] C:\WINDOWS\system32\kernel32.dll (Windows NT BASE API Client DLL/Microsoft Corporation)
IAT C:\WINDOWS\System32\svchost.exe[3072] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!WideCharToMultiByte] [7C863FFD] C:\WINDOWS\system32\kernel32.dll (Windows NT BASE API Client DLL/Microsoft Corporation)
IAT C:\WINDOWS\System32\svchost.exe[3072] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!lstrlenW] [7C864D27] C:\WINDOWS\system32\kernel32.dll (Windows NT BASE API Client DLL/Microsoft Corporation)
IAT C:\WINDOWS\System32\svchost.exe[3072] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!LocalFree] [7C81044C] C:\WINDOWS\system32\kernel32.dll (Windows NT BASE API Client DLL/Microsoft Corporation)
IAT C:\WINDOWS\System32\svchost.exe[3072] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!GetCurrentProcess] [7C80220F] C:\WINDOWS\system32\kernel32.dll (Windows NT BASE API Client DLL/Microsoft Corporation)
IAT C:\WINDOWS\System32\svchost.exe[3072] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!GetCurrentThread] [7C809A92] C:\WINDOWS\system32\kernel32.dll (Windows NT BASE API Client DLL/Microsoft Corporation)
IAT C:\WINDOWS\System32\svchost.exe[3072] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!GetProcAddress] [7C810DA7] C:\WINDOWS\system32\kernel32.dll (Windows NT BASE API Client DLL/Microsoft Corporation)
IAT C:\WINDOWS\System32\svchost.exe[3072] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!LoadLibraryExW] [7C801A24] C:\WINDOWS\system32\kernel32.dll (Windows NT BASE API Client DLL/Microsoft Corporation)
IAT C:\WINDOWS\System32\svchost.exe[3072] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!LCMapStringW] [7C8615B5] C:\WINDOWS\system32\kernel32.dll (Windows NT BASE API Client DLL/Microsoft Corporation)
IAT C:\WINDOWS\System32\svchost.exe[3072] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!FreeLibrary] [7C802442] C:\WINDOWS\system32\kernel32.dll (Windows NT BASE API Client DLL/Microsoft Corporation)
IAT C:\WINDOWS\System32\svchost.exe[3072] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!lstrcpyW] [7C80C078] C:\WINDOWS\system32\kernel32.dll (Windows NT BASE API Client DLL/Microsoft Corporation)
IAT C:\WINDOWS\System32\svchost.exe[3072] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!ExpandEnvironmentStringsW] [7C8092C5] C:\WINDOWS\system32\kernel32.dll (Windows NT BASE API Client DLL/Microsoft Corporation)
IAT C:\WINDOWS\System32\svchost.exe[3072] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!lstrcmpiW] [7C812D76] C:\WINDOWS\system32\kernel32.dll (Windows NT BASE API Client DLL/Microsoft Corporation)
IAT C:\WINDOWS\System32\svchost.exe[3072] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!ExitProcess] [7C812AFE] C:\WINDOWS\system32\kernel32.dll (Windows NT BASE API Client DLL/Microsoft Corporation)
IAT C:\WINDOWS\System32\svchost.exe[3072] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!GetCommandLineW] [7C80ABE1] C:\WINDOWS\system32\kernel32.dll (Windows NT BASE API Client DLL/Microsoft Corporation)
IAT C:\WINDOWS\System32\svchost.exe[3072] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!InitializeCriticalSection] [7C81CAAB] C:\WINDOWS\system32\kernel32.dll (Windows NT BASE API Client DLL/Microsoft Corporation)
IAT C:\WINDOWS\System32\svchost.exe[3072] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!GetProcessHeap] [7C809B04] C:\WINDOWS\system32\kernel32.dll (Windows NT BASE API Client DLL/Microsoft Corporation)
IAT C:\WINDOWS\System32\svchost.exe[3072] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!SetErrorMode] [7C809A71] C:\WINDOWS\system32\kernel32.dll (Windows NT BASE API Client DLL/Microsoft Corporation)
IAT C:\WINDOWS\System32\svchost.exe[3072] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!SetUnhandledExceptionFilter] [7C80FC4F] C:\WINDOWS\system32\kernel32.dll (Windows NT BASE API Client DLL/Microsoft Corporation)
IAT C:\WINDOWS\System32\svchost.exe[3072] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!RegisterWaitForSingleObject] [7C80E95F] C:\WINDOWS\system32\kernel32.dll (Windows NT BASE API Client DLL/Microsoft Corporation)
IAT C:\WINDOWS\System32\svchost.exe[3072] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!InterlockedCompareExchange] [7C810657] C:\WINDOWS\system32\kernel32.dll (Windows NT BASE API Client DLL/Microsoft Corporation)
IAT C:\WINDOWS\System32\svchost.exe[3072] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!LoadLibraryA] [7C80AC2F] C:\WINDOWS\system32\kernel32.dll (Windows NT BASE API Client DLL/Microsoft Corporation)
IAT C:\WINDOWS\System32\svchost.exe[3072] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!QueryPerformanceCounter] [7C831E35] C:\WINDOWS\system32\kernel32.dll (Windows NT BASE API Client DLL/Microsoft Corporation)
IAT C:\WINDOWS\System32\svchost.exe[3072] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!GetTickCount] [7C859F78] C:\WINDOWS\system32\kernel32.dll (Windows NT BASE API Client DLL/Microsoft Corporation)
IAT C:\WINDOWS\System32\svchost.exe[3072] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!GetCurrentThreadId] [7C91043D] C:\WINDOWS\system32\ntdll.dll (NT Layer DLL/Microsoft Corporation)
IAT C:\WINDOWS\System32\svchost.exe[3072] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!GetCurrentProcessId] [7C802367] C:\WINDOWS\system32\kernel32.dll (Windows NT BASE API Client DLL/Microsoft Corporation)
IAT C:\WINDOWS\System32\svchost.exe[3072] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!GetSystemTimeAsFileTime] [7C834CC9] C:\WINDOWS\system32\kernel32.dll (Windows NT BASE API Client DLL/Microsoft Corporation)
IAT C:\WINDOWS\System32\svchost.exe[3072] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!TerminateProcess] [7C814B12] C:\WINDOWS\system32\kernel32.dll (Windows NT BASE API Client DLL/Microsoft Corporation)
IAT C:\WINDOWS\System32\svchost.exe[3072] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!UnhandledExceptionFilter] [7C8024A7] C:\WINDOWS\system32\kernel32.dll (Windows NT BASE API Client DLL/Microsoft Corporation)
IAT C:\WINDOWS\System32\svchost.exe[3072] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!LocalAlloc] [7C80A9EC] C:\WINDOWS\system32\kernel32.dll (Windows NT BASE API Client DLL/Microsoft Corporation)
IAT C:\WINDOWS\System32\svchost.exe[3072] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!lstrcmpW] [7C80DE1E] C:\WINDOWS\system32\kernel32.dll (Windows NT BASE API Client DLL/Microsoft Corporation)
IAT C:\WINDOWS\System32\svchost.exe[3072] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!DelayLoadFailureHook] [7C810780] C:\WINDOWS\system32\kernel32.dll (Windows NT BASE API Client DLL/Microsoft Corporation)
IAT C:\WINDOWS\System32\svchost.exe[3072] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!NtQuerySecurityObject] [7C801D77] C:\WINDOWS\system32\kernel32.dll (Windows NT BASE API Client DLL/Microsoft Corporation)
IAT C:\WINDOWS\System32\svchost.exe[3072] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlFreeHeap] 00000000
IAT C:\WINDOWS\System32\svchost.exe[3072] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!NtOpenKey] [7E41A89D] C:\WINDOWS\system32\USER32.dll (Windows XP USER API Client DLL/Microsoft Corporation)
IAT C:\WINDOWS\System32\svchost.exe[3072] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!wcscat] [7E41A600] C:\WINDOWS\system32\USER32.dll (Windows XP USER API Client DLL/Microsoft Corporation)
IAT C:\WINDOWS\System32\svchost.exe[3072] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!wcscpy] [7E41A9A6] C:\WINDOWS\system32\USER32.dll (Windows XP USER API Client DLL/Microsoft Corporation)
IAT C:\WINDOWS\System32\svchost.exe[3072] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlAllocateHeap] 00000000
IAT C:\WINDOWS\System32\svchost.exe[3072] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlCompareUnicodeString] [42C8CDEA] C:\WINDOWS\system32\WININET.dll (Internet Extensions for Win32/Microsoft Corporation)
IAT C:\WINDOWS\System32\svchost.exe[3072] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlInitUnicodeString] [42C24351] C:\WINDOWS\system32\WININET.dll (Internet Extensions for Win32/Microsoft Corporation)
IAT C:\WINDOWS\System32\svchost.exe[3072] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlInitializeSid] [42C1DA89] C:\WINDOWS\system32\WININET.dll (Internet Extensions for Win32/Microsoft Corporation)
IAT C:\WINDOWS\System32\svchost.exe[3072] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlLengthRequiredSid] [42C249B2] C:\WINDOWS\system32\WININET.dll (Internet Extensions for Win32/Microsoft Corporation)
IAT C:\WINDOWS\System32\svchost.exe[3072] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlSubAuthoritySid] [42C2C869] C:\WINDOWS\system32\WININET.dll (Internet Extensions for Win32/Microsoft Corporation)
IAT C:\WINDOWS\System32\svchost.exe[3072] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!NtClose] [42C41374] C:\WINDOWS\system32\WININET.dll (Internet Extensions for Win32/Microsoft Corporation)
IAT C:\WINDOWS\System32\svchost.exe[3072] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlSubAuthorityCountSid] [42C367E6] C:\WINDOWS\system32\WININET.dll (Internet Extensions for Win32/Microsoft Corporation)
IAT C:\WINDOWS\System32\svchost.exe[3072] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlGetDaclSecurityDescriptor] [42C2ABBC] C:\WINDOWS\system32\WININET.dll (Internet Extensions for Win32/Microsoft Corporation)
IAT C:\WINDOWS\System32\svchost.exe[3072] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlQueryInformationAcl] [42C3363B] C:\WINDOWS\system32\WININET.dll (Internet Extensions for Win32/Microsoft Corporation)
IAT C:\WINDOWS\System32\svchost.exe[3072] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlGetAce] 00000000
IAT C:\WINDOWS\System32\svchost.exe[3072] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlImageNtHeader] [71AB428A] C:\WINDOWS\System32\WS2_32.dll (Windows Socket 2.0 32-Bit DLL/Microsoft Corporation)
IAT C:\WINDOWS\System32\svchost.exe[3072] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!wcslen] [71AB664D] C:\WINDOWS\System32\WS2_32.dll (Windows Socket 2.0 32-Bit DLL/Microsoft Corporation)
IAT C:\WINDOWS\System32\svchost.exe[3072] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlUnhandledExceptionFilter] [71AB951E] C:\WINDOWS\System32\WS2_32.dll (Windows Socket 2.0 32-Bit DLL/Microsoft Corporation)
IAT C:\WINDOWS\System32\svchost.exe[3072] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlCopySid] [71AB2B66] C:\WINDOWS\System32\WS2_32.dll (Windows Socket 2.0 32-Bit DLL/Microsoft Corporation)
IAT C:\WINDOWS\System32\svchost.exe[3072] @ C:\WINDOWS\System32\svchost.exe [RPCRT4.dll!RpcServerUnregisterIfEx] [71AB406A] C:\WINDOWS\System32\WS2_32.dll (Windows Socket 2.0 32-Bit DLL/Microsoft Corporation)
IAT C:\WINDOWS\System32\svchost.exe[3072] @ C:\WINDOWS\System32\svchost.exe [RPCRT4.dll!RpcMgmtWaitServerListen] [71AB3B91] C:\WINDOWS\System32\WS2_32.dll (Windows Socket 2.0 32-Bit DLL/Microsoft Corporation)
IAT C:\WINDOWS\System32\svchost.exe[3072] @ C:\WINDOWS\System32\svchost.exe [RPCRT4.dll!RpcMgmtSetServerStackSize] [71AB615A] C:\WINDOWS\System32\WS2_32.dll (Windows Socket 2.0 32-Bit DLL/Microsoft Corporation)
IAT C:\WINDOWS\System32\svchost.exe[3072] @ C:\WINDOWS\System32\svchost.exe [RPCRT4.dll!RpcServerUnregisterIf] [71AB2BF4] C:\WINDOWS\System32\WS2_32.dll (Windows Socket 2.0 32-Bit DLL/Microsoft Corporation)
IAT C:\WINDOWS\System32\svchost.exe[3072] @ C:\WINDOWS\System32\svchost.exe [RPCRT4.dll!RpcServerListen] [71AB4FD4] C:\WINDOWS\System32\WS2_32.dll (Windows Socket 2.0 32-Bit DLL/Microsoft Corporation)
IAT C:\WINDOWS\System32\svchost.exe[3072] @ C:\WINDOWS\System32\svchost.exe [RPCRT4.dll!RpcServerUseProtseqEpW] 00000000
IAT C:\WINDOWS\System32\svchost.exe[3072] @ C:\WINDOWS\System32\svchost.exe [RPCRT4.dll!RpcServerRegisterIf] [76D6A2AA] C:\WINDOWS\System32\iphlpapi.dll (IP Helper API/Microsoft Corporation)
IAT C:\WINDOWS\System32\svchost.exe[3072] @ C:\WINDOWS\System32\svchost.exe [RPCRT4.dll!I_RpcMapWin32Status] [76D6A252] C:\WINDOWS\System32\iphlpapi.dll (IP Helper API/Microsoft Corporation)
IAT C:\WINDOWS\System32\svchost.exe[3072] @ C:\WINDOWS\System32\svchost.exe [RPCRT4.dll!RpcMgmtStopServerListening] [76D6CE49] C:\WINDOWS\System32\iphlpapi.dll (IP Helper API/Microsoft Corporation)

---- Devices - GMER 1.0.15 ----

Device \FileSystem\Ntfs \Ntfs 86760AD0

AttachedDevice \FileSystem\Ntfs \Ntfs SYMEVENT.SYS (Symantec Event Library/Symantec Corporation)

Device \FileSystem\Mup \Dfs 86760AD0

AttachedDevice \Driver\Tcpip \Device\Ip 86763740

Device \FileSystem\RAW \Device\RawTape 86760AD0

AttachedDevice \Driver\Tcpip \Device\Tcp 86763740

Device \FileSystem\Mup \Device\Mup 86760AD0

AttachedDevice \Driver\Tcpip \Device\Udp 86763740
AttachedDevice \Driver\Tcpip \Device\RawIp 86763740

Device 86760AD0
Device \Driver\SYMTDI \Device\SymTDI 86763740
Device mrxsmb.sys (Windows NT SMB Minirdr/Microsoft Corporation)
Device \FileSystem\Mup \Device\WinDfs\Root 86760AD0
Device B7BDDC8A

AttachedDevice fltMgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
AttachedDevice SYMEVENT.SYS (Symantec Event Library/Symantec Corporation)

---- Threads - GMER 1.0.15 ----

Thread explorer.exe [1612:1940] 00FD0000

---- EOF - GMER 1.0.15 ----


See anything strange?

-Angelfish

#4 thewall

thewall

  • Malware Response Team
  • 6,425 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Florida
  • Local time:10:05 AM

Posted 02 September 2009 - 08:34 PM

Let's let ComboFix have a look at it:


Please download ComboFix from one of these locations:

Link 1
Link 2

* IMPORTANT !!! Save ComboFix.exe to your Desktop
  • Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. Instruction can be found HERE
  • Double click on ComboFix.exe & follow the prompts.
  • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

Posted Image



Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:


Posted Image


Click on Yes, to continue scanning for malware.

When finished, it will produce a log for you. Please include the C:\ComboFix.txt in your next reply.
If I have helped you then please consider donating so I can continue the fight against malware Posted Image
All donations go directly to the helper

Posted Image

Due to the large amount of backlogs we have I cannot respond to PMs for help unless I am already working with you

#5 Angelfish

Angelfish
  • Topic Starter

  • Members
  • 34 posts
  • OFFLINE
  •  
  • Local time:08:05 AM

Posted 03 September 2009 - 12:28 PM

Hello thewall.

I downloaded Combo Fix and disabled my security software, as instructed. When I tried to run Combo Fix my computer crashed. I got the "fatal and serious error" message. When it rebooted, an IE icon had inserted itself onto my desktop.

I was able to run Combo Fix on the second try. Here is the log:

ComboFix 09-09-02.02 - User 09/03/2009 10:09.1.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.1022.541 [GMT -7:00]
Running from: c:\documents and settings\User\My Documents\Downloads\ComboFix.exe
AV: Symantec AntiVirus Corporate Edition *On-access scanning disabled* (Updated) {FB06448E-52B8-493A-90F3-E43226D3305C}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\LOG45.tmp
C:\LOG47.tmp
C:\LOG4B.tmp
C:\LOG4D.tmp
C:\LOG59.tmp
C:\LOG695.tmp
C:\LOG6E0.tmp
C:\LOG6E1.tmp
C:\LOGA58.tmp
C:\LOGA69.tmp
C:\LOGA6A.tmp
C:\LOGAB1.tmp
C:\LOGAB3.tmp
C:\LOGAB6.tmp
C:\LOGAB7.tmp
C:\LOGAB8.tmp
C:\LOGAB9.tmp
C:\LOGABA.tmp
C:\LOGAD0.tmp
C:\LOGEA.tmp
c:\windows\system32\MabryObj.dll

.
((((((((((((((((((((((((( Files Created from 2009-08-03 to 2009-09-03 )))))))))))))))))))))))))))))))
.

2009-09-01 00:45 . 2009-09-01 00:45 -------- d-----w- C:\spoolerlogs
2009-08-31 01:49 . 2009-08-31 01:49 -------- d-----w- c:\program files\Trend Micro
2009-08-21 15:27 . 2009-08-21 15:27 -------- d-----w- c:\documents and settings\User\Local Settings\Application Data\Temp
2009-08-13 23:22 . 2009-08-13 23:22 45344 ----a-w- c:\windows\system32\drivers\lfneb1f.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-09-03 17:06 . 2007-08-24 22:40 -------- d-----w- c:\program files\Symantec AntiVirus
2009-09-01 22:35 . 2009-03-29 03:42 -------- d-----w- c:\documents and settings\All Users\Application Data\Google Updater
2009-08-30 02:12 . 2009-03-29 03:42 -------- d-----w- c:\program files\Google
2009-08-26 03:56 . 2007-08-24 22:27 143840 ----a-w- c:\windows\system32\nvModes.dat
2009-08-17 18:31 . 2007-08-26 22:48 -------- d-----w- c:\program files\HP
.

------- Sigcheck -------

[-] 2007-08-25 15:21 502272 6225F14B8CE08CCBA8B25AD27843C674 c:\windows\system32\winlogon.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Google Update"="c:\documents and settings\User\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2008-09-03 133104]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-03-29 39408]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-05-12 8429568]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-05-12 81920]
"ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2006-07-19 52896]
"vptray"="c:\progra~1\SYMANT~1\VPTray.exe" [2006-09-28 125168]
"Dell QuickSet"="c:\program files\Dell\QuickSet\quickset.exe" [2007-05-14 1191936]
"OEM02Mon.exe"="c:\windows\OEM02Mon.exe" [2007-02-02 36864]
"ISUSPM"="c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe" [2006-03-20 213936]
"NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 155648]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 132496]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-12 39792]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-03-29 413696]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-04-24 185896]
"SigmatelSysTrayApp"="stsystra.exe" - c:\windows\stsystra.exe [2007-05-06 405504]
"nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2007-05-12 1626112]
"NVHotkey"="nvHotkey.dll" - c:\windows\system32\nvhotkey.dll [2007-05-12 67584]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"ShowDeskFix"="shell32" [X]
"IE7-11"="advpack.dll" - c:\windows\system32\advpack.dll [2007-06-27 124928]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-12 83360]
Service Manager.lnk - c:\program files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe [2005-5-3 81920]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
020D155119868075E60F.Xaddr LINDSEY.LONG_BEACH.CA
020D155119868075E60F.Xsernum 3HLH6OQ0TUQ0003

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\InterVideo\\DVD8\\WinDVD.exe"=
"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Documents and Settings\\User\\Local Settings\\Application Data\\Google\\Google Talk Plugin\\googletalkplugin.dll"=
"c:\\Documents and Settings\\User\\Local Settings\\Application Data\\Google\\Google Talk Plugin\\googletalkplugin.exe"=
"c:\\Program Files\\ExamSoft\\SofTest\\SoftLnch.exe"= c:\\Program Files\\ExamSoft\\SoftLnch.exe
"c:\\Program Files\\ExamSoft\\SofTest\\softest.exe"= c:\\Program Files\\ExamSoft\\SofTest.exe

R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [8/29/2009 7:18 PM 102448]
R3 OEM02Afx;Provides a software interface to control audio effects of M08 Internal webcam.;c:\windows\system32\drivers\OEM02Afx.sys [8/25/2007 8:39 AM 141376]
R3 OEM02Dev;Creative Camera OEM002 Driver;c:\windows\system32\drivers\OEM02Dev.sys [8/25/2007 8:39 AM 234496]
R3 OEM02Vfx;Creative Camera OEM002 Video VFX Driver;c:\windows\system32\drivers\OEM02Vfx.sys [8/25/2007 8:39 AM 7424]
S0 lfneb1f;lfneb1f;\SystemRoot\\SystemRoot\System32\drivers\lfneb1f.sys --> \SystemRoot\\SystemRoot\System32\drivers\lfneb1f.sys [?]
S1 df84da32.sys;df84da32.sys;\??\c:\windows\System32\drivers\df84da32.sys --> c:\windows\System32\drivers\df84da32.sys [?]
S3 ADM8511;ADMtek ADM8511/AN986 USB To Fast Ethernet Converter;c:\windows\system32\drivers\ADM8511.SYS [8/24/2007 2:02 PM 20160]
S3 SavRoam;SAVRoam;c:\program files\Symantec AntiVirus\SavRoam.exe [9/27/2006 5:33 PM 116464]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
.
Contents of the 'Scheduled Tasks' folder

2009-09-03 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-03-29 03:42]

2009-08-30 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1715567821-1960408961-725345543-1004Core.job
- c:\documents and settings\User\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2008-09-03 23:44]

2009-09-03 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1715567821-1960408961-725345543-1004UA.job
- c:\documents and settings\User\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2008-09-03 23:44]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://pchs.angellearning.com/frames.aspx
uInternet Connection Wizard,ShellNext = iexplore
IE: E&xport to Microsoft Excel - c:\progra~1\MI1933~1\Office10\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\User\Application Data\Mozilla\Firefox\Profiles\l2yv0sq2.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/
FF - plugin: c:\documents and settings\User\Application Data\Mozilla\plugins\npgoogletalk.dll
FF - plugin: c:\documents and settings\User\Local Settings\Application Data\Google\Update\1.2.183.7\npGoogleOneClick8.dll
FF - plugin: c:\program files\Google\Google Updater\2.4.1536.6592\npCIDetect13.dll
.
.
------- File Associations -------
.
inifile=%SystemRoot%\System32\NOTEPAD.EXE %1"
.

**************************************************************************

disk not found C:\

please note that you need administrator rights to perform deep scan
scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files:

**************************************************************************
.
Completion time: 2009-09-03 10:14
ComboFix-quarantined-files.txt 2009-09-03 17:14

Pre-Run: 106,092,617,728 bytes free
Post-Run: 106,794,373,120 bytes free

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(3)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(3)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect

152



Thank you very much.

Angelfish

#6 thewall

thewall

  • Malware Response Team
  • 6,425 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Florida
  • Local time:10:05 AM

Posted 03 September 2009 - 05:12 PM

We've got to get ComboFix on your Desktop. Right now you can see it is running from Downloads and that won't work for the next thing we need to do.

c:\documents and settings\User\My Documents\Downloads\ComboFix.exe


What I need for you to do is delete the version you have and download another version and try to get it installed on your Desktop.

That's odd about the IE icon appearing, I may have to do some asking around about it.
If I have helped you then please consider donating so I can continue the fight against malware Posted Image
All donations go directly to the helper

Posted Image

Due to the large amount of backlogs we have I cannot respond to PMs for help unless I am already working with you

#7 Angelfish

Angelfish
  • Topic Starter

  • Members
  • 34 posts
  • OFFLINE
  •  
  • Local time:08:05 AM

Posted 05 September 2009 - 05:41 PM

Hi thewall.

Installing to the desktop was part of your original ComboFix instruction. Sorry I missed it.

I reinstalled CF to my desktop and ran another log, which is pasted below. In the meantime, my computer is crashing a lot more, IE has again shown up on my desktop, my SQL server is no longer working.

Thanks again for your help. Here is the new log:

ComboFix 09-09-05.02 - User 09/05/2009 15:28.2.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.1022.423 [GMT -7:00]
Running from: c:\documents and settings\User\Desktop\ComboFix.exe
AV: Symantec AntiVirus Corporate Edition *On-access scanning disabled* (Updated) {FB06448E-52B8-493A-90F3-E43226D3305C}
* Created a new restore point
.

((((((((((((((((((((((((( Files Created from 2009-08-05 to 2009-09-05 )))))))))))))))))))))))))))))))
.

2009-09-01 00:45 . 2009-09-01 00:45 -------- d-----w- C:\spoolerlogs
2009-08-31 01:49 . 2009-08-31 01:49 -------- d-----w- c:\program files\Trend Micro
2009-08-21 15:27 . 2009-08-21 15:27 -------- d-----w- c:\documents and settings\User\Local Settings\Application Data\Temp
2009-08-13 23:22 . 2009-08-13 23:22 45344 ----a-w- c:\windows\system32\drivers\lfneb1f.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-09-05 22:26 . 2007-08-24 22:40 -------- d-----w- c:\program files\Symantec AntiVirus
2009-09-05 03:13 . 2009-03-29 03:42 -------- d-----w- c:\documents and settings\All Users\Application Data\Google Updater
2009-08-30 02:12 . 2009-03-29 03:42 -------- d-----w- c:\program files\Google
2009-08-26 03:56 . 2007-08-24 22:27 143840 ----a-w- c:\windows\system32\nvModes.dat
2009-08-17 18:31 . 2007-08-26 22:48 -------- d-----w- c:\program files\HP
.

------- Sigcheck -------

[-] 2007-08-25 15:21 502272 6225F14B8CE08CCBA8B25AD27843C674 c:\windows\system32\winlogon.exe
.
((((((((((((((((((((((((((((( SnapShot@2009-09-03_17.13.18 )))))))))))))))))))))))))))))))))))))))))
.
- 2004-08-04 12:00 . 2009-09-03 17:10 70090 c:\windows\system32\perfc009.dat
+ 2004-08-04 12:00 . 2009-09-05 22:16 70090 c:\windows\system32\perfc009.dat
+ 2009-09-03 17:13 . 2007-07-30 23:19 53080 c:\windows\system32\dllcache\cache\wuauclt.exe
+ 2009-09-03 17:13 . 2004-08-03 23:56 13824 c:\windows\system32\dllcache\cache\wscntfy.exe
+ 2009-09-03 17:13 . 2004-08-03 23:56 82944 c:\windows\system32\dllcache\cache\ws2_32.dll
+ 2009-09-03 17:13 . 2004-08-03 23:56 24576 c:\windows\system32\dllcache\cache\userinit.exe
+ 2009-09-03 17:13 . 2004-08-03 23:56 14336 c:\windows\system32\dllcache\cache\svchost.exe
+ 2009-09-03 17:13 . 2004-08-03 23:56 71680 c:\windows\system32\dllcache\cache\ssdpsrv.dll
+ 2009-09-03 17:13 . 2007-03-21 21:36 57856 c:\windows\system32\dllcache\cache\spoolsv.exe
+ 2009-09-03 17:13 . 2004-08-03 23:56 59904 c:\windows\system32\dllcache\cache\regsvc.dll
+ 2009-09-03 17:13 . 2004-08-03 23:56 89088 c:\windows\system32\dllcache\cache\rasauto.dll
+ 2009-09-03 17:13 . 2004-08-03 23:56 17408 c:\windows\system32\dllcache\cache\powrprof.dll
+ 2009-09-03 17:13 . 2007-03-21 21:38 27136 c:\windows\system32\dllcache\cache\mspmsnsv.dll
+ 2009-09-03 17:13 . 2004-08-03 23:56 33792 c:\windows\system32\dllcache\cache\msgsvc.dll
+ 2009-09-03 17:13 . 2004-08-03 23:56 13312 c:\windows\system32\dllcache\cache\lsass.exe
+ 2009-09-03 17:13 . 2004-08-03 23:56 22016 c:\windows\system32\dllcache\cache\lpk.dll
+ 2009-09-03 17:13 . 2007-03-21 21:35 19968 c:\windows\system32\dllcache\cache\linkinfo.dll
+ 2009-09-03 17:13 . 2004-08-03 21:58 24576 c:\windows\system32\dllcache\cache\kbdclass.sys
+ 2009-09-03 17:13 . 2004-08-03 22:00 29056 c:\windows\system32\dllcache\cache\ip6fw.sys
+ 2009-09-03 17:13 . 2004-08-03 23:56 55808 c:\windows\system32\dllcache\cache\eventlog.dll
+ 2009-09-03 17:13 . 2004-08-03 23:56 15360 c:\windows\system32\dllcache\cache\ctfmon.exe
+ 2009-09-03 17:13 . 2007-03-21 21:34 62464 c:\windows\system32\dllcache\cache\cryptsvc.dll
+ 2009-09-03 17:13 . 2007-03-21 21:34 77824 c:\windows\system32\dllcache\cache\browser.dll
+ 2009-09-03 17:13 . 2004-08-03 22:05 14336 c:\windows\system32\dllcache\cache\asyncmac.sys
+ 2009-09-03 17:13 . 2004-08-04 12:00 11648 c:\windows\system32\dllcache\cache\acpiec.sys
+ 2009-09-03 17:13 . 2004-08-03 23:56 5120 c:\windows\system32\dllcache\cache\sfc.dll
+ 2009-09-03 17:13 . 2004-08-04 12:00 2944 c:\windows\system32\dllcache\cache\null.sys
+ 2009-09-03 17:13 . 2004-08-04 12:00 4224 c:\windows\system32\dllcache\cache\beep.sys
- 2004-08-04 12:00 . 2009-09-03 17:10 419462 c:\windows\system32\perfh009.dat
+ 2004-08-04 12:00 . 2009-09-05 22:16 419462 c:\windows\system32\perfh009.dat
+ 2009-09-03 17:13 . 2004-08-03 23:56 129536 c:\windows\system32\dllcache\cache\xmlprov.dll
+ 2009-09-03 17:13 . 2007-06-27 14:40 824320 c:\windows\system32\dllcache\cache\wininet.dll
+ 2009-09-03 17:13 . 2007-03-08 15:48 578048 c:\windows\system32\dllcache\cache\user32.dll
+ 2009-09-03 17:13 . 2007-02-05 20:17 185344 c:\windows\system32\dllcache\cache\upnphost.dll
+ 2009-09-03 17:13 . 2007-03-21 21:37 295424 c:\windows\system32\dllcache\cache\termsrv.dll
+ 2009-09-03 17:13 . 2007-03-21 21:37 360704 c:\windows\system32\dllcache\cache\tcpip.sys
+ 2009-09-03 17:13 . 2007-03-21 21:37 249344 c:\windows\system32\dllcache\cache\tapisrv.dll
+ 2009-09-03 17:13 . 2004-08-03 23:56 170496 c:\windows\system32\dllcache\cache\srsvc.dll
+ 2009-09-03 17:13 . 2007-03-21 21:36 135168 c:\windows\system32\dllcache\cache\shsvcs.dll
+ 2009-09-03 17:13 . 2004-08-03 23:56 108032 c:\windows\system32\dllcache\cache\services.exe
+ 2009-09-03 17:13 . 2004-08-03 23:56 190976 c:\windows\system32\dllcache\cache\schedsvc.dll
+ 2009-09-03 17:13 . 2004-08-03 23:56 180224 c:\windows\system32\dllcache\cache\scecli.dll
+ 2009-09-03 17:13 . 2007-03-21 21:36 399360 c:\windows\system32\dllcache\cache\rpcss.dll
+ 2009-09-03 17:13 . 2004-08-03 23:56 382464 c:\windows\system32\dllcache\cache\qmgr.dll
+ 2009-09-03 17:13 . 2004-08-03 23:56 435200 c:\windows\system32\dllcache\cache\ntmssvc.dll
+ 2009-09-03 17:13 . 2007-02-09 11:10 574464 c:\windows\system32\dllcache\cache\ntfs.sys
+ 2009-09-03 17:13 . 2007-03-21 21:36 197632 c:\windows\system32\dllcache\cache\netman.dll
+ 2009-09-03 17:13 . 2004-08-03 23:56 407040 c:\windows\system32\dllcache\cache\netlogon.dll
+ 2009-09-03 17:13 . 2004-08-03 22:14 182912 c:\windows\system32\dllcache\cache\ndis.sys
+ 2009-09-03 17:13 . 2004-08-03 23:56 245248 c:\windows\system32\dllcache\cache\mswsock.dll
+ 2009-09-03 17:13 . 2007-03-21 21:35 927504 c:\windows\system32\dllcache\cache\mfc40u.dll
+ 2009-09-03 17:13 . 2007-04-16 16:07 986112 c:\windows\system32\dllcache\cache\kernel32.dll
+ 2009-09-03 17:13 . 2004-08-03 23:56 110080 c:\windows\system32\dllcache\cache\imm32.dll
+ 2009-09-03 17:13 . 2007-03-21 21:34 243200 c:\windows\system32\dllcache\cache\es.dll
+ 2009-09-03 17:13 . 2004-08-03 23:56 792064 c:\windows\system32\dllcache\cache\comres.dll
+ 2009-09-03 17:13 . 2007-03-21 21:34 617472 c:\windows\system32\dllcache\cache\comctl32.dll
+ 2009-09-03 17:13 . 2005-05-28 04:14 142464 c:\windows\system32\dllcache\cache\aec.sys
+ 2009-09-03 17:13 . 2004-08-03 23:56 1580544 c:\windows\system32\dllcache\cache\sfcfiles.dll
+ 2009-09-03 17:13 . 2007-02-28 09:53 2137600 c:\windows\system32\dllcache\cache\ntoskrnl.exe
+ 2009-09-03 17:13 . 2007-02-28 09:15 2017280 c:\windows\system32\dllcache\cache\ntkrnlpa.exe
+ 2009-09-03 17:13 . 2007-07-19 04:00 3583488 c:\windows\system32\dllcache\cache\mshtml.dll
+ 2009-09-03 17:13 . 2007-06-13 11:26 1033216 c:\windows\system32\dllcache\cache\explorer.exe
.
-- Snapshot reset to current date --
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Google Update"="c:\documents and settings\User\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2008-09-03 133104]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-03-29 39408]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-05-12 8429568]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-05-12 81920]
"ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2006-07-19 52896]
"vptray"="c:\progra~1\SYMANT~1\VPTray.exe" [2006-09-28 125168]
"Dell QuickSet"="c:\program files\Dell\QuickSet\quickset.exe" [2007-05-14 1191936]
"OEM02Mon.exe"="c:\windows\OEM02Mon.exe" [2007-02-02 36864]
"ISUSPM"="c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe" [2006-03-20 213936]
"NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 155648]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 132496]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-12 39792]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-03-29 413696]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-04-24 185896]
"SigmatelSysTrayApp"="stsystra.exe" - c:\windows\stsystra.exe [2007-05-06 405504]
"nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2007-05-12 1626112]
"NVHotkey"="nvHotkey.dll" - c:\windows\system32\nvhotkey.dll [2007-05-12 67584]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"ShowDeskFix"="shell32" [X]
"IE7-11"="advpack.dll" - c:\windows\system32\advpack.dll [2007-06-27 124928]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-12 83360]
Service Manager.lnk - c:\program files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe [2005-5-3 81920]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
020D155119868075E60F.Xaddr LINDSEY.LONG_BEACH.CA
020D155119868075E60F.Xsernum 3HLH6OQ0TUQ0003

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\InterVideo\\DVD8\\WinDVD.exe"=
"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Documents and Settings\\User\\Local Settings\\Application Data\\Google\\Google Talk Plugin\\googletalkplugin.dll"=
"c:\\Documents and Settings\\User\\Local Settings\\Application Data\\Google\\Google Talk Plugin\\googletalkplugin.exe"=
"c:\\Program Files\\ExamSoft\\SofTest\\SoftLnch.exe"= c:\\Program Files\\ExamSoft\\SoftLnch.exe
"c:\\Program Files\\ExamSoft\\SofTest\\softest.exe"= c:\\Program Files\\ExamSoft\\SofTest.exe

R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [8/29/2009 7:18 PM 102448]
R3 OEM02Afx;Provides a software interface to control audio effects of M08 Internal webcam.;c:\windows\system32\drivers\OEM02Afx.sys [8/25/2007 8:39 AM 141376]
R3 OEM02Dev;Creative Camera OEM002 Driver;c:\windows\system32\drivers\OEM02Dev.sys [8/25/2007 8:39 AM 234496]
R3 OEM02Vfx;Creative Camera OEM002 Video VFX Driver;c:\windows\system32\drivers\OEM02Vfx.sys [8/25/2007 8:39 AM 7424]
S0 lfneb1f;lfneb1f;\SystemRoot\\SystemRoot\System32\drivers\lfneb1f.sys --> \SystemRoot\\SystemRoot\System32\drivers\lfneb1f.sys [?]
S1 df84da32.sys;df84da32.sys;\??\c:\windows\System32\drivers\df84da32.sys --> c:\windows\System32\drivers\df84da32.sys [?]
S3 ADM8511;ADMtek ADM8511/AN986 USB To Fast Ethernet Converter;c:\windows\system32\drivers\ADM8511.SYS [8/24/2007 2:02 PM 20160]
S3 SavRoam;SAVRoam;c:\program files\Symantec AntiVirus\SavRoam.exe [9/27/2006 5:33 PM 116464]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
.
Contents of the 'Scheduled Tasks' folder

2009-09-05 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-03-29 03:42]

2009-09-04 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1715567821-1960408961-725345543-1004Core.job
- c:\documents and settings\User\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2008-09-03 23:44]

2009-09-05 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1715567821-1960408961-725345543-1004UA.job
- c:\documents and settings\User\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2008-09-03 23:44]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://pchs.angellearning.com/frames.aspx
uInternet Connection Wizard,ShellNext = iexplore
IE: E&xport to Microsoft Excel - c:\progra~1\MI1933~1\Office10\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\User\Application Data\Mozilla\Firefox\Profiles\l2yv0sq2.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/
FF - plugin: c:\documents and settings\User\Application Data\Mozilla\plugins\npgoogletalk.dll
FF - plugin: c:\documents and settings\User\Local Settings\Application Data\Google\Update\1.2.183.7\npGoogleOneClick8.dll
FF - plugin: c:\program files\Google\Google Updater\2.4.1536.6592\npCIDetect13.dll
.
.
------- File Associations -------
.
inifile=%SystemRoot%\System32\NOTEPAD.EXE %1"
.

**************************************************************************

disk not found C:\

please note that you need administrator rights to perform deep scan
scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files:

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(2484)
c:\windows\system32\wpdshserviceobj.dll
c:\windows\system32\portabledevicetypes.dll
c:\windows\system32\portabledeviceapi.dll
.
Completion time: 2009-09-05 15:32
ComboFix-quarantined-files.txt 2009-09-05 22:32
ComboFix2.txt 2009-09-03 17:14

Pre-Run: 106,794,967,040 bytes free
Post-Run: 106,783,916,032 bytes free

196


Angelfish.

#8 thewall

thewall

  • Malware Response Team
  • 6,425 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Florida
  • Local time:10:05 AM

Posted 06 September 2009 - 12:01 PM

It's OK, easy to miss things when you are doing this type of work. This is next:


Special ComboFix script made for this computer only

1. Close any open browsers.

2. Close/disable all anti virus and anti malware programs including TeaTimer if you have it so they do not interfere with the running of ComboFix. Instructions for doing so are located here

3. Open notepad and copy/paste the text in the quotebox below into it:

File::
c:\windows\system32\drivers\lfneb1f.sys
c:\windows\System32\drivers\df84da32.sys
Driver::
lfneb1f
df84da32


Save this as CFScript.txt, in the same location as ComboFix.exe


Posted Image

Refering to the picture above, drag CFScript into ComboFix.exe

When finished, it shall produce a log for you at C:\ComboFix.txt which I will require in your next reply.
If I have helped you then please consider donating so I can continue the fight against malware Posted Image
All donations go directly to the helper

Posted Image

Due to the large amount of backlogs we have I cannot respond to PMs for help unless I am already working with you

#9 Angelfish

Angelfish
  • Topic Starter

  • Members
  • 34 posts
  • OFFLINE
  •  
  • Local time:08:05 AM

Posted 07 September 2009 - 12:04 AM

Hi thewall.

Sadly, things are rapidly getting worse. Thank you, again, for all of your help. Here is the log you requested:

ComboFix 09-09-05.02 - User 09/06/2009 21:48.3.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.1022.497 [GMT -7:00]
Running from: c:\documents and settings\User\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\User\Desktop\CFScript.txt
AV: Symantec AntiVirus Corporate Edition *On-access scanning disabled* (Updated) {FB06448E-52B8-493A-90F3-E43226D3305C}

FILE ::
"c:\windows\System32\drivers\df84da32.sys"
"c:\windows\system32\drivers\lfneb1f.sys"
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\docume~1\User\LOCALS~1\Temp\catchme.dll
c:\documents and settings\User\Local Settings\temp\catchme.dll
c:\windows\system32\drivers\lfneb1f.sys

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_lfneb1f


((((((((((((((((((((((((( Files Created from 2009-08-07 to 2009-09-07 )))))))))))))))))))))))))))))))
.

2009-09-01 00:45 . 2009-09-01 00:45 -------- d-----w- C:\spoolerlogs
2009-08-31 01:49 . 2009-08-31 01:49 -------- d-----w- c:\program files\Trend Micro
2009-08-21 15:27 . 2009-08-21 15:27 -------- d-----w- c:\documents and settings\User\Local Settings\Application Data\Temp

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-09-07 04:56 . 2007-08-24 22:40 -------- d-----w- c:\program files\Symantec AntiVirus
2009-09-07 04:33 . 2009-03-29 03:42 -------- d-----w- c:\documents and settings\All Users\Application Data\Google Updater
2009-08-30 02:12 . 2009-03-29 03:42 -------- d-----w- c:\program files\Google
2009-08-26 03:56 . 2007-08-24 22:27 143840 ----a-w- c:\windows\system32\nvModes.dat
2009-08-17 18:31 . 2007-08-26 22:48 -------- d-----w- c:\program files\HP
.

------- Sigcheck -------

[-] 2007-08-25 15:21 502272 6225F14B8CE08CCBA8B25AD27843C674 c:\windows\system32\winlogon.exe
.
((((((((((((((((((((((((((((( SnapShot_2009-09-05_22.31.44 )))))))))))))))))))))))))))))))))))))))))
.
- 2004-08-04 12:00 . 2009-09-05 22:16 70090 c:\windows\system32\perfc009.dat
+ 2004-08-04 12:00 . 2009-09-07 04:37 70090 c:\windows\system32\perfc009.dat
+ 2004-08-04 12:00 . 2009-09-07 04:37 419462 c:\windows\system32\perfh009.dat
- 2004-08-04 12:00 . 2009-09-05 22:16 419462 c:\windows\system32\perfh009.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Google Update"="c:\documents and settings\User\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2008-09-03 133104]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-03-29 39408]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-05-12 8429568]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-05-12 81920]
"ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2006-07-19 52896]
"vptray"="c:\progra~1\SYMANT~1\VPTray.exe" [2006-09-28 125168]
"Dell QuickSet"="c:\program files\Dell\QuickSet\quickset.exe" [2007-05-14 1191936]
"OEM02Mon.exe"="c:\windows\OEM02Mon.exe" [2007-02-02 36864]
"ISUSPM"="c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe" [2006-03-20 213936]
"NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 155648]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 132496]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-12 39792]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-03-29 413696]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-04-24 185896]
"SigmatelSysTrayApp"="stsystra.exe" - c:\windows\stsystra.exe [2007-05-06 405504]
"nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2007-05-12 1626112]
"NVHotkey"="nvHotkey.dll" - c:\windows\system32\nvhotkey.dll [2007-05-12 67584]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"ShowDeskFix"="shell32" [X]
"IE7-11"="advpack.dll" - c:\windows\system32\advpack.dll [2007-06-27 124928]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-12 83360]
Service Manager.lnk - c:\program files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe [2005-5-3 81920]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
020D155119868075E60F.Xaddr LINDSEY.LONG_BEACH.CA
020D155119868075E60F.Xsernum 3HLH6OQ0TUQ0003

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\InterVideo\\DVD8\\WinDVD.exe"=
"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Documents and Settings\\User\\Local Settings\\Application Data\\Google\\Google Talk Plugin\\googletalkplugin.dll"=
"c:\\Documents and Settings\\User\\Local Settings\\Application Data\\Google\\Google Talk Plugin\\googletalkplugin.exe"=
"c:\\Program Files\\ExamSoft\\SofTest\\SoftLnch.exe"= c:\\Program Files\\ExamSoft\\SoftLnch.exe
"c:\\Program Files\\ExamSoft\\SofTest\\softest.exe"= c:\\Program Files\\ExamSoft\\SofTest.exe

R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [8/29/2009 7:18 PM 102448]
R3 OEM02Afx;Provides a software interface to control audio effects of M08 Internal webcam.;c:\windows\system32\drivers\OEM02Afx.sys [8/25/2007 8:39 AM 141376]
R3 OEM02Dev;Creative Camera OEM002 Driver;c:\windows\system32\drivers\OEM02Dev.sys [8/25/2007 8:39 AM 234496]
R3 OEM02Vfx;Creative Camera OEM002 Video VFX Driver;c:\windows\system32\drivers\OEM02Vfx.sys [8/25/2007 8:39 AM 7424]
S1 df84da32.sys;df84da32.sys;\??\c:\windows\System32\drivers\df84da32.sys --> c:\windows\System32\drivers\df84da32.sys [?]
S3 ADM8511;ADMtek ADM8511/AN986 USB To Fast Ethernet Converter;c:\windows\system32\drivers\ADM8511.SYS [8/24/2007 2:02 PM 20160]
S3 SavRoam;SAVRoam;c:\program files\Symantec AntiVirus\SavRoam.exe [9/27/2006 5:33 PM 116464]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
.
Contents of the 'Scheduled Tasks' folder

2009-09-07 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-03-29 03:42]

2009-09-04 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1715567821-1960408961-725345543-1004Core.job
- c:\documents and settings\User\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2008-09-03 23:44]

2009-09-07 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1715567821-1960408961-725345543-1004UA.job
- c:\documents and settings\User\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2008-09-03 23:44]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://pchs.angellearning.com/frames.aspx
uInternet Connection Wizard,ShellNext = iexplore
IE: E&xport to Microsoft Excel - c:\progra~1\MI1933~1\Office10\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\User\Application Data\Mozilla\Firefox\Profiles\l2yv0sq2.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/
FF - plugin: c:\documents and settings\User\Application Data\Mozilla\plugins\npgoogletalk.dll
FF - plugin: c:\documents and settings\User\Local Settings\Application Data\Google\Update\1.2.183.7\npGoogleOneClick8.dll
FF - plugin: c:\program files\Google\Google Updater\2.4.1536.6592\npCIDetect13.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-09-06 21:55
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(4072)
c:\windows\system32\wpdshserviceobj.dll
c:\windows\system32\portabledevicetypes.dll
c:\windows\system32\portabledeviceapi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Common Files\Symantec Shared\ccSetMgr.exe
c:\program files\Common Files\Symantec Shared\ccEvtMgr.exe
c:\program files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Symantec AntiVirus\DefWatch.exe
c:\program files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
c:\windows\system32\nvsvc32.exe
c:\program files\Symantec AntiVirus\Rtvscan.exe
c:\windows\system32\rundll32.exe
c:\windows\system32\rundll32.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2009-09-07 21:58 - machine was rebooted
ComboFix-quarantined-files.txt 2009-09-07 04:58
ComboFix2.txt 2009-09-05 22:32
ComboFix3.txt 2009-09-03 17:14

Pre-Run: 106,797,953,024 bytes free
Post-Run: 106,694,062,080 bytes free

159


Angelfish.

#10 thewall

thewall

  • Malware Response Team
  • 6,425 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Florida
  • Local time:10:05 AM

Posted 07 September 2009 - 08:41 AM

What are the things which are getting worse? Would you elaborate on that please.
If I have helped you then please consider donating so I can continue the fight against malware Posted Image
All donations go directly to the helper

Posted Image

Due to the large amount of backlogs we have I cannot respond to PMs for help unless I am already working with you

#11 Angelfish

Angelfish
  • Topic Starter

  • Members
  • 34 posts
  • OFFLINE
  •  
  • Local time:08:05 AM

Posted 08 September 2009 - 12:24 AM

Hi thewall.

Well, last night it took me 3 restarts (forced) to get my computer to stay on and let me go online. I keep getting an error message at startup saying that my SQL server is not connected or can't be found or something like that. When I clicked on the icon to open Firefox, nothing would happen. An IE window kept popping up and opening tab after tab. I would have to force quit this process to get it to stop. So that is what was happening yesterday.

This is the first time I have started up my computer since I sent you the log last night. At start up the screen went blue and said it was performing a disk check (DSKCHK I think). I'm not sure if this is a problem, but it is definitely new. I still get the SQL server error, and the IE icon is still lurking on my desktop despite my attempts to delete it.

Things seem better right now--based on the fact that I am able to start up, get online, and write you without much interference (e.g. IE taking over and opening random windows). What do you think?

Thank you for helping me.

Angelfish.

#12 thewall

thewall

  • Malware Response Team
  • 6,425 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Florida
  • Local time:10:05 AM

Posted 08 September 2009 - 07:24 AM

That doesn't sound good. I want to check for something else so please run the following:



Save this file to your desktop. Click on Start->Run, and copy-paste the following command (the bolded text) into the "Open" box, and click OK. When it's finished, there will be a log called Win32kDiag.txt on your desktop. Please open it with notepad and post the contents here.
"%userprofile%\desktop\win32kdiag.exe" -r
If I have helped you then please consider donating so I can continue the fight against malware Posted Image
All donations go directly to the helper

Posted Image

Due to the large amount of backlogs we have I cannot respond to PMs for help unless I am already working with you

#13 Angelfish

Angelfish
  • Topic Starter

  • Members
  • 34 posts
  • OFFLINE
  •  
  • Local time:08:05 AM

Posted 09 September 2009 - 01:23 AM

Hello thewall.

The log you asked for is below.

---------
Log file is located at: C:\Documents and Settings\User\Desktop\Win32kDiag.txt

Attempting to reset file permissions.

WARNING: Could not get backup privileges!

Searching 'C:\WINDOWS'...





Finished!

------

My computer has been running much more smoothly since my last post. I still get an error message at startup saying my SQL server isn't working, but other than that, things have been calm.

Please let me know what you think I should do. I am so grateful for your help.

Angelfish.

#14 thewall

thewall

  • Malware Response Team
  • 6,425 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Florida
  • Local time:10:05 AM

Posted 09 September 2009 - 08:32 AM

Just to double check making sure that was all there was to the log you posted please use Explorer by right clicking on Start and choosing Explore to navigate to the following and open Win32kDiag.txt. If it is the same as what was in your last post let me know. If not post what is in there. If you have any problems you can stop and ask me about them.


C:\Documents and Settings\User\Desktop\Win32kDiag.txt
If I have helped you then please consider donating so I can continue the fight against malware Posted Image
All donations go directly to the helper

Posted Image

Due to the large amount of backlogs we have I cannot respond to PMs for help unless I am already working with you

#15 Angelfish

Angelfish
  • Topic Starter

  • Members
  • 34 posts
  • OFFLINE
  •  
  • Local time:08:05 AM

Posted 10 September 2009 - 11:24 AM

Hello thewall.

I did as you asked and the log was the same as was in my last post. I tried to re-run the Win32Diag file, as instructed originally, and came up with the same result.

Thank you.
Angelfish.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users