Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Unable to restore my computer, can't remove malware. Help? :D


  • This topic is locked This topic is locked
12 replies to this topic

#1 Q12

Q12

  • Members
  • 10 posts
  • OFFLINE
  •  
  • Local time:09:27 AM

Posted 12 September 2009 - 08:56 PM

I was told it would be a good idea to post a DDS log here, so that's exactly what I'm doing.

My situation is in this thread: http://www.bleepingcomputer.com/forums/ind...p;#entry1423275


Uhhh here's my log


DDS (Ver_09-07-30.01) - NTFSx86
Run by Teigen at 21:41:53.94 on Sat 09/12/2009
Internet Explorer: 7.0.6001.18000
Microsoft® Windows Vista™ Home Basic 6.0.6001.1.1252.1.1033.18.1978.911 [GMT -4:00]

SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}

============== Running Processes ===============

C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k rpcss
C:\Windows\System32\svchost.exe -k secsvcs
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\System32\igfxpers.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\Microsoft Xbox 360 Accessories\XBoxStat.exe
C:\Program Files\HP\QuickPlay\QPService.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\system32\igfxsrvc.exe
C:\Program Files\AIM6\aolsoftware.exe
C:\Windows\svchasts.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\SMINST\BLService.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\DRIVERS\xaudio.exe
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Windows\System32\alg.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files\Hewlett-Packard\HP wireless Assistant\WiFiMsg.EXE
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe
C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Mozilla Firefox\firefox.exe
c:\program files\windows defender\MpCmdRun.exe
C:\PROGRA~1\FREEDO~1\fdm.exe
C:\Program Files\Guitar Pro 5\GP5.exe
C:\Program Files\AIM6\aim6.exe
C:\Program Files\Audacity\audacity.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Users\Teigen\Downloads\dds.scr
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\wbem\wmiprvse.exe

============== Pseudo HJT Report ===============

uStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=83&bd=Presario&pf=cnnb
uDefault_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=83&bd=Presario&pf=cnnb
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=83&bd=Presario&pf=cnnb
mDefault_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=83&bd=Presario&pf=cnnb
uInternet Settings,ProxyOverride = *.local
BHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\program files\yahoo!\companion\installs\cpn\yt.dll
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: SSVHelper Class: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre1.6.0_05\bin\ssv.dll
BHO: ICQSys (IE PlugIn): {76dc0b63-1533-4ba9-8be8-d59eb676fa02} - c:\windows\system32\dddesot.dll
BHO: FDMIECookiesBHO Class: {cc59e0f9-7e43-44fa-9faa-8377850bf205} - c:\program files\free download manager\iefdm2.dll
TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn\yt.dll
TB: {D4027C7F-154A-4066-A1AD-4243D8127440} - No File
uRun: [Steam] "c:\program files\steam\Steam.exe" -silent
uRun: [WMPNSCFG] c:\program files\windows media player\WMPNSCFG.exe
uRun: [Aim6] "c:\program files\aim6\aim6.exe" /d locale=en-US ee://aol/imApp
mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
mRun: [Persistence] c:\windows\system32\igfxpers.exe
mRun: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 8.0\reader\Reader_sl.exe"
mRun: [HP Health Check Scheduler] c:\program files\hewlett-packard\hp health check\HPHC_Scheduler.exe
mRun: [HP Software Update] c:\program files\hp\hp software update\HPWuSchd2.exe
mRun: [hpWirelessAssistant] c:\program files\hewlett-packard\hp wireless assistant\HPWAMain.exe
mRun: [SunJavaUpdateSched] "c:\program files\java\jre1.6.0_05\bin\jusched.exe"
mRun: [XboxStat] "c:\program files\microsoft xbox 360 accessories\XboxStat.exe" silentrun
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [QPService] "c:\program files\hp\quickplay\QPService.exe"
mRun: [QlbCtrl.exe] c:\program files\hewlett-packard\hp quick launch buttons\QlbCtrl.exe /Start
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
StartupFolder: c:\users\teigen\appdata\roaming\micros~1\windows\startm~1\programs\startup\adobeg~1.lnk - c:\program files\common files\adobe\calibration\Adobe Gamma Loader.exe
StartupFolder: c:\users\teigen\appdata\roaming\micros~1\windows\startm~1\programs\startup\digsby.lnk - c:\program files\digsby\digsby.exe
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: Download all with Free Download Manager - file://c:\program files\free download manager\dlall.htm
IE: Download selected with Free Download Manager - file://c:\program files\free download manager\dlselected.htm
IE: Download video with Free Download Manager - file://c:\program files\free download manager\dlfvideo.htm
IE: Download with Free Download Manager - file://c:\program files\free download manager\dllink.htm
IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBC} - c:\program files\java\jre1.6.0_05\bin\ssv.dll
DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab
Notify: igfxcui - igfxdev.dll

================= FIREFOX ===================

FF - ProfilePath - c:\users\teigen\appdata\roaming\mozilla\firefox\profiles\i1jxkvqt.default\
FF - prefs.js: browser.search.defaulturl - hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2706&invocationType=&query=
FF - prefs.js: browser.search.selectedEngine - AIM Search
FF - prefs.js: browser.startup.homepage - hxxp://aimzones.aol.com/homepage
FF - prefs.js: keyword.URL - hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2706&invocationType=&query=
FF - component: c:\program files\free download manager\firefox\extension\components\vmsfdmff.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npdnu.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npViewpoint.dll
FF - plugin: c:\program files\viewpoint\viewpoint media player\npViewpoint.dll
FF - plugin: c:\programdata\nexonus\ngm\npNxGameUS.dll
FF - plugin: c:\users\teigen\appdata\local\google\update\1.2.183.7\npGoogleOneClick8.dll
FF - plugin: c:\users\teigen\appdata\roaming\mozilla\plugins\npgoogletalk.dll

---- FIREFOX POLICIES ----
FF - user.js: yahoo.homepage.dontask - true
============= SERVICES / DRIVERS ===============

R2 AntipPro2009_100;AntipyProex;c:\windows\svchasts.exe [2009-9-7 163840]
R2 Recovery Service for Windows;Recovery Service for Windows;c:\windows\sminst\BLService.exe [2008-7-26 361808]
R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\viewpoint\common\ViewpointService.exe [2008-12-28 24652]
R3 Com4QLBEx;Com4QLBEx;c:\program files\hewlett-packard\hp quick launch buttons\Com4QLBEx.exe [2008-7-26 193840]
R3 IntcHdmiAddService;Intel® High Definition Audio HDMI;c:\windows\system32\drivers\IntcHdmi.sys [2008-6-4 113664]
S3 vvftav302;vvftav302;c:\windows\system32\drivers\vvftav302.sys [2007-3-18 475136]

============== File Associations ===============

regfile="regedit.exe" "%1"

=============== Created Last 30 ================

2009-09-07 15:47 <DIR> --d----- c:\users\teigen\appdata\roaming\Malwarebytes
2009-09-07 15:46 38,160 a------- c:\windows\system32\drivers\mbamswissarmy.sys
2009-09-07 15:46 <DIR> --d----- c:\programdata\Malwarebytes
2009-09-07 15:46 <DIR> --d----- c:\progra~2\Malwarebytes
2009-09-07 15:46 19,096 a------- c:\windows\system32\drivers\mbam.sys
2009-09-07 15:46 <DIR> --d----- c:\program files\Malwarebytes' Anti-Malware
2009-09-07 15:01 <DIR> a-d----- c:\windows\system32\images
2009-09-07 15:01 8,547 a------- c:\windows\system32\wispex.html
2009-09-07 15:00 9 a------- c:\windows\system32\bennuar.old
2009-09-07 15:00 495,616 a------- c:\windows\system32\dddesot.dll
2009-09-07 15:00 440,320 a------- c:\windows\system32\desote.exe
2009-09-07 15:00 163,840 a------- c:\windows\svchasts.exe
2009-09-07 15:00 58 a------- c:\windows\ppp4.dat
2009-09-07 15:00 36 a------- c:\windows\system32\sysnet.dat
2009-09-07 15:00 2 a------- c:\windows\ppp3.dat
2009-08-29 11:34 <DIR> --d----- c:\program files\IAHGames

==================== Find3M ====================

2009-09-12 09:30 119,296 a------- c:\windows\system32\zlib.dll
2009-08-06 13:01 141,862,924 a------- c:\windows\DUMP6a75.tmp
2009-07-18 12:06 827,904 a------- c:\windows\system32\wininet.dll
2009-07-18 12:01 78,336 a------- c:\windows\system32\ieencode.dll
2009-07-18 05:46 26,624 a------- c:\windows\system32\ieUnatt.exe
2009-06-25 18:13 86,016 a------- c:\windows\inf\infstrng.dat
2009-06-25 18:13 51,200 a------- c:\windows\inf\infpub.dat
2009-06-25 18:13 766 a------- c:\users\teigen\appdata\roaming\wklnhst.dat
2009-06-25 17:32 86,016 a------- c:\windows\inf\infstor.dat
2009-06-15 11:24 156,672 a------- c:\windows\system32\t2embed.dll
2009-06-15 11:20 72,704 a------- c:\windows\system32\fontsub.dll
2009-06-15 11:20 10,240 a------- c:\windows\system32\dciman32.dll
2009-06-15 08:52 289,792 a------- c:\windows\system32\atmfd.dll
2009-01-18 23:09 1,727,864 a------- c:\program files\kaizomarioworld
2008-07-25 23:46 665,600 a------- c:\windows\inf\drvindex.dat
2008-01-20 22:57 174 a--sh--- c:\program files\desktop.ini
2006-11-02 08:39 287,440 a------- c:\windows\inf\perflib\0409\perfi.dat
2006-11-02 08:39 287,440 a------- c:\windows\inf\perflib\0409\perfh.dat
2006-11-02 08:39 30,674 a------- c:\windows\inf\perflib\0409\perfd.dat
2006-11-02 08:39 30,674 a------- c:\windows\inf\perflib\0409\perfc.dat
2006-11-02 05:20 287,440 a------- c:\windows\inf\perflib\0000\perfi.dat
2006-11-02 05:20 287,440 a------- c:\windows\inf\perflib\0000\perfh.dat
2006-11-02 05:20 30,674 a------- c:\windows\inf\perflib\0000\perfd.dat
2006-11-02 05:20 30,674 a------- c:\windows\inf\perflib\0000\perfc.dat

============= FINISH: 21:43:31.20 ===============

BC AdBot (Login to Remove)

 


#2 thewall

thewall

  • Malware Response Team
  • 6,425 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Florida
  • Local time:09:27 AM

Posted 13 September 2009 - 02:01 PM

Hello Q12 :( Welcome to the BC HijackThis Log and Analysis forum. I will be assisting you in cleaning up your system.


I ask that you refrain from running tools other than those we suggest while we are cleaning up your computer. The reason for this is so we know what is going on with the machine at any time. Some programs can interfere with others and hamper the recovery process.



In the upper right hand corner of the topic you will see a button called Options. If you click on this in the drop-down menu you can choose Track this topic. By doing this and then choosing Immediate E-Mail notification and then clicking on Proceed you will be advised when we respond the your topic and facilitate the cleaning of your machine.

After 5 days if a topic is not replied to we assume it has been abandoned and it is closed.



I do not see any sign of an antivirus on your machine. That's a real problem with all of the things floating around out there on the Internet. We need to get you one installed but first I want you to do a scan with GMER. I strongly advise against any Internet surfing until we get you some protection up and running.


We need to scan for Rootkits with GMER
  • Please download GMER from one of the following locations, and save it to your desktop:
    • Main Mirror
      This version will download a randomly named file (Recommended)
    • Zip Mirror
      This version will download a zip file you will need to extract first. If you use this mirror, please extract the zip file to your desktop.
  • Close any and all open programs, as this process may crash your computer.
  • Double click Posted Image or Posted Image on your desktop.
  • Allow the gmer.sys driver to load if asked.
  • You may see this window. If you do, click No.
    Posted Image
  • Click on Posted Image and wait for the scan to finish.
  • If you see a rootkit warning window, click OK.
  • Push Posted Image and save the logfile to your desktop.
  • Copy and Paste the contents of that file in your next post.



Please do not post any logs as an attachment unless asked to do so.





Thanks,



thewall
If I have helped you then please consider donating so I can continue the fight against malware Posted Image
All donations go directly to the helper

Posted Image

Due to the large amount of backlogs we have I cannot respond to PMs for help unless I am already working with you

#3 Q12

Q12
  • Topic Starter

  • Members
  • 10 posts
  • OFFLINE
  •  
  • Local time:09:27 AM

Posted 14 September 2009 - 05:13 PM

Hi thewall, thanks for taking time to help me fix up my computer.

I tried running that program you told me to use, but the first time it just ended up "Not Responding." I tried again a second time and I managed to get the scan running, but after letting it sit for 2 hours I didn't manage to get anything out of it other than

GMER 1.0.15.15077 [8hlp0zqn.exe] - http://www.gmer.net
Rootkit scan 2009-09-14 17:21:50
Windows 6.0.6001 Service Pack 1


---- System - GMER 1.0.15 ----

Code 867A02C8 ZwEnumerateKey
Code 867A32C8 ZwFlushInstructionCache
Code 867AF2C6 ZwSaveKey
Code 867AB2C6 ZwSaveKeyEx
Code 867A92C5 IofCallDriver
Code 867B22C6 IofCompleteRequest


Which I assume is just typical start-up "stuff."

My computer seems to be getting progressively worse, with it now having pop-ups telling me to install "Protection System" due to trojans, worms, backdoor viruses and whatnot. I'm fully prepared to wipe my computer completely if there is some way I could get Vista on here again (some Vista product code I could find on my computer that I could use to reinstall it? It probably isn't that simple though D: ).

Whatever you can do to help me out would be great.

Thanks,
-Q12

#4 thewall

thewall

  • Malware Response Team
  • 6,425 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Florida
  • Local time:09:27 AM

Posted 14 September 2009 - 05:41 PM

The infection is blocking us so try this one next. Delete the version of GMER you have on your Desktop now before downloading this version. If it won't run try RootRepeal which I have posted below.


Download GMER Rootkit Scanner from here to your desktop.
  • Double click the exe file.
  • If it gives you a warning about rootkit activity and asks if you want to run scan...click on NO, then use the following settings for a more complete scan.


    Posted Image
    Click the image to enlarge it


  • In the right panel, you will see several boxes that have been checked. Uncheck the following ...
    • Sections
    • IAT/EAT
    • Drives/Partition other than Systemdrive (typically C:\)
    • Show All (don't miss this one)
  • Then click the Scan button & wait for it to finish.
  • Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
  • Save it where you can easily find it, such as your desktop, and post it in reply.
**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<--- ROOKIT" entries











  • Download RootRepeal from the following location and save it to your desktop.
  • Extract the contents of RootRepeal.zip, to your desktop.
  • Double click Posted Image on your desktop.
  • Click on the report tab, then click scan
  • Check all seven boxes:
    Drivers
    Files
    Processes
    SSDT
    Stealth Objects
    Hidden Services
    Shadow SSDT
  • Click Ok
  • Check the box for your main system drive (Usually C:), and press Ok.
  • Allow RootRepeal to run a scan of your system. This may take some time.
  • Once the scan completes, Click the Save Report button. Save the log as RootRepeal.txt and post it in your next reply.

If I have helped you then please consider donating so I can continue the fight against malware Posted Image
All donations go directly to the helper

Posted Image

Due to the large amount of backlogs we have I cannot respond to PMs for help unless I am already working with you

#5 Q12

Q12
  • Topic Starter

  • Members
  • 10 posts
  • OFFLINE
  •  
  • Local time:09:27 AM

Posted 15 September 2009 - 03:23 PM

The new program seems to have worked. Last night I did a scan for roughly 2 hours and when I came back to my computer the program was closed. I just did it again and it stopped scanning after 20 minutes and this is what it produced

GMER 1.0.15.15086 - http://www.gmer.net
Rootkit scan 2009-09-15 16:19:51
Windows 6.0.6001 Service Pack 1
Running: z1ikrgrd.exe; Driver: C:\Users\Teigen\AppData\Local\Temp\aujasnkj.sys


---- System - GMER 1.0.15 ----

Code 866863CE ZwEnumerateKey
Code 866824AE ZwFlushInstructionCache
Code 8668C47E ZwSaveKey
Code 8668F3C6 ZwSaveKeyEx
Code 866962BD IofCallDriver
Code 8669841D IofCompleteRequest
---- Processes - GMER 1.0.15 ----

Library \\?\globalroot\systemroot\system32\UACprqwyicpto.dll (*** hidden *** ) @ C:\Windows\system32\svchost.exe [764] 0x01EB0000
Library C:\Windows\system32\uacav.dll (*** hidden *** ) @ C:\Windows\system32\svchost.exe [764] 0x02B20000
Library \\?\globalroot\systemroot\system32\UACprqwyicpto.dll (*** hidden *** ) @ C:\Windows\system32\svchost.exe [868] 0x10000000
Library \\?\globalroot\systemroot\system32\UACprqwyicpto.dll (*** hidden *** ) @ C:\Windows\System32\svchost.exe [944] 0x10000000
Library \\?\globalroot\systemroot\system32\UACprqwyicpto.dll (*** hidden *** ) @ C:\Windows\System32\svchost.exe [1108] 0x10000000
Library \\?\globalroot\systemroot\system32\UACprqwyicpto.dll (*** hidden *** ) @ C:\Windows\System32\svchost.exe [1152] 0x10000000
Library \\?\globalroot\systemroot\system32\UACprqwyicpto.dll (*** hidden *** ) @ C:\Windows\system32\svchost.exe [1172] 0x10000000
Library \\?\globalroot\systemroot\system32\UACprqwyicpto.dll (*** hidden *** ) @ C:\Windows\system32\svchost.exe [1320] 0x10000000
Library \\?\globalroot\systemroot\system32\UACprqwyicpto.dll (*** hidden *** ) @ C:\Windows\system32\svchost.exe [1456] 0x10000000
Library \\?\globalroot\systemroot\system32\ytasfwocpexqvp.dll (*** hidden *** ) @ C:\Windows\Explorer.EXE [1800] 0x10000000
Library \\?\globalroot\systemroot\system32\UACprqwyicpto.dll (*** hidden *** ) @ C:\Windows\system32\svchost.exe [1904] 0x10000000
Library \\?\globalroot\systemroot\system32\UACprqwyicpto.dll (*** hidden *** ) @ C:\Program Files\Internet Explorer\iexplore.exe [2332] 0x10000000
Library \\?\globalroot\systemroot\system32\ytasfwocpexqvp.dll (*** hidden *** ) @ C:\Program Files\Internet Explorer\iexplore.exe [2332] 0x00B10000
Library \\?\globalroot\systemroot\system32\UACprqwyicpto.dll (*** hidden *** ) @ C:\Windows\system32\svchost.exe [2460] 0x10000000
Library \\?\globalroot\systemroot\system32\UACprqwyicpto.dll (*** hidden *** ) @ C:\Windows\system32\svchost.exe [2556] 0x10000000
Library \\?\globalroot\systemroot\system32\UACprqwyicpto.dll (*** hidden *** ) @ C:\Program Files\Mozilla Firefox\firefox.exe [2788] 0x10000000
Library \\?\globalroot\systemroot\system32\ytasfwocpexqvp.dll (*** hidden *** ) @ C:\Program Files\Mozilla Firefox\firefox.exe [2788] 0x004A0000
Library \\?\globalroot\systemroot\system32\UACprqwyicpto.dll (*** hidden *** ) @ C:\Windows\System32\svchost.exe [2832] 0x10000000

---- Services - GMER 1.0.15 ----

Service C:\Windows\system32\drivers\UACcioxtcrnqv.sys (*** hidden *** ) [SYSTEM] UACd.sys <-- ROOTKIT !!!
Service C:\Windows\system32\drivers\ytasfwsotwsxpp.sys (*** hidden *** ) [SYSTEM] ytasfwnjhrfhvy <-- ROOTKIT !!!

---- Registry - GMER 1.0.15 ----

Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{2D999906-A054-A4A1-E18E-50740F2A5D94}
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{2D999906-A054-A4A1-E18E-50740F2A5D94}@mahjdemklonhjmocbnfoengcfm 0x6A 0x61 0x61 0x69 ...
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{2D999906-A054-A4A1-E18E-50740F2A5D94}@nabjnfgbbhnkbndiepfgkpiecgdc 0x6A 0x61 0x61 0x69 ...

---- Files - GMER 1.0.15 ----

File C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS01514.log 131072 bytes
File C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS01515.log 0 bytes
File C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS01516.log 0 bytes
File C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS01517.log 0 bytes
File C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS01518.log 0 bytes
File C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS01519.log 0 bytes
File C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS0151A.log 0 bytes
File C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS0151B.log 0 bytes
File C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS0151C.log 0 bytes
File C:\Windows\System32\drivers\UACcioxtcrnqv.sys 50176 bytes executable <-- ROOTKIT !!!
File C:\Windows\System32\drivers\ytasfweqmiydie.sys 71168 bytes
File C:\Windows\System32\drivers\ytasfwsotwsxpp.sys 71168 bytes <-- ROOTKIT !!!

---- EOF - GMER 1.0.15 ----

#6 thewall

thewall

  • Malware Response Team
  • 6,425 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Florida
  • Local time:09:27 AM

Posted 15 September 2009 - 04:00 PM

Definitely infected there. We may get blocked here so don't worry yourself too much if it doesn't act like it wants to load and run. Just let me know.


Please download ComboFix from one of these locations:

Link 1
Link 2

* IMPORTANT !!! Save ComboFix.exe to your Desktop
  • Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. Instruction can be found HERE
  • Double click on ComboFix.exe & follow the prompts.
  • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

Posted Image



Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:


Posted Image


Click on Yes, to continue scanning for malware.

When finished, it will produce a log for you. Please include the C:\ComboFix.txt in your next reply.
If I have helped you then please consider donating so I can continue the fight against malware Posted Image
All donations go directly to the helper

Posted Image

Due to the large amount of backlogs we have I cannot respond to PMs for help unless I am already working with you

#7 Q12

Q12
  • Topic Starter

  • Members
  • 10 posts
  • OFFLINE
  •  
  • Local time:09:27 AM

Posted 15 September 2009 - 04:17 PM

I can't get the program to start. I double click and give it permission to run, but nothing happens.

#8 thewall

thewall

  • Malware Response Team
  • 6,425 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Florida
  • Local time:09:27 AM

Posted 15 September 2009 - 06:25 PM

If you were able to get it to download to your Desktop delete the version you have and try the following one:

  • Download Combofix from any of the links below. You must rename it before saving it. Save it to your desktop.

    Link 1
    Link 2

    Posted Image


    Posted Image

    --------------------------------------------------------------------


    Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. You can get help on disabling your protection programs here

  • Double click on Combo-Fix.exe & follow the prompts. When prompted, please agree to the End-User License Agreement to install the Microsoft Recovery Console.


    Posted Image

  • At the next prompt, click 'Yes' to run the full ComboFix scan.
  • When the tool is finished, it will produce a report for you.
Please post the C:\ComboFix.txt in your next reply
If I have helped you then please consider donating so I can continue the fight against malware Posted Image
All donations go directly to the helper

Posted Image

Due to the large amount of backlogs we have I cannot respond to PMs for help unless I am already working with you

#9 Q12

Q12
  • Topic Starter

  • Members
  • 10 posts
  • OFFLINE
  •  
  • Local time:09:27 AM

Posted 19 September 2009 - 10:37 PM

The programs seems to have removed the malware, but it wouldn't create the log file, it just froze.

It seems to have done other things as my wireless driver stopped working for a little while (but Vista did some repair after I clicked the repair thing.)

I still can't open my task manager.

#10 thewall

thewall

  • Malware Response Team
  • 6,425 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Florida
  • Local time:09:27 AM

Posted 20 September 2009 - 10:38 AM

Try this:

Open your MalwareBytes and do an update. Then run a Quick Scan only. Make sure it is not a Full Scan and post the log it produces if you are successful.
If I have helped you then please consider donating so I can continue the fight against malware Posted Image
All donations go directly to the helper

Posted Image

Due to the large amount of backlogs we have I cannot respond to PMs for help unless I am already working with you

#11 Q12

Q12
  • Topic Starter

  • Members
  • 10 posts
  • OFFLINE
  •  
  • Local time:09:27 AM

Posted 23 September 2009 - 05:36 PM

Try this:

Open your MalwareBytes and do an update. Then run a Quick Scan only. Make sure it is not a Full Scan and post the log it produces if you are successful.


It froze where it usually does, at around 20,000 items and it found 6 infected items.

#12 thewall

thewall

  • Malware Response Team
  • 6,425 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Florida
  • Local time:09:27 AM

Posted 24 September 2009 - 08:27 AM

Please save this file to your desktop. Click on Start->Run, and copy-paste the following command (the bolded text) into the "Open" box, and click OK. When it's finished, there will be a log called Win32kDiag.txt on your desktop. Please open it with notepad and post the contents here.
"%userprofile%\desktop\win32kdiag.exe" -f -r
If I have helped you then please consider donating so I can continue the fight against malware Posted Image
All donations go directly to the helper

Posted Image

Due to the large amount of backlogs we have I cannot respond to PMs for help unless I am already working with you

#13 thewall

thewall

  • Malware Response Team
  • 6,425 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Florida
  • Local time:09:27 AM

Posted 30 September 2009 - 11:25 AM

Due to the lack of feedback This Topic is closed.

Should you need it reopened, please contact my by PM. Include the address of this thread in your request.

If you have a new issue, please start a New Topic.

This applies only to the original poster. Everyone else please begin a New Topic.
If I have helped you then please consider donating so I can continue the fight against malware Posted Image
All donations go directly to the helper

Posted Image

Due to the large amount of backlogs we have I cannot respond to PMs for help unless I am already working with you




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users