Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Windows Police Pro Virus...maybe more...


  • This topic is locked This topic is locked
29 replies to this topic

#1 Monkeyb00y

Monkeyb00y

  • Members
  • 75 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Behind my eyes...
  • Local time:02:45 AM

Posted 17 October 2009 - 12:19 AM

Good day BleepingComputer.com,
I've got a live one for you. I've got a computer with the Windows Police Pro virus... possibly much more.
System Info:
Windows XP SP2
HP a1540n
The "System" icon in Control Panel won't open to see any other details.
When you start the computer, seems fine until the "Starting" screen shows...
GoogleLogIn.exe failed...
When you finally get to the desktop, there are 34 errors showing.
I assume these are the startup programs.
I can access the regedit screen but not CMD.
CTRL + ALT + DEL doesn't work either, nor CTRL+SHIFT+ESC.

I would post the DDS Log but it didn't work.

I have to use a jump drive to transfer the info from the infected computer to
my laptop. It tried to jump over through an autorun file.
My AVIRA AntiVir caught it before it did any damage.
I then cleaned it with AVIRA AntiVir & it was successfully removed.

Please let me know when you can what needs to be done next. Thanks!
-Monkeyb00y

Here is the RootRepeal Log:
ROOTREPEAL © AD, 2007-2009
==================================================
Scan Start Time: 2009/10/17 01:03
Program Version: Version 1.3.5.0
Windows Version: Windows XP Media Center Edition SP2
==================================================

Drivers
-------------------
Name: dump_atapi.sys
Image Path: C:\WINDOWS\System32\Drivers\dump_atapi.sys
Address: 0xB665E000 Size: 98304 File Visible: No Signed: -
Status: -

Name: dump_WMILIB.SYS
Image Path: C:\WINDOWS\System32\Drivers\dump_WMILIB.SYS
Address: 0xBADF0000 Size: 8192 File Visible: No Signed: -
Status: -

Name: hjgruiqaosjxxk.sys
Image Path: C:\WINDOWS\system32\drivers\hjgruiqaosjxxk.sys
Address: 0xB6991000 Size: 163840 File Visible: - Signed: -
Status: Hidden from the Windows API!

Name: rootrepeal.sys
Image Path: C:\WINDOWS\system32\drivers\rootrepeal.sys
Address: 0xB3CF6000 Size: 49152 File Visible: No Signed: -
Status: -

Name: UACjeohecsmmujnrdj.sys
Image Path: C:\WINDOWS\system32\drivers\UACjeohecsmmujnrdj.sys
Address: 0xB697D000 Size: 81920 File Visible: - Signed: -
Status: Hidden from the Windows API!

Hidden/Locked Files
-------------------
Path: C:\hiberfil.sys
Status: Locked to the Windows API!

Path: C:\WINDOWS\system32\hjgruicikvnhba.dat
Status: Invisible to the Windows API!

Path: C:\WINDOWS\system32\hjgruikdcpicah.dll
Status: Invisible to the Windows API!

Path: C:\WINDOWS\system32\hjgruikreeocct.dat
Status: Invisible to the Windows API!

Path: C:\WINDOWS\system32\hjgruislswnbrv.dll
Status: Invisible to the Windows API!

Path: C:\WINDOWS\system32\hjgruivhklyxud.dll
Status: Invisible to the Windows API!

Path: C:\WINDOWS\system32\hjgruivpapqxux.dll
Status: Invisible to the Windows API!

Path: C:\WINDOWS\system32\UACbdrldetaxgojtou.dll
Status: Invisible to the Windows API!

Path: C:\WINDOWS\system32\UACbhdlnijeefentnu.dll
Status: Invisible to the Windows API!

Path: C:\WINDOWS\system32\UACfsibivcvjkytkuc.dll
Status: Invisible to the Windows API!

Path: C:\WINDOWS\system32\uacinit.dll
Status: Invisible to the Windows API!

Path: C:\WINDOWS\system32\UACitjwjcfapswxrak.dat
Status: Invisible to the Windows API!

Path: C:\WINDOWS\system32\UACkksnkustpublpyu.db
Status: Invisible to the Windows API!

Path: C:\WINDOWS\system32\uactmp.db
Status: Invisible to the Windows API!

Path: C:\WINDOWS\system32\UACvkytgkgmpktkkpt.dll
Status: Invisible to the Windows API!

Path: C:\WINDOWS\system32\UACvwokqioyqpsjwlj.dll
Status: Invisible to the Windows API!

Path: C:\WINDOWS\Temp\UAC1ab7.tmp
Status: Invisible to the Windows API!

Path: C:\WINDOWS\Temp\UAC33d1.tmp
Status: Invisible to the Windows API!

Path: C:\WINDOWS\Temp\UAC40a6.tmp
Status: Invisible to the Windows API!

Path: C:\WINDOWS\Temp\UAC519c.tmp
Status: Invisible to the Windows API!

Path: C:\WINDOWS\Temp\UAC6243.tmp
Status: Invisible to the Windows API!

Path: C:\WINDOWS\Temp\UAC7084.tmp
Status: Invisible to the Windows API!

Path: C:\WINDOWS\Temp\UAC7e3a.tmp
Status: Invisible to the Windows API!

Path: C:\WINDOWS\Temp\UAC88b9.tmp
Status: Invisible to the Windows API!

Path: C:\WINDOWS\Temp\UAC8b0f.tmp
Status: Invisible to the Windows API!

Path: C:\WINDOWS\Temp\UAC90cd.tmp
Status: Invisible to the Windows API!

Path: C:\WINDOWS\Temp\UAC9710.tmp
Status: Invisible to the Windows API!

Path: C:\WINDOWS\Temp\UACa4e3.tmp
Status: Invisible to the Windows API!

Path: C:\WINDOWS\Temp\UACa6d5.tmp
Status: Invisible to the Windows API!

Path: C:\WINDOWS\Temp\UACaca1.tmp
Status: Invisible to the Windows API!

Path: C:\WINDOWS\Temp\UACce5e.tmp
Status: Invisible to the Windows API!

Path: C:\WINDOWS\Temp\UACf8a6.tmp
Status: Invisible to the Windows API!

Path: C:\WINDOWS\Temp\UACfe4d.tmp
Status: Invisible to the Windows API!

Path: C:\WINDOWS\system32\drivers\hjgruiqaosjxxk.sys
Status: Invisible to the Windows API!

Path: C:\WINDOWS\system32\drivers\UACjeohecsmmujnrdj.sys
Status: Invisible to the Windows API!

Path: C:\Documents and Settings\HP_Administrator\Local Settings\Temp\UAC553c.tmp
Status: Invisible to the Windows API!

Path: C:\Program Files\Common Files\Symantec Shared\VirusDefs\20080829.005\EraserUtilRebootDrv.sys
Status: Locked to the Windows API!

Path: c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscsa59b6ac5-4919-49a5-9983-1fd00243db72.tmp
Status: Allocation size mismatch (API: 983040, Raw: 0)

Path: c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscsaa5dff8e-2c73-4c01-96f7-bc9c79e3e608.tmp
Status: Allocation size mismatch (API: 64, Raw: 0)

Path: c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscsab793f38-02b2-4757-ba3b-80a6a4186add.tmp
Status: Allocation size mismatch (API: 4096, Raw: 0)

Path: c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscsb2b0cda5-243c-4cb4-a0ea-818f4ffbbf13.tmp
Status: Allocation size mismatch (API: 245760, Raw: 0)

Path: c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscsd135be4e-b77e-4adc-9bf1-f66d9a831f05.tmp
Status: Allocation size mismatch (API: 983040, Raw: 0)

Path: c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscsd616e7ca-88bc-44bb-8d56-34a4f1073b92.tmp
Status: Allocation size mismatch (API: 212992, Raw: 0)

Path: c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs5fc59991-1dd4-4a58-91b4-9e7930d3c31a.tmp
Status: Allocation size mismatch (API: 327680, Raw: 0)

Path: c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs64640ffb-707f-4c9e-a735-97ddf9920e80.tmp
Status: Allocation size mismatch (API: 2686976, Raw: 0)

Path: c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs681e1391-a9a2-428f-8332-bbaaba4c2d43.tmp
Status: Allocation size mismatch (API: 5898240, Raw: 0)

Path: c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs69767161-23f4-4bce-aac9-4f36a664e194.tmp
Status: Allocation size mismatch (API: 8192, Raw: 0)

Path: c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs6cd33d69-af18-42fc-9d02-0dffc60af427.tmp
Status: Allocation size mismatch (API: 288, Raw: 0)

Path: c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscsf6e817b4-261b-40d2-8a8d-0b7b8e8dd018.tmp
Status: Allocation size mismatch (API: 1703936, Raw: 0)

Path: c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscsf7a625de-0a84-4f57-9bc5-37f7e6c117c7.tmp
Status: Allocation size mismatch (API: 983040, Raw: 0)

Path: c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs96f7638d-af06-4a9e-a575-5d184abb80ab.tmp
Status: Allocation size mismatch (API: 983040, Raw: 0)

Path: c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscsb9672a16-93d4-4868-a0a5-f9c7af7eaefd.tmp
Status: Allocation size mismatch (API: 147456, Raw: 0)

Path: c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs165a6bb7-e51a-4daf-8c05-eb61db690f13.tmp
Status: Allocation size mismatch (API: 245760, Raw: 0)

Path: c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs183ee4b8-f56b-4aa8-8e57-49019e95bd3a.tmp
Status: Allocation size mismatch (API: 2555904, Raw: 0)

Path: c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs1bb07d67-98ff-49bc-bce0-7c9ceb2e0e96.tmp
Status: Allocation size mismatch (API: 65536, Raw: 0)

Path: c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs5696b7c5-225d-4873-a4f2-0f84e64a9a1a.tmp
Status: Allocation size mismatch (API: 8, Raw: 0)

Path: c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs5cfe90cd-f395-4910-88fd-d7c075eeadd7.tmp
Status: Allocation size mismatch (API: 4096, Raw: 0)

Path: c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs74f6069a-5276-447c-856c-2a0e0809ee4d.tmp
Status: Allocation size mismatch (API: 147456, Raw: 0)

Path: c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs7c913074-de19-4781-9c00-f05902de40a2.tmp
Status: Allocation size mismatch (API: 4096, Raw: 0)

Path: c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs7e00b4e1-31d4-44f3-9e8c-a9f6aaa8371e.tmp
Status: Allocation size mismatch (API: 1966080, Raw: 0)

Path: c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs850fcb4e-068a-4526-88bc-7431bbd8963f.tmp
Status: Allocation size mismatch (API: 208, Raw: 0)

Path: c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs3775a6a8-5492-4669-9f22-418e3e06faf5.tmp
Status: Allocation size mismatch (API: 5898240, Raw: 0)

Stealth Objects
-------------------
Object: Hidden Module [Name: UACvwokqioyqpsjwlj.dll]
Process: winlogon.exe (PID: 724) Address: 0x009a0000 Size: 49152

Object: Hidden Module [Name: UACbhdlnijeefentnu.dll]
Process: winlogon.exe (PID: 724) Address: 0x10000000 Size: 45056

Object: Hidden Module [Name: UACvwokqioyqpsjwlj.dll]
Process: services.exe (PID: 772) Address: 0x00ab0000 Size: 49152

Object: Hidden Module [Name: UACbhdlnijeefentnu.dll]
Process: services.exe (PID: 772) Address: 0x10000000 Size: 45056

Object: Hidden Module [Name: UACvwokqioyqpsjwlj.dll]
Process: lsass.exe (PID: 784) Address: 0x00b90000 Size: 49152

Object: Hidden Module [Name: UACbhdlnijeefentnu.dll]
Process: lsass.exe (PID: 784) Address: 0x10000000 Size: 45056

Object: Hidden Module [Name: UACbdrldetaxgojtou.dll]
Process: svchost.exe (PID: 960) Address: 0x00a60000 Size: 217088

Object: Hidden Module [Name: hjgruivpapqxux.dll]
Process: svchost.exe (PID: 960) Address: 0x00ae0000 Size: 24576

Object: Hidden Module [Name: UACbhdlnijeefentnu.dll]
Process: svchost.exe (PID: 960) Address: 0x00d90000 Size: 45056

Object: Hidden Module [Name: UACvwokqioyqpsjwlj.dll]
Process: svchost.exe (PID: 960) Address: 0x00e20000 Size: 49152

Object: Hidden Module [Name: UACvkytgkgmpktkkpt.dll]
Process: svchost.exe (PID: 960) Address: 0x00ec0000 Size: 77824

Object: Hidden Module [Name: UACfsibivcvjkytkuc.dll]
Process: svchost.exe (PID: 960) Address: 0x00f70000 Size: 73728

Object: Hidden Module [Name: hjgruikdcpicah.dll]
Process: svchost.exe (PID: 960) Address: 0x10000000 Size: 57344

Object: Hidden Module [Name: UACbhdlnijeefentnu.dll]
Process: svchost.exe (PID: 1060) Address: 0x00b50000 Size: 45056

Object: Hidden Module [Name: UACvwokqioyqpsjwlj.dll]
Process: svchost.exe (PID: 1060) Address: 0x00be0000 Size: 49152

Object: Hidden Module [Name: UACbdrldetaxgojtou.dll]
Process: svchost.exe (PID: 1060) Address: 0x10000000 Size: 217088

Object: Hidden Module [Name: UACbhdlnijeefentnu.dll]
Process: svchost.exe (PID: 1144) Address: 0x00b50000 Size: 45056

Object: Hidden Module [Name: UACvwokqioyqpsjwlj.dll]
Process: svchost.exe (PID: 1144) Address: 0x00be0000 Size: 49152

Object: Hidden Module [Name: UACbdrldetaxgojtou.dll]
Process: svchost.exe (PID: 1144) Address: 0x10000000 Size: 217088

Object: Hidden Module [Name: UACbhdlnijeefentnu.dll]
Process: svchost.exe (PID: 1264) Address: 0x00b40000 Size: 45056

Object: Hidden Module [Name: UACvwokqioyqpsjwlj.dll]
Process: svchost.exe (PID: 1264) Address: 0x00bd0000 Size: 49152

Object: Hidden Module [Name: UACbdrldetaxgojtou.dll]
Process: svchost.exe (PID: 1264) Address: 0x10000000 Size: 217088

Object: Hidden Module [Name: UACbhdlnijeefentnu.dll]
Process: svchost.exe (PID: 1412) Address: 0x00b40000 Size: 45056

Object: Hidden Module [Name: UACvwokqioyqpsjwlj.dll]
Process: svchost.exe (PID: 1412) Address: 0x00bd0000 Size: 49152

Object: Hidden Module [Name: UACbdrldetaxgojtou.dll]
Process: svchost.exe (PID: 1412) Address: 0x10000000 Size: 217088

Object: Hidden Module [Name: UACbhdlnijeefentnu.dll]
Process: Explorer.EXE (PID: 1492) Address: 0x00d30000 Size: 45056

Object: Hidden Module [Name: UACvwokqioyqpsjwlj.dll]
Process: Explorer.EXE (PID: 1492) Address: 0x00e90000 Size: 49152

Object: Hidden Module [Name: UACvwokqioyqpsjwlj.dll]
Process: ctfmon.exe (PID: 1612) Address: 0x00d10000 Size: 49152

Object: Hidden Module [Name: UACbhdlnijeefentnu.dll]
Process: ctfmon.exe (PID: 1612) Address: 0x10000000 Size: 45056

Object: Hidden Module [Name: UACvwokqioyqpsjwlj.dll]
Process: spoolsv.exe (PID: 1856) Address: 0x00e00000 Size: 49152

Object: Hidden Module [Name: UACbhdlnijeefentnu.dll]
Process: spoolsv.exe (PID: 1856) Address: 0x10000000 Size: 45056

Object: Hidden Module [Name: UACvwokqioyqpsjwlj.dll]
Process: AppleMobileDeviceService.exe (PID: 1960) Address: 0x00be0000 Size: 49152

Object: Hidden Module [Name: UACbhdlnijeefentnu.dll]
Process: AppleMobileDeviceService.exe (PID: 1960) Address: 0x10000000 Size: 45056

Object: Hidden Module [Name: UACvwokqioyqpsjwlj.dll]
Process: arservice.exe (PID: 1976) Address: 0x00db0000 Size: 49152

Object: Hidden Module [Name: UACbhdlnijeefentnu.dll]
Process: arservice.exe (PID: 1976) Address: 0x10000000 Size: 45056

Object: Hidden Module [Name: UACbhdlnijeefentnu.dll]
Process: svchost.exe (PID: 212) Address: 0x00b40000 Size: 45056

Object: Hidden Module [Name: UACvwokqioyqpsjwlj.dll]
Process: svchost.exe (PID: 212) Address: 0x00bd0000 Size: 49152

Object: Hidden Module [Name: UACbdrldetaxgojtou.dll]
Process: svchost.exe (PID: 212) Address: 0x10000000 Size: 217088

Object: Hidden Module [Name: UACvwokqioyqpsjwlj.dll]
Process: DTSRVC.exe (PID: 320) Address: 0x00be0000 Size: 49152

Object: Hidden Module [Name: UACbhdlnijeefentnu.dll]
Process: DTSRVC.exe (PID: 320) Address: 0x10000000 Size: 45056

Object: Hidden Module [Name: UACvwokqioyqpsjwlj.dll]
Process: ehRecvr.exe (PID: 344) Address: 0x00a60000 Size: 49152

Object: Hidden Module [Name: UACbhdlnijeefentnu.dll]
Process: ehRecvr.exe (PID: 344) Address: 0x10000000 Size: 45056

Object: Hidden Module [Name: UACvwokqioyqpsjwlj.dll]
Process: ehSched.exe (PID: 360) Address: 0x00a40000 Size: 49152

Object: Hidden Module [Name: UACbhdlnijeefentnu.dll]
Process: ehSched.exe (PID: 360) Address: 0x10000000 Size: 45056

Object: Hidden Module [Name: UACvwokqioyqpsjwlj.dll]
Process: FastNetSrv.exe (PID: 464) Address: 0x00fb0000 Size: 49152

Object: Hidden Module [Name: UACbhdlnijeefentnu.dll]
Process: FastNetSrv.exe (PID: 464) Address: 0x10000000 Size: 45056

Object: Hidden Module [Name: UACvwokqioyqpsjwlj.dll]
Process: LSSrvc.exe (PID: 1236) Address: 0x00cc0000 Size: 49152

Object: Hidden Module [Name: UACbhdlnijeefentnu.dll]
Process: LSSrvc.exe (PID: 1236) Address: 0x10000000 Size: 45056

Object: Hidden Module [Name: UACvwokqioyqpsjwlj.dll]
Process: MDM.EXE (PID: 1352) Address: 0x00c40000 Size: 49152

Object: Hidden Module [Name: UACbhdlnijeefentnu.dll]
Process: MDM.EXE (PID: 1352) Address: 0x10000000 Size: 45056

Object: Hidden Module [Name: UACbhdlnijeefentnu.dll]
Process: PSIService.exe (PID: 1436) Address: 0x00bc0000 Size: 45056

Object: Hidden Module [Name: UACvwokqioyqpsjwlj.dll]
Process: PSIService.exe (PID: 1436) Address: 0x00d00000 Size: 49152

Object: Hidden Module [Name: UACbhdlnijeefentnu.dll]
Process: svchost.exe (PID: 1636) Address: 0x00b40000 Size: 45056

Object: Hidden Module [Name: UACvwokqioyqpsjwlj.dll]
Process: svchost.exe (PID: 1636) Address: 0x00bd0000 Size: 49152

Object: Hidden Module [Name: UACbdrldetaxgojtou.dll]
Process: svchost.exe (PID: 1636) Address: 0x10000000 Size: 217088

Object: Hidden Module [Name: UACvwokqioyqpsjwlj.dll]
Process: mcrdsvc.exe (PID: 2028) Address: 0x00a60000 Size: 49152

Object: Hidden Module [Name: UACbhdlnijeefentnu.dll]
Process: mcrdsvc.exe (PID: 2028) Address: 0x10000000 Size: 45056

Object: Hidden Module [Name: UACbhdlnijeefentnu.dll]
Process: svchost.exe (PID: 2332) Address: 0x00b50000 Size: 45056

Object: Hidden Module [Name: UACvwokqioyqpsjwlj.dll]
Process: svchost.exe (PID: 2332) Address: 0x00be0000 Size: 49152

Object: Hidden Module [Name: UACbdrldetaxgojtou.dll]
Process: svchost.exe (PID: 2332) Address: 0x10000000 Size: 217088

Object: Hidden Module [Name: UACvwokqioyqpsjwlj.dll]
Process: SetPoint.exe (PID: 1128) Address: 0x00da0000 Size: 49152

Object: Hidden Module [Name: UACbhdlnijeefentnu.dll]
Process: SetPoint.exe (PID: 1128) Address: 0x10000000 Size: 45056

Object: Hidden Module [Name: UACvwokqioyqpsjwlj.dll]
Process: wpctrl.exe (PID: 1080) Address: 0x00bb0000 Size: 49152

Object: Hidden Module [Name: UACbhdlnijeefentnu.dll]
Process: wpctrl.exe (PID: 1080) Address: 0x10000000 Size: 45056

Object: Hidden Module [Name: UACvwokqioyqpsjwlj.dll]
Process: jusched.exe (PID: 3368) Address: 0x00d10000 Size: 49152

Object: Hidden Module [Name: UACbhdlnijeefentnu.dll]
Process: jusched.exe (PID: 3368) Address: 0x10000000 Size: 45056

Object: Hidden Module [Name: UACvwokqioyqpsjwlj.dll]
Process: hpqtra08.exe (PID: 3080) Address: 0x00c50000 Size: 49152

Object: Hidden Module [Name: UACbhdlnijeefentnu.dll]
Process: hpqtra08.exe (PID: 3080) Address: 0x10000000 Size: 45056

Object: Hidden Module [Name: UACbhdlnijeefentnu.dll]
Process: PrnStatusMX.exe (PID: 2264) Address: 0x00ba0000 Size: 45056

Object: Hidden Module [Name: UACvwokqioyqpsjwlj.dll]
Process: PrnStatusMX.exe (PID: 2264) Address: 0x00d30000 Size: 49152

Object: Hidden Module [Name: UACvwokqioyqpsjwlj.dll]
Process: DMAScheduler.exe (PID: 2088) Address: 0x00c30000 Size: 49152

Object: Hidden Module [Name: UACbhdlnijeefentnu.dll]
Process: DMAScheduler.exe (PID: 2088) Address: 0x10000000 Size: 45056

Object: Hidden Module [Name: UACvwokqioyqpsjwlj.dll]
Process: HPwuSchd2.exe (PID: 2420) Address: 0x00c00000 Size: 49152

Object: Hidden Module [Name: UACbhdlnijeefentnu.dll]
Process: HPwuSchd2.exe (PID: 2420) Address: 0x10000000 Size: 45056

Object: Hidden Module [Name: UACvwokqioyqpsjwlj.dll]
Process: liser.exe (PID: 696) Address: 0x00b10000 Size: 49152

Object: Hidden Module [Name: UACbhdlnijeefentnu.dll]
Process: liser.exe (PID: 696) Address: 0x10000000 Size: 45056

Object: Hidden Module [Name: UACvwokqioyqpsjwlj.dll]
Process: ARPWRMSG.EXE (PID: 2236) Address: 0x00dc0000 Size: 49152

Object: Hidden Module [Name: UACbhdlnijeefentnu.dll]
Process: ARPWRMSG.EXE (PID: 2236) Address: 0x10000000 Size: 45056

Object: Hidden Module [Name: UACvwokqioyqpsjwlj.dll]
Process: iTunesHelper.exe (PID: 2060) Address: 0x00d70000 Size: 49152

Object: Hidden Module [Name: UACbhdlnijeefentnu.dll]
Process: iTunesHelper.exe (PID: 2060) Address: 0x10000000 Size: 45056

Object: Hidden Module [Name: UACvwokqioyqpsjwlj.dll]
Process: ehtray.exe (PID: 260) Address: 0x00b90000 Size: 49152

Object: Hidden Module [Name: UACbhdlnijeefentnu.dll]
Process: ehtray.exe (PID: 260) Address: 0x10000000 Size: 45056

Object: Hidden Module [Name: UACvwokqioyqpsjwlj.dll]
Process: ehmsas.exe (PID: 2392) Address: 0x00a50000 Size: 49152

Object: Hidden Module [Name: UACbhdlnijeefentnu.dll]
Process: ehmsas.exe (PID: 2392) Address: 0x10000000 Size: 45056

Object: Hidden Module [Name: UACvwokqioyqpsjwlj.dll]
Process: floater.exe (PID: 2876) Address: 0x00cb0000 Size: 49152

Object: Hidden Module [Name: UACbhdlnijeefentnu.dll]
Process: floater.exe (PID: 2876) Address: 0x10000000 Size: 45056

Object: Hidden Module [Name: UACvwokqioyqpsjwlj.dll]
Process: KHALMNPR.EXE (PID: 3352) Address: 0x00b30000 Size: 49152

Object: Hidden Module [Name: UACbhdlnijeefentnu.dll]
Process: KHALMNPR.EXE (PID: 3352) Address: 0x10000000 Size: 45056

Object: Hidden Module [Name: UACvwokqioyqpsjwlj.dll]
Process: iPodService.exe (PID: 3932) Address: 0x00c40000 Size: 49152

Object: Hidden Module [Name: UACbhdlnijeefentnu.dll]
Process: iPodService.exe (PID: 3932) Address: 0x10000000 Size: 45056

Object: Hidden Module [Name: UACvwokqioyqpsjwlj.dll]
Process: RootRepeal.exe (PID: 3252) Address: 0x00cb0000 Size: 49152

Object: Hidden Module [Name: UACbhdlnijeefentnu.dll]
Process: RootRepeal.exe (PID: 3252) Address: 0x10000000 Size: 45056

Object: Hidden Module [Name: UACbdrldetaxgojtou.dll]
Process: Iexplore.exe (PID: 2000) Address: 0x01550000 Size: 217088

Object: Hidden Module [Name: UACbhdlnijeefentnu.dll]
Process: Iexplore.exe (PID: 2000) Address: 0x01740000 Size: 45056

Object: Hidden Module [Name: UACvwokqioyqpsjwlj.dll]
Process: Iexplore.exe (PID: 2000) Address: 0x017f0000 Size: 49152

Object: Hidden Code [Driver: Tcpip, IRP_MJ_CREATE]
Process: System Address: 0x89383670 Size: 627

Object: Hidden Code [Driver: Tcpip, IRP_MJ_CREATE_NAMED_PIPE]
Process: System Address: 0x8937f670 Size: 891

Object: Hidden Code [Driver: Tcpip, IRP_MJ_CLOSE]
Process: System Address: 0x8937d670 Size: 891

Object: Hidden Code [Driver: Tcpip, IRP_MJ_READ]
Process: System Address: 0x8937b670 Size: 429

Object: Hidden Code [Driver: Tcpip, IRP_MJ_WRITE]
Process: System Address: 0x89379670 Size: 2448

Object: Hidden Code [Driver: Tcpip, IRP_MJ_QUERY_INFORMATION]
Process: System Address: 0x8936f670 Size: 395

Object: Hidden Code [Driver: Tcpip, IRP_MJ_SET_INFORMATION]
Process: System Address: 0x8946e820 Size: 459

Object: Hidden Code [Driver: Tcpip, IRP_MJ_QUERY_EA]
Process: System Address: 0x8982d6f8 Size: 1172

Object: Hidden Code [Driver: Tcpip, IRP_MJ_SET_EA]
Process: System Address: 0x8984ea60 Size: 578

Object: Hidden Code [Driver: Tcpip, IRP_MJ_FLUSH_BUFFERS]
Process: System Address: 0x89360688 Size: 724

Object: Hidden Code [Driver: Tcpip, IRP_MJ_QUERY_VOLUME_INFORMATION]
Process: System Address: 0x8935f688 Size: 146

Object: Hidden Code [Driver: Tcpip, IRP_MJ_SET_VOLUME_INFORMATION]
Process: System Address: 0x890dc7a8 Size: 104

Object: Hidden Code [Driver: Tcpip, IRP_MJ_DIRECTORY_CONTROL]
Process: System Address: 0x8948d848 Size: 1976

Object: Hidden Code [Driver: Tcpip, IRP_MJ_FILE_SYSTEM_CONTROL]
Process: System Address: 0x88e24898 Size: 1896

Object: Hidden Code [Driver: Tcpip, IRP_MJ_DEVICE_CONTROL]
Process: System Address: 0x89465858 Size: 259

Object: Hidden Code [Driver: Tcpip, IRP_MJ_INTERNAL_DEVICE_CONTROL]
Process: System Address: 0x890b6758 Size: 202

Object: Hidden Code [Driver: Tcpip, IRP_MJ_SHUTDOWN]
Process: System Address: 0x890b66e0 Size: 111

Object: Hidden Code [Driver: Tcpip, IRP_MJ_LOCK_CONTROL]
Process: System Address: 0x890b4758 Size: 2216

Object: Hidden Code [Driver: Tcpip, IRP_MJ_CLEANUP]
Process: System Address: 0x890b46e0 Size: 111

Object: Hidden Code [Driver: Tcpip, IRP_MJ_CREATE_MAILSLOT]
Process: System Address: 0x890b1758 Size: 2216

Object: Hidden Code [Driver: Tcpip, IRP_MJ_QUERY_SECURITY]
Process: System Address: 0x890b16e0 Size: 111

Object: Hidden Code [Driver: Tcpip, IRP_MJ_SET_SECURITY]
Process: System Address: 0x890af758 Size: 207

Object: Hidden Code [Driver: Tcpip, IRP_MJ_POWER]
Process: System Address: 0x890af6e0 Size: 111

Object: Hidden Code [Driver: Tcpip, IRP_MJ_SYSTEM_CONTROL]
Process: System Address: 0x890ac758 Size: 2216

Object: Hidden Code [Driver: Tcpip, IRP_MJ_DEVICE_CHANGE]
Process: System Address: 0x890ac6e0 Size: 111

Object: Hidden Code [Driver: Tcpip, IRP_MJ_QUERY_QUOTA]
Process: System Address: 0x890aa758 Size: 307

Object: Hidden Code [Driver: Tcpip, IRP_MJ_SET_QUOTA]
Process: System Address: 0x890aa6e0 Size: 111

Object: Hidden Code [Driver: Tcpip, IRP_MJ_PNP]
Process: System Address: 0x890a7758 Size: 290

==EOF==

BC AdBot (Login to Remove)

 


#2 m0le

m0le

    Can U Dig It?


  • Malware Response Team
  • 34,527 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:London, UK
  • Local time:07:45 AM

Posted 29 October 2009 - 02:24 PM

Hello and welcome to Bleeping Computer

We apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help. No one is ignored here.

If you have since resolved the original problem you were having, we would appreciate you letting us know. If not please perform the following steps below so we can have a look at the current condition of your machine.

If you have not done so, include a clear description of the problems you're having, along with any steps you may have performed so far.

Upon completing the steps below another staff member will review and take the steps necessary with you to get your machine back in working order clean and free of malware.

If you have already posted a DDS log, please do so again, as your situation may have changed.
Use the 'Add Reply' and add the new log to this thread.


Thanks and again sorry for the delay.

We need to see some information about what is happening in your machine. Please perform the following scan:
  • Download DDS by sUBs from one of the following links. Save it to your desktop.
  • Double click on the DDS icon, allow it to run.
  • A small box will open, with an explaination about the tool. No input is needed, the scan is running.
  • Notepad will open with the results.
  • Follow the instructions that pop up for posting the results.
  • Close the program window, and delete the program from your desktop.
Please note: You may have to disable any script protection running if the scan fails to run. After downloading the tool, disconnect from the internet and disable all antivirus protection. Run the scan, enable your A/V and reconnect to the internet.

Information on A/V control HERE


And

We Need to check for Rootkits with RootRepeal
  • Download RootRepeal from the following location and save it to your desktop.

    First Location
    Second Location
    Third Location

  • Open Posted Image on your desktop.
  • Click the Posted Image tab.
  • Click the Posted Image button.
  • Check all seven boxes: Posted Image
  • Push Ok
  • Check the box for your main system drive (Usually C:), and press Ok.
  • Allow RootRepeal to run a scan of your system. This may take some time.
  • Once the scan completes, push the Posted Image button. Save the log to your desktop, using a distinctive name, such as RootRepeal.txt. Include this report in your next reply, please.

Posted Image
m0le is a proud member of UNITE

#3 Monkeyb00y

Monkeyb00y
  • Topic Starter

  • Members
  • 75 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Behind my eyes...
  • Local time:02:45 AM

Posted 31 October 2009 - 12:46 AM

Thank you very much for the help. The information showing in the first post is still the current. The
computer in question has been OFF since the ROOT REPEAL scan has been done. DDS will not work
but ROOT REPEAL did. The description of the problem is in the first post.
Thank you again for the help!
Monkeyb00y

#4 m0le

m0le

    Can U Dig It?


  • Malware Response Team
  • 34,527 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:London, UK
  • Local time:07:45 AM

Posted 31 October 2009 - 04:07 AM

There's evidence of two rootkits on the logs. However, Windows Police Pro brings along some other nasty companions. We need to damage those processes and try and remove them.

Download and Run RKill

Please download RKill by Grinler from one of the 4 links below and save it to your desktop.

Link 1
Link 2
Link 3
Link 4
  • Before we begin, you should disable your anti-malware softwares you have installed so they do not interfere RKill running as some anti-malware softwares detect RKill as malicious. Please refer to this page if you are not sure how.
  • Double-click on Rkill on your desktop to run it. (If you are using Windows Vista, please right-click on it and select Run As Administrator)
  • A black screen will appear and then disappear. Please do not worry, that is normal. This means that the tool has been successfully executed.
  • If nothing happens or if the tool does not run, please let me know in your next reply
Otherwise

Please download ComboFix from one of these locations:* IMPORTANT !!! Save ComboFix.exe to your Desktop making sure you rename it comfix.exe
  • Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. (Click on this link to see a list of programs that should be disabled. The list is not all inclusive.)
  • Double click on Combofix.exe & follow the prompts.
  • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

Posted Image


Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

Posted Image


Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

Thanks :(
Posted Image
m0le is a proud member of UNITE

#5 Monkeyb00y

Monkeyb00y
  • Topic Starter

  • Members
  • 75 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Behind my eyes...
  • Local time:02:45 AM

Posted 02 November 2009 - 01:17 AM

Thanks for the help, m0le!

Everything ran without a hitch.

-Monkeyb00y

ComboFix log below:

ComboFix 09-11-01.02 - HP_Administrator 11/02/2009 1:00.1.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1982.1625 [GMT -5:00]
Running from: c:\documents and settings\HP_Administrator\Desktop\ComFix.exe
AV: Norton 360 *On-access scanning enabled* (Updated) {A5F1BC7C-EA33-4247-961C-0217208396C4}
FW: Norton 360 *enabled* {371C0A40-5A0C-4AD2-A6E5-69C02037FBF3}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users\Application Data\SysFld
c:\documents and settings\All Users\Application Data\SysFld\fastav.cfg
c:\documents and settings\HP_Administrator\Application Data\Fast Antivirus 2009
c:\program files\Manson
c:\program files\Manson\liser.dll
c:\program files\Manson\liser.exe
c:\program files\Mozilla Firefox\searchplugins\search.xml
c:\program files\Windows Police Pro
c:\program files\Windows Police Pro\msvcm80.dll
c:\program files\Windows Police Pro\msvcp80.dll
c:\program files\Windows Police Pro\msvcr80.dll
c:\program files\Windows Police Pro\tmp\dbsinit.exe
c:\program files\Windows Police Pro\tmp\images\i1.gif
c:\program files\Windows Police Pro\tmp\images\i2.gif
c:\program files\Windows Police Pro\tmp\images\i3.gif
c:\program files\Windows Police Pro\tmp\images\j1.gif
c:\program files\Windows Police Pro\tmp\images\j2.gif
c:\program files\Windows Police Pro\tmp\images\j3.gif
c:\program files\Windows Police Pro\tmp\images\jj1.gif
c:\program files\Windows Police Pro\tmp\images\jj2.gif
c:\program files\Windows Police Pro\tmp\images\jj3.gif
c:\program files\Windows Police Pro\tmp\images\l1.gif
c:\program files\Windows Police Pro\tmp\images\l2.gif
c:\program files\Windows Police Pro\tmp\images\l3.gif
c:\program files\Windows Police Pro\tmp\images\pix.gif
c:\program files\Windows Police Pro\tmp\images\t1.gif
c:\program files\Windows Police Pro\tmp\images\t2.gif
c:\program files\Windows Police Pro\tmp\images\up1.gif
c:\program files\Windows Police Pro\tmp\images\up2.gif
c:\program files\Windows Police Pro\tmp\images\w1.gif
c:\program files\Windows Police Pro\tmp\images\w11.gif
c:\program files\Windows Police Pro\tmp\images\w2.gif
c:\program files\Windows Police Pro\tmp\images\w3.gif
c:\program files\Windows Police Pro\tmp\images\w3.jpg
c:\program files\Windows Police Pro\tmp\images\wt1.gif
c:\program files\Windows Police Pro\tmp\images\wt2.gif
c:\program files\Windows Police Pro\tmp\images\wt3.gif
c:\program files\Windows Police Pro\tmp\wispex.html
c:\program files\Windows Police Pro\windows Police Pro.exe
c:\recycler\S-1-5-21-527237240-179605362-725345543-500
c:\windows\Install.txt
c:\windows\kb913800.exe
c:\windows\ppp3.dat
c:\windows\ppp4.dat
c:\windows\run.log
c:\windows\system32\6to4v32.dll
c:\windows\system32\bincd32.dat
c:\windows\system32\config\systemprofile\Desktop\Windows Police Pro.lnk
c:\windows\system32\dddesot.dll
c:\windows\system32\desote.exe
c:\windows\system32\drivers\hjgruiqaosjxxk.sys
c:\windows\system32\drivers\UACjeohecsmmujnrdj.sys
c:\windows\system32\FInstall.sys
c:\windows\system32\hjgruicikvnhba.dat
c:\windows\system32\hjgruikdcpicah.dll
c:\windows\system32\hjgruikreeocct.dat
c:\windows\system32\hjgruislswnbrv.dll
c:\windows\system32\hjgruivhklyxud.dll
c:\windows\system32\hjgruivpapqxux.dll
c:\windows\system32\Install.txt
c:\windows\system32\isasdk.sys
c:\windows\system32\net.net
c:\windows\system32\onhelp.htm
c:\windows\system32\regedit32.exe
c:\windows\system32\sonhelp.htm
c:\windows\system32\UACbdrldetaxgojtou.dll
c:\windows\system32\UACbhdlnijeefentnu.dll
c:\windows\system32\UACfsibivcvjkytkuc.dll
c:\windows\system32\uacinit.dll
c:\windows\system32\UACitjwjcfapswxrak.dat
c:\windows\system32\UACkksnkustpublpyu.db
c:\windows\system32\UACkseqxtivkdwyfypib.log
c:\windows\system32\uactmp.db
c:\windows\system32\UACvkytgkgmpktkkpt.dll
c:\windows\system32\UACvwokqioyqpsjwlj.dll
c:\windows\TEMP\mta83542.dll
D:\Autorun.inf

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_hjgruiarofjdlx
-------\Legacy_hjgruiarofjdlx
-------\Service_UACd.sys
-------\Legacy_UACd.sys
-------\Legacy_6TO4
-------\Legacy_BACKGROUND_SWITCH
-------\Legacy_ISASDK
-------\Service_6to4
-------\Service_BackGround switch
-------\Service_isasdk


((((((((((((((((((((((((( Files Created from 2009-10-02 to 2009-11-02 )))))))))))))))))))))))))))))))
.

2009-11-02 06:00 . 2009-11-02 06:00 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Google
2009-11-02 05:54 . 2005-06-29 17:03 175104 ----a-w- c:\windows\system32\drivers\ftsata2.sys
2009-11-02 05:54 . 2005-06-17 06:33 872064 ----a-w- c:\windows\system32\drivers\iaStor.sys
2009-11-02 05:54 . 2004-08-04 05:59 95360 ----a-w- c:\windows\system32\drivers\atapi.sys
2009-11-02 05:54 . 2004-08-04 05:59 95360 ----a-w- c:\windows\system32\dllcache\atapi.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-09-20 16:25 . 2009-09-20 16:25 2198 ----a-w- C:\Ff623.bat
2009-09-01 16:25 . 2009-09-01 16:25 163840 ----a-w- c:\windows\svchasts.exe
2009-03-08 18:10 . 2007-03-05 01:37 67688 ----a-w- c:\program files\mozilla firefox\components\jar50.dll
2009-03-08 18:10 . 2007-03-05 01:37 54368 ----a-w- c:\program files\mozilla firefox\components\jsd3250.dll
2009-03-08 18:10 . 2007-03-05 01:37 34944 ----a-w- c:\program files\mozilla firefox\components\myspell.dll
2009-03-08 18:10 . 2007-03-05 01:37 46712 ----a-w- c:\program files\mozilla firefox\components\spellchk.dll
2009-03-08 18:10 . 2007-03-05 01:37 172136 ----a-w- c:\program files\mozilla firefox\components\xpinstal.dll
2009-06-20 12:49 . 2007-08-16 02:13 88 --sh--r- c:\windows\system32\856F3E0EE0.sys
2009-06-20 12:49 . 2007-08-16 02:13 2516 --sha-w- c:\windows\system32\KGyGaAvL.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{B975DCEB-B486-4FB4-97A9-01C9145F9528}]
2004-08-09 21:00 117760 ----a-w- c:\windows\system32\avwa.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2004-10-13 1694208]
"updateMgr"="c:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 313472]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"UserFaultCheck"="c:\windows\system32\dumprep 0 -u" [X]
"ehTray"="c:\windows\ehome\ehtray.exe" [2005-09-29 67584]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-01-24 7311360]
"HPHUPD08"="c:\program files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08.exe" [2005-06-01 49152]
"DMAScheduler"="c:\program files\HP DigitalMedia Archive\DMAScheduler.exe" [2006-03-20 90112]
"Recguard"="c:\windows\SMINST\RECGUARD.EXE" [2005-07-22 237568]
"HPBootOp"="c:\program files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" [2006-02-15 249856]
"SpySweeper"="c:\program files\Webroot\Spy Sweeper\SpySweeperUI.exe" [2006-11-17 4806656]
"HP Software Update"="c:\program files\HP\HP Software Update\HPwuSchd2.exe" [2005-12-15 49152]
"SunJavaUpdateSched"="c:\program files\Java\jre1.5.0_09\bin\jusched.exe" [2006-10-12 49263]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2007-06-29 286720]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2007-07-10 270648]
"QuickFinder Scheduler"="c:\program files\WordPerfect Office X3\Programs\QFSCHD130.EXE" [2007-01-03 83568]
"ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2007-07-18 116072]
"DISCover"="c:\program files\DISC\DISCover.exe" [2007-10-31 1095256]
"Symantec PIF AlertEng"="c:\program files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2008-01-29 583048]
"PivotSoftware"="c:\program files\Portrait Displays\Pivot Software\wpctrl.exe" [2007-02-09 694008]
"hpbdfawep"="c:\program files\HP\Dfawep\bin\hpbdfawep.exe" [2007-04-25 954368]
"PrnStatusMX"="c:\program files\Hewlett-Packard\PrnStatusMX\PrnStatusMX.exe" [2007-08-29 1077248]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-06-29 198160]
"AlwaysReady Power Message APP"="ARPWRMSG.EXE" - c:\windows\arpwrmsg.exe [2005-08-02 77312]
"nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2006-01-24 1519616]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" - c:\windows\KHALMNPR.Exe [2008-02-29 76304]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-9-23 29696]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2005-12-15 282624]
Logitech Desktop Messenger.lnk - c:\program files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe [2009-3-8 91440]
Logitech SetPoint.lnk - c:\program files\Logitech\SetPoint\SetPoint.exe [2009-3-8 805392]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
2008-05-02 06:42 72208 ----a-w- c:\program files\Common Files\Logishrd\Bluetooth\LBTWLgn.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0SsiEfr.e

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WebrootSpySweeperService]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=
"c:\\Program Files\\Updates from HP\\9972322\\Program\\Updates from HP.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\\Program Files\\DISC\\DISCover.exe"=
"c:\\Program Files\\DISC\\DiscStreamHub.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"=

R2 BtwSrv;BtwSrv;c:\windows\system32\svchost.exe -k netsvcs [8/9/2004 4:00 PM 14336]
R2 fastnetsrv;fastnetsrv Service;c:\windows\system32\FastNetSrv.exe [8/9/2004 4:00 PM 94208]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [8/29/2008 12:53 PM 99376]
S2 gupdate1c9f91296f3e0a4;Google Update Service (gupdate1c9f91296f3e0a4);c:\program files\Google\Update\GoogleUpdate.exe [6/29/2009 6:37 PM 133104]

--- Other Services/Drivers In Memory ---

*NewlyCreated* - COMHOST
*NewlyCreated* - MBR
*Deregistered* - mbr

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
BtwSrv
.
Contents of the 'Scheduled Tasks' folder

2009-06-24 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 19:57]

2009-11-02 c:\windows\Tasks\GoogleUpdateTaskMachine.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-06-29 23:37]

2009-09-01 c:\windows\Tasks\wrSpySweeper_F49C9508A0A146169C02CCAE7EFDBA50.job
- c:\program files\Webroot\Spy Sweeper\SpySweeperUI.exe [2006-12-27 21:14]

2009-09-01 c:\windows\Tasks\wrSpySweeper_F49C9508A0A146169C02CCAE7EFDBA50.job
- c:\program files\Webroot\Spy Sweeper\SpySweeperUI.exe [2006-12-27 21:14]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
uDefault_Search_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=63&bd=PAVILION&pf=desktop
mSearch Bar = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=63&bd=PAVILION&pf=desktop
uInternet Connection Wizard,ShellNext = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=63&bd=PAVILION&pf=desktop
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
IE: Open with WordPerfect - c:\program files\WordPerfect Office X3\Programs\WPLauncher.hta
Trusted Zone: trymedia.com
Handler: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - c:\program files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
FF - ProfilePath - c:\documents and settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\ygfzyk87.default\
FF - component: c:\program files\Mozilla Firefox\components\xpinstal.dll
FF - component: c:\program files\Real\RealPlayer\browserrecord\firefox\ext\components\nprpffbrowserrecordext.dll
.
- - - - ORPHANS REMOVED - - - -

HKCU-Run-net - c:\windows\system32\net.net
HKLM-Run-PCDrProfiler - (no file)
SafeBoot-svcWRSSSDK
AddRemove-Win Police Pro - c:\program files\Windows Police Pro\AntiSpyware_Uninstall.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-11-02 01:09
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\BtwSrv]
"ServiceDll"="c:\windows\system32\BtwSrv.dll\00/1.0\0d\0aAccept: */*\0d\0aUA-CPU: x86\0d\0aUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.0.3705; .NET CLR 1.1.4322; Media Center PC 4.0; .NET CLR 2.0.50727)\0d\0aHost: 204.27.57.210\0d\0aConnection: Keep-Alive\0d\0a\0d\0a"
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\System\ControlSet001\Enum\HID\Vid_046d&Pid_c529&MI_01&Col01\7&16d741ff&0&0000\LogConf]
@DACL=(02 0000)
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(712)
c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll
c:\program files\common files\logishrd\bluetooth\LBTServ.dll
c:\windows\system32\WRLogonNTF.dll

- - - - - - - > 'explorer.exe'(3284)
c:\program files\Logitech\SetPoint\lgscroll.dll
c:\program files\Portrait Displays\Pivot Software\winphook.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Common Files\Symantec Shared\ccSvcHst.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\windows\arservice.exe
c:\program files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
c:\windows\eHome\ehRecvr.exe
c:\windows\eHome\ehSched.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\windows\system32\nvsvc32.exe
c:\windows\system32\PSIService.exe
c:\program files\Webroot\Spy Sweeper\SpySweeper.exe
c:\windows\ehome\mcrdsvc.exe
c:\windows\eHome\ehmsas.exe
c:\windows\system32\dllhost.exe
c:\program files\Portrait Displays\Pivot Software\floater.exe
c:\program files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
c:\program files\DISC\DiscStreamHub.exe
c:\program files\iPod\bin\iPodService.exe
.
**************************************************************************
.
Completion time: 2009-11-02 1:12 - machine was rebooted
ComboFix-quarantined-files.txt 2009-11-02 06:12

Pre-Run: 220,464,246,784 bytes free
Post-Run: 220,917,075,968 bytes free

- - End Of File - - AE3914803E0C967865422D09913A35B7

#6 m0le

m0le

    Can U Dig It?


  • Malware Response Team
  • 34,527 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:London, UK
  • Local time:07:45 AM

Posted 02 November 2009 - 05:26 AM

Good start, now we need to go back and get the rest :(

1. Close any open browsers.

2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

3. Open notepad and copy/paste the text in the quotebox below into it:

File::
c:\windows\system32\BtwSrv.dll
c:\windows\system32\FastNetSrv.exe

Registry::
[-HKEY_LOCAL_MACHINE\System\ControlSet001\Services\BtwSrv]

Driver::
BtwSrv
fastnetsrv

NetSvc::
BtwSrv


Save this as CFScript.txt, in the same location as ComboFix.exe


Posted Image

Refering to the picture above, drag CFScript into ComboFix.exe

When finished, it shall produce a log for you at C:\ComboFix.txt which I will require in your next reply.

Also, let me know how the PC is running.

Thanks :(
Posted Image
m0le is a proud member of UNITE

#7 Monkeyb00y

Monkeyb00y
  • Topic Starter

  • Members
  • 75 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Behind my eyes...
  • Local time:02:45 AM

Posted 02 November 2009 - 02:30 PM

Good day,

The computer is running pretty well now.
Edit: But when you shut down, Internet Explorer crashes & you have to push "OK" to
terminate it on the shut down screen. Other than that, seems ok.
As of last night, after the computer booted up, there weren't
any more error messages for every startup program. It used to have at least 35. That's stopped.
Now as for the antivirus programs to use, this computer has Spy Sweeper (didn't work while it was
infected) and Norton 360, which didn't prevent the infection in the first place, and it was PAID for too.
They wanted to charge an astronomical charge just to fix it. Their solution?
FORMAT the computer. That's all they say after being paid. Those guys don't know how to handle
malware & rootkits.
My other computers use Avira AntiVir Personal (Free) and they are just fine.
Please let me know your recommendations.

Thanks again!
Monkeyb00y

Here is the newest ComboFix Log:

ComboFix 09-11-01.02 - HP_Administrator 11/02/2009 14:13.2.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1982.1532 [GMT -5:00]
Running from: c:\documents and settings\HP_Administrator\Desktop\ComFix.exe
Command switches used :: c:\documents and settings\HP_Administrator\Desktop\CFScript1.txt
AV: Norton 360 *On-access scanning enabled* (Updated) {A5F1BC7C-EA33-4247-961C-0217208396C4}
FW: Norton 360 *enabled* {371C0A40-5A0C-4AD2-A6E5-69C02037FBF3}

FILE ::
"c:\windows\system32\BtwSrv.dll"
"c:\windows\system32\FastNetSrv.exe"
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\BtwSrv.dll
c:\windows\system32\FastNetSrv.exe
c:\windows\TEMP\mta89957.dll

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_BTWSRV
-------\Legacy_FASTNETSRV
-------\Service_fastnetsrv


((((((((((((((((((((((((( Files Created from 2009-10-02 to 2009-11-02 )))))))))))))))))))))))))))))))
.

2009-11-02 19:13 . 2005-06-29 17:03 175104 ----a-w- c:\windows\system32\drivers\ftsata2.sys
2009-11-02 19:13 . 2005-06-17 06:33 872064 ----a-w- c:\windows\system32\drivers\iaStor.sys
2009-11-02 19:13 . 2004-08-04 05:59 95360 ----a-w- c:\windows\system32\drivers\atapi.sys
2009-11-02 19:13 . 2004-08-04 05:59 95360 ----a-w- c:\windows\system32\dllcache\atapi.sys
2009-11-02 06:00 . 2009-11-02 06:00 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Google

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-09-20 16:25 . 2009-09-20 16:25 2198 ----a-w- C:\Ff623.bat
2009-09-01 16:25 . 2009-09-01 16:25 163840 ----a-w- c:\windows\svchasts.exe
2009-03-08 18:10 . 2007-03-05 01:37 67688 ----a-w- c:\program files\mozilla firefox\components\jar50.dll
2009-03-08 18:10 . 2007-03-05 01:37 54368 ----a-w- c:\program files\mozilla firefox\components\jsd3250.dll
2009-03-08 18:10 . 2007-03-05 01:37 34944 ----a-w- c:\program files\mozilla firefox\components\myspell.dll
2009-03-08 18:10 . 2007-03-05 01:37 46712 ----a-w- c:\program files\mozilla firefox\components\spellchk.dll
2009-03-08 18:10 . 2007-03-05 01:37 172136 ----a-w- c:\program files\mozilla firefox\components\xpinstal.dll
2009-06-20 12:49 . 2007-08-16 02:13 88 --sh--r- c:\windows\system32\856F3E0EE0.sys
2009-06-20 12:49 . 2007-08-16 02:13 2516 --sha-w- c:\windows\system32\KGyGaAvL.sys
.

((((((((((((((((((((((((((((( SnapShot@2009-11-02_06.09.38 )))))))))))))))))))))))))))))))))))))))))
.
- 2005-08-30 21:07 . 2009-11-02 05:45 64064 c:\windows\system32\perfc009.dat
+ 2005-08-30 21:07 . 2009-11-02 06:13 64064 c:\windows\system32\perfc009.dat
+ 2005-08-30 21:07 . 2009-11-02 06:13 405640 c:\windows\system32\perfh009.dat
- 2005-08-30 21:07 . 2009-11-02 05:45 405640 c:\windows\system32\perfh009.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{B975DCEB-B486-4FB4-97A9-01C9145F9528}]
2004-08-09 21:00 117760 ----a-w- c:\windows\system32\avwa.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2004-10-13 1694208]
"updateMgr"="c:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 313472]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"UserFaultCheck"="c:\windows\system32\dumprep 0 -u" [X]
"ehTray"="c:\windows\ehome\ehtray.exe" [2005-09-29 67584]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-01-24 7311360]
"HPHUPD08"="c:\program files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08.exe" [2005-06-01 49152]
"DMAScheduler"="c:\program files\HP DigitalMedia Archive\DMAScheduler.exe" [2006-03-20 90112]
"Recguard"="c:\windows\SMINST\RECGUARD.EXE" [2005-07-22 237568]
"HPBootOp"="c:\program files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" [2006-02-15 249856]
"HP Software Update"="c:\program files\HP\HP Software Update\HPwuSchd2.exe" [2005-12-15 49152]
"SunJavaUpdateSched"="c:\program files\Java\jre1.5.0_09\bin\jusched.exe" [2006-10-12 49263]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2007-06-29 286720]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2007-07-10 270648]
"QuickFinder Scheduler"="c:\program files\WordPerfect Office X3\Programs\QFSCHD130.EXE" [2007-01-03 83568]
"ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2007-07-18 116072]
"DISCover"="c:\program files\DISC\DISCover.exe" [2007-10-31 1095256]
"Symantec PIF AlertEng"="c:\program files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2008-01-29 583048]
"PivotSoftware"="c:\program files\Portrait Displays\Pivot Software\wpctrl.exe" [2007-02-09 694008]
"hpbdfawep"="c:\program files\HP\Dfawep\bin\hpbdfawep.exe" [2007-04-25 954368]
"PrnStatusMX"="c:\program files\Hewlett-Packard\PrnStatusMX\PrnStatusMX.exe" [2007-08-29 1077248]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-06-29 198160]
"AlwaysReady Power Message APP"="ARPWRMSG.EXE" - c:\windows\arpwrmsg.exe [2005-08-02 77312]
"nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2006-01-24 1519616]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" - c:\windows\KHALMNPR.Exe [2008-02-29 76304]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-9-23 29696]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2005-12-15 282624]
Logitech Desktop Messenger.lnk - c:\program files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe [2009-3-8 91440]
Logitech SetPoint.lnk - c:\program files\Logitech\SetPoint\SetPoint.exe [2009-3-8 805392]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
2008-05-02 06:42 72208 ----a-w- c:\program files\Common Files\Logishrd\Bluetooth\LBTWLgn.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0SsiEfr.e

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WebrootSpySweeperService]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=
"c:\\Program Files\\Updates from HP\\9972322\\Program\\Updates from HP.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\\Program Files\\DISC\\DISCover.exe"=
"c:\\Program Files\\DISC\\DiscStreamHub.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"=

R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [8/29/2008 12:53 PM 99376]
S2 gupdate1c9f91296f3e0a4;Google Update Service (gupdate1c9f91296f3e0a4);c:\program files\Google\Update\GoogleUpdate.exe [6/29/2009 6:37 PM 133104]

--- Other Services/Drivers In Memory ---

*NewlyCreated* - COMHOST
*Deregistered* - mbr
.
Contents of the 'Scheduled Tasks' folder

2009-06-24 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 19:57]

2009-11-02 c:\windows\Tasks\GoogleUpdateTaskMachine.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-06-29 23:37]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.comcast.net/home.html
uDefault_Search_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=63&bd=PAVILION&pf=desktop
mSearch Bar = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=63&bd=PAVILION&pf=desktop
uInternet Connection Wizard,ShellNext = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=63&bd=PAVILION&pf=desktop
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
IE: Open with WordPerfect - c:\program files\WordPerfect Office X3\Programs\WPLauncher.hta
Trusted Zone: trymedia.com
Handler: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - c:\program files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
FF - ProfilePath - c:\documents and settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\ygfzyk87.default\
FF - component: c:\program files\Mozilla Firefox\components\xpinstal.dll
FF - component: c:\program files\Real\RealPlayer\browserrecord\firefox\ext\components\nprpffbrowserrecordext.dll
.

**************************************************************************
scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files:

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\System\ControlSet001\Enum\HID\Vid_046d&Pid_c529&MI_01&Col01\7&16d741ff&0&0000\LogConf]
@DACL=(02 0000)
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(728)
c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll
c:\program files\common files\logishrd\bluetooth\LBTServ.dll
c:\windows\system32\WRLogonNTF.dll

- - - - - - - > 'explorer.exe'(4080)
c:\program files\Logitech\SetPoint\lgscroll.dll
c:\program files\Portrait Displays\Pivot Software\winphook.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Common Files\Symantec Shared\ccSvcHst.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\windows\arservice.exe
c:\program files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
c:\windows\eHome\ehRecvr.exe
c:\windows\eHome\ehSched.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\windows\system32\nvsvc32.exe
c:\windows\system32\PSIService.exe
c:\program files\Webroot\Spy Sweeper\SpySweeper.exe
c:\windows\ehome\mcrdsvc.exe
c:\windows\system32\dllhost.exe
c:\windows\eHome\ehmsas.exe
c:\program files\Portrait Displays\Pivot Software\floater.exe
c:\program files\DISC\DiscStreamHub.exe
c:\program files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
c:\program files\iPod\bin\iPodService.exe
c:\hp\KBD\KBD.EXE
c:\windows\system\hpsysdrv.exe
.
**************************************************************************
.
Completion time: 2009-11-02 14:25 - machine was rebooted
ComboFix-quarantined-files.txt 2009-11-02 19:24
ComboFix2.txt 2009-11-02 06:12

Pre-Run: 220,908,462,080 bytes free
Post-Run: 220,898,295,808 bytes free

- - End Of File - - 33DF6B646D4A689B3F20F32E38BAA999

Edited by Monkeyb00y, 02 November 2009 - 02:42 PM.


#8 m0le

m0le

    Can U Dig It?


  • Malware Response Team
  • 34,527 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:London, UK
  • Local time:07:45 AM

Posted 02 November 2009 - 07:56 PM

I will recommend some things to look for at the end of the fix. Don't be too hard on the security companies, they will always be behind the new malware as it takes time to catch and analyse them before they update their programs.


We still have things to remove though...

1. Close any open browsers.

2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

3. Open notepad and copy/paste the text in the quotebox below into it:

File::
c:\windows\svchasts.exe
c:\windows\system32\856F3E0EE0.sys
c:\windows\system32\avwa.dll

Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{B975DCEB-B486-4FB4-97A9-01C9145F9528}]


Save this as CFScript.txt, in the same location as ComboFix.exe


Posted Image

Refering to the picture above, drag CFScript into ComboFix.exe

When finished, it shall produce a log for you at C:\ComboFix.txt which I will require in your next reply.


Next, please run MBAM to clean up

Please download Posted Image Malwarebytes Anti-Malware and save it to your desktop.
  • Make sure you are connected to the Internet.
  • Double-click on mbam-setup.exe to install the application or, if you are using Vista, right-click and select Run As Administrator on mbam-setup.exe to install the application.
  • When the installation begins, follow the prompts and do not make any changes to default settings.
  • When installation has finished, make sure you leave both of these checked:
    • Update Malwarebytes' Anti-Malware
    • Launch Malwarebytes' Anti-Malware
  • Then click Finish.
  • MBAM will automatically start and you will be asked to update the program before performing a scan. If an update is found, the program will automatically update itself. Press the OK button to close that box and continue. If you encounter any problems while downloading the updates, manually download them from here and just double-click on mbam-rules.exe to install.
  • On the Scanner tab:
    • Make sure the "Perform Full Scan" option is selected.
    • Then click on the Scan button.
  • If asked to select the drives to scan, leave all the drives selected and click on the Start Scan button.
  • The scan will begin and "Scan in progress" will show at the top. It may take some time to complete so please be patient.
  • When the scan is finished, a message box will say "The scan completed successfully. Click 'Show Results' to display all objects found".
  • Click OK to close the message box and continue with the removal process.
  • Back at the main Scanner screen, click on the Show Results button to see a list of any malware that was found.
  • Make sure that everything is checked, and click Remove Selected.
  • When removal is completed, a log report will open in Notepad.
  • The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
  • Copy and paste the contents of that report in your next reply and exit MBAM.
Note: If MBAM encounters a file that is difficult to remove, you may be asked to reboot your computer so it can proceed with the disinfection process. Regardless if prompted to restart the computer or not, please do so immediately. Failure to reboot normally (not into safe mode) will prevent MBAM from removing all the malware. MBAM may make changes to your registry as part of its disinfection routine. If you're using other security programs that detect registry changes, they may alert you after scanning with MBAM. Please permit the program to allow the changes.

Thanks :(
Posted Image
m0le is a proud member of UNITE

#9 Monkeyb00y

Monkeyb00y
  • Topic Starter

  • Members
  • 75 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Behind my eyes...
  • Local time:02:45 AM

Posted 02 November 2009 - 09:18 PM

Thanks again for the help m0le,

After you put into perspective, you're right. The problems we face come about every day, it takes lots of time to go through them,
especially as a big company.

Thanks again,
Monkeyb00y

ComboFix Log:

ComboFix 09-11-01.02 - HP_Administrator 11/02/2009 20:25.3.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1982.1564 [GMT -5:00]
Running from: c:\documents and settings\HP_Administrator\Desktop\ComFix.exe
Command switches used :: c:\documents and settings\HP_Administrator\Desktop\CFScript2.txt
AV: Norton 360 *On-access scanning enabled* (Updated) {A5F1BC7C-EA33-4247-961C-0217208396C4}
FW: Norton 360 *enabled* {371C0A40-5A0C-4AD2-A6E5-69C02037FBF3}

FILE ::
"c:\windows\svchasts.exe"
"c:\windows\system32\856F3E0EE0.sys"
"c:\windows\system32\avwa.dll"
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\svchasts.exe
c:\windows\system32\856F3E0EE0.sys
c:\windows\system32\avwa.dll

.
((((((((((((((((((((((((( Files Created from 2009-10-03 to 2009-11-03 )))))))))))))))))))))))))))))))
.

2009-11-03 01:25 . 2005-06-29 17:03 175104 ----a-w- c:\windows\system32\drivers\ftsata2.sys
2009-11-03 01:25 . 2005-06-17 06:33 872064 ----a-w- c:\windows\system32\drivers\iaStor.sys
2009-11-03 01:25 . 2004-08-04 05:59 95360 ----a-w- c:\windows\system32\drivers\atapi.sys
2009-11-03 01:25 . 2004-08-04 05:59 95360 ----a-w- c:\windows\system32\dllcache\atapi.sys
2009-11-02 19:11 . 2009-11-02 19:25 -------- d-----w- C:\ComFix
2009-11-02 06:00 . 2009-11-02 06:00 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Google

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-09-20 16:25 . 2009-09-20 16:25 2198 ----a-w- C:\Ff623.bat
2009-03-08 18:10 . 2007-03-05 01:37 67688 ----a-w- c:\program files\mozilla firefox\components\jar50.dll
2009-03-08 18:10 . 2007-03-05 01:37 54368 ----a-w- c:\program files\mozilla firefox\components\jsd3250.dll
2009-03-08 18:10 . 2007-03-05 01:37 34944 ----a-w- c:\program files\mozilla firefox\components\myspell.dll
2009-03-08 18:10 . 2007-03-05 01:37 46712 ----a-w- c:\program files\mozilla firefox\components\spellchk.dll
2009-03-08 18:10 . 2007-03-05 01:37 172136 ----a-w- c:\program files\mozilla firefox\components\xpinstal.dll
2009-06-20 12:49 . 2007-08-16 02:13 2516 --sha-w- c:\windows\system32\KGyGaAvL.sys
.

((((((((((((((((((((((((((((( SnapShot@2009-11-02_06.09.38 )))))))))))))))))))))))))))))))))))))))))
.
- 2005-08-30 21:07 . 2009-11-02 05:45 64064 c:\windows\system32\perfc009.dat
+ 2005-08-30 21:07 . 2009-11-02 06:13 64064 c:\windows\system32\perfc009.dat
+ 2005-08-30 21:07 . 2009-11-02 06:13 405640 c:\windows\system32\perfh009.dat
- 2005-08-30 21:07 . 2009-11-02 05:45 405640 c:\windows\system32\perfh009.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2004-10-13 1694208]
"updateMgr"="c:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 313472]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"UserFaultCheck"="c:\windows\system32\dumprep 0 -u" [X]
"ehTray"="c:\windows\ehome\ehtray.exe" [2005-09-29 67584]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-01-24 7311360]
"HPHUPD08"="c:\program files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08.exe" [2005-06-01 49152]
"DMAScheduler"="c:\program files\HP DigitalMedia Archive\DMAScheduler.exe" [2006-03-20 90112]
"Recguard"="c:\windows\SMINST\RECGUARD.EXE" [2005-07-22 237568]
"HPBootOp"="c:\program files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" [2006-02-15 249856]
"HP Software Update"="c:\program files\HP\HP Software Update\HPwuSchd2.exe" [2005-12-15 49152]
"SunJavaUpdateSched"="c:\program files\Java\jre1.5.0_09\bin\jusched.exe" [2006-10-12 49263]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2007-06-29 286720]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2007-07-10 270648]
"QuickFinder Scheduler"="c:\program files\WordPerfect Office X3\Programs\QFSCHD130.EXE" [2007-01-03 83568]
"ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2007-07-18 116072]
"DISCover"="c:\program files\DISC\DISCover.exe" [2007-10-31 1095256]
"Symantec PIF AlertEng"="c:\program files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2008-01-29 583048]
"PivotSoftware"="c:\program files\Portrait Displays\Pivot Software\wpctrl.exe" [2007-02-09 694008]
"hpbdfawep"="c:\program files\HP\Dfawep\bin\hpbdfawep.exe" [2007-04-25 954368]
"PrnStatusMX"="c:\program files\Hewlett-Packard\PrnStatusMX\PrnStatusMX.exe" [2007-08-29 1077248]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-06-29 198160]
"AlwaysReady Power Message APP"="ARPWRMSG.EXE" - c:\windows\arpwrmsg.exe [2005-08-02 77312]
"nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2006-01-24 1519616]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" - c:\windows\KHALMNPR.Exe [2008-02-29 76304]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-9-23 29696]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2005-12-15 282624]
Logitech Desktop Messenger.lnk - c:\program files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe [2009-3-8 91440]
Logitech SetPoint.lnk - c:\program files\Logitech\SetPoint\SetPoint.exe [2009-3-8 805392]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
2008-05-02 06:42 72208 ----a-w- c:\program files\Common Files\Logishrd\Bluetooth\LBTWLgn.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0SsiEfr.e

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WebrootSpySweeperService]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=
"c:\\Program Files\\Updates from HP\\9972322\\Program\\Updates from HP.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\\Program Files\\DISC\\DISCover.exe"=
"c:\\Program Files\\DISC\\DiscStreamHub.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"=

R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [8/29/2008 12:53 PM 99376]
S2 gupdate1c9f91296f3e0a4;Google Update Service (gupdate1c9f91296f3e0a4);c:\program files\Google\Update\GoogleUpdate.exe [6/29/2009 6:37 PM 133104]

--- Other Services/Drivers In Memory ---

*NewlyCreated* - COMHOST
*Deregistered* - mbr
*Deregistered* - PROCEXP113
.
Contents of the 'Scheduled Tasks' folder

2009-06-24 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 19:57]

2009-11-03 c:\windows\Tasks\GoogleUpdateTaskMachine.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-06-29 23:37]

2009-11-03 c:\windows\Tasks\HP WEP.job
- c:\program files\HP\Dfawep\bin\hpbdfawep.exe [2007-04-25 18:28]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.comcast.net/home.html
uDefault_Search_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=63&bd=PAVILION&pf=desktop
mSearch Bar = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=63&bd=PAVILION&pf=desktop
uInternet Connection Wizard,ShellNext = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=63&bd=PAVILION&pf=desktop
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
IE: Open with WordPerfect - c:\program files\WordPerfect Office X3\Programs\WPLauncher.hta
Trusted Zone: trymedia.com
Handler: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - c:\program files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
FF - ProfilePath - c:\documents and settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\ygfzyk87.default\
FF - component: c:\program files\Mozilla Firefox\components\xpinstal.dll
FF - component: c:\program files\Real\RealPlayer\browserrecord\firefox\ext\components\nprpffbrowserrecordext.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-11-02 20:31
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\System\ControlSet001\Enum\HID\Vid_046d&Pid_c529&MI_01&Col01\7&16d741ff&0&0000\LogConf]
@DACL=(02 0000)
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(724)
c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll
c:\program files\common files\logishrd\bluetooth\LBTServ.dll
c:\windows\system32\WRLogonNTF.dll
.
Completion time: 2009-11-03 20:32
ComboFix-quarantined-files.txt 2009-11-03 01:32
ComboFix2.txt 2009-11-02 19:25
ComboFix3.txt 2009-11-02 06:12

Pre-Run: 220,897,480,704 bytes free
Post-Run: 220,862,164,992 bytes free

- - End Of File - - AA1506C40675484766348B95D4021397


*****************************************************************

MBAM Log:

Malwarebytes' Anti-Malware 1.41
Database version: 3030
Windows 5.1.2600 Service Pack 2

11/2/2009 9:14:14 PM
mbam-log-2009-11-02 (21-14-14).txt

Scan type: Full Scan (C:\|D:\|)
Objects scanned: 225543
Time elapsed: 30 minute(s), 51 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 3
Registry Data Items Infected: 5
Folders Infected: 0
Files Infected: 54

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\mBt (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\udfa (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\mfa (Backdoor.Bot) -> Quarantined and deleted successfully.

Registry Data Items Infected:
HKEY_CURRENT_USER\SOFTWARE\Classes\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\URL (Hijack.SearchPage) -> Bad: (http://search-gala.com/?&uid=147&q={searchTerms}) Good: (http://www.Google.com/) -> Quarantined and deleted successfully.
HKEY_USERS\S-1-5-19\SOFTWARE\Classes\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\URL (Hijack.SearchPage) -> Bad: (http://search-gala.com/?&uid=147&q={searchTerms}) Good: (http://www.Google.com/) -> Quarantined and deleted successfully.
HKEY_USERS\S-1-5-19\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\URL (Hijack.SearchPage) -> Bad: (http://search-gala.com/?&uid=147&q={searchTerms}) Good: (http://www.Google.com/) -> Quarantined and deleted successfully.
HKEY_USERS\S-1-5-20\SOFTWARE\Classes\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\URL (Hijack.SearchPage) -> Bad: (http://search-gala.com/?&uid=147&q={searchTerms}) Good: (http://www.Google.com/) -> Quarantined and deleted successfully.
HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\URL (Hijack.SearchPage) -> Bad: (http://search-gala.com/?&uid=147&q={searchTerms}) Good: (http://www.Google.com/) -> Quarantined and deleted successfully.

Folders Infected:
(No malicious items detected)

Files Infected:
C:\Documents and Settings\All Users\Application Data\f4376c1\EXf437.exe (Rogue.FastAntiVirus) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\Program Files\Manson\liser.dll.vir (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\Program Files\Manson\liser.exe.vir (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\Program Files\Windows Police Pro\windows Police Pro.exe.vir (Antivirus2009) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\Program Files\Windows Police Pro\tmp\dbsinit.exe.vir (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\svchasts.exe.vir (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\6to4v32.dll.vir (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\BtwSrv.dll.vir (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\dddesot.dll.vir (Rogue.ASC-AntiSpyware) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\desote.exe.vir (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\FastNetSrv.exe.vir (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\hjgruikdcpicah.dll.vir (Rootkit.TDSS) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\hjgruislswnbrv.dll.vir (Rootkit.TDSS) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\hjgruivhklyxud.dll.vir (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\hjgruivpapqxux.dll.vir (Rootkit.TDSS) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\isasdk.sys.vir (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\net.net.vir (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\regedit32.exe.vir (Trojan.Backdoor) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\UACbdrldetaxgojtou.dll.vir (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\UACbhdlnijeefentnu.dll.vir (Rootkit.TDSS) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\UACfsibivcvjkytkuc.dll.vir (Rootkit.TDSS) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\UACvkytgkgmpktkkpt.dll.vir (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\UACvwokqioyqpsjwlj.dll.vir (Rootkit.TDSS) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\drivers\hjgruiqaosjxxk.sys.vir (Rootkit.TDSS) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\drivers\UACjeohecsmmujnrdj.sys.vir (Rootkit.TDSS) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{106CF321-99A3-4E3A-9103-1BD027606A99}\RP801\A0043767.sys (Rootkit.TDSS) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{106CF321-99A3-4E3A-9103-1BD027606A99}\RP801\A0043768.dll (Rootkit.TDSS) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{106CF321-99A3-4E3A-9103-1BD027606A99}\RP801\A0043769.dll (Rootkit.TDSS) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{106CF321-99A3-4E3A-9103-1BD027606A99}\RP801\A0043770.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{106CF321-99A3-4E3A-9103-1BD027606A99}\RP801\A0043771.dll (Rootkit.TDSS) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{106CF321-99A3-4E3A-9103-1BD027606A99}\RP801\A0043772.sys (Rootkit.TDSS) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{106CF321-99A3-4E3A-9103-1BD027606A99}\RP801\A0043773.dll (Rootkit.TDSS) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{106CF321-99A3-4E3A-9103-1BD027606A99}\RP801\A0043774.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{106CF321-99A3-4E3A-9103-1BD027606A99}\RP801\A0043775.dll (Rootkit.TDSS) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{106CF321-99A3-4E3A-9103-1BD027606A99}\RP801\A0043776.dll (Rootkit.TDSS) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{106CF321-99A3-4E3A-9103-1BD027606A99}\RP801\A0043777.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{106CF321-99A3-4E3A-9103-1BD027606A99}\RP801\A0043808.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{106CF321-99A3-4E3A-9103-1BD027606A99}\RP801\A0043809.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{106CF321-99A3-4E3A-9103-1BD027606A99}\RP801\A0043813.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{106CF321-99A3-4E3A-9103-1BD027606A99}\RP801\A0043814.exe (Antivirus2009) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{106CF321-99A3-4E3A-9103-1BD027606A99}\RP801\A0043816.dll (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{106CF321-99A3-4E3A-9103-1BD027606A99}\RP801\A0043818.dll (Rogue.ASC-AntiSpyware) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{106CF321-99A3-4E3A-9103-1BD027606A99}\RP801\A0043819.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{106CF321-99A3-4E3A-9103-1BD027606A99}\RP801\A0043821.sys (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{106CF321-99A3-4E3A-9103-1BD027606A99}\RP801\A0043822.exe (Trojan.Backdoor) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{106CF321-99A3-4E3A-9103-1BD027606A99}\RP801\A0043949.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{106CF321-99A3-4E3A-9103-1BD027606A99}\RP801\A0043950.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{106CF321-99A3-4E3A-9103-1BD027606A99}\RP801\A0044134.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\lsm32.sys (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\opeia.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\wmdtc.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Documents and Settings\HP_Administrator\Desktop\Fast Antivirus 2009.lnk (Rogue.FastAntiVirus) -> Quarantined and deleted successfully.
C:\Documents and Settings\HP_Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\Fast Antivirus 2009.lnk (Rogue.FastAntiVirus) -> Quarantined and deleted successfully.
C:\Documents and Settings\HP_Administrator\Start Menu\Fast Antivirus 2009.lnk (Rogue.FastAntiVirus) -> Quarantined and deleted successfully.

#10 m0le

m0le

    Can U Dig It?


  • Malware Response Team
  • 34,527 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:London, UK
  • Local time:07:45 AM

Posted 02 November 2009 - 09:42 PM

The Combofix log is looking good and the MBAM log shows us that there was a lot of infections on the PC.


We should clean out your temp files/cache/cookies

Please download ATF Cleaner by Atribune. Double-click ATF-Cleaner.exe to run the program.
Under Main "Select Files to Delete" choose: Select All.
Click the Empty Selected button.
If you use Firefox browserClick Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
If you use Opera browserClick Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
Click Exit on the Main menu to close the program.
For Technical Support, double-click the e-mail address located at the bottom of each menu.

If you are using Firefox and this has caused page loading problems then please clear your private data. To do this go
to the Tools menu, select Clear Private Data, and then check Cache. Click Clear Private Data Now.

Then close Firefox and then reopen it.


Please run a second MBAM scan - this time a quick scan - so that we can confirm that the malware has gone for good.


Next please do an online scan to clean up

I'd like us to scan your machine with ESET OnlineScan
  • Hold down Control and click on the following link to open ESET OnlineScan in a new window.
    ESET OnlineScan
  • Click the Posted Image button.
  • For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
    • Click on Posted Image to download the ESET Smart Installer. Save it to your desktop.
    • Double click on the Posted Image icon on your desktop.
  • Check Posted Image
  • Click the Posted Image button.
  • Accept any security warnings from your browser.
  • Check Posted Image
  • Push the Start button.
  • ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
  • When the scan completes, push Posted Image
  • Push Posted Image, and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
  • Push the Posted Image button.
  • Push Posted Image
Thanks :(
Posted Image
m0le is a proud member of UNITE

#11 Monkeyb00y

Monkeyb00y
  • Topic Starter

  • Members
  • 75 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Behind my eyes...
  • Local time:02:45 AM

Posted 02 November 2009 - 10:21 PM

m0le, Thanks for the help again.

ATF-Cleaner worked on both browsers.

I could not connect the computer to the internet. I have DSL but this computer used Comcast Cable Internet in it's normal setting.
I'm not sure if it's a good idea to try to get it to work or if there is another way to check it. I've tried the conventional ways
to get it connected but no luck. :(

Thanks again,
Monkeyb00y

MBAM Log:
Malwarebytes' Anti-Malware 1.41
Database version: 3030
Windows 5.1.2600 Service Pack 2

11/2/2009 10:00:16 PM
mbam-log-2009-11-02 (22-00-16).txt

Scan type: Quick Scan
Objects scanned: 109699
Time elapsed: 3 minute(s), 58 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

#12 m0le

m0le

    Can U Dig It?


  • Malware Response Team
  • 34,527 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:London, UK
  • Local time:07:45 AM

Posted 02 November 2009 - 10:39 PM

Okay we're not going to hook up any dodgy networks. :(

MBAM is good and Combofix was also clear.

I would like to run some kind of scanner that deals with the lesser malware files so let's run Dr Web Cure-it. The download link to the newest version means it can run without connecting to the internet to update.


Before we start fixing anything you should print out these instructions or copy them to a NotePad file so they will be accessible. Some steps will require you to disconnect from the Internet or use Safe Mode and you will not have access to this page.

Please download DrWeb-CureIt and save it to your desktop. DO NOT perform a scan yet.

Reboot your computer in "Safe Mode" using the F8 method. To do this, restart your computer and after hearing your computer beep once during startup (but before the Windows icon appears) press the F8 key repeatedly. A menu will appear with several options. Use the arrow keys to navigate and select the option to run Windows in "Safe Mode".

Scan with Dr.Web CureIt as follows:
  • Double-click on launch.exe to open the program and click Start. (There is no need to update if you just downloaded the most current version
  • Read the Virus check by DrWeb scanner prompt and click Ok where asked to Start scan now? Allow the setup.exe to load if asked by any of your security programs.
  • The Express scan will automatically begin.
    (This is a short scan of files currently running in memory, boot sectors, and targeted folders).
  • If prompted to dowload the Full version Free Trial, ignore and click the X to close the window.
  • If an infected object is found, you will be prompted to move anything that cannot be cured. Click Yes to All. (This will move any detected files to the C:\Documents and Settings\userprofile\DoctorWeb\Quarantine folder if they can't be cured)
  • After the Express Scan is finished, put a check next to Complete scan to scan all local disks and removable media.
  • In the top menu, click Settings > Change settings, and uncheck "Heuristic analysis" under the "Scanning" tab, then click Apply, Ok.
  • Back at the main window, click the green arrow "Start Scanning" button on the right under the Dr.Web logo.
  • Please be patient as this scan could take a long time to complete.
  • When the scan has finished, a message will be displayed at the bottom indicating if any viruses were found.
  • Click Select All, then choose Cure > Move incurable.
  • In the top menu, click file and choose save report list.
  • Save the DrWeb.csv report to your desktop.
  • Exit Dr.Web Cureit when done.
  • Important! Reboot your computer because it could be possible that files in use will be moved/deleted during reboot.
  • After reboot, post the contents of the log from Dr.Web in your next reply. (You can use Notepad to open the DrWeb.cvs report)
If this is good then we're nearly there :(
Posted Image
m0le is a proud member of UNITE

#13 Monkeyb00y

Monkeyb00y
  • Topic Starter

  • Members
  • 75 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Behind my eyes...
  • Local time:02:45 AM

Posted 03 November 2009 - 02:31 AM

OK, I was running Dr Web Cure It, it got ALL the way through about 3 hours in...
then it crashed... :(
See the picture I attached.
Not sure what to do next...
or should I just rerun it?

Thanks for the help,
Please let me know.
Monkeyb00y

Attached Files



#14 m0le

m0le

    Can U Dig It?


  • Malware Response Team
  • 34,527 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:London, UK
  • Local time:07:45 AM

Posted 03 November 2009 - 09:44 AM

The dz6ahXP.exe file looks malicious and may be interfering with Dr Web.


Let's try and locate it

Please download SystemLook from one of the links below and save it to your Desktop.
Download Mirror #1
Download Mirror #2
  • Double-click SystemLook.exe to run it.
  • Copy the content of the following codebox into the main textfield:
    :filefind
    dz6ahXP.exe
  • Click the Look button to start the scan.
  • When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.
Note: The log can also be found on your Desktop entitled SystemLook.txt

Thanks :(
Posted Image
m0le is a proud member of UNITE

#15 Monkeyb00y

Monkeyb00y
  • Topic Starter

  • Members
  • 75 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Behind my eyes...
  • Local time:02:45 AM

Posted 03 November 2009 - 11:31 PM

Hey m0le,

This thing is being sneaky. I ran SystemLook in normal & safe mode. If you need me to run Dr Web Cure It again in SAFE mode, let me know.

Thanks again!
Monkeyb00y :D

Here is the SystemLook log:

SystemLook v1.0 by jpshortstuff (29.08.09)
Log created at 23:21 on 03/11/2009 by HP_Administrator (Administrator - Elevation successful)

========== filefind ==========

Searching for "dz6ahXP.exe"
No files found.

-=End Of File=-

Edited by Monkeyb00y, 03 November 2009 - 11:31 PM.





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users