Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Infected with Antivirus pro 2010 and More


  • This topic is locked This topic is locked
30 replies to this topic

#1 kmcdonald

kmcdonald

  • Members
  • 37 posts
  • OFFLINE
  •  
  • Local time:03:36 PM

Posted 22 October 2009 - 07:23 PM

I have run Norman_Malware_Cleaner with some results but It will not clean this up.

Originally I was not able to run Task Manager or Regedit, I now can. I haven't changed anything.

Currently I and not run Malwarebytes as the mbam.exe is deleted on install or first run.

I also can not enter safemode, My be unrelated but do not know for sure.

My norman Security Suite is now constantally quarantining W32/Malware.JLGK location is C:\WINDOWS\system32\calc.dll

Other than that the only other seen problem is a hijacked wall paper.

Following are logs.

Thanks for your help


DDS (Ver_09-10-13.01) - NTFSx86
Run by Chad Mothe' at 14:49:17.00 on Thu 10/22/2009
Internet Explorer: 8.0.6001.18702
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.2037.1483 [GMT -7:00]

AV: Norman Security Suite *On-access scanning enabled* (Updated) {EB9EFB40-AE72-4C43-B204-0FCD0E92D5F1}

============== Running Processes ===============

C:\Program Files\Norman\Npm\Bin\Elogsvc.exe
C:\Program Files\Norman\Ngs\Bin\Nprosec.exe
C:\WINDOWS\system32\svchost -k DcomLaunch
C:\WINDOWS\system32\svchost -k rpcss
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\Program Files\Norman\Npm\Bin\Zanda.exe
C:\Program Files\Norman\npm\bin\nvoy.exe
C:\WINDOWS\system32\svchost.exe -k NetworkService
C:\WINDOWS\system32\svchost.exe -k LocalService
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Norman\Npm\Bin\ZLH.EXE
C:\WINDOWS\system32\svchost.exe -k LocalService
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Broadcom\ASFIPMon\AsfIpMon.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\WINDOWS\system32\FastNetSrv.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\PnkBstrB.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Norman\Npm\Bin\scheduler.exe
C:\Program Files\Norman\Npm\Bin\Njeeves.exe
C:\Program Files\Norman\Nse\Bin\NSESVC.EXE
C:\Program Files\Norman\Nvc\Bin\nvcoas.exe
C:\Program Files\Norman\Nvc\Bin\Nip.exe
C:\Program Files\Norman\Nvc\Bin\cclaw.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Chad Mothe'\Desktop\dds.scr
C:\WINDOWS\system32\wbem\wmiprvse.exe

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.google.com/
uSearch Page = hxxp://www.google.com/hws/sb/dell-usuk-rel/en/side.html?channel=us
uSearch Bar = hxxp://www.google.com/hws/sb/dell-usuk-rel/en/side.html?channel=us
uDefault_Page_URL = www.google.com/ig/dell?hl=en&client=dell-usuk-rel&channel=us&ibd=1080123
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uInternet Connection Wizard,ShellNext = hxxp://www.google.com/ig/dell?hl=en&client=dell-usuk-rel&channel=us&ibd=1080123
uInternet Settings,ProxyOverride = *.local
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
mSearchAssistant = hxxp://www.google.com/hws/sb/dell-usuk-rel/en/side.html?channel=us
uURLSearchHooks: N/A: {00a6faf6-072e-44cf-8957-5838f569a31d} - c:\program files\mywebsearch\bar\1.bin\MWSSRCAS.DLL
uURLSearchHooks: Mininova Toolbar: {f592709f-ff4a-4862-b659-4afabda56312} - c:\program files\mininova\tbMini.dll
uURLSearchHooks: The Pirate Bay Toolbar: {a33fa729-d155-4b23-842b-2c665ecabdb6} - c:\program files\the_pirate_bay\tbThe_.dll
BHO: MyWebSearch Search Assistant BHO: {00a6faf1-072e-44cf-8957-5838f569a31d} - c:\program files\mywebsearch\bar\1.bin\MWSSRCAS.DLL
BHO: c:\windows\system32\svs2gkv.dll: {a2234b15-23f2-42ad-f4e4-00aac39c0004} - c:\windows\system32\svs2gkv.dll
TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
TB: My Web Search: {07b18ea9-a523-4961-b6bb-170de4475cca} - c:\program files\mywebsearch\bar\1.bin\MWSBAR.DLL
TB: Mininova Toolbar: {f592709f-ff4a-4862-b659-4afabda56312} - c:\program files\mininova\tbMini.dll
TB: The Pirate Bay Toolbar: {a33fa729-d155-4b23-842b-2c665ecabdb6} - c:\program files\the_pirate_bay\tbThe_.dll
uRun: [calc] rundll32.exe c:\docume~1\chadmo~1\ntuser.dll,_IWMPEvents@0
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe"
mRun: [calc] rundll32.exe c:\windows\system32\calc.dll,_IWMPEvents@0
mRun: [PaperPort PTD] "c:\program files\scansoft\paperport\pptd40nt.exe"
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [SoundMAXPnP] c:\program files\analog devices\core\smax4pnp.exe
mRun: [Norman ZANDA] "c:\program files\norman\npm\bin\ZLH.EXE" /LOAD /SPLASH
mRun: [IndexSearch] "c:\program files\scansoft\paperport\IndexSearch.exe"
mRun: [MSConfig] c:\windows\pchealth\helpctr\binaries\MSConfig.exe /auto
mRun: [Wpazafecufi] rundll32.exe "c:\windows\egolineter.dll",Startup
mRun: [riwozavas] Rundll32.exe "c:\windows\system32\sabafiru.dll",a
mRunOnce: [Malwarebytes' Anti-Malware] c:\program files\malwarebytes' anti-malware\mbamgui.exe /install /silent
dRunOnce: [RunNarrator] Narrator.exe
StartupFolder: c:\docume~1\chadmo~1\startm~1\programs\startup\scandisk.lnk - c:\windows\system32\rundll32.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\d-link~1.lnk - c:\program files\d-link airplus g\AirPlus.exe
uPolicies-explorer: NoSetActiveDesktop = 1 (0x1)
uPolicies-explorer: ForceClassicControlPanel = 1 (0x1)
mPolicies-explorer: NoSetActiveDesktop = 1 (0x1)
IE: &Search - http://edits.mywebsearch.com/toolbaredits/...?p=ZUxdm486WLUS
IE: E&xport to Microsoft Excel - c:\progra~1\micros~3\office12\EXCEL.EXE/3000
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~3\office12\ONBttnIE.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~3\office12\REFIEBAR.DLL
DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - hxxp://ak.exe.imgfarm.com/images/nocache/funwebproducts/ei-4/MyFunCardsInitialSetup1.0.1.1.cab
DPF: {3DCEC959-378A-4922-AD7E-FD5C925D927F} - hxxp://disney.go.com/pirates/online/testActiveX/built/signed/DisneyOnlineGames.cab
DPF: {6C269571-C6D7-4818-BCA4-32A035E8C884} - hxxp://ccfiles.creative.com/Web/softwareupdate/su/ocx/15101/CTSUEng.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_12-windows-i586.cab
DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_12-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_12-windows-i586.cab
DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} - hxxp://ccfiles.creative.com/Web/softwareupdate/su/ocx/15106/CTPID.cab
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\progra~1\micros~3\office12\GR99D3~1.DLL
Notify: igfxcui - igfxdev.dll
AppInit_DLLs: c:\windows\system32\sabafiru.dll,dafamupu.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SSODL: lapiyotul - {0bdd4518-b9da-4506-bde6-cc9d6f562b0f} - c:\windows\system32\nowepeto.dll
SSODL: keyapasef - {ea7070f5-4851-41b1-a273-b94e1a152d33} - c:\windows\system32\nowepeto.dll
SSODL: pazesawof - {3d23c4c9-1f9c-45b2-af4b-81e35c192c1d} - c:\windows\system32\nowepeto.dll
SSODL: darehukip - {cc74517d-708b-42df-a030-c85a52b73eb9} - c:\windows\system32\nowepeto.dll
SSODL: povoguzuf - {1c3b5932-3b89-4a10-a085-e0a9f8ddb399} - c:\windows\system32\nowepeto.dll
SSODL: foyetened - {450e8d12-e412-45c3-b0f3-8f1e45909157} - c:\windows\system32\nowepeto.dll
SSODL: zuyopeniz - {88941f9f-661c-4628-a8c8-25a2450cedd3} - c:\windows\system32\nowepeto.dll
SSODL: vawuwihas - {592ceca5-f8b0-45a9-aea7-de8fb6a0ef58} - c:\windows\system32\nowepeto.dll
SSODL: zijaruvej - {804f6e59-59db-4685-a433-dea2e86ac8c0} - c:\windows\system32\sabafiru.dll
STS: tokatiluy: {0bdd4518-b9da-4506-bde6-cc9d6f562b0f} - c:\windows\system32\nowepeto.dll
STS: mujuzedij: {ea7070f5-4851-41b1-a273-b94e1a152d33} - c:\windows\system32\nowepeto.dll
STS: tokatiluy: {3d23c4c9-1f9c-45b2-af4b-81e35c192c1d} - c:\windows\system32\nowepeto.dll
STS: tokatiluy: {cc74517d-708b-42df-a030-c85a52b73eb9} - c:\windows\system32\nowepeto.dll
STS: jugezatag: {1c3b5932-3b89-4a10-a085-e0a9f8ddb399} - c:\windows\system32\nowepeto.dll
STS: jugezatag: {450e8d12-e412-45c3-b0f3-8f1e45909157} - c:\windows\system32\nowepeto.dll
STS: kupuhivus: {88941f9f-661c-4628-a8c8-25a2450cedd3} - c:\windows\system32\nowepeto.dll
STS: tokatiluy: {592ceca5-f8b0-45a9-aea7-de8fb6a0ef58} - c:\windows\system32\nowepeto.dll
STS: c:\windows\system32\svs2gkv.dll: {a2234b15-23f2-42ad-f4e4-00aac39c0004} - c:\windows\system32\svs2gkv.dll
STS: gahurihor: {804f6e59-59db-4685-a433-dea2e86ac8c0} - c:\windows\system32\sabafiru.dll
SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\progra~1\micros~3\office12\GRA8E1~1.DLL
LSA: Notification Packages = scecli icherdc.dll wunufaku.dll

============= SERVICES / DRIVERS ===============

R1 NGS;Norman General Security Driver;c:\program files\norman\ngs\bin\ngs.sys [2009-2-27 25032]
R1 NPROSEC;Norman Security driver;c:\program files\norman\ngs\bin\nprosec.sys [2009-5-12 56136]
R2 ASFIPmon;Broadcom ASF IP and SMBIOS Mailbox Monitor;c:\program files\broadcom\asfipmon\AsfIpMon.exe [2007-6-20 79168]
R2 fastnetsrv;fastnetsrv Service;c:\windows\system32\FastNetSrv.exe [2004-8-4 94720]
R2 Ndiskio;Ndiskio;c:\program files\norman\nse\bin\Ndiskio.sys [2009-10-15 24168]
R2 NPROSECSVC;Norman Security service;c:\program files\norman\ngs\bin\nprosec.exe [2009-5-12 124232]
R2 NVOY;Norman Resource Provider;c:\program files\norman\npm\bin\nvoy.exe [2009-2-25 128328]
R3 nsesvc;Norman Scanner Engine Service;c:\program files\norman\nse\bin\Nsesvc.exe [2009-10-15 320840]
R3 NvcMFlt;NvcMFlt;c:\windows\system32\drivers\nvcw32mf.sys [2009-2-25 21832]
R3 nvcoas;Norman Virus Control on-access component;c:\program files\norman\nvc\bin\Nvcoas.exe [2009-2-25 197960]
R3 Scheduler;Norman Scheduler Service;c:\program files\norman\npm\bin\scheduler.exe [2009-5-12 132424]
S2 BtwSrv;BtwSrv;c:\windows\system32\svchost.exe -k netsvcs [2004-8-10 14336]
S2 MyWebSearchService;My Web Search Service;c:\progra~1\mywebs~1\bar\1.bin\mwssvc.exe [2009-9-28 28762]
S3 isapeep;isapeep;c:\windows\system32\isapeep.sys [2004-8-10 2304]
S3 NVCScheduler;Norman Virus Control Scheduler;"c:\program files\norman\npm\bin\nvcsched.exe" --> c:\program files\norman\npm\bin\Nvcsched.exe [?]
S3 W8100PCI;D-Link AirPlus G Wireless Driver;c:\windows\system32\drivers\MRV8K51.sys [2008-1-31 297984]

=============== Created Last 30 ================

2009-10-22 14:32 25,600 a--sh--- c:\windows\system32\calc.dll
2009-10-22 13:30 38,224 a------- c:\windows\system32\drivers\mbamswissarmy.sys
2009-10-22 13:30 19,160 a------- c:\windows\system32\drivers\mbam.sys
2009-10-22 13:30 <DIR> --d----- c:\program files\Malwarebytes' Anti-Malware
2009-10-22 09:49 <DIR> --d----- C:\!KillBox
2009-10-21 21:19 <DIR> --d----- C:\_OTM
2009-10-21 19:50 <DIR> --d----- c:\windows\pss
2009-10-21 19:48 19,942 a------- c:\windows\system32\ywyqoluka.bat
2009-10-21 19:48 19,708 a------- c:\docume~1\chadmo~1\applic~1\sefodo.com
2009-10-21 19:48 17,730 a------- c:\windows\system32\afebinepi.bin
2009-10-21 19:48 17,154 a------- c:\windows\bibegaj._dl
2009-10-21 19:48 16,487 a------- c:\windows\system32\yramog.scr
2009-10-21 19:48 16,479 a------- c:\program files\common files\faqor.bat
2009-10-21 19:48 15,716 a------- c:\program files\common files\dycyleqobi.reg
2009-10-21 19:48 15,323 a------- c:\windows\mury.dat
2009-10-21 19:48 15,316 a------- c:\windows\hutipinu.ban
2009-10-21 19:48 14,528 a------- c:\docume~1\chadmo~1\applic~1\vihi.vbs
2009-10-21 19:48 14,176 a------- c:\windows\system32\ezihajalef.bin
2009-10-21 19:48 13,264 a------- c:\windows\ujyhokex.exe
2009-10-21 19:48 12,099 a------- c:\docume~1\chadmo~1\applic~1\ygeka.sys
2009-10-21 19:48 11,718 a------- c:\windows\vuju.dl
2009-10-20 18:13 <DIR> --d----- c:\docume~1\chadmo~1\applic~1\Malwarebytes
2009-10-20 18:13 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Malwarebytes
2009-10-20 18:11 0 a------- c:\windows\system32\AVR09.exe
2009-10-20 06:48 <DIR> --d----- c:\docume~1\alluse~1\applic~1\tipiyipo
2009-10-20 06:48 <DIR> --d----- c:\docume~1\alluse~1\applic~1\sajekeye
2009-10-20 06:48 <DIR> --d----- c:\docume~1\alluse~1\applic~1\lamisefi
2009-10-19 14:44 <DIR> --d----- c:\docume~1\alluse~1\applic~1\yidurufo
2009-10-19 14:44 <DIR> --d----- c:\docume~1\alluse~1\applic~1\sufetida
2009-10-19 14:44 <DIR> --d----- c:\docume~1\alluse~1\applic~1\sofapohe
2009-10-18 19:40 <DIR> --d----- c:\docume~1\alluse~1\applic~1\sozejudu
2009-10-18 19:40 <DIR> --d----- c:\docume~1\alluse~1\applic~1\dujiyera
2009-10-18 19:40 <DIR> --d----- c:\docume~1\alluse~1\applic~1\dofakase
2009-10-17 13:55 19,791 a------- c:\program files\common files\hexyji.scr
2009-10-17 13:55 17,331 a------- c:\windows\requxahoko.ban
2009-10-17 13:55 16,299 a------- c:\docume~1\alluse~1\applic~1\qefeke.scr
2009-10-17 13:55 15,579 a------- c:\windows\system32\ujykoki.com
2009-10-17 13:55 15,285 a------- c:\program files\common files\qisymyxej.bin
2009-10-17 13:55 15,233 a------- c:\docume~1\chadmo~1\applic~1\owylyby.scr
2009-10-17 13:55 15,089 a------- c:\windows\zowobenom.scr
2009-10-17 13:55 14,508 a------- c:\windows\datafudu.sys
2009-10-17 13:55 13,416 a------- c:\windows\lozeh.dl
2009-10-17 13:55 13,073 a------- c:\windows\system32\alumo._sy
2009-10-17 13:55 12,619 a------- c:\windows\ebigud.vbs
2009-10-17 13:55 11,828 a------- c:\docume~1\chadmo~1\applic~1\elocakuja.com
2009-10-17 13:42 664 a------- c:\windows\system32\d3d9caps.dat
2009-10-17 13:09 18,901 a------- c:\docume~1\chadmo~1\applic~1\getami.vbs
2009-10-17 13:09 18,079 a------- c:\windows\system32\iqigadiz.bin
2009-10-17 13:09 15,019 a------- c:\windows\system32\obajudyc.inf
2009-10-17 13:09 12,732 a------- c:\windows\yhuqu.exe
2009-10-17 13:08 19,468 a------- c:\docume~1\alluse~1\applic~1\quta.dll
2009-10-17 13:08 19,108 a------- c:\windows\lolafaky._sy
2009-10-17 13:08 17,632 a------- c:\windows\suzydana.ban
2009-10-17 13:08 16,931 a------- c:\program files\common files\paquzixu.vbs
2009-10-17 13:08 13,562 a------- c:\windows\system32\ogucex.db
2009-10-17 13:08 13,030 a------- c:\windows\olume.vbs
2009-10-17 13:08 10,974 a------- c:\windows\system32\rojimemu.reg
2009-10-17 13:05 120 a------- c:\windows\Lmaleqe.dat
2009-10-17 13:05 0 a------- c:\windows\Cpime.bin
2009-10-17 13:01 0 a------- c:\windows\system32\winhelper.dll
2009-10-17 13:01 49,152 a------- C:\bqefoh.exe
2009-10-17 13:01 25,600 a--sh--- c:\documents and settings\chad mothe'\ntuser.dll
2009-10-17 13:01 831 a------- c:\windows\system32\critical_warning.html
2009-10-04 10:20 <DIR> --d----- c:\program files\Coupons
2009-10-03 08:10 <DIR> --d----- c:\program files\The_Pirate_Bay
2009-10-01 21:33 1,089,593 -------- c:\windows\system32\dllcache\ntprint.cat
2009-10-01 03:02 <DIR> --d----- c:\windows\system32\XPSViewer
2009-10-01 03:02 <DIR> --d----- C:\48ebf4ec2836341a98
2009-10-01 03:02 1,676,288 -------- c:\windows\system32\xpssvcs.dll
2009-10-01 03:02 1,676,288 -------- c:\windows\system32\dllcache\xpssvcs.dll
2009-10-01 03:02 597,504 -------- c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2009-10-01 03:02 575,488 -------- c:\windows\system32\xpsshhdr.dll
2009-10-01 03:02 575,488 -------- c:\windows\system32\dllcache\xpsshhdr.dll
2009-10-01 03:02 117,760 -------- c:\windows\system32\prntvpt.dll
2009-10-01 03:02 89,088 -------- c:\windows\system32\dllcache\filterpipelineprintproc.dll
2009-09-30 17:47 <DIR> --d----- c:\docume~1\chadmo~1\applic~1\uTorrent
2009-09-28 19:51 <DIR> --d----- c:\docume~1\chadmo~1\applic~1\DriverCure
2009-09-28 19:51 <DIR> --d----- c:\program files\common files\ParetoLogic
2009-09-28 19:51 <DIR> --d----- c:\docume~1\alluse~1\applic~1\ParetoLogic
2009-09-28 19:51 <DIR> --d----- c:\docume~1\alluse~1\applic~1\DriverCure
2009-09-28 19:38 <DIR> --d----- c:\program files\Mininova
2009-09-28 19:38 <DIR> --d----- c:\program files\Conduit
2009-09-28 17:59 28,672 a------- c:\windows\system32\f3PSSavr.scr
2009-09-28 17:59 <DIR> --d----- c:\program files\MyWebSearch
2009-09-28 17:58 <DIR> --d----- c:\program files\FunWebProducts

==================== Find3M ====================

2009-10-17 13:55 19,931 a------- c:\program files\common files\nutiba.inf
2009-10-17 13:08 19,243 a------- c:\program files\common files\verovahy.db
2009-10-17 13:08 14,395 a------- c:\program files\common files\raloleku.ban
2009-10-08 03:59 21,832 a------- c:\windows\system32\drivers\nvcw32mf.sys
2009-10-07 05:07 214,344 a------- c:\windows\system32\nscrnsav.scr
2009-09-11 07:18 136,192 a------- c:\windows\system32\msv1_0.dll
2009-09-11 07:18 136,192 -------- c:\windows\system32\dllcache\msv1_0.dll
2009-09-04 14:03 58,880 a------- c:\windows\system32\msasn1.dll
2009-09-04 14:03 58,880 -------- c:\windows\system32\dllcache\msasn1.dll
2009-08-28 03:35 173,056 a------- c:\windows\system32\dllcache\ie4uinit.exe
2009-08-26 01:00 247,326 a------- c:\windows\system32\strmdll.dll
2009-08-26 01:00 247,326 -------- c:\windows\system32\dllcache\strmdll.dll
2009-08-06 19:24 327,896 a------- c:\windows\system32\dllcache\wucltui.dll
2009-08-06 19:24 209,632 a------- c:\windows\system32\dllcache\wuweb.dll
2009-08-06 19:24 35,552 a------- c:\windows\system32\dllcache\wups.dll
2009-08-06 19:24 53,472 a------- c:\windows\system32\dllcache\wuauclt.exe
2009-08-06 19:24 96,480 a------- c:\windows\system32\dllcache\cdm.dll
2009-08-06 19:23 575,704 a------- c:\windows\system32\dllcache\wuapi.dll
2009-08-06 19:23 1,929,952 a------- c:\windows\system32\dllcache\wuaueng.dll
2009-08-05 02:01 204,800 a------- c:\windows\system32\mswebdvd.dll
2009-08-05 02:01 204,800 -------- c:\windows\system32\dllcache\mswebdvd.dll
2009-08-04 20:44 2,189,184 -------- c:\windows\system32\dllcache\ntoskrnl.exe
2009-08-04 08:13 2,145,280 a------- c:\windows\system32\ntoskrnl.exe
2009-08-04 08:13 2,145,280 -------- c:\windows\system32\dllcache\ntkrnlmp.exe
2009-08-04 07:20 2,023,936 a------- c:\windows\system32\ntkrnlpa.exe
2009-08-04 07:20 2,023,936 -------- c:\windows\system32\dllcache\ntkrpamp.exe
2009-08-04 07:20 2,066,048 -------- c:\windows\system32\dllcache\ntkrnlpa.exe
2009-02-27 16:53 22,328 a------- c:\docume~1\chadmo~1\applic~1\PnkBstrK.sys
2009-07-22 14:28 54,272 a--sh--- c:\windows\system32\dafamupu.dll
2009-07-22 14:27 1,011,707 a--sh--- c:\windows\system32\fivajubu.exe
2009-07-22 14:28 54,272 a--sh--- c:\windows\system32\gerizoha.dll
2009-07-17 13:06 39,424 a--sh--- c:\windows\system32\hahonuhe.dll
2009-07-18 07:40 39,424 a--sh--- c:\windows\system32\jogopamo.dll
2009-07-18 07:40 54,272 a--sh--- c:\windows\system32\pihuyeha.dll
2009-07-22 14:27 91,648 a--sh--- c:\windows\system32\sabafiru.dll
2009-07-17 13:06 90,624 a--sh--- c:\windows\system32\soziredo.dll
2009-07-22 14:28 54,272 a--sh--- c:\windows\system32\wunufaku.dll
2009-07-22 14:27 54,272 a--sh--- c:\windows\system32\yadihoni.dll
2009-07-17 13:06 1,108,871 a--sh--- c:\windows\system32\yeweduwo.exe
2009-07-22 14:27 39,424 a--sh--- c:\windows\system32\yuyobiso.dll
2008-10-12 09:07 32,768 a--sh--- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012008101220081013\index.dat

============= FINISH: 14:50:25.98 ===============

Attached Files



BC AdBot (Login to Remove)

 


#2 Blade81

Blade81

    Bleepin' Rocker


  • Malware Response Team
  • 6,465 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Finland
  • Local time:01:36 AM

Posted 30 October 2009 - 02:04 AM

Hi,

Sorry for delayed response. Forums have been really busy. If you still need help with this post fresh dds log, please.

Microsoft Windows Insider MVP 2016-2017

Microsoft MVP Consumer Security 2008-2015
UNITE member since 2006
unite_blue.png

Provided malware removal related instructions are meant to be used in the correspondent user's case only. If you have similar symptoms create own topic instead of following instructions given to some other, please.


#3 kmcdonald

kmcdonald
  • Topic Starter

  • Members
  • 37 posts
  • OFFLINE
  •  
  • Local time:03:36 PM

Posted 02 November 2009 - 07:42 PM

Thanks for the response, I'm ok with the delay, I will not be able to respond with the new dds log until Wednesday or Thursday this week, please do not close this, I still need help.

Thanks
Ken

#4 Blade81

Blade81

    Bleepin' Rocker


  • Malware Response Team
  • 6,465 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Finland
  • Local time:01:36 AM

Posted 03 November 2009 - 01:42 AM

Ok. Thanks for the heads up :(

Microsoft Windows Insider MVP 2016-2017

Microsoft MVP Consumer Security 2008-2015
UNITE member since 2006
unite_blue.png

Provided malware removal related instructions are meant to be used in the correspondent user's case only. If you have similar symptoms create own topic instead of following instructions given to some other, please.


#5 kmcdonald

kmcdonald
  • Topic Starter

  • Members
  • 37 posts
  • OFFLINE
  •  
  • Local time:03:36 PM

Posted 06 November 2009 - 12:02 AM

Thanks for waiting for me, here is the DDS report and attached files.


DDS (Ver_09-10-26.01) - NTFSx86
Run by Chad Mothe' at 20:51:34.67 on Thu 11/05/2009
Internet Explorer: 8.0.6001.18702
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.2037.1448 [GMT -8:00]

AV: Norman Security Suite *On-access scanning enabled* (Updated) {EB9EFB40-AE72-4C43-B204-0FCD0E92D5F1}

============== Running Processes ===============

C:\Program Files\Norman\Npm\Bin\Elogsvc.exe
C:\Program Files\Norman\Ngs\Bin\Nprosec.exe
C:\WINDOWS\system32\svchost -k DcomLaunch
C:\WINDOWS\system32\svchost -k rpcss
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\Program Files\Norman\Npm\Bin\Zanda.exe
C:\Program Files\Norman\npm\bin\nvoy.exe
C:\WINDOWS\system32\svchost.exe -k NetworkService
C:\WINDOWS\system32\svchost.exe -k LocalService
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\svchost.exe -k LocalService
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Broadcom\ASFIPMon\AsfIpMon.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\PnkBstrB.exe
C:\Program Files\Norman\Npm\Bin\scheduler.exe
C:\Program Files\Norman\Npm\Bin\Njeeves.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Norman\Nse\Bin\NSESVC.EXE
C:\Program Files\Norman\Nvc\Bin\nvcoas.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wmdtc.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Norman\Npm\Bin\ZLH.EXE
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Norman\Nvc\Bin\Nip.exe
C:\Program Files\Norman\Nvc\Bin\cclaw.exe
C:\WINDOWS\system32\svchost.exe -k netsvcs
C:\WINDOWS\system32\FastNetSrv.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Chad Mothe'\Local Settings\Temporary Internet Files\Content.IE5\QPL9JGQY\dds[1].scr
C:\WINDOWS\system32\lsm32.sys
C:\WINDOWS\system32\wbem\wmiprvse.exe

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.google.com/
uSearch Page = hxxp://www.google.com/hws/sb/dell-usuk-rel/en/side.html?channel=us
uSearch Bar = hxxp://www.google.com/hws/sb/dell-usuk-rel/en/side.html?channel=us
uDefault_Page_URL = www.google.com/ig/dell?hl=en&client=dell-usuk-rel&channel=us&ibd=1080123
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uInternet Connection Wizard,ShellNext = hxxp://www.google.com/ig/dell?hl=en&client=dell-usuk-rel&channel=us&ibd=1080123
uInternet Settings,ProxyOverride = *.local
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
mSearchAssistant = hxxp://www.google.com/hws/sb/dell-usuk-rel/en/side.html?channel=us
uURLSearchHooks: N/A: {00a6faf6-072e-44cf-8957-5838f569a31d} - c:\program files\mywebsearch\bar\1.bin\MWSSRCAS.DLL
uURLSearchHooks: Mininova Toolbar: {f592709f-ff4a-4862-b659-4afabda56312} - c:\program files\mininova\tbMini.dll
uURLSearchHooks: The Pirate Bay Toolbar: {a33fa729-d155-4b23-842b-2c665ecabdb6} - c:\program files\the_pirate_bay\tbThe_.dll
mURLSearchHooks: N/A: {00a6faf6-072e-44cf-8957-5838f569a31d} - c:\program files\mywebsearch\bar\1.bin\MWSSRCAS.DLL
BHO: MyWebSearch Search Assistant BHO: {00a6faf1-072e-44cf-8957-5838f569a31d} - c:\program files\mywebsearch\bar\1.bin\MWSSRCAS.DLL
BHO: {769ee983-2fee-45c3-a35a-71b693e086d1} - dahovibo.dll
BHO: c:\windows\system32\svs2gkv.dll: {a2234b15-23f2-42ad-f4e4-00aac39c0004} - c:\windows\system32\svs2gkv.dll
TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
TB: My Web Search: {07b18ea9-a523-4961-b6bb-170de4475cca} - c:\program files\mywebsearch\bar\1.bin\MWSBAR.DLL
TB: Mininova Toolbar: {f592709f-ff4a-4862-b659-4afabda56312} - c:\program files\mininova\tbMini.dll
TB: The Pirate Bay Toolbar: {a33fa729-d155-4b23-842b-2c665ecabdb6} - c:\program files\the_pirate_bay\tbThe_.dll
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe"
mRun: [MSConfig] c:\windows\pchealth\helpctr\binaries\MSConfig.exe /auto
mRun: [Wpazafecufi] rundll32.exe "c:\windows\egolineter.dll",Startup
mRun: [Norman ZANDA] "c:\program files\norman\npm\bin\ZLH.EXE" /LOAD /SPLASH
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [roviyefamu] Rundll32.exe "fayivani.dll",s
mRun: [riwozavas] Rundll32.exe "c:\docume~1\alluse~1\applic~1\galubanu\galubanu.dll",a
dRunOnce: [RunNarrator] Narrator.exe
uPolicies-explorer: NoSetActiveDesktop = 1 (0x1)
uPolicies-explorer: ForceClassicControlPanel = 1 (0x1)
mPolicies-explorer: NoSetActiveDesktop = 1 (0x1)
IE: &Search - http://edits.mywebsearch.com/toolbaredits/...?p=ZUxdm486WLUS
IE: E&xport to Microsoft Excel - c:\progra~1\micros~3\office12\EXCEL.EXE/3000
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~3\office12\ONBttnIE.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~3\office12\REFIEBAR.DLL
DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - hxxp://ak.exe.imgfarm.com/images/nocache/funwebproducts/ei-4/MyFunCardsInitialSetup1.0.1.1.cab
DPF: {3DCEC959-378A-4922-AD7E-FD5C925D927F} - hxxp://disney.go.com/pirates/online/testActiveX/built/signed/DisneyOnlineGames.cab
DPF: {6C269571-C6D7-4818-BCA4-32A035E8C884} - hxxp://ccfiles.creative.com/Web/softwareupdate/su/ocx/15101/CTSUEng.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_12-windows-i586.cab
DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_12-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_12-windows-i586.cab
DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} - hxxp://ccfiles.creative.com/Web/softwareupdate/su/ocx/15106/CTPID.cab
TCP: {3612423A-4E35-4EAF-918F-128B05C439B2} = 77.74.48.113
TCP: {EB562B6A-751A-484E-8E7D-5623157607B0} = 77.74.48.113
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\progra~1\micros~3\office12\GR99D3~1.DLL
Notify: igfxcui - igfxdev.dll
AppInit_DLLs: gezokije.dll c:\docume~1\alluse~1\applic~1\galubanu\galubanu.dll c:\windows\system32\fuwoduke.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SSODL: lapiyotul - {0bdd4518-b9da-4506-bde6-cc9d6f562b0f} - c:\windows\system32\nowepeto.dll
SSODL: keyapasef - {ea7070f5-4851-41b1-a273-b94e1a152d33} - c:\windows\system32\nowepeto.dll
SSODL: pazesawof - {3d23c4c9-1f9c-45b2-af4b-81e35c192c1d} - c:\windows\system32\nowepeto.dll
SSODL: darehukip - {cc74517d-708b-42df-a030-c85a52b73eb9} - c:\windows\system32\nowepeto.dll
SSODL: povoguzuf - {1c3b5932-3b89-4a10-a085-e0a9f8ddb399} - c:\windows\system32\nowepeto.dll
SSODL: foyetened - {450e8d12-e412-45c3-b0f3-8f1e45909157} - c:\windows\system32\nowepeto.dll
SSODL: zuyopeniz - {88941f9f-661c-4628-a8c8-25a2450cedd3} - c:\windows\system32\nowepeto.dll
SSODL: vawuwihas - {592ceca5-f8b0-45a9-aea7-de8fb6a0ef58} - c:\windows\system32\nowepeto.dll
SSODL: kusadiguy - {93344bf4-114e-4ec1-b79d-8b807eced240} - No File
SSODL: rekobohin - {6b377db4-0a2d-473a-9162-b7c3cd10b6b8} - No File
SSODL: duyedafim - {cd2fd4bc-580a-4367-b280-8848900764eb} - No File
SSODL: vabinufit - {2254bf06-78fe-4c76-8133-c635eb02d871} - c:\docume~1\alluse~1\applic~1\galubanu\galubanu.dll
STS: tokatiluy: {0bdd4518-b9da-4506-bde6-cc9d6f562b0f} - c:\windows\system32\nowepeto.dll
STS: mujuzedij: {ea7070f5-4851-41b1-a273-b94e1a152d33} - c:\windows\system32\nowepeto.dll
STS: tokatiluy: {3d23c4c9-1f9c-45b2-af4b-81e35c192c1d} - c:\windows\system32\nowepeto.dll
STS: tokatiluy: {cc74517d-708b-42df-a030-c85a52b73eb9} - c:\windows\system32\nowepeto.dll
STS: jugezatag: {1c3b5932-3b89-4a10-a085-e0a9f8ddb399} - c:\windows\system32\nowepeto.dll
STS: jugezatag: {450e8d12-e412-45c3-b0f3-8f1e45909157} - c:\windows\system32\nowepeto.dll
STS: kupuhivus: {88941f9f-661c-4628-a8c8-25a2450cedd3} - c:\windows\system32\nowepeto.dll
STS: tokatiluy: {592ceca5-f8b0-45a9-aea7-de8fb6a0ef58} - c:\windows\system32\nowepeto.dll
STS: c:\windows\system32\svs2gkv.dll: {a2234b15-23f2-42ad-f4e4-00aac39c0004} - c:\windows\system32\svs2gkv.dll
STS: {93344bf4-114e-4ec1-b79d-8b807eced240} - No File
STS: {6b377db4-0a2d-473a-9162-b7c3cd10b6b8} - No File
STS: {cd2fd4bc-580a-4367-b280-8848900764eb} - No File
STS: tokatiluy: {2254bf06-78fe-4c76-8133-c635eb02d871} - c:\docume~1\alluse~1\applic~1\galubanu\galubanu.dll
SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\progra~1\micros~3\office12\GRA8E1~1.DLL
LSA: Notification Packages = scecli icherdc.dll fayivani.dll

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\chadmo~1\applic~1\mozilla\firefox\profiles\xuyqsw5x.default\
FF - plugin: c:\documents and settings\all users\application data\nexonus\ngm\npNxGameUS.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\
FF - HiddenExtension: XULRunner: {C3713728-3F90-4064-8DE3-5BBF0EEDB025} - c:\documents and settings\chad mothe'\local settings\application data\{C3713728-3F90-4064-8DE3-5BBF0EEDB025}

============= SERVICES / DRIVERS ===============

R1 NGS;Norman General Security Driver;c:\program files\norman\ngs\bin\ngs.sys [2009-2-27 25032]
R1 NPROSEC;Norman Security driver;c:\program files\norman\ngs\bin\nprosec.sys [2009-5-12 56136]
R2 ASFIPmon;Broadcom ASF IP and SMBIOS Mailbox Monitor;c:\program files\broadcom\asfipmon\AsfIpMon.exe [2007-6-20 79168]
R2 BtwSrv;BtwSrv;c:\windows\system32\svchost.exe -k netsvcs [2004-8-10 14336]
R2 fastnetsrv;fastnetsrv Service;c:\windows\system32\FastNetSrv.exe [2004-8-4 47104]
R2 Ndiskio;Ndiskio;c:\program files\norman\nse\bin\Ndiskio.sys [2009-10-15 24168]
R2 NPROSECSVC;Norman Security service;c:\program files\norman\ngs\bin\nprosec.exe [2009-5-12 124232]
R2 NVOY;Norman Resource Provider;c:\program files\norman\npm\bin\nvoy.exe [2009-2-25 128328]
R3 nsesvc;Norman Scanner Engine Service;c:\program files\norman\nse\bin\Nsesvc.exe [2009-10-15 320840]
R3 NvcMFlt;NvcMFlt;c:\windows\system32\drivers\nvcw32mf.sys [2009-2-25 21832]
R3 nvcoas;Norman Virus Control on-access component;c:\program files\norman\nvc\bin\Nvcoas.exe [2009-2-25 197960]
R3 Scheduler;Norman Scheduler Service;c:\program files\norman\npm\bin\scheduler.exe [2009-5-12 132424]
S2 MyWebSearchService;My Web Search Service;c:\progra~1\mywebs~1\bar\1.bin\mwssvc.exe [2009-9-28 28762]
S3 isapeep;isapeep;c:\windows\system32\isapeep.sys [2004-8-10 2304]
S3 NVCScheduler;Norman Virus Control Scheduler;"c:\program files\norman\npm\bin\nvcsched.exe" --> c:\program files\norman\npm\bin\Nvcsched.exe [?]
S3 W8100PCI;D-Link AirPlus G Wireless Driver;c:\windows\system32\drivers\MRV8K51.sys [2008-1-31 297984]

=============== Created Last 30 ================

2009-11-06 04:44:38 92160 --sh--w- c:\windows\system32\fuwoduke.dll
2009-11-06 04:44:38 39424 --sh--w- c:\windows\system32\vakumene.dll
2009-11-05 14:18:48 0 d-----w- c:\docume~1\alluse~1\applic~1\korulawa
2009-11-05 14:18:48 0 d-----w- c:\docume~1\alluse~1\applic~1\galubanu
2009-11-05 14:18:47 0 d-----w- c:\docume~1\alluse~1\applic~1\zabeyuse
2009-11-05 02:18:42 0 d-----w- c:\docume~1\alluse~1\applic~1\sakadadu
2009-11-05 02:18:41 0 d-----w- c:\docume~1\alluse~1\applic~1\sijureha
2009-11-05 02:18:41 0 d-----w- c:\docume~1\alluse~1\applic~1\damozibu
2009-11-04 14:18:32 0 d-----w- c:\docume~1\alluse~1\applic~1\zufanazu
2009-11-04 14:18:31 0 d-----w- c:\docume~1\alluse~1\applic~1\lojelumo
2009-11-04 14:18:31 0 d-----w- c:\docume~1\alluse~1\applic~1\kufasoki
2009-11-04 02:18:17 0 d-----w- c:\docume~1\alluse~1\applic~1\kizuwihe
2009-11-04 02:18:16 0 d-----w- c:\docume~1\alluse~1\applic~1\sadapeso
2009-11-04 02:18:16 0 d-----w- c:\docume~1\alluse~1\applic~1\redekere
2009-11-03 14:18:09 0 d-----w- c:\docume~1\alluse~1\applic~1\yenawuju
2009-11-03 14:18:06 0 d-----w- c:\docume~1\alluse~1\applic~1\jodafoli
2009-11-03 02:18:04 0 d-----w- c:\docume~1\alluse~1\applic~1\zokohito
2009-11-03 02:18:04 0 d-----w- c:\docume~1\alluse~1\applic~1\tulozuru
2009-11-02 14:17:58 0 d-----w- c:\docume~1\alluse~1\applic~1\tarowata
2009-11-02 14:17:58 0 d-----w- c:\docume~1\alluse~1\applic~1\kefunuya
2009-11-02 02:17:48 0 d-----w- c:\docume~1\alluse~1\applic~1\kezahopi
2009-11-02 02:17:44 0 d-----w- c:\docume~1\alluse~1\applic~1\vipukuna
2009-11-01 14:17:29 0 d-----w- c:\docume~1\alluse~1\applic~1\tekugusa
2009-11-01 14:17:29 0 d-----w- c:\docume~1\alluse~1\applic~1\tavufugo
2009-11-01 02:17:26 0 d-----w- c:\docume~1\alluse~1\applic~1\zuniramo
2009-11-01 02:17:26 0 d-----w- c:\docume~1\alluse~1\applic~1\medujiho
2009-10-31 14:17:22 0 d-----w- c:\docume~1\alluse~1\applic~1\kemuvude
2009-10-31 14:17:22 0 d-----w- c:\docume~1\alluse~1\applic~1\fuyopeyu
2009-10-31 02:17:20 0 d-----w- c:\docume~1\alluse~1\applic~1\kovovaga
2009-10-31 02:17:20 0 d-----w- c:\docume~1\alluse~1\applic~1\bamigano
2009-10-30 14:16:55 0 d-----w- c:\docume~1\alluse~1\applic~1\ziyosije
2009-10-30 14:16:55 0 d-----w- c:\docume~1\alluse~1\applic~1\wuhesiba
2009-10-30 14:16:55 0 d-----w- c:\docume~1\alluse~1\applic~1\wiyerane
2009-10-30 02:16:38 0 d-----w- c:\docume~1\alluse~1\applic~1\sulobugu
2009-10-30 02:16:38 0 d-----w- c:\docume~1\alluse~1\applic~1\sawatuka
2009-10-30 02:16:38 0 d-----w- c:\docume~1\alluse~1\applic~1\hivelegi
2009-10-29 14:16:35 0 d-----w- c:\docume~1\alluse~1\applic~1\yojojara
2009-10-29 14:16:35 0 d-----w- c:\docume~1\alluse~1\applic~1\yizinama
2009-10-29 14:16:35 0 d-----w- c:\docume~1\alluse~1\applic~1\tiziyonu
2009-10-29 02:16:32 0 d-----w- c:\docume~1\alluse~1\applic~1\yazadule
2009-10-29 02:16:32 0 d-----w- c:\docume~1\alluse~1\applic~1\sofeposu
2009-10-28 14:16:26 0 d-----w- c:\docume~1\alluse~1\applic~1\rujuhiva
2009-10-28 14:16:26 0 d-----w- c:\docume~1\alluse~1\applic~1\hasolawo
2009-10-28 14:16:26 0 d-----w- c:\docume~1\alluse~1\applic~1\dusivuje
2009-10-27 04:53:29 2713 --sh--w- c:\windows\system32\vilijazi.exe
2009-10-26 10:52:38 2713 --sh--w- c:\windows\system32\porihimi.exe
2009-10-25 16:51:48 2713 --sh--w- c:\windows\system32\wubedige.exe
2009-10-22 21:58:21 0 --sha-w- c:\documents and settings\chad mothe'\ntuser.dll
2009-10-22 16:49:06 0 d-----w- C:\!KillBox
2009-10-22 04:19:07 0 d-----w- C:\_OTM
2009-10-22 02:50:06 0 d-----w- c:\windows\pss
2009-10-22 02:48:24 19942 ----a-w- c:\windows\system32\ywyqoluka.bat
2009-10-22 02:48:24 19708 ----a-w- c:\docume~1\chadmo~1\applic~1\sefodo.com
2009-10-22 02:48:24 17730 ----a-w- c:\windows\system32\afebinepi.bin
2009-10-22 02:48:24 17154 ----a-w- c:\windows\bibegaj._dl
2009-10-22 02:48:24 16487 ----a-w- c:\windows\system32\yramog.scr
2009-10-22 02:48:24 16479 ----a-w- c:\program files\common files\faqor.bat
2009-10-22 02:48:24 15716 ----a-w- c:\program files\common files\dycyleqobi.reg
2009-10-22 02:48:24 15323 ----a-w- c:\windows\mury.dat
2009-10-22 02:48:24 15316 ----a-w- c:\windows\hutipinu.ban
2009-10-22 02:48:24 14528 ----a-w- c:\docume~1\chadmo~1\applic~1\vihi.vbs
2009-10-22 02:48:24 14176 ----a-w- c:\windows\system32\ezihajalef.bin
2009-10-22 02:48:24 13264 ----a-w- c:\windows\ujyhokex.exe
2009-10-22 02:48:24 12099 ----a-w- c:\docume~1\chadmo~1\applic~1\ygeka.sys
2009-10-22 02:48:24 11718 ----a-w- c:\windows\vuju.dl
2009-10-21 01:13:17 0 d-----w- c:\docume~1\chadmo~1\applic~1\Malwarebytes
2009-10-21 01:13:10 0 d-----w- c:\docume~1\alluse~1\applic~1\Malwarebytes
2009-10-21 01:11:15 0 ----a-w- c:\windows\system32\AVR09.exe
2009-10-20 13:48:41 0 d-----w- c:\docume~1\alluse~1\applic~1\tipiyipo
2009-10-20 13:48:41 0 d-----w- c:\docume~1\alluse~1\applic~1\sajekeye
2009-10-20 13:48:41 0 d-----w- c:\docume~1\alluse~1\applic~1\lamisefi
2009-10-19 21:44:55 0 d-----w- c:\docume~1\alluse~1\applic~1\yidurufo
2009-10-19 21:44:55 0 d-----w- c:\docume~1\alluse~1\applic~1\sufetida
2009-10-19 21:44:55 0 d-----w- c:\docume~1\alluse~1\applic~1\sofapohe
2009-10-19 02:40:48 0 d-----w- c:\docume~1\alluse~1\applic~1\sozejudu
2009-10-19 02:40:48 0 d-----w- c:\docume~1\alluse~1\applic~1\dujiyera
2009-10-19 02:40:48 0 d-----w- c:\docume~1\alluse~1\applic~1\dofakase
2009-10-17 20:55:45 19791 ----a-w- c:\program files\common files\hexyji.scr
2009-10-17 20:55:45 17331 ----a-w- c:\windows\requxahoko.ban
2009-10-17 20:55:45 16299 ----a-w- c:\docume~1\alluse~1\applic~1\qefeke.scr
2009-10-17 20:55:45 15579 ----a-w- c:\windows\system32\ujykoki.com
2009-10-17 20:55:45 15285 ----a-w- c:\program files\common files\qisymyxej.bin
2009-10-17 20:55:45 15233 ----a-w- c:\docume~1\chadmo~1\applic~1\owylyby.scr
2009-10-17 20:55:45 15089 ----a-w- c:\windows\zowobenom.scr
2009-10-17 20:55:45 14508 ----a-w- c:\windows\datafudu.sys
2009-10-17 20:55:45 13416 ----a-w- c:\windows\lozeh.dl
2009-10-17 20:55:45 13073 ----a-w- c:\windows\system32\alumo._sy
2009-10-17 20:55:45 12619 ----a-w- c:\windows\ebigud.vbs
2009-10-17 20:55:45 11828 ----a-w- c:\docume~1\chadmo~1\applic~1\elocakuja.com
2009-10-17 20:42:50 664 ----a-w- c:\windows\system32\d3d9caps.dat
2009-10-17 20:09:00 18901 ----a-w- c:\docume~1\chadmo~1\applic~1\getami.vbs
2009-10-17 20:09:00 18079 ----a-w- c:\windows\system32\iqigadiz.bin
2009-10-17 20:09:00 15019 ----a-w- c:\windows\system32\obajudyc.inf
2009-10-17 20:09:00 12732 ----a-w- c:\windows\yhuqu.exe
2009-10-17 20:08:59 19468 ----a-w- c:\docume~1\alluse~1\applic~1\quta.dll
2009-10-17 20:08:59 19108 ----a-w- c:\windows\lolafaky._sy
2009-10-17 20:08:59 17632 ----a-w- c:\windows\suzydana.ban
2009-10-17 20:08:59 16931 ----a-w- c:\program files\common files\paquzixu.vbs
2009-10-17 20:08:59 13562 ----a-w- c:\windows\system32\ogucex.db
2009-10-17 20:08:59 13030 ----a-w- c:\windows\olume.vbs
2009-10-17 20:08:59 10974 ----a-w- c:\windows\system32\rojimemu.reg
2009-10-17 20:05:20 120 ----a-w- c:\windows\Lmaleqe.dat
2009-10-17 20:05:20 0 ----a-w- c:\windows\Cpime.bin
2009-10-17 20:01:38 0 ----a-w- c:\windows\system32\winhelper.dll
2009-10-17 20:01:34 49152 ----a-w- C:\bqefoh.exe

==================== Find3M ====================

2009-10-17 20:55:45 19931 ----a-w- c:\program files\common files\nutiba.inf
2009-10-17 20:08:59 19243 ----a-w- c:\program files\common files\verovahy.db
2009-10-17 20:08:59 14395 ----a-w- c:\program files\common files\raloleku.ban
2009-10-08 10:59:26 21832 ----a-w- c:\windows\system32\drivers\nvcw32mf.sys
2009-10-07 12:07:04 214344 ----a-w- c:\windows\system32\nscrnsav.scr
2009-09-29 00:59:33 28672 ----a-w- c:\windows\system32\f3PSSavr.scr
2009-09-11 14:18:39 136192 ----a-w- c:\windows\system32\msv1_0.dll
2009-09-11 14:18:39 136192 ------w- c:\windows\system32\dllcache\msv1_0.dll
2009-09-04 21:03:36 58880 ----a-w- c:\windows\system32\msasn1.dll
2009-09-04 21:03:36 58880 ------w- c:\windows\system32\dllcache\msasn1.dll
2009-08-28 10:35:52 173056 ----a-w- c:\windows\system32\dllcache\ie4uinit.exe
2009-08-26 08:00:21 247326 ----a-w- c:\windows\system32\strmdll.dll
2009-08-26 08:00:21 247326 ------w- c:\windows\system32\dllcache\strmdll.dll
2009-08-06 04:44:30 45056 --sha-w- c:\windows\system32\dahogemu.dll
2009-07-28 02:16:41 54272 --sha-w- c:\windows\system32\dahovibo.dll
2009-07-28 02:16:41 54272 --sha-w- c:\windows\system32\fayivani.dll
2009-07-22 21:27:54 1011707 --sha-w- c:\windows\system32\fivajubu.exe
2009-07-28 02:16:41 54272 --sha-w- c:\windows\system32\gezokije.dll
2009-07-17 20:06:36 39424 --sha-w- c:\windows\system32\hahonuhe.dll
2009-07-28 02:16:10 54272 --sha-w- c:\windows\system32\hulifeki.dll
2009-07-18 14:40:47 39424 --sha-w- c:\windows\system32\jogopamo.dll
2009-07-28 02:16:09 39424 --sha-w- c:\windows\system32\kogetagi.dll
2009-07-24 22:50:38 39424 --sha-w- c:\windows\system32\noregupu.dll
2009-07-18 14:40:47 54272 --sha-w- c:\windows\system32\pihuyeha.dll
2009-07-28 02:16:09 92160 --sha-w- c:\windows\system32\sekikawe.dll
2009-07-23 21:28:24 39424 --sha-w- c:\windows\system32\seruyone.dll
2009-07-17 20:06:36 90624 --sha-w- c:\windows\system32\soziredo.dll
2009-07-23 09:28:18 1011749 --sha-w- c:\windows\system32\tedawiwe.exe
2009-07-23 21:28:24 1011749 --sha-w- c:\windows\system32\vahuwodi.exe
2009-07-22 21:27:53 54272 --sha-w- c:\windows\system32\yadihoni.dll
2009-07-17 20:06:36 1108871 --sha-w- c:\windows\system32\yeweduwo.exe
2009-08-06 04:44:30 70656 --sha-w- c:\windows\system32\yeyozoda.dll
2009-07-22 21:27:55 39424 --sha-w- c:\windows\system32\yuyobiso.dll
2009-07-23 09:28:18 39424 --sha-w- c:\windows\system32\zedomuju.dll

============= FINISH: 20:52:16.79 ===============

Attached Files



#6 Blade81

Blade81

    Bleepin' Rocker


  • Malware Response Team
  • 6,465 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Finland
  • Local time:01:36 AM

Posted 06 November 2009 - 01:10 AM

Hi,

I recommend you to uninstall those mininova and piratebay toolbars.


Please visit this webpage for download links, and instructions for running ComboFix tool:

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

Please ensure you read this guide carefully and install the Recovery Console first.

The Windows Recovery Console will allow you to boot up into a special recovery (repair) mode. This allows us to more easily help you should your computer have a problem after an attempted removal of malware. It is a simple procedure that will only take a few moments of your time.

Once installed, you should see a blue screen prompt that says:

The Recovery Console was successfully installed.

Please continue as follows:
  • Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix, link
    Remember to re-enable them afterwards.

  • Click Yes to allow ComboFix to continue scanning for malware.
When the tool is finished, it will produce a report for you.

Please include the following reports for further review, and so we may continue cleansing the system:

C:\ComboFix.txt
New ddslog.


A word of warning: Neither I nor sUBs are responsible for any damage you may have caused your machine by running ComboFix. This tool is not a toy and not for everyday use.

Microsoft Windows Insider MVP 2016-2017

Microsoft MVP Consumer Security 2008-2015
UNITE member since 2006
unite_blue.png

Provided malware removal related instructions are meant to be used in the correspondent user's case only. If you have similar symptoms create own topic instead of following instructions given to some other, please.


#7 kmcdonald

kmcdonald
  • Topic Starter

  • Members
  • 37 posts
  • OFFLINE
  •  
  • Local time:03:36 PM

Posted 06 November 2009 - 09:53 PM

I skipped past the request to remove mininova and priatebay toolbars prior to running combofix, I removed them prior to the new dds log

Thanks again


DDS (Ver_09-10-13.01) - NTFSx86
Run by Chad Mothe' at 18:47:17.79 on Fri 11/06/2009
Internet Explorer: 8.0.6001.18702
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.2037.1458 [GMT -8:00]

AV: Norman Security Suite *On-access scanning disabled* (Updated) {EB9EFB40-AE72-4C43-B204-0FCD0E92D5F1}

============== Running Processes ===============

C:\Program Files\Norman\Npm\Bin\Elogsvc.exe
C:\Program Files\Norman\Ngs\Bin\Nprosec.exe
C:\WINDOWS\system32\svchost -k DcomLaunch
C:\WINDOWS\system32\svchost -k rpcss
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\Program Files\Norman\Npm\Bin\Zanda.exe
C:\Program Files\Norman\npm\bin\nvoy.exe
C:\WINDOWS\system32\svchost.exe -k NetworkService
C:\WINDOWS\system32\svchost.exe -k LocalService
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\svchost.exe -k LocalService
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Broadcom\ASFIPMon\AsfIpMon.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\PnkBstrB.exe
C:\Program Files\Norman\Npm\Bin\scheduler.exe
C:\Program Files\Norman\Npm\Bin\Njeeves.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Norman\Nse\Bin\NSESVC.EXE
C:\Program Files\Norman\Nvc\Bin\nvcoas.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Norman\Npm\Bin\ZLH.EXE
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Norman\Nvc\Bin\Nip.exe
C:\Program Files\Norman\Nvc\Bin\cclaw.exe
C:\WINDOWS\system32\opeia.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\svchost.exe -k netsvcs
C:\WINDOWS\system32\FastNetSrv.exe
C:\WINDOWS\explorer.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\internet explorer\iexplore.exe
C:\WINDOWS\system32\lsm32.sys
C:\Documents and Settings\Chad Mothe'\Desktop\dds.scr
C:\WINDOWS\system32\wbem\wmiprvse.exe

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.google.com/
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uInternet Connection Wizard,ShellNext = hxxp://www.google.com/ig/dell?hl=en&client=dell-usuk-rel&channel=us&ibd=1080123
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
mURLSearchHooks: N/A: {00a6faf6-072e-44cf-8957-5838f569a31d} - c:\program files\mywebsearch\bar\1.bin\MWSSRCAS.DLL
TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe"
mRun: [Norman ZANDA] "c:\program files\norman\npm\bin\ZLH.EXE" /LOAD /SPLASH
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
dRunOnce: [RunNarrator] Narrator.exe
IE: &Search - http://edits.mywebsearch.com/toolbaredits/...?p=ZUxdm486WLUS
IE: E&xport to Microsoft Excel - c:\progra~1\micros~3\office12\EXCEL.EXE/3000
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~3\office12\ONBttnIE.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~3\office12\REFIEBAR.DLL
DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - hxxp://ak.exe.imgfarm.com/images/nocache/funwebproducts/ei-4/MyFunCardsInitialSetup1.0.1.1.cab
DPF: {3DCEC959-378A-4922-AD7E-FD5C925D927F} - hxxp://disney.go.com/pirates/online/testActiveX/built/signed/DisneyOnlineGames.cab
DPF: {6C269571-C6D7-4818-BCA4-32A035E8C884} - hxxp://ccfiles.creative.com/Web/softwareupdate/su/ocx/15101/CTSUEng.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_12-windows-i586.cab
DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_12-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_12-windows-i586.cab
DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} - hxxp://ccfiles.creative.com/Web/softwareupdate/su/ocx/15106/CTPID.cab
TCP: {3612423A-4E35-4EAF-918F-128B05C439B2} = 77.74.48.113
TCP: {EB562B6A-751A-484E-8E7D-5623157607B0} = 77.74.48.113
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\progra~1\micros~3\office12\GR99D3~1.DLL
Notify: igfxcui - igfxdev.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\progra~1\micros~3\office12\GRA8E1~1.DLL
LSA: Notification Packages = scecli icherdc.dll

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\chadmo~1\applic~1\mozilla\firefox\profiles\xuyqsw5x.default\
FF - plugin: c:\documents and settings\all users\application data\nexonus\ngm\npNxGameUS.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\

============= SERVICES / DRIVERS ===============

R1 NGS;Norman General Security Driver;c:\program files\norman\ngs\bin\ngs.sys [2009-2-27 25032]
R1 NPROSEC;Norman Security driver;c:\program files\norman\ngs\bin\nprosec.sys [2009-5-12 56136]
R2 ASFIPmon;Broadcom ASF IP and SMBIOS Mailbox Monitor;c:\program files\broadcom\asfipmon\AsfIpMon.exe [2007-6-20 79168]
R2 BtwSrv;BtwSrv;c:\windows\system32\svchost.exe -k netsvcs [2004-8-10 14336]
R2 fastnetsrv;fastnetsrv Service;c:\windows\system32\FastNetSrv.exe [2004-8-4 48128]
R2 Ndiskio;Ndiskio;c:\program files\norman\nse\bin\Ndiskio.sys [2009-10-15 24168]
R2 NPROSECSVC;Norman Security service;c:\program files\norman\ngs\bin\nprosec.exe [2009-5-12 124232]
R2 NVOY;Norman Resource Provider;c:\program files\norman\npm\bin\nvoy.exe [2009-2-25 128328]
R3 nsesvc;Norman Scanner Engine Service;c:\program files\norman\nse\bin\Nsesvc.exe [2009-10-15 320840]
R3 NvcMFlt;NvcMFlt;c:\windows\system32\drivers\nvcw32mf.sys [2009-2-25 21832]
R3 nvcoas;Norman Virus Control on-access component;c:\program files\norman\nvc\bin\Nvcoas.exe [2009-2-25 197960]
R3 Scheduler;Norman Scheduler Service;c:\program files\norman\npm\bin\scheduler.exe [2009-5-12 132424]
S3 NVCScheduler;Norman Virus Control Scheduler;"c:\program files\norman\npm\bin\nvcsched.exe" --> c:\program files\norman\npm\bin\Nvcsched.exe [?]
S3 W8100PCI;D-Link AirPlus G Wireless Driver;c:\windows\system32\drivers\MRV8K51.sys [2008-1-31 297984]

=============== Created Last 30 ================

2009-11-05 22:29 <DIR> a-dshr-- C:\cmdcons
2009-11-05 22:28 267,264 a------- c:\windows\PEV.exe
2009-11-05 22:28 161,792 a------- c:\windows\SWREG.exe
2009-11-05 22:28 98,816 a------- c:\windows\sed.exe
2009-11-05 22:28 77,312 a------- c:\windows\MBR.exe
2009-11-05 22:28 <DIR> --d----- C:\ComboFix
2009-11-05 20:44 39,424 ---sh--- c:\windows\system32\vakumene.dll
2009-11-05 06:18 <DIR> --d----- c:\docume~1\alluse~1\applic~1\korulawa
2009-11-05 06:18 <DIR> --d----- c:\docume~1\alluse~1\applic~1\galubanu
2009-11-05 06:18 <DIR> --d----- c:\docume~1\alluse~1\applic~1\zabeyuse
2009-11-04 18:18 <DIR> --d----- c:\docume~1\alluse~1\applic~1\sakadadu
2009-11-04 18:18 <DIR> --d----- c:\docume~1\alluse~1\applic~1\sijureha
2009-11-04 18:18 <DIR> --d----- c:\docume~1\alluse~1\applic~1\damozibu
2009-11-04 06:18 <DIR> --d----- c:\docume~1\alluse~1\applic~1\zufanazu
2009-11-04 06:18 <DIR> --d----- c:\docume~1\alluse~1\applic~1\lojelumo
2009-11-04 06:18 <DIR> --d----- c:\docume~1\alluse~1\applic~1\kufasoki
2009-11-03 18:18 <DIR> --d----- c:\docume~1\alluse~1\applic~1\kizuwihe
2009-11-03 18:18 <DIR> --d----- c:\docume~1\alluse~1\applic~1\sadapeso
2009-11-03 18:18 <DIR> --d----- c:\docume~1\alluse~1\applic~1\redekere
2009-11-03 06:18 <DIR> --d----- c:\docume~1\alluse~1\applic~1\yenawuju
2009-11-03 06:18 <DIR> --d----- c:\docume~1\alluse~1\applic~1\jodafoli
2009-11-02 18:18 <DIR> --d----- c:\docume~1\alluse~1\applic~1\zokohito
2009-11-02 18:18 <DIR> --d----- c:\docume~1\alluse~1\applic~1\tulozuru
2009-11-02 06:17 <DIR> --d----- c:\docume~1\alluse~1\applic~1\tarowata
2009-11-02 06:17 <DIR> --d----- c:\docume~1\alluse~1\applic~1\kefunuya
2009-11-01 18:17 <DIR> --d----- c:\docume~1\alluse~1\applic~1\kezahopi
2009-11-01 18:17 <DIR> --d----- c:\docume~1\alluse~1\applic~1\vipukuna
2009-11-01 06:17 <DIR> --d----- c:\docume~1\alluse~1\applic~1\tekugusa
2009-11-01 06:17 <DIR> --d----- c:\docume~1\alluse~1\applic~1\tavufugo
2009-10-31 18:17 <DIR> --d----- c:\docume~1\alluse~1\applic~1\zuniramo
2009-10-31 18:17 <DIR> --d----- c:\docume~1\alluse~1\applic~1\medujiho
2009-10-31 06:17 <DIR> --d----- c:\docume~1\alluse~1\applic~1\kemuvude
2009-10-31 06:17 <DIR> --d----- c:\docume~1\alluse~1\applic~1\fuyopeyu
2009-10-30 18:17 <DIR> --d----- c:\docume~1\alluse~1\applic~1\kovovaga
2009-10-30 18:17 <DIR> --d----- c:\docume~1\alluse~1\applic~1\bamigano
2009-10-30 06:16 <DIR> --d----- c:\docume~1\alluse~1\applic~1\ziyosije
2009-10-30 06:16 <DIR> --d----- c:\docume~1\alluse~1\applic~1\wuhesiba
2009-10-30 06:16 <DIR> --d----- c:\docume~1\alluse~1\applic~1\wiyerane
2009-10-29 18:16 <DIR> --d----- c:\docume~1\alluse~1\applic~1\sulobugu
2009-10-29 18:16 <DIR> --d----- c:\docume~1\alluse~1\applic~1\sawatuka
2009-10-29 18:16 <DIR> --d----- c:\docume~1\alluse~1\applic~1\hivelegi
2009-10-29 06:16 <DIR> --d----- c:\docume~1\alluse~1\applic~1\yojojara
2009-10-29 06:16 <DIR> --d----- c:\docume~1\alluse~1\applic~1\yizinama
2009-10-29 06:16 <DIR> --d----- c:\docume~1\alluse~1\applic~1\tiziyonu
2009-10-28 18:16 <DIR> --d----- c:\docume~1\alluse~1\applic~1\yazadule
2009-10-28 18:16 <DIR> --d----- c:\docume~1\alluse~1\applic~1\sofeposu
2009-10-28 06:16 <DIR> --d----- c:\docume~1\alluse~1\applic~1\rujuhiva
2009-10-28 06:16 <DIR> --d----- c:\docume~1\alluse~1\applic~1\hasolawo
2009-10-28 06:16 <DIR> --d----- c:\docume~1\alluse~1\applic~1\dusivuje
2009-10-22 08:49 <DIR> --d----- C:\!KillBox
2009-10-21 20:19 <DIR> --d----- C:\_OTM
2009-10-21 18:50 <DIR> --d----- c:\windows\pss
2009-10-21 18:48 15,323 a------- c:\windows\mury.dat
2009-10-20 17:13 <DIR> --d----- c:\docume~1\chadmo~1\applic~1\Malwarebytes
2009-10-20 17:13 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Malwarebytes
2009-10-20 05:48 <DIR> --d----- c:\docume~1\alluse~1\applic~1\tipiyipo
2009-10-20 05:48 <DIR> --d----- c:\docume~1\alluse~1\applic~1\sajekeye
2009-10-20 05:48 <DIR> --d----- c:\docume~1\alluse~1\applic~1\lamisefi
2009-10-19 13:44 <DIR> --d----- c:\docume~1\alluse~1\applic~1\yidurufo
2009-10-19 13:44 <DIR> --d----- c:\docume~1\alluse~1\applic~1\sufetida
2009-10-19 13:44 <DIR> --d----- c:\docume~1\alluse~1\applic~1\sofapohe
2009-10-18 18:40 <DIR> --d----- c:\docume~1\alluse~1\applic~1\sozejudu
2009-10-18 18:40 <DIR> --d----- c:\docume~1\alluse~1\applic~1\dujiyera
2009-10-18 18:40 <DIR> --d----- c:\docume~1\alluse~1\applic~1\dofakase
2009-10-17 12:55 15,579 a------- c:\windows\system32\ujykoki.com
2009-10-17 12:42 664 a------- c:\windows\system32\d3d9caps.dat
2009-10-17 12:08 13,562 a------- c:\windows\system32\ogucex.db
2009-10-17 12:05 120 a------- c:\windows\Lmaleqe.dat
2009-10-17 12:05 0 a------- c:\windows\Cpime.bin

==================== Find3M ====================

2009-10-22 01:19 5,939,712 a------- c:\windows\system32\dllcache\mshtml.dll
2009-10-17 12:08 19,243 a------- c:\program files\common files\verovahy.db
2009-10-08 02:59 21,832 a------- c:\windows\system32\drivers\nvcw32mf.sys
2009-10-07 04:07 214,344 a------- c:\windows\system32\nscrnsav.scr
2009-09-11 06:18 136,192 a------- c:\windows\system32\msv1_0.dll
2009-09-11 06:18 136,192 -------- c:\windows\system32\dllcache\msv1_0.dll
2009-09-04 13:03 58,880 a------- c:\windows\system32\msasn1.dll
2009-09-04 13:03 58,880 -------- c:\windows\system32\dllcache\msasn1.dll
2009-08-28 02:35 173,056 a------- c:\windows\system32\dllcache\ie4uinit.exe
2009-08-26 00:00 247,326 a------- c:\windows\system32\strmdll.dll
2009-08-26 00:00 247,326 -------- c:\windows\system32\dllcache\strmdll.dll
2009-02-27 15:53 22,328 a------- c:\docume~1\chadmo~1\applic~1\PnkBstrK.sys
2009-08-05 20:44 45,056 a--sh--- c:\windows\system32\dahogemu.dll

============= FINISH: 18:47:27.84 ===============

Attached Files



#8 Blade81

Blade81

    Bleepin' Rocker


  • Malware Response Team
  • 6,465 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Finland
  • Local time:01:36 AM

Posted 07 November 2009 - 05:22 AM

Hi again,


Open notepad and copy/paste the text in the quotebox below into it:

Driver::
BtwSrv
fastnetsrv
File::
c:\windows\system32\vakumene.dll
c:\documents and settings\Chad Mothe'\Local Settings\Application Data\syxebali.dat
c:\windows\mury.dat
c:\documents and settings\Jade Mothe'\Local Settings\Application Data\Cpime.bin
c:\documents and settings\Jade Mothe'\Local Settings\Application Data\Lmaleqe.dat
c:\windows\system32\ujykoki.com
c:\documents and settings\Drake Mothe'\Local Settings\Application Data\Cpime.bin
c:\documents and settings\Drake Mothe'\Local Settings\Application Data\Lmaleqe.dat
c:\windows\Cpime.bin
c:\windows\Lmaleqe.dat
c:\program files\Common Files\verovahy.db
c:\windows\system32\dahogemu.dll
c:\windows\system32\FastNetSrv.exe
c:\windows\icherdc.dll
c:\windows\system32\lsm32.sys
Folder::
c:\documents and settings\All Users\Application Data\korulawa
c:\documents and settings\All Users\Application Data\galubanu
c:\documents and settings\All Users\Application Data\zabeyuse
c:\documents and settings\All Users\Application Data\sakadadu
c:\documents and settings\All Users\Application Data\sijureha
c:\documents and settings\All Users\Application Data\damozibu
c:\documents and settings\All Users\Application Data\zufanazu
c:\documents and settings\All Users\Application Data\lojelumo
c:\documents and settings\All Users\Application Data\kufasoki
c:\documents and settings\All Users\Application Data\kizuwihe
c:\documents and settings\All Users\Application Data\redekere
c:\documents and settings\All Users\Application Data\sadapeso
c:\documents and settings\All Users\Application Data\yenawuju
c:\documents and settings\All Users\Application Data\jodafoli
c:\documents and settings\All Users\Application Data\zokohito
c:\documents and settings\All Users\Application Data\tulozuru
c:\documents and settings\All Users\Application Data\tarowata
c:\documents and settings\All Users\Application Data\kefunuya
c:\documents and settings\All Users\Application Data\kezahopi
c:\documents and settings\All Users\Application Data\vipukuna
c:\documents and settings\All Users\Application Data\tavufugo
c:\documents and settings\All Users\Application Data\tekugusa
c:\documents and settings\All Users\Application Data\zuniramo
c:\documents and settings\All Users\Application Data\medujiho
c:\documents and settings\All Users\Application Data\kemuvude
c:\documents and settings\All Users\Application Data\fuyopeyu
c:\documents and settings\All Users\Application Data\kovovaga
c:\documents and settings\All Users\Application Data\bamigano
c:\documents and settings\All Users\Application Data\wiyerane
c:\documents and settings\All Users\Application Data\ziyosije
c:\documents and settings\All Users\Application Data\wuhesiba
c:\documents and settings\All Users\Application Data\sulobugu
c:\documents and settings\All Users\Application Data\sawatuka
c:\documents and settings\All Users\Application Data\hivelegi
c:\documents and settings\All Users\Application Data\yizinama
c:\documents and settings\All Users\Application Data\yojojara
c:\documents and settings\All Users\Application Data\tiziyonu
c:\documents and settings\All Users\Application Data\yazadule
c:\documents and settings\All Users\Application Data\sofeposu
c:\documents and settings\All Users\Application Data\dusivuje
c:\documents and settings\All Users\Application Data\rujuhiva
c:\documents and settings\All Users\Application Data\hasolawo
c:\documents and settings\All Users\Application Data\lamisefi
c:\documents and settings\All Users\Application Data\tipiyipo
c:\documents and settings\All Users\Application Data\sajekeye
c:\documents and settings\All Users\Application Data\yidurufo
c:\documents and settings\All Users\Application Data\sufetida
c:\documents and settings\All Users\Application Data\sofapohe
c:\documents and settings\All Users\Application Data\dujiyera
c:\documents and settings\All Users\Application Data\sozejudu
c:\documents and settings\All Users\Application Data\dofakase
DDS::
mURLSearchHooks: N/A: {00a6faf6-072e-44cf-8957-5838f569a31d} - c:\program files\mywebsearch\bar\1.bin\MWSSRCAS.DLL
IE: &Search - http://edits.mywebsearch.com/toolbaredits/...?p=ZUxdm486WLUS
Registry::
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
"Notification Packages"=hex(7):73,63,65,63,6c,69,00,00


Save this as
CFScript

A word of warning: Neither I nor sUBs are responsible for any damage you may have caused your machine. This tool is not a toy and not for everyday use.

Posted Image

Close all browser windows and refering to the picture above, drag CFScript into ComboFix.exe
Then post the resultant log.


Uninstall old Adobe Reader versions and get the latest one (9.2) here or get Foxit Reader here. Make sure you don't install toolbar if choose Foxit Reader! You may also check free readers introduced here.


Check here to see if your Flash is up-to-date (do it separately with each of your browsers). If not, uninstall vulnerable versions by following instructions here. Fresh version can be obtained here.


Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update to the latest version...

Updating Java:
  • Download the latest version of Java Runtime Environment (JRE) 6 Update 17.
  • Click the
    Download
    button to the right.
  • Select Windows on platform combobox and check the box that says:
    Accept License Agreement. Click continue.
  • The page will refresh.
  • Click on the link to download Windows Offline Installation with or without Multi-language and save to your desktop.
  • Close any programs you may have running - especially your web browser.
  • Go to Start > Control Panel double-click on Add/Remove programs and remove all older versions of Java.
  • Check any item with Java Runtime Environment (JRE or J2SE) in the name.
  • Click the Remove or Change/Remove button.
  • Repeat as many times as necessary to remove each Java versions.
  • Reboot your computer once all Java components are removed.
  • Then from your desktop double-click on jre-6u17-windows-i586-p.exe to install the newest version. Uncheck Carbonite online backup trial if it's offered there.


Download ATF (Atribune Temp File) Cleanerę by Atribune to your desktop.

Double-click ATF Cleaner.exe to open it

Under Main choose:
Windows Temp
Current User Temp
All Users Temp
Cookies
Temporary Internet Files
Prefetch
Java Cache

*The other boxes are optional*
Then click the Empty Selected button.

If you use Firefox:
Click Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click NO at the prompt.

If you use Opera:
Click Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click NO at the prompt.

Click Exit on the Main menu to close the program.


Please run an online scan with Kaspersky Online Scanner as instructed in the screenshot here.


Post back its report, a fresh dds.txt log and above mentioned ComboFix resultant log.

Microsoft Windows Insider MVP 2016-2017

Microsoft MVP Consumer Security 2008-2015
UNITE member since 2006
unite_blue.png

Provided malware removal related instructions are meant to be used in the correspondent user's case only. If you have similar symptoms create own topic instead of following instructions given to some other, please.


#9 kmcdonald

kmcdonald
  • Topic Starter

  • Members
  • 37 posts
  • OFFLINE
  •  
  • Local time:03:36 PM

Posted 07 November 2009 - 02:19 PM

I have lost the ability to log into Blppeingcomputer.com with the infected computer, I can log unto Home page Google that is all, I have copied Combofix, DDS and attach logs to this PC to continue, I cant check check Java or run Kaspersky at this time.

I also checked and I now can get to safe mode, should I start following the rest of your instructions in safe mode?


DDS (Ver_09-10-13.01) - NTFSx86
Run by Chad Mothe' at 11:10:52.70 on Sat 11/07/2009
Internet Explorer: 8.0.6001.18702
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.2037.1518 [GMT -8:00]

AV: Norman Security Suite *On-access scanning enabled* (Updated) {EB9EFB40-AE72-4C43-B204-0FCD0E92D5F1}

============== Running Processes ===============

C:\Program Files\Norman\Npm\Bin\Elogsvc.exe
C:\Program Files\Norman\Ngs\Bin\Nprosec.exe
C:\WINDOWS\system32\svchost -k DcomLaunch
C:\WINDOWS\system32\svchost -k rpcss
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\Program Files\Norman\Npm\Bin\Zanda.exe
C:\Program Files\Norman\npm\bin\nvoy.exe
C:\WINDOWS\system32\svchost.exe -k NetworkService
C:\WINDOWS\system32\svchost.exe -k LocalService
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\svchost.exe -k LocalService
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Broadcom\ASFIPMon\AsfIpMon.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\PnkBstrB.exe
C:\Program Files\Norman\Npm\Bin\scheduler.exe
C:\Program Files\Norman\Npm\Bin\Njeeves.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Norman\Nse\Bin\NSESVC.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Norman\Npm\Bin\ZLH.EXE
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Norman\Nvc\Bin\nvcoas.exe
C:\Program Files\Norman\Nvc\Bin\Nip.exe
C:\Program Files\Norman\Nvc\Bin\cclaw.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\msiexec.exe
C:\Documents and Settings\Chad Mothe'\Desktop\dds.scr
C:\WINDOWS\system32\wbem\wmiprvse.exe

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.google.com/
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uInternet Connection Wizard,ShellNext = hxxp://www.google.com/ig/dell?hl=en&client=dell-usuk-rel&channel=us&ibd=1080123
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
mURLSearchHooks: N/A: {00a6faf6-072e-44cf-8957-5838f569a31d} - c:\program files\mywebsearch\bar\1.bin\MWSSRCAS.DLL
TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe"
mRun: [Norman ZANDA] "c:\program files\norman\npm\bin\ZLH.EXE" /LOAD /SPLASH
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [riwozavas] Rundll32.exe "c:\docume~1\alluse~1\applic~1\galubanu\galubanu.dll",a
dRunOnce: [RunNarrator] Narrator.exe
IE: E&xport to Microsoft Excel - c:\progra~1\micros~3\office12\EXCEL.EXE/3000
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~3\office12\ONBttnIE.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~3\office12\REFIEBAR.DLL
DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - hxxp://ak.exe.imgfarm.com/images/nocache/funwebproducts/ei-4/MyFunCardsInitialSetup1.0.1.1.cab
DPF: {3DCEC959-378A-4922-AD7E-FD5C925D927F} - hxxp://disney.go.com/pirates/online/testActiveX/built/signed/DisneyOnlineGames.cab
DPF: {6C269571-C6D7-4818-BCA4-32A035E8C884} - hxxp://ccfiles.creative.com/Web/softwareupdate/su/ocx/15101/CTSUEng.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_12-windows-i586.cab
DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_12-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_12-windows-i586.cab
DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} - hxxp://ccfiles.creative.com/Web/softwareupdate/su/ocx/15106/CTPID.cab
TCP: {3612423A-4E35-4EAF-918F-128B05C439B2} = 77.74.48.113
TCP: {EB562B6A-751A-484E-8E7D-5623157607B0} = 77.74.48.113
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\progra~1\micros~3\office12\GR99D3~1.DLL
Notify: igfxcui - igfxdev.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\progra~1\micros~3\office12\GRA8E1~1.DLL

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\chadmo~1\applic~1\mozilla\firefox\profiles\xuyqsw5x.default\
FF - plugin: c:\documents and settings\all users\application data\nexonus\ngm\npNxGameUS.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\

============= SERVICES / DRIVERS ===============

R1 NGS;Norman General Security Driver;c:\program files\norman\ngs\bin\ngs.sys [2009-2-27 25032]
R1 NPROSEC;Norman Security driver;c:\program files\norman\ngs\bin\nprosec.sys [2009-5-12 56136]
R2 ASFIPmon;Broadcom ASF IP and SMBIOS Mailbox Monitor;c:\program files\broadcom\asfipmon\AsfIpMon.exe [2007-6-20 79168]
R2 Ndiskio;Ndiskio;c:\program files\norman\nse\bin\Ndiskio.sys [2009-10-15 24168]
R2 NPROSECSVC;Norman Security service;c:\program files\norman\ngs\bin\nprosec.exe [2009-5-12 124232]
R2 NVOY;Norman Resource Provider;c:\program files\norman\npm\bin\nvoy.exe [2009-2-25 128328]
R3 nsesvc;Norman Scanner Engine Service;c:\program files\norman\nse\bin\Nsesvc.exe [2009-10-15 320840]
R3 NvcMFlt;NvcMFlt;c:\windows\system32\drivers\nvcw32mf.sys [2009-2-25 21832]
R3 nvcoas;Norman Virus Control on-access component;c:\program files\norman\nvc\bin\Nvcoas.exe [2009-2-25 197960]
R3 Scheduler;Norman Scheduler Service;c:\program files\norman\npm\bin\scheduler.exe [2009-5-12 132424]
S3 NVCScheduler;Norman Virus Control Scheduler;"c:\program files\norman\npm\bin\nvcsched.exe" --> c:\program files\norman\npm\bin\Nvcsched.exe [?]
S3 W8100PCI;D-Link AirPlus G Wireless Driver;c:\windows\system32\drivers\MRV8K51.sys [2008-1-31 297984]

=============== Created Last 30 ================

2009-11-07 10:48 267,264 a------- c:\windows\PEV.exe
2009-11-07 10:48 161,792 a------- c:\windows\SWREG.exe
2009-11-07 10:48 98,816 a------- c:\windows\sed.exe
2009-11-07 10:48 77,312 a------- c:\windows\MBR.exe
2009-11-07 10:31 <DIR> --dsh--- c:\documents and settings\chad mothe'\IECompatCache
2009-11-05 22:29 <DIR> a-dshr-- C:\cmdcons
2009-10-22 08:49 <DIR> --d----- C:\!KillBox
2009-10-21 20:19 <DIR> --d----- C:\_OTM
2009-10-21 18:50 <DIR> --d----- c:\windows\pss
2009-10-20 17:13 <DIR> --d----- c:\docume~1\chadmo~1\applic~1\Malwarebytes
2009-10-20 17:13 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Malwarebytes
2009-10-17 12:42 664 a------- c:\windows\system32\d3d9caps.dat
2009-10-17 12:08 13,562 a------- c:\windows\system32\ogucex.db

==================== Find3M ====================

2009-10-22 01:19 5,939,712 a------- c:\windows\system32\dllcache\mshtml.dll
2009-10-08 02:59 21,832 a------- c:\windows\system32\drivers\nvcw32mf.sys
2009-10-07 04:07 214,344 a------- c:\windows\system32\nscrnsav.scr
2009-09-11 06:18 136,192 a------- c:\windows\system32\msv1_0.dll
2009-09-11 06:18 136,192 -------- c:\windows\system32\dllcache\msv1_0.dll
2009-09-04 13:03 58,880 a------- c:\windows\system32\msasn1.dll
2009-09-04 13:03 58,880 -------- c:\windows\system32\dllcache\msasn1.dll
2009-08-28 02:35 173,056 a------- c:\windows\system32\dllcache\ie4uinit.exe
2009-08-26 00:00 247,326 a------- c:\windows\system32\strmdll.dll
2009-08-26 00:00 247,326 -------- c:\windows\system32\dllcache\strmdll.dll
2009-02-27 15:53 22,328 a------- c:\docume~1\chadmo~1\applic~1\PnkBstrK.sys

============= FINISH: 11:11:04.50 ===============

Attached Files



#10 Blade81

Blade81

    Bleepin' Rocker


  • Malware Response Team
  • 6,465 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Finland
  • Local time:01:36 AM

Posted 07 November 2009 - 06:04 PM

Hi,

At which point connection problems began? Do you have a firewall enabled there and if yes, is browser given permission to access internet?

Microsoft Windows Insider MVP 2016-2017

Microsoft MVP Consumer Security 2008-2015
UNITE member since 2006
unite_blue.png

Provided malware removal related instructions are meant to be used in the correspondent user's case only. If you have similar symptoms create own topic instead of following instructions given to some other, please.


#11 kmcdonald

kmcdonald
  • Topic Starter

  • Members
  • 37 posts
  • OFFLINE
  •  
  • Local time:03:36 PM

Posted 08 November 2009 - 09:30 AM

Internet Connection is back, not really sure what happened, it was almost like browser was being redirected, Google is home page and it would go there but seemed to redirect if any other address was choosen.

This morning however my antivirus program detected and quarantined W32/Renos with extensions of .axfu, awft, axci, axgb, axff, axeb, axdv and axgh. all are currently still sitting in quarantine, should I delete them, and also should I work in save mode?

#12 Blade81

Blade81

    Bleepin' Rocker


  • Malware Response Team
  • 6,465 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Finland
  • Local time:01:36 AM

Posted 08 November 2009 - 09:49 AM

Hi,

Are you able to get exact list of quarantined objects? Since the connection is back breathing I assume you're able to carry out with those other steps in my earlier post (kaspersky online scanner run etc) :(

Microsoft Windows Insider MVP 2016-2017

Microsoft MVP Consumer Security 2008-2015
UNITE member since 2006
unite_blue.png

Provided malware removal related instructions are meant to be used in the correspondent user's case only. If you have similar symptoms create own topic instead of following instructions given to some other, please.


#13 kmcdonald

kmcdonald
  • Topic Starter

  • Members
  • 37 posts
  • OFFLINE
  •  
  • Local time:03:36 PM

Posted 08 November 2009 - 10:51 AM

Yes I will run the requests from the earlier post
Quarantined files
W32/Renos.axfu
W32/Renos.awft
W32/Renos.axci
W32/Renos.axgb
W32/Renos.axff
W32/Renos.axeb
W32/Renos.axdv
W32/Renos.axgh

I will post requested logs next

#14 kmcdonald

kmcdonald
  • Topic Starter

  • Members
  • 37 posts
  • OFFLINE
  •  
  • Local time:03:36 PM

Posted 08 November 2009 - 01:15 PM

All requests have now been completed, I did not include Combofix log as I did not rerun combo fix after last request.



DDS (Ver_09-10-13.01) - NTFSx86
Run by Chad Mothe' at 10:11:23.84 on Sun 11/08/2009
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_17
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.2037.1381 [GMT -8:00]

AV: Norman Security Suite *On-access scanning enabled* (Updated) {EB9EFB40-AE72-4C43-B204-0FCD0E92D5F1}

============== Running Processes ===============

C:\Program Files\Norman\Npm\Bin\Elogsvc.exe
C:\Program Files\Norman\Ngs\Bin\Nprosec.exe
C:\WINDOWS\system32\svchost -k DcomLaunch
C:\WINDOWS\system32\svchost -k rpcss
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\Program Files\Norman\Npm\Bin\Zanda.exe
C:\Program Files\Norman\npm\bin\nvoy.exe
C:\WINDOWS\system32\svchost.exe -k NetworkService
C:\WINDOWS\system32\svchost.exe -k LocalService
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\svchost.exe -k LocalService
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Broadcom\ASFIPMon\AsfIpMon.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\PnkBstrB.exe
C:\Program Files\Norman\Npm\Bin\scheduler.exe
C:\Program Files\Norman\Npm\Bin\Njeeves.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Norman\Nse\Bin\NSESVC.EXE
C:\Program Files\Norman\Nvc\Bin\nvcoas.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Norman\Npm\Bin\ZLH.EXE
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Norman\Nvc\Bin\Nip.exe
C:\Program Files\Norman\Nvc\Bin\cclaw.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Java\jre6\bin\java.exe
C:\Documents and Settings\Chad Mothe'\Local Settings\temp\jkos-Chad Mothe'\binaries\ScanningProcess.exe
C:\Documents and Settings\Chad Mothe'\Local Settings\temp\jkos-Chad Mothe'\binaries\ScanningProcess.exe
C:\Documents and Settings\Chad Mothe'\Desktop\dds.scr
C:\WINDOWS\system32\wbem\wmiprvse.exe

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.google.com/
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uInternet Connection Wizard,ShellNext = hxxp://www.google.com/ig/dell?hl=en&client=dell-usuk-rel&channel=us&ibd=1080123
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
mURLSearchHooks: N/A: {00a6faf6-072e-44cf-8957-5838f569a31d} - c:\program files\mywebsearch\bar\1.bin\MWSSRCAS.DLL
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe"
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
mRun: [Norman ZANDA] "c:\program files\norman\npm\bin\ZLH.EXE" /LOAD /SPLASH
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [riwozavas] Rundll32.exe "c:\docume~1\alluse~1\applic~1\galubanu\galubanu.dll",a
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
dRunOnce: [RunNarrator] Narrator.exe
IE: E&xport to Microsoft Excel - c:\progra~1\micros~3\office12\EXCEL.EXE/3000
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~3\office12\ONBttnIE.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~3\office12\REFIEBAR.DLL
DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - hxxp://ak.exe.imgfarm.com/images/nocache/funwebproducts/ei-4/MyFunCardsInitialSetup1.0.1.1.cab
DPF: {3DCEC959-378A-4922-AD7E-FD5C925D927F} - hxxp://disney.go.com/pirates/online/testActiveX/built/signed/DisneyOnlineGames.cab
DPF: {6C269571-C6D7-4818-BCA4-32A035E8C884} - hxxp://ccfiles.creative.com/Web/softwareupdate/su/ocx/15101/CTSUEng.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} - hxxp://ccfiles.creative.com/Web/softwareupdate/su/ocx/15106/CTPID.cab
TCP: {3612423A-4E35-4EAF-918F-128B05C439B2} = 77.74.48.113
TCP: {EB562B6A-751A-484E-8E7D-5623157607B0} = 77.74.48.113
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\progra~1\micros~3\office12\GR99D3~1.DLL
Notify: igfxcui - igfxdev.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\progra~1\micros~3\office12\GRA8E1~1.DLL

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\chadmo~1\applic~1\mozilla\firefox\profiles\xuyqsw5x.default\
FF - plugin: c:\documents and settings\all users\application data\nexonus\ngm\npNxGameUS.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}

============= SERVICES / DRIVERS ===============

R1 NGS;Norman General Security Driver;c:\program files\norman\ngs\bin\ngs.sys [2009-2-27 25032]
R1 NPROSEC;Norman Security driver;c:\program files\norman\ngs\bin\nprosec.sys [2009-5-12 56136]
R2 ASFIPmon;Broadcom ASF IP and SMBIOS Mailbox Monitor;c:\program files\broadcom\asfipmon\AsfIpMon.exe [2007-6-20 79168]
R2 Ndiskio;Ndiskio;c:\program files\norman\nse\bin\Ndiskio.sys [2009-10-15 24168]
R2 NPROSECSVC;Norman Security service;c:\program files\norman\ngs\bin\nprosec.exe [2009-5-12 124232]
R2 NVOY;Norman Resource Provider;c:\program files\norman\npm\bin\nvoy.exe [2009-2-25 128328]
R3 nsesvc;Norman Scanner Engine Service;c:\program files\norman\nse\bin\Nsesvc.exe [2009-10-15 320840]
R3 NvcMFlt;NvcMFlt;c:\windows\system32\drivers\nvcw32mf.sys [2009-2-25 21832]
R3 nvcoas;Norman Virus Control on-access component;c:\program files\norman\nvc\bin\Nvcoas.exe [2009-2-25 197960]
R3 Scheduler;Norman Scheduler Service;c:\program files\norman\npm\bin\scheduler.exe [2009-5-12 132424]
S3 NVCScheduler;Norman Virus Control Scheduler;"c:\program files\norman\npm\bin\nvcsched.exe" --> c:\program files\norman\npm\bin\Nvcsched.exe [?]
S3 W8100PCI;D-Link AirPlus G Wireless Driver;c:\windows\system32\drivers\MRV8K51.sys [2008-1-31 297984]

=============== Created Last 30 ================

2009-11-08 08:14 73,728 a------- c:\windows\system32\javacpl.cpl
2009-11-07 10:48 267,264 a------- c:\windows\PEV.exe
2009-11-07 10:48 161,792 a------- c:\windows\SWREG.exe
2009-11-07 10:48 98,816 a------- c:\windows\sed.exe
2009-11-07 10:48 77,312 a------- c:\windows\MBR.exe
2009-11-07 10:31 <DIR> --dsh--- c:\documents and settings\chad mothe'\IECompatCache
2009-11-05 22:29 <DIR> a-dshr-- C:\cmdcons
2009-10-22 08:49 <DIR> --d----- C:\!KillBox
2009-10-21 20:19 <DIR> --d----- C:\_OTM
2009-10-21 18:50 <DIR> --d----- c:\windows\pss
2009-10-20 17:13 <DIR> --d----- c:\docume~1\chadmo~1\applic~1\Malwarebytes
2009-10-20 17:13 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Malwarebytes
2009-10-17 12:42 664 a------- c:\windows\system32\d3d9caps.dat
2009-10-17 12:08 13,562 a------- c:\windows\system32\ogucex.db

==================== Find3M ====================

2009-11-08 08:14 411,368 a------- c:\windows\system32\deploytk.dll
2009-10-22 01:19 5,939,712 a------- c:\windows\system32\dllcache\mshtml.dll
2009-10-08 02:59 21,832 a------- c:\windows\system32\drivers\nvcw32mf.sys
2009-10-07 04:07 214,344 a------- c:\windows\system32\nscrnsav.scr
2009-09-11 06:18 136,192 a------- c:\windows\system32\msv1_0.dll
2009-09-11 06:18 136,192 -------- c:\windows\system32\dllcache\msv1_0.dll
2009-09-04 13:03 58,880 a------- c:\windows\system32\msasn1.dll
2009-09-04 13:03 58,880 -------- c:\windows\system32\dllcache\msasn1.dll
2009-08-28 02:35 173,056 a------- c:\windows\system32\dllcache\ie4uinit.exe
2009-08-26 00:00 247,326 a------- c:\windows\system32\strmdll.dll
2009-08-26 00:00 247,326 -------- c:\windows\system32\dllcache\strmdll.dll
2009-02-27 15:53 22,328 a------- c:\docume~1\chadmo~1\applic~1\PnkBstrK.sys

============= FINISH: 10:11:39.46 ===============

Attached Files



#15 Blade81

Blade81

    Bleepin' Rocker


  • Malware Response Team
  • 6,465 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Finland
  • Local time:01:36 AM

Posted 08 November 2009 - 02:12 PM

Thanks for the logs :(

Open notepad and copy/paste the text in the quotebox below into it:

File::
C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\SN2NI165\logo[1].htm
C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\SN2NI165\logo[2].htm


Save this as
CFScript

A word of warning: Neither I nor sUBs are responsible for any damage you may have caused your machine. This tool is not a toy and not for everyday use.

Posted Image

Close all browser windows and refering to the picture above, drag CFScript into ComboFix.exe
Then post the resultant log & fresh dds log. How's the system running?

Microsoft Windows Insider MVP 2016-2017

Microsoft MVP Consumer Security 2008-2015
UNITE member since 2006
unite_blue.png

Provided malware removal related instructions are meant to be used in the correspondent user's case only. If you have similar symptoms create own topic instead of following instructions given to some other, please.





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users