Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Keyesitez Malware/Adware


  • This topic is locked This topic is locked
12 replies to this topic

#1 Mandenbar

Mandenbar

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:05:14 PM

Posted 03 November 2009 - 10:57 PM

I have a pretty stubborn adware infection on my computer. It's running fairly slow (that's a given), and pop ups are happening pretty frequently. I'm unable to boot into safe mode: when I select the option it quickly goes down a list of all of the drivers it's loading, then I get an error flashed very quickly on the screen (too quickly to even see anything that it says) before the computer automatically reboots. Have used Microsoft's Guided Help to boot into Clean Mode, and have ran Avira AntiVir, Lavasoft's Adaware, IOBit Security 360, and Sophos, Trend, McAfee, and Kaspersky (all included in some Multi AVI scanning tool), which have found multiple infections and "removed" them. Additionally, the malware cleverly deleted mbam.exe, and will not allow me to reinstall MalwareBytes (it keeps deleting that file immediately upon installation). Problem still persists, hence my request for assistance from you kind folks.

DDS LOG


DDS (Ver_09-10-26.01) - NTFSx86
Run by HP_Owner at 19:36:48.39 on Tue 11/03/2009
Internet Explorer: 8.0.6001.18702
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.959.458 [GMT -8:00]

AV: AntiVir Desktop *On-access scanning enabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
C:\WINDOWS\system32\svchost -k rpcss
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k NetworkService
C:\WINDOWS\system32\svchost.exe -k LocalService
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\WINDOWS\system32\svchost.exe -k LocalService
C:\Program Files\Google\Update\1.2.183.13\GoogleCrashHandler.exe
C:\Program Files\LSI SoftModem\agrsmsvc.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\IObit\IObit Security 360\IS360srv.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
c:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wbem\unsecapp.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\System32\alg.exe
C:\windows\system\hpsysdrv.exe
C:\HP\KBD\KBD.EXE
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
C:\Documents and Settings\HP_Owner.YOUR-AE066C3A9B\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\HP_Owner.YOUR-AE066C3A9B\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\HP_Owner.YOUR-AE066C3A9B\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\HP_Owner.YOUR-AE066C3A9B\My Documents\Downloads\dds (1).scr
C:\WINDOWS\system32\wbem\wmiprvse.exe

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.google.com
uDefault_Search_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q404&bd=pavilion&pf=desktop
mStart Page = hxxp://www.google.com
mSearch Bar = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q404&bd=pavilion&pf=desktop
uInternet Settings,ProxyOverride = *.local
mURLSearchHooks: H - No File
BHO: {d22e38ed-2529-46df-94ed-b2829a6d258c} - ralasife.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No File
TB: {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - No File
TB: {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No File
uRun: [Google Update] "c:\documents and settings\hp_owner.your-ae066c3a9b\local settings\application data\google\update\GoogleUpdate.exe" /c
uRun: [Aim6]
mRun: [hpsysdrv] c:\windows\system\hpsysdrv.exe
mRun: [KBD] c:\hp\kbd\KBD.EXE
mRun: [Recguard] c:\windows\sminst\RECGUARD.EXE
mRun: [PS2] c:\windows\system32\ps2.exe
mRun: [Reminder] "c:\windows\creator\Remind_XP.exe"
mRun: [Ad-Watch] c:\program files\lavasoft\ad-aware\AAWTray.exe
mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRun: [Logitech Utility] Logi_MwX.Exe
mRun: [avgnt] "c:\program files\avira\antivir desktop\avgnt.exe" /min
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [keyesitez] Rundll32.exe "c:\windows\system32\suhahebu.dll",a
mRun: [kularusefa] Rundll32.exe "javavuso.dll",s
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: Add To HP Organize... - c:\progra~1\hewlet~1\hporga~1\bin\core.hp.main\SendTo.html
IE: E&xport to Microsoft Excel
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
DPF: {CAFEEFAC-0014-0002-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/products/plugin/autodl/jinstall-142-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
Handler: cetihpz - {CF184AD3-CDCB-4168-A3F7-8E447D129300} - c:\program files\hp\hpcoretech\comp\hpuiprot.dll
Notify: igfxcui - igfxsrvc.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SSODL: vahupegof - {c133b3b5-0960-4667-a265-6749ec63edb1} - No File
SSODL: gasovekam - {96b7629c-2aa0-4996-ab96-09ed9bc3f0c5} - No File
SSODL: yefajafeb - {e216b0c8-a2c3-4018-acc4-4d532cf10360} - No File
SSODL: gasurifiy - {f3f33ae0-77d6-412a-b007-b079ce57408c} - c:\windows\system32\migunugo.dll
SSODL: leyubuvif - {fec0dd6a-e5b7-4648-a133-5fd22f304250} - c:\windows\system32\niwaluyu.dll
SSODL: tunewopez - {2b6b865e-fa92-447b-962b-245e50e73baa} - c:\windows\system32\suhahebu.dll
STS: {c133b3b5-0960-4667-a265-6749ec63edb1} - No File
STS: {96b7629c-2aa0-4996-ab96-09ed9bc3f0c5} - No File
STS: {e216b0c8-a2c3-4018-acc4-4d532cf10360} - No File
STS: tokatiluy: {f3f33ae0-77d6-412a-b007-b079ce57408c} - c:\windows\system32\migunugo.dll
STS: mujuzedij: {fec0dd6a-e5b7-4648-a133-5fd22f304250} - c:\windows\system32\niwaluyu.dll
STS: kupuhivus: {2b6b865e-fa92-447b-962b-245e50e73baa} - c:\windows\system32\suhahebu.dll

============= SERVICES / DRIVERS ===============

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2009-5-19 64288]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\avira\antivir desktop\sched.exe [2009-10-24 108289]
R2 IS360service;IS360service;c:\program files\iobit\iobit security 360\is360srv.exe [2009-10-31 312592]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\AAWService.exe [2009-9-24 1179232]
S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2009-8-14 133104]

=============== Created Last 30 ================

2009-11-04 03:10:27 98816 ----a-w- c:\windows\sed.exe
2009-11-04 03:10:27 77312 ----a-w- c:\windows\MBR.exe
2009-11-04 03:10:27 236544 ----a-w- c:\windows\PEV.exe
2009-11-04 03:10:27 161792 ----a-w- c:\windows\SWREG.exe
2009-11-04 03:10:18 0 d-s---w- C:\ComboFix
2009-10-31 02:43:18 0 d-----w- c:\program files\ACW
2009-10-31 02:35:31 2577 ----a-w- c:\windows\system32\config.bak
2009-10-31 02:35:31 1688 ----a-w- c:\windows\system32\autoexec.bak
2009-10-29 15:02:49 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-10-29 15:02:46 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-10-29 15:02:46 0 d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-10-29 05:02:09 93360 ----a-w- c:\windows\system32\drivers\SBREDrv.sys
2009-10-29 05:00:42 0 dc-h--w- c:\docume~1\alluse~1\applic~1\{CFBD8779-FAAB-4357-84F2-1EC8619FADA6}
2009-10-26 02:11:30 0 d-----w- c:\docume~1\alluse~1\applic~1\IObit
2009-10-25 06:59:41 55656 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2009-10-25 06:59:36 0 d-----w- c:\program files\Avira
2009-10-25 06:59:36 0 d-----w- c:\docume~1\alluse~1\applic~1\Avira

==================== Find3M ====================

2009-10-29 05:02:02 15880 ----a-w- c:\windows\system32\lsdelete.exe
2009-09-23 12:55:23 64288 ----a-w- c:\windows\system32\drivers\Lbd.sys
2009-09-11 14:18:39 136192 ----a-w- c:\windows\system32\msv1_0.dll
2009-09-04 21:03:36 58880 ----a-w- c:\windows\system32\msasn1.dll
2009-08-31 04:45:04 30612 ---ha-w- c:\windows\system32\mlfcache.dat
2009-08-29 08:08:21 916480 ----a-w- c:\windows\system32\wininet.dll
2009-08-29 02:42:52 2065696 ----a-w- c:\windows\system32\usbaaplrc.dll
2009-08-26 08:00:21 247326 ----a-w- c:\windows\system32\strmdll.dll
2009-08-07 02:23:46 274288 ----a-w- c:\windows\system32\mucltui.dll
2009-08-07 02:23:46 215920 ----a-w- c:\windows\system32\muweb.dll
2009-07-31 03:41:41 89600 --sha-w- c:\windows\system32\zayezeru.dll
2009-08-04 02:42:20 60928 --sha-w- c:\windows\system32\zukepive.dll

============= FINISH: 19:37:48.54 ===============


End of DDS Log.

Thank you in advance for your time, I truly appreciate it!!

- Mandenbar

Attached Files



BC AdBot (Login to Remove)

 


#2 JSntgRvr

JSntgRvr

    Master Surgeon General


  • Malware Response Team
  • 11,210 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto Rico
  • Local time:08:14 PM

Posted 03 November 2009 - 11:26 PM

Hi, Mandenbar :(

Welcome.

Download GMER from Here. Note the file's name and save it to your root folder, such as C:\.
  • Disconnect from the Internet and close all running programs.
  • Temporarily disable any real-time active protection so your security program drivers will not conflict with this file.
  • Click on this link to see a list of programs that should be disabled.
  • Double-click on the downloaded file to start the program. (If running Vista, right click on it and select "Run as an Administrator")
  • Allow the driver to load if asked.
  • You may be prompted to scan immediately if it detects rootkit activity.
  • If you are prompted to scan your system click "No", save the log and post back the results.
  • If not prompted, click the "Rootkit/Malware" tab.
  • On the right-side, all items to be scanned should be checked by default except for "Show All". Leave that box unchecked.
  • Select all drives that are connected to your system to be scanned.
  • Click the Scan button to begin. (Please be patient as it can take some time to complete)
  • When the scan is finished, click Save to save the scan results to your Desktop.
  • Save the file as Results.log and copy/paste the contents in your next reply.
  • Exit the program and re-enable all active protection when done.

No request for help throughout private messaging will be attended.

If I have helped you, consider making a donation to help me continue the fight against Malware!
btn_donate_SM.gif


#3 Mandenbar

Mandenbar
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:05:14 PM

Posted 04 November 2009 - 11:22 AM

Hi JSntgRvr,

Thanks for your prompt attention and help, I truly appreciate it.

Here's the log:

GMER 1.0.15.15163 - http://www.gmer.net
Rootkit scan 2009-11-04 08:15:32
Windows 5.1.2600 Service Pack 3
Running: 5lldvkyp.exe; Driver: C:\DOCUME~1\HP_OWN~1.YOU\LOCALS~1\Temp\kfpirfoc.sys


---- System - GMER 1.0.15 ----

SSDT F7C55B46 ZwCreateKey
SSDT F7C55B3C ZwCreateThread
SSDT F7C55B4B ZwDeleteKey
SSDT F7C55B55 ZwDeleteValueKey
SSDT F7C55B5A ZwLoadKey
SSDT F7C55B28 ZwOpenProcess
SSDT F7C55B2D ZwOpenThread
SSDT F7C55B64 ZwReplaceKey
SSDT F7C55B5F ZwRestoreKey
SSDT F7C55B50 ZwSetValueKey
SSDT F7C55B37 ZwTerminateProcess

---- Kernel code sections - GMER 1.0.15 ----

? System32\Drivers\hiber_WMILIB.SYS The system cannot find the path specified. !

---- User code sections - GMER 1.0.15 ----

.text C:\WINDOWS\Explorer.EXE[1532] kernel32.dll!LoadLibraryExW + C4 7C801BB9 4 Bytes CALL 00FF0001
.text C:\WINDOWS\Explorer.EXE[1532] kernel32.dll!CreateProcessW 7C802336 6 Bytes JMP 5F0D0F5A
.text C:\WINDOWS\Explorer.EXE[1532] kernel32.dll!CreateProcessA 7C80236B 6 Bytes JMP 5F0A0F5A
.text C:\WINDOWS\Explorer.EXE[1532] ADVAPI32.dll!CreateProcessAsUserW 77DEA8A9 6 Bytes JMP 5F100F5A
.text C:\WINDOWS\Explorer.EXE[1532] ADVAPI32.dll!CreateProcessWithLogonW 77E15FFD 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\Explorer.EXE[1532] ADVAPI32.dll!CreateProcessWithLogonW + 4 77E16001 2 Bytes [05, 5F]
.text C:\windows\system\hpsysdrv.exe[2424] ntdll.dll!NtCreateKey 7C90D0EE 3 Bytes [FF, 25, 1E]
.text C:\windows\system\hpsysdrv.exe[2424] ntdll.dll!NtCreateKey + 4 7C90D0F2 2 Bytes [17, 5F] {POP SS; POP EDI}
.text C:\windows\system\hpsysdrv.exe[2424] ntdll.dll!NtSetValueKey 7C90DDCE 3 Bytes [FF, 25, 1E]
.text C:\windows\system\hpsysdrv.exe[2424] ntdll.dll!NtSetValueKey + 4 7C90DDD2 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\windows\system\hpsysdrv.exe[2424] kernel32.dll!LoadLibraryExW + C4 7C801BB9 4 Bytes CALL 00F80001
.text C:\windows\system\hpsysdrv.exe[2424] kernel32.dll!CreateProcessW 7C802336 6 Bytes JMP 5F0D0F5A
.text C:\windows\system\hpsysdrv.exe[2424] kernel32.dll!CreateProcessA 7C80236B 6 Bytes JMP 5F0A0F5A
.text C:\windows\system\hpsysdrv.exe[2424] ADVAPI32.dll!CreateProcessAsUserW 77DEA8A9 6 Bytes JMP 5F100F5A
.text C:\windows\system\hpsysdrv.exe[2424] ADVAPI32.dll!CreateProcessWithLogonW 77E15FFD 3 Bytes [FF, 25, 1E]
.text C:\windows\system\hpsysdrv.exe[2424] ADVAPI32.dll!CreateProcessWithLogonW + 4 77E16001 2 Bytes [05, 5F]
.text C:\windows\system\hpsysdrv.exe[2424] ADVAPI32.dll!CreateServiceA 77E37211 6 Bytes JMP 5F190F5A
.text C:\windows\system\hpsysdrv.exe[2424] ADVAPI32.dll!CreateServiceW 77E373A9 6 Bytes JMP 5F1C0F5A
.text C:\HP\KBD\KBD.EXE[2440] ntdll.dll!NtCreateKey 7C90D0EE 3 Bytes [FF, 25, 1E]
.text C:\HP\KBD\KBD.EXE[2440] ntdll.dll!NtCreateKey + 4 7C90D0F2 2 Bytes [17, 5F] {POP SS; POP EDI}
.text C:\HP\KBD\KBD.EXE[2440] ntdll.dll!NtSetValueKey 7C90DDCE 3 Bytes [FF, 25, 1E]
.text C:\HP\KBD\KBD.EXE[2440] ntdll.dll!NtSetValueKey + 4 7C90DDD2 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\HP\KBD\KBD.EXE[2440] kernel32.dll!LoadLibraryExW + C4 7C801BB9 4 Bytes CALL 009F0001
.text C:\HP\KBD\KBD.EXE[2440] kernel32.dll!CreateProcessW 7C802336 6 Bytes JMP 5F0D0F5A
.text C:\HP\KBD\KBD.EXE[2440] kernel32.dll!CreateProcessA 7C80236B 6 Bytes JMP 5F0A0F5A
.text C:\HP\KBD\KBD.EXE[2440] ADVAPI32.dll!CreateProcessAsUserW 77DEA8A9 6 Bytes JMP 5F100F5A
.text C:\HP\KBD\KBD.EXE[2440] ADVAPI32.dll!CreateProcessWithLogonW 77E15FFD 3 Bytes [FF, 25, 1E]
.text C:\HP\KBD\KBD.EXE[2440] ADVAPI32.dll!CreateProcessWithLogonW + 4 77E16001 2 Bytes [05, 5F]
.text C:\HP\KBD\KBD.EXE[2440] ADVAPI32.dll!CreateServiceA 77E37211 6 Bytes JMP 5F190F5A
.text C:\HP\KBD\KBD.EXE[2440] ADVAPI32.dll!CreateServiceW 77E373A9 6 Bytes JMP 5F1C0F5A
.text C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe[2504] ntdll.dll!NtCreateKey 7C90D0EE 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe[2504] ntdll.dll!NtCreateKey + 4 7C90D0F2 2 Bytes [17, 5F] {POP SS; POP EDI}
.text C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe[2504] ntdll.dll!NtSetValueKey 7C90DDCE 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe[2504] ntdll.dll!NtSetValueKey + 4 7C90DDD2 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe[2504] kernel32.dll!LoadLibraryExW + C4 7C801BB9 4 Bytes CALL 003F0001
.text C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe[2504] kernel32.dll!CreateProcessW 7C802336 6 Bytes JMP 5F0D0F5A
.text C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe[2504] kernel32.dll!CreateProcessA 7C80236B 6 Bytes JMP 5F0A0F5A
.text C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe[2504] ADVAPI32.dll!CreateProcessAsUserW 77DEA8A9 6 Bytes JMP 5F100F5A
.text C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe[2504] ADVAPI32.dll!CreateProcessWithLogonW 77E15FFD 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe[2504] ADVAPI32.dll!CreateProcessWithLogonW + 4 77E16001 2 Bytes [05, 5F]
.text C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe[2504] ADVAPI32.dll!CreateServiceA 77E37211 6 Bytes JMP 5F190F5A
.text C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe[2504] ADVAPI32.dll!CreateServiceW 77E373A9 6 Bytes JMP 5F1C0F5A
.text C:\WINDOWS\system32\RUNDLL32.EXE[2520] ntdll.dll!NtCreateKey 7C90D0EE 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\RUNDLL32.EXE[2520] ntdll.dll!NtCreateKey + 4 7C90D0F2 2 Bytes [17, 5F] {POP SS; POP EDI}
.text C:\WINDOWS\system32\RUNDLL32.EXE[2520] ntdll.dll!NtSetValueKey 7C90DDCE 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\RUNDLL32.EXE[2520] ntdll.dll!NtSetValueKey + 4 7C90DDD2 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\WINDOWS\system32\RUNDLL32.EXE[2520] kernel32.dll!LoadLibraryExW + C4 7C801BB9 4 Bytes CALL 00CB0001
.text C:\WINDOWS\system32\RUNDLL32.EXE[2520] kernel32.dll!CreateProcessW 7C802336 6 Bytes JMP 5F0D0F5A
.text C:\WINDOWS\system32\RUNDLL32.EXE[2520] kernel32.dll!CreateProcessA 7C80236B 6 Bytes JMP 5F0A0F5A
.text C:\WINDOWS\system32\RUNDLL32.EXE[2520] ADVAPI32.dll!CreateProcessAsUserW 77DEA8A9 6 Bytes JMP 5F100F5A
.text C:\WINDOWS\system32\RUNDLL32.EXE[2520] ADVAPI32.dll!CreateProcessWithLogonW 77E15FFD 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\RUNDLL32.EXE[2520] ADVAPI32.dll!CreateProcessWithLogonW + 4 77E16001 2 Bytes [05, 5F]
.text C:\WINDOWS\system32\RUNDLL32.EXE[2520] ADVAPI32.dll!CreateServiceA 77E37211 6 Bytes JMP 5F190F5A
.text C:\WINDOWS\system32\RUNDLL32.EXE[2520] ADVAPI32.dll!CreateServiceW 77E373A9 6 Bytes JMP 5F1C0F5A
.text C:\Program Files\Logitech\MouseWare\system\em_exec.exe[3020] ntdll.dll!NtCreateKey 7C90D0EE 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Logitech\MouseWare\system\em_exec.exe[3020] ntdll.dll!NtCreateKey + 4 7C90D0F2 2 Bytes [17, 5F] {POP SS; POP EDI}
.text C:\Program Files\Logitech\MouseWare\system\em_exec.exe[3020] ntdll.dll!NtSetValueKey 7C90DDCE 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Logitech\MouseWare\system\em_exec.exe[3020] ntdll.dll!NtSetValueKey + 4 7C90DDD2 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\Program Files\Logitech\MouseWare\system\em_exec.exe[3020] kernel32.dll!LoadLibraryExW + C4 7C801BB9 4 Bytes CALL 003F0001
.text C:\Program Files\Logitech\MouseWare\system\em_exec.exe[3020] kernel32.dll!CreateProcessW 7C802336 6 Bytes JMP 5F0D0F5A
.text C:\Program Files\Logitech\MouseWare\system\em_exec.exe[3020] kernel32.dll!CreateProcessA 7C80236B 6 Bytes JMP 5F0A0F5A
.text C:\Program Files\Logitech\MouseWare\system\em_exec.exe[3020] ADVAPI32.dll!CreateProcessAsUserW 77DEA8A9 6 Bytes JMP 5F100F5A
.text C:\Program Files\Logitech\MouseWare\system\em_exec.exe[3020] ADVAPI32.dll!CreateProcessWithLogonW 77E15FFD 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Logitech\MouseWare\system\em_exec.exe[3020] ADVAPI32.dll!CreateProcessWithLogonW + 4 77E16001 2 Bytes [05, 5F]
.text C:\Program Files\Logitech\MouseWare\system\em_exec.exe[3020] ADVAPI32.dll!CreateServiceA 77E37211 6 Bytes JMP 5F190F5A
.text C:\Program Files\Logitech\MouseWare\system\em_exec.exe[3020] ADVAPI32.dll!CreateServiceW 77E373A9 6 Bytes JMP 5F1C0F5A
.text C:\5lldvkyp.exe[4780] ntdll.dll!NtCreateKey 7C90D0EE 3 Bytes [FF, 25, 1E]
.text C:\5lldvkyp.exe[4780] ntdll.dll!NtCreateKey + 4 7C90D0F2 2 Bytes [17, 5F] {POP SS; POP EDI}
.text C:\5lldvkyp.exe[4780] ntdll.dll!NtSetValueKey 7C90DDCE 3 Bytes [FF, 25, 1E]
.text C:\5lldvkyp.exe[4780] ntdll.dll!NtSetValueKey + 4 7C90DDD2 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\5lldvkyp.exe[4780] kernel32.dll!LoadLibraryExW + C4 7C801BB9 4 Bytes CALL 003F0001
.text C:\5lldvkyp.exe[4780] kernel32.dll!CreateProcessW 7C802336 6 Bytes JMP 5F0D0F5A
.text C:\5lldvkyp.exe[4780] kernel32.dll!CreateProcessA 7C80236B 6 Bytes JMP 5F0A0F5A
.text C:\5lldvkyp.exe[4780] ADVAPI32.dll!CreateProcessAsUserW 77DEA8A9 6 Bytes JMP 5F100F5A
.text C:\5lldvkyp.exe[4780] ADVAPI32.dll!CreateProcessWithLogonW 77E15FFD 3 Bytes [FF, 25, 1E]
.text C:\5lldvkyp.exe[4780] ADVAPI32.dll!CreateProcessWithLogonW + 4 77E16001 2 Bytes [05, 5F]
.text C:\5lldvkyp.exe[4780] ADVAPI32.dll!CreateServiceA 77E37211 6 Bytes JMP 5F190F5A
.text C:\5lldvkyp.exe[4780] ADVAPI32.dll!CreateServiceW 77E373A9 6 Bytes JMP 5F1C0F5A

---- Devices - GMER 1.0.15 ----

AttachedDevice \Driver\Tcpip \Device\Tcp Lbd.sys (Boot Driver/Lavasoft AB)
AttachedDevice \FileSystem\Fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)

---- Registry - GMER 1.0.15 ----

Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@DeviceNotSelectedTimeout 15
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@GDIProcessHandleQuota 10000
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@Spooler yes
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@swapdisk
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@TransmissionRetryTimeout 90
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@USERProcessHandleQuota 10000
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@AppInit_DLLs zimizapa.dll c:\windows\system32\suhahebu.dll

---- EOF - GMER 1.0.15 ----

Thanks again!

#4 JSntgRvr

JSntgRvr

    Master Surgeon General


  • Malware Response Team
  • 11,210 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto Rico
  • Local time:08:14 PM

Posted 04 November 2009 - 11:37 AM

Please download ComboFix from Here or Here to your Desktop.

**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**
  • Please, never rename Combofix unless instructed.
  • Close any open browsers.
  • Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

    -----------------------------------------------------------

    • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
    • Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.

      -----------------------------------------------------------

    • Close any open browsers.
    • WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
    • Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
    • If there is no internet connection after running Combofix, then restart your computer to restore back your connection.

    -----------------------------------------------------------

    • Copy the entire contents of the Quote Box below to Notepad.
    • Name the file as CFScript.txt
    • Change the Save as Type to All Files
    • and Save it on the desktop

    File::
    c:\windows\system32\zayezeru.dll
    c:\windows\system32\zukepive.dll
    c:\windows\system32\migunugo.dll
    c:\windows\system32\niwaluyu.dll
    c:\windows\system32\suhahebu.dll
    c:\windows\system32\javavuso.dll
    c:\windows\system32\suhahebu.dll
    c:\windows\system32\ralasife.dll

    Registry::
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
    "AppInit_DLLs"=""


    Posted Image

    Once saved, referring to the picture above, drag CFScript.txt into ComboFix.exe.
  • If you receive a message that Combofix has detected the presence of rootkit activity and needs to reboot, kindly write down on paper the list of files present in the message before continuing, and post it in your next reply.
  • Install the Recovery Console upon request.
  • When finished, it will produce a report for you.
  • Please post the "C:\ComboFix.txt" along with a new HijackThis log for further review.
**Note: Do not mouseclick combofix's window while it's running. That may cause it to stall**

Note: ComboFix may reset a number of Internet Explorer's settings, including making it the default browser.
Note: Combofix prevents autorun of ALL CDs, floppies and USB devices to assist with malware removal & increase security.

Please do not install any new programs or update anything unless told to do so while we are fixing your problem.

No request for help throughout private messaging will be attended.

If I have helped you, consider making a donation to help me continue the fight against Malware!
btn_donate_SM.gif


#5 Mandenbar

Mandenbar
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:05:14 PM

Posted 04 November 2009 - 12:39 PM

ComboFix:

ComboFix 09-11-03.03 - HP_Owner 11/04/2009 9:06.3.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.959.443 [GMT -8:00]
Running from: c:\documents and settings\HP_Owner.YOUR-AE066C3A9B\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\HP_Owner.YOUR-AE066C3A9B\Desktop\CFScript.txt
AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
.

((((((((((((((((((((((((( Files Created from 2009-10-04 to 2009-11-04 )))))))))))))))))))))))))))))))
.

2009-11-04 06:20 . 2009-11-04 06:19 291328 ----a-w- C:\5lldvkyp.exe
2009-10-31 02:46 . 2009-10-31 02:46 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Temp
2009-10-31 02:43 . 2009-10-31 21:57 -------- d-----w- c:\program files\ACW
2009-10-31 02:41 . 2009-10-31 02:47 -------- d-sh--w- c:\windows\system32\config\systemprofile\PrivacIE
2009-10-29 15:02 . 2009-09-10 21:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-10-29 15:02 . 2009-10-31 23:25 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-10-29 15:02 . 2009-09-10 21:53 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-10-29 05:02 . 2009-10-29 05:02 93360 ----a-w- c:\windows\system32\drivers\SBREDrv.sys
2009-10-29 05:00 . 2009-10-29 05:00 -------- dc-h--w- c:\documents and settings\All Users\Application Data\{CFBD8779-FAAB-4357-84F2-1EC8619FADA6}
2009-10-26 02:11 . 2009-10-26 02:11 -------- d-----w- c:\documents and settings\All Users\Application Data\IObit
2009-10-25 06:59 . 2009-07-28 23:33 55656 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2009-10-25 06:59 . 2009-03-30 17:33 96104 ----a-w- c:\windows\system32\drivers\avipbb.sys
2009-10-25 06:59 . 2009-02-13 19:29 22360 ----a-w- c:\windows\system32\drivers\avgntmgr.sys
2009-10-25 06:59 . 2009-02-13 19:17 45416 ----a-w- c:\windows\system32\drivers\avgntdd.sys
2009-10-25 06:59 . 2009-10-25 06:59 -------- d-----w- c:\program files\Avira
2009-10-25 06:59 . 2009-10-25 06:59 -------- d-----w- c:\documents and settings\All Users\Application Data\Avira
2009-10-21 02:10 . 2009-10-21 02:10 -------- d-sh--w- c:\documents and settings\LocalService\IECompatCache

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-10-29 05:02 . 2009-05-20 18:20 15880 ----a-w- c:\windows\system32\lsdelete.exe
2009-10-26 02:11 . 2009-04-03 21:16 -------- d-----w- c:\program files\IObit
2009-10-26 02:06 . 2009-03-25 04:12 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-10-25 17:07 . 2008-09-01 19:34 -------- d-----w- c:\documents and settings\All Users\Application Data\avg8
2009-10-23 04:10 . 2009-06-13 19:21 -------- d-----w- c:\documents and settings\HP_Owner.YOUR-AE066C3A9B\Application Data\Azureus
2009-10-20 04:59 . 2009-06-13 19:28 -------- d-----w- c:\program files\PeerGuardian2
2009-10-18 18:53 . 2009-08-29 21:26 -------- d-----w- c:\program files\Vuze
2009-10-18 18:50 . 2007-06-19 02:37 -------- d-----w- c:\program files\Azureus
2009-10-16 23:45 . 2009-09-11 06:54 -------- d-----w- c:\documents and settings\HP_Owner.YOUR-AE066C3A9B\Application Data\Any Video Converter
2009-10-15 01:08 . 2004-08-07 21:20 -------- d-----w- c:\program files\iTunes
2009-10-15 01:07 . 2004-08-07 21:20 -------- d-----w- c:\program files\iPod
2009-10-04 22:11 . 2009-09-11 06:54 -------- d-----w- c:\program files\Any Video Converter
2009-10-04 06:05 . 2009-10-04 06:04 -------- d-----w- c:\documents and settings\HP_Owner.YOUR-AE066C3A9B\Application Data\Move Networks
2009-10-01 16:31 . 2004-08-07 19:36 -------- d-----w- c:\program files\Java
2009-09-23 12:55 . 2009-05-19 16:20 64288 ----a-w- c:\windows\system32\drivers\Lbd.sys
2009-09-11 14:18 . 2004-08-07 18:47 136192 ----a-w- c:\windows\system32\msv1_0.dll
2009-09-11 07:54 . 2009-05-19 07:18 -------- d-----w- c:\documents and settings\HP_Owner.YOUR-AE066C3A9B\Application Data\Apple Computer
2009-09-11 06:51 . 2009-09-11 06:50 -------- d-----w- c:\documents and settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}
2009-09-11 06:48 . 2004-08-07 21:20 -------- d-----w- c:\program files\QuickTime
2009-09-11 06:46 . 2007-11-18 18:49 -------- d-----w- c:\program files\Common Files\Apple
2009-09-11 06:34 . 2009-09-11 06:14 -------- d-----w- c:\program files\Common Files\AVSMedia
2009-09-11 06:34 . 2009-09-11 06:14 -------- d-----w- c:\program files\AVS4YOU
2009-09-11 06:19 . 2009-09-11 06:19 -------- d-----w- c:\documents and settings\HP_Owner.YOUR-AE066C3A9B\Application Data\AVS4YOU
2009-09-11 06:19 . 2009-09-11 06:19 -------- d-----w- c:\documents and settings\All Users\Application Data\AVS4YOU
2009-09-09 03:17 . 2008-08-08 04:06 -------- d-----w- c:\program files\Microsoft Silverlight
2009-09-09 03:15 . 2009-09-09 03:15 -------- d-----w- c:\program files\LSI SoftModem
2009-09-09 03:01 . 2009-09-09 03:01 -------- d-----w- c:\program files\microsoft frontpage
2009-09-07 23:46 . 2009-04-14 03:40 -------- d-----w- c:\program files\Bonjour
2009-09-07 17:30 . 2009-09-07 17:30 -------- d-----w- c:\documents and settings\Administrator\Application Data\Malwarebytes
2009-09-07 17:26 . 2009-09-07 17:26 -------- d-----w- c:\documents and settings\HP_Owner.YOUR-AE066C3A9B\Application Data\Motive
2009-09-04 21:03 . 2004-08-07 18:47 58880 ----a-w- c:\windows\system32\msasn1.dll
2009-08-31 04:45 . 2009-08-31 04:45 30612 ---ha-w- c:\windows\system32\mlfcache.dat
2009-08-29 08:08 . 2004-08-07 18:47 916480 ------w- c:\windows\system32\wininet.dll
2009-08-29 02:42 . 2009-05-20 05:42 40448 ----a-w- c:\windows\system32\drivers\usbaapl.sys
2009-08-29 02:42 . 2009-05-20 05:42 2065696 ----a-w- c:\windows\system32\usbaaplrc.dll
2009-08-26 08:00 . 2004-08-07 18:47 247326 ----a-w- c:\windows\system32\strmdll.dll
2009-08-13 22:07 . 2004-08-07 20:14 1163328 ----a-w- c:\windows\system32\drivers\AGRSM.sys
2009-08-07 02:24 . 2004-08-07 19:01 327896 ----a-w- c:\windows\system32\wucltui.dll
2009-08-07 02:24 . 2004-08-07 19:01 209632 ----a-w- c:\windows\system32\wuweb.dll
2009-08-07 02:24 . 2008-10-16 21:09 44768 ----a-w- c:\windows\system32\wups2.dll
2009-08-07 02:24 . 2004-08-07 19:01 35552 ----a-w- c:\windows\system32\wups.dll
2009-08-07 02:24 . 2004-08-07 19:01 53472 ------w- c:\windows\system32\wuauclt.exe
2009-08-07 02:24 . 2004-08-07 18:46 96480 ----a-w- c:\windows\system32\cdm.dll
2009-08-07 02:23 . 2004-08-07 19:01 575704 ----a-w- c:\windows\system32\wuapi.dll
2009-08-07 02:23 . 2009-08-09 17:44 274288 ----a-w- c:\windows\system32\mucltui.dll
2009-08-07 02:23 . 2009-08-09 17:44 215920 ----a-w- c:\windows\system32\muweb.dll
2009-08-07 02:23 . 2004-08-07 19:01 1929952 ----a-w- c:\windows\system32\wuaueng.dll
2002-11-19 22:01 . 2005-01-06 09:39 28672 ----a-w- c:\program files\opera\program\plugins\PlugDef.dll
2009-07-31 03:41 . 2009-07-31 03:41 89600 --sha-w- c:\windows\system32\zayezeru.dll
2009-08-04 02:42 . 2009-08-04 02:42 60928 --sha-w- c:\windows\system32\zukepive.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Google Update"="c:\documents and settings\HP_Owner.YOUR-AE066C3A9B\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2009-05-20 133104]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"hpsysdrv"="c:\windows\system\hpsysdrv.exe" [1998-05-07 52736]
"KBD"="c:\hp\KBD\KBD.EXE" [2003-02-12 61440]
"Recguard"="c:\windows\SMINST\RECGUARD.EXE" [2004-04-15 233472]
"PS2"="c:\windows\system32\ps2.exe" [2002-10-16 81920]
"Reminder"="c:\windows\Creator\Remind_XP.exe" [2003-12-18 118784]
"Ad-Watch"="c:\program files\Lavasoft\Ad-Aware\AAWTray.exe" [2009-10-29 788368]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-03-28 86016]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-03-28 13684736]
"Logitech Utility"="Logi_MwX.Exe" - c:\windows\LOGI_MWX.EXE [2003-12-17 19968]

c:\documents and settings\HP_Owner\Start Menu\Programs\Startup\
BOINC Manager.lnk - c:\program files\BOINC\boincmgr.exe [2008-3-4 4150016]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Updates from HP\\309731\\Program\\Updates from HP.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\World of Warcraft\\Launcher.exe"=
"c:\\Program Files\\World of Warcraft\\Repair.exe"=
"c:\\Program Files\\World of Warcraft\\BackgroundDownloader.exe"=
"c:\\Program Files\\World of Warcraft\\BNUpdate.exe"=
"c:\\Program Files\\Azureus\\Azureus.exe"=
"c:\\Program Files\\AIM6\\aim6.exe"=
"c:\\Program Files\\World of Warcraft\\WoW-3.1.3.9947-to-3.2.0.10192-enUS-downloader.exe"=
"c:\\Program Files\\Curse\\CurseClient.exe"=
"c:\\Program Files\\World of Warcraft\\WoW-3.2.0.10192-to-3.2.0.10314-enUS-downloader.exe"=
"c:\\Program Files\\Vuze\\Azureus.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Documents and Settings\\HP_Owner.YOUR-AE066C3A9B\\Local Settings\\Application Data\\Google\\Chrome\\Application\\chrome.exe"=
"c:\\Documents and Settings\\HP_Owner.YOUR-AE066C3A9B\\My Documents\\Downloads\\mbam-setup (1).exe"=
"c:\\Program Files\\HP\\hpcoretech\\comp\\hptskmgr.exe"=
"c:\\Program Files\\iPod\\bin\\iPodService.exe"=
"c:\\WINDOWS\\system32\\wbem\\wmiprvse.exe"=
"c:\\Program Files\\Avira\\AntiVir Desktop\\avguard.exe"=
"c:\\WINDOWS\\system32\\wbem\\unsecapp.exe"=
"c:\\WINDOWS\\system32\\spoolsv.exe"=
"c:\\Program Files\\Common Files\\Apple\\Mobile Device Support\\bin\\AppleMobileDeviceService.exe"=
"c:\\AV-CLS\\WGET.EXE"=
"c:\\Program Files\\Google\\Update\\1.2.183.13\\GoogleCrashHandler.exe"=
"c:\\Program Files\\Common Files\\Microsoft Shared\\VS7DEBUG\\MDM.EXE"=

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [5/19/2009 8:20 AM 64288]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [10/24/2009 10:59 PM 108289]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [9/24/2009 3:17 AM 1179232]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [8/14/2009 1:31 PM 133104]
S2 IS360service;IS360service;c:\program files\IObit\IObit Security 360\is360srv.exe [10/31/2009 3:32 PM 312592]

--- Other Services/Drivers In Memory ---

*NewlyCreated* - KFPIRFOC
*NewlyCreated* - ROOTREPEAL1
*Deregistered* - kfpirfoc
*Deregistered* - mbr
*Deregistered* - PROCEXP113
*Deregistered* - rootrepeal1
.
Contents of the 'Scheduled Tasks' folder

2009-11-04 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-10-01 05:01]

2009-10-29 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-04-12 19:34]

2009-10-31 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2007-01-04 19:18]

2009-11-04 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-08-14 21:31]

2009-11-04 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-08-14 21:31]

2009-11-04 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3142469487-4006317816-1449478044-1009.job
- c:\documents and settings\HP_Owner\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2008-09-03 02:52]

2009-11-04 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-570519193-866217441-3793752732-1009Core.job
- c:\documents and settings\HP_Owner.YOUR-AE066C3A9B\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-05-20 03:12]

2009-11-04 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-570519193-866217441-3793752732-1009UA.job
- c:\documents and settings\HP_Owner.YOUR-AE066C3A9B\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-05-20 03:12]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com
uDefault_Search_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q404&bd=pavilion&pf=desktop
mStart Page = hxxp://www.google.com
mSearch Bar = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q404&bd=pavilion&pf=desktop
uInternet Settings,ProxyOverride = *.local
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: Add To HP Organize... - c:\progra~1\HEWLET~1\HPORGA~1\bin\core.hp.main\SendTo.html
IE: E&xport to Microsoft Excel
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-11-04 09:12
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(5768)
c:\windows\system32\WININET.dll
c:\program files\Logitech\MouseWare\System\LgWndHk.dll
c:\program files\Common Files\Logitech\Scrolling\LgMsgHk.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Completion time: 2009-11-04 9:14
ComboFix-quarantined-files.txt 2009-11-04 17:14
ComboFix2.txt 2009-11-04 17:01

Pre-Run: 13,491,073,024 bytes free
Post-Run: 13,469,683,712 bytes free

HiJackThis:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:37:49 AM, on 11/4/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\Program Files\Google\Update\1.2.183.13\GoogleCrashHandler.exe
C:\Program Files\LSI SoftModem\agrsmsvc.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\system32\nvsvc32.exe
c:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\windows\system\hpsysdrv.exe
C:\HP\KBD\KBD.EXE
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\explorer.exe
C:\Documents and Settings\HP_Owner.YOUR-AE066C3A9B\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\HP_Owner.YOUR-AE066C3A9B\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a...&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a...&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [Reminder] "C:\Windows\Creator\Remind_XP.exe"
O4 - HKLM\..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\HP_Owner.YOUR-AE066C3A9B\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200
O8 - Extra context menu item: Add To HP Organize... - C:\PROGRA~1\HEWLET~1\HPORGA~1\bin\core.hp.main\SendTo.html
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - LSI Corporation - C:\Program Files\LSI SoftModem\agrsmsvc.exe
O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Unknown owner - C:\Program Files\Bonjour\mDNSResponder.exe (file missing)
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: IS360service - IObit - C:\Program Files\IObit\IObit Security 360\IS360srv.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

--
End of file - 5721 bytes

#6 JSntgRvr

JSntgRvr

    Master Surgeon General


  • Malware Response Team
  • 11,210 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto Rico
  • Local time:08:14 PM

Posted 04 November 2009 - 03:45 PM

  • Copy the entire contents of the Quote Box below to Notepad.
  • Name the file as CFScript.txt
  • Change the Save as Type to All Files
  • and Save it on the desktop

File::
c:\windows\system32\zayezeru.dll
c:\windows\system32\zukepive.dll


Posted Image

Once saved, referring to the picture above, drag CFScript.txt into ComboFix.exe, and post back the resulting report.

Please do an online scan with Kaspersky WebScanner

Kaspersky online scanner uses JAVA tecnology to perform the scan. If you do not have the latest JAVA version, follow the instrutions below under Upgrading Java, to download and install the latest vesion.
  • Read through the requirements and privacy statement and click on Accept button.
  • It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
  • When the downloads have finished, click on Settings.
  • Make sure the following is checked.
    • Spyware, Adware, Dialers, and other potentially dangerous programs
      Archives
      Mail databases
  • Click on My Computer under Scan.
  • Once the scan is complete, it will display the results. Click on View Scan Report.
  • You will see a list of infected items there. Click on Save Report As....
  • Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button.
  • Please post this log in your next reply.
Attention! Kaspersky Online Scanner 7.0 may fail to start if another anti-virus program is already installed and running on your computer. Please deactivate the anti-virus software installed on your computer prior to starting Kaspersky Online Scanner 7.0.

Upgrading Java:
  • Download the latest version of Java SE Runtime Environment (JRE)JRE 6 Update 17.
  • Click the "Download" button to the right.
  • Select your Platform and check the box that says: "I agree to the Java SE Runtime Environment 6 License Agreement.".
  • Click on Continue.
  • Click on the link to download Windows Offline Installation (jre-6u17-windows-i586.exe) and save it to your desktop. Do NOT use the Sun Download Manager..
  • Close any programs you may have running - especially your web browser.
  • Go to Start > Control Panel, double-click on Add/Remove programs and remove all older versions of Java.
  • Check any item with Java Runtime Environment (JRE or J2SE) in the name.
  • Click the Remove or Change/Remove button.
  • Repeat as many times as necessary to remove each Java version.
  • Reboot your computer once all Java components are removed.
  • Then from your desktop double-click on the download to install the newest version.(Vista users, right click on the jre-6u17-windows-i586.exe and select "Run as an Administrator.")

No request for help throughout private messaging will be attended.

If I have helped you, consider making a donation to help me continue the fight against Malware!
btn_donate_SM.gif


#7 Mandenbar

Mandenbar
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:05:14 PM

Posted 04 November 2009 - 04:00 PM

So I completely misunderstood what you meant in your 2nd to last post telling me to copy the entire contents of the "quote box" and saving it to drag onto the ComboFix application. I believe I simply saved the contents of the ComboFix report, then drug those onto the ComboFix application instead. My question is, would you like me to go back and start from the large "quote box" that you supplied me with (containing several dll's and the registry line) and to the process correctly from there, or continue using the most recent one (containing just the 2 dll's). I'm aware that doing this in the correct order is important; hence my question. Thank you!

#8 JSntgRvr

JSntgRvr

    Master Surgeon General


  • Malware Response Team
  • 11,210 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto Rico
  • Local time:08:14 PM

Posted 04 November 2009 - 04:29 PM

The first CfScript.txt was already ran. You need to create another one with the information provided, overwrite the previous one and drag the new CFScript.txt into Combofix.

No request for help throughout private messaging will be attended.

If I have helped you, consider making a donation to help me continue the fight against Malware!
btn_donate_SM.gif


#9 Mandenbar

Mandenbar
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:05:14 PM

Posted 05 November 2009 - 11:20 AM

New ComboFix report

ComboFix 09-11-04.02 - HP_Owner 11/04/2009 21:21.5.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.959.566 [GMT -8:00]
Running from: c:\documents and settings\HP_Owner.YOUR-AE066C3A9B\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\HP_Owner.YOUR-AE066C3A9B\Desktop\CFScript.txt
AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}

FILE ::
"c:\windows\system32\zayezeru.dll"
"c:\windows\system32\zukepive.dll"
.

((((((((((((((((((((((((( Files Created from 2009-10-05 to 2009-11-05 )))))))))))))))))))))))))))))))
.

2009-11-04 06:20 . 2009-11-04 06:19 291328 ----a-w- C:\5lldvkyp.exe
2009-10-31 02:46 . 2009-10-31 02:46 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Temp
2009-10-31 02:43 . 2009-10-31 21:57 -------- d-----w- c:\program files\ACW
2009-10-31 02:41 . 2009-10-31 02:47 -------- d-sh--w- c:\windows\system32\config\systemprofile\PrivacIE
2009-10-29 15:02 . 2009-09-10 21:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-10-29 15:02 . 2009-10-31 23:25 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-10-29 15:02 . 2009-09-10 21:53 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-10-29 05:02 . 2009-10-29 05:02 93360 ----a-w- c:\windows\system32\drivers\SBREDrv.sys
2009-10-29 05:02 . 2009-10-29 05:02 93360 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\Drivers\SBREDrv.sys
2009-10-29 05:02 . 2009-10-29 05:02 554280 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\sbap.dll
2009-10-29 05:02 . 2009-10-29 05:02 537576 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\aawapi.dll
2009-10-29 05:02 . 2009-10-29 05:02 283944 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\Vipre.dll
2009-10-29 05:02 . 2009-10-29 05:02 212480 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\VipreBridge.dll
2009-10-29 05:01 . 2009-10-29 05:01 1223976 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\SBTE.dll
2009-10-29 05:01 . 2009-10-29 05:01 242984 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\SBRE.dll
2009-10-29 05:00 . 2009-10-29 05:00 -------- dc-h--w- c:\documents and settings\All Users\Application Data\{CFBD8779-FAAB-4357-84F2-1EC8619FADA6}
2009-10-29 05:00 . 2009-10-03 08:15 2924848 -c--a-w- c:\documents and settings\All Users\Application Data\{CFBD8779-FAAB-4357-84F2-1EC8619FADA6}\Ad-AwareInstallation.exe
2009-10-26 02:11 . 2009-10-26 02:11 -------- d-----w- c:\documents and settings\All Users\Application Data\IObit
2009-10-25 06:59 . 2009-07-28 23:33 55656 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2009-10-25 06:59 . 2009-03-30 17:33 96104 ----a-w- c:\windows\system32\drivers\avipbb.sys
2009-10-25 06:59 . 2009-02-13 19:29 22360 ----a-w- c:\windows\system32\drivers\avgntmgr.sys
2009-10-25 06:59 . 2009-02-13 19:17 45416 ----a-w- c:\windows\system32\drivers\avgntdd.sys
2009-10-25 06:59 . 2009-10-25 06:59 -------- d-----w- c:\program files\Avira
2009-10-25 06:59 . 2009-10-25 06:59 -------- d-----w- c:\documents and settings\All Users\Application Data\Avira
2009-10-23 04:08 . 2009-10-23 04:08 10628032 ----a-w- c:\documents and settings\HP_Owner.YOUR-AE066C3A9B\Application Data\Azureus\tmp\AZU3406225635294847877.tmp\Vuze_4.2.0.8b_win32.exe
2009-10-21 02:10 . 2009-10-21 02:10 -------- d-sh--w- c:\documents and settings\LocalService\IECompatCache
2009-10-15 00:58 . 2009-10-15 00:58 79144 ----a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 9.0.1.8\SetupAdmin.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-11-02 03:53 . 2009-06-07 00:08 1 ----a-w- c:\documents and settings\HP_Owner.YOUR-AE066C3A9B\Application Data\OpenOffice.org\3\user\uno_packages\cache\stamp.sys
2009-10-29 05:02 . 2009-06-20 18:17 862040 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\threatwork.exe
2009-10-29 05:02 . 2009-06-20 18:17 206944 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\lavamessage.dll
2009-10-29 05:02 . 2009-05-27 19:21 15880 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\lsdelete.exe
2009-10-29 05:02 . 2009-05-20 18:20 15880 ----a-w- c:\windows\system32\lsdelete.exe
2009-10-29 05:02 . 2009-06-20 18:17 390288 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\lavalicense.dll
2009-10-29 05:02 . 2009-06-20 18:17 370744 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\UpdateManager.dll
2009-10-29 05:01 . 2009-06-20 18:17 194104 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\Savapibridge.dll
2009-10-29 05:01 . 2009-05-27 19:21 163728 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\ShellExt.dll
2009-10-29 05:01 . 2009-06-20 18:17 5908024 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\Resources.dll
2009-10-29 05:01 . 2009-05-27 19:21 327000 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\RPAPI.dll
2009-10-29 05:01 . 2009-05-27 19:21 87496 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\PrivacyClean.dll
2009-10-29 05:01 . 2009-06-20 18:17 933120 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\CEAPI.dll
2009-10-29 05:01 . 2009-09-25 04:53 640608 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\AutoLaunch.exe
2009-10-29 05:01 . 2009-06-20 18:17 815760 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\Ad-AwareCommand.exe
2009-10-29 05:01 . 2009-06-20 18:17 822904 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\Ad-AwareAdmin.exe
2009-10-29 05:01 . 2009-06-20 18:16 1638104 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\Ad-Aware.exe
2009-10-29 05:01 . 2009-06-20 18:16 788368 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\AAWTray.exe
2009-10-29 05:01 . 2009-06-20 18:16 1179232 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\AAWService.exe
2009-10-26 02:11 . 2009-04-03 21:16 -------- d-----w- c:\program files\IObit
2009-10-26 02:06 . 2009-03-25 04:12 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-10-25 17:07 . 2008-09-01 19:34 -------- d-----w- c:\documents and settings\All Users\Application Data\avg8
2009-10-23 04:10 . 2009-06-13 19:21 -------- d-----w- c:\documents and settings\HP_Owner.YOUR-AE066C3A9B\Application Data\Azureus
2009-10-20 04:59 . 2009-06-13 19:28 -------- d-----w- c:\program files\PeerGuardian2
2009-10-18 18:53 . 2009-08-29 21:26 -------- d-----w- c:\program files\Vuze
2009-10-18 18:50 . 2007-06-19 02:37 -------- d-----w- c:\program files\Azureus
2009-10-16 23:45 . 2009-09-11 06:54 -------- d-----w- c:\documents and settings\HP_Owner.YOUR-AE066C3A9B\Application Data\Any Video Converter
2009-10-15 01:08 . 2004-08-07 21:20 -------- d-----w- c:\program files\iTunes
2009-10-15 01:07 . 2004-08-07 21:20 -------- d-----w- c:\program files\iPod
2009-10-04 22:11 . 2009-09-11 06:54 -------- d-----w- c:\program files\Any Video Converter
2009-10-04 06:05 . 2009-10-04 06:04 -------- d-----w- c:\documents and settings\HP_Owner.YOUR-AE066C3A9B\Application Data\Move Networks
2009-10-04 06:04 . 2009-10-04 06:04 127872 ----a-w- c:\documents and settings\HP_Owner.YOUR-AE066C3A9B\Application Data\Move Networks\uninstall.exe
2009-10-04 06:04 . 2009-06-16 06:35 4183416 ----a-w- c:\documents and settings\HP_Owner.YOUR-AE066C3A9B\Application Data\Move Networks\plugins\npqmp071503000010.dll
2009-10-04 01:59 . 2009-06-13 19:23 7154255 ----a-w- c:\documents and settings\HP_Owner.YOUR-AE066C3A9B\Application Data\Azureus\plugins\azemp\azmplay.exe
2009-10-04 01:58 . 2009-08-09 19:03 10686001 ----a-w- c:\documents and settings\HP_Owner.YOUR-AE066C3A9B\Application Data\Azureus\plugins\azump\mplayer.exe
2009-10-01 16:31 . 2004-08-07 19:36 -------- d-----w- c:\program files\Java
2009-10-01 16:29 . 2009-10-01 16:29 152576 ----a-w- c:\documents and settings\HP_Owner.YOUR-AE066C3A9B\Application Data\Sun\Java\jre1.6.0_15\lzma.dll
2009-09-25 04:53 . 2009-09-25 04:53 17632 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\WSCUpdate.dll
2009-09-25 04:53 . 2009-03-05 04:51 68640 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\Drivers\64\lbd.sys
2009-09-25 04:53 . 2009-03-05 04:51 303976 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\Drivers\64\AAWDriverTool.exe
2009-09-25 04:53 . 2009-06-20 18:16 640760 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\AAWWSC.exe
2009-09-23 12:55 . 2009-05-19 16:20 64288 ----a-w- c:\windows\system32\drivers\Lbd.sys
2009-09-11 14:18 . 2004-08-07 18:47 136192 ----a-w- c:\windows\system32\msv1_0.dll
2009-09-11 07:54 . 2009-05-19 07:18 -------- d-----w- c:\documents and settings\HP_Owner.YOUR-AE066C3A9B\Application Data\Apple Computer
2009-09-11 06:51 . 2009-09-11 06:50 -------- d-----w- c:\documents and settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}
2009-09-11 06:48 . 2004-08-07 21:20 -------- d-----w- c:\program files\QuickTime
2009-09-11 06:46 . 2007-11-18 18:49 -------- d-----w- c:\program files\Common Files\Apple
2009-09-11 06:34 . 2009-09-11 06:14 -------- d-----w- c:\program files\Common Files\AVSMedia
2009-09-11 06:34 . 2009-09-11 06:14 -------- d-----w- c:\program files\AVS4YOU
2009-09-11 06:19 . 2009-09-11 06:19 -------- d-----w- c:\documents and settings\HP_Owner.YOUR-AE066C3A9B\Application Data\AVS4YOU
2009-09-11 06:19 . 2009-09-11 06:19 -------- d-----w- c:\documents and settings\All Users\Application Data\AVS4YOU
2009-09-09 03:17 . 2008-08-08 04:06 -------- d-----w- c:\program files\Microsoft Silverlight
2009-09-09 03:15 . 2009-09-09 03:15 -------- d-----w- c:\program files\LSI SoftModem
2009-09-09 03:01 . 2009-09-09 03:01 -------- d-----w- c:\program files\microsoft frontpage
2009-09-07 23:46 . 2009-04-14 03:40 -------- d-----w- c:\program files\Bonjour
2009-09-07 17:30 . 2009-09-07 17:30 -------- d-----w- c:\documents and settings\Administrator\Application Data\Malwarebytes
2009-09-07 17:26 . 2009-09-07 17:26 -------- d-----w- c:\documents and settings\HP_Owner.YOUR-AE066C3A9B\Application Data\Motive
2009-09-04 21:03 . 2004-08-07 18:47 58880 ----a-w- c:\windows\system32\msasn1.dll
2009-08-31 04:45 . 2009-08-31 04:45 30612 ---ha-w- c:\windows\system32\mlfcache.dat
2009-08-29 08:08 . 2004-08-07 18:47 916480 ------w- c:\windows\system32\wininet.dll
2009-08-29 02:42 . 2009-05-20 05:42 40448 ----a-w- c:\windows\system32\drivers\usbaapl.sys
2009-08-29 02:42 . 2009-05-20 05:42 2065696 ----a-w- c:\windows\system32\usbaaplrc.dll
2009-08-26 08:00 . 2004-08-07 18:47 247326 ----a-w- c:\windows\system32\strmdll.dll
2009-08-13 22:07 . 2004-08-07 20:14 1163328 ----a-w- c:\windows\system32\drivers\AGRSM.sys
2002-11-19 22:01 . 2005-01-06 09:39 28672 ----a-w- c:\program files\opera\program\plugins\PlugDef.dll
.

((((((((((((((((((((((((((((( SnapShot@2009-11-04_16.55.47 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-11-05 05:01 . 2009-11-05 05:01 16384 c:\windows\temp\Perflib_Perfdata_190.dat
+ 2009-11-04 03:24 . 2009-11-05 05:02 32768 c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
- 2009-11-04 03:24 . 2009-11-04 03:34 32768 c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
+ 2009-10-31 23:02 . 2009-11-05 05:02 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
- 2009-10-31 23:02 . 2009-11-04 03:34 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Google Update"="c:\documents and settings\HP_Owner.YOUR-AE066C3A9B\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2009-05-20 133104]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"hpsysdrv"="c:\windows\system\hpsysdrv.exe" [1998-05-07 52736]
"KBD"="c:\hp\KBD\KBD.EXE" [2003-02-12 61440]
"Recguard"="c:\windows\SMINST\RECGUARD.EXE" [2004-04-15 233472]
"PS2"="c:\windows\system32\ps2.exe" [2002-10-16 81920]
"Reminder"="c:\windows\Creator\Remind_XP.exe" [2003-12-18 118784]
"Ad-Watch"="c:\program files\Lavasoft\Ad-Aware\AAWTray.exe" [2009-10-29 788368]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-03-28 86016]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-03-28 13684736]
"Logitech Utility"="Logi_MwX.Exe" - c:\windows\LOGI_MWX.EXE [2003-12-17 19968]

c:\documents and settings\HP_Owner\Start Menu\Programs\Startup\
BOINC Manager.lnk - c:\program files\BOINC\boincmgr.exe [2008-3-4 4150016]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Updates from HP\\309731\\Program\\Updates from HP.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\World of Warcraft\\Launcher.exe"=
"c:\\Program Files\\World of Warcraft\\Repair.exe"=
"c:\\Program Files\\World of Warcraft\\BackgroundDownloader.exe"=
"c:\\Program Files\\World of Warcraft\\BNUpdate.exe"=
"c:\\Program Files\\Azureus\\Azureus.exe"=
"c:\\Program Files\\AIM6\\aim6.exe"=
"c:\\Program Files\\World of Warcraft\\WoW-3.1.3.9947-to-3.2.0.10192-enUS-downloader.exe"=
"c:\\Program Files\\Curse\\CurseClient.exe"=
"c:\\Program Files\\World of Warcraft\\WoW-3.2.0.10192-to-3.2.0.10314-enUS-downloader.exe"=
"c:\\Program Files\\Vuze\\Azureus.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Documents and Settings\\HP_Owner.YOUR-AE066C3A9B\\Local Settings\\Application Data\\Google\\Chrome\\Application\\chrome.exe"=
"c:\\Documents and Settings\\HP_Owner.YOUR-AE066C3A9B\\My Documents\\Downloads\\mbam-setup (1).exe"=
"c:\\Program Files\\HP\\hpcoretech\\comp\\hptskmgr.exe"=
"c:\\Program Files\\iPod\\bin\\iPodService.exe"=
"c:\\WINDOWS\\system32\\wbem\\wmiprvse.exe"=
"c:\\Program Files\\Avira\\AntiVir Desktop\\avguard.exe"=
"c:\\WINDOWS\\system32\\wbem\\unsecapp.exe"=
"c:\\WINDOWS\\system32\\spoolsv.exe"=
"c:\\Program Files\\Common Files\\Apple\\Mobile Device Support\\bin\\AppleMobileDeviceService.exe"=
"c:\\AV-CLS\\WGET.EXE"=
"c:\\Program Files\\Google\\Update\\1.2.183.13\\GoogleCrashHandler.exe"=
"c:\\Program Files\\Common Files\\Microsoft Shared\\VS7DEBUG\\MDM.EXE"=

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [5/19/2009 8:20 AM 64288]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [10/24/2009 10:59 PM 108289]
R2 IS360service;IS360service;c:\program files\IObit\IObit Security 360\is360srv.exe [10/31/2009 3:32 PM 312592]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [9/24/2009 3:17 AM 1179232]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [8/14/2009 1:31 PM 133104]

--- Other Services/Drivers In Memory ---

*Deregistered* - mbr
*Deregistered* - PROCEXP113
.
Contents of the 'Scheduled Tasks' folder

2009-11-05 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-10-01 05:01]

2009-10-29 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-04-12 19:34]

2009-10-31 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2007-01-04 19:18]

2009-11-05 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-08-14 21:31]

2009-11-04 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-08-14 21:31]

2009-11-04 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3142469487-4006317816-1449478044-1009.job
- c:\documents and settings\HP_Owner\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2008-09-03 02:52]

2009-11-04 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-570519193-866217441-3793752732-1009Core.job
- c:\documents and settings\HP_Owner.YOUR-AE066C3A9B\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-05-20 03:12]

2009-11-04 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-570519193-866217441-3793752732-1009UA.job
- c:\documents and settings\HP_Owner.YOUR-AE066C3A9B\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-05-20 03:12]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com
uDefault_Search_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q404&bd=pavilion&pf=desktop
mStart Page = hxxp://www.google.com
mSearch Bar = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q404&bd=pavilion&pf=desktop
uInternet Settings,ProxyOverride = *.local
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: Add To HP Organize... - c:\progra~1\HEWLET~1\HPORGA~1\bin\core.hp.main\SendTo.html
IE: E&xport to Microsoft Excel
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-11-04 21:27
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(2928)
c:\windows\system32\WININET.dll
c:\program files\Logitech\MouseWare\System\LgWndHk.dll
c:\windows\system32\ieframe.dll
c:\program files\Common Files\Logitech\Scrolling\LgMsgHk.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Completion time: 2009-11-05 21:29
ComboFix-quarantined-files.txt 2009-11-05 05:29
ComboFix2.txt 2009-11-05 05:19
ComboFix3.txt 2009-11-04 17:14
ComboFix4.txt 2009-11-04 17:01

Pre-Run: 13,463,601,152 bytes free
Post-Run: 13,446,619,136 bytes free

Kaspersky Report

--------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER 7.0: scan report
Thursday, November 5, 2009
Operating system: Microsoft Windows XP Home Edition Service Pack 3 (build 2600)
Kaspersky Online Scanner version: 7.0.26.13
Last database update: Thursday, November 05, 2009 05:01:12
Records in database: 3134310
--------------------------------------------------------------------------------

Scan settings:
scan using the following database: extended
Scan archives: yes
Scan e-mail databases: yes

Scan area - My Computer:
C:\
D:\
E:\
F:\
G:\
H:\
I:\
J:\

Scan statistics:
Objects scanned: 174906
Threats found: 9
Infected objects found: 11
Suspicious objects found: 2
Scan duration: 06:38:36


File name / Threat / Threats count
C:\Eudora\In.mbx Suspicious: Exploit.HTML.Iframe.FileDownload 1
C:\Eudora\In.mbx Infected: Trojan-Spy.HTML.Paylap.bg 1
C:\Eudora\In.mbx Suspicious: Trojan-Spy.HTML.Fraud.gen 1
C:\Eudora\Trash.mbx Infected: Trojan-Dropper.VBS.Zerolin 1
C:\Qoobox\Quarantine\C\WINDOWS\system32\dukeyiwa.dll.vir Infected: Trojan.Win32.Monder.curj 1
C:\Qoobox\Quarantine\C\WINDOWS\system32\huhugafe.dll.vir Infected: Trojan.Win32.Monder.cuse 1
C:\Qoobox\Quarantine\C\WINDOWS\system32\namogizu.dll.vir Infected: Trojan.Win32.Monder.cuum 1
C:\System Volume Information\_restore{E7B21304-9105-4D9D-AFAC-E7088FDCC6A0}\RP152\A0021732.dll Infected: Trojan.Win32.Monder.curj 1
C:\System Volume Information\_restore{E7B21304-9105-4D9D-AFAC-E7088FDCC6A0}\RP153\A0021812.dll Infected: Trojan.Win32.Monder.curj 1
C:\System Volume Information\_restore{E7B21304-9105-4D9D-AFAC-E7088FDCC6A0}\RP153\A0021886.dll Infected: Trojan.Win32.Monder.cuqy 1
C:\System Volume Information\_restore{E7B21304-9105-4D9D-AFAC-E7088FDCC6A0}\RP154\A0022000.dll Infected: Trojan.Win32.Monder.cusx 1
C:\System Volume Information\_restore{E7B21304-9105-4D9D-AFAC-E7088FDCC6A0}\RP154\A0022097.dll Infected: Trojan.Win32.Monder.curj 1
C:\System Volume Information\_restore{E7B21304-9105-4D9D-AFAC-E7088FDCC6A0}\RP154\A0022098.dll Infected: Trojan.Win32.Monder.cuse 1

Selected area has been scanned.

#10 JSntgRvr

JSntgRvr

    Master Surgeon General


  • Malware Response Team
  • 11,210 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto Rico
  • Local time:08:14 PM

Posted 05 November 2009 - 12:16 PM

Reset and Re-enable your System Restore to remove bad files that have been backed up by Windows. The files in System Restore are protected to prevent any programmes changing them. This is the only way to clean these files: (You will lose all previous restore points which are likely to be infected.)

To reset your restore points, please note that you will need to log into your computer with an account which has full administrator access. You will know if the account has administrator access because you will be able to see the System Restore tab. If the tab is missing, you are logged in under a limited account.

(Windows XP)

1. Turn off System Restore.
On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
Check Turn off System Restore.
Click Apply, and then click OK.

2. Reboot.

3. Turn ON System Restore.

On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
UN-Check *Turn off System Restore*.
Click Apply, and then click OK..

Since the tools we used to scan the computer, as well as tools to delete files and folders, are no longer needed, they should be removed, as well as the folders created by these tools.

Follow these steps to uninstall Combofix
  • Click START then RUN
  • Now type Combofix /Uninstall in the runbox and click OK. Note the space between the x and the /u, it needs to be there.
Clear the Eudora Inbox and trash can.

Create a Restore point (If the above process fails to do so):
  • Click Start, point to All Programs, point to Accessories, point to System Tools, and then click System Restore.
  • In the System Restore dialog box, click Create a restore point, and then click Next.
  • Type a description for your restore point, such as "After Cleanup", then click Create.
How is the computer doing?

No request for help throughout private messaging will be attended.

If I have helped you, consider making a donation to help me continue the fight against Malware!
btn_donate_SM.gif


#11 Mandenbar

Mandenbar
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:05:14 PM

Posted 09 November 2009 - 11:05 PM

My apologies on the delayed response, I was out of town for the last several days. I've ran Avira Antivir, IOBit360, and Malwarebytez and none of them found a single thing. All is running well! Thank you so very much for your help, I really appreciate it!!!

- Mandenbar

#12 JSntgRvr

JSntgRvr

    Master Surgeon General


  • Malware Response Team
  • 11,210 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto Rico
  • Local time:08:14 PM

Posted 10 November 2009 - 12:46 AM

Congratulations.

The following is a list of free tools and utilities that I like to suggest to people. This list is full of great tools and utilities to help you understand how you got infected and how to keep from getting infected again.
  • Spybot Search & Destroy - A useful tool which can search and annhilate bad files that make it onto your system. Now with an Immunize section that will help prevent future infections.
  • AdAware - Another very powerful tool which searches and kills bad files that infect your system. AdAware and Spybot Search & Destroy compliment each other very well.
  • SpywareBlaster - Great prevention tool to keep bad files from installing on your system.
  • ZonedOut + IE-SpyAd - puts over 5000 sites in your restricted zone so you'll be protected when you visit innocent-looking sites that aren't actually innocent at all.
  • ATF! - Cleans temporary files from IE and Windows, empties the recycle bin and more. Great tool to help speed up your computer and knock out those bad files that like to reside in the temp folders.
  • Windows Updates - It is very important to make sure that both Internet Explorer and Windows are kept current with the latest critical security patches from Microsoft. To do this just start Internet Explorer and select Tools > Windows Update, and follow the online instructions from there.
  • Google Toolbar - Free google toolbar that allows you to use the powerful Google search engine from the bar, but also blocks pop up windows.
  • Trillian or Miranda-IM - These are Malware free Instant Messenger programs which allow you to connect to multiple IM services in one program! (AOL, Yahoo, ICQ, IRC, MSN)
  • ERUNT (Emergency Recovery Utility NT) allows you to keep a complete backup of your registry and restore it when needed. The standard registry backup options that come with Windows back up most of the registry but not all of it. ERUNT however creates a complete backup set, including the Security hive and user related sections. ERUNT is easy to use and since it creates a full backup, there are no options or choices other than to select the location of the backup files. The backup set includes a small executable that will launch the registry restore if needed.
  • Recovery Console - Recent trends appear to indicate that future infections will include attacks to the boot sector of the computer. The installation of the Recovery Console in the computer will be our only defense against this threat. For more information and steps to install the Recovery Console see This Article. Should you need assistance in installing the Recovery Console, please do not hesitate to ask.
To find out more information about how you got infected in the first place and some great guidelines to follow to prevent future infections you can read this article by Miekiemoes.

Best wishes! Posted Image

No request for help throughout private messaging will be attended.

If I have helped you, consider making a donation to help me continue the fight against Malware!
btn_donate_SM.gif


#13 JSntgRvr

JSntgRvr

    Master Surgeon General


  • Malware Response Team
  • 11,210 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto Rico
  • Local time:08:14 PM

Posted 23 November 2009 - 04:35 PM

Since this issue appears to be resolved ... this Topic has been closed. Glad we could help.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please begin a New Topic.

No request for help throughout private messaging will be attended.

If I have helped you, consider making a donation to help me continue the fight against Malware!
btn_donate_SM.gif





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users