Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

blue screen shut downs after using combofix


  • Please log in to reply
1 reply to this topic

#1 drock0525

drock0525

  • Members
  • 1 posts
  • OFFLINE
  •  
  • Local time:01:02 AM

Posted 05 November 2009 - 03:55 PM

I have used combofix to rid my computer of a rootkit virus in eventlog.dll, which it did exceptionally. I have not had someone review my log file, and every since running combofix, whenever i restart my computer, i get the dreaded blue screen shut down, after which i have to restart 2 more times before finally getting a "windows serious error has occurred" dialog box, and being able to use my computer. The error signature is "BCCode: 1000008e BCP1: C0000005 BCP2: 804D9A69 BCP3: F08C2B94 BCP4: 00000000 OSVer: 5_1_2600 SP: 3_0 Product: 768_1," and has also had slightly different numbers every time. I understand i did not run combofix as recommended by not having a helper or whatever, but PLEASE help me now! I cant handle restarting my comp 3 times before being able to use it. not to mention the other minor problems that arise along the way. Thanks so much in advance!!!! My combofix log file is:

ComboFix 09-10-01.05 - owner 10/03/2009 19:00.1.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.223.120 [GMT -5:00]
Running from: c:\documents and settings\owner\Desktop\CFix.exe
AV: avast! antivirus 4.8.1351 [VPS 091003-0] *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\recycler\S-1-5-21-343818398-515967899-725345543-1004

Infected copy of c:\windows\system32\eventlog.dll was found and disinfected
Restored copy from - c:\windows\ServicePackFiles\i386\eventlog.dll

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_{79007602-0CDB-4405-9DBF-1257BB3226ED}


((((((((((((((((((((((((( Files Created from 2009-09-04 to 2009-10-04 )))))))))))))))))))))))))))))))
.

2009-10-03 03:06 . 2009-10-03 03:06 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-09-30 05:25 . 2009-09-30 05:25 -------- d-----w- c:\documents and settings\Administrator\IETldCache
2009-09-30 05:24 . 2009-10-03 03:05 -------- d-s---w- c:\documents and settings\Administrator
2009-09-22 07:05 . 2009-09-22 07:05 27656 ----a-w- c:\windows\system32\drivers\pxsec.sys
2009-09-22 07:05 . 2009-09-22 07:05 22024 ----a-w- c:\windows\system32\drivers\pxscan.sys
2009-09-22 07:05 . 2009-09-22 07:05 -------- d-----w- c:\program files\Prevx
2009-09-22 07:04 . 2009-10-03 04:12 -------- d-----w- c:\documents and settings\All Users\Application Data\PrevxCSI
2009-09-21 06:11 . 2009-07-30 20:10 114672 ----a-w- c:\windows\system32\drivers\keyscrambler.sys
2009-09-21 06:11 . 2009-09-21 06:11 -------- d-----w- c:\program files\KeyScrambler
2009-09-16 02:01 . 2009-09-10 19:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-09-16 02:01 . 2009-09-10 19:53 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-09-09 23:31 . 2009-06-21 21:44 153088 -c----w- c:\windows\system32\dllcache\triedit.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-10-04 00:07 . 2009-07-04 03:51 -------- d-----w- c:\program files\PeerGuardian2
2009-10-03 03:20 . 2009-09-30 06:37 0 ----a-r- c:\windows\win32k.sys
2009-10-03 03:06 . 2009-09-30 06:36 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware(3)
2009-10-03 03:05 . 2009-10-03 03:05 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware(2)
2009-10-03 03:05 . 2009-10-03 03:05 -------- d-----w- c:\documents and settings\owner\Application Data\Malwarebytes
2009-10-03 03:05 . 2009-10-03 03:05 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-10-03 03:05 . 2009-10-01 02:52 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes(2)
2009-10-01 06:30 . 2009-06-28 09:07 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-09-24 23:36 . 2003-01-03 12:02 -------- d-----w- c:\documents and settings\owner\Application Data\uTorrent
2009-09-22 09:38 . 2009-08-25 07:11 -------- d-----w- c:\documents and settings\owner\Application Data\vlc
2009-09-01 08:24 . 2009-09-01 08:12 -------- d-----w- c:\program files\BitPim
2009-08-25 07:10 . 2009-07-26 15:40 -------- d-----w- c:\program files\VLC Media Player
2009-08-17 16:10 . 2009-06-16 11:02 1279456 ----a-w- c:\windows\system32\aswBoot.exe
2009-08-17 16:06 . 2009-06-16 11:02 93392 ----a-w- c:\windows\system32\drivers\aswmon.sys
2009-08-17 16:06 . 2009-06-16 11:02 94160 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2009-08-17 16:05 . 2009-06-16 11:02 114768 ----a-w- c:\windows\system32\drivers\aswSP.sys
2009-08-17 16:05 . 2009-06-16 11:02 20560 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2009-08-17 16:04 . 2009-06-16 11:02 51376 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2009-08-17 16:04 . 2009-06-16 11:02 23152 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2009-08-17 16:03 . 2009-06-16 11:02 26944 ----a-w- c:\windows\system32\drivers\aavmker4.sys
2009-08-17 16:02 . 2009-06-16 11:02 97480 ----a-w- c:\windows\system32\AvastSS.scr
2009-08-05 09:01 . 2004-08-04 12:00 204800 ----a-w- c:\windows\system32\mswebdvd.dll
2009-07-17 19:01 . 2004-08-04 12:00 58880 ----a-w- c:\windows\system32\atl.dll
2009-07-12 17:21 . 2004-08-04 12:00 233472 ----a-w- c:\windows\system32\wmpdxm.dll
2009-07-11 08:52 . 2009-07-11 08:52 64368 ----a-w- c:\documents and settings\owner\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]
"PeerGuardian"="c:\program files\PeerGuardian2\pg2.exe" [2007-01-30 1432064]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPLpr"="c:\program files\Synaptics\SynTP\SynTPLpr.exe" [2003-01-01 98304]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2003-01-01 499712]
"SunKist"="c:\program files\Digital Media Reader\shwicon2k.exe" [2004-05-26 139264]
"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2009-09-10 1312080]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2003-07-10 155648]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2003-07-10 114688]
"avast!"="c:\progra~1\AVAST!~1\Avast4\ashDisp.exe" [2009-08-17 81000]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"1309:UDP"= 1309:UDP:Windows Media Format SDK (wmplayer.exe)
"1308:UDP"= 1308:UDP:Windows Media Format SDK (wmplayer.exe)
"1323:UDP"= 1323:UDP:Windows Media Format SDK (wmplayer.exe)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)

R0 pxscan;pxscan;c:\windows\system32\drivers\pxscan.sys [9/22/2009 2:05 AM 22024]
R0 pxsec;pxsec;c:\windows\system32\drivers\pxsec.sys [9/22/2009 2:05 AM 27656]
R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [6/16/2009 6:02 AM 114768]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [6/16/2009 6:02 AM 20560]
R3 KeyScrambler;KeyScrambler;c:\windows\system32\drivers\keyscrambler.sys [9/21/2009 1:11 AM 114672]
S2 CSIScanner;CSIScanner;c:\program files\Prevx\prevx.exe [9/22/2009 2:05 AM 4368952]

--- Other Services/Drivers In Memory ---

*NewlyCreated* - GTNDIS5
*NewlyCreated* - PGFILTER

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
Contents of the 'Scheduled Tasks' folder

2009-10-04 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-07-02 02:43]

2009-10-03 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-07-02 02:43]
.
.
------- Supplementary Scan -------
.
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\owner\Application Data\Mozilla\Firefox\Profiles\uzf0kys8.default\
FF - prefs.js: browser.startup.homepage - www.google.com
FF - prefs.js: network.proxy.type - 4
FF - component: c:\documents and settings\owner\Application Data\Mozilla\Firefox\Profiles\uzf0kys8.default\extensions\keyscrambler@qfx.software.corporation\components\KeyScramblerIE.dll
FF - plugin: c:\program files\Google\Update\1.2.183.7\npGoogleOneClick8.dll
FF - plugin: c:\program files\VLC Media Player\npvlc.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-10-03 19:11
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(2172)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Avast! Anti-Virus Software\Avast4\ashServ.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\program files\Dynex Wireless G Adapter\WLanCfgG.exe
c:\program files\Avast! Anti-Virus Software\Avast4\ashMaiSv.exe
c:\program files\Avast! Anti-Virus Software\Avast4\ashWebSv.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2009-10-04 19:20 - machine was rebooted
ComboFix-quarantined-files.txt 2009-10-04 00:20

Pre-Run: 8,012,898,304 bytes free
Post-Run: 7,932,092,416 bytes free

154 --- E O F --- 2009-09-11 01:28

BC AdBot (Login to Remove)

 


#2 kahdah

kahdah

  • Security Colleague
  • 11,138 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Florida
  • Local time:02:02 AM

Posted 10 November 2009 - 07:45 AM

Hello drock0525

Welcome to BleepingComputer :(
==========================
  • Download OTL to your desktop.
  • Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
  • When the window appears, underneath Output at the top change it to Minimal Output.
  • Under the Standard Registry box change it to All.
  • Check the boxes beside LOP Check and Purity Check.
  • Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
  • When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
  • Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply.
===========
Download This file. Note its name and save it to your root folder, such as C:\.
  • Disconnect from the Internet and close all running programs.
  • Temporarily disable any real-time active protection so your security program drivers will not conflict with this file.
  • Click on this link to see a list of programs that should be disabled.
  • Double-click on the downloaded file to start the program. (If running Vista, right click on it and select "Run as an Administrator")
  • Allow the driver to load if asked.
  • You may be prompted to scan immediately if it detects rootkit activity.
  • If you are prompted to scan your system click "Yes" to begin the scan.
  • If not prompted, click the "Rootkit/Malware" tab.
  • On the right-side, all items to be scanned should be checked by default except for "Show All". Leave that box unchecked.
  • Select all drives that are connected to your system to be scanned.
  • Click the Scan button to begin. (Please be patient as it can take some time to complete)
  • When the scan is finished, click Save to save the scan results to your Desktop.
  • Save the file as Results.log and copy/paste the contents in your next reply.
  • Exit the program and re-enable all active protection when done.

Please do not pm for help, post it in the forums instead.

If I am helping you and have not responded for 48 hours please send me a pm as I don't always get notifications.

My help is always free, however, if you would like to make a donation to me for the help I have provided please click here Posted Image




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users