Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Redirect virus, frequent Symantec traffic blocks


  • This topic is locked This topic is locked
34 replies to this topic

#1 myopic

myopic

  • Members
  • 33 posts
  • OFFLINE
  •  
  • Local time:04:50 AM

Posted 26 February 2010 - 06:02 AM

Hey there bleepingcomputer. As of right now I get random new tabs opened up in firefox that are directed to random websites. Also, Symantec Endpoint Protection frequently notifies me of traffic blockage-

QUOTE
[SID: 23509] HTTP Fake Antivirus Install Request 4 detected.
Traffic has been blocked from this application: C:\WINDOWS\system32\svchost.exe

QUOTE
[SID: 23615] HTTPS Tidserv Request 2 detected.
Traffic has been blocked from this application: C:\WINDOWS\system32\svchost.exe

QUOTE
Traffic from IP address 60.12.117.145 is blocked from 2/25/2010 7:06:29 PM to 2/25/2010 7:16:29 PM.


I also have a slew of viruses- http://img200.imageshack.us/img200/5421/54846452.png.

I also get a "Generic Host Process for Win32 Services has encountered a problem and needs to close. We are sorry for the inconvenience."

I can't seem to run the gmer scan without my computer freezing, so the log attached is the initial gmer startup scan.

Thank you in advance.


DDS (Ver_09-12-01.01) - NTFSx86
Run by Man at 5:48:53.23 on Fri 02/26/2010
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_18
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.3070.1884 [GMT -5:00]

AV: Symantec Endpoint Protection *On-access scanning enabled* (Updated) {FB06448E-52B8-493A-90F3-E43226D3305C}
FW: Symantec Endpoint Protection *enabled* {BE898FE3-CD0B-4014-85A9-03DB9923DDB6}

============== Running Processes ===============

C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
C:\Program Files\Symantec\Symantec Endpoint Protection\Smc.exe
svchost.exe
svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Unlocker\UnlockerAssistant.exe
C:\Program Files\AIM\aim.exe
C:\Documents and Settings\Man\Application Data\SanDisk\Sansa Updater\SansaDispatch.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Logitech\Logitech Vid\vid.exe
svchost.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Logishrd\LQCVFX\COCIManager.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\LogMeIn Hamachi\hamachi-2.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\PnkBstrB.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
C:\Program Files\Symantec\Symantec Endpoint Protection\Rtvscan.exe
C:\Program Files\Symantec\Symantec Endpoint Protection\SmcGui.exe
C:\Program Files\Logitech\Logitech Vid\LU\LULnchr.exe
C:\Program Files\Logitech\Logitech Vid\LU\LogitechUpdate.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\WINDOWS\System32\svchost.exe -k HTTPFilter
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Man\Desktop\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://yahoo.com/
uInternet Settings,ProxyOverride = *.local
uURLSearchHooks: AIM Toolbar Search Class: {03402f96-3dc7-4285-bc50-9e81fefafe43} - c:\program files\aim toolbar\aimtb.dll
uURLSearchHooks: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn0\yt.dll
mURLSearchHooks: AIM Toolbar Search Class: {03402f96-3dc7-4285-bc50-9e81fefafe43} - c:\program files\aim toolbar\aimtb.dll
BHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\program files\yahoo!\companion\installs\cpn0\yt.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll
BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: AIM Toolbar Loader: {b0cda128-b425-4eef-a174-61a11ac5dbf8} - c:\program files\aim toolbar\aimtb.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
BHO: SingleInstance Class: {fdad4da1-61a2-4fd8-9c17-86f7ac245081} - c:\program files\yahoo!\companion\installs\cpn0\YTSingleInstance.dll
TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn0\yt.dll
TB: AIM Toolbar: {61539ecd-cc67-4437-a03c-9aaccbd14326} - c:\program files\aim toolbar\aimtb.dll
uRun: [Messenger (Yahoo!)] "c:\program files\yahoo!\messenger\YahooMessenger.exe" -quiet
uRun: [Aim] "c:\program files\aim\aim.exe" /d locale=en-US
uRun: [SansaDispatch] c:\documents and settings\man\application data\sandisk\sansa updater\SansaDispatch.exe
uRun: [SpybotSD TeaTimer] c:\program files\spybot - search & destroy\TeaTimer.exe
uRun: [Logitech Vid] "c:\program files\logitech\logitech vid\vid.exe" -bootmode
uRun: [SUPERAntiSpyware] c:\program files\superantispyware\SUPERAntiSpyware.exe
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
mRun: [ccApp] "c:\program files\common files\symantec shared\ccApp.exe"
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [IMJPMIG8.1] "c:\windows\ime\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
mRun: [IMEKRMIG6.1] c:\windows\ime\imkr6_1\IMEKRMIG.EXE
mRun: [nwiz] c:\program files\nvidia corporation\nview\nwiz.exe /install
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRun: [RTHDCPL] RTHDCPL.EXE
mRun: [LogitechQuickCamRibbon] "c:\program files\logitech\logitech webcam software\LWS.exe" /hide
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
mRun: [UnlockerAssistant] "c:\program files\unlocker\UnlockerAssistant.exe"
dRunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe
StartupFolder: c:\docume~1\man\startm~1\programs\startup\impuls~1.lnk - c:\program files\stardock\impulse\now\ImpulseNow.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\micros~1.lnk - c:\program files\microsoft office\office\OSA9.EXE
dPolicies-explorer: NoSetActiveDesktop = 1 (0x1)
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll
DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://download.microsoft.com/download/C/0/C/C0CBBA88-A6F2-48D9-9B0E-1719D1177202/LegitCheckControl.cab
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1242487506109
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
DPF: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab
Notify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLL

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\man\applic~1\mozilla\firefox\profiles\5ma0iolo.default\
FF - prefs.js: browser.search.defaulturl - hxxp://aim.search.aol.com/search/search?query={searchTerms}&invocationType=tb50-ff-aim-chromesbox-en-us
FF - prefs.js: browser.startup.homepage - google.com
FF - plugin: c:\documents and settings\all users\application data\nexonus\ngm\npNxGameUS.dll
FF - plugin: c:\program files\k-lite codec pack\real\browser\plugins\nppl3260.dll
FF - plugin: c:\program files\k-lite codec pack\real\browser\plugins\nprpjplug.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npdnu.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npdnupdater2.dll
FF - plugin: c:\program files\mozilla firefox\plugins\NPMFireLauncher.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA}

---- FIREFOX POLICIES ----
FF - user.js: yahoo.homepage.dontask - true);user_pref(network.protocol-handler.warn-external.dnupdate, false);user_pref(network.protocol-handler.warn-external.dnupdate, falsec:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);

============= SERVICES / DRIVERS ===============

R1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\sasdifsv.sys [2010-1-5 9968]
R1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2010-1-5 74480]
R2 ccEvtMgr;Symantec Event Manager;c:\program files\common files\symantec shared\ccSvcHst.exe [2008-8-14 108392]
R2 ccSetMgr;Symantec Settings Manager;c:\program files\common files\symantec shared\ccSvcHst.exe [2008-8-14 108392]
R2 Hamachi2Svc;LogMeIn Hamachi 2.0 Tunneling Engine;c:\program files\logmein hamachi\hamachi-2.exe [2009-10-29 1074568]
R2 Symantec AntiVirus;Symantec Endpoint Protection;c:\program files\symantec\symantec endpoint protection\Rtvscan.exe [2008-9-11 2436536]
R2 WinDefend;Windows Defender;c:\program files\windows defender\MsMpEng.exe [2006-11-3 13592]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\common files\symantec shared\eengine\EraserUtilRebootDrv.sys [2009-8-27 102448]
R3 NAVENG;NAVENG;c:\progra~1\common~1\symant~1\virusd~1\20100225.006\NAVENG.SYS [2010-2-25 84912]
R3 NAVEX15;NAVEX15;c:\progra~1\common~1\symant~1\virusd~1\20100225.006\NAVEX15.SYS [2010-2-25 1324720]
R3 SASENUM;SASENUM;c:\program files\superantispyware\SASENUM.SYS [2010-1-5 7408]
S3 ALSysIO;ALSysIO;\??\c:\docume~1\man\locals~1\temp\alsysio.sys --> c:\docume~1\man\locals~1\temp\ALSysIO.sys [?]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\ambfilt.sys [2009-8-2 1684736]
S3 COH_Mon;COH_Mon;c:\windows\system32\drivers\coh_mon.sys [2008-1-12 23888]
S3 npggsvc;nProtect GameGuard Service;c:\windows\system32\gamemon.des -service --> c:\windows\system32\GameMon.des -service [?]
S3 XDva294;XDva294;\??\c:\windows\system32\xdva294.sys --> c:\windows\system32\XDva294.sys [?]
S3 XDva309;XDva309;\??\c:\windows\system32\xdva309.sys --> c:\windows\system32\XDva309.sys [?]

=============== Created Last 30 ================

2010-02-26 10:48:15 0 ----a-w- c:\documents and settings\man\defogger_reenable
2010-02-24 23:47:47 0 d-----w- c:\program files\dumps
2010-02-13 16:31:46 0 d-----w- c:\program files\Trend Micro
2010-02-13 16:30:46 73728 ----a-w- c:\windows\system32\javacpl.cpl
2010-02-13 04:04:05 0 d-----w- c:\program files\CCleaner
2010-02-13 02:22:46 0 d-----w- c:\docume~1\alluse~1\applic~1\SUPERAntiSpyware.com
2010-02-13 02:22:33 0 d-----w- c:\program files\SUPERAntiSpyware
2010-02-13 02:22:33 0 d-----w- c:\docume~1\man\applic~1\SUPERAntiSpyware.com
2010-02-12 23:01:18 0 d-----w- c:\program files\Uru Live
2010-02-07 23:15:39 0 d-----w- c:\program files\softnyx
2010-02-07 21:25:40 0 d-----w- C:\8cc56c1dad5d0e509c5af8ecbf
2010-02-07 20:52:24 0 d-----w- c:\program files\Unlocker
2010-02-04 00:37:23 0 ----a-w- c:\windows\system32\drivers\lvuvc.hs
2010-02-04 00:36:59 539160 ----a-w- c:\windows\system32\LVUI2.dll
2010-02-04 00:36:59 416280 ----a-w- c:\windows\system32\lvcodec2.dll
2010-02-04 00:36:58 6756632 ----a-w- c:\windows\system32\drivers\lvuvc.sys
2010-02-04 00:36:58 539160 ----a-w- c:\windows\system32\LVUI2RC.dll
2010-02-04 00:36:58 266828 ----a-w- c:\windows\system32\drivers\LVAFT.cfg
2010-02-04 00:36:31 82289 ----a-w- c:\windows\system32\lvcoinst.ini
2010-02-04 00:36:31 34068 ----a-w- c:\windows\system32\Repository.reg
2010-02-04 00:36:31 199192 ----a-w- c:\windows\system32\lvci12101110.dll
2010-02-04 00:36:30 266008 ----a-w- c:\windows\system32\drivers\lvrs.sys
2010-02-04 00:36:13 0 ----a-w- c:\windows\system32\drivers\logiflt.iad
2010-02-04 00:36:04 23832 ----a-w- c:\windows\system32\drivers\lvuvcflt.sys
2010-02-04 00:26:57 59264 -c--a-w- c:\windows\system32\dllcache\usbaudio.sys
2010-02-04 00:26:57 59264 ----a-w- c:\windows\system32\drivers\USBAUDIO.sys
2010-02-04 00:26:50 53760 -c--a-w- c:\windows\system32\dllcache\vfwwdm32.dll
2010-02-04 00:26:50 53760 ----a-w- c:\windows\system32\vfwwdm32.dll
2010-02-04 00:26:50 20992 -c--a-w- c:\windows\system32\dllcache\dshowext.ax
2010-02-04 00:26:50 20992 ----a-w- c:\windows\system32\dshowext.ax
2010-02-03 20:03:28 0 d-----w- c:\program files\GTactix
2010-01-30 02:35:41 0 d-----w- C:\AeriaGames
2010-01-29 21:08:54 0 d-----w- c:\program files\OGPlanet

==================== Find3M ====================

2010-02-13 16:30:31 411368 ----a-w- c:\windows\system32\deploytk.dll
2010-01-29 19:12:21 192224 ----a-w- c:\windows\fonts\Constantia.ttf
2010-01-19 02:31:53 23348 ----a-w- c:\windows\system32\emptyregdb.dat
2010-01-12 22:57:06 162048 ----a-w- c:\windows\system32\drivers\WpsHelper.sys
2010-01-07 21:07:14 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-01-07 21:07:04 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-12-31 16:14:12 352640 ----a-w- c:\windows\system32\drivers\srv.sys
2009-12-21 19:14:05 916480 ------w- c:\windows\system32\wininet.dll
2009-12-19 03:54:45 78525 ----a-w- c:\windows\War3Unin.dat
2009-12-19 01:15:49 86016 ----a-w- c:\windows\system32\OpenAL32.dll
2009-12-19 01:15:49 413696 ----a-w- c:\windows\system32\wrap_oal.dll
2009-12-16 12:58:04 343040 ----a-w- c:\windows\system32\mspaint.exe
2009-12-14 07:35:35 33280 ----a-w- c:\windows\system32\csrsrv.dll
2009-12-10 03:54:07 261632 ----a-w- c:\windows\PEV.exe
2009-12-08 18:11:44 2142720 ------w- c:\windows\system32\ntoskrnl.exe
2009-12-08 17:35:25 2020864 ------w- c:\windows\system32\ntkrnlpa.exe

============= FINISH: 5:50:11.37 ===============

Attached Files


Edited by myopic, 26 February 2010 - 06:04 AM.


BC AdBot (Login to Remove)

 


#2 etavares

etavares

    Bleepin' Remover


  • Malware Response Team
  • 15,514 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:04:50 AM

Posted 28 February 2010 - 02:08 PM

My name is etavares and I will be helping you with this log.

Here are some guidelines to ensure we are able to get your machine back under your control.
  • Please do not run any unsupervised scans, fixes, etc. We can work against each other and end up in a worse place.
  • Please subscribe to this topic if you have not already done so. Please check back just in case, as the email system can fail at times.
  • Just because your machine is running better does not mean it is completely cleaned. Please wait for the 'all clear' from me to say when we are done.
  • Please reply within 3 days to be fair to other people asking for help.
  • When in doubt, please stop and ask first. There's no harm in asking questions!

Please give me a little time to look over your log and I'll reply back.


If I don't respond within 2 days, please feel free to PM me.
Please don't ask for help via PM. The forums are there for a reason. Please post in the forums so others may benefit as well.

Posted Image
Unified Network of Instructors and Trusted Eliminators
 


#3 etavares

etavares

    Bleepin' Remover


  • Malware Response Team
  • 15,514 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:04:50 AM

Posted 28 February 2010 - 02:19 PM

Please don't miss my post above.

before I post any fixes, I notice that you appear to be getting help here:
http://forum.bullguard.com/forum/8/Several...redi_82163.html

I must ask you to pick one site or the other. If you try to follow two of us, we'll just end up working against each other, with potential damage to your OS. Please let me know if you'd like to continue here...but that means you agree to only work with me and not with any other site.


If I don't respond within 2 days, please feel free to PM me.
Please don't ask for help via PM. The forums are there for a reason. Please post in the forums so others may benefit as well.

Posted Image
Unified Network of Instructors and Trusted Eliminators
 


#4 myopic

myopic
  • Topic Starter

  • Members
  • 33 posts
  • OFFLINE
  •  
  • Local time:04:50 AM

Posted 28 February 2010 - 05:02 PM

QUOTE(etavares @ Feb 28 2010, 02:19 PM) View Post
Please don't miss my post above.

before I post any fixes, I notice that you appear to be getting help here:
http://forum.bullguard.com/forum/8/Several...redi_82163.html

I must ask you to pick one site or the other. If you try to follow two of us, we'll just end up working against each other, with potential damage to your OS. Please let me know if you'd like to continue here...but that means you agree to only work with me and not with any other site.


Yeah sorry I should have mentioned that. I'd like to continue here, as I haven't had a response in the other thread for over a week. I will not follow the other site anymore. Thank you for your time.

Edited by myopic, 28 February 2010 - 05:03 PM.


#5 etavares

etavares

    Bleepin' Remover


  • Malware Response Team
  • 15,514 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:04:50 AM

Posted 28 February 2010 - 08:58 PM

Hello, myopic.
Ok, let's get started. Some may be similar to before. Let's start with Combofix. Please delete any copy you may have used before and download a fresh, updated copy.



One or more of the identified infections is a backdoor trojan.

This allows hackers to remotely control your computer, steal critical system information and download and execute files.

I would counsel you to disconnect this PC from the Internet immediately. If you do any banking or other financial transactions on the PC or if it should contain any other sensitive information, please get to a known clean computer and change all passwords where applicable, and it would be wise to contact those same financial institutions to apprise them of your situation.

Though the trojan has been identified and can be killed, because of it's backdoor functionality, your PC is very likely compromised and there is no way to be sure your computer can ever again be trusted. Many experts in the security community believe that once infected with this type of trojan, the best course of action would be a reformat and reinstall of the OS. Please read these for more information:

How Do I Handle Possible Identify Theft, Internet Fraud and CC Fraud?
When Should I Format, How Should I Reinstall

We can still clean this machine but I can't guarantee that it will be 100% secure afterwards. Let me know what you decide to do. If you do decide to proceed, please continue with the fix below.



Step 1

1. We need to disable Spybot S&D's "TeaTimer"
TeaTimer works by preventing ANY changes to the system. It will attempt to undo any fixes we run, because it blocks these fixes from running.

In order to safeguard your system from problems that can be brought on by a half finished fix, we need to disable TeaTimer. We can reenable it when we're done if you like.
  1. Open SpyBot Search and Destroy by going to Start -> All Programs -> Spybot Search and Destroy -> Spybot Search and Destroy.
  2. If prompted with a legal dialog, accept the warning.
  3. Click and then on "Advanced Mode"
  4. You may be presented with a warning dialog. If so, press
  5. Click on
  6. Click on
  7. Uncheck this checkbox:
  8. Close/Exit Spybot Search and Destroy



Step 2

Next, please download ComboFix from one of these locations:* IMPORTANT !!! Save ComboFix.exe to your Desktop as myopicCF.exe
  • Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. (Click on this link to see a list of programs that should be disabled. The list is not all inclusive.)
  • Double click on myopicCF.exe & follow the prompts.
  • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.



Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:



Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply, along with any symptoms that are present after it runs.

etavares


EDIT: need to disable teatimer.

Edited by etavares, 28 February 2010 - 08:59 PM.


If I don't respond within 2 days, please feel free to PM me.
Please don't ask for help via PM. The forums are there for a reason. Please post in the forums so others may benefit as well.

Posted Image
Unified Network of Instructors and Trusted Eliminators
 


#6 myopic

myopic
  • Topic Starter

  • Members
  • 33 posts
  • OFFLINE
  •  
  • Local time:04:50 AM

Posted 28 February 2010 - 10:25 PM

EDIT: Nevermind, going to post combofix scan in a bit.

Edited by myopic, 01 March 2010 - 05:34 AM.


#7 etavares

etavares

    Bleepin' Remover


  • Malware Response Team
  • 15,514 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:04:50 AM

Posted 01 March 2010 - 06:10 PM

OK, I'll wait on it. Thanks for closing out the other thread as well.

One other question...do you have a Windows CD handy? We may need it...may not. But if you have one, it may be worth digging it out in case we can't find a clean copy on your machine.


If I don't respond within 2 days, please feel free to PM me.
Please don't ask for help via PM. The forums are there for a reason. Please post in the forums so others may benefit as well.

Posted Image
Unified Network of Instructors and Trusted Eliminators
 


#8 myopic

myopic
  • Topic Starter

  • Members
  • 33 posts
  • OFFLINE
  •  
  • Local time:04:50 AM

Posted 01 March 2010 - 07:56 PM

QUOTE(etavares @ Mar 1 2010, 06:10 PM) View Post
OK, I'll wait on it. Thanks for closing out the other thread as well.

One other question...do you have a Windows CD handy? We may need it...may not. But if you have one, it may be worth digging it out in case we can't find a clean copy on your machine.


Yeah I have a Windows CD. Also, here's the combofix log- I'm not sure if it shows in the log but before the scan starts, it says "ComboFix has detected the presence of rootkit activity and needs to reboot the machine." My computer reboots fine and continues scanning. Thank you for your time.

EDIT: I'm still getting the Symantec Endpoint Protection notifications as well as the new tabs opened.

ComboFix 10-03-01.01 - Man 03/01/2010 19:37:51.8.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.3070.2596 [GMT -5:00]
Running from: c:\documents and settings\Man\Desktop\myopicCF.exe
AV: Symantec Endpoint Protection *On-access scanning disabled* (Updated) {FB06448E-52B8-493A-90F3-E43226D3305C}
FW: Symantec Endpoint Protection *disabled* {BE898FE3-CD0B-4014-85A9-03DB9923DDB6}
.

((((((((((((((((((((((((( Files Created from 2010-02-02 to 2010-03-02 )))))))))))))))))))))))))))))))
.

2010-02-24 23:47 . 2010-02-24 23:47 -------- d-----w- c:\program files\dumps
2010-02-15 23:05 . 2010-02-15 23:05 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Application Data\Adobe
2010-02-15 18:23 . 2010-02-15 18:23 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Adobe
2010-02-13 16:31 . 2010-02-13 16:31 -------- d-----w- c:\program files\Trend Micro
2010-02-13 16:31 . 2010-02-13 16:31 61440 ----a-w- c:\documents and settings\Man\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-4498f94e-n\decora-sse.dll
2010-02-13 16:31 . 2010-02-13 16:31 503808 ----a-w- c:\documents and settings\Man\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-7cf7aa70-n\msvcp71.dll
2010-02-13 16:31 . 2010-02-13 16:31 499712 ----a-w- c:\documents and settings\Man\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-7cf7aa70-n\jmc.dll
2010-02-13 16:31 . 2010-02-13 16:31 348160 ----a-w- c:\documents and settings\Man\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-7cf7aa70-n\msvcr71.dll
2010-02-13 16:31 . 2010-02-13 16:31 12800 ----a-w- c:\documents and settings\Man\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-4498f94e-n\decora-d3d.dll
2010-02-13 16:30 . 2010-02-13 16:30 -------- d-----w- c:\program files\Common Files\Java
2010-02-13 16:30 . 2010-02-13 16:30 -------- d-----w- c:\program files\Java
2010-02-13 04:04 . 2010-02-13 04:04 -------- d-----w- c:\program files\CCleaner
2010-02-13 02:23 . 2010-02-13 02:23 52224 ----a-w- c:\documents and settings\Man\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10005.dll
2010-02-13 02:23 . 2010-02-13 02:23 117760 ----a-w- c:\documents and settings\Man\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
2010-02-13 02:22 . 2010-02-13 02:22 -------- d-----w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2010-02-13 02:22 . 2010-02-13 02:22 -------- d-----w- c:\program files\SUPERAntiSpyware
2010-02-13 02:22 . 2010-02-13 02:22 -------- d-----w- c:\documents and settings\Man\Application Data\SUPERAntiSpyware.com
2010-02-12 23:01 . 2010-02-13 02:15 -------- d-----w- c:\program files\Uru Live
2010-02-07 23:15 . 2010-02-07 23:15 -------- d-----w- c:\program files\softnyx
2010-02-07 21:25 . 2010-02-07 21:25 -------- d-----w- C:\8cc56c1dad5d0e509c5af8ecbf
2010-02-07 20:52 . 2010-02-15 04:25 -------- d-----w- c:\program files\Unlocker
2010-02-04 00:38 . 2010-02-04 00:38 -------- d-----w- c:\documents and settings\Man\Local Settings\Application Data\LogiShrd
2010-02-04 00:37 . 2010-02-04 00:37 -------- d-----w- c:\documents and settings\Man\Application Data\Leadertech
2010-02-04 00:36 . 2009-10-07 08:48 539160 ----a-w- c:\windows\system32\LVUI2.dll
2010-02-04 00:36 . 2009-10-07 08:43 416280 ----a-w- c:\windows\system32\lvcodec2.dll
2010-02-04 00:36 . 2009-10-07 08:49 6756632 ----a-w- c:\windows\system32\drivers\lvuvc.sys
2010-02-04 00:36 . 2009-10-07 08:48 539160 ----a-w- c:\windows\system32\LVUI2RC.dll
2010-02-04 00:36 . 2009-10-07 08:43 199192 ----a-w- c:\windows\system32\lvci12101110.dll
2010-02-04 00:36 . 2009-10-07 08:24 34068 ----a-w- c:\windows\system32\Repository.reg
2010-02-04 00:36 . 2009-10-07 08:47 266008 ----a-w- c:\windows\system32\drivers\lvrs.sys
2010-02-04 00:36 . 2009-10-07 08:49 23832 ----a-w- c:\windows\system32\drivers\lvuvcflt.sys
2010-02-04 00:35 . 2010-02-04 00:37 -------- d-----w- c:\program files\Common Files\LogiShrd
2010-02-04 00:35 . 2010-02-05 10:26 -------- d-----w- c:\documents and settings\All Users\Application Data\LogiShrd
2010-02-04 00:35 . 2010-02-04 00:37 -------- d-----w- c:\program files\Logitech
2010-02-04 00:26 . 2004-08-04 04:07 59264 -c--a-w- c:\windows\system32\dllcache\usbaudio.sys
2010-02-04 00:26 . 2004-08-04 04:07 59264 ----a-w- c:\windows\system32\drivers\USBAUDIO.sys
2010-02-04 00:26 . 2004-08-04 05:56 53760 -c--a-w- c:\windows\system32\dllcache\vfwwdm32.dll
2010-02-04 00:26 . 2004-08-04 05:56 53760 ----a-w- c:\windows\system32\vfwwdm32.dll
2010-02-03 20:03 . 2010-02-03 20:06 -------- d-----w- c:\program files\GTactix

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-03-01 22:01 . 2009-05-30 16:30 -------- d-----w- c:\program files\Steam
2010-03-01 19:43 . 2010-01-17 17:26 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2010-02-26 11:03 . 2009-05-16 17:07 1324 ----a-w- c:\windows\system32\d3d9caps.dat
2010-02-25 10:59 . 2009-09-15 02:18 401408 ----a-w- c:\documents and settings\All Users\Application Data\NexonUS\NGM\NGMResource.dll
2010-02-17 20:46 . 2009-11-30 01:15 -------- d-----w- c:\documents and settings\Man\Application Data\Any Video Converter
2010-02-15 18:24 . 2009-05-16 20:38 1100 ----a-w- c:\windows\system32\d3d8caps.dat
2010-02-13 16:30 . 2009-06-23 21:51 411368 ----a-w- c:\windows\system32\deploytk.dll
2010-02-13 03:59 . 2009-05-16 19:56 -------- d-----w- c:\program files\Pando Networks
2010-02-13 02:22 . 2009-05-30 01:33 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2010-02-11 22:50 . 2010-01-25 00:03 -------- d-----w- c:\program files\Common Files\BioWare
2010-02-04 00:37 . 2010-02-04 00:37 0 ----a-w- c:\windows\system32\drivers\lvuvc.hs
2010-02-04 00:36 . 2010-02-04 00:36 0 ----a-w- c:\windows\system32\drivers\logiflt.iad
2010-02-02 10:18 . 2010-01-03 02:07 -------- d-----w- c:\program files\Microsoft Silverlight
2010-01-30 23:00 . 2009-05-16 13:47 27752 ----a-w- c:\documents and settings\Man\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-01-29 21:08 . 2010-01-29 21:08 -------- d-----w- c:\program files\OGPlanet
2010-01-25 03:03 . 2010-01-25 03:02 23 ----a-w- c:\windows\popcinfot.dat
2010-01-24 23:42 . 2010-01-24 23:42 -------- d-----w- c:\program files\Elaborate Bytes
2010-01-19 11:08 . 2010-01-19 11:08 -------- d-----w- c:\program files\MSXML 6.0
2010-01-19 02:31 . 2009-05-16 01:57 23348 ----a-w- c:\windows\system32\emptyregdb.dat
2010-01-18 21:59 . 2009-05-16 15:21 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-01-18 21:58 . 2009-09-03 19:57 -------- d-----w- c:\documents and settings\All Users\Application Data\ijjigame
2010-01-17 22:09 . 2010-01-17 22:09 -------- d-----w- c:\documents and settings\Man\Application Data\AVG8
2010-01-17 17:26 . 2010-01-17 17:26 -------- d-----w- c:\program files\Spybot - Search & Destroy
2010-01-17 17:19 . 2009-10-02 22:51 -------- d-----w- c:\documents and settings\Man\Application Data\Move Networks
2010-01-17 00:48 . 2010-01-16 23:14 -------- d-----w- c:\program files\Windows Defender
2010-01-16 22:37 . 2010-01-16 22:37 -------- d-----w- c:\windows\system32\config\systemprofile\Application Data\Yahoo!
2010-01-16 20:57 . 2010-01-16 20:57 -------- d-----w- c:\documents and settings\Man\Application Data\Malwarebytes
2010-01-16 20:57 . 2010-01-16 20:57 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-01-16 20:57 . 2010-01-16 20:57 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-01-12 22:57 . 2008-06-20 04:12 162048 ----a-w- c:\windows\system32\drivers\WpsHelper.sys
2010-01-07 21:07 . 2010-01-16 20:57 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-01-07 21:07 . 2010-01-16 20:57 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-12-31 16:14 . 2004-08-04 10:00 352640 ----a-w- c:\windows\system32\drivers\srv.sys
2009-12-21 19:14 . 2006-03-04 03:33 916480 ------w- c:\windows\system32\wininet.dll
2009-12-19 03:54 . 2009-08-01 01:13 78525 ----a-w- c:\windows\War3Unin.dat
2009-12-19 01:15 . 2009-11-03 16:25 86016 ----a-w- c:\windows\system32\OpenAL32.dll
2009-12-19 01:15 . 2009-11-03 16:25 413696 ----a-w- c:\windows\system32\wrap_oal.dll
2009-12-16 12:58 . 2009-05-16 01:56 343040 ----a-w- c:\windows\system32\mspaint.exe
2009-12-14 07:35 . 2004-08-04 10:00 33280 ----a-w- c:\windows\system32\csrsrv.dll
2009-12-09 21:15 . 2009-11-29 22:51 574344 ----a-w- c:\documents and settings\Man\Application Data\SanDisk\Sansa Updater\SansaUpdater.exe
2009-12-08 18:11 . 2005-03-30 01:21 2142720 ------w- c:\windows\system32\ntoskrnl.exe
2009-12-08 17:35 . 2005-03-30 01:01 2020864 ------w- c:\windows\system32\ntkrnlpa.exe
2009-12-04 14:41 . 2004-08-04 10:00 453760 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
.

------- Sigcheck -------

[7] 2008-04-13 . 9F3A2F5AA6875C72BF062C712CFA2674 . 96512 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\9866fb57abdc0ea2f5d4e132d055ba4e\atapi.sys
[-] 2004-08-04 10:00 . !HASH: COULD NOT OPEN FILE !!!!! . 95360 . . [------] . . c:\windows\system32\drivers\atapi.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Messenger (Yahoo!)"="c:\program files\Yahoo!\Messenger\YahooMessenger.exe" [2009-05-27 4351216]
"Aim"="c:\program files\AIM\aim.exe" [2009-09-16 3634024]
"SansaDispatch"="c:\documents and settings\Man\Application Data\SanDisk\Sansa Updater\SansaDispatch.exe" [2009-11-29 79872]
"Logitech Vid"="c:\program files\Logitech\Logitech Vid\vid.exe" [2009-07-16 5458704]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2010-01-05 2002160]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2008-08-14 115560]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-04 208952]
"IMEKRMIG6.1"="c:\windows\ime\imkr6_1\IMEKRMIG.EXE" [2004-08-04 44032]
"nwiz"="c:\program files\NVIDIA Corporation\nView\nwiz.exe" [2009-09-24 1657448]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-09-27 13918208]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-09-27 86016]
"RTHDCPL"="RTHDCPL.EXE" [2009-10-16 18782720]
"LogitechQuickCamRibbon"="c:\program files\Logitech\Logitech WebCam Software\LWS.exe" [2009-10-14 2793304]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-01-11 246504]
"UnlockerAssistant"="c:\program files\Unlocker\UnlockerAssistant.exe" [2010-02-15 15872]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"tscuninstall"="c:\windows\system32\tscupgrd.exe" [2004-08-04 44544]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [1999-2-17 65588]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoSetActiveDesktop"= 1 (0x1)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-03 19:21 548352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ccEvtMgr]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ccSetMgr]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Symantec Antivirus]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Symantec Antvirus]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\World of Warcraft Public Test\\Launcher.exe"=
"c:\\Program Files\\World of Warcraft\\BackgroundDownloader.exe"=
"c:\\Program Files\\World of Warcraft Public Test\\WoW-0.2.0.10048-to-0.2.0.10072-enUS-downloader.exe"=
"c:\\Program Files\\World of Warcraft Public Test\\WoW-0.2.0.10072-to-0.2.0.10083-enUS-downloader.exe"=
"c:\\Program Files\\World of Warcraft Public Test\\wow-0.2.0.10083-to-0.2.0.10116-enUS-downloader.exe"=
"c:\\Program Files\\World of Warcraft Public Test\\WoW-0.2.0.10116-to-0.2.0.10128-enUS-downloader.exe"=
"c:\\Program Files\\Steam\\steamapps\\chinatownman\\insurgency\\hl2.exe"=
"c:\\Program Files\\World of Warcraft\\WoW-3.1.3.9947-to-3.2.0.10192-enUS-downloader.exe"=
"c:\\Program Files\\World of Warcraft\\Launcher.exe"=
"c:\\Program Files\\Steam\\steamapps\\goeatc\\insurgency\\hl2.exe"=
"c:\\Program Files\\Steam\\steamapps\\goeatc\\source sdk base\\hl2.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\Steam\\steamapps\\goeatc\\age of chivalry\\hl2.exe"=
"c:\\Program Files\\Steam\\steamapps\\chinatownman\\synergy\\hl2.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Steam\\steamapps\\chinatownman\\source sdk base\\hl2.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"c:\\WINDOWS\\Downloaded Program Files\\PurpleBean.exe"=
"c:\\Program Files\\Steam\\steamapps\\candymaneric11\\counter-strike source\\hl2.exe"=
"c:\\Documents and Settings\\All Users\\Application Data\\NexonUS\\NGM\\NGM.exe"=
"c:\\Nexon\\DFO\\DFO.exe"=
"c:\\Program Files\\AIM\\aim.exe"=
"c:\\WINDOWS\\system32\\mmc.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\GameKiss\\ValkyrieSky\\Valkyrie Sky.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\GTactix\\GTactix.exe"=
"c:\\Program Files\\Steam\\steamapps\\chinatownman\\team fortress 2\\hl2.exe"=
"c:\\Program Files\\softnyx\\GunboundWC\\GunBound.gme"=
"c:\\gPotato.com\\Allods Online\\bin\\Launcher.exe"=
"c:\\gPotato.com\\Allods Online\\bin\\AOgame.exe"=
"c:\\Program Files\\Steam\\steamapps\\chinatownman\\counter-strike\\hl.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\peggle extreme\\PeggleExtreme.exe"=
"c:\\Program Files\\Steam\\steamapps\\chinatownman\\counter-strike source\\hl2.exe"=
"c:\\Program Files\\Steam\\steamapps\\chinatownman\\sourcesdk\\bin\\SDKLauncher.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\left 4 dead 2\\left4dead2.exe"=
"c:\\Program Files\\Logitech\\Logitech Vid\\Vid.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3724:TCP"= 3724:TCP:Blizzard Downloader: 3724
"57889:TCP"= 57889:TCP:Pando Media Booster
"57889:UDP"= 57889:UDP:Pando Media Booster
"56673:TCP"= 56673:TCP:Pando Media Booster
"56673:UDP"= 56673:UDP:Pando Media Booster
"56306:TCP"= 56306:TCP:Pando Media Booster
"56306:UDP"= 56306:UDP:Pando Media Booster
"56776:TCP"= 56776:TCP:Pando Media Booster
"56776:UDP"= 56776:UDP:Pando Media Booster
"59074:TCP"= 59074:TCP:Pando Media Booster
"59074:UDP"= 59074:UDP:Pando Media Booster

R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [1/5/2010 7:56 AM 9968]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [1/5/2010 7:56 AM 74480]
R2 Hamachi2Svc;LogMeIn Hamachi 2.0 Tunneling Engine;c:\program files\LogMeIn Hamachi\hamachi-2.exe [10/29/2009 12:27 PM 1074568]
R2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [11/3/2006 7:19 PM 13592]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [8/27/2009 7:41 AM 102448]
S3 ALSysIO;ALSysIO;\??\c:\docume~1\Man\LOCALS~1\Temp\ALSysIO.sys --> c:\docume~1\Man\LOCALS~1\Temp\ALSysIO.sys [?]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\ambfilt.sys [8/2/2009 5:15 PM 1684736]
S3 COH_Mon;COH_Mon;c:\windows\system32\drivers\coh_mon.sys [1/12/2008 5:32 PM 23888]
S3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des -service --> c:\windows\system32\GameMon.des -service [?]
S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [1/5/2010 7:56 AM 7408]
S3 XDva294;XDva294;\??\c:\windows\system32\XDva294.sys --> c:\windows\system32\XDva294.sys [?]
S3 XDva309;XDva309;\??\c:\windows\system32\XDva309.sys --> c:\windows\system32\XDva309.sys [?]
.
Contents of the 'Scheduled Tasks' folder

2010-03-02 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Windows Defender\MpCmdRun.exe [2006-11-04 00:20]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://yahoo.com/
uInternet Settings,ProxyOverride = *.local
FF - ProfilePath - c:\documents and settings\Man\Application Data\Mozilla\Firefox\Profiles\5ma0iolo.default\
FF - prefs.js: browser.search.defaulturl - hxxp://aim.search.aol.com/search/search?query={searchTerms}&invocationType=tb50-ff-aim-chromesbox-en-us
FF - prefs.js: browser.startup.homepage - google.com
FF - plugin: c:\documents and settings\All Users\Application Data\NexonUS\NGM\npNxGameUS.dll
FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll
FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npdnupdater2.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\NPMFireLauncher.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- FIREFOX POLICIES ----
FF - user.js: yahoo.homepage.dontask - true);user_pref(network.protocol-handler.warn-external.dnupdate, false);user_pref(network.protocol-handler.warn-external.dnupdate, false.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-03-01 19:49
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

HKCU\Software\Microsoft\Windows\CurrentVersion\Run
SansaDispatch = c:\documents and settings\Man\Application Data\SanDisk\Sansa Updater\SansaDispatch.exe??e?c?k?.?j?p?g?"?>?<?/?d?i?v?>?<?/?t?d?>?<?/?t?r?>? ?<?t?r?>?<?t?d?>?C?h?e?c?k?i?n?g?

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe catchme.sys CLASSPNP.SYS disk.sys ACPI.sys hal.dll >>UNKNOWN [0x8AEB48D4]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0xb80ecfc3
\Driver\ACPI -> ACPI.sys @ 0xb7f7fcb8
\Driver\atapi -> atapi.sys @ 0xb7f377b4
IoDeviceObjectType -> DeleteProcedure -> ntkrnlpa.exe @ 0x80582544
ParseProcedure -> ntkrnlpa.exe @ 0x80581684
\Device\Harddisk0\DR0 -> DeleteProcedure -> ntkrnlpa.exe @ 0x80582544
ParseProcedure -> ntkrnlpa.exe @ 0x80581684
NDIS: Intel® 82562V-2 10/100 Network Connection -> SendCompleteHandler -> NDIS.sys @ 0xb7e19ba0
PacketIndicateHandler -> NDIS.sys @ 0xb7e26b21
SendHandler -> NDIS.sys @ 0xb7e0487b
user & kernel MBR OK

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\npggsvc]
"ImagePath"="c:\windows\system32\GameMon.des -service"
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(1140)
c:\windows\system32\WININET.dll
c:\program files\SUPERAntiSpyware\SASWINLO.dll

- - - - - - - > 'lsass.exe'(1200)
c:\windows\system32\WININET.dll
.
Completion time: 2010-03-01 19:53:05
ComboFix-quarantined-files.txt 2010-03-02 00:52
ComboFix2.txt 2010-02-20 17:43
ComboFix3.txt 2010-02-16 05:42
ComboFix4.txt 2010-02-15 04:18
ComboFix5.txt 2010-03-01 02:58

Pre-Run: 1,650,708,480 bytes free
Post-Run: 1,913,491,456 bytes free

- - End Of File - - 4AD9D6CB11D5902B171A8855A7C849EF

Edited by myopic, 01 March 2010 - 08:47 PM.


#9 etavares

etavares

    Bleepin' Remover


  • Malware Response Team
  • 15,514 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:04:50 AM

Posted 02 March 2010 - 10:18 PM

Hello, myopic.
OK, we need to manually replace an infected file.





Step 1

We need to create a batch file to run from the Recovery Console.
  • Open notepad
  • Copy the contents of the Code Box below to the notepad window
  • Click File -> Save As...
  • In the File name: field, type C:\runme.txt, then click Save
  • Close notepad
CODE
ren c:\windows\system32\drivers\atapi.sys atapi.old
copy c:\windows\SoftwareDistribution\Download\9866fb57abdc0ea2f5d4e132d055ba4e\atapi.sys c:\windows\system32\drivers


Now give the instructions to boot into recovery console. To boot into the Recovery Console, once your computer passes the BIOS, you will have 2 seconds in the OS choice menu to choose Windows XP or Windows Recovery Console. Use you arrow keys to move up. High-light it and hit Enter on your keyboard.

Once in recovery console:

Type the following command at the C:\Windows prompt then hit Enter: (note the space between ...ch C:\...)

batch C:\runme.txt

Reboot normally.





Step 2

After the reboot, please post a fresh OTL log. If this doesn't work, we'll likely need your Windows CD.

etavares

Edited by etavares, 02 March 2010 - 10:18 PM.


If I don't respond within 2 days, please feel free to PM me.
Please don't ask for help via PM. The forums are there for a reason. Please post in the forums so others may benefit as well.

Posted Image
Unified Network of Instructors and Trusted Eliminators
 


#10 myopic

myopic
  • Topic Starter

  • Members
  • 33 posts
  • OFFLINE
  •  
  • Local time:04:50 AM

Posted 02 March 2010 - 10:35 PM

After following Step 1, I get a BSOD every time I try to restart my computer. The error is : STOP 0X0000007B.

#11 etavares

etavares

    Bleepin' Remover


  • Malware Response Team
  • 15,514 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:04:50 AM

Posted 02 March 2010 - 10:59 PM

OK, that one did not work. That error is related to this file. Either it didn't take, or it's a bad copy. This is a nasty rootkit.

Get back into the recovery console. This time type the following at the command prompt and hit enter after each line. This will get back to the infected one, but at least you can boot up for now. We'll need your CD after this to find a clean copy that will work.

ren c:\windows\system32\drivers\atapi.sys atapi.bak
ren c:\windows\system32\drivers\atapi.old atapi.sys


Then reboot normally. Success?


If I don't respond within 2 days, please feel free to PM me.
Please don't ask for help via PM. The forums are there for a reason. Please post in the forums so others may benefit as well.

Posted Image
Unified Network of Instructors and Trusted Eliminators
 


#12 myopic

myopic
  • Topic Starter

  • Members
  • 33 posts
  • OFFLINE
  •  
  • Local time:04:50 AM

Posted 02 March 2010 - 11:04 PM

It appears I don't have the file.
I get "the system cannot find the file or directory specified"

#13 etavares

etavares

    Bleepin' Remover


  • Malware Response Team
  • 15,514 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:04:50 AM

Posted 02 March 2010 - 11:06 PM

for which line?


If I don't respond within 2 days, please feel free to PM me.
Please don't ask for help via PM. The forums are there for a reason. Please post in the forums so others may benefit as well.

Posted Image
Unified Network of Instructors and Trusted Eliminators
 


#14 myopic

myopic
  • Topic Starter

  • Members
  • 33 posts
  • OFFLINE
  •  
  • Local time:04:50 AM

Posted 02 March 2010 - 11:06 PM

Both ohmy.gif

#15 etavares

etavares

    Bleepin' Remover


  • Malware Response Team
  • 15,514 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:04:50 AM

Posted 02 March 2010 - 11:18 PM

OK, no worries. Your files are safe and we can recover.

1. Boot from your Windows CD. You may need to change the boot order by going into BIOS to change the boot order.
2. At "press any key to boot from CD", just hit Enter.
3. After it loads (takes a minute), press "R" to enter the recovery console.
4. If you need to select the installation, select '1'.
5. If prompted for an Admin password, type it in, or press Enter if there is none.
6. Determine your CD drive. It should look like D: \device\CdRom0 which means D: is your CD Drive.
7. Once at the command prompt...type the following and hit enter after each line


cd system32\drivers
ren atapi.sys atapi.old
expand D:\i386\atapi.sy_


And change D:\ in the last line to your CD-ROm letter. Then reboot.

Success?

Edited by etavares, 02 March 2010 - 11:18 PM.


If I don't respond within 2 days, please feel free to PM me.
Please don't ask for help via PM. The forums are there for a reason. Please post in the forums so others may benefit as well.

Posted Image
Unified Network of Instructors and Trusted Eliminators
 





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users