Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Google Redirecting Searches, Other Possible Infections


  • This topic is locked This topic is locked
11 replies to this topic

#1 Ralis

Ralis

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:11:43 AM

Posted 28 February 2010 - 05:10 AM

Hello,

I've been having problems with my computer for a few months now, ever since I was infected with a Trojan false anti-virus program. Although it appeared I was able to successful get rid of it, either remnants remain or I have a new infection. Some of my problems include:

- Google redirecting searches. I often have to go back and try two or three times to get where I want to go.

- MSN Messenger will not start. I get the error message "Failed to connect to the service. This could be due to improper firewall or proxy settings. Please review your proxy and firewall settings."

- Cannot upload images or files to anything like emails, Photobucket, Imageshack, Deviantart, etc. I get this message: "Upload failed for screenValkyrie048.jpg with error: A network error caused your upload to fail. Please try your upload again."

- Ventrilo (Live chat program) no longer allows me to talk, though I can hear others. (Nevermind; figured this one out, though I'm not sure how it happened in the first place.)

I'm not sure which of these are caused by viruses and which are something weird going on in my system. It seems like every day something else is breaking, which is making me think there's some sort of infection eating my files away. As far as I know, I haven't changed anything having to do with my settings for any of these things. I have uninstalled and reinstalled all these programs and the problems persist.

Any help in getting things back to normal would be greatly appreciated. Thank you!


DDS (Ver_09-12-01.01) - NTFSx86
Run by B at 1:06:00.31 on Sun 02/28/2010
Internet Explorer: 8.0.6001.18702
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.1023.324 [GMT -8:00]

AV: Malware Defense *On-access scanning enabled* (Outdated) {28e00e3b-806e-4533-925c-f4c3d79514b9}
AV: ESET Smart Security 4.0 *On-access scanning enabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
FW: ESET Personal firewall *enabled* {E5E70D32-0101-4340-86A3-A7B0F1C8FFE0}

============== Running Processes ===============

C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost -k DcomLaunch
C:\WINDOWS\system32\svchost -k rpcss
C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\ZcfgSvc.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
C:\WINDOWS\system32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k NetworkService
C:\WINDOWS\system32\svchost.exe -k LocalService
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Spyware Doctor\BDT\BDTUpdateService.exe
C:\PROGRA~1\Intel\Wireless\Bin\1XConfig.exe
C:\Program Files\ESET\ESET Smart Security\ekrn.exe
C:\Program Files\Common Files\Motive\McciCMService.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\Spyware Doctor\pctsAuxs.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\ESET\ESET Smart Security\egui.exe
C:\Program Files\Spyware Doctor\pctsTray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Spyware Doctor\pctsSvc.exe
C:\Documents and Settings\B\Desktop\Oldcrap\RagnarokOnline\RagFree.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Innovative Solutions\Advanced Uninstaller PRO\uninstaller.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\Documents and Settings\B\My Documents\Downloads\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.google.com/
uSearch Page = hxxp://www.google.com
uDefault_Page_URL = hxxp://www.dell4me.com/myway
uSearch Bar = hxxp://www.google.com/ie
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyServer = http=127.0.0.1:5555
uInternet Settings,ProxyOverride = <local>
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
mSearchAssistant = hxxp://www.google.com/ie
BHO: AcroIEHlprObj Class: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 7.0\activex\AcroIEHelper.dll
BHO: PC Tools Browser Guard BHO: {2a0f3d1b-0909-4ff4-b272-609cce6054e7} - c:\program files\spyware doctor\bdt\PCTBrowserDefender.dll
BHO: Search Helper: {6ebf7485-159f-4bff-a14f-b9e3aac4465b} - c:\program files\microsoft\search enhancement pack\search helper\SearchHelper.dll
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Windows Live Toolbar Helper: {e15a8dc0-8516-42a1-81ea-dc94ec1acf10} - c:\program files\windows live\toolbar\wltcore.dll
TB: &Windows Live Toolbar: {21fa44ef-376d-4d53-9b0f-8a89d3229068} - c:\program files\windows live\toolbar\wltcore.dll
TB: PC Tools Browser Guard: {472734ea-242a-422b-adf8-83d1e48cc825} - c:\program files\spyware doctor\bdt\PCTBrowserDefender.dll
TB: &Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} -
EB: Real.com: {fe54fa40-d68c-11d2-98fa-00c0f0318afe} - c:\windows\system32\Shdocvw.dll
uRun: [blacstdg] c:\documents and settings\b\local settings\application data\ojlsgu\wkhisftav.exe
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRunOnce: [Shockwave Updater] c:\windows\system32\adobe\shockw~1\SWHELP~1.EXE -Update -1103471 -"Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.0.14) Gecko/2009082707 desktopsmiley_3_3_682531475513595441_13_66" -"http://www.neopets.com/games/dgs/play_shockwave.phtml?va=&game_id=349&nc_referer=&age=1&hiscore=150345&sp=0&questionSet=&r=9032385&width=600&height=440&quality=high"
mRun: [Apoint] c:\program files\apoint\Apoint.exe
mRun: [<NO NAME>]
mRun: [IntelWireless] c:\program files\intel\wireless\bin\ifrmewrk.exe /tf Intel PROSet/Wireless
mRun: [ATIPTA] "c:\program files\ati technologies\ati control panel\atiptaxx.exe"
mRun: [egui] "c:\program files\eset\eset smart security\egui.exe" /hide /waitservice
mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
mRun: [blacstdg] c:\documents and settings\b\local settings\application data\ojlsgu\wkhisftav.exe
mRun: [ISTray] "c:\program files\spyware doctor\pctsTray.exe"
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\digita~1.lnk - c:\program files\digital line detect\DLG.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\mcafee~1.lnk - c:\program files\mcafee security scan\2.0.181\SSScheduler.exe
mPolicies-system: EnableLUA = 0 (0x0)
IE: E&xport to Microsoft Excel - c:\progra~1\micros~4\office10\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files\google\google toolbar\component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll/cmsidewiki.html
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {08B0E5C0-4FCB-11CF-AAA5-00401C608501}
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll
IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - {FE54FA40-D68C-11d2-98FA-00C0F0318AFE} - c:\windows\system32\Shdocvw.dll
DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/products/plugin/autodl/jinstall-142-windows-i586.cab
DPF: {CAFEEFAC-0014-0002-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/products/plugin/autodl/jinstall-142-windows-i586.cab
TCP: NameServer = 93.188.162.95,93.188.161.78
TCP: {BF6E9588-5A35-4BEB-B8C4-D5C804B8E0B7} = 93.188.162.95,93.188.161.78
TCP: {CDB885C2-7E57-4D97-A981-CCFBF34C896D} = 93.188.162.95,93.188.161.78
Handler: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - c:\program files\common files\microsoft shared\web folders\PKMCDO.DLL
Notify: AtiExtEvent - Ati2evxx.dll
Notify: IntelWireless - c:\program files\intel\wireless\bin\LgNotify.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\b\applic~1\mozilla\firefox\profiles\qsxkzf7s.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/
FF - prefs.js: keyword.URL - hxxp://www.gamingharbor.com/search.do?desktopsmiley&keyword=
FF - plugin: c:\documents and settings\b\application data\mozilla\firefox\profiles\qsxkzf7s.default\extensions\moveplayer@movenetworks.com\platform\winnt_x86-msvc\plugins\npmnqmp071303000006.dll
FF - plugin: c:\program files\java\j2re1.4.2_03\bin\NPJava11.dll
FF - plugin: c:\program files\java\j2re1.4.2_03\bin\NPJava12.dll
FF - plugin: c:\program files\java\j2re1.4.2_03\bin\NPJava13.dll
FF - plugin: c:\program files\java\j2re1.4.2_03\bin\NPJava14.dll
FF - plugin: c:\program files\java\j2re1.4.2_03\bin\NPJava32.dll
FF - plugin: c:\program files\java\j2re1.4.2_03\bin\NPJPI142_03.dll
FF - plugin: c:\program files\java\j2re1.4.2_03\bin\NPOJI610.dll
FF - plugin: c:\program files\microsoft\office live\npOLW.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npunagi2.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npViewpoint.dll
FF - plugin: c:\program files\windows live\photo gallery\NPWLPG.dll

---- FIREFOX POLICIES ----
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);

============= SERVICES / DRIVERS ===============

R0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [2010-1-5 207792]
R2 Browser Defender Update Service;Browser Defender Update Service;c:\program files\spyware doctor\bdt\BDTUpdateService.exe [2010-1-5 112592]
R2 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [2009-9-11 108792]
R2 ekrn;ESET Service;c:\program files\eset\eset smart security\ekrn.exe [2009-9-11 735960]
R2 fssfltr;FssFltr;c:\windows\system32\drivers\fssfltr_tdi.sys [2009-11-6 54752]
R2 sdAuxService;PC Tools Auxiliary Service;c:\program files\spyware doctor\pctsAuxs.exe [2010-2-27 359624]
R2 sdCoreService;PC Tools Security Service;c:\program files\spyware doctor\pctsSvc.exe [2010-2-27 1141712]
S2 .EsetTrialReset;Eset Trial Reset;c:\windows\reset.exe [2009-3-13 357182]
S3 fsssvc;Windows Live Family Safety Service;c:\program files\windows live\family safety\fsssvc.exe [2009-8-5 704864]
S3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\mcafee security scan\2.0.181\McCHSvc.exe [2010-1-15 227232]
S3 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [2004-10-29 32000]
S3 palmmdm;Palm Modem;c:\windows\system32\drivers\palmmdm.sys [2006-1-30 9728]

=============== Created Last 30 ================

2010-02-28 09:05:40 0 ----a-w- c:\documents and settings\b\defogger_reenable
2010-02-28 08:50:28 0 d-----w- c:\program files\Ventrilo
2010-02-28 08:50:20 210 ----a-w- c:\windows\{789289CA-F73A-4A16-A331-54D498CE069F}_WiseFW.ini
2010-02-27 07:36:06 0 d-sh--w- c:\documents and settings\b\IECompatCache
2010-02-27 07:35:20 0 d-sh--w- c:\documents and settings\b\PrivacIE
2010-02-27 07:33:25 0 d-sh--w- c:\documents and settings\b\IETldCache
2010-02-27 07:26:28 0 dc-h--w- c:\windows\ie8
2010-02-26 07:53:40 0 d-----w- c:\docume~1\alluse~1\applic~1\McAfee Security Scan
2010-02-26 07:53:32 0 d-----w- c:\program files\McAfee Security Scan
2010-02-01 22:47:36 164 ----a-w- c:\windows\CDPLAYER.UNI

==================== Find3M ====================

2010-01-06 03:57:42 16904 ----a-w- c:\windows\system32\drivers\KLMD.sys

============= FINISH: 1:06:49.06 ===============

Attached Files


Edited by Ralis, 28 February 2010 - 05:20 AM.


BC AdBot (Login to Remove)

 


#2 Ralis

Ralis
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:11:43 AM

Posted 01 March 2010 - 01:42 AM

Update:

A lot of things (scans, other messenger services) are telling me there's a problem with my internet connection. I'm just not sure what exactly that problem is.

#3 Blade

Blade

    Strong in the Bleepforce


  • Site Admin
  • 12,702 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:US
  • Local time:03:43 PM

Posted 03 March 2010 - 09:26 PM

Hello Ralis

Hello, and welcome.gif to the Malware Removal forum! My online alias is Blade Zephon, or Blade for short, and I will be assisting you with your malware issues!

If you have since resolved the original problem you were having, we would appreciate you letting us know.

In the upper right hand corner of the topic you will see a button called Options. If you click on this in the drop-down menu you can choose Track this topic. By doing this and then choosing Immediate E-Mail notification and then clicking on Proceed you will be advised when we respond to your topic and facilitate the cleaning of your machine.

Before we begin cleaning your machine, I'd like to lay out some guidelines for us to follow while we are working together.
  • I will be assisting you with your malware issues. This may or may not resolve other problems you are having with your computer. If you are still having problems after your machine has been determined clean, I will be glad to direct you to the proper forum for assistance.
  • Even if things appear better, that does not mean we are finished. Please continue to follow my instructions until I give you the all clean. Absence of symptoms does not mean that all the malware has been removed. If a piece of the infection is left, it can regenerate and reinfect your machine.
  • Attention to detail is important! Since I cannot see or directly interact with your computer I am dependent on you to "be my eyes" and provide as much information as you can regarding the current state of your computer.
  • I ask that you please refrain from running tools other than those I suggest to you while I am cleaning up your computer. The reason for this is so I know what is going on with the machine at any time. If you act independently it will cause changes to your system that I will not be aware of, which will make the process of cleaning the machine a much slower and more difficult process. Additionally, some programs can interfere with others and hamper the recovery process.
  • Please perform all steps in the order received. If you are unsure or confused about any instructions I give you, you should ask me to clarify before doing anything. Additionally, if you run into any problems while carrying out instructions, you should STOP and reply back here explaining what happened.
  • After 5 days if a topic is not replied to we assume it has been abandoned and it is closed. If you need additional time, that is perfectly alright; you just need to let us know beforehand. smile.gif

***************************************************

Please perform the following steps below so we can have a look at the current condition of your machine.

Download Combofix from any of the links below but rename it to renamed.exe before saving it to your desktop.


Link 1
Link 2

* IMPORTANT !!! Save ComboFix.exe to your Desktop
  • VERY IMPORTANT: Disable all running antivirus, antimalware and firewall programs as they may interfere with the proper running of ComboFix. Click on this link to see a list of programs that should be disabled. NOTE: This list is not all-inclusive. If yours is not listed and you do not know how to disable it, please ask.
  • Double click on renamed.exe & follow the prompts.
  • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.



Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:



Click on Yes, to continue scanning for malware.

When finished, it will produce a log for you. Please include the C:\ComboFix.txt in your next reply

A word of warning: Neither I nor sUBs are responsible for any damage you may have caused your machine by running ComboFix on your own.
This tool is not a toy and not for everyday use.
ComboFix SHOULD NOT be used unless requested by a forum helper


~Blade

In your next reply, please include the following:
ComboFix log

Posted Image

If I am helping you, it has been 48 hours since your last post, and I have yet to reply to your topic, please send me a PM
Become a BleepingComputer fan: Facebook
Follow us on Twitter!
Circle us on Google+


#4 Ralis

Ralis
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:11:43 AM

Posted 04 March 2010 - 12:22 AM

Hi Blade,

Thanks for the help. =)

Here's the log:

ComboFix 10-03-03.04 - B 03/03/2010 21:05:02.1.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.1023.671 [GMT -8:00]
Running from: c:\documents and settings\B\My Documents\Downloads\Renamed.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users\Application Data\sysReserve.ini
c:\program files\WinPCap
c:\program files\WinPCap\daemon_mgm.exe
c:\program files\WinPCap\INSTALL.LOG
c:\program files\WinPCap\NetMonInstaller.exe
c:\program files\WinPCap\npf_mgm.exe
c:\program files\WinPCap\rpcapd.exe
c:\program files\WinPCap\Uninstall.exe
c:\windows\system32\drivers\npf.sys
c:\windows\system32\H8SRTbxeolidqxr.dll
c:\windows\system32\H8SRThskpewswew.dll
c:\windows\system32\H8SRTjrsiphwerf.dat
c:\windows\system32\H8SRTlngwrumltq.dll
c:\windows\system32\krl32mainweq.dll
c:\windows\system32\Packet.dll
c:\windows\system32\pthreadVC.dll
c:\windows\system32\srcr.dat
c:\windows\system32\twain_32.dll
c:\windows\system32\WanPacket.dll
c:\windows\system32\wpcap.dll

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_NPF
-------\Service_NPF


((((((((((((((((((((((((( Files Created from 2010-02-04 to 2010-03-04 )))))))))))))))))))))))))))))))
.

2010-03-04 05:00 . 2010-03-04 05:02 -------- d-----w- C:\Renamed
2010-03-02 06:57 . 2010-03-02 06:57 -------- d-----w- c:\program files\Ventrilo
2010-03-02 05:39 . 2010-03-02 05:39 -------- d-----w- c:\windows\system32\wbem\Repository
2010-03-02 05:35 . 2010-03-02 05:35 -------- d-----w- c:\documents and settings\All Users\Application Data\NOS
2010-03-02 05:34 . 2010-03-02 05:38 -------- d-----w- c:\program files\Google
2010-03-02 05:26 . 2010-03-02 05:26 -------- d-----w- c:\documents and settings\B\Local Settings\Application Data\Threat Expert
2010-03-02 05:26 . 2010-03-02 05:26 -------- d-----w- c:\documents and settings\B\Application Data\PC Tools
2010-03-02 05:26 . 2010-03-02 05:26 -------- d-----w- c:\documents and settings\All Users\Application Data\PC Tools
2010-02-28 08:50 . 2010-03-02 05:34 -------- d-----w- c:\program files\Ventrilo(2)
2010-02-27 07:36 . 2010-02-27 07:36 -------- d-----w- c:\documents and settings\B\IECompatCache
2010-02-27 07:35 . 2010-02-27 07:35 -------- d-----w- c:\documents and settings\B\PrivacIE
2010-02-27 07:33 . 2010-02-27 07:33 -------- d-----w- c:\documents and settings\LocalService\IETldCache
2010-02-27 07:33 . 2010-02-27 07:33 -------- d-----w- c:\documents and settings\B\IETldCache
2010-02-27 07:26 . 2010-03-02 05:35 -------- dc----w- c:\windows\ie8
2010-02-26 07:53 . 2010-02-26 07:53 -------- d-----w- c:\documents and settings\All Users\Application Data\McAfee

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-03-04 05:12 . 2008-07-14 15:11 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2010-03-02 06:57 . 2005-07-23 00:29 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2010-03-02 05:35 . 2010-01-06 04:38 -------- d-----w- c:\program files\Spyware Doctor
2010-03-02 05:26 . 2010-01-06 04:38 -------- d-----w- c:\program files\Common Files\PC Tools
2010-03-02 04:26 . 2005-10-26 02:39 29256 ----a-w- c:\documents and settings\B\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-02-01 07:39 . 2010-02-01 07:39 -------- d-----w- c:\documents and settings\B\Application Data\Canon
2010-01-07 04:25 . 2010-01-07 04:25 -------- d-----w- c:\program files\ESET
2010-01-06 03:57 . 2010-01-06 03:57 16904 ----a-w- c:\windows\system32\drivers\KLMD.sys
2010-01-05 23:46 . 2010-01-05 23:41 -------- d-----w- c:\documents and settings\All Users\Application Data\avg9
2010-01-05 23:20 . 2010-01-05 23:20 -------- d-----w- c:\documents and settings\B\Application Data\AVG8
2010-01-05 23:12 . 2010-01-05 23:12 -------- d-----w- c:\documents and settings\LocalService\Application Data\AVG7
2010-01-05 23:12 . 2010-01-05 23:12 -------- d-----w- c:\documents and settings\All Users\Application Data\Grisoft
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Apoint"="c:\program files\Apoint\Apoint.exe" [2004-09-13 155648]
"IntelWireless"="c:\program files\Intel\Wireless\Bin\ifrmewrk.exe" [2004-10-30 385024]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-08-06 344064]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2005-7-15 24576]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\IntelWireless]
2004-09-07 21:08 110592 ----a-w- c:\program files\Intel\Wireless\Bin\LgNotify.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"c:\\Program Files\\Ventrilo\\Ventrilo.exe"=

R0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [1/5/2010 8:38 PM 207792]
R2 Browser Defender Update Service;Browser Defender Update Service;c:\program files\Spyware Doctor\BDT\BDTUpdateService.exe [1/5/2010 8:41 PM 112592]
R2 fssfltr;FssFltr;c:\windows\system32\drivers\fssfltr_tdi.sys [11/6/2009 12:06 AM 54752]
S3 fsssvc;Windows Live Family Safety Service;c:\program files\Windows Live\Family Safety\fsssvc.exe [8/5/2009 10:48 PM 704864]
S3 palmmdm;Palm Modem;c:\windows\system32\drivers\palmmdm.sys [1/30/2006 12:42 PM 9728]
S3 sdAuxService;PC Tools Auxiliary Service;c:\program files\Spyware Doctor\pctsAuxs.exe [1/5/2010 8:38 PM 359624]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://home.gamingharbor.com
mStart Page = hxxp://www.dell4me.com/myway
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = *.local
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\Office10\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll/cmsidewiki.html
FF - ProfilePath - c:\documents and settings\B\Application Data\Mozilla\Firefox\Profiles\qsxkzf7s.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/
FF - prefs.js: keyword.URL - hxxp://www.gamingharbor.com/search.do?desktopsmiley&keyword=
FF - plugin: c:\documents and settings\B\Application Data\Mozilla\Firefox\Profiles\qsxkzf7s.default\extensions\moveplayer@movenetworks.com\platform\WINNT_x86-msvc\plugins\npmnqmp071303000006.dll
FF - plugin: c:\program files\Java\j2re1.4.2_03\bin\NPJava11.dll
FF - plugin: c:\program files\Java\j2re1.4.2_03\bin\NPJava12.dll
FF - plugin: c:\program files\Java\j2re1.4.2_03\bin\NPJava13.dll
FF - plugin: c:\program files\Java\j2re1.4.2_03\bin\NPJava14.dll
FF - plugin: c:\program files\Java\j2re1.4.2_03\bin\NPJava32.dll
FF - plugin: c:\program files\Java\j2re1.4.2_03\bin\NPJPI142_03.dll
FF - plugin: c:\program files\Java\j2re1.4.2_03\bin\NPOJI610.dll
FF - plugin: c:\program files\Microsoft\Office Live\npOLW.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npunagi2.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npViewpoint.dll
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
.
- - - - ORPHANS REMOVED - - - -

AddRemove-WinPcapInst - c:\program files\WinPcap\Uninstall.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-03-03 21:13
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys PCTCore.sys atapi.sys >>UNKNOWN [0x867CF8C8]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0xf761ffc3
\Driver\ACPI -> ACPI.sys @ 0xf74b2cb8
\Driver\atapi -> atapi.sys @ 0xf74309f2
IoDeviceObjectType -> DeleteProcedure -> ntkrnlpa.exe @ 0x80577d44
\Device\Harddisk0\DR0 -> DeleteProcedure -> ntkrnlpa.exe @ 0x80577d44
NDIS: Broadcom 440x 10/100 Integrated Controller -> SendCompleteHandler -> NDIS.sys @ 0xf730fba0
PacketIndicateHandler -> NDIS.sys @ 0xf72fea0b
SendHandler -> NDIS.sys @ 0xf7312b31
user & kernel MBR OK

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(1028)
c:\windows\system32\Ati2evxx.dll
c:\program files\Intel\Wireless\Bin\LgNotify.dll

- - - - - - - > 'explorer.exe'(3380)
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\Ati2evxx.exe
c:\program files\Intel\Wireless\Bin\EvtEng.exe
c:\program files\Intel\Wireless\Bin\S24EvMon.exe
c:\program files\Intel\Wireless\Bin\ZcfgSvc.exe
c:\program files\Intel\Wireless\Bin\WLKeeper.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Common Files\Motive\McciCMService.exe
c:\program files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
c:\progra~1\Intel\Wireless\Bin\1XConfig.exe
c:\program files\Intel\Wireless\Bin\RegSrvc.exe
c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
c:\windows\system32\Ati2evxx.exe
c:\program files\Canon\CAL\CALMAIN.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2010-03-03 21:18:15 - machine was rebooted
ComboFix-quarantined-files.txt 2010-03-04 05:18

Pre-Run: 12,045,156,352 bytes free
Post-Run: 12,081,938,432 bytes free

- - End Of File - - 6E9A2BB17ED7FAB37496DD0CDB0A5D22


#5 Blade

Blade

    Strong in the Bleepforce


  • Site Admin
  • 12,702 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:US
  • Local time:03:43 PM

Posted 06 March 2010 - 09:31 PM

  • Download TDSSKiller and save it to your Desktop.
  • Extract its contents to your desktop and make sure TDSSKiller.exe (the contents of the zipped file) is on the Desktop itself, not within a folder on the desktop.
  • Go to Start > Run (Or you can hold down your Windows key and press R) and copy and paste the following into the text field. (make sure you include the quote marks) Then press OK.

    "%userprofile%\Desktop\TDSSKiller.exe" -l C:\TDSSKiller.txt -v

  • If it says "Hidden service detected" DO NOT type anything in. Just press Enter on your keyboard to not do anything to the file.
  • When it is done, a log file should be created on your C: drive called "TDSSKiller.txt" please copy and paste the contents of that file here.

~Blade


In your next reply, please include the following:
TDSSKiller log

Posted Image

If I am helping you, it has been 48 hours since your last post, and I have yet to reply to your topic, please send me a PM
Become a BleepingComputer fan: Facebook
Follow us on Twitter!
Circle us on Google+


#6 Ralis

Ralis
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:11:43 AM

Posted 07 March 2010 - 12:58 AM

The TDSS log:

21:56:10:562 0764 TDSS rootkit removing tool 2.2.7.1 Feb 27 2010 13:29:25
21:56:10:562 0764 ================================================================================
21:56:10:562 0764 SystemInfo:

21:56:10:562 0764 OS Version: 5.1.2600 ServicePack: 2.0
21:56:10:562 0764 Product type: Workstation
21:56:10:562 0764 ComputerName: DELL6000
21:56:10:562 0764 UserName: B
21:56:10:562 0764 Windows directory: C:\WINDOWS
21:56:10:562 0764 Processor architecture: Intel x86
21:56:10:562 0764 Number of processors: 1
21:56:10:562 0764 Page size: 0x1000
21:56:10:562 0764 Boot type: Normal boot
21:56:10:562 0764 ================================================================================
21:56:10:562 0764 UnloadDriverW: NtUnloadDriver error 1
21:56:10:562 0764 ForceUnloadDriverW: UnloadDriverW(klmd21) error 1
21:56:10:578 0764 LoadDriverW: Driver already loaded
21:56:10:578 0764 KLMD_DropNLoadW: LoadDriverW(klmd21) error 1056
21:56:10:578 0764 Initialize success
21:56:10:578 0764
21:56:10:578 0764 Scanning Services ...
21:56:10:578 0764 wfopen_ex: Trying to open file C:\WINDOWS\system32\config\system
21:56:10:578 0764 wfopen_ex: MyNtCreateFileW error 32 (C0000043)
21:56:10:578 0764 wfopen_ex: Trying to KLMD file open
21:56:10:578 0764 wfopen_ex: File opened ok (Flags 2)
21:56:10:578 0764 wfopen_ex: Trying to open file C:\WINDOWS\system32\config\software
21:56:10:578 0764 wfopen_ex: MyNtCreateFileW error 32 (C0000043)
21:56:10:578 0764 wfopen_ex: Trying to KLMD file open
21:56:10:578 0764 wfopen_ex: File opened ok (Flags 2)
21:56:11:078 0764 GetAdvancedServicesInfo: Raw services enum returned 350 services
21:56:11:078 0764 fclose_ex: Trying to close file C:\WINDOWS\system32\config\system
21:56:11:078 0764 fclose_ex: Trying to close file C:\WINDOWS\system32\config\software
21:56:11:078 0764
21:56:11:078 0764 Scanning Kernel memory ...
21:56:11:078 0764 Devices to scan: 4
21:56:11:078 0764
21:56:11:078 0764 Driver Name: Disk
21:56:11:078 0764 IRP_MJ_CREATE : F7621C30
21:56:11:078 0764 IRP_MJ_CREATE_NAMED_PIPE : 804F320E
21:56:11:078 0764 IRP_MJ_CLOSE : F7621C30
21:56:11:078 0764 IRP_MJ_READ : F761BD9B
21:56:11:078 0764 IRP_MJ_WRITE : F761BD9B
21:56:11:078 0764 IRP_MJ_QUERY_INFORMATION : 804F320E
21:56:11:078 0764 IRP_MJ_SET_INFORMATION : 804F320E
21:56:11:078 0764 IRP_MJ_QUERY_EA : 804F320E
21:56:11:078 0764 IRP_MJ_SET_EA : 804F320E
21:56:11:078 0764 IRP_MJ_FLUSH_BUFFERS : F761C366
21:56:11:078 0764 IRP_MJ_QUERY_VOLUME_INFORMATION : 804F320E
21:56:11:078 0764 IRP_MJ_SET_VOLUME_INFORMATION : 804F320E
21:56:11:078 0764 IRP_MJ_DIRECTORY_CONTROL : 804F320E
21:56:11:078 0764 IRP_MJ_FILE_SYSTEM_CONTROL : 804F320E
21:56:11:078 0764 IRP_MJ_DEVICE_CONTROL : F761C44D
21:56:11:078 0764 IRP_MJ_INTERNAL_DEVICE_CONTROL : F761FFC3
21:56:11:078 0764 IRP_MJ_SHUTDOWN : F761C366
21:56:11:078 0764 IRP_MJ_LOCK_CONTROL : 804F320E
21:56:11:078 0764 IRP_MJ_CLEANUP : 804F320E
21:56:11:078 0764 IRP_MJ_CREATE_MAILSLOT : 804F320E
21:56:11:078 0764 IRP_MJ_QUERY_SECURITY : 804F320E
21:56:11:078 0764 IRP_MJ_SET_SECURITY : 804F320E
21:56:11:078 0764 IRP_MJ_POWER : F761DEF3
21:56:11:078 0764 IRP_MJ_SYSTEM_CONTROL : F7622A24
21:56:11:078 0764 IRP_MJ_DEVICE_CHANGE : 804F320E
21:56:11:078 0764 IRP_MJ_QUERY_QUOTA : 804F320E
21:56:11:078 0764 IRP_MJ_SET_QUOTA : 804F320E
21:56:11:109 0764 TDL3_StartIoLastChanceHookDetect: Unable to dump StartIo handler code
21:56:11:109 0764 sion
21:56:11:109 0764 C:\WINDOWS\system32\DRIVERS\disk.sys - Verdict: Clean
21:56:11:109 0764
21:56:11:109 0764 Driver Name: Disk
21:56:11:109 0764 IRP_MJ_CREATE : F7621C30
21:56:11:109 0764 IRP_MJ_CREATE_NAMED_PIPE : 804F320E
21:56:11:109 0764 IRP_MJ_CLOSE : F7621C30
21:56:11:109 0764 IRP_MJ_READ : F761BD9B
21:56:11:109 0764 IRP_MJ_WRITE : F761BD9B
21:56:11:109 0764 IRP_MJ_QUERY_INFORMATION : 804F320E
21:56:11:109 0764 IRP_MJ_SET_INFORMATION : 804F320E
21:56:11:109 0764 IRP_MJ_QUERY_EA : 804F320E
21:56:11:109 0764 IRP_MJ_SET_EA : 804F320E
21:56:11:109 0764 IRP_MJ_FLUSH_BUFFERS : F761C366
21:56:11:109 0764 IRP_MJ_QUERY_VOLUME_INFORMATION : 804F320E
21:56:11:109 0764 IRP_MJ_SET_VOLUME_INFORMATION : 804F320E
21:56:11:109 0764 IRP_MJ_DIRECTORY_CONTROL : 804F320E
21:56:11:109 0764 IRP_MJ_FILE_SYSTEM_CONTROL : 804F320E
21:56:11:109 0764 IRP_MJ_DEVICE_CONTROL : F761C44D
21:56:11:109 0764 IRP_MJ_INTERNAL_DEVICE_CONTROL : F761FFC3
21:56:11:109 0764 IRP_MJ_SHUTDOWN : F761C366
21:56:11:109 0764 IRP_MJ_LOCK_CONTROL : 804F320E
21:56:11:109 0764 IRP_MJ_CLEANUP : 804F320E
21:56:11:109 0764 IRP_MJ_CREATE_MAILSLOT : 804F320E
21:56:11:109 0764 IRP_MJ_QUERY_SECURITY : 804F320E
21:56:11:109 0764 IRP_MJ_SET_SECURITY : 804F320E
21:56:11:109 0764 IRP_MJ_POWER : F761DEF3
21:56:11:109 0764 IRP_MJ_SYSTEM_CONTROL : F7622A24
21:56:11:109 0764 IRP_MJ_DEVICE_CHANGE : 804F320E
21:56:11:109 0764 IRP_MJ_QUERY_QUOTA : 804F320E
21:56:11:109 0764 IRP_MJ_SET_QUOTA : 804F320E
21:56:11:109 0764 TDL3_StartIoLastChanceHookDetect: Unable to dump StartIo handler code
21:56:11:109 0764 sion
21:56:11:125 0764 C:\WINDOWS\system32\DRIVERS\disk.sys - Verdict: Clean
21:56:11:125 0764
21:56:11:125 0764 Driver Name: Disk
21:56:11:125 0764 IRP_MJ_CREATE : F7621C30
21:56:11:125 0764 IRP_MJ_CREATE_NAMED_PIPE : 804F320E
21:56:11:125 0764 IRP_MJ_CLOSE : F7621C30
21:56:11:125 0764 IRP_MJ_READ : F761BD9B
21:56:11:125 0764 IRP_MJ_WRITE : F761BD9B
21:56:11:125 0764 IRP_MJ_QUERY_INFORMATION : 804F320E
21:56:11:125 0764 IRP_MJ_SET_INFORMATION : 804F320E
21:56:11:125 0764 IRP_MJ_QUERY_EA : 804F320E
21:56:11:125 0764 IRP_MJ_SET_EA : 804F320E
21:56:11:125 0764 IRP_MJ_FLUSH_BUFFERS : F761C366
21:56:11:125 0764 IRP_MJ_QUERY_VOLUME_INFORMATION : 804F320E
21:56:11:125 0764 IRP_MJ_SET_VOLUME_INFORMATION : 804F320E
21:56:11:125 0764 IRP_MJ_DIRECTORY_CONTROL : 804F320E
21:56:11:125 0764 IRP_MJ_FILE_SYSTEM_CONTROL : 804F320E
21:56:11:125 0764 IRP_MJ_DEVICE_CONTROL : F761C44D
21:56:11:125 0764 IRP_MJ_INTERNAL_DEVICE_CONTROL : F761FFC3
21:56:11:125 0764 IRP_MJ_SHUTDOWN : F761C366
21:56:11:125 0764 IRP_MJ_LOCK_CONTROL : 804F320E
21:56:11:125 0764 IRP_MJ_CLEANUP : 804F320E
21:56:11:125 0764 IRP_MJ_CREATE_MAILSLOT : 804F320E
21:56:11:125 0764 IRP_MJ_QUERY_SECURITY : 804F320E
21:56:11:125 0764 IRP_MJ_SET_SECURITY : 804F320E
21:56:11:125 0764 IRP_MJ_POWER : F761DEF3
21:56:11:125 0764 IRP_MJ_SYSTEM_CONTROL : F7622A24
21:56:11:125 0764 IRP_MJ_DEVICE_CHANGE : 804F320E
21:56:11:125 0764 IRP_MJ_QUERY_QUOTA : 804F320E
21:56:11:125 0764 IRP_MJ_SET_QUOTA : 804F320E
21:56:11:125 0764 TDL3_StartIoLastChanceHookDetect: Unable to dump StartIo handler code
21:56:11:125 0764 sion
21:56:11:140 0764 C:\WINDOWS\system32\DRIVERS\disk.sys - Verdict: Clean
21:56:11:140 0764
21:56:11:140 0764 Driver Name: atapi
21:56:11:140 0764 IRP_MJ_CREATE : F74309F2
21:56:11:140 0764 IRP_MJ_CREATE_NAMED_PIPE : F74309F2
21:56:11:140 0764 IRP_MJ_CLOSE : F74309F2
21:56:11:140 0764 IRP_MJ_READ : F74309F2
21:56:11:140 0764 IRP_MJ_WRITE : F74309F2
21:56:11:140 0764 IRP_MJ_QUERY_INFORMATION : F74309F2
21:56:11:140 0764 IRP_MJ_SET_INFORMATION : F74309F2
21:56:11:140 0764 IRP_MJ_QUERY_EA : F74309F2
21:56:11:140 0764 IRP_MJ_SET_EA : F74309F2
21:56:11:140 0764 IRP_MJ_FLUSH_BUFFERS : F74309F2
21:56:11:140 0764 IRP_MJ_QUERY_VOLUME_INFORMATION : F74309F2
21:56:11:140 0764 IRP_MJ_SET_VOLUME_INFORMATION : F74309F2
21:56:11:140 0764 IRP_MJ_DIRECTORY_CONTROL : F74309F2
21:56:11:140 0764 IRP_MJ_FILE_SYSTEM_CONTROL : F74309F2
21:56:11:140 0764 IRP_MJ_DEVICE_CONTROL : F74309F2
21:56:11:140 0764 IRP_MJ_INTERNAL_DEVICE_CONTROL : F74309F2
21:56:11:140 0764 IRP_MJ_SHUTDOWN : F74309F2
21:56:11:140 0764 IRP_MJ_LOCK_CONTROL : F74309F2
21:56:11:140 0764 IRP_MJ_CLEANUP : F74309F2
21:56:11:140 0764 IRP_MJ_CREATE_MAILSLOT : F74309F2
21:56:11:140 0764 IRP_MJ_QUERY_SECURITY : F74309F2
21:56:11:140 0764 IRP_MJ_SET_SECURITY : F74309F2
21:56:11:140 0764 IRP_MJ_POWER : F74309F2
21:56:11:140 0764 IRP_MJ_SYSTEM_CONTROL : F74309F2
21:56:11:140 0764 IRP_MJ_DEVICE_CHANGE : F74309F2
21:56:11:140 0764 IRP_MJ_QUERY_QUOTA : F74309F2
21:56:11:140 0764 IRP_MJ_SET_QUOTA : F74309F2
21:56:11:156 0764 TDL3_IrpHookDetect: TDL3 Stub signature found, trying to get hook true addr
21:56:11:156 0764 TDL3_IrpHookDetect: New IrpHandler addr: 867648C8
21:56:11:156 0764 ihd1
21:56:11:156 0764 siohd: 0
21:56:11:156 0764 C:\WINDOWS\system32\drivers\tskDF.tmp - Verdict: Clean
21:56:11:156 0764
21:56:11:156 0764 Completed
21:56:11:156 0764
21:56:11:156 0764 Results:
21:56:11:156 0764 Memory objects infected / cured / cured on reboot: 0 / 0 / 0
21:56:11:171 0764 Registry objects infected / cured / cured on reboot: 0 / 0 / 0
21:56:11:171 0764 File objects infected / cured / cured on reboot: 0 / 0 / 0
21:56:11:171 0764
21:56:11:171 0764 UnloadDriverW: NtUnloadDriver error 1
21:56:11:171 0764 KLMD_Unload: UnloadDriverW(klmd21) error 1
21:56:11:171 0764 KLMD(ARK) unloaded successfully

#7 Blade

Blade

    Strong in the Bleepforce


  • Site Admin
  • 12,702 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:US
  • Local time:03:43 PM

Posted 08 March 2010 - 01:24 PM

1. Open notepad and copy/paste the text in the codebox below into it:

CODE
MBR::

Registry::
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"=-


Save this as CFScript.txt, in the same location as ComboFix.exe

2. Close any open browsers.

3. VERY IMPORTANT: Disable all running antivirus, antimalware and firewall programs as they may interfere with the proper running of ComboFix. Click on this link to see a list of programs that should be disabled. NOTE: This list is not all-inclusive. If yours is not listed and you do not know how to disable it, please ask.



Refering to the picture above, drag CFScript into ComboFix.exe

When finished, it shall produce a log for you at C:\ComboFix.txt which I will require in your next reply.

~Blade


In your next reply, please include the following:
ComboFix Log
How is the computer running now?


Posted Image

If I am helping you, it has been 48 hours since your last post, and I have yet to reply to your topic, please send me a PM
Become a BleepingComputer fan: Facebook
Follow us on Twitter!
Circle us on Google+


#8 Ralis

Ralis
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:11:43 AM

Posted 08 March 2010 - 02:46 PM

ComboFix 10-03-03.04 - B 03/08/2010 11:14:32.2.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.1023.699 [GMT -8:00]
Running from: c:\documents and settings\B\Desktop\Renamed.exe
Command switches used :: c:\documents and settings\B\Desktop\CFScript.txt
.

((((((((((((((((((((((((( Files Created from 2010-02-08 to 2010-03-08 )))))))))))))))))))))))))))))))
.

2010-03-04 05:00 . 2010-03-04 05:02 -------- d-----w- C:\Renamed
2010-03-02 06:57 . 2010-03-02 06:57 -------- d-----w- c:\program files\Ventrilo
2010-03-02 05:39 . 2010-03-02 05:39 -------- d-----w- c:\windows\system32\wbem\Repository
2010-03-02 05:35 . 2010-03-02 05:35 -------- d-----w- c:\documents and settings\All Users\Application Data\NOS
2010-03-02 05:34 . 2010-03-02 05:38 -------- d-----w- c:\program files\Google
2010-03-02 05:26 . 2010-03-02 05:26 -------- d-----w- c:\documents and settings\B\Local Settings\Application Data\Threat Expert
2010-03-02 05:26 . 2010-03-02 05:26 -------- d-----w- c:\documents and settings\B\Application Data\PC Tools
2010-03-02 05:26 . 2010-03-02 05:26 -------- d-----w- c:\documents and settings\All Users\Application Data\PC Tools
2010-02-28 08:50 . 2010-03-02 05:34 -------- d-----w- c:\program files\Ventrilo(2)
2010-02-27 07:36 . 2010-02-27 07:36 -------- d-----w- c:\documents and settings\B\IECompatCache
2010-02-27 07:35 . 2010-02-27 07:35 -------- d-----w- c:\documents and settings\B\PrivacIE
2010-02-27 07:33 . 2010-02-27 07:33 -------- d-----w- c:\documents and settings\LocalService\IETldCache
2010-02-27 07:33 . 2010-02-27 07:33 -------- d-----w- c:\documents and settings\B\IETldCache
2010-02-27 07:26 . 2010-03-02 05:35 -------- dc----w- c:\windows\ie8
2010-02-26 07:53 . 2010-02-26 07:53 -------- d-----w- c:\documents and settings\All Users\Application Data\McAfee

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-03-08 19:21 . 2008-07-14 15:11 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2010-03-07 17:30 . 2004-08-04 03:59 95360 ----a-w- c:\windows\system32\drivers\atapi.sys
2010-03-04 06:09 . 2005-10-26 02:39 27696 ----a-w- c:\documents and settings\B\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-03-02 06:57 . 2005-07-23 00:29 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2010-03-02 05:35 . 2010-01-06 04:38 -------- d-----w- c:\program files\Spyware Doctor
2010-03-02 05:26 . 2010-01-06 04:38 -------- d-----w- c:\program files\Common Files\PC Tools
2010-02-01 07:39 . 2010-02-01 07:39 -------- d-----w- c:\documents and settings\B\Application Data\Canon
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Apoint"="c:\program files\Apoint\Apoint.exe" [2004-09-13 155648]
"IntelWireless"="c:\program files\Intel\Wireless\Bin\ifrmewrk.exe" [2004-10-30 385024]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-08-06 344064]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2005-07-16 98304]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2005-7-15 24576]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\IntelWireless]
2004-09-07 21:08 110592 ----a-w- c:\program files\Intel\Wireless\Bin\LgNotify.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"c:\\Program Files\\Ventrilo\\Ventrilo.exe"=

R0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [1/5/2010 8:38 PM 207792]
R2 Browser Defender Update Service;Browser Defender Update Service;c:\program files\Spyware Doctor\BDT\BDTUpdateService.exe [1/5/2010 8:41 PM 112592]
R2 fssfltr;FssFltr;c:\windows\system32\drivers\fssfltr_tdi.sys [11/6/2009 12:06 AM 54752]
S3 fsssvc;Windows Live Family Safety Service;c:\program files\Windows Live\Family Safety\fsssvc.exe [8/5/2009 10:48 PM 704864]
S3 palmmdm;Palm Modem;c:\windows\system32\drivers\palmmdm.sys [1/30/2006 12:42 PM 9728]
S3 sdAuxService;PC Tools Auxiliary Service;c:\program files\Spyware Doctor\pctsAuxs.exe [1/5/2010 8:38 PM 359624]
.
.
------- Supplementary Scan -------
.
mStart Page = hxxp://www.dell4me.com/myway
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = *.local
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\Office10\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll/cmsidewiki.html
FF - ProfilePath - c:\documents and settings\B\Application Data\Mozilla\Firefox\Profiles\qsxkzf7s.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/
FF - prefs.js: keyword.URL - hxxp://www.gamingharbor.com/search.do?desktopsmiley&keyword=
FF - plugin: c:\documents and settings\B\Application Data\Mozilla\Firefox\Profiles\qsxkzf7s.default\extensions\moveplayer@movenetworks.com\platform\WINNT_x86-msvc\plugins\npmnqmp071303000006.dll
FF - plugin: c:\program files\Java\j2re1.4.2_03\bin\NPJava11.dll
FF - plugin: c:\program files\Java\j2re1.4.2_03\bin\NPJava12.dll
FF - plugin: c:\program files\Java\j2re1.4.2_03\bin\NPJava13.dll
FF - plugin: c:\program files\Java\j2re1.4.2_03\bin\NPJava14.dll
FF - plugin: c:\program files\Java\j2re1.4.2_03\bin\NPJava32.dll
FF - plugin: c:\program files\Java\j2re1.4.2_03\bin\NPJPI142_03.dll
FF - plugin: c:\program files\Java\j2re1.4.2_03\bin\NPOJI610.dll
FF - plugin: c:\program files\Microsoft\Office Live\npOLW.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npunagi2.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npViewpoint.dll
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
.
- - - - ORPHANS REMOVED - - - -

SafeBoot-klmdb.sys



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-03-08 11:22
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(1044)
c:\windows\system32\Ati2evxx.dll
c:\program files\Intel\Wireless\Bin\LgNotify.dll

- - - - - - - > 'explorer.exe'(3144)
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\Ati2evxx.exe
c:\program files\Intel\Wireless\Bin\EvtEng.exe
c:\program files\Intel\Wireless\Bin\S24EvMon.exe
c:\program files\Intel\Wireless\Bin\ZcfgSvc.exe
c:\program files\Intel\Wireless\Bin\WLKeeper.exe
c:\progra~1\Intel\Wireless\Bin\1XConfig.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Common Files\Motive\McciCMService.exe
c:\program files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
c:\program files\Intel\Wireless\Bin\RegSrvc.exe
c:\windows\system32\Ati2evxx.exe
c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
c:\program files\Canon\CAL\CALMAIN.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2010-03-08 11:27:47 - machine was rebooted
ComboFix-quarantined-files.txt 2010-03-08 19:27
ComboFix2.txt 2010-03-04 05:18

Pre-Run: 12,102,742,016 bytes free
Post-Run: 12,073,865,216 bytes free

- - End Of File - - EE3A0ED312C1D92448114D8155F61C1D




Google seems to be working now. Thank you for all the help. =)

#9 Blade

Blade

    Strong in the Bleepforce


  • Site Admin
  • 12,702 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:US
  • Local time:03:43 PM

Posted 09 March 2010 - 08:36 AM

Hello Ralis

Your Java is out of date. Older versions have vulnerabilities that malicious sites can use to exploit and infect your system. Please follow these steps to remove older version Java components and update:
  • Download the latest version of Java Runtime Environment (JRE) Version 6 and save it to your desktop.
  • Look for "Java Runtime Environment (JRE)" JRE 6 Update 18.
  • Click the Download button to the right.
  • Select your Platform: "Windows".
  • Select your Language: "Multi-language".
  • Read the License Agreement, and then check the box that says: "Accept License Agreement".
  • Click Continue and the page will refresh.
  • Under Required Files, check the box for Windows Offline Installation, click the link below it and save the file to your desktop.
  • Close any programs you may have running - especially your web browser.
Go to Start > Settings > Control Panel, double-click on Add/Remove Programs and remove all older versions of Java.
  • Check (highlight) any item with Java Runtime Environment (JRE or J2SE) in the name.
  • Click the Remove or Change/Remove button and follow the onscreen instructions for the Java uninstaller.
  • Repeat as many times as necessary to remove each Java versions.
  • Reboot your computer once all Java components are removed.
  • Then from your desktop double-click on jre-6u18-windows-i586.exe to install the newest version.
  • If using Windows Vista and the installer refuses to launch due to insufficient user permissions, then Run As Administrator.
-- If you choose to update via the Java applet in Control Panel, uncheck the option to install the Toolbar unless you want it.
-- Starting with Java 6u10, the uninstaller incorporated in each new release uses Enhanced Auto update to automatically remove the previous version when updating to a later update release. It will not remove older versions, so they will need to be removed manually.
-- Java is updated frequently. If you want to be automatically notified of future updates, just turn on the Java Automatic Update feature and you will not have to remember to update when Java releases a new version.


Note: The Java Quick Starter (JQS.exe) adds a service to improve the initial startup time of Java applets and applications. To disable the JQS service if you don't want to use it, go to Start > Control Panel > Java > Advanced > Miscellaneous and uncheck the box for Java Quick Starter. Click Ok and reboot your computer.

***************************************************

Your Adobe Reader is out of date. Please uninstall it through Add/Remove Programs and download the latest version from Adobe: Download
Please untick all proposed toolbars unless you really want them.

***************************************************

Please go to the Kaspersky website and perform an online antivirus scan.
  1. Read through the requirements and privacy statement and click on Accept button.
  2. It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
  3. When the downloads have finished, click on Settings.
  4. Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
      Spyware, Adware, Dialers, and other potentially dangerous programs
      Archives
  5. Click on My Computer under Scan.
  6. Once the scan is complete, it will display the results. Click on View Scan Report.
  7. You will see a list of infected items there. Click on Save Report As....
  8. Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button.
  9. Please post this log in your next reply .

~Blade


In your next reply, please include the following:
Kaspersky Online Scan log

Posted Image

If I am helping you, it has been 48 hours since your last post, and I have yet to reply to your topic, please send me a PM
Become a BleepingComputer fan: Facebook
Follow us on Twitter!
Circle us on Google+


#10 Ralis

Ralis
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:11:43 AM

Posted 11 March 2010 - 02:09 AM

Hi Blade,

Thanks again for all your help. I haven't had time to do the log and stuff yet, and I'll be out of town for a few days. Just wanted to make sure that was known and that I didn't abandon my post. =) Looks like you'll be out of town, too, though, so have a good one!

#11 myrti

myrti

    Sillyberry


  • Malware Study Hall Admin
  • 33,766 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:At home
  • Local time:09:43 PM

Posted 12 March 2010 - 09:26 AM

Hi,

I'll be taking over for Blade as he'll be gone. Could you let me know how long you will be gone?

regards myrti

is that a bird?  a plane? nooo it's the flying blueberry!

If I have been helping you and haven't replied in 2 days, feel free to shoot me a PM! Please don't send help request via PM, unless I am already helping you. Use the forums!

 

Follow BleepingComputer on: Facebook | Twitter | Google+


#12 myrti

myrti

    Sillyberry


  • Malware Study Hall Admin
  • 33,766 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:At home
  • Local time:09:43 PM

Posted 20 April 2010 - 04:02 PM

Due to lack of feedback, this topic is now Closed

If you need this topic reopened, please send me a PM.
Please include the address of this thread in your request.
This applies only to the original topic starter.

Everyone else please start a new topic.

With Regards,
myrti

is that a bird?  a plane? nooo it's the flying blueberry!

If I have been helping you and haven't replied in 2 days, feel free to shoot me a PM! Please don't send help request via PM, unless I am already helping you. Use the forums!

 

Follow BleepingComputer on: Facebook | Twitter | Google+





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users