Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

HTTP Tidserv Request


  • This topic is locked This topic is locked
26 replies to this topic

#1 ttiwguitar

ttiwguitar

  • Members
  • 12 posts
  • OFFLINE
  •  
  • Local time:04:51 PM

Posted 06 April 2010 - 11:52 AM

I've been getting alerts about this from Norton the past day or two after I downloaded a torrent. I've run Spybot and Malwarebytes but the problem keeps happening.

DDS (Ver_10-03-17.01) - NTFSx86
Run by Alan at 11:16:25.15 on Tue 04/06/2010
Internet Explorer: 7.0.5730.13 BrowserJavaVersion: 1.6.0_18
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2038.1110 [GMT -4:00]

AV: Norton Internet Security *On-access scanning enabled* (Updated) {E10A9785-9598-4754-B552-92431C1C35F8}
FW: Norton Internet Security *enabled* {7C21A4C9-F61F-4AC4-B722-A6E19C16F220}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Google\Gmail Notifier\gnotify.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\OpenOffice.org 3\program\soffice.exe
C:\DOCUME~1\Alan\LOCALS~1\Temp\RtkBtMnt.exe
C:\Program Files\OpenOffice.org 3\program\soffice.bin
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Norton Internet Security\Engine\16.8.0.41\ccSvcHst.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Norton Internet Security\Engine\16.8.0.41\ccSvcHst.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Alan\My Documents\Downloads\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.google.com/
uInternet Settings,ProxyOverride = *.local
mWinlogon: SfcDisable=-99 (0xffffff9d)
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll
BHO: Symantec NCO BHO: {602adb0e-4aff-4217-8aa1-95dac4dfa408} - c:\program files\norton internet security\engine\16.8.0.41\coIEPlg.dll
BHO: Symantec Intrusion Prevention: {6d53ec84-6aae-4787-aeee-f4628f01010c} - c:\program files\norton internet security\engine\16.8.0.41\IPSBHO.DLL
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: Norton Toolbar: {7febefe3-6b19-4349-98d2-ffb09d4b49ca} - c:\program files\norton internet security\engine\16.8.0.41\coIEPlg.dll
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [SpybotSD TeaTimer] c:\program files\spybot - search & destroy\TeaTimer.exe
uRun: [Google Update] "c:\documents and settings\alan\local settings\application data\google\update\GoogleUpdate.exe" /c
mRun: [H2O] c:\program files\syncrosoft\pos\h2o\cledx.exe
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [RTHDCPL] RTHDCPL.EXE
mRun: [Alcmtr] ALCMTR.EXE
mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
mRun: [Persistence] c:\windows\system32\igfxpers.exe
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
mRun: [SynTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe
mRun: [TkBellExe] "c:\program files\common files\real\update_ob\realsched.exe" -osboot
mRun: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] c:\program files\google\gmail notifier\gnotify.exe
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
dRunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N
dRunOnce: [ShowDeskFix] regsvr32 /s /n /i:u shell32
StartupFolder: c:\docume~1\alan\startm~1\programs\startup\magicd~1.lnk - c:\program files\magicdisc\MagicDisc.exe
StartupFolder: c:\docume~1\alan\startm~1\programs\startup\openof~1.lnk - c:\program files\openoffice.org 3\program\quickstart.exe
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll
Trusted Zone: line6.net
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_06-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab
Handler: symres - {AA1061FE-6C41-421f-9344-69640C9732AB} - c:\program files\norton internet security\engine\16.8.0.41\CoIEPlg.dll
Notify: igfxcui - igfxdev.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
Hosts: 127.0.0.1 www.spywareinfo.com
Hosts: 312.041.121.19 thepiratebay.org
Hosts: 312.041.121.19 www.thepiratebay.org
Hosts: 312.041.121.19 thepiratebay.org
Hosts: 312.041.121.19 www.thepiratebay.org

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\alan\applic~1\mozilla\firefox\profiles\hp6lzn27.default\
FF - component: c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\norton\coffplgn\components\coFFPlgn.dll
FF - component: c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\norton\ipsffplgn\components\IPSFFPl.dll
FF - plugin: c:\documents and settings\alan\local settings\application data\google\update\1.2.183.23\npGoogleOneClick8.dll
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA}

---- FIREFOX POLICIES ----
c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\mozilla firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);

============= SERVICES / DRIVERS ===============

R0 iastor78;iastor78;c:\windows\system32\drivers\iastor78.sys [2008-6-19 308248]
R0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\nis\1008000.029\SymEFA.sys [2010-2-6 310320]
R1 BHDrvx86;Symantec Heuristics Driver;c:\windows\system32\drivers\nis\1008000.029\BHDrvx86.sys [2010-2-6 259632]
R1 ccHP;Symantec Hash Provider;c:\windows\system32\drivers\nis\1008000.029\cchpx86.sys [2010-2-6 482432]
R1 IDSxpx86;IDSxpx86;c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\norton\definitions\ipsdefs\20100402.001\IDSXpx86.sys [2010-4-6 329592]
R2 Norton Internet Security;Norton Internet Security;c:\program files\norton internet security\engine\16.8.0.41\ccSvcHst.exe [2010-2-6 117640]
R3 CLEDX;Team H2O CLEDX service;c:\windows\system32\drivers\cledx.sys [2009-11-30 33792]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\common files\symantec shared\eengine\EraserUtilRebootDrv.sys [2010-3-30 102448]
R3 NAVENG;NAVENG;c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\norton\definitions\virusdefs\20100405.038\NAVENG.SYS [2010-4-6 84912]
R3 NAVEX15;NAVEX15;c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\norton\definitions\virusdefs\20100405.038\NAVEX15.SYS [2010-4-6 1324720]
S3 L6TPortA;Service - Line 6 TonePort UX1;c:\windows\system32\drivers\L6TPortA.sys [2009-12-1 531456]

=============== Created Last 30 ================

2010-04-06 15:15:55 0 -c--a-w- c:\documents and settings\alan\defogger_reenable
2010-04-02 16:02:31 0 d-----w- c:\program files\Spybot - Search & Destroy
2010-04-02 16:02:31 0 d-----w- c:\docume~1\alluse~1\applic~1\Spybot - Search & Destroy
2010-03-31 19:42:07 0 d-----w- c:\program files\Bonjour
2010-03-31 18:01:52 0 d-----w- c:\program files\Spyware Doctor
2010-03-31 18:01:52 0 d-----w- c:\program files\common files\PC Tools
2010-03-30 18:36:57 0 d-----w- c:\program files\common files\eSellerate
2010-03-30 18:36:43 0 d-----w- c:\program files\TuneSleeve
2010-03-30 18:36:43 0 d-----w- c:\docume~1\alluse~1\applic~1\eSellerate
2010-03-30 18:29:41 0 dc----w- c:\docume~1\alan\applic~1\Malwarebytes
2010-03-30 18:28:57 0 d-----w- c:\docume~1\alluse~1\applic~1\Malwarebytes
2010-03-30 18:24:27 0 d-----w- c:\program files\Eusing Free Registry Cleaner
2010-03-30 18:07:35 0 d-----w- c:\program files\Sony
2010-03-18 21:16:35 25600 ----a-w- c:\windows\system32\drivers\rig3avs.sys
2010-03-18 21:16:35 185856 ----a-w- c:\windows\system32\drivers\rig3usb.sys
2010-03-18 21:15:32 0 d-----w- c:\program files\common files\Native Instruments
2010-03-18 21:14:30 0 d-----w- c:\program files\Native Instruments
2010-03-17 15:12:35 0 d-----w- c:\program files\iPod
2010-03-17 15:12:27 0 d-----w- c:\program files\iTunes
2010-03-15 17:12:12 0 d-----w- c:\program files\Waves

==================== Find3M ====================

2010-02-23 15:49:08 19796 ---ha-w- c:\windows\system32\mlfcache.dat
2010-02-12 16:46:14 91424 ----a-w- c:\windows\system32\dnssd.dll
2010-02-12 16:46:14 107808 ----a-w- c:\windows\system32\dns-sd.exe
2009-11-30 23:26:24 32768 --sha-w- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012009113020091201\index.dat

============= FINISH: 11:17:58.95 ===============

Attached Files



BC AdBot (Login to Remove)

 


#2 thewall

thewall

  • Malware Response Team
  • 6,425 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Florida
  • Local time:04:51 PM

Posted 09 April 2010 - 06:17 PM


Hello ttiwguitar smile.gif Welcome to the BC HijackThis Log and Analysis forum. I will be assisting you in cleaning up your system.


I ask that you refrain from running tools other than those we suggest while we are cleaning up your computer. The reason for this is so we know what is going on with the machine at any time. Some programs can interfere with others and hamper the recovery process.



In the upper right hand corner of the topic you will see a button called Options. If you click on this in the drop-down menu you can choose Track this topic. By doing this and then choosing Immediate E-Mail notification and then clicking on Proceed you will be advised when we respond the your topic and facilitate the cleaning of your machine.


Please keep in mind that we have a large backlog of users just like yourself waiting to be helped so try to be as timely as possible in your replies. Since we do this on a part-time voluntary basis we are limited on how many logs we can respond to and keep open due to time restraints. If you have to be away or can't answer for some other reason just let me know. Thank you for your understanding.



After 5 days if a topic is not replied to we assume it has been abandoned and it is closed.






Please download ComboFix from one of these locations:

Link 1
Link 2

* IMPORTANT !!! Save ComboFix.exe to your Desktop
  • Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. Instruction can be found HERE
  • Double click on ComboFix.exe & follow the prompts.
  • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.




Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:





Click on Yes, to continue scanning for malware.

When finished, it will produce a log for you. Please include the C:\ComboFix.txt in your next reply.



Note: Please post the log in the reply window and do not make it an attachment. Do this with all subsequent replies unless I ask otherwise.





Thanks,



thewall





If I have helped you then please consider donating so I can continue the fight against malware Posted Image
All donations go directly to the helper

Posted Image

Due to the large amount of backlogs we have I cannot respond to PMs for help unless I am already working with you

#3 ttiwguitar

ttiwguitar
  • Topic Starter

  • Members
  • 12 posts
  • OFFLINE
  •  
  • Local time:04:51 PM

Posted 10 April 2010 - 09:08 AM

Hi, thanks for your help. However, every time I run ComboFix, it gets to the malware scanning part and after a minute or two I get a blue screen reading "DRIVER UNLOADED WITHOUT CANCELING PENDING OPERATIONS". Any idea what I can do about that?

#4 thewall

thewall

  • Malware Response Team
  • 6,425 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Florida
  • Local time:04:51 PM

Posted 10 April 2010 - 10:29 AM

Be sure the Norton is disabled and if you haven't done so disable TeaTimer. Link for doing so is below:

http://www.bleepingcomputer.com/forums/t/114351/how-to-temporarily-disable-your-anti-virus-firewall-and-anti-malware-programs/


When you are sure they are disabled run the following first and then try ComboFix again:


RKill by Grinler
Link #1
Link #2
Link #3
Link #4
  • Download Link #1.
  • Save it to your Desktop.
  • Double click the RKill desktop icon.
    If you are using Vista please right click and run as Admin!
  • A black screen will briefly flash indicating a successful run.
  • If this does not occur please delete that application and download Link #2.
  • Continue process until the tool runs.
  • If the tool does not run from any of the links tell me about it.



If I have helped you then please consider donating so I can continue the fight against malware Posted Image
All donations go directly to the helper

Posted Image

Due to the large amount of backlogs we have I cannot respond to PMs for help unless I am already working with you

#5 ttiwguitar

ttiwguitar
  • Topic Starter

  • Members
  • 12 posts
  • OFFLINE
  •  
  • Local time:04:51 PM

Posted 13 April 2010 - 09:39 AM

Still having the same problem after trying all of that.

#6 thewall

thewall

  • Malware Response Team
  • 6,425 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Florida
  • Local time:04:51 PM

Posted 13 April 2010 - 03:34 PM

Is your antivirus a free edition or is it something you paid for. The reason I ask is something is blocking us and it could be the antivirus even though it is disabled.
If I have helped you then please consider donating so I can continue the fight against malware Posted Image
All donations go directly to the helper

Posted Image

Due to the large amount of backlogs we have I cannot respond to PMs for help unless I am already working with you

#7 ttiwguitar

ttiwguitar
  • Topic Starter

  • Members
  • 12 posts
  • OFFLINE
  •  
  • Local time:04:51 PM

Posted 14 April 2010 - 09:25 AM

It's a paid subscription version of Norton Internet Security. I even went as far as uninstalling the software and Spybot with internet access disabled to try running the program and it didn't work.

#8 thewall

thewall

  • Malware Response Team
  • 6,425 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Florida
  • Local time:04:51 PM

Posted 14 April 2010 - 10:07 AM

Let's try running it in Safe Mode one time and see what happens. Don't force the issue if it won't run we'll try something else.
If I have helped you then please consider donating so I can continue the fight against malware Posted Image
All donations go directly to the helper

Posted Image

Due to the large amount of backlogs we have I cannot respond to PMs for help unless I am already working with you

#9 thewall

thewall

  • Malware Response Team
  • 6,425 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Florida
  • Local time:04:51 PM

Posted 18 April 2010 - 01:36 PM

Are you still with me?
If I have helped you then please consider donating so I can continue the fight against malware Posted Image
All donations go directly to the helper

Posted Image

Due to the large amount of backlogs we have I cannot respond to PMs for help unless I am already working with you

#10 ttiwguitar

ttiwguitar
  • Topic Starter

  • Members
  • 12 posts
  • OFFLINE
  •  
  • Local time:04:51 PM

Posted 18 April 2010 - 04:23 PM

Yes, sorry about that. Finally got ComboFix to run.

ComboFix 10-04-09.06 - Alan 04/18/2010 16:22:38.1.1 - x86 MINIMAL
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2038.1757 [GMT -4:00]
Running from: c:\documents and settings\Alan\My Documents\Downloads\ComboFix.exe
AV: Norton Internet Security *On-access scanning enabled* (Updated) {E10A9785-9598-4754-B552-92431C1C35F8}
FW: Norton Internet Security *enabled* {7C21A4C9-F61F-4AC4-B722-A6E19C16F220}
.
- REDUCED FUNCTIONALITY MODE -
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\recycler\S-1-5-21-1123561945-1682526488-1606980848-500
c:\recycler\S-1-5-21-1123561945-1682526488-1606980848-500\desktop.ini
F:\Autorun.inf

.
((((((((((((((((((((((((( Files Created from 2010-03-18 to 2010-04-18 )))))))))))))))))))))))))))))))
.

2010-04-18 20:03 . 2010-04-18 20:03 -------- dc----w- c:\documents and settings\Alan\Local Settings\Application Data\Symantec
2010-04-14 23:23 . 2008-04-14 09:15 60032 ----a-w- c:\windows\system32\drivers\USBAUDIO.sys
2010-04-14 23:23 . 2008-04-14 09:15 32128 ----a-w- c:\windows\system32\drivers\usbccgp.sys
2010-04-10 17:34 . 2010-04-18 20:08 -------- d-----w- c:\program files\Common Files\Symantec Shared
2010-04-10 17:20 . 2010-04-10 17:20 20936 -c--a-w- c:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-04-10 17:10 . 2010-04-10 17:10 -------- d--h--w- c:\windows\PIF
2010-04-10 13:55 . 2007-09-29 21:03 308248 ----a-w- c:\windows\system32\drivers\iaStor_2.sys
2010-04-02 16:02 . 2010-04-10 17:45 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2010-04-02 16:02 . 2010-04-10 17:39 -------- d-----w- c:\program files\Spybot - Search & Destroy
2010-04-01 17:32 . 2010-04-01 17:32 -------- dc----w- c:\documents and settings\Alan\Local Settings\Application Data\Help
2010-03-31 19:42 . 2010-03-31 19:42 -------- d-----w- c:\program files\Bonjour
2010-03-31 18:01 . 2010-03-31 19:47 -------- d-----w- c:\program files\Spyware Doctor
2010-03-31 18:01 . 2010-03-31 19:46 -------- d-----w- c:\program files\Common Files\PC Tools
2010-03-31 18:01 . 2010-03-31 18:05 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2010-03-30 18:36 . 2010-03-30 18:36 -------- d-----w- c:\program files\Common Files\eSellerate
2010-03-30 18:36 . 2010-03-30 18:36 -------- d-----w- c:\program files\TuneSleeve
2010-03-30 18:36 . 2010-03-30 18:36 -------- d-----w- c:\documents and settings\All Users\Application Data\eSellerate
2010-03-30 18:29 . 2010-03-30 18:29 -------- dc----w- c:\documents and settings\Alan\Application Data\Malwarebytes
2010-03-30 18:28 . 2010-03-30 18:28 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-03-30 18:24 . 2010-04-02 16:02 -------- d-----w- c:\program files\Eusing Free Registry Cleaner
2010-03-30 18:14 . 2010-03-30 18:14 -------- dc----w- c:\documents and settings\Alan\Application Data\Publish Providers
2010-03-30 18:08 . 2010-03-30 18:08 -------- d-----w- c:\documents and settings\All Users\Application Data\Sony
2010-03-30 18:07 . 2010-03-30 18:07 -------- d-----w- c:\program files\Sony
2010-03-30 17:23 . 2010-04-01 21:17 -------- dc----w- c:\documents and settings\Alan\Application Data\Sony
2010-03-30 17:23 . 2010-03-30 17:23 -------- dc----w- c:\documents and settings\Alan\Local Settings\Application Data\Sony
2010-03-23 17:07 . 2010-03-23 17:07 1925088 -c--a-w- c:\documents and settings\Alan\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\fpupdatepl\fpupdatepl.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-04-18 20:06 . 2009-12-01 18:34 -------- d-----w- c:\documents and settings\All Users\Application Data\Norton
2010-04-17 07:14 . 2009-12-02 05:13 -------- dc----w- c:\documents and settings\Alan\Application Data\vlc
2010-04-16 02:36 . 2010-02-10 15:23 -------- d-----w- c:\program files\SpeedFan
2010-04-15 20:24 . 2009-12-01 19:03 -------- dc----w- c:\documents and settings\Alan\Application Data\uTorrent
2010-04-10 17:33 . 2009-12-01 18:28 -------- dc----w- c:\documents and settings\Alan\Application Data\GetRightToGo
2010-04-10 17:33 . 2009-12-01 18:33 -------- d-----w- c:\documents and settings\All Users\Application Data\NortonInstaller
2010-04-09 13:59 . 2010-03-07 17:49 439816 -c--a-w- c:\documents and settings\Alan\Application Data\Real\Update\setup3.10\setup.exe
2010-04-07 16:43 . 2009-12-02 00:54 1 -c--a-w- c:\documents and settings\Alan\Application Data\OpenOffice.org\3\user\uno_packages\cache\stamp.sys
2010-04-01 17:32 . 2009-11-30 23:23 -------- d-----w- c:\program files\Resource Hacker 3.4.0
2010-03-31 16:10 . 2010-02-05 16:18 -------- d-----w- c:\program files\Steam
2010-03-25 22:36 . 2009-12-01 18:24 -------- dc----w- c:\documents and settings\Alan\Application Data\Apple Computer
2010-03-25 02:09 . 2009-12-01 18:54 -------- d-----w- c:\program files\REAPER
2010-03-24 16:35 . 2009-12-17 16:24 -------- dc----w- c:\documents and settings\Alan\Application Data\dvdcss
2010-03-18 21:16 . 2010-03-18 21:14 -------- d-----w- c:\program files\Native Instruments
2010-03-18 21:15 . 2010-03-18 21:15 -------- d-----w- c:\program files\Common Files\Native Instruments
2010-03-17 15:13 . 2010-03-17 15:12 -------- d-----w- c:\program files\iTunes
2010-03-17 15:12 . 2010-03-17 15:12 -------- d-----w- c:\program files\iPod
2010-03-17 15:12 . 2009-12-01 18:22 -------- d-----w- c:\program files\Common Files\Apple
2010-03-17 15:04 . 2010-03-17 15:04 72488 ----a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 9.0.3.15\SetupAdmin.exe
2010-03-15 17:13 . 2009-12-05 00:15 -------- dc----w- c:\documents and settings\Alan\Application Data\REAPER
2010-03-15 17:12 . 2010-03-15 17:12 -------- d-----w- c:\program files\Waves
2010-03-06 21:12 . 2010-03-06 21:12 -------- dc----w- c:\documents and settings\Alan\Application Data\SharePod
2010-02-28 22:36 . 2010-02-28 22:36 -------- d-----w- c:\program files\Microsoft Silverlight
2010-02-23 15:49 . 2010-01-28 20:50 19796 ---ha-w- c:\windows\system32\mlfcache.dat
2010-02-15 15:09 . 2010-02-15 15:09 79144 ----a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\Safari 5.31.21.10\SetupAdmin.exe
2010-02-13 23:12 . 2009-11-30 23:33 20936 -c--a-w- c:\documents and settings\Alan\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-02-12 16:46 . 2010-02-12 16:46 91424 ----a-w- c:\windows\system32\dnssd.dll
2010-02-12 16:46 . 2010-02-12 16:46 107808 ----a-w- c:\windows\system32\dns-sd.exe
2010-01-27 20:47 . 2010-01-27 20:47 503808 -c--a-w- c:\documents and settings\Alan\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-7db0b9b6-n\msvcp71.dll
2010-01-27 20:47 . 2010-01-27 20:47 499712 -c--a-w- c:\documents and settings\Alan\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-7db0b9b6-n\jmc.dll
2010-01-27 20:47 . 2010-01-27 20:47 348160 -c--a-w- c:\documents and settings\Alan\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-7db0b9b6-n\msvcr71.dll
2010-01-27 20:47 . 2010-01-27 20:47 61440 -c--a-w- c:\documents and settings\Alan\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-78ec579e-n\decora-sse.dll
2010-01-27 20:47 . 2010-01-27 20:47 12800 -c--a-w- c:\documents and settings\Alan\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-78ec579e-n\decora-d3d.dll
.

------- Sigcheck -------

[-] 2008-06-19 . 68F06FE0021B01E670AF37B8C5964FDF . 361344 . . [5.1.2600.5512] . . c:\windows\system32\drivers\tcpip.sys

[-] 2008-04-23 . AF263738FAD02E11D21F2C8F18054C80 . 2350208 . . [5.1.2600.5512] . . c:\windows\system32\ntoskrnl.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Google Update"="c:\documents and settings\Alan\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2010-04-06 136176]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"H2O"="c:\program files\SyncroSoft\Pos\H2O\cledx.exe" [2007-12-11 307200]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-11-11 417792]
"RTHDCPL"="RTHDCPL.EXE" [2007-10-25 16855552]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-08-24 135168]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-08-24 159744]
"Persistence"="c:\windows\system32\igfxpers.exe" [2007-08-24 131072]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-01-11 246504]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-05-18 827392]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-12-03 185896]
"{0228e555-4f9c-4e35-a3ec-b109a192b4c2}"="c:\program files\Google\Gmail Notifier\gnotify.exe" [2005-07-15 479232]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-02-15 141608]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"ShowDeskFix"="shell32" [X]
"nltide_3"="advpack.dll" [2008-06-19 124928]

c:\documents and settings\Alan\Start Menu\Programs\Startup\
MagicDisc.lnk - c:\program files\MagicDisc\MagicDisc.exe [2009-12-3 576000]
OpenOffice.org 3.1.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2009-8-18 384000]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Steam\\Steam.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\WINDOWS\\system32\\spoolsv.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=

R0 iastor78;iastor78;c:\windows\system32\drivers\iastor78.sys [6/19/2008 4:56 PM 308248]
R3 CLEDX;Team H2O CLEDX service;c:\windows\system32\drivers\cledx.sys [11/30/2009 7:53 PM 33792]
S3 EraserUtilDrvI9;EraserUtilDrvI9;\??\c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilDrvI9.sys --> c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilDrvI9.sys [?]
S3 L6TPortA;Service - Line 6 TonePort UX1;c:\windows\system32\drivers\L6TPortA.sys [12/1/2009 3:56 PM 531456]
.
Contents of the 'Scheduled Tasks' folder

2010-01-02 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 17:34]

2010-04-16 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1123561945-1682526488-1606980848-1004Core.job
- c:\documents and settings\Alan\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-04-06 14:43]

2010-04-18 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1123561945-1682526488-1606980848-1004UA.job
- c:\documents and settings\Alan\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-04-06 14:43]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
uInternet Settings,ProxyOverride = *.local
Trusted Zone: line6.net
FF - ProfilePath -

---- FIREFOX POLICIES ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
.
- - - - ORPHANS REMOVED - - - -

AddRemove-Native Instruments - Rig Kontrol 3 Driver - c:\program files\Native Instruments\Rig Kontrol 3 Driver\uninst.exe Software\Native Instruments\Rig Kontrol 3 Driver\Setup



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-04-18 16:25
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntoskrnl.exe catchme.sys CLASSPNP.SYS disk.sys ACPI.sys hal.dll >>UNKNOWN [0x8A626D6B]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0xf763bf28
\Driver\ACPI -> ACPI.sys @ 0xf75aecb8
\Driver\atapi -> atapi.sys @ 0xf74a0852
\Driver\iaStor -> iaStor.sys @ 0xf7b52002
IoDeviceObjectType -> DeleteProcedure -> ntoskrnl.exe @ 0x805a0598
ParseProcedure -> ntoskrnl.exe @ 0x8056c1d6
\Device\Harddisk0\DR0 -> DeleteProcedure -> ntoskrnl.exe @ 0x805a0598
ParseProcedure -> ntoskrnl.exe @ 0x8056c1d6
user & kernel MBR OK

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-1123561945-1682526488-1606980848-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\Clsid]
@Denied: (Full) (LocalSystem)
.
Completion time: 2010-04-18 16:29:07
ComboFix-quarantined-files.txt 2010-04-18 20:29

Pre-Run: 1,745,051,648 bytes free
Post-Run: 1,757,777,920 bytes free

- - End Of File - - 9B707A8E7A397887BA89ED964693DB18


#11 thewall

thewall

  • Malware Response Team
  • 6,425 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Florida
  • Local time:04:51 PM

Posted 18 April 2010 - 05:30 PM

Please give me a rundown on the state of your machine now. Are you experiencing problems?
If I have helped you then please consider donating so I can continue the fight against malware Posted Image
All donations go directly to the helper

Posted Image

Due to the large amount of backlogs we have I cannot respond to PMs for help unless I am already working with you

#12 ttiwguitar

ttiwguitar
  • Topic Starter

  • Members
  • 12 posts
  • OFFLINE
  •  
  • Local time:04:51 PM

Posted 19 April 2010 - 04:27 PM

QUOTE(thewall @ Apr 18 2010, 06:30 PM) View Post
Please give me a rundown on the state of your machine now. Are you experiencing problems?


Just encountered the HTTP Tidserv Request again. It almost always happens when I'm doing a Google search, if that helps.

#13 thewall

thewall

  • Malware Response Team
  • 6,425 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Florida
  • Local time:04:51 PM

Posted 19 April 2010 - 04:55 PM

are you getting anything like redirections or popups? Anything like that?

If I have helped you then please consider donating so I can continue the fight against malware Posted Image
All donations go directly to the helper

Posted Image

Due to the large amount of backlogs we have I cannot respond to PMs for help unless I am already working with you

#14 ttiwguitar

ttiwguitar
  • Topic Starter

  • Members
  • 12 posts
  • OFFLINE
  •  
  • Local time:04:51 PM

Posted 19 April 2010 - 05:01 PM

Yeah, I've had a couple of those occur randomly in Firefox.

#15 thewall

thewall

  • Malware Response Team
  • 6,425 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Florida
  • Local time:04:51 PM

Posted 21 April 2010 - 10:33 AM

Apologies, I either didn't get your reply or it accidentally got deleted.

  • Download TDSSKiller and save it to your Desktop.
  • Extract its contents to your desktop and make sure TDSSKiller.exe (the contents of the zipped file) is on the Desktop itself, not within a folder on the desktop.
  • Go to Start > Run (Or you can hold down your Windows key and press R) and copy and paste the following into the text field. (make sure you include the quote marks) Then press OK.

    "%userprofile%\Desktop\TDSSKiller.exe" -l C:\TDSSKiller.txt -v

  • If it says "Hidden service detected" DO NOT type anything in. Just press Enter on your keyboard to not do anything to the file.
  • When it is done, a log file should be created on your C: drive called "TDSSKiller.txt" please copy and paste the contents of that file here.

If I have helped you then please consider donating so I can continue the fight against malware Posted Image
All donations go directly to the helper

Posted Image

Due to the large amount of backlogs we have I cannot respond to PMs for help unless I am already working with you




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users