Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

AntispywareSoft Rogue.antisoft / Trojan Dropper/win-nv removed?


  • This topic is locked This topic is locked
3 replies to this topic

#1 Peaty

Peaty

  • Members
  • 15 posts
  • OFFLINE
  •  
  • Local time:09:08 AM

Posted 25 April 2010 - 08:20 PM

Referred from here: http://www.bleepingcomputer.com/forums/t/312219/antispywaresoft-rogueantisoft-trojan-dropperwin-nv-removal/ ~ OB

I've offered to help my cousin remove malware from her laptop. I've done this sort of thing before but this one is being a real bugger.

Laptop is running Win XP Home it had SP2 I've since updated it to SP3 McAfee was installed but had not been updated in over a year.

When I received the laptop it had all the pop-ups and issues associated with Antispyware Soft. The exe extension was not working, none of the removal tools I have would load or execute. I could not get it to boot into safemode.

I was able to get the portable version of SuperAntiSpyware (SAS) to run because it uses a .com extension. That enabled me to remove many items on a reboot. I then ran a reg fix for the .exe and turned off system restore.

I removed McAfee and installed Avast (did standard and boot time scan), installed and ran Dr. Web cure-it, SAS, Malwarebytes, windows malicious software removal tool, ccleaner and windows defender. After all the scanning and rebooting I thought I was in the clear, however one issue did remain that I was working on. I could not get the windows update to work via the window website nor was windows defender able to connect to the server to update.

Since I thought I was in the clear I then proceed to update the firmware, drivers and install windows SP3 and continued to work on getting win update to work. After I installed SP3 (used the redistributable version) I was doing some other tweaks when once again the pop ups started from AntispywareSoft pop-ups again! I went through the above procedure again but I also added Spybot and Spywareblaster. I also ran them again in safemode (system restore was still off) Many of the same items were found with with some new items with Spybot after all the previous scans were done. I apologize for not getting the items that were found I forgot to write them down.

Where I am now is, once again everything seems fine even windows update and defender update are working again (I've updated to the latest security service packs etc). After scanning with everything I have installed, I'm getting no infections found. I'm currently doing another full Dr. Web Cure-it scan in safemode. The laptop has been running for about two days with no issues. My question is, is there a way to be sure I've cleared everything out? I plan on running the Laptop for a few days more to be sure before sending it back.

Thanks you in advance for taking the time to review my issue.

Regards,

Peaty

DDS info :

________>


DDS (Ver_10-03-17.01) - NTFSx86
Run by MicheleRD at 16:38:11.57 on Sun 04/25/2010
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_20
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.2038.1297 [GMT -4:00]

AV: avast! Antivirus *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\System32\WLTRYSVC.EXE
C:\WINDOWS\System32\bcmwltry.exe
C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\WINDOWS\system32\WLTRAY.exe
C:\WINDOWS\stsystra.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Dell\MediaDirect\PCMService.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
svchost.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Kodak\printer\center\KodakSvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\explorer.exe
C:\Documents and Settings\MicheleRD\Desktop\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.google.com/
uInternet Settings,ProxyOverride =
uInternet Settings,ProxyServer = http=127.0.0.1:5555
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://search.yahoo.com/search?fr=mcafee&p=%s
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll
BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: CBrowserHelperObject Object: {ca6319c0-31b7-401e-a518-a07c3db8f777} - c:\program files\bae\BAE.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: StumbleUpon Toolbar: {5093eb4c-3e93-40ab-9266-b607ba87bdc8} - c:\program files\stumbleupon\StumbleUponIEBar.dll
EB: &Discuss: {bdeade7f-c265-11d0-bced-00a0c90ab50f} - shdocvw.dll
uRun: [SUPERAntiSpyware] c:\program files\superantispyware\SUPERAntiSpyware.exe
uRun: [SpybotSD TeaTimer] c:\program files\spybot - search & destroy\TeaTimer.exe
mRun: [igfxtray] c:\windows\system32\igfxtray.exe
mRun: [igfxhkcmd] c:\windows\system32\hkcmd.exe
mRun: [igfxpers] c:\windows\system32\igfxpers.exe
mRun: [Broadcom Wireless Manager UI] c:\windows\system32\WLTRAY.exe
mRun: [SigmatelSysTrayApp] stsystra.exe
mRun: [SynTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe
mRun: [dla] c:\windows\system32\dla\tfswctrl.exe
mRun: [PCMService] "c:\program files\dell\mediadirect\PCMService.exe"
mRun: [AppleSyncNotifier] c:\program files\common files\apple\mobile device support\bin\AppleSyncNotifier.exe
mRun: [Windows Defender] "c:\program files\windows defender\MSASCui.exe" -hide
mRun: [avast5] c:\progra~1\alwils~1\avast5\avastUI.exe /nogui
IE: E&xport to Microsoft Excel - c:\progra~1\micros~4\office11\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files\google\google toolbar\component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll/cmsidewiki.html
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~4\office11\REFIEBAR.DLL
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll
DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} - hxxp://www.musicnotes.com/download/mnviewer.cab
DPF: {31435657-9980-0010-8000-00AA00389B71} - hxxp://download.microsoft.com/download/e/2/f/e2fcec4b-6c8b-48b7-adab-ab9c403a978f/wvc1dmo.cab
DPF: {54BE6B6F-3056-470B-97E1-BB92E051B6C4} - hxxp://h30155.www3.hp.com/ediags/dd/install/HPDriverDiagnosticsxp2k.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
DPF: {FFBB3F3B-0A5A-4106-BE53-DFE1E2340CB1} - hxxp://dlm.tools.akamai.com/dlmanager/versions/activex/dlm-activex-2.2.1.6.cab
Notify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.dll
Notify: igfxcui - igfxdev.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLL
SEH: Microsoft AntiMalware ShellExecuteHook: {091eb208-39dd-417d-a5dd-7e2c2d8fb9cb} - c:\progra~1\window~4\MpShHook.dll

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\michel~1\applic~1\mozilla\firefox\profiles\2atgy7n7.default\
FF - plugin: c:\program files\divx\divx plus web player\npdivx32.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npdeployJava1.dll
FF - plugin: c:\program files\musicnotes\npmusicn.dll
FF - plugin: c:\program files\musicnotes\NPSibelius.dll
FF - plugin: c:\program files\viewpoint\viewpoint experience technology\npViewpoint.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\
FF - HiddenExtension: XULRunner: {473DB22E-0A74-47CE-8924-ECCEF9561B1A} - c:\documents and settings\michelerd\local settings\application data\{473DB22E-0A74-47CE-8924-ECCEF9561B1A}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}

---- FIREFOX POLICIES ----
FF - user.js: dom.disable_open_during_load - false // Popupblocker control handled by McAfee Privacy Service
c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\mozilla firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);

============= SERVICES / DRIVERS ===============

R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [2010-4-25 162768]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2010-4-25 19024]
R2 avast! Antivirus;avast! Antivirus;c:\program files\alwil software\avast5\AvastSvc.exe [2010-4-25 40384]
R2 KodakSvc;Kodak AiO Device Service;c:\program files\kodak\printer\center\KodakSvc.exe [2008-2-28 18944]
R2 WinDefend;Windows Defender;c:\program files\windows defender\MsMpEng.exe [2006-11-3 13592]
S1 SASDIFSV;SASDIFSV;\??\c:\docume~1\michel~1\locals~1\temp\sas_selfextract\sasdifsv.sys --> c:\docume~1\michel~1\locals~1\temp\sas_selfextract\SASDIFSV.SYS [?]
S1 SASKUTIL;SASKUTIL;\??\c:\docume~1\michel~1\locals~1\temp\sas_selfextract\saskutil.sys --> c:\docume~1\michel~1\locals~1\temp\sas_selfextract\SASKUTIL.sys [?]
S3 avast! Mail Scanner;avast! Mail Scanner;c:\program files\alwil software\avast5\AvastSvc.exe [2010-4-25 40384]
S3 avast! Web Scanner;avast! Web Scanner;c:\program files\alwil software\avast5\AvastSvc.exe [2010-4-25 40384]
S3 SASENUM;SASENUM;\??\c:\docume~1\michel~1\locals~1\temp\sas_selfextract\sasenum.sys --> c:\docume~1\michel~1\locals~1\temp\sas_selfextract\SASENUM.SYS [?]
S3 StumbleUponUpdateService;StumbleUponUpdateService;c:\program files\stumbleupon\StumbleUponUpdateService.exe [2010-3-25 120232]

=============== Created Last 30 ================

2010-04-25 20:27:39 0 ----a-w- c:\documents and settings\michelerd\defogger_reenable
2010-04-25 16:40:00 0 d-----w- c:\program files\ezconvert
2010-04-25 16:38:00 45928832 ----a-w- c:\windows\Field desktop.bmp
2010-04-25 16:37:57 18105104 ----a-w- c:\windows\burning desktop 1.bmp
2010-04-25 13:54:25 0 d-----w- c:\documents and settings\michelerd\Tracing
2010-04-25 13:53:29 0 d-----w- c:\program files\Microsoft
2010-04-25 13:53:10 0 d-----w- c:\program files\Windows Live SkyDrive
2010-04-25 13:50:56 0 d-----w- c:\program files\common files\Windows Live
2010-04-24 13:51:28 0 d-----w- c:\program files\Panda Security
2010-04-24 00:07:32 0 d-----w- c:\program files\SpywareBlaster
2010-04-23 23:36:15 64000 ------w- c:\windows\system32\dllcache\iecompat.dll
2010-04-23 23:15:43 0 d-----w- c:\program files\Windows Media Connect 2
2010-04-23 22:54:03 0 d-----w- c:\program files\Spybot - Search & Destroy
2010-04-23 22:54:03 0 d-----w- c:\docume~1\alluse~1\applic~1\Spybot - Search & Destroy
2010-04-23 22:01:34 0 d-----w- c:\windows\ie8updates
2010-04-23 09:00:45 594432 ------w- c:\windows\system32\dllcache\msfeeds.dll
2010-04-23 09:00:44 55296 ------w- c:\windows\system32\dllcache\msfeedsbs.dll
2010-04-23 09:00:42 247808 ------w- c:\windows\system32\dllcache\ieproxy.dll
2010-04-23 09:00:41 12800 ------w- c:\windows\system32\dllcache\xpshims.dll
2010-04-23 09:00:33 1985536 ------w- c:\windows\system32\dllcache\iertutil.dll
2010-04-23 07:09:39 0 d-----w- C:\4d2e4a06d9717c72e757eb69791e
2010-04-23 07:04:09 0 d-sha-r- C:\cmdcons
2010-04-23 06:35:23 98816 ----a-w- c:\windows\sed.exe
2010-04-23 06:35:23 77312 ----a-w- c:\windows\MBR.exe
2010-04-23 06:35:23 261632 ----a-w- c:\windows\PEV.exe
2010-04-23 06:35:23 161792 ----a-w- c:\windows\SWREG.exe
2010-04-23 06:18:25 1315328 ------w- c:\windows\system32\dllcache\msoe.dll
2010-04-23 06:17:03 353792 ------w- c:\windows\system32\dllcache\srv.sys
2010-04-23 06:15:28 81920 ------w- c:\windows\system32\dllcache\fontsub.dll
2010-04-23 06:15:26 119808 ------w- c:\windows\system32\dllcache\t2embed.dll
2010-04-23 06:15:10 284160 ------w- c:\windows\system32\dllcache\pdh.dll
2010-04-23 06:15:07 401408 ------w- c:\windows\system32\dllcache\rpcss.dll
2010-04-23 06:15:06 110592 ------w- c:\windows\system32\dllcache\services.exe
2010-04-23 06:15:04 473600 ------w- c:\windows\system32\dllcache\fastprox.dll
2010-04-23 06:15:04 227840 ------w- c:\windows\system32\dllcache\wmiprvse.exe
2010-04-23 06:15:02 453120 ------w- c:\windows\system32\dllcache\wmiprvsd.dll
2010-04-23 06:14:50 730112 ------w- c:\windows\system32\dllcache\lsasrv.dll
2010-04-23 06:14:49 617472 ------w- c:\windows\system32\dllcache\advapi32.dll
2010-04-23 06:14:47 714752 ------w- c:\windows\system32\dllcache\ntdll.dll
2010-04-23 06:14:42 2146304 ------w- c:\windows\system32\dllcache\ntkrnlmp.exe
2010-04-23 06:14:36 2189952 ------w- c:\windows\system32\dllcache\ntoskrnl.exe
2010-04-23 06:14:29 2024448 ------w- c:\windows\system32\dllcache\ntkrpamp.exe
2010-04-23 06:14:10 0 ----a-w- C:\__tmp_rar_sfx_access_check_592734
2010-04-23 06:11:13 337408 ------w- c:\windows\system32\dllcache\netapi32.dll
2010-04-23 05:12:29 0 d-----w- C:\5af87e75802d2d0e815cc4
2010-04-23 04:08:59 12800 ------w- c:\windows\system32\credssp.dll
2010-04-23 04:01:29 4255 ------w- c:\windows\system32\drivers\adv01nt5.dll
2010-04-23 03:59:53 19569 ----a-w- c:\windows\002907_.tmp
2010-04-23 03:52:27 0 d-----w- c:\windows\EHome
2010-04-23 03:49:45 0 d-----w- c:\windows\pss
2010-04-23 03:20:54 0 d-sh--w- c:\documents and settings\michelerd\IECompatCache
2010-04-23 03:20:11 0 d-sh--w- c:\documents and settings\michelerd\PrivacIE
2010-04-23 03:07:11 0 d-sh--w- c:\documents and settings\michelerd\IETldCache
2010-04-23 00:24:48 267272 ----a-w- c:\windows\system32\xactengine2_10.dll
2010-04-23 00:23:59 3426072 ----a-w- c:\windows\system32\d3dx9_32.dll
2010-04-23 00:23:54 0 d-----w- c:\program files\common files\DivX Shared
2010-04-23 00:21:19 0 d-----w- c:\program files\DivX
2010-04-23 00:20:44 0 d-----w- c:\docume~1\alluse~1\applic~1\DivX
2010-04-23 00:19:53 0 d--h--w- c:\windows\msdownld.tmp
2010-04-23 00:19:18 0 d-----w- c:\windows\Logs
2010-04-23 00:14:14 416 ----a-w- c:\windows\system32\vcredist_x86.bat
2010-04-23 00:14:13 2682880 ----a-w- c:\windows\system32\vcredist_x86.exe
2010-04-23 00:13:38 22729 ----a-w- C:\newkey
2010-04-23 00:13:38 22729 ----a-w- C:\newfile.enc
2010-04-22 23:55:41 0 dc-h--w- c:\windows\ie8
2010-04-22 23:46:36 95360 ----a-w- c:\windows\system32\drivers\lssyzzec.sys
2010-04-22 23:30:05 411368 ----a-w- c:\windows\system32\deployJava1.dll
2010-04-22 22:56:45 0 d-----w- c:\program files\SUPERAntiSpyware
2010-04-22 22:56:18 0 d-----w- c:\program files\common files\Wise Installation Wizard
2010-04-22 22:55:40 0 d-----w- c:\program files\CCleaner
2010-04-22 22:46:03 181632 ------w- c:\windows\system32\MpSigStub.exe
2010-04-22 22:29:11 95360 ----a-w- c:\windows\system32\drivers\bwjlgxho.sys
2010-04-22 12:31:56 0 d-----w- c:\docume~1\alluse~1\applic~1\Alwil Software
2010-04-22 06:58:06 73728 ----a-w- c:\windows\system32\javacpl.cpl
2010-04-22 06:26:25 0 d-----w- c:\docume~1\michel~1\applic~1\Malwarebytes
2010-04-22 06:25:42 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-04-22 06:25:38 0 d-----w- c:\docume~1\alluse~1\applic~1\Malwarebytes
2010-04-22 06:25:37 20824 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-04-22 06:25:36 0 d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-04-22 05:58:10 0 d-----w- c:\docume~1\michel~1\applic~1\SUPERAntiSpyware.com
2010-04-22 05:58:10 0 d-----w- c:\docume~1\alluse~1\applic~1\SUPERAntiSpyware.com
2010-04-21 22:06:09 455680 ------w- c:\windows\system32\dllcache\mrxsmb.sys
2010-04-21 22:03:58 0 d-----w- c:\windows\system32\LogFiles
2010-04-15 05:07:12 0 d-----w- c:\docume~1\alluse~1\applic~1\avG
2010-04-03 04:29:18 3555328 ------w- c:\windows\system32\dllcache\moviemk.exe
2010-04-03 04:11:02 552 ----a-w- c:\windows\system32\d3d8caps.dat
2010-03-31 01:58:24 353592 ----a-w- c:\windows\system32\DivXControlPanelApplet.cpl

==================== Find3M ====================

2010-03-31 01:58:04 9200 ------w- c:\windows\system32\drivers\cdralw2k.sys
2010-03-31 01:58:04 9072 ------w- c:\windows\system32\drivers\cdr4_xp.sys
2010-03-31 01:58:04 44944 ------w- c:\windows\system32\drivers\pxhelp20.sys
2010-03-31 01:58:04 133616 ------w- c:\windows\system32\pxafs.dll
2010-03-31 01:58:04 125424 ------w- c:\windows\system32\pxinsi64.exe
2010-03-31 01:58:04 123888 ------w- c:\windows\system32\pxcpyi64.exe
2010-03-10 06:15:52 420352 ----a-w- c:\windows\system32\vbscript.dll
2010-03-10 06:15:52 420352 ----a-w- c:\windows\system32\dllcache\vbscript.dll
2010-03-08 17:59:18 94208 ----a-w- c:\windows\system32\dpl100.dll
2010-02-25 15:54:36 11070976 ------w- c:\windows\system32\dllcache\ieframe.dll
2010-02-25 06:24:37 916480 ----a-w- c:\windows\system32\wininet.dll
2010-02-25 06:24:37 916480 ----a-w- c:\windows\system32\dllcache\wininet.dll
2010-02-25 06:24:37 611840 ----a-w- c:\windows\system32\dllcache\mstime.dll
2010-02-25 06:24:37 206848 ------w- c:\windows\system32\dllcache\occache.dll
2010-02-25 06:24:37 1209344 ----a-w- c:\windows\system32\dllcache\urlmon.dll
2010-02-25 06:24:36 5944832 ----a-w- c:\windows\system32\dllcache\mshtml.dll
2010-02-25 06:24:35 25600 ----a-w- c:\windows\system32\dllcache\jsproxy.dll
2010-02-25 06:24:35 184320 ----a-w- c:\windows\system32\dllcache\iepeers.dll
2010-02-25 06:24:34 387584 ------w- c:\windows\system32\dllcache\iedkcs32.dll
2010-02-24 09:54:25 173056 ------w- c:\windows\system32\dllcache\ie4uinit.exe
2010-02-19 19:27:36 720384 ----a-w- c:\windows\system32\DivX.dll
2010-02-19 19:27:16 856064 ----a-w- c:\windows\system32\divx_xx0c.dll
2010-02-19 19:27:16 856064 ----a-w- c:\windows\system32\divx_xx07.dll
2010-02-19 19:27:16 847872 ----a-w- c:\windows\system32\divx_xx0a.dll
2010-02-19 19:27:16 843776 ----a-w- c:\windows\system32\divx_xx16.dll
2010-02-19 19:27:16 839680 ----a-w- c:\windows\system32\divx_xx11.dll
2010-02-16 14:08:49 2146304 ----a-w- c:\windows\system32\ntoskrnl.exe
2010-02-16 13:25:04 2066816 ------w- c:\windows\system32\dllcache\ntkrnlpa.exe
2010-02-16 13:25:04 2024448 ----a-w- c:\windows\system32\ntkrnlpa.exe
2010-02-12 04:33:11 100864 ----a-w- c:\windows\system32\6to4svc.dll
2010-02-12 04:33:11 100864 ------w- c:\windows\system32\dllcache\6to4svc.dll
2010-02-11 12:02:15 226880 ------w- c:\windows\system32\dllcache\tcpip6.sys
2010-02-04 14:01:14 74072 ----a-w- c:\windows\system32\XAPOFX1_4.dll
2010-02-04 14:01:14 528216 ----a-w- c:\windows\system32\XAudio2_6.dll
2010-02-04 14:01:14 238936 ----a-w- c:\windows\system32\xactengine3_6.dll
2010-02-04 14:01:14 22360 ----a-w- c:\windows\system32\X3DAudio1_7.dll
2009-12-02 01:33:50 168 --sh--r- c:\windows\system32\03CC08DAB8.sys
2009-12-02 01:33:51 5642 --sha-w- c:\windows\system32\KGyGaAvL.sys

============= FINISH: 16:39:09.15 ===============

Attached Files


Edited by Orange Blossom, 26 April 2010 - 08:34 PM.


BC AdBot (Login to Remove)

 


#2 schrauber

schrauber

    Mr.Mechanic


  • Malware Response Team
  • 24,794 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Munich,Germany
  • Local time:03:08 PM

Posted 30 April 2010 - 11:18 AM

Hello and welcome to Bleeping Computer

We apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help. No one is ignored here.

If you have since resolved the original problem you were having, we would appreciate you letting us know. If not please perform the following steps below so we can have a look at the current condition of your machine.

If you have not done so, include a clear description of the problems you're having, along with any steps you may have performed so far.

Upon completing the steps below another staff member will review and take the steps necessary with you to get your machine back in working order clean and free of malware.

If you have already posted a DDS log, please do so again, as your situation may have changed.
Use the 'Add Reply' and add the new log to this thread.


Thanks and again sorry for the delay.

We need to see some information about what is happening in your machine. Please perform the following scan:
  • Download DDS by sUBs from one of the following links. Save it to your desktop.
  • Double click on the DDS icon, allow it to run.
  • A small box will open, with an explaination about the tool. No input is needed, the scan is running.
  • Notepad will open with the results.
  • Follow the instructions that pop up for posting the results.
  • Close the program window, and delete the program from your desktop.
Please note: You may have to disable any script protection running if the scan fails to run. After downloading the tool, disconnect from the internet and disable all antivirus protection. Run the scan, enable your A/V and reconnect to the internet.

Information on A/V control HERE



Please download GMER from one of the following locations and save it to your desktop:
  • Main Mirror
    This version will download a randomly named file (Recommended)
  • Zipped Mirror
    This version will download a zip file you will need to extract first. If you use this mirror, please extract the zip file to your desktop.
  • Disconnect from the Internet and close all running programs.
  • Temporarily disable any real-time active protection so your security programs will not conflict with gmer's driver.
  • Double-click on the randomly named GMER file (i.e. n7gmo46c.exe) and allow the gmer.sys driver to load if asked.
  • Note: If you downloaded the zipped version, extract the file to its own folder such as C:\gmer and then double-click on gmer.exe.


  • GMER will open to the Rootkit/Malware tab and perform an automatic quick scan when first run. (do not use the computer while the scan is in progress)
  • If you receive a WARNING!!! about rootkit activity and are asked to fully scan your system...click NO.
  • Now click the Scan button. If you see a rootkit warning window, click OK.
  • When the scan is finished, click the Save... button to save the scan results to your Desktop. Save the file as gmer.log.
  • Click the Copy button and paste the results into your next reply.
  • Exit GMER and re-enable all active protection when done.
-- If you encounter any problems, try running GMER in Safe Mode.
regards,
schrauber

Posted Image
Posted Image

If I've not posted back within 48 hrs., feel free to send a PM with your topic link. Thank you!

If I have helped you then please consider donating to continue the fight against malware Posted Image

#3 Peaty

Peaty
  • Topic Starter

  • Members
  • 15 posts
  • OFFLINE
  •  
  • Local time:09:08 AM

Posted 30 April 2010 - 08:14 PM

I completely understand about not being able to get to each and every request right away. I did post the requested info above however, I had to ship the laptop back to the owner today. It seemed to be working fine and no re-occurrence of the original issue resurfaced. I did load some good preventive software on the laptop and hope to get on a remote assistance to show the owner how to update and run scans.

Thanks for having such a good website, searching around I've learned quite a bit.

Regards,

Peaty

#4 schrauber

schrauber

    Mr.Mechanic


  • Malware Response Team
  • 24,794 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Munich,Germany
  • Local time:03:08 PM

Posted 01 May 2010 - 09:37 AM

Since this issue appears to be resolved ... this Topic has been closed. Glad we could help. smile.gif

If your the topic starter, and need this topic reopened, please contact me via pm with the address of the thread.

Everyone else please begin a New Topic.
regards,
schrauber

Posted Image
Posted Image

If I've not posted back within 48 hrs., feel free to send a PM with your topic link. Thank you!

If I have helped you then please consider donating to continue the fight against malware Posted Image




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users