Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Google Redirect - COMBOFIX LOG


  • This topic is locked This topic is locked
2 replies to this topic

#1 sbolar

sbolar

  • Members
  • 1 posts
  • OFFLINE
  •  
  • Local time:06:33 AM

Posted 11 May 2010 - 08:15 PM

ComboFix 10-05-10.05 - ...... 05/11/2010 19:52:39.1.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1014.692 [GMT -5:00]
Running from: c:\documents and settings\owner\My Documents\Downloads\ComboFix.exe
AV: Security Shield Antivirus *On-access scanning disabled* (Updated) {6C4BB89C-B0ED-4F41-A29C-4373888923BB}
FW: Security Shield Firewall *disabled* {4055920F-2E99-48A8-A270-4243D2B8F242}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Owner\Local Settings\Application Data\2991590366.dll
c:\windows\system32\Thumbs.db

Infected copy of c:\windows\system32\drivers\atapi.sys was found and disinfected
Restored copy from - Kitty had a snack tongue.gif
.
((((((((((((((((((((((((( Files Created from 2010-04-12 to 2010-05-12 )))))))))))))))))))))))))))))))
.

2010-05-12 00:50 . 2010-05-12 00:50 -------- d--h--w- c:\temp\dvmexp
2010-05-12 00:50 . 2010-05-12 00:50 -------- d-----w- C:\dvmexp
2010-05-07 01:01 . 2010-05-07 01:01 -------- d-----w- c:\program files\Common Files\Hewlett-Packard
2010-05-07 01:00 . 2008-04-14 05:15 15104 -c--a-w- c:\windows\system32\dllcache\usbscan.sys
2010-05-07 01:00 . 2008-04-14 05:15 15104 ----a-w- c:\windows\system32\drivers\usbscan.sys
2010-05-07 01:00 . 2004-09-29 17:15 204800 ----a-w- c:\windows\system32\HPZipr12.dll
2010-05-07 01:00 . 2004-09-29 17:14 69632 ----a-w- c:\windows\system32\HPZipm12.exe
2010-05-07 01:00 . 2004-09-29 17:12 278584 ----a-w- c:\windows\system32\HPZidr12.dll
2010-05-07 01:00 . 2004-09-29 17:09 57344 ----a-w- c:\windows\system32\HPZisn12.dll
2010-05-07 01:00 . 2004-09-29 17:09 94208 ----a-w- c:\windows\system32\HPZipt12.dll
2010-05-07 01:00 . 2004-09-29 17:08 61440 ----a-w- c:\windows\system32\HPZinw12.exe
2010-05-07 01:00 . 1998-10-29 21:45 306688 ----a-w- c:\windows\IsUninst.exe
2010-05-07 01:00 . 2010-05-07 01:00 -------- d-----w- c:\program files\HP
2010-05-07 00:59 . 2010-05-07 01:02 102262 ----a-w- c:\windows\hpoins05.dat
2010-05-07 00:59 . 2005-06-22 14:03 17505 ------w- c:\windows\hpomdl07.dat
2010-05-07 00:59 . 2005-03-08 19:43 21744 ----a-w- c:\windows\system32\drivers\HPZius12.sys
2010-05-07 00:59 . 2005-03-08 19:43 51120 ----a-w- c:\windows\system32\drivers\HPZid412.sys
2010-05-07 00:59 . 2005-03-08 19:43 16496 ----a-w- c:\windows\system32\drivers\HPZipr12.sys
2010-05-07 00:59 . 2005-03-08 19:39 274432 ----a-w- c:\windows\system32\HPZc3212.dll
2010-05-07 00:59 . 2005-02-05 02:58 98304 ----a-w- c:\windows\system32\hpzjsn01.dll
2010-05-07 00:59 . 2005-04-08 15:51 278528 ----a-w- c:\windows\system32\hpgwiamd.dll
2010-05-07 00:59 . 2005-04-08 15:51 258122 ----a-w- c:\windows\system32\hpovst08.dll
2010-05-07 00:59 . 2005-04-08 15:51 606208 ----a-w- c:\windows\system32\hpotscl.dll
2010-05-07 00:59 . 2005-03-18 18:32 180315 ----a-w- c:\windows\system32\hpzsnt12.dll
2010-05-07 00:58 . 2005-03-08 19:41 393216 ----a-w- c:\windows\system32\hpzcon12.dll
2010-05-07 00:58 . 2005-03-08 19:41 196608 ----a-w- c:\windows\system32\hpzcoi12.dll
2010-05-07 00:47 . 2008-04-14 05:17 25856 -c--a-w- c:\windows\system32\dllcache\usbprint.sys
2010-05-07 00:47 . 2008-04-14 05:17 25856 ----a-w- c:\windows\system32\drivers\usbprint.sys
2010-04-28 23:17 . 2010-04-28 23:17 -------- d-----w- c:\documents and settings\Owner\Application Data\Webshots
2010-04-28 23:16 . 2010-04-28 23:16 -------- d-----w- c:\program files\Webshots
2010-04-28 23:16 . 2010-04-28 23:16 -------- d-----w- c:\documents and settings\Owner\Application Data\AGI
2010-04-28 23:16 . 2010-04-28 23:16 -------- d-----w- c:\program files\AGI
2010-04-28 23:15 . 2010-04-28 23:16 -------- d-----w- c:\documents and settings\All Users\Application Data\agi
2010-04-25 18:05 . 2010-04-25 18:05 -------- d-----w- c:\windows\system32\wbem\Repository
2010-04-19 19:59 . 2010-04-19 19:59 255472 ----a-w- c:\documents and settings\Owner\Application Data\Mozilla\plugins\npgoogletalk.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-05-12 00:48 . 2008-04-14 00:10 96512 ----a-w- c:\windows\system32\drivers\atapi.sys
2010-05-12 00:31 . 2010-03-15 06:04 -------- d-----w- c:\documents and settings\Owner\Application Data\Skype
2010-05-12 00:31 . 2010-03-15 06:05 -------- d-----w- c:\documents and settings\Owner\Application Data\skypePM
2010-05-11 14:15 . 2010-03-08 17:32 664 ----a-w- c:\windows\system32\d3d9caps.dat
2010-05-11 04:52 . 2010-03-18 05:18 -------- d-----w- c:\documents and settings\Owner\Application Data\U3
2010-05-09 16:53 . 2010-03-06 16:23 -------- d-----w- c:\program files\CCleaner
2010-04-25 17:56 . 2010-04-24 01:23 112 ----a-w- c:\documents and settings\All Users\Application Data\33p3FpN.dat
2010-04-19 02:41 . 2009-12-30 23:13 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help
2010-04-19 02:08 . 2010-04-11 01:44 132 ----a-w- c:\windows\system32\rezumatenoi.dat
2010-04-11 02:02 . 2010-04-11 02:02 -------- d-----w- c:\program files\Support Tools
2010-04-09 04:57 . 2010-03-28 17:44 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-04-09 04:50 . 2010-04-09 04:50 0 ----a-w- c:\windows\system32\wsbl.dat
2010-04-09 04:50 . 2010-04-09 04:50 0 ----a-w- c:\windows\system32\ph_white.dat
2010-04-09 04:50 . 2010-04-09 04:50 0 ----a-w- c:\windows\system32\ph_summ.dat
2010-04-09 04:50 . 2010-04-09 04:50 0 ----a-w- c:\windows\system32\ph_black.dat
2010-04-09 04:50 . 2010-04-09 04:50 0 ----a-w- c:\windows\system32\pcwords2.dat
2010-04-09 04:50 . 2010-04-09 04:50 0 ----a-w- c:\windows\system32\pcwords.dat
2010-04-09 04:41 . 2010-04-09 04:41 -------- d-----w- c:\documents and settings\All Users\Application Data\BitDefender
2010-04-09 04:38 . 2010-04-09 04:38 -------- d-----w- c:\documents and settings\Owner\Application Data\Security Shield
2010-04-09 04:37 . 2010-04-09 04:37 -------- d-----w- c:\program files\Common Files\Security Shield
2010-04-09 04:37 . 2010-04-09 04:37 -------- d-----w- c:\program files\Security Shield
2010-04-09 04:37 . 2010-04-09 04:37 -------- d-----w- c:\documents and settings\All Users\Application Data\Security Shield
2010-04-09 04:36 . 2010-04-09 04:36 -------- d-----w- c:\program files\Common Files\BitDefender
2010-04-09 04:08 . 2010-04-09 04:08 -------- d-----w- c:\program files\NortonInstaller
2010-04-09 04:08 . 2010-04-09 04:08 -------- d-----w- c:\documents and settings\All Users\Application Data\NortonInstaller
2010-04-09 03:51 . 2010-04-09 03:51 552 ----a-w- c:\windows\system32\d3d8caps.dat
2010-04-04 01:32 . 2010-04-04 01:32 -------- d-----w- c:\documents and settings\Owner\Application Data\uTorrent
2010-03-30 01:45 . 2010-03-15 05:15 -------- d-----w- c:\program files\Paint.NET
2010-03-28 17:45 . 2010-03-28 17:45 -------- d-----w- c:\documents and settings\Owner\Application Data\Malwarebytes
2010-03-28 17:44 . 2010-03-28 17:44 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-03-26 02:38 . 2010-03-26 02:38 766 ----a-r- c:\documents and settings\Owner\Application Data\Microsoft\Installer\{FBF79AB0-3A91-4D44-9772-A8FC8A3FFD70}\_644366bb.exe
2010-03-26 02:38 . 2010-03-26 02:38 -------- d-----w- c:\program files\Western Digital Corp
2010-03-24 06:21 . 2009-12-30 22:57 -------- d-----w- c:\program files\PCDR5
2010-03-24 06:18 . 2009-12-30 23:00 -------- d-----w- c:\documents and settings\All Users\Application Data\VeriFace
2010-03-18 05:28 . 2010-03-18 05:19 -------- d-----w- c:\program files\Recuva
2010-03-15 06:05 . 2010-03-15 06:05 48 ---ha-w- c:\windows\system32\ezsidmv.dat
2010-03-15 06:03 . 2010-03-15 06:03 -------- d-----r- c:\program files\Skype
2010-03-15 06:03 . 2010-03-15 06:03 -------- d-----w- c:\program files\Common Files\Skype
2010-03-15 06:03 . 2010-03-15 06:03 -------- d-----w- c:\documents and settings\All Users\Application Data\Skype
2010-03-15 05:15 . 2010-03-05 17:12 68456 ----a-w- c:\documents and settings\Owner\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-03-14 23:54 . 2009-12-30 23:19 -------- d-----w- c:\program files\Microsoft SQL Server
2010-03-14 20:16 . 2008-07-21 19:15 76487 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat
2010-03-13 20:03 . 2010-03-13 20:03 68456 ----a-w- c:\documents and settings\Tammy\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-03-10 06:15 . 2008-07-21 20:04 420352 ----a-w- c:\windows\system32\vbscript.dll
2010-03-06 17:54 . 2010-03-06 17:54 1925088 ----a-w- c:\documents and settings\Owner\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\fpupdatepl\fpupdatepl.exe
2010-03-06 16:23 . 2010-03-06 16:23 0 ----a-w- c:\windows\nsreg.dat
2010-02-25 06:24 . 2008-07-21 20:04 916480 ----a-w- c:\windows\system32\wininet.dll
2010-02-24 13:11 . 2008-07-21 20:04 455680 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2010-02-16 14:08 . 2008-04-14 00:54 2146304 ----a-w- c:\windows\system32\ntoskrnl.exe
2010-02-16 13:25 . 2008-04-14 00:01 2024448 ----a-w- c:\windows\system32\ntkrnlpa.exe
2010-02-12 04:33 . 2008-07-21 20:04 100864 ----a-w- c:\windows\system32\6to4svc.dll
2010-02-11 12:02 . 2008-07-21 20:04 226880 ----a-w- c:\windows\system32\drivers\tcpip6.sys
2009-09-14 03:10 . 2010-04-09 04:42 47104 ----a-w- c:\program files\mozilla firefox\components\FFComm.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{0BC6E3FA-78EF-4886-842C-5A1258C4455A}"= "mscoree.dll" [2008-07-25 282112]

[HKEY_CLASSES_ROOT\clsid\{0bc6e3fa-78ef-4886-842c-5a1258c4455a}]
[HKEY_CLASSES_ROOT\agihelper.AGUtils]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0bc6e3fa-78ef-4886-842c-5a1258c4455a}]
2008-07-25 19:16 282112 ----a-w- c:\windows\system32\mscoree.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\VeriFace Enc]
@="{771C7324-DA80-49D3-8017-753B0AF60951}"
[HKEY_CLASSES_ROOT\CLSID\{771C7324-DA80-49D3-8017-753B0AF60951}]
2009-12-30 23:00 241752 ----a-w- c:\windows\system32\IcnOvrly.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2010-03-09 26100520]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-05-23 1146880]
"EnergyUtility"="c:\program files\Lenovo\Energy Management\utility.exe" [2008-07-10 4456448]
"Energy Management"="c:\program files\Lenovo\Energy Management\Energy Management.exe" [2008-08-28 1283984]
"RTHDCPL"="RTHDCPL.EXE" [2009-02-17 17508864]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-02-28 141848]
"Persistence"="c:\windows\system32\igfxpers.exe" [2008-02-28 137752]
"TVT Scheduler Proxy"="c:\program files\Common Files\Lenovo\Scheduler\scheduler_proxy.exe" [2008-03-04 487424]
"VeriFaceManager"="c:\program files\Lenovo\VeriFaceIII\PManage.exe" [2009-12-30 323584]
"Necutray"="NECUTRAY.EXE" [2002-08-01 40960]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\PicNotify]
2009-12-30 23:00 1167360 ----a-w- c:\windows\system32\PicNotify.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]
2008-02-28 07:00 166424 ----a-w- c:\windows\system32\hkcmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
"DisableNotifications"= 1 (0x1)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Documents and Settings\\Owner\\Local Settings\\Application Data\\Google\\Google Talk Plugin\\googletalkplugin.dll"=
"c:\\Documents and Settings\\Owner\\Local Settings\\Application Data\\Google\\Google Talk Plugin\\googletalkplugin.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

R2 AGCoreService;AG Core Services;c:\program files\AGI\core\4.2.0.10753\AGCoreService.exe [4/28/2010 6:16 PM 20480]
R2 DvmMDES;DeviceVM Meta Data Export Service;c:\qstart.sys\config\DVMExportService.exe [11/20/2008 12:15 PM 307200]
R3 ACPIVPC;Lenovo Virtual Power Controller Driver;c:\windows\system32\drivers\AcpiVpc.sys [12/30/2009 5:51 PM 9472]
R3 RSUSBSTOR;RTS5121.Sys Realtek USB Card Reader;c:\windows\system32\drivers\RTS5121.sys [12/30/2009 5:57 PM 157696]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [12/30/2009 5:51 PM 1684736]
S3 PCD5SRVC{07D2499C-80E86AC3-05040000};PCD5SRVC{07D2499C-80E86AC3-05040000} - PCDR Kernel Mode Service Helper Driver;c:\progra~1\PCDR5\PCD5SRVC.pkms [5/7/2008 1:24 PM 21280]
S3 Rts516xIR;Realtek IR Driver;c:\windows\system32\DRIVERS\Rts516xIR.sys --> c:\windows\system32\DRIVERS\Rts516xIR.sys [?]
.
Contents of the 'Scheduled Tasks' folder

2010-05-12 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4282291345-894191819-4065513110-1009Core.job
- c:\documents and settings\Owner\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-03-06 16:27]

2010-05-12 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4282291345-894191819-4065513110-1009UA.job
- c:\documents and settings\Owner\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-03-06 16:27]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://lenovo.msn.com
uInternet Settings,ProxyOverride = <local>
IE: E&xport to Microsoft Excel - c:\progra~1\MI1933~1\Office12\EXCEL.EXE/3000
DPF: {C345E174-3E87-4F41-A01C-B066A90A49B4} - hxxp://trial.trymicrosoftoffice.com/trialoaa/buymsoffice_assets/framework/microsoft/wrc32.ocx
FF - ProfilePath - c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\3zf1o9v2.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/ig
FF - prefs.js: network.proxy.type - 4
FF - component: c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\3zf1o9v2.default\extensions\afom@idevfh\components\npAFOM.dll
FF - component: c:\program files\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}\components\SkypeFfComponent.dll
FF - plugin: c:\documents and settings\Owner\Application Data\Mozilla\plugins\npgoogletalk.dll
FF - plugin: c:\documents and settings\Owner\Application Data\Mozilla\plugins\npgoogletalk.dll
FF - plugin: c:\documents and settings\Owner\Local Settings\Application Data\Google\Update\1.2.183.23\npGoogleOneClick8.dll
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- FIREFOX POLICIES ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-05-11 20:03
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe catchme.sys CLASSPNP.SYS disk.sys >>UNKNOWN [0x86CDFAC8]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0xf7641f28
\Driver\ACPI -> ACPI.sys @ 0xf74d4cb8
\Driver\atapi -> atapi.sys @ 0xf746e852
IoDeviceObjectType -> ParseProcedure -> ntkrnlpa.exe @ 0x805827e8
SecurityProcedure -> ntkrnlpa.exe @ 0x80583d4a
\Device\Harddisk0\DR0 -> ParseProcedure -> ntkrnlpa.exe @ 0x805827e8
SecurityProcedure -> ntkrnlpa.exe @ 0x80583d4a
NDIS: Broadcom 802.11g Network Adapter -> SendCompleteHandler -> NDIS.sys @ 0xf737abb0
PacketIndicateHandler -> NDIS.sys @ 0xf7387a21
SendHandler -> NDIS.sys @ 0xf736587b
user & kernel MBR OK
copy of MBR has been found in sector 1 !

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\PCD5SRVC{07D2499C-80E86AC3-05040000}]
"ImagePath"="\??\c:\progra~1\PCDR5\PCD5SRVC.pkms"
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(832)
c:\windows\system32\WININET.dll
c:\windows\system32\PicNotify.dll
c:\windows\system32\FaceVerify.dll
c:\windows\system32\MainOp.dll
c:\windows\system32\VideoOp.dll
c:\windows\system32\Image.dll
c:\windows\system32\Momo.dll
c:\windows\system32\Apblend.dll
c:\windows\system32\SetDev.dll
c:\windows\system32\FunFrm.dll
c:\windows\system32\facev.dll

- - - - - - - > 'lsass.exe'(892)
c:\windows\system32\WININET.dll
.
Completion time: 2010-05-11 20:09:58
ComboFix-quarantined-files.txt 2010-05-12 01:09

Pre-Run: 144,908,771,328 bytes free
Post-Run: 145,100,218,368 bytes free

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect

- - End Of File - - 1840662E60F7D05A867D9106B6B5D517

Edited by sbolar, 11 May 2010 - 10:40 PM.


BC AdBot (Login to Remove)

 


#2 schrauber

schrauber

    Mr.Mechanic


  • Malware Response Team
  • 24,794 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Munich,Germany
  • Local time:12:33 PM

Posted 13 May 2010 - 01:58 AM

Hello, sbolar
Welcome to the Bleeping Computer Forums. My name is Thomas (Tom is fine), and I will be helping you fixing your problems.

If you do not make a reply in 5 days, we will have to close your topic.

You may want to keep the link to this topic in your favourites. Alternatively, you can click the button at the top bar of this topic and Track this Topic. The topics you are tracking can be found here.

Please take note of some guidelines for this fix:
  • Refrain from making any changes to your computer including installing/uninstall programs, deleting files, modifying the registry, and running scanners or tools. Doing so could cause changes to the directions I have to give you and prolong the time required. Further more, you should not be taking any advice relating to this computer from any other source throughout the course of this fix.
  • If you do not understand any step(s) provided, please do not hesitate to ask before continuing. I would much rather clarify instructions or explain them differently than have something important broken.
  • Even if things appear to be better, it might not mean we are finished. Please continue to follow my instructions and reply back until I give you the "all clean". We do not want to clean you part-way, only to have the system re-infect itself.
  • Please reply using the button in the lower right hand corner of your screen. Do not start a new topic. The logs that you post should be pasted directly into the reply. Only attach them if requested or if they do not fit into the post.
  • Old topics are closed after 3 days with no reply, and working topics are closed after 5 days. If for any reason you cannot complete instructions within that time, that's fine, just post back here so that we know you're still here.
  • Please set your system to show all files.
    Click Start, open My Computer, select the Tools menu and click Folder Options.
    Select the View Tab. Under the Hidden files and folders heading, select Show hidden files and folders.
    Uncheck: Hide file extensions for known file types
    Uncheck the Hide protected operating system files (recommended) option.
    Click Yes to confirm.




You must first verify that you can logon to the Windows Recovery Console.
To do so, you must have the Recovery Console installed or use the Windows XP installation cd.

How to install and use the Windows XP Recovery Console


Next, please download maxlook, saving the file to your desktop.
Double click maxlook.exe to run it. Note - you must run it only once!
As instructed when the tool runs, restart the computer and logon to the Recovery Console.
Execute the following bolded command at the x:\windows> prompt <--- the red x represents your operating system drive letter, usually C

batch look.bat

You will see many files copied then return to the x:\windows> prompt.
Type Exit then restart your computer and logon in normal mode.
Please run maxlook.exe again now. Note - you must run it only once!
It will produce looklog.txt on the desktop and open it.
Please post the results here.

NEXT:

Once back in Windows, go to Start > Run, and copy/paste the following then press Enter.

maxlook -sig


Post the log in your next reply
regards,
schrauber

Posted Image
Posted Image

If I've not posted back within 48 hrs., feel free to send a PM with your topic link. Thank you!

If I have helped you then please consider donating to continue the fight against malware Posted Image

#3 schrauber

schrauber

    Mr.Mechanic


  • Malware Response Team
  • 24,794 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Munich,Germany
  • Local time:12:33 PM

Posted 18 May 2010 - 03:36 PM

Due to the lack of feedback, this topic is now closed.
If you need this topic reopened, please PM a staff member and we will reopen it for you (include the address of this thread in your request). This applies to the original topic starter only. Everyone else with similar problems, please start a new topic.
regards,
schrauber

Posted Image
Posted Image

If I've not posted back within 48 hrs., feel free to send a PM with your topic link. Thank you!

If I have helped you then please consider donating to continue the fight against malware Posted Image




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users