Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

IE script errors, redirect, and audio ads


  • This topic is locked This topic is locked
13 replies to this topic

#1 mertaan24

mertaan24

  • Members
  • 13 posts
  • OFFLINE
  •  
  • Local time:01:47 AM

Posted 28 April 2011 - 12:21 PM

Hello, I was recently sent to this thread from my original topic http://www.bleepingcomputer.com/forums/topic392738.html and I have followed the steps in the prep. guide. The logs that were asked for are provided below. Thanks again for the help.


.
DDS (Ver_11-03-05.01) - NTFSx86
Run by tfox at 17:05:59.09 on Wed 04/27/2011
Internet Explorer: 6.0.2900.2180 BrowserJavaVersion: 1.6.0_18
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.2046.1444 [GMT -5:00]
.
AV: McAfee VirusScan *Enabled/Updated* {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}
FW: McAfee Personal Firewall *Disabled*
.
============== Running Processes ===============
.
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
svchost.exe
C:\WINDOWS\DOWNLO~1\WebEx\319\atnthost.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\program files\common files\mcafee\mna\mcnasvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\Program Files\McAfee\MSK\MskSrver.exe
C:\Program Files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe
C:\Program Files\SiteAdvisor\6253\SAService.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
c:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\WINDOWS\DOWNLO~1\WebEx\319\raagtx.exe
C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
C:\Program Files\Common Files\Intuit\QuickBooks\QBWebConnector\QBWebConnector.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Documents and Settings\TFox\Desktop\dds.scr
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://google.com/
uDefault_Page_URL = hxxp://www.dell4me.com/mywaybiz
mDefault_Page_URL = hxxp://companyweb
mStart Page = hxxp://www.dell4me.com/mywaybiz
uInternet Settings,ProxyOverride = <local>
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 7.0\activex\AcroIEHelper.dll
BHO: {089fd14d-132b-48fc-8861-0048ae113215} - c:\program files\siteadvisor\6253\SiteAdv.dll
BHO: McAfee Phishing Filter: {27b4851a-3207-45a2-b947-be8afe6163ab} - c:\progra~1\mcafee\msk\mskapbho.dll
BHO: scriptproxy: {7db2d5a0-7241-4e79-b68d-6309f01c5231} - c:\program files\mcafee\virusscan\scriptsn.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.1.1309.3572\swg.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: McAfee SiteAdvisor: {0bf43445-2f28-4351-9252-17fe6e806aa0} - c:\program files\siteadvisor\6253\SiteAdv.dll
EB: Real.com: {fe54fa40-d68c-11d2-98fa-00c0f0318afe} - c:\windows\system32\Shdocvw.dll
uRun: [DellSupport] "c:\program files\dellsupport\DSAgnt.exe" /startup
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [DellTransferAgent] "c:\documents and settings\all users\application data\dell\transferagent\TransferAgent.exe"
uRun: [updateMgr] "c:\program files\adobe\acrobat 7.0\reader\AdobeUpdateManager.exe" AcRdB7_0_9
uRun: [SUPERAntiSpyware] c:\program files\superantispyware\SUPERAntiSpyware.exe
mRun: [mcagent_exe] "c:\program files\mcafee.com\agent\mcagent.exe" /runkey
mRun: [TkBellExe] "c:\program files\common files\real\update_ob\realsched.exe" -osboot
mRun: [Intuit SyncManager] c:\program files\common files\intuit\sync\IntuitSyncManager.exe startup
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\access~1.lnk - c:\windows\downlo~1\webex\319\raagtx.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\adober~1.lnk - c:\program files\adobe\acrobat 7.0\reader\reader_sl.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\quickb~1.lnk - c:\program files\common files\intuit\quickbooks\qbupdate\qbupdate.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\quickb~2.lnk - c:\program files\common files\intuit\quickbooks\qbwebconnector\QBWebConnector.exe
mPolicies-explorer: NoWelcomeScreen = 1 (0x1)
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL
IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - {FE54FA40-D68C-11d2-98FA-00C0F0318AFE} - c:\windows\system32\Shdocvw.dll
Trusted Zone: musicmatch.com\online
DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - hxxp://download.mcafee.com/molbin/shared/mcinsctl/en-us/4,0,0,90/mcinsctl.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab
DPF: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
Handler: intu-help-qb3 - {c5e479ea-0a65-4b05-8c6c-2fc8cc682eb4} - c:\program files\intuit\quickbooks enterprise solutions 5.0\HelpAsyncPluggableProtocol.dll
Handler: qbwc - {FC598A64-626C-4447-85B8-53150405FD57} - c:\windows\system32\mscoree.dll
Handler: siteadvisor - {3A5DC592-7723-4EAA-9EE6-AF4222BCF879} - c:\program files\siteadvisor\6253\SiteAdv.dll
Notify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.DLL
Notify: igfxcui - igfxdev.dll
SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLL
.
============= SERVICES / DRIVERS ===============
.
R1 mfehidk;McAfee Inc. mfehidk;c:\windows\system32\drivers\mfehidk.sys [2007-4-10 214664]
R1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\sasdifsv.sys [2010-2-17 12872]
R1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2010-5-10 67656]
R2 atnthost;AT Host Service;c:\windows\downlo~1\webex\319\atnthost.exe [2005-11-22 30720]
R2 McProxy;McAfee Proxy Service;c:\progra~1\common~1\mcafee\mcproxy\mcproxy.exe [2007-4-10 359952]
R2 McShield;McAfee Real-time Scanner;c:\progra~1\mcafee\viruss~1\mcshield.exe [2007-4-10 144704]
R3 McSysmon;McAfee SystemGuards;c:\progra~1\mcafee\viruss~1\mcsysmon.exe [2007-4-10 606736]
R3 mfeavfk;McAfee Inc. mfeavfk;c:\windows\system32\drivers\mfeavfk.sys [2007-4-10 79816]
R3 mfebopk;McAfee Inc. mfebopk;c:\windows\system32\drivers\mfebopk.sys [2007-4-10 35272]
R3 mfesmfk;McAfee Inc. mfesmfk;c:\windows\system32\drivers\mfesmfk.sys [2007-4-10 40552]
S2 gupdate1c99d29538bb16;Google Update Service (gupdate1c99d29538bb16);c:\program files\google\update\GoogleUpdate.exe [2009-3-4 133104]
S2 QuickBooksDB17;QuickBooksDB17;c:\progra~1\intuit\quickb~1.0\qbdbmgrn.exe -hvquickbooksdb17 --> c:\progra~1\intuit\quickb~1.0\QBDBMgrN.exe -hvQuickBooksDB17 [?]
S3 mferkdk;McAfee Inc. mferkdk;c:\windows\system32\drivers\mferkdk.sys [2007-4-10 34248]
.
=============== Created Last 30 ================
.
2011-04-20 22:51:54 -------- d-----w- c:\docume~1\tfox\locals~1\applic~1\Chromium
2011-04-19 18:52:46 -------- d-----w- c:\docume~1\tfox\applic~1\SUPERAntiSpyware.com
2011-04-19 18:52:46 -------- d-----w- c:\docume~1\alluse~1\applic~1\SUPERAntiSpyware.com
2011-04-19 18:52:38 -------- d-----w- c:\program files\SUPERAntiSpyware
2011-04-19 18:09:23 -------- d-----w- c:\windows\pss
2011-04-05 20:26:34 -------- d-----w- c:\program files\Black Isle
2011-03-31 00:52:18 -------- d-----w- c:\docume~1\tfox\applic~1\DAEMON Tools Lite
2011-03-31 00:52:18 -------- d-----w- c:\docume~1\alluse~1\applic~1\DAEMON Tools Lite
.
==================== Find3M ====================
.
.
============= FINISH: 17:07:42.35 ===============

BC AdBot (Login to Remove)

 


#2 mertaan24

mertaan24
  • Topic Starter

  • Members
  • 13 posts
  • OFFLINE
  •  
  • Local time:01:47 AM

Posted 28 April 2011 - 12:29 PM

Here is another log.

Attached File  Attach.txt   21.49KB   2 downloads


#3 mertaan24

mertaan24
  • Topic Starter

  • Members
  • 13 posts
  • OFFLINE
  •  
  • Local time:01:47 AM

Posted 28 April 2011 - 12:32 PM

For some reason it will not let me post my Gmer log. Every time I try it either crashes my browser or says the webpage is unavailable.

#4 mertaan24

mertaan24
  • Topic Starter

  • Members
  • 13 posts
  • OFFLINE
  •  
  • Local time:01:47 AM

Posted 28 April 2011 - 02:51 PM

Ran Gmer again and created another log.


GMER 1.0.15.15570 - http://www.gmer.net
Rootkit scan 2011-04-28 14:27:15
Windows 5.1.2600 Service Pack 2 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3 Maxtor_6Y080L0 rev.YAR41BW0
Running: gmer.exe; Driver: C:\DOCUME~1\TFox\LOCALS~1\Temp\pgliqpoc.sys


---- System - GMER 1.0.15 ----

SSDT \??\C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS (SASKUTIL.SYS/SUPERAdBlocker.com and SUPERAntiSpyware.com) ZwTerminateProcess [0xB0A80620]

Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwCreateFile [0xB096678A]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwCreateKey [0xB0966821]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwCreateProcess [0xB0966738]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwCreateProcessEx [0xB096674C]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwDeleteKey [0xB0966835]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwDeleteValueKey [0xB0966861]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwEnumerateKey [0xB09668CF]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwEnumerateValueKey [0xB09668B9]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwMapViewOfSection [0xB09667CA]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwNotifyChangeKey [0xB09668FB]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwOpenKey [0xB096680D]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwOpenProcess [0xB0966710]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwOpenThread [0xB0966724]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwProtectVirtualMemory [0xB096679E]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwQueryKey [0xB0966937]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwQueryMultipleValueKey [0xB09668A3]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwQueryValueKey [0xB096688D]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwRenameKey [0xB096684B]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwReplaceKey [0xB0966923]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwRestoreKey [0xB096690F]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwSetContextThread [0xB0966776]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwSetInformationProcess [0xB0966762]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwSetValueKey [0xB0966877]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwTerminateProcess [0xB09667F9]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwUnloadKey [0xB09668E5]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwUnmapViewOfSection [0xB09667E0]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwYieldExecution [0xB09667B4]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) NtCreateFile
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) NtMapViewOfSection
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) NtOpenProcess
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) NtOpenThread
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) NtSetInformationProcess

---- Kernel code sections - GMER 1.0.15 ----

.text ntoskrnl.exe!ZwYieldExecution 80509014 7 Bytes JMP B09667B8 \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
PAGE ntoskrnl.exe!ZwOpenKey 80571CB4 5 Bytes JMP B0966811 \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
PAGE ntoskrnl.exe!ZwQueryValueKey 805720F8 7 Bytes JMP B0966891 \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
PAGE ntoskrnl.exe!ZwCreateKey 8057722F 5 Bytes JMP B0966825 \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
PAGE ntoskrnl.exe!ZwQueryKey 80577FA4 7 Bytes JMP B096693B \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
PAGE ntoskrnl.exe!ZwEnumerateKey 805783A4 7 Bytes JMP B09668D3 \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
PAGE ntoskrnl.exe!NtOpenProcess 80579084 5 Bytes JMP B0966714 \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
PAGE ntoskrnl.exe!ZwProtectVirtualMemory 80579399 7 Bytes JMP B09667A2 \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
PAGE ntoskrnl.exe!NtCreateFile 8057D3BC 5 Bytes JMP B096678E \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
PAGE ntoskrnl.exe!ZwUnmapViewOfSection 8057E29B 5 Bytes JMP B09667E4 \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
PAGE ntoskrnl.exe!NtMapViewOfSection 8057E713 7 Bytes JMP B09667CE \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
PAGE ntoskrnl.exe!ZwSetValueKey 8057FF0B 7 Bytes JMP B096687B \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
PAGE ntoskrnl.exe!NtSetInformationProcess 80581B25 5 Bytes JMP B0966766 \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
PAGE ntoskrnl.exe!ZwCreateProcessEx 8058AB14 7 Bytes JMP B0966750 \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
PAGE ntoskrnl.exe!ZwTerminateProcess 8058C39D 5 Bytes JMP B09667FD \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
PAGE ntoskrnl.exe!ZwEnumerateValueKey 8058F45F 7 Bytes JMP B09668BD \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
PAGE ntoskrnl.exe!ZwDeleteValueKey 805969F7 7 Bytes JMP B0966865 \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
PAGE ntoskrnl.exe!ZwDeleteKey 8059817B 7 Bytes JMP B0966839 \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
PAGE ntoskrnl.exe!NtOpenThread 805B1337 5 Bytes JMP B0966728 \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
PAGE ntoskrnl.exe!ZwNotifyChangeKey 805B1BA6 5 Bytes JMP B09668FF \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
PAGE ntoskrnl.exe!ZwCreateProcess 805C0C00 5 Bytes JMP B096673C \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
PAGE ntoskrnl.exe!ZwSetContextThread 80633DA3 5 Bytes JMP B096677A \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
PAGE ntoskrnl.exe!ZwRestoreKey 8065317C 5 Bytes JMP B0966913 \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
PAGE ntoskrnl.exe!ZwUnloadKey 80653455 7 Bytes JMP B09668E9 \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
PAGE ntoskrnl.exe!ZwQueryMultipleValueKey 80653D24 7 Bytes JMP B09668A7 \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
PAGE ntoskrnl.exe!ZwRenameKey 8065416B 7 Bytes JMP B096684F \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
PAGE ntoskrnl.exe!ZwReplaceKey 8065465E 5 Bytes JMP B0966927 \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
INITc VolSnap.sys F7622BD0 4 Bytes [82, AA, 4D, 80]
INITc VolSnap.sys F7622BF8 4 Bytes [96, 7D, 4E, 80]
INITc VolSnap.sys F7622C21 3 Bytes [C4, 4D, 80] {LES ECX, DWORD [EBP-0x80]}
INITc VolSnap.sys F7622C48 4 Bytes [76, 34, 4E, 80]
INITc VolSnap.sys F7622C70 4 Bytes [E4, 14, 4E, 80]
INITc ...
init C:\WINDOWS\system32\drivers\senfilt.sys entry point in "init" section [0xB9C57F80]

---- User code sections - GMER 1.0.15 ----

.text C:\WINDOWS\system32\services.exe[728] kernel32.dll!CreateFileA 7C801A24 5 Bytes JMP 008D0000
.text C:\WINDOWS\system32\services.exe[728] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 008D0FA8
.text C:\WINDOWS\system32\services.exe[728] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 008D0FB9
.text C:\WINDOWS\system32\services.exe[728] kernel32.dll!LoadLibraryExW 7C801AF1 5 Bytes JMP 008D0087
.text C:\WINDOWS\system32\services.exe[728] kernel32.dll!LoadLibraryExA 7C801D4F 5 Bytes JMP 008D0076
.text C:\WINDOWS\system32\services.exe[728] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes JMP 008D005B
.text C:\WINDOWS\system32\services.exe[728] kernel32.dll!GetStartupInfoW 7C801E50 5 Bytes JMP 008D00D0
.text C:\WINDOWS\system32\services.exe[728] kernel32.dll!GetStartupInfoA 7C801EEE 5 Bytes JMP 008D00BF
.text C:\WINDOWS\system32\services.exe[728] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 008D0F66
.text C:\WINDOWS\system32\services.exe[728] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 008D00F5
.text C:\WINDOWS\system32\services.exe[728] kernel32.dll!GetProcAddress 7C80ADB0 5 Bytes JMP 008D0110
.text C:\WINDOWS\system32\services.exe[728] kernel32.dll!LoadLibraryW 7C80AE5B 5 Bytes JMP 008D0FD4
.text C:\WINDOWS\system32\services.exe[728] kernel32.dll!CreateFileW 7C810770 5 Bytes JMP 008D001B
.text C:\WINDOWS\system32\services.exe[728] kernel32.dll!CreatePipe 7C81E0D7 5 Bytes JMP 008D00AE
.text C:\WINDOWS\system32\services.exe[728] kernel32.dll!CreateNamedPipeW 7C82F0EF 5 Bytes JMP 008D0036
.text C:\WINDOWS\system32\services.exe[728] kernel32.dll!CreateNamedPipeA 7C85FE94 5 Bytes JMP 008D0FEF
.text C:\WINDOWS\system32\services.exe[728] kernel32.dll!WinExec 7C86158D 5 Bytes JMP 008D0F77
.text C:\WINDOWS\system32\services.exe[728] ADVAPI32.dll!RegOpenKeyExW 77DD6A8F 5 Bytes JMP 00070FD4
.text C:\WINDOWS\system32\services.exe[728] ADVAPI32.dll!RegCreateKeyExW 77DD774C 5 Bytes JMP 00070FB9
.text C:\WINDOWS\system32\services.exe[728] ADVAPI32.dll!RegOpenKeyExA 77DD7832 5 Bytes JMP 00070025
.text C:\WINDOWS\system32\services.exe[728] ADVAPI32.dll!RegOpenKeyW 77DD7926 5 Bytes JMP 00070FE5
.text C:\WINDOWS\system32\services.exe[728] ADVAPI32.dll!RegCreateKeyExA 77DDE834 5 Bytes JMP 00070076
.text C:\WINDOWS\system32\services.exe[728] ADVAPI32.dll!RegOpenKeyA 77DDEE08 5 Bytes JMP 00070000
.text C:\WINDOWS\system32\services.exe[728] ADVAPI32.dll!RegCreateKeyW 77DE45EE 5 Bytes JMP 0007005B
.text C:\WINDOWS\system32\services.exe[728] ADVAPI32.dll!RegCreateKeyA 77DE4706 5 Bytes JMP 0007004A
.text C:\WINDOWS\system32\services.exe[728] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 00060F9C
.text C:\WINDOWS\system32\services.exe[728] msvcrt.dll!system 77C293C7 5 Bytes JMP 00060FAD
.text C:\WINDOWS\system32\services.exe[728] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 00060FD2
.text C:\WINDOWS\system32\services.exe[728] msvcrt.dll!_open 77C2F566 5 Bytes JMP 00060000
.text C:\WINDOWS\system32\services.exe[728] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 00060027
.text C:\WINDOWS\system32\services.exe[728] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 00060FE3
.text C:\WINDOWS\system32\services.exe[728] WININET.dll!InternetOpenW 771BAEED 5 Bytes JMP 00050000
.text C:\WINDOWS\system32\services.exe[728] WININET.dll!InternetOpenA 771C573E 5 Bytes JMP 00050FEF
.text C:\WINDOWS\system32\services.exe[728] WININET.dll!InternetOpenUrlA 771C59F1 5 Bytes JMP 00050FCA
.text C:\WINDOWS\system32\services.exe[728] WININET.dll!InternetOpenUrlW 771D5B3A 5 Bytes JMP 00050FA3
.text C:\WINDOWS\system32\services.exe[728] WS2_32.dll!socket 71AB3B91 5 Bytes JMP 00040000
.text C:\WINDOWS\system32\lsass.exe[744] kernel32.dll!CreateFileA 7C801A24 5 Bytes JMP 00E30000
.text C:\WINDOWS\system32\lsass.exe[744] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 00E30093
.text C:\WINDOWS\system32\lsass.exe[744] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00E30F9E
.text C:\WINDOWS\system32\lsass.exe[744] kernel32.dll!LoadLibraryExW 7C801AF1 5 Bytes JMP 00E30FAF
.text C:\WINDOWS\system32\lsass.exe[744] kernel32.dll!LoadLibraryExA 7C801D4F 5 Bytes JMP 00E3006C
.text C:\WINDOWS\system32\lsass.exe[744] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes JMP 00E30040
.text C:\WINDOWS\system32\lsass.exe[744] kernel32.dll!GetStartupInfoW 7C801E50 5 Bytes JMP 00E30F83
.text C:\WINDOWS\system32\lsass.exe[744] kernel32.dll!GetStartupInfoA 7C801EEE 5 Bytes JMP 00E300BF
.text C:\WINDOWS\system32\lsass.exe[744] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 00E300E6
.text C:\WINDOWS\system32\lsass.exe[744] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00E30F4D
.text C:\WINDOWS\system32\lsass.exe[744] kernel32.dll!GetProcAddress 7C80ADB0 5 Bytes JMP 00E30101
.text C:\WINDOWS\system32\lsass.exe[744] kernel32.dll!LoadLibraryW 7C80AE5B 5 Bytes JMP 00E30051
.text C:\WINDOWS\system32\lsass.exe[744] kernel32.dll!CreateFileW 7C810770 5 Bytes JMP 00E30FE5
.text C:\WINDOWS\system32\lsass.exe[744] kernel32.dll!CreatePipe 7C81E0D7 5 Bytes JMP 00E300AE
.text C:\WINDOWS\system32\lsass.exe[744] kernel32.dll!CreateNamedPipeW 7C82F0EF 5 Bytes JMP 00E30025
.text C:\WINDOWS\system32\lsass.exe[744] kernel32.dll!CreateNamedPipeA 7C85FE94 5 Bytes JMP 00E30FD4
.text C:\WINDOWS\system32\lsass.exe[744] kernel32.dll!WinExec 7C86158D 5 Bytes JMP 00E30F72
.text C:\WINDOWS\system32\lsass.exe[744] ADVAPI32.dll!RegOpenKeyExW 77DD6A8F 5 Bytes JMP 00E20FDB
.text C:\WINDOWS\system32\lsass.exe[744] ADVAPI32.dll!RegCreateKeyExW 77DD774C 5 Bytes JMP 00E20FC0
.text C:\WINDOWS\system32\lsass.exe[744] ADVAPI32.dll!RegOpenKeyExA 77DD7832 5 Bytes JMP 00E2002C
.text C:\WINDOWS\system32\lsass.exe[744] ADVAPI32.dll!RegOpenKeyW 77DD7926 5 Bytes JMP 00E20011
.text C:\WINDOWS\system32\lsass.exe[744] ADVAPI32.dll!RegCreateKeyExA 77DDE834 5 Bytes JMP 00E2007D
.text C:\WINDOWS\system32\lsass.exe[744] ADVAPI32.dll!RegOpenKeyA 77DDEE08 5 Bytes JMP 00E20000
.text C:\WINDOWS\system32\lsass.exe[744] ADVAPI32.dll!RegCreateKeyW 77DE45EE 5 Bytes JMP 00E20062
.text C:\WINDOWS\system32\lsass.exe[744] ADVAPI32.dll!RegCreateKeyA 77DE4706 5 Bytes JMP 00E20047
.text C:\WINDOWS\system32\lsass.exe[744] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP

#5 CatByte

CatByte

    bleepin' tiger


  • Malware Response Team
  • 14,664 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Location:Canada
  • Local time:03:47 AM

Posted 28 April 2011 - 08:46 PM

Hi,

Please do the following:

Download ComboFix from one of the following locations:
Link 1
Link 2

VERY IMPORTANT !!! Save ComboFix.exe to your Desktop

* IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here
  • Double click on ComboFix.exe & follow the prompts.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

Posted Image

  • Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

Posted Image

  • Click on Yes, to continue scanning for malware.
When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.
Notes:
1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.

Microsoft MVP - 2010, 2011, 2012, 2013, 2014, 2015


#6 mertaan24

mertaan24
  • Topic Starter

  • Members
  • 13 posts
  • OFFLINE
  •  
  • Local time:01:47 AM

Posted 02 May 2011 - 04:14 PM

Combofix ran without a problem and here is the log.


ComboFix 11-05-02.03 - tfox 05/02/2011 15:56:58.1.2 - x86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.2046.1391 [GMT -5:00]
Running from: c:\documents and settings\TFox\Desktop\ComboFix.exe
AV: McAfee VirusScan *Disabled/Updated* {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}
FW: McAfee Personal Firewall *Disabled* {94894B63-8C7F-4050-BDA4-813CA00DA3E8}
* Created a new restore point
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\TFox\WINDOWS
c:\windows\system32\bszip.dll
.
.
((((((((((((((((((((((((( Files Created from 2011-04-02 to 2011-05-02 )))))))))))))))))))))))))))))))
.
.
2011-04-28 17:13 . 2011-02-03 02:40 472808 ----a-w- c:\windows\system32\deployJava1.dll
2011-04-20 22:51 . 2011-04-20 22:51 -------- d-----w- c:\documents and settings\TFox\Local Settings\Application Data\Chromium
2011-04-19 18:52 . 2011-04-19 18:52 -------- d-----w- c:\documents and settings\TFox\Application Data\SUPERAntiSpyware.com
2011-04-19 18:52 . 2011-04-19 18:52 -------- d-----w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2011-04-19 18:52 . 2011-04-19 18:52 -------- d-----w- c:\program files\SUPERAntiSpyware
2011-04-05 20:26 . 2011-04-05 20:26 -------- d-----w- c:\program files\Black Isle
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-04-19 17:52 . 2006-11-29 22:18 12464 ----a-w- c:\windows\system32\drivers\CdaD10BA.SYS
2011-02-03 00:19 . 2007-05-31 22:16 73728 ----a-w- c:\windows\system32\javacpl.cpl
.
.
((((((((((((((((((((((((((((((((((((((((((((( AWF ))))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-11-13 21:46 . 2007-11-13 21:46 135168 c:\documents and settings\All Users\Application Data\Dell\TransferAgent\bak\TransferAgent.exe
.
2005-09-14 03:32 . 2004-10-15 00:42 1404928 c:\program files\Analog Devices\Core\bak\smax4pnp.exe
.
2004-07-27 21:50 . 2004-07-27 21:50 81920 c:\program files\Common Files\InstallShield\UpdateService\bak\issch.exe
.
2004-07-27 21:50 . 2004-07-27 21:50 221184 c:\program files\Common Files\InstallShield\UpdateService\bak\ISUSPM.exe
.
2007-03-15 16:09 . 2007-03-15 16:09 460784 c:\program files\DellSupport\bak\DSAgnt.exe
.
2006-09-13 15:32 . 2006-09-13 15:32 128536 c:\program files\Intuit\QuickBooks Enterprise Solutions 5.0\bak\QBDBMgrN.exe
2009-08-18 08:25 . 2009-08-18 08:25 678912 c:\program files\Intuit\QuickBooks Enterprise Solutions 5.0\QBDBMgrN.exe
.
2007-05-31 22:16 . 2007-03-14 08:43 83608 c:\program files\Java\jre1.6.0_01\bin\bak\jusched.exe
.
2005-09-14 04:03 . 2007-08-04 04:33 582992 c:\program files\McAfee.com\Agent\bak\mcagent.exe
2005-09-14 04:03 . 2009-10-29 12:54 1218008 c:\program files\McAfee.com\Agent\mcagent.exe
.
2006-06-21 03:36 . 2006-06-21 03:36 1207080 c:\program files\Microsoft ActiveSync\bak\wcescomm.exe
.
2007-03-12 21:52 . 2006-01-19 16:06 11776 c:\program files\MUSICMATCH\Musicmatch Jukebox\bak\mimboot.exe
.
2005-09-14 03:58 . 2005-09-14 03:58 98304 c:\program files\QuickTime\bak\qttask.exe
.
2005-09-14 03:58 . 2005-09-14 03:58 26112 c:\program files\Real\RealPlayer\bak\RealPlay.exe
2009-03-05 00:28 . 2009-03-05 00:28 214536 c:\program files\Real\RealPlayer\realplay.exe
.
2007-12-18 15:04 . 2007-02-09 02:39 36904 c:\program files\SiteAdvisor\6253\bak\SiteAdv.exe
.
2004-08-11 22:00 . 2004-08-04 10:00 15360 c:\windows\system32\bak\ctfmon.exe
2004-08-11 22:00 . 2004-08-04 10:00 15360 c:\windows\system32\ctfmon.exe
.
2005-09-14 03:32 . 2005-09-20 15:32 77824 c:\windows\system32\bak\hkcmd.exe
.
2005-09-20 15:36 . 2005-09-20 15:36 114688 c:\windows\system32\bak\igfxpers.exe
.
2005-09-14 03:32 . 2005-09-20 15:35 94208 c:\windows\system32\bak\igfxtray.exe
.
2005-09-14 04:01 . 2004-12-06 06:05 127035 c:\windows\system32\dla\bak\tfswctrl.exe
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DellSupport"="c:\program files\DellSupport\DSAgnt.exe" [N/A]
"DellTransferAgent"="c:\documents and settings\All Users\Application Data\Dell\TransferAgent\TransferAgent.exe" [N/A]
"updateMgr"="c:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [N/A]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2011-03-16 2423752]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"mcagent_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2009-10-29 1218008]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-03-05 198160]
"Intuit SyncManager"="c:\program files\Common Files\Intuit\Sync\IntuitSyncManager.exe" [2010-10-19 1439496]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 10.0\Reader\Reader_sl.exe" [2011-01-30 35736]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-11-10 932288]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-10-29 249064]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Access Anywhere Agent.LNK - c:\windows\DOWNLO~1\WebEx\319\raagtx.exe [2005-11-22 16384]
QuickBooks Update Agent.lnk - c:\program files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe [2010-11-9 1154848]
QuickBooks Web Connector.lnk - c:\program files\Common Files\Intuit\QuickBooks\QBWebConnector\QBWebConnector.exe [2009-2-9 300328]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoWelcomeScreen"= 1 (0x1)
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-03 22:21 548352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.DLL
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
"DisableMonitoring"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Intuit\\QuickBooks Enterprise Solutions 5.0\\QBDBMgrN.exe"=
.
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [2/17/2010 1:25 PM 12872]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [5/10/2010 1:41 PM 67656]
R2 atnthost;AT Host Service;c:\windows\DOWNLO~1\WebEx\319\atnthost.exe [11/22/2005 6:16 PM 30720]
S2 gupdate1c99d29538bb16;Google Update Service (gupdate1c99d29538bb16);c:\program files\Google\Update\GoogleUpdate.exe [3/4/2009 7:26 PM 133104]
S2 QuickBooksDB17;QuickBooksDB17;c:\progra~1\Intuit\QUICKB~1.0\QBDBMgrN.exe -hvQuickBooksDB17 --> c:\progra~1\Intuit\QUICKB~1.0\QBDBMgrN.exe -hvQuickBooksDB17 [?]
S3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [3/4/2009 7:26 PM 133104]
.
Contents of the 'Scheduled Tasks' folder
.
2011-05-02 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-12-17 21:02]
.
2011-05-02 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-03-05 00:26]
.
2011-04-30 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-03-05 00:26]
.
2011-04-15 c:\windows\Tasks\McDefragTask.job
- c:\program files\mcafee\mqc\QcConsol.exe [2007-04-10 18:22]
.
2011-04-01 c:\windows\Tasks\McQcTask.job
- c:\program files\mcafee\mqc\QcConsol.exe [2007-04-10 18:22]
.
2011-05-02 c:\windows\Tasks\WGASetup.job
- c:\windows\system32\KB905474\wgasetup.exe [2009-05-06 03:18]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://google.com/
mStart Page = hxxp://www.dell4me.com/mywaybiz
uInternet Settings,ProxyOverride = <local>
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
Trusted Zone: musicmatch.com\online
Handler: intu-help-qb3 - {c5e479ea-0a65-4b05-8c6c-2fc8cc682eb4} - c:\program files\Intuit\QuickBooks Enterprise Solutions 5.0\HelpAsyncPluggableProtocol.dll
.
- - - - ORPHANS REMOVED - - - -
.
AddRemove-WebCyberCoach_wtrb - c:\program files\WebCyberCoach\b_Dell\WCC_Wipe.exe WebCyberCoach ext\wtrb
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-05-02 16:02
Windows 5.1.2600 Service Pack 2 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\S-1-5-21-648718457-1444169434-215325977-1156\Software\Microsoft\Windows Mobile Disc\S*a*m*s*u*n*g* *B*l*a*c*k*J*a*c*k*"!\CriticalAppInstall\ActiveSync]
"Name"="ActiveSync"
"DisplayName"="Microsoft ActiveSync"
"Param1"="ActiveSync"
"Type"="wellknown"
"Order"=dword:00000000
"State"=dword:0000000b
.
[HKEY_USERS\S-1-5-21-648718457-1444169434-215325977-1156\Software\Microsoft\Windows Mobile Disc\S*a*m*s*u*n*g* *B*l*a*c*k*J*a*c*k*"!\CriticalAppInstall\IESettings]
"Name"="IESettings"
"Type"="IESettings"
"Order"=dword:00000003
"State"=dword:0000000b
.
[HKEY_USERS\S-1-5-21-648718457-1444169434-215325977-1156\Software\Microsoft\Windows Mobile Disc\S*a*m*s*u*n*g* *B*l*a*c*k*J*a*c*k*"!\CriticalAppInstall\MediaFiles]
"Name"="MediaFiles"
"Type"="MediaFiles"
"Order"=dword:00000002
"State"=dword:0000000b
.
[HKEY_USERS\S-1-5-21-648718457-1444169434-215325977-1156\Software\Microsoft\Windows Mobile Disc\S*a*m*s*u*n*g* *B*l*a*c*k*J*a*c*k*"!\CriticalAppInstall\NPW]
"Name"="NPW"
"Param1"="NPW"
"Type"="wellknown"
"Order"=dword:00000001
"State"=dword:0000000b
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'winlogon.exe'(660)
c:\program files\SUPERAntiSpyware\SASWINLO.DLL
.
Completion time: 2011-05-02 16:04:54
ComboFix-quarantined-files.txt 2011-05-02 21:04
.
Pre-Run: 41,369,440,256 bytes free
Post-Run: 41,416,962,048 bytes free
.
WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect
.
- - End Of File - - 9AFA8DA8033CD1E507F505D26846B7F7

#7 CatByte

CatByte

    bleepin' tiger


  • Malware Response Team
  • 14,664 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Location:Canada
  • Local time:03:47 AM

Posted 02 May 2011 - 04:31 PM

Hi,

Please do the following:

Please download aswMBR ( 511KB ) to your desktop.
  • Double click the aswMBR.exe icon to run it
  • Click the Scan button to start the scan
  • On completion of the scan, click the save log button, save it to your desktop and post it in your next reply.

Microsoft MVP - 2010, 2011, 2012, 2013, 2014, 2015


#8 mertaan24

mertaan24
  • Topic Starter

  • Members
  • 13 posts
  • OFFLINE
  •  
  • Local time:01:47 AM

Posted 02 May 2011 - 05:14 PM

I have downloaded aswMBR and it completed it's scan.


aswMBR version 0.9.5.247 Copyright© 2011 AVAST Software
Run date: 2011-05-02 17:07:39
-----------------------------
17:07:39.346 OS Version: Windows 5.1.2600 Service Pack 2
17:07:39.346 Number of processors: 2 586 0x401
17:07:39.346 ComputerName: COMPUTER3 UserName: tfox
17:07:39.909 Initialize success
17:07:47.580 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3
17:07:47.580 Disk 0 Vendor: Maxtor_6Y080L0 YAR41BW0 Size: 76293MB BusType: 3
17:07:49.612 Disk 0 MBR read successfully
17:07:49.612 Disk 0 MBR scan
17:07:49.612 Disk 0 unknown MBR code
17:07:51.612 Disk 0 scanning sectors +156232125
17:07:51.643 Disk 0 scanning C:\WINDOWS\system32\drivers
17:08:05.768 Service scanning
17:08:06.737 Disk 0 trace - called modules:
17:08:06.752 ntoskrnl.exe catchme.sys CLASSPNP.SYS disk.sys atapi.sys hal.dll pciide.sys PCIIDEX.SYS
17:08:06.752 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x89b86ab8]
17:08:06.752 3 CLASSPNP.SYS[f763805b] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-3[0x89bc1b00]
17:08:06.768 Scan finished successfully
17:08:33.034 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\TFox\Desktop\MBR.dat"
17:08:33.080 The log file has been saved successfully to "C:\Documents and Settings\TFox\Desktop\aswMBR.txt"



#9 CatByte

CatByte

    bleepin' tiger


  • Malware Response Team
  • 14,664 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Location:Canada
  • Local time:03:47 AM

Posted 02 May 2011 - 06:14 PM

Hi,


Please advise how the computer is running and if there are any outstanding issues

Please do the following:



  • Please open your MalwareBytes AntiMalware Program
  • Click the Update Tab and search for updates
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select "Perform Quick Scan", then click Scan.
  • The scan may take some time to finish, so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected. <-- very important
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Extra Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  • Copy&Paste the entire report in your next reply.

Extra Note:If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer, please do so immediately.



NEXT


Go here to run an online scanner from ESET.
  • Turn off the real time scanner of any existing antivirus program while performing the online scan
  • Tick the box next to YES, I accept the Terms of Use.
  • Click Start
  • When asked, allow the activeX control to install
  • Click Start
  • Make sure that the option Remove found threats is unticked and the Scan Archives option is ticked.
  • Click on Advanced Settings, ensure the options Scan for potentially unwanted applications, Scan for potentially unsafe applications, and Enable Anti-Stealth Technology are ticked.
  • Click Scan
  • Wait for the scan to finish
  • When the scan completes, press the LIST OF THREATS FOUND button
  • Press EXPORT TO TEXT FILE , name the file ESETSCAN and save it to your desktop
  • Include the contents of this report in your next reply.
  • Press the BACK button.
  • Press Finish

Microsoft MVP - 2010, 2011, 2012, 2013, 2014, 2015


#10 mertaan24

mertaan24
  • Topic Starter

  • Members
  • 13 posts
  • OFFLINE
  •  
  • Local time:01:47 AM

Posted 02 May 2011 - 10:48 PM

Things are looking a lot better. My computer has been running for at least 10 hours without a single script error, audio ad or redirect in google search. The logs you asked for are provided below. The ESET scan showed some problems with Java and MBAM showed no problems.




Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Database version: 6495

Windows 5.1.2600 Service Pack 2
Internet Explorer 6.0.2900.2180

5/2/2011 8:52:26 PM
mbam-log-2011-05-02 (20-52-26).txt

Scan type: Quick scan
Objects scanned: 207782
Time elapsed: 21 minute(s), 37 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)


ESETSCAN:


C:\Documents and Settings\TFox\Application Data\Sun\Java\Deployment\cache\6.0\13\2213128d-22949ea7 a variant of Java/Agent.AO trojan
C:\Documents and Settings\TFox\Application Data\Sun\Java\Deployment\cache\6.0\14\2a23558e-39efeebe a variant of Java/Agent.AO trojan
C:\Documents and Settings\TFox\Application Data\Sun\Java\Deployment\cache\6.0\40\c74d828-751810ec a variant of Java/Agent.AO trojan
C:\Documents and Settings\TFox\Application Data\Sun\Java\Deployment\cache\6.0\51\7a899eb3-5dceaf78 multiple threats
C:\Documents and Settings\TFox\Application Data\Sun\Java\Deployment\cache\6.0\57\18396c39-48cdbf85 a variant of Java/TrojanDownloader.OpenStream.NBF trojan

#11 CatByte

CatByte

    bleepin' tiger


  • Malware Response Team
  • 14,664 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Location:Canada
  • Local time:03:47 AM

Posted 03 May 2011 - 06:43 PM

Please do the following:

Visit ADOBEand download the latest version of Acrobat Reader (version X)
Having the latest updates ensures there are no security vulnerabilities in your system.

NEXT

Posted Image
Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update.
  • Download the latest version of Java Runtime Environment (JRE) 25 and save it to your desktop.
  • Scroll down to where it says JDK 6 Update 25 (JDK or JRE)
  • Click the Download JRE button to the right
  • Select the Windows platform from the dropdown menu.
  • Read the License Agreement and then check the box that says: "I agree to the Java SE Runtime Environment 6u25 with JavaFX 1 License Agreement". Click on Continue. The page will refresh.
  • Click on the link to download Windows Offline Installation and save the file to your desktop.
  • Close any programs you may have running - especially your web browser.
  • Go to Start > Control Panel, double-click on Add or Remove Programs and remove all older versions of Java.
  • Check (highlight) any item with Java Runtime Environment (JRE or J2SE or Java™ 6) in the name.
  • Click the Remove or Change/Remove button.
  • Repeat as many times as necessary to remove each Java versions.
  • Reboot your computer once all Java components are removed.
  • Then from your desktop double-click on jre-6u25-windows-i586.exe to install the newest version.
  • After the install is complete, go into the Control Panel (using Classic View) and double-click the Java Icon. (looks like a coffee cup)
    • On the General tab, under Temporary Internet Files, click the Settings button.
    • Next, click on the Delete Files button
    • There are two options in the window to clear the cache - Leave BOTH Checked
      Applications and Applets
      Trace and Log Files
  • Click OK on Delete Temporary Files Window
    Note: This deletes ALL the Downloaded Applications and Applets from the CACHE.
  • Click OK to leave the Temporary Files Window
  • Click OK to leave the Java Control Panel.


NEXT


  • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below.
  • They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
Copy/paste the text inside the Codebox below into notepad:

Here's how to do that:
Click Start > Run type Notepad click OK.
This will open an empty notepad file:

Copy all the text inside of the code box - Press Ctrl+C (or right click on the highlighted section and choose 'copy')


Folder::
c:\documents and settings\All Users\Application Data\Dell\TransferAgent\bak
c:\program files\Analog Devices\Core\bak
c:\program files\Common Files\InstallShield\UpdateService\bak
c:\program files\DellSupport\bak
c:\program files\Intuit\QuickBooks Enterprise Solutions 5.0\bak
c:\program files\Java\jre1.6.0_01\bin\bak
c:\program files\McAfee.com\Agent\bak
c:\program files\Microsoft ActiveSync\bak
c:\program files\MUSICMATCH\Musicmatch Jukebox\bak
c:\program files\QuickTime\bak
c:\program files\Real\RealPlayer\bak
c:\program files\SiteAdvisor\6253\bak
c:\windows\system32\bak
c:\windows\system32\dla\bak


Now paste the copied text into the open notepad - press CTRL+V (or right click and choose 'paste')

Save this file to your desktop, Save this as "CFScript"


Here's how to do that:

1.Click File;
2.Click Save As... Change the directory to your desktop;
3.Change the Save as type to "All Files";
4.Type in the file name: CFScript
5.Click Save ...

Posted Image
  • Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
  • ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
  • When finished, it shall produce a log for you.
  • Copy and paste the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.

Microsoft MVP - 2010, 2011, 2012, 2013, 2014, 2015


#12 mertaan24

mertaan24
  • Topic Starter

  • Members
  • 13 posts
  • OFFLINE
  •  
  • Local time:01:47 AM

Posted 04 May 2011 - 10:26 AM

I have the Adobe X installed but the Java will not install saying that it is not a valid Win32 application.

#13 CatByte

CatByte

    bleepin' tiger


  • Malware Response Team
  • 14,664 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Location:Canada
  • Local time:03:47 AM

Posted 04 May 2011 - 04:47 PM

Try Javara

Please download JavaRa to your desktop and unzip it to its own folder.
  • Run JavaRa.exe, pick the language of your choice and click Select. Then click Remove Older Versions
  • Accept any prompts.
  • Open JavaRa.exe again and select Search For Updates.
  • Select Update Using Oracle Java's Website then click Search and click on the Open Webpage button.
  • Scroll down to the Java SE Runtime Environment (JRE) option.
  • Download and install the latest Java Runtime Environment (JRE) version for your computer.(version 6, update 25)

Microsoft MVP - 2010, 2011, 2012, 2013, 2014, 2015


#14 CatByte

CatByte

    bleepin' tiger


  • Malware Response Team
  • 14,664 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Location:Canada
  • Local time:03:47 AM

Posted 11 May 2011 - 04:43 PM

Due to the lack of feedback, this topic is now closed.In the event you still have problems, please send me or any Moderator a Private Message and ask them to reopen this topic within the next 5 days. Please include a link to your topic in the Private Message. Thank you.

Microsoft MVP - 2010, 2011, 2012, 2013, 2014, 2015





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users