Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Google Redirect, Random Audio Ads, FakeAlert


  • This topic is locked This topic is locked
36 replies to this topic

#1 noviceuser99

noviceuser99

  • Members
  • 22 posts
  • OFFLINE
  •  
  • Local time:04:08 AM

Posted 01 June 2011 - 01:16 PM

Hello, I was instructed by a moderator to post this in this forum for assistance. Please see DDS Log below, and I have also attached the GMR Log as well. Thank you!

.
DDS (Ver_11-05-19.01) - NTFSx86
Internet Explorer: 8.0.6001.18702
Run by BMyhre at 17:34:10 on 2011-05-31
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2932.418 [GMT -5:00]
.
.
============== Running Processes ===============
.
C:\PROGRA~1\AVG\AVG10\avgchsvx.exe
C:\WINDOWS\system32\ibmpmsvc.exe
C:\WINDOWS\system32\svchost.exe -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\Program Files\Intel\WiFi\bin\S24EvMon.exe
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\TpShocks.exe
C:\Program Files\Lenovo\HOTKEY\TPOSDSVC.exe
C:\Program Files\Lenovo\NPDIRECT\TPFNF7SP.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\Program Files\Common Files\Lenovo\Scheduler\scheduler_proxy.exe
C:\Program Files\Lenovo\HOTKEY\TPONSCR.exe
C:\PROGRA~1\THINKV~1\PrdCtr\LPMGR.exe
C:\Program Files\Lenovo\Zoom\TpScrex.exe
C:\PROGRA~1\THINKV~1\PrdCtr\LPMLCHK.exe
C:\Program Files\LENOVO\Message Center Plus\MCPLaunch.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\ThinkPad\ConnectUtilities\ACTray.exe
C:\Program Files\ThinkPad\ConnectUtilities\ACWLIcon.exe
C:\Program Files\Lenovo\Client Security Solution\cssauth.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\McAfee\Common Framework\UdaterUI.exe
C:\WINDOWS\system32\igfxext.exe
C:\Program Files\McAfee\Common Framework\McTray.exe
C:\Program Files\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe
C:\Program Files\AVG\AVG10\avgtray.exe
C:\Program Files\SalesLogix\SyncClient.exe
C:\Program Files\Meeting Center\Modules\Launcher\mcLauncher.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe
C:\Program Files\Digital Line Detect\DLG.exe
svchost.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Windows Desktop Search\WindowsSearch.exe
C:\Program Files\LENOVO\HOTKEY\TPHKSVC.exe
C:\Documents and Settings\bmyhre\Local Settings\Application Data\Autobahn\mlb-nexdef-autobahn.exe
C:\Documents and Settings\bmyhre\Local Settings\Application Data\Sage\SlxDesktopManager.exe
C:\Program Files\ThinkPad\ConnectUtilities\AcPrfMgrSvc.exe
C:\PROGRA~1\Lenovo\HOTKEY\tpnumlk.exe
C:\Program Files\SalesLogix\ServerHost.exe
C:\PROGRA~1\Lenovo\HOTKEY\tpnumlkd.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\PROGRA~1\ThinkPad\BLUETO~1\BTSTAC~1.EXE
C:\Program Files\AVG\AVG10\avgwdsvc.exe
C:\Program Files\AVG\AVG10\Identity Protection\agent\bin\avgidsmonitor.exe
C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
C:\Program Files\ThinkPad\Utilities\DOZESVC.EXE
C:\Program Files\Intel\WiFi\bin\EvtEng.exe
C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
C:\Program Files\LENOVO\HOTKEY\CAMMUTE.exe
C:\Program Files\LENOVO\HOTKEY\MICMUTE.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Intel\Intel® Management Engine Components\LMS\LMS.exe
C:\Program Files\McAfee\Common Framework\FrameworkService.exe
C:\Program Files\Microsoft SQL Server\MSSQL10_50.SALESLOGIX\MSSQL\Binn\sqlservr.exe
C:\Program Files\AVG\AVG10\avgnsx.exe
C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
C:\Program Files\Microsoft SQL Server\MSRS10_50.SALESLOGIX\Reporting Services\ReportServer\bin\ReportingServicesService.exe
C:\Program Files\SalesLogix\SLXServer.exe
C:\Program Files\SalesLogix\SLXSystem.exe
C:\Program Files\SalesLogix\SLXLoggingServer.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\Program Files\SalesLogix\SpeedSearch\Bin\SLXSearchService.exe
C:\WINDOWS\System32\snmp.exe
C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
c:\Program Files\Common Files\Lenovo\tvt_reg_monitor_svc.exe
C:\Program Files\Lenovo\Rescue and Recovery\rrpservice.exe
C:\Program Files\Lenovo\Rescue and Recovery\rrservice.exe
c:\Program Files\Common Files\Lenovo\Scheduler\tvtsched.exe
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
C:\Program Files\Intel\Intel® Management Engine Components\UNS\UNS.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\Program Files\ThinkPad\ConnectUtilities\AcSvc.exe
C:\Program Files\ThinkPad\Utilities\PWMDBSVC.EXE
c:\program files\lenovo\system update\suservice.exe
C:\Program Files\Intel\Intel® Management Engine Components\IMSS\PrivacyIconClient.exe
C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe
C:\Program Files\ThinkPad\Bluetooth Software\bin\btwdins.exe
C:\Program Files\ThinkPad\ConnectUtilities\SvcGuiHlpr.exe
C:\WINDOWS\System32\svchost.exe -k HTTPFilter
C:\PROGRA~1\AVG\AVG10\avgrsx.exe
C:\Program Files\AVG\AVG10\avgcsrvx.exe
C:\Program Files\AVG\AVG10\avgsrmax.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SCServer\SCServer.exe
C:\Program Files\Common Files\Research In Motion\RIMDeviceManager\RIMDeviceManager.exe
C:\Program Files\Common Files\Research In Motion\USB Drivers\BbDevMgr.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\AT&T\Communication Manager\ATTCM.exe
C:\Program Files\AT&T\Communication Manager\RcAppSvc.exe
C:\Program Files\AT&T\Communication Manager\bmctl.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE
C:\Program Files\AVG\AVG10\avgcsrvx.exe
C:\Program Files\Adobe\Reader 9.0\Reader\AcroRd32.exe
C:\Documents and Settings\bmyhre\Local Settings\Temporary Internet Files\Content.IE5\1CNWOMRE\Defogger[1].exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\SearchProtocolHost.exe
C:\WINDOWS\system32\SearchProtocolHost.exe
C:\Documents and Settings\bmyhre\Desktop\dds.scr
C:\WINDOWS\system32\WSCRIPT.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.google.com/ig?hl=en&source=iglk
uInternet Settings,ProxyOverride = *.local
mURLSearchHooks: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - c:\program files\avg\avg10\toolbar\IEToolbar.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg10\avgssie.dll
BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO: Search Helper: {6ebf7485-159f-4bff-a14f-b9e3aac4465b} - c:\program files\microsoft\search enhancement pack\search helper\SEPsearchhelperie.dll
BHO: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - c:\program files\avg\avg10\toolbar\IEToolbar.dll
BHO: IePasswordManagerHelper Class: {bf468356-bb7e-42d7-9f15-4f3b9bcfced2} - c:\program files\lenovo\client security solution\tvtpwm_ie_com.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: Windows Live Toolbar Helper: {e15a8dc0-8516-42a1-81ea-dc94ec1acf10} - c:\program files\windows live\toolbar\wltcore.dll
TB: &Windows Live Toolbar: {21fa44ef-376d-4d53-9b0f-8a89d3229068} - c:\program files\windows live\toolbar\wltcore.dll
TB: AVG Security Toolbar: {ccc7a320-b3ca-4199-b1a6-9f516dd69829} - c:\program files\avg\avg10\toolbar\IEToolbar.dll
uRun: [SyncClient.exe] c:\program files\saleslogix\SyncClient.exe /b"SLXREMOTE" /NOSPLASH
uRun: [MeetingLauncher] "c:\program files\meeting center\modules\launcher\mcLauncher.exe"
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
mRun: [TpShocks] TpShocks.exe
mRun: [IMSS] "c:\program files\intel\intel® management engine components\imss\PIconStartup.exe"
mRun: [TPHOTKEY] c:\program files\lenovo\hotkey\TPOSDSVC.exe
mRun: [TPFNF7] c:\program files\lenovo\npdirect\TPFNF7SP.exe /r
mRun: [SmartAudio] c:\program files\conexant\saii\SAIICpl.exe /t
mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
mRun: [Persistence] c:\windows\system32\igfxpers.exe
mRun: [TVT Scheduler Proxy] c:\program files\common files\lenovo\scheduler\scheduler_proxy.exe
mRun: [LPManager] c:\progra~1\thinkv~1\prdctr\LPMGR.exe
mRun: [LPMailChecker] c:\progra~1\thinkv~1\prdctr\LPMLCHK.exe
mRun: [Message Center Plus] c:\program files\lenovo\message center plus\MCPLaunch.exe /start
mRun: [PWRMGRTR] rundll32 c:\progra~1\thinkpad\utilit~1\PWRMGRTR.DLL,PwrMgrBkGndMonitor
mRun: [CreateLMBCShortCut] "c:\program files\lenovo\mobile broadband connect\UserShortcutCreator.exe"
mRun: [ACTray] c:\program files\thinkpad\connectutilities\ACTray.exe
mRun: [ACWLIcon] c:\program files\thinkpad\connectutilities\ACWLIcon.exe
mRun: [cssauth] "c:\program files\lenovo\client security solution\cssauth.exe" silent
mRun: [SynTPEnh] %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe
mRun: [McAfeeUpdaterUI] "c:\program files\mcafee\common framework\UdaterUI.exe" /StartedFromRunKey
mRun: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
mRun: [AT&T Communication Manager] "c:\program files\at&t\communication manager\ATTCM.exe" -a
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
mRun: [RIMBBLaunchAgent.exe] c:\program files\common files\research in motion\usb drivers\RIMBBLaunchAgent.exe
mRun: [AVG_TRAY] c:\program files\avg\avg10\avgtray.exe
mRun: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
StartupFolder: c:\docume~1\bmyhre\startm~1\programs\startup\mlbtvn~1.lnk - c:\documents and settings\bmyhre\local settings\application data\autobahn\mlb-nexdef-autobahn.exe
StartupFolder: c:\docume~1\bmyhre\startm~1\programs\startup\salesl~2.lnk - c:\documents and settings\bmyhre\local settings\application data\sage\SlxDesktopManager.exe
StartupFolder: c:\docume~1\bmyhre\startm~1\programs\startup\salesl~1.lnk - c:\program files\saleslogix\ServerHost.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\blueto~1.lnk - c:\program files\thinkpad\bluetooth software\BTTray.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\digita~1.lnk - c:\program files\digital line detect\DLG.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\logite~1.lnk - c:\program files\logitech\setpoint\SetPoint.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\vpncli~1.lnk - c:\windows\installer\{51fb15f4-ad27-43bc-ad4b-dd0354fb6bbd}\Icon3E5562ED7.ico
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\window~1.lnk - c:\program files\windows desktop search\WindowsSearch.exe
IE: E&xport to Microsoft Excel - c:\progra~1\mi1933~1\office12\EXCEL.EXE/3000
IE: Send to &Bluetooth Device... - c:\program files\thinkpad\bluetooth software\btsendto_ie_ctx.htm
IE: Send To Bluetooth - c:\program files\thinkpad\bluetooth software\btsendto_ie.htm
IE: {09C04DA7-5B76-4EBC-BBEE-B25EAC5965F5}
IE: {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\program files\thinkpad\bluetooth software\btsendto_ie.htm
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\mi1933~1\office12\REFIEBAR.DLL
IE: {F4F55DC8-0B69-4DFE-BA94-CB677B88B2A3} - {F4F55DC8-0B69-4DFE-BA94-CB677B88B2A3} - c:\program files\lenovo\client security solution\tvtpwm_ie_com.dll
LSP: bmnet.dll
Trusted Zone: eitsd
Trusted Zone: eitservicedesk
Trusted Zone: go2uti.com
Trusted Zone: go2uti.com\gdfran1.global.corp
Trusted Zone: go2uti.com\ritdcn1.eu.corp
Trusted Zone: sinmpy01
Trusted Zone: sinmpy03
Trusted Zone: sinmpy04
Trusted Zone: sinmpy05
Trusted Zone: sinmpy06
Trusted Zone: uslaxy7
Trusted Zone: eitsd
Trusted Zone: eitservicedesk
Trusted Zone: go2uti.com
Trusted Zone: go2uti.com\gdfran1.global.corp
Trusted Zone: go2uti.com\ritdcn1.eu.corp
Trusted Zone: sinmpy01
Trusted Zone: sinmpy03
Trusted Zone: sinmpy04
Trusted Zone: sinmpy05
Trusted Zone: sinmpy06
Trusted Zone: uslaxy7
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Handler: avgsecuritytoolbar - {F2DDE6B2-9684-4A55-86D4-E255E237B77C} - c:\program files\avg\avg10\toolbar\IEToolbar.dll
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg10\avgpp.dll
Notify: igfxcui - igfxdev.dll
Notify: LBTWlgn - c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll
SEH: Windows Desktop Search Namespace Manager: {56f9679e-7826-4c84-81f3-532071a8bcc5} - c:\program files\windows desktop search\MSNLNamespaceMgr.dll
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\documents and settings\bmyhre\application data\mozilla\firefox\profiles\sx29ed60.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/
FF - prefs.js: network.proxy.type - 0
FF - component: c:\documents and settings\bmyhre\application data\mozilla\firefox\profiles\sx29ed60.default\extensions\{76903721-3e54-41df-98cc-86c24d2fe8e7}\lib\ff36\sagegears.dll
FF - component: c:\program files\avg\avg10\firefox4\components\avgssff4.dll
FF - component: c:\program files\avg\avg10\toolbar\firefox\avg@igeared\components\IGeared_tavgp_xputils3.dll
FF - component: c:\program files\avg\avg10\toolbar\firefox\avg@igeared\components\IGeared_tavgp_xputils35.dll
FF - component: c:\program files\avg\avg10\toolbar\firefox\avg@igeared\components\xpavgtbapi.dll
FF - plugin: c:\documents and settings\bmyhre\local settings\application data\unity\webplayer\loader\npUnity3D32.dll
FF - plugin: c:\program files\common files\research in motion\bbwebsllauncher\NPWebSLLauncher.dll
FF - plugin: c:\program files\meeting center\modules\firefox\plugins\npMCInstall.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npdeployJava1.dll
FF - plugin: c:\program files\windows live\photo gallery\NPWLPG.dll
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\DotNetAssistantExtension
FF - Ext: Genesys Meeting Center: meetinglauncher@iconf.net - c:\program files\meeting center\modules\Firefox
FF - Ext: AVG Safe Search: {1E73965B-8B48-48be-9C8D-68B920ABC1C4} - c:\program files\avg\avg10\Firefox4
FF - Ext: AVG Security Toolbar em:version=7.004.022.004 em:displayname=AVG Security Toolbar em:iconURL=chrome://tavgp/skin/logo.ico em:creator=AVG Technologies em:description=AVG Security Toolbar em:homepageURL=http://www.avg.com >: avg@igeared - c:\program files\avg\avg10\toolbar\firefox\avg@igeared
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
FF - Ext: Sage SalesLogix Desktop Integration Module: {76903721-3E54-41DF-98CC-86C24D2FE8E7} - %profile%\extensions\{76903721-3E54-41DF-98CC-86C24D2FE8E7}
.
---- FIREFOX POLICIES ----
FF - user.js: general.useragent.extra.brc -
.
============= SERVICES / DRIVERS ===============
.
R0 AVGIDSEH;AVGIDSEH;c:\windows\system32\drivers\AVGIDSEH.sys [2011-2-22 22992]
R0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\drivers\avgrkx86.sys [2011-3-16 32592]
R0 DozeHDD;DozeHDD;c:\windows\system32\drivers\DOZEHDD.SYS [2010-5-7 24304]
R0 stmtpm;STM TPM Service;c:\windows\system32\drivers\stm_tpm.sys [2010-5-7 21504]
R0 TPDIGIMN;TPDIGIMN;c:\windows\system32\drivers\ApsHM86.sys [2009-10-9 20520]
R1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\drivers\avgldx86.sys [2011-1-7 248656]
R1 Avgmfx86;AVG Mini-Filter Resident Anti-Virus Shield;c:\windows\system32\drivers\avgmfx86.sys [2011-3-1 34896]
R1 Avgtdix;AVG TDI Driver;c:\windows\system32\drivers\avgtdix.sys [2011-4-5 297168]
R1 lenovo.smi;Lenovo System Interface Driver;c:\windows\system32\drivers\smiif32.sys [2009-11-27 13480]
R2 AVGIDSAgent;AVGIDSAgent;c:\program files\avg\avg10\identity protection\agent\bin\AVGIDSAgent.exe [2011-4-18 7398752]
R2 avgwd;AVG WatchDog;c:\program files\avg\avg10\avgwdsvc.exe [2011-2-8 269520]
R2 DozeSvc;Lenovo Doze Mode Service;c:\program files\thinkpad\utilities\DOZESVC.EXE [2010-5-7 132456]
R2 LBeepKE;LBeepKE;c:\windows\system32\drivers\LBeepKE.sys [2010-12-1 10384]
R2 LENOVO.CAMMUTE;Lenovo Camera Mute;c:\program files\lenovo\hotkey\cammute.exe [2009-11-27 54632]
R2 LENOVO.MICMUTE;Lenovo Microphone Mute;c:\program files\lenovo\hotkey\micmute.exe [2009-11-27 44984]
R2 McAfeeFramework;McAfee Framework Service;c:\program files\mcafee\common framework\FrameworkService.exe [2010-5-7 104000]
R2 MSSQL$SALESLOGIX;SQL Server (SALESLOGIX);c:\program files\microsoft sql server\mssql10_50.saleslogix\mssql\binn\sqlservr.exe [2010-4-3 42884448]
R2 Power Manager DBC Service;Power Manager DBC Service;c:\program files\thinkpad\utilities\PWMDBSVC.exe [2010-5-7 53248]
R2 regi;regi;c:\windows\system32\drivers\regi.sys [2007-4-17 11032]
R2 ReportServer$SALESLOGIX;SQL Server Reporting Services (SALESLOGIX);c:\program files\microsoft sql server\msrs10_50.saleslogix\reporting services\reportserver\bin\ReportingServicesService.exe [2010-4-3 1177952]
R2 rimspci;rimspci;c:\windows\system32\drivers\rimspe86.sys [2010-5-7 45056]
R2 SalesLogix Server Service;SalesLogix Server;c:\program files\saleslogix\SLXServer.exe [2010-8-10 734552]
R2 SalesLogix System;SalesLogix System Service;c:\program files\saleslogix\SLXSystem.exe [2010-8-10 390488]
R2 SlxSearch;SalesLogix SpeedSearch;c:\program files\saleslogix\speedsearch\bin\SLXSearchService.exe [2008-9-13 977752]
R2 TPHKSVC;On Screen Display;c:\program files\lenovo\hotkey\TPHKSVC.exe [2009-11-27 62904]
R2 TVT Backup Protection Service;TVT Backup Protection Service;c:\program files\lenovo\rescue and recovery\rrpservice.exe [2008-11-24 520192]
R2 UNS;Intel® Management & Security Application User Notification Service;c:\program files\intel\intel® management engine components\uns\UNS.exe [2010-5-7 2320920]
R3 ATTRcAppSvc;AT&T RcAppSvc;c:\program files\at&t\communication manager\RcAppSvc.exe [2010-9-2 121416]
R3 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\drivers\AVGIDSDriver.sys [2011-4-14 134480]
R3 AVGIDSFilter;AVGIDSFilter;c:\windows\system32\drivers\AVGIDSFilter.sys [2011-2-10 24144]
R3 AVGIDSShim;AVGIDSShim;c:\windows\system32\drivers\AVGIDSShim.sys [2011-2-10 27216]
R3 e1kexpress;Intel® PRO/1000 PCI Express Network Connection Driver K;c:\windows\system32\drivers\e1k5132.sys [2010-5-7 166568]
R3 Impcd;Impcd;c:\windows\system32\drivers\Impcd.sys [2010-5-7 125696]
R3 IntcDAud;Intel® Display Audio;c:\windows\system32\drivers\IntcDAud.sys [2010-5-7 205824]
R3 TVTI2C;Lenovo SM bus driver;c:\windows\system32\drivers\tvti2c.sys [2009-10-8 38336]
S2 TVT_UpdateMonitor;TVT Windows Update Monitor;c:\program files\lenovo\rescue and recovery\UpdateMonitor.exe [2008-5-9 360448]
S3 AVG Security Toolbar Service;AVG Security Toolbar Service;c:\program files\avg\avg10\toolbar\ToolbarBroker.exe [2011-5-24 984392]
S3 LEqdUsb;Logitech SetPoint Unifying KMDF USB Filter;c:\windows\system32\drivers\LEqdUsb.sys [2009-6-17 40720]
S3 LHidEqd;Logitech SetPoint Unifying KMDF HID Filter;c:\windows\system32\drivers\LHidEqd.sys [2009-6-17 10384]
S3 vsdatant;vsdatant;c:\windows\system32\vsdatant.sys [2007-11-14 394952]
S3 WinRM;Windows Remote Management (WS-Management);c:\windows\system32\svchost.exe -k WINRM [2008-7-21 14336]
S4 MSSQLFDLauncher$SALESLOGIX;SQL Full-text Filter Daemon Launcher (SALESLOGIX);c:\program files\microsoft sql server\mssql10_50.saleslogix\mssql\binn\fdlauncher.exe [2010-4-3 28512]
S4 MSSQLServerADHelper100;SQL Active Directory Helper Service;c:\program files\microsoft sql server\100\shared\sqladhlp.exe [2010-4-3 44896]
S4 RsFx0150;RsFx0150 Driver;c:\windows\system32\drivers\RsFx0150.sys [2010-4-3 240608]
S4 SQLAgent$SALESLOGIX;SQL Server Agent (SALESLOGIX);c:\program files\microsoft sql server\mssql10_50.saleslogix\mssql\binn\SQLAGENT.EXE [2010-4-3 367456]
.
=============== Created Last 30 ================
.
2011-05-24 19:26:57 388096 ----a-r- c:\documents and settings\bmyhre\application data\microsoft\installer\{45a66726-69bc-466b-a7a4-12fcba4883d7}\HiJackThis.exe
2011-05-24 19:26:56 -------- d-----w- c:\program files\Trend Micro
2011-05-24 19:14:41 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-05-24 19:14:38 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2011-05-24 18:52:34 -------- d--h--w- C:\$AVG
2011-05-24 18:13:39 -------- d-----w- c:\documents and settings\bmyhre\local settings\application data\AVG Security Toolbar
2011-05-24 18:11:07 -------- d-----w- c:\documents and settings\all users\application data\AVG Security Toolbar
2011-05-24 18:10:25 -------- d-----w- c:\windows\system32\drivers\AVG
2011-05-24 15:33:21 -------- d-sha-r- C:\cmdcons
2011-05-24 15:28:57 98816 ----a-w- c:\windows\sed.exe
2011-05-24 15:28:57 89088 ----a-w- c:\windows\MBR.exe
2011-05-24 15:28:57 256512 ----a-w- c:\windows\PEV.exe
2011-05-24 15:28:57 161792 ----a-w- c:\windows\SWREG.exe
2011-05-24 02:55:29 -------- d-----w- c:\documents and settings\bmyhre\application data\AVG10
2011-05-24 02:54:26 -------- d-----w- c:\documents and settings\all users\application data\Common Files
2011-05-24 02:53:19 -------- d-----w- c:\documents and settings\all users\application data\AVG10
2011-05-24 02:52:35 -------- d-----w- c:\program files\AVG
2011-05-24 02:46:50 -------- d-----w- c:\documents and settings\all users\application data\MFAData
2011-05-24 01:46:03 -------- d-----w- c:\documents and settings\bmyhre\application data\Malwarebytes
2011-05-24 01:45:56 -------- d-----w- c:\documents and settings\all users\application data\Malwarebytes
2011-05-23 21:50:20 -------- d-----w- c:\documents and settings\all users\application data\CA-SupportBridge
2011-05-23 18:30:26 -------- d-----w- C:\Quarantine
.
==================== Find3M ====================
.
2011-04-15 02:28:42 134480 ----a-w- c:\windows\system32\drivers\AVGIDSDriver.sys
2011-04-05 05:59:56 297168 ----a-w- c:\windows\system32\drivers\avgtdix.sys
2011-03-16 21:03:20 32592 ----a-w- c:\windows\system32\drivers\avgrkx86.sys
.
============= FINISH: 17:35:05.07 ===============

BC AdBot (Login to Remove)

 


#2 CatByte

CatByte

    bleepin' tiger


  • Malware Response Team
  • 14,664 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Location:Canada
  • Local time:05:08 AM

Posted 02 June 2011 - 07:49 PM

Please run the following

Please download aswMBR ( 511KB ) to your desktop.
  • Double click the aswMBR.exe icon to run it
  • Click the Scan button to start the scan
  • On completion of the scan, click the save log button, save it to your desktop and post it in your next reply.

Microsoft MVP - 2010, 2011, 2012, 2013, 2014, 2015


#3 noviceuser99

noviceuser99
  • Topic Starter

  • Members
  • 22 posts
  • OFFLINE
  •  
  • Local time:04:08 AM

Posted 02 June 2011 - 08:13 PM

Thank you! Log below.

aswMBR version 0.9.5.256 Copyright© 2011 AVAST Software
Run date: 2011-06-02 20:11:35
-----------------------------
20:11:35.750 OS Version: Windows 5.1.2600 Service Pack 3
20:11:35.750 Number of processors: 4 586 0x2505
20:11:35.750 ComputerName: USMSPL011 UserName: BMyhre
20:11:39.203 Initialize success
20:11:49.781 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1
20:11:49.781 Disk 0 Vendor: HITACHI_ PC3Z Size: 305245MB BusType: 3
20:11:49.812 Disk 0 MBR read successfully
20:11:49.812 Disk 0 MBR scan
20:11:49.812 Disk 0 unknown MBR code
20:11:49.843 Disk 0 scanning sectors +625136400
20:11:49.921 Disk 0 scanning C:\WINDOWS\system32\drivers
20:12:07.718 Service scanning
20:12:08.828 Disk 0 trace - called modules:
20:12:08.843 ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll >>UNKNOWN [0x8928f1ed]<<
20:12:08.859 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x8ad75030]
20:12:08.859 3 CLASSPNP.SYS[ba108fd7] -> nt!IofCallDriver -> \Device\0000009a[0x8ad62920]
20:12:08.859 5 ACPI.sys[b9f7f620] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-1[0x8ad76028]
20:12:08.859 \Driver\iaStor[0x8ad7c750] -> IRP_MJ_INTERNAL_DEVICE_CONTROL -> 0x8928f1ed
20:12:08.859 Scan finished successfully
20:12:40.515 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\bmyhre\Desktop\MBR.dat"
20:12:40.531 The log file has been saved successfully to "C:\Documents and Settings\bmyhre\Desktop\aswMBR log.txt"

#4 CatByte

CatByte

    bleepin' tiger


  • Malware Response Team
  • 14,664 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Location:Canada
  • Local time:05:08 AM

Posted 02 June 2011 - 08:18 PM

Hi,

Please do the following:


Please download TDSSKiller.zip
  • Extract it to your desktop
  • Double click TDSSKiller.exe
  • Press Start Scan
    • Only if Malicious objects are found then ensure Cure is selected
    • Then click Continue > Reboot now
  • Copy and paste the log in your next reply
    • A copy of the log will be saved automatically to the root of the drive (typically C:\)



NEXT



Download ComboFix from one of the following locations:
Link 1
Link 2

VERY IMPORTANT !!! Save ComboFix.exe to your Desktop

* IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here
  • Double click on ComboFix.exe & follow the prompts.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

Posted Image

  • Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

Posted Image

  • Click on Yes, to continue scanning for malware.
When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.
Notes:
1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.

Microsoft MVP - 2010, 2011, 2012, 2013, 2014, 2015


#5 noviceuser99

noviceuser99
  • Topic Starter

  • Members
  • 22 posts
  • OFFLINE
  •  
  • Local time:04:08 AM

Posted 03 June 2011 - 08:29 AM

I followed your instructions, and the TDS Killer doesn't seem to run. After extracting the files, I double clicked on it, and nothing happened. Please assist.

#6 CatByte

CatByte

    bleepin' tiger


  • Malware Response Team
  • 14,664 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Location:Canada
  • Local time:05:08 AM

Posted 03 June 2011 - 04:41 PM

move on to ComboFix, but when you are saving it > rename it to iexplore before saving it to the desktop,

if it wont run in normal mode > boot into safe mode to run it.

To Enter Safemode
  • Go to Start> Shut off your Computer> Restart
  • As the computer starts to boot-up, Tap the F8 KEY repeatedly,
  • this will bring up a menu.
  • Use the Up and Down Arrow Keys to scroll up to Safemode
  • Then press the Enter Key on your Keyboard
  • go into your usual account

Microsoft MVP - 2010, 2011, 2012, 2013, 2014, 2015


#7 noviceuser99

noviceuser99
  • Topic Starter

  • Members
  • 22 posts
  • OFFLINE
  •  
  • Local time:04:08 AM

Posted 03 June 2011 - 06:27 PM

Thanks again. Please see the log below. FYI- Combofix did ask me to unistall AVG in order for it to run. I thought I had it turned off, but apparently not. So, I did uninstall it before running combofix.

ComboFix 11-06-04.02 - BMyhre 06/03/2011 18:19:12.2.4 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2932.1948 [GMT -5:00]
Running from: c:\documents and settings\bmyhre\My Documents\Downloads\ComboFix.exe
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\bmyhre\Start Menu\Programs\Windows XP Recovery
c:\documents and settings\bmyhre\Start Menu\Programs\Windows XP Recovery\Uninstall Windows XP Recovery.lnk
c:\documents and settings\bmyhre\Start Menu\Programs\Windows XP Recovery\Windows XP Recovery.lnk
.
c:\windows\system32\Drivers\Volsnap.sys . . . is infected!!
.
.
((((((((((((((((((((((((( Files Created from 2011-05-03 to 2011-06-03 )))))))))))))))))))))))))))))))
.
.
2011-05-28 18:53 . 2011-05-28 18:53 -------- d-----w- c:\windows\system32\config\systemprofile\Application Data\Xerox
2011-05-24 19:26 . 2011-05-24 19:26 388096 ----a-r- c:\documents and settings\bmyhre\Application Data\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2011-05-24 19:26 . 2011-05-24 19:26 -------- d-----w- c:\program files\Trend Micro
2011-05-24 19:14 . 2010-12-20 23:09 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-05-24 19:14 . 2011-05-24 19:14 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2011-05-24 18:13 . 2011-05-24 18:13 -------- d-----w- c:\documents and settings\bmyhre\Local Settings\Application Data\AVG Security Toolbar
2011-05-24 02:55 . 2011-05-24 02:55 -------- d-----w- c:\documents and settings\bmyhre\Application Data\AVG10
2011-05-24 02:54 . 2011-05-24 02:54 -------- d-----w- c:\documents and settings\All Users\Application Data\Common Files
2011-05-24 02:53 . 2011-06-03 22:58 -------- d-----w- c:\documents and settings\All Users\Application Data\AVG10
2011-05-24 02:52 . 2011-05-24 02:52 -------- d-----w- c:\program files\AVG
2011-05-24 02:46 . 2011-06-03 22:43 -------- d-----w- c:\documents and settings\All Users\Application Data\MFAData
2011-05-24 01:46 . 2011-05-24 01:46 -------- d-----w- c:\documents and settings\bmyhre\Application Data\Malwarebytes
2011-05-24 01:45 . 2011-05-24 01:45 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2011-05-23 21:50 . 2011-05-23 22:33 -------- d-----w- c:\documents and settings\All Users\Application Data\CA-SupportBridge
2011-05-23 20:10 . 2011-05-23 20:10 -------- d-sh--w- c:\documents and settings\Administrator\PrivacIE
2011-05-23 20:10 . 2011-05-23 20:10 -------- d-sh--w- c:\documents and settings\Administrator\IETldCache
2011-05-23 18:30 . 2011-05-24 01:28 -------- d-----w- C:\Quarantine
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-04-15 14:38 . 2011-04-15 14:38 45056 ----a-r- c:\documents and settings\bmyhre\Application Data\Microsoft\Installer\{EC375336-05E7-4E45-B804-15A6928E66CE}\ARPPRODUCTICON.exe
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SyncClient.exe"="c:\program files\SalesLogix\SyncClient.exe" [2010-08-10 6936920]
"MeetingLauncher"="c:\program files\Meeting Center\Modules\Launcher\mcLauncher.exe" [2011-03-01 509328]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TpShocks"="TpShocks.exe" [2009-11-28 337256]
"IMSS"="c:\program files\Intel\Intel® Management Engine Components\IMSS\PIconStartup.exe" [2009-10-01 111640]
"TPHOTKEY"="c:\program files\Lenovo\HOTKEY\TPOSDSVC.exe" [2009-11-17 69568]
"TPFNF7"="c:\program files\Lenovo\NPDIRECT\TPFNF7SP.exe" [2009-11-29 62312]
"SmartAudio"="c:\program files\CONEXANT\SAII\SAIICpl.exe" [2009-07-16 307768]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-11-13 139600]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-11-13 173592]
"Persistence"="c:\windows\system32\igfxpers.exe" [2009-11-13 144920]
"TVT Scheduler Proxy"="c:\program files\Common Files\Lenovo\Scheduler\scheduler_proxy.exe" [2008-11-24 487424]
"LPManager"="c:\progra~1\THINKV~1\PrdCtr\LPMGR.exe" [2009-07-22 185688]
"LPMailChecker"="c:\progra~1\THINKV~1\PrdCtr\LPMLCHK.exe" [2009-07-22 124248]
"Message Center Plus"="c:\program files\LENOVO\Message Center Plus\MCPLaunch.exe" [2009-05-28 49976]
"PWRMGRTR"="c:\progra~1\ThinkPad\UTILIT~1\PWRMGRTR.DLL" [2009-11-26 497000]
"CreateLMBCShortCut"="c:\program files\Lenovo\Mobile Broadband Connect\UserShortcutCreator.exe" [2009-11-10 40960]
"ACTray"="c:\program files\ThinkPad\ConnectUtilities\ACTray.exe" [2009-11-27 431464]
"ACWLIcon"="c:\program files\ThinkPad\ConnectUtilities\ACWLIcon.exe" [2009-11-27 181608]
"cssauth"="c:\program files\Lenovo\Client Security Solution\cssauth.exe" [2009-11-27 3081528]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2009-11-12 1594664]
"McAfeeUpdaterUI"="c:\program files\McAfee\Common Framework\UdaterUI.exe" [2007-03-27 136768]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2009-06-17 55824]
"AT&T Communication Manager"="c:\program files\AT&T\Communication Manager\ATTCM.exe" [2010-09-02 883272]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2011-01-31 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-21 932288]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2010-11-29 421888]
"RIMBBLaunchAgent.exe"="c:\program files\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe" [2011-02-18 79192]
.
c:\documents and settings\bmyhre\Start Menu\Programs\Startup\
MLB.TV NexDef Plug-in.lnk - c:\documents and settings\bmyhre\Local Settings\Application Data\Autobahn\mlb-nexdef-autobahn.exe [2011-3-16 15502336]
SalesLogix Desktop Manager.lnk - c:\documents and settings\bmyhre\Local Settings\Application Data\Sage\SlxDesktopManager.exe [2011-2-22 539648]
SalesLogix Web Server.lnk - c:\program files\SalesLogix\ServerHost.exe [2010-8-10 737112]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Bluetooth.lnk - c:\program files\ThinkPad\Bluetooth Software\BTTray.exe [2009-8-14 607584]
Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2010-5-7 50688]
Logitech SetPoint.lnk - c:\program files\Logitech\SetPoint\SetPoint.exe [2010-12-1 813584]
VPN Client.lnk - c:\windows\Installer\{51FB15F4-AD27-43BC-AD4B-DD0354FB6BBD}\Icon3E5562ED7.ico [2010-5-7 6144]
Windows Search.lnk - c:\program files\Windows Desktop Search\WindowsSearch.exe [2008-5-27 123904]
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-25 304128]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
2009-07-20 20:28 72208 ----a-w- c:\program files\Common Files\Logishrd\Bluetooth\LBTWLgn.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-803202442-2430849016-2014793278-40187\Scripts\Logoff\0\0]
"Script"=\\corp.go2uti.com\NETLOGON\OADeployment\checkLAXOAclient.bat
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-803202442-2430849016-2014793278-40187\Scripts\Logoff\1\0]
"Script"=\\corp.go2uti.com\netlogon\checkoaclient.bat
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-803202442-2430849016-2014793278-40187\Scripts\Logon\0\0]
"Script"=\\corp.go2uti.com\netlogon\oadeployment\checkLAXOAclient.bat
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-803202442-2430849016-2014793278-40187\Scripts\Logon\1\0]
"Script"=\\corp.go2uti.com\netlogon\checkoaclient.bat
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
@=""
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\McAfee\\Common Framework\\FrameworkService.exe"=
"c:\\Program Files\\SalesLogix\\ServerHost.exe"=
"c:\\Program Files\\Research In Motion\\BlackBerry Desktop\\Rim.Desktop.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5985:TCP"= 5985:TCP:*:Disabled:Windows Remote Management
.
R0 DozeHDD;DozeHDD;c:\windows\system32\drivers\DOZEHDD.SYS [5/7/2010 4:32 PM 24304]
R0 stmtpm;STM TPM Service;c:\windows\system32\drivers\stm_tpm.sys [5/7/2010 4:18 PM 21504]
R0 TPDIGIMN;TPDIGIMN;c:\windows\system32\drivers\ApsHM86.sys [10/9/2009 2:10 PM 20520]
R1 lenovo.smi;Lenovo System Interface Driver;c:\windows\system32\drivers\smiif32.sys [11/27/2009 5:14 AM 13480]
R2 DozeSvc;Lenovo Doze Mode Service;c:\program files\ThinkPad\Utilities\DOZESVC.EXE [5/7/2010 4:32 PM 132456]
R2 LBeepKE;LBeepKE;c:\windows\system32\drivers\LBeepKE.sys [12/1/2010 3:44 PM 10384]
R2 LENOVO.CAMMUTE;Lenovo Camera Mute;c:\program files\Lenovo\HOTKEY\cammute.exe [11/27/2009 5:14 AM 54632]
R2 LENOVO.MICMUTE;Lenovo Microphone Mute;c:\program files\Lenovo\HOTKEY\micmute.exe [11/27/2009 5:14 AM 44984]
R2 MSSQL$SALESLOGIX;SQL Server (SALESLOGIX);c:\program files\Microsoft SQL Server\MSSQL10_50.SALESLOGIX\MSSQL\Binn\sqlservr.exe [4/3/2010 2:56 PM 42884448]
R2 Power Manager DBC Service;Power Manager DBC Service;c:\program files\ThinkPad\Utilities\PWMDBSVC.exe [5/7/2010 4:32 PM 53248]
R2 regi;regi;c:\windows\system32\drivers\regi.sys [4/17/2007 10:09 PM 11032]
R2 ReportServer$SALESLOGIX;SQL Server Reporting Services (SALESLOGIX);c:\program files\Microsoft SQL Server\MSRS10_50.SALESLOGIX\Reporting Services\ReportServer\bin\ReportingServicesService.exe [4/3/2010 12:56 PM 1177952]
R2 rimspci;rimspci;c:\windows\system32\drivers\rimspe86.sys [5/7/2010 4:05 PM 45056]
R2 SalesLogix Server Service;SalesLogix Server;c:\program files\SalesLogix\SLXServer.exe [8/10/2010 8:53 AM 734552]
R2 SalesLogix System;SalesLogix System Service;c:\program files\SalesLogix\SLXSystem.exe [8/10/2010 8:53 AM 390488]
R2 SlxSearch;SalesLogix SpeedSearch;c:\program files\SalesLogix\SpeedSearch\Bin\SLXSearchService.exe [9/13/2008 8:50 AM 977752]
R2 TPHKSVC;On Screen Display;c:\program files\Lenovo\HOTKEY\TPHKSVC.exe [11/27/2009 5:14 AM 62904]
R2 TVT Backup Protection Service;TVT Backup Protection Service;c:\program files\Lenovo\Rescue and Recovery\rrpservice.exe [11/24/2008 5:34 PM 520192]
R2 UNS;Intel® Management & Security Application User Notification Service;c:\program files\Intel\Intel® Management Engine Components\UNS\UNS.exe [5/7/2010 4:19 PM 2320920]
R3 e1kexpress;Intel® PRO/1000 PCI Express Network Connection Driver K;c:\windows\system32\drivers\e1k5132.sys [5/7/2010 4:04 PM 166568]
R3 Impcd;Impcd;c:\windows\system32\drivers\Impcd.sys [5/7/2010 4:20 PM 125696]
R3 IntcDAud;Intel® Display Audio;c:\windows\system32\drivers\IntcDAud.sys [5/7/2010 4:20 PM 205824]
R3 LEqdUsb;Logitech SetPoint Unifying KMDF USB Filter;c:\windows\system32\drivers\LEqdUsb.sys [6/17/2009 11:55 AM 40720]
R3 LHidEqd;Logitech SetPoint Unifying KMDF HID Filter;c:\windows\system32\drivers\LHidEqd.sys [6/17/2009 11:55 AM 10384]
R3 TVTI2C;Lenovo SM bus driver;c:\windows\system32\drivers\tvti2c.sys [10/8/2009 9:52 PM 38336]
S2 TVT_UpdateMonitor;TVT Windows Update Monitor;c:\program files\Lenovo\Rescue and Recovery\UpdateMonitor.exe [5/9/2008 7:50 PM 360448]
S3 ATTRcAppSvc;AT&T RcAppSvc;c:\program files\AT&T\Communication Manager\RcAppSvc.exe [9/2/2010 7:01 PM 121416]
S3 WinRM;Windows Remote Management (WS-Management);c:\windows\system32\svchost.exe -k WINRM [7/21/2008 5:50 PM 14336]
S4 MSSQLFDLauncher$SALESLOGIX;SQL Full-text Filter Daemon Launcher (SALESLOGIX);c:\program files\Microsoft SQL Server\MSSQL10_50.SALESLOGIX\MSSQL\Binn\fdlauncher.exe [4/3/2010 12:56 PM 28512]
S4 MSSQLServerADHelper100;SQL Active Directory Helper Service;c:\program files\Microsoft SQL Server\100\Shared\sqladhlp.exe [4/3/2010 2:56 PM 44896]
S4 RsFx0150;RsFx0150 Driver;c:\windows\system32\drivers\RsFx0150.sys [4/3/2010 12:02 PM 240608]
S4 SQLAgent$SALESLOGIX;SQL Server Agent (SALESLOGIX);c:\program files\Microsoft SQL Server\MSSQL10_50.SALESLOGIX\MSSQL\Binn\SQLAGENT.EXE [4/3/2010 2:56 PM 367456]
.
--- Other Services/Drivers In Memory ---
.
*Deregistered* - BMLoad
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
WINRM REG_MULTI_SZ WINRM
.
Contents of the 'Scheduled Tasks' folder
.
2011-06-02 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2009-10-22 17:50]
.
2011-04-09 c:\windows\Tasks\PCDoctorBackgroundMonitorTask.job
- c:\program files\PCDR5\pcdr5cuiw32.exe [2009-10-06 21:55]
.
2011-06-03 c:\windows\Tasks\PMTask.job
- c:\progra~1\ThinkPad\UTILIT~1\PWMIDTSK.EXE [2010-05-07 16:10]
.
2011-06-03 c:\windows\Tasks\User_Feed_Synchronization-{D9C34F72-B95B-4C05-8796-84AD13655402}.job
- c:\windows\system32\msfeedssync.exe [2007-08-14 11:31]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/ig?hl=en&source=iglk
uInternet Settings,ProxyOverride = *.local
IE: E&xport to Microsoft Excel - c:\progra~1\MI1933~1\Office12\EXCEL.EXE/3000
IE: Send to &Bluetooth Device... - c:\program files\ThinkPad\Bluetooth Software\btsendto_ie_ctx.htm
IE: Send To Bluetooth - c:\program files\ThinkPad\Bluetooth Software\btsendto_ie.htm
LSP: bmnet.dll
Trusted Zone: eitsd
Trusted Zone: eitservicedesk
Trusted Zone: go2uti.com
Trusted Zone: go2uti.com\gdfran1.global.corp
Trusted Zone: go2uti.com\ritdcn1.eu.corp
Trusted Zone: sinmpy01
Trusted Zone: sinmpy03
Trusted Zone: sinmpy04
Trusted Zone: sinmpy05
Trusted Zone: sinmpy06
Trusted Zone: uslaxy7
Trusted Zone: eitsd
Trusted Zone: eitservicedesk
Trusted Zone: go2uti.com
Trusted Zone: go2uti.com\gdfran1.global.corp
Trusted Zone: go2uti.com\ritdcn1.eu.corp
Trusted Zone: sinmpy01
Trusted Zone: sinmpy03
Trusted Zone: sinmpy04
Trusted Zone: sinmpy05
Trusted Zone: sinmpy06
Trusted Zone: uslaxy7
TCP: DhcpNameServer = 192.168.0.1
FF - ProfilePath - c:\documents and settings\bmyhre\Application Data\Mozilla\Firefox\Profiles\sx29ed60.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/
FF - prefs.js: network.proxy.type - 0
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF - Ext: Genesys Meeting Center: meetinglauncher@iconf.net - c:\program files\Meeting Center\Modules\Firefox
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
FF - Ext: Sage SalesLogix Desktop Integration Module: {76903721-3E54-41DF-98CC-86C24D2FE8E7} - %profile%\extensions\{76903721-3E54-41DF-98CC-86C24D2FE8E7}
FF - user.js: general.useragent.extra.brc -
.
- - - - ORPHANS REMOVED - - - -
.
Toolbar-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
WebBrowser-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-06-03 18:23
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'winlogon.exe'(1576)
c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll
c:\program files\common files\logishrd\bluetooth\LBTServ.dll
.
- - - - - - - > 'lsass.exe'(1632)
c:\windows\system32\bmnet.dll
.
Completion time: 2011-06-03 18:24:15
ComboFix-quarantined-files.txt 2011-06-03 23:24
ComboFix2.txt 2011-05-24 16:10
.
Pre-Run: 274,319,228,928 bytes free
Post-Run: 274,379,452,416 bytes free
.
- - End Of File - - E99E4E8436686D2EF76636D4BBB5F450

#8 CatByte

CatByte

    bleepin' tiger


  • Malware Response Team
  • 14,664 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Location:Canada
  • Local time:05:08 AM

Posted 03 June 2011 - 07:05 PM

we need to see if we can find a replacement for volsnap.sys as it is infected

please do the following:

Please download SystemLook from one of the links below and save it to your Desktop.
Download Mirror #1
Download Mirror #2

  • Double-click SystemLook.exe to run it.
  • Copy the content of the following codebox into the main textfield:

    :filefind
    *volsnap*
    
  • Click the Look button to start the scan.
  • When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.
Note: The log can also be found on your Desktop entitled SystemLook.txt

Microsoft MVP - 2010, 2011, 2012, 2013, 2014, 2015


#9 noviceuser99

noviceuser99
  • Topic Starter

  • Members
  • 22 posts
  • OFFLINE
  •  
  • Local time:04:08 AM

Posted 04 June 2011 - 01:36 PM

As always, thank you again. Please see log below.

SystemLook 04.09.10 by jpshortstuff
Log created at 13:34 on 04/06/2011 by BMyhre
Administrator - Elevation successful

========== filefind ==========

Searching for "*volsnap*"
C:\I386\VOLSNAP.IN_ ------- 698 bytes [22:45 21/07/2008] [12:00 14/04/2008] 03FF8C24B69C1FC99663DF3908FBEBA4
C:\I386\VOLSNAP.SY_ ------- 25386 bytes [22:45 21/07/2008] [12:00 14/04/2008] 64409F40C23B1395594B71E4EB54E019
C:\WINDOWS\inf\volsnap.inf ------- 1095 bytes [22:50 21/07/2008] [12:00 14/04/2008] 1C43F4D998567C9D2463E18669F33A3C
C:\WINDOWS\inf\volsnap.PNF --a---- 4964 bytes [21:17 06/12/2010] [21:17 06/12/2010] 2CC2F45CBC80EC480625EA8367C07FFD
C:\WINDOWS\system32\drivers\volsnap.sys ------- 52352 bytes [22:50 21/07/2008] [12:00 14/04/2008] D41D8CD98F00B204E9800998ECF8427E

-= EOF =-

#10 CatByte

CatByte

    bleepin' tiger


  • Malware Response Team
  • 14,664 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Location:Canada
  • Local time:05:08 AM

Posted 04 June 2011 - 02:11 PM

Hi

Please do the following:

Go to Start > Run type cmd into the open run box and hit enter.

This will open the command prompt window.

Now type in the following red text exactly as seen at the command prompt.

expand C:\I386\VOLSNAP.SY_ C:\volsnap.sys

(take note of the spaces, especially the space between .SY_ and C:\ - it needs to be there)

Please let me know that the command executed properly - you should see something like "expanded to {xxxxxx} bytes, {xx}% increase"

(if you did not get this message do not continue but report back with the error message)

If you received verification the files expanded successfully please do the following:


Re run ComboFix - allow it to update if it requests to do so

(Note: the folder name is I386 - which is a capital i - not a lowercase L)

Edited by CatByte, 04 June 2011 - 02:12 PM.

Microsoft MVP - 2010, 2011, 2012, 2013, 2014, 2015


#11 noviceuser99

noviceuser99
  • Topic Starter

  • Members
  • 22 posts
  • OFFLINE
  •  
  • Local time:04:08 AM

Posted 04 June 2011 - 04:15 PM

Thanks again. The command did execute properly and said there was a 106% increase. Please see the combofix log below.

ComboFix 11-06-04.02 - BMyhre 06/04/2011 16:09:01.3.4 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2932.2025 [GMT -5:00]
Running from: c:\documents and settings\bmyhre\My Documents\Downloads\ComboFix.exe
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\system32\Drivers\Volsnap.sys . . . is infected!!
.
.
((((((((((((((((((((((((( Files Created from 2011-05-04 to 2011-06-04 )))))))))))))))))))))))))))))))
.
.
2011-06-04 21:04 . 2008-04-14 05:11 52352 ----a-w- C:\volsnap.sys
2011-05-28 18:53 . 2011-05-28 18:53 -------- d-----w- c:\windows\system32\config\systemprofile\Application Data\Xerox
2011-05-24 19:26 . 2011-05-24 19:26 388096 ----a-r- c:\documents and settings\bmyhre\Application Data\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2011-05-24 19:26 . 2011-05-24 19:26 -------- d-----w- c:\program files\Trend Micro
2011-05-24 19:14 . 2010-12-20 23:09 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-05-24 19:14 . 2011-05-24 19:14 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2011-05-24 18:13 . 2011-05-24 18:13 -------- d-----w- c:\documents and settings\bmyhre\Local Settings\Application Data\AVG Security Toolbar
2011-05-24 02:55 . 2011-05-24 02:55 -------- d-----w- c:\documents and settings\bmyhre\Application Data\AVG10
2011-05-24 02:54 . 2011-05-24 02:54 -------- d-----w- c:\documents and settings\All Users\Application Data\Common Files
2011-05-24 02:53 . 2011-06-03 22:58 -------- d-----w- c:\documents and settings\All Users\Application Data\AVG10
2011-05-24 02:52 . 2011-05-24 02:52 -------- d-----w- c:\program files\AVG
2011-05-24 02:46 . 2011-06-03 22:43 -------- d-----w- c:\documents and settings\All Users\Application Data\MFAData
2011-05-24 01:46 . 2011-05-24 01:46 -------- d-----w- c:\documents and settings\bmyhre\Application Data\Malwarebytes
2011-05-24 01:45 . 2011-05-24 01:45 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2011-05-23 21:50 . 2011-05-23 22:33 -------- d-----w- c:\documents and settings\All Users\Application Data\CA-SupportBridge
2011-05-23 20:10 . 2011-05-23 20:10 -------- d-sh--w- c:\documents and settings\Administrator\PrivacIE
2011-05-23 20:10 . 2011-05-23 20:10 -------- d-sh--w- c:\documents and settings\Administrator\IETldCache
2011-05-23 18:30 . 2011-05-24 01:28 -------- d-----w- C:\Quarantine
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-04-15 14:38 . 2011-04-15 14:38 45056 ----a-r- c:\documents and settings\bmyhre\Application Data\Microsoft\Installer\{EC375336-05E7-4E45-B804-15A6928E66CE}\ARPPRODUCTICON.exe
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SyncClient.exe"="c:\program files\SalesLogix\SyncClient.exe" [2010-08-10 6936920]
"MeetingLauncher"="c:\program files\Meeting Center\Modules\Launcher\mcLauncher.exe" [2011-03-01 509328]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TpShocks"="TpShocks.exe" [2009-11-28 337256]
"IMSS"="c:\program files\Intel\Intel® Management Engine Components\IMSS\PIconStartup.exe" [2009-10-01 111640]
"TPHOTKEY"="c:\program files\Lenovo\HOTKEY\TPOSDSVC.exe" [2009-11-17 69568]
"TPFNF7"="c:\program files\Lenovo\NPDIRECT\TPFNF7SP.exe" [2009-11-29 62312]
"SmartAudio"="c:\program files\CONEXANT\SAII\SAIICpl.exe" [2009-07-16 307768]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-11-13 139600]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-11-13 173592]
"Persistence"="c:\windows\system32\igfxpers.exe" [2009-11-13 144920]
"TVT Scheduler Proxy"="c:\program files\Common Files\Lenovo\Scheduler\scheduler_proxy.exe" [2008-11-24 487424]
"LPManager"="c:\progra~1\THINKV~1\PrdCtr\LPMGR.exe" [2009-07-22 185688]
"LPMailChecker"="c:\progra~1\THINKV~1\PrdCtr\LPMLCHK.exe" [2009-07-22 124248]
"Message Center Plus"="c:\program files\LENOVO\Message Center Plus\MCPLaunch.exe" [2009-05-28 49976]
"PWRMGRTR"="c:\progra~1\ThinkPad\UTILIT~1\PWRMGRTR.DLL" [2009-11-26 497000]
"CreateLMBCShortCut"="c:\program files\Lenovo\Mobile Broadband Connect\UserShortcutCreator.exe" [2009-11-10 40960]
"ACTray"="c:\program files\ThinkPad\ConnectUtilities\ACTray.exe" [2009-11-27 431464]
"ACWLIcon"="c:\program files\ThinkPad\ConnectUtilities\ACWLIcon.exe" [2009-11-27 181608]
"cssauth"="c:\program files\Lenovo\Client Security Solution\cssauth.exe" [2009-11-27 3081528]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2009-11-12 1594664]
"McAfeeUpdaterUI"="c:\program files\McAfee\Common Framework\UdaterUI.exe" [2007-03-27 136768]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2009-06-17 55824]
"AT&T Communication Manager"="c:\program files\AT&T\Communication Manager\ATTCM.exe" [2010-09-02 883272]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2011-01-31 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-21 932288]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2010-11-29 421888]
"RIMBBLaunchAgent.exe"="c:\program files\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe" [2011-02-18 79192]
.
c:\documents and settings\bmyhre\Start Menu\Programs\Startup\
MLB.TV NexDef Plug-in.lnk - c:\documents and settings\bmyhre\Local Settings\Application Data\Autobahn\mlb-nexdef-autobahn.exe [2011-3-16 15502336]
SalesLogix Desktop Manager.lnk - c:\documents and settings\bmyhre\Local Settings\Application Data\Sage\SlxDesktopManager.exe [2011-2-22 539648]
SalesLogix Web Server.lnk - c:\program files\SalesLogix\ServerHost.exe [2010-8-10 737112]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Bluetooth.lnk - c:\program files\ThinkPad\Bluetooth Software\BTTray.exe [2009-8-14 607584]
Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2010-5-7 50688]
Logitech SetPoint.lnk - c:\program files\Logitech\SetPoint\SetPoint.exe [2010-12-1 813584]
VPN Client.lnk - c:\windows\Installer\{51FB15F4-AD27-43BC-AD4B-DD0354FB6BBD}\Icon3E5562ED7.ico [2010-5-7 6144]
Windows Search.lnk - c:\program files\Windows Desktop Search\WindowsSearch.exe [2008-5-27 123904]
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-25 304128]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
2009-07-20 20:28 72208 ----a-w- c:\program files\Common Files\Logishrd\Bluetooth\LBTWLgn.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-803202442-2430849016-2014793278-40187\Scripts\Logoff\0\0]
"Script"=\\corp.go2uti.com\NETLOGON\OADeployment\checkLAXOAclient.bat
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-803202442-2430849016-2014793278-40187\Scripts\Logoff\1\0]
"Script"=\\corp.go2uti.com\netlogon\checkoaclient.bat
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-803202442-2430849016-2014793278-40187\Scripts\Logon\0\0]
"Script"=\\corp.go2uti.com\netlogon\oadeployment\checkLAXOAclient.bat
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-803202442-2430849016-2014793278-40187\Scripts\Logon\1\0]
"Script"=\\corp.go2uti.com\netlogon\checkoaclient.bat
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
@=""
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\McAfee\\Common Framework\\FrameworkService.exe"=
"c:\\Program Files\\SalesLogix\\ServerHost.exe"=
"c:\\Program Files\\Research In Motion\\BlackBerry Desktop\\Rim.Desktop.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5985:TCP"= 5985:TCP:*:Disabled:Windows Remote Management
.
R0 DozeHDD;DozeHDD;c:\windows\system32\drivers\DOZEHDD.SYS [5/7/2010 4:32 PM 24304]
R0 stmtpm;STM TPM Service;c:\windows\system32\drivers\stm_tpm.sys [5/7/2010 4:18 PM 21504]
R0 TPDIGIMN;TPDIGIMN;c:\windows\system32\drivers\ApsHM86.sys [10/9/2009 2:10 PM 20520]
R1 lenovo.smi;Lenovo System Interface Driver;c:\windows\system32\drivers\smiif32.sys [11/27/2009 5:14 AM 13480]
R2 DozeSvc;Lenovo Doze Mode Service;c:\program files\ThinkPad\Utilities\DOZESVC.EXE [5/7/2010 4:32 PM 132456]
R2 LBeepKE;LBeepKE;c:\windows\system32\drivers\LBeepKE.sys [12/1/2010 3:44 PM 10384]
R2 LENOVO.CAMMUTE;Lenovo Camera Mute;c:\program files\Lenovo\HOTKEY\cammute.exe [11/27/2009 5:14 AM 54632]
R2 LENOVO.MICMUTE;Lenovo Microphone Mute;c:\program files\Lenovo\HOTKEY\micmute.exe [11/27/2009 5:14 AM 44984]
R2 MSSQL$SALESLOGIX;SQL Server (SALESLOGIX);c:\program files\Microsoft SQL Server\MSSQL10_50.SALESLOGIX\MSSQL\Binn\sqlservr.exe [4/3/2010 2:56 PM 42884448]
R2 Power Manager DBC Service;Power Manager DBC Service;c:\program files\ThinkPad\Utilities\PWMDBSVC.exe [5/7/2010 4:32 PM 53248]
R2 regi;regi;c:\windows\system32\drivers\regi.sys [4/17/2007 10:09 PM 11032]
R2 ReportServer$SALESLOGIX;SQL Server Reporting Services (SALESLOGIX);c:\program files\Microsoft SQL Server\MSRS10_50.SALESLOGIX\Reporting Services\ReportServer\bin\ReportingServicesService.exe [4/3/2010 12:56 PM 1177952]
R2 rimspci;rimspci;c:\windows\system32\drivers\rimspe86.sys [5/7/2010 4:05 PM 45056]
R2 SalesLogix Server Service;SalesLogix Server;c:\program files\SalesLogix\SLXServer.exe [8/10/2010 8:53 AM 734552]
R2 SalesLogix System;SalesLogix System Service;c:\program files\SalesLogix\SLXSystem.exe [8/10/2010 8:53 AM 390488]
R2 SlxSearch;SalesLogix SpeedSearch;c:\program files\SalesLogix\SpeedSearch\Bin\SLXSearchService.exe [9/13/2008 8:50 AM 977752]
R2 TPHKSVC;On Screen Display;c:\program files\Lenovo\HOTKEY\TPHKSVC.exe [11/27/2009 5:14 AM 62904]
R2 TVT Backup Protection Service;TVT Backup Protection Service;c:\program files\Lenovo\Rescue and Recovery\rrpservice.exe [11/24/2008 5:34 PM 520192]
R2 UNS;Intel® Management & Security Application User Notification Service;c:\program files\Intel\Intel® Management Engine Components\UNS\UNS.exe [5/7/2010 4:19 PM 2320920]
R3 e1kexpress;Intel® PRO/1000 PCI Express Network Connection Driver K;c:\windows\system32\drivers\e1k5132.sys [5/7/2010 4:04 PM 166568]
R3 Impcd;Impcd;c:\windows\system32\drivers\Impcd.sys [5/7/2010 4:20 PM 125696]
R3 IntcDAud;Intel® Display Audio;c:\windows\system32\drivers\IntcDAud.sys [5/7/2010 4:20 PM 205824]
R3 LEqdUsb;Logitech SetPoint Unifying KMDF USB Filter;c:\windows\system32\drivers\LEqdUsb.sys [6/17/2009 11:55 AM 40720]
R3 LHidEqd;Logitech SetPoint Unifying KMDF HID Filter;c:\windows\system32\drivers\LHidEqd.sys [6/17/2009 11:55 AM 10384]
R3 TVTI2C;Lenovo SM bus driver;c:\windows\system32\drivers\tvti2c.sys [10/8/2009 9:52 PM 38336]
S2 TVT_UpdateMonitor;TVT Windows Update Monitor;c:\program files\Lenovo\Rescue and Recovery\UpdateMonitor.exe [5/9/2008 7:50 PM 360448]
S3 ATTRcAppSvc;AT&T RcAppSvc;c:\program files\AT&T\Communication Manager\RcAppSvc.exe [9/2/2010 7:01 PM 121416]
S3 WinRM;Windows Remote Management (WS-Management);c:\windows\system32\svchost.exe -k WINRM [7/21/2008 5:50 PM 14336]
S4 MSSQLFDLauncher$SALESLOGIX;SQL Full-text Filter Daemon Launcher (SALESLOGIX);c:\program files\Microsoft SQL Server\MSSQL10_50.SALESLOGIX\MSSQL\Binn\fdlauncher.exe [4/3/2010 12:56 PM 28512]
S4 MSSQLServerADHelper100;SQL Active Directory Helper Service;c:\program files\Microsoft SQL Server\100\Shared\sqladhlp.exe [4/3/2010 2:56 PM 44896]
S4 RsFx0150;RsFx0150 Driver;c:\windows\system32\drivers\RsFx0150.sys [4/3/2010 12:02 PM 240608]
S4 SQLAgent$SALESLOGIX;SQL Server Agent (SALESLOGIX);c:\program files\Microsoft SQL Server\MSSQL10_50.SALESLOGIX\MSSQL\Binn\SQLAGENT.EXE [4/3/2010 2:56 PM 367456]
.
--- Other Services/Drivers In Memory ---
.
*Deregistered* - BMLoad
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
WINRM REG_MULTI_SZ WINRM
.
Contents of the 'Scheduled Tasks' folder
.
2011-06-02 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2009-10-22 17:50]
.
2011-04-09 c:\windows\Tasks\PCDoctorBackgroundMonitorTask.job
- c:\program files\PCDR5\pcdr5cuiw32.exe [2009-10-06 21:55]
.
2011-06-03 c:\windows\Tasks\PMTask.job
- c:\progra~1\ThinkPad\UTILIT~1\PWMIDTSK.EXE [2010-05-07 16:10]
.
2011-06-04 c:\windows\Tasks\User_Feed_Synchronization-{D9C34F72-B95B-4C05-8796-84AD13655402}.job
- c:\windows\system32\msfeedssync.exe [2007-08-14 11:31]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/ig?hl=en&source=iglk
uInternet Settings,ProxyOverride = *.local
IE: E&xport to Microsoft Excel - c:\progra~1\MI1933~1\Office12\EXCEL.EXE/3000
IE: Send to &Bluetooth Device... - c:\program files\ThinkPad\Bluetooth Software\btsendto_ie_ctx.htm
IE: Send To Bluetooth - c:\program files\ThinkPad\Bluetooth Software\btsendto_ie.htm
LSP: bmnet.dll
Trusted Zone: eitsd
Trusted Zone: eitservicedesk
Trusted Zone: go2uti.com
Trusted Zone: go2uti.com\gdfran1.global.corp
Trusted Zone: go2uti.com\ritdcn1.eu.corp
Trusted Zone: sinmpy01
Trusted Zone: sinmpy03
Trusted Zone: sinmpy04
Trusted Zone: sinmpy05
Trusted Zone: sinmpy06
Trusted Zone: uslaxy7
Trusted Zone: eitsd
Trusted Zone: eitservicedesk
Trusted Zone: go2uti.com
Trusted Zone: go2uti.com\gdfran1.global.corp
Trusted Zone: go2uti.com\ritdcn1.eu.corp
Trusted Zone: sinmpy01
Trusted Zone: sinmpy03
Trusted Zone: sinmpy04
Trusted Zone: sinmpy05
Trusted Zone: sinmpy06
Trusted Zone: uslaxy7
TCP: DhcpNameServer = 192.168.0.1
FF - ProfilePath - c:\documents and settings\bmyhre\Application Data\Mozilla\Firefox\Profiles\sx29ed60.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/
FF - prefs.js: network.proxy.type - 0
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF - Ext: Genesys Meeting Center: meetinglauncher@iconf.net - c:\program files\Meeting Center\Modules\Firefox
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
FF - Ext: Sage SalesLogix Desktop Integration Module: {76903721-3E54-41DF-98CC-86C24D2FE8E7} - %profile%\extensions\{76903721-3E54-41DF-98CC-86C24D2FE8E7}
FF - user.js: general.useragent.extra.brc -
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-06-04 16:11
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'winlogon.exe'(1576)
c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll
c:\program files\common files\logishrd\bluetooth\LBTServ.dll
.
- - - - - - - > 'lsass.exe'(1632)
c:\windows\system32\bmnet.dll
.
- - - - - - - > 'explorer.exe'(6860)
c:\windows\system32\WININET.dll
c:\program files\Logitech\SetPoint\lgscroll.dll
c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989\MSVCR80.dll
c:\windows\system32\btmmhook.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\msi.dll
c:\windows\system32\webcheck.dll
.
Completion time: 2011-06-04 16:12:34
ComboFix-quarantined-files.txt 2011-06-04 21:12
ComboFix2.txt 2011-06-03 23:24
ComboFix3.txt 2011-05-24 16:10
.
Pre-Run: 274,365,198,336 bytes free
Post-Run: 274,373,955,584 bytes free
.
- - End Of File - - 4498E2416318F24F642A77857763F494

#12 CatByte

CatByte

    bleepin' tiger


  • Malware Response Team
  • 14,664 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Location:Canada
  • Local time:05:08 AM

Posted 04 June 2011 - 05:51 PM

Hi

It didn't replace the infected volsnap with the one we just expanded, so let's try TDSSKiller, if that doesn't do it, then we'll have to replace it in the Recovery Console.

Please do the following:

Please download TDSSKiller.zip
  • Extract it to your desktop
  • Double click TDSSKiller.exe
  • Press Start Scan
    • Only if Malicious objects are found then ensure Cure is selected
    • Then click Continue > Reboot now
  • Copy and paste the log in your next reply
    • A copy of the log will be saved automatically to the root of the drive (typically C:\)

Microsoft MVP - 2010, 2011, 2012, 2013, 2014, 2015


#13 noviceuser99

noviceuser99
  • Topic Starter

  • Members
  • 22 posts
  • OFFLINE
  •  
  • Local time:04:08 AM

Posted 04 June 2011 - 07:36 PM

Thank you. Again, it will not allow me to run TDS, even if I rename it. I tried it 5 times, and no go.

#14 CatByte

CatByte

    bleepin' tiger


  • Malware Response Team
  • 14,664 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Location:Canada
  • Local time:05:08 AM

Posted 04 June 2011 - 07:42 PM

OK, then we need to use the recovery console


Please do the following:

1. Reboot your computer and as Windows starts it will present you with your startup options for exactly two seconds - you'll have to be quick - which in your case will be Microsoft Windows XP Professional and Microsoft Windows Recovery Console

2. With the arrows keys on your keyboard select the option listed as Microsoft Windows Recovery Console and press the enter key on your keyboard.

If it passes by too quickly, restart the machine again, and press F8. Once you're at the Advanced Boot Menu Options screen, select "Return to OS Choices", then choose Recovery Console from the next screen.

3. The Recovery Console will start and ask you which Windows installation you would like to log on to. If you have multiple Windows installations, it will list each one, and you would enter the number associated with the installation you would like to work on and press enter. If you have just one Windows installation, type 1 and press enter.

4. It will then prompt you for the Administrator's password. If there is no password, simply press enter. Otherwise type in the password and then press enter.

5. You should now be presented with a C:\Windows> prompt

At that prompt, type in the following bolded text:

cd system32\drivers

Press Enter (you should now be at C:\windows\system32\drivers> prompt)

ren volsnap.sys volsnap.old

Press Enter -

Note - If you receive a message similar to 'invalid parameter or bad command, ensure you have a space between ren and volsnap.sys and another space between volsnap.sys and volsnap.old


Next, type in the following bolded text:

copy C:\volsnap.sys c:\windows\system32\drivers\volsnap.sys

Press Enter

You should see a message '1 file copied'. If you did not see that message, try again and ensure there is a space after the word copy and another space between the file paths.

If you did see '1 file copied', type in exit, press Enter, and the system will reboot.

now rerun ComboFix and try TDSSKiller as well, it should now run.

Microsoft MVP - 2010, 2011, 2012, 2013, 2014, 2015


#15 noviceuser99

noviceuser99
  • Topic Starter

  • Members
  • 22 posts
  • OFFLINE
  •  
  • Local time:04:08 AM

Posted 05 June 2011 - 01:35 PM

Thanks again. When I go into Windows recovery, all it does is show a black screen with a blinking cursor in the upper left hand corner. It doesn't even allow me to type a thing....




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users