Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Google redirects, popups, defender.exe, ovo.exe, BusinessSearchToolbar, LOTS of others


  • This topic is locked This topic is locked
14 replies to this topic

#1 bigpinkears

bigpinkears

  • Members
  • 17 posts
  • OFFLINE
  •  
  • Local time:12:51 AM

Posted 05 August 2011 - 01:15 AM

O.S.:
XP Home (SP3), 2002

Browsers:
Firefox 3.6.18
I.E. 6

Security stuff:
Malwarebytes (free version)
Avira Antivir (free version)
Hijackthis 1.99.0001

I need some help. :-(


Browsers freeze, trojans, and Google redirect problems. I use firefox, mainly. But when using either IE or Firefox, I almost always get redirected when clicking on a link. Shopcirca, Find-answers-fast, stuff that sounds like that. Also popups, even though I have popup blocker on. I also frequently hear that little two-note piano sound that plays on Windows OS when the system asks you a question (are you sure you want to perform this action?), but I never get a visual to go with it. Just the noise in the background.

Checked firefox, and it is set for 'no proxy'. Homepage is set to google. Looked at hijack this scan, and found a bad entry and deleted it. Was infected with defender.exe and ovo.exe, but deleted them and did some other stuff. Looks like that one is gone, but I can't be sure. Malwarebytes showed a buttload of infection and said it cleared them (quarantine). Stuff keeps comeing back though, redirect keeps happening, popups keep happening, and my antivirus (Avira) still keeps sending me messages about this or that pest trying to get access to my system. And just a couple of hours ago, I deleted horribly infected TEMP folder (the one in Windows folder). Shift + delete. Also found businesssearchtoolbar, or something like that and I think I successfully deleted it. Not sure. :(

Also, plugin-container.exe seemed to be slowing my system. Taskmanager said the thing was running at 98% at times. I read some stuff on internet, went off half-cocked, and deleted it. oops. But firefox never gave me trouble before I started seeing this exe in the running processes. Well, it didn't make things any better, it made them worse I think. Probably why browsers are freezing on me now. I know what it is and what Mozilla says about it, but that process was really causing a problem. I would download a copy of it, but I can't find one.

It's a laptop. Inside isn't dirty, not overheating, and I have a minimum amount of crap installed. (Except for infections, I suppose). Clearing cache doesn't seem to help.

Anyways, if someone could help me, I would be grateful. Thanks.

I didn't change anything on my system just prior to running DDS and GMER, and haven't changed anything since. DDS log:


.
DDS (Ver_2011-06-23.01) - NTFSx86
Internet Explorer: 6.0.2900.5512 BrowserJavaVersion: 1.6.0_26
Run by anonymous at 23:36:55 on 2011-08-04
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.2039.1110 [GMT -5:00]
.
AV: AntiVir Desktop *Enabled/Outdated* {AD166499-45F9-482A-A743-FDD3350758C7}
.
============== Running Processes ===============
.
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
svchost.exe
svchost.exe
C:\WINDOWS\System32\WLTRYSVC.EXE
C:\WINDOWS\System32\bcmwltry.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\WINDOWS\system32\basfipm.exe
svchost.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\WLTRAY.exe
C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
.
============== Pseudo HJT Report ===============
.
uStart Page = about:blank
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: DivX Plus Web Player HTML5 <video>: {326e768d-4182-46fd-9c16-1449a49795f4} - c:\program files\divx\divx plus web player\ie\divxhtml5\DivXHTML5.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
mRun: [igfxtray] c:\windows\system32\igfxtray.exe
mRun: [igfxhkcmd] c:\windows\system32\hkcmd.exe
mRun: [Broadcom Wireless Manager UI] c:\windows\system32\WLTRAY.exe
mRun: [IntelZeroConfig] "c:\program files\intel\wireless\bin\ZCfgSvc.exe"
mRun: [IntelWireless] "c:\program files\intel\wireless\bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
mRun: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
mRun: [avgnt] "c:\program files\avira\antivir desktop\avgnt.exe" /min
dRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
dRun: [970923359] c:\documents and settings\networkservice\local settings\application data\lju.exe
dRun: [Dbasinuyozewaha] rundll32.exe "c:\windows\mscntl.dll",Startup
dRun: [1098782260] c:\documents and settings\networkservice\local settings\application data\rmm.exe
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
TCP: DhcpNameServer = 208.180.42.68 208.180.42.100
TCP: Interfaces\{8BC3B03B-B4E5-4D92-825B-01367FDDB0F7} : DhcpNameServer = 208.180.42.68 208.180.42.100
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\documents and settings\anonymous\application data\mozilla\firefox\profiles\ky76goi6.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com
FF - prefs.js: network.proxy.http - 127.0.0.1
FF - prefs.js: network.proxy.http_port - 54808
FF - prefs.js: network.proxy.type - 0
FF - plugin: c:\program files\divx\divx ovs helper\npovshelper.dll
FF - plugin: c:\program files\divx\divx plus web player\npdivx32.dll
FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}
FF - Ext: DivX Plus Web Player HTML5 &lt;video&gt;: {23fcfd51-4958-4f00-80a3-ae97e717ed8b} - c:\program files\divx\divx plus web player\firefox\DivXHTML5
FF - Ext: Java Quick Starter: jqs@sun.com - c:\program files\java\jre6\lib\deploy\jqs\ff
.
---- FIREFOX POLICIES ----
FF - user.js: network.cookie.cookieBehavior - 0
FF - user.js: privacy.clearOnShutdown.cookies - false
FF - user.js: security.warn_viewing_mixed - false
FF - user.js: security.warn_viewing_mixed.show_once - false
FF - user.js: security.warn_submit_insecure - false
FF - user.js: security.warn_submit_insecure.show_once - false
.
============= SERVICES / DRIVERS ===============
.
R1 avgio;avgio;c:\program files\avira\antivir desktop\avgio.sys [2011-7-6 11608]
R2 AntiVirService;Avira AntiVir Guard;c:\program files\avira\antivir desktop\avguard.exe [2011-7-6 269480]
R2 avgntflt;avgntflt;c:\windows\system32\drivers\avgntflt.sys [2011-7-6 66616]
R3 GTIPCI21;GTIPCI21;c:\windows\system32\drivers\gtipci21.sys [2009-6-25 88192]
S4 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\avira\antivir desktop\sched.exe [2011-7-6 136360]
S4 wscsvc32;Security Center ;c:\windows\system32\msvcirt32.exe --> c:\windows\system32\msvcirt32.exe [?]
.
=============== File Associations ===============
.
exefile="c:\documents and settings\networkservice\local settings\application data\ovo.exe" -a "%1" %*
.
=============== Created Last 30 ================
.
2011-08-05 00:16:07 73728 ----a-w- c:\windows\system32\javacpl.cpl
2011-08-05 00:16:07 476904 ----a-w- c:\program files\mozilla firefox\plugins\npdeployJava1.dll
2011-08-05 00:16:07 472808 ----a-w- c:\windows\system32\deployJava1.dll
2011-08-05 00:14:03 909600 ----a-w- c:\program files\mozilla firefox\jre-6u26-windows-i586-iftw.exe
2011-08-04 01:56:04 -------- d-----w- c:\documents and settings\all users\application data\pD00000BgPnD00000
2011-08-03 02:34:38 -------- d-----w- c:\documents and settings\anonymous\local settings\application data\Help
2011-08-03 00:11:44 -------- d-----w- c:\documents and settings\anonymous\application data\Malwarebytes
2011-08-03 00:11:38 41272 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-08-03 00:11:37 -------- d-----w- c:\documents and settings\all users\application data\Malwarebytes
2011-08-03 00:11:34 22712 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-08-03 00:11:34 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2011-08-03 00:10:05 9466208 ----a-w- c:\program files\mozilla firefox\mbam-setup-1.51.1.1800.exe
2011-08-01 16:51:47 25856 -c--a-w- c:\windows\system32\dllcache\usbprint.sys
2011-08-01 16:51:47 25856 ----a-w- c:\windows\system32\drivers\usbprint.sys
2011-08-01 16:51:03 32128 -c--a-w- c:\windows\system32\dllcache\usbccgp.sys
2011-08-01 16:51:03 32128 ----a-w- c:\windows\system32\drivers\usbccgp.sys
2011-07-29 23:07:35 -------- d-----w- c:\documents and settings\all users\application data\cC10513OhNdL10513
2011-07-29 23:06:48 -------- d-----w- C:\Adobe
2011-07-29 04:39:02 -------- d-----w- c:\program files\Solveig Multimedia
2011-07-29 04:39:02 -------- d-----w- c:\program files\common files\Solveig Multimedia
2011-07-29 04:37:28 5851084 ----a-w- c:\program files\mozilla firefox\SolveigMM_AVI_Trimmer_2_0_1106_20_Beta.exe
2011-07-29 04:31:15 -------- d-----w- c:\program files\Pando Networks
2011-07-29 04:30:35 2110336 ----a-w- c:\program files\mozilla firefox\VideoSpin_2_0_Setup-pdlm.exe
2011-07-29 03:50:39 344064 ----a-w- c:\windows\system32\msvcr70.dll
2011-07-29 03:50:39 -------- d-----w- c:\program files\common files\DVDVideoSoft
2011-07-29 03:49:12 -------- d-----w- c:\documents and settings\anonymous\application data\GetRightToGo
2011-07-28 07:55:55 0 ---ha-w- c:\documents and settings\anonymous\ptgpbysigl.tmp
2011-07-24 07:40:39 -------- d-----w- c:\program files\musicjacker
2011-07-24 07:40:38 -------- d-----w- c:\documents and settings\all users\application data\musicjacker
2011-07-18 07:12:12 -------- d-----w- c:\program files\Banshee Screamer Alarm
2011-07-16 00:06:07 -------- d-----w- c:\documents and settings\anonymous\application data\DDMSettings
2011-07-15 23:18:00 -------- d-----w- c:\documents and settings\all users\application data\DivX
2011-07-10 02:55:59 -------- d-----w- c:\program files\Veoh Networks
2011-07-06 20:56:47 -------- d-----w- c:\documents and settings\anonymous\application data\Avira
2011-07-06 09:54:55 -------- d-----w- c:\windows\system32\NtmsData
2011-07-06 09:44:31 66616 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2011-07-06 09:44:31 -------- d-----w- c:\program files\Avira
2011-07-06 09:44:31 -------- d-----w- c:\documents and settings\all users\application data\Avira
2011-07-06 04:50:45 -------- d-----w- c:\program files\Panda Security
.
==================== Find3M ====================
.
2011-07-05 20:06:45 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-06-02 17:53:02 94208 ----a-w- c:\windows\system32\dpl100.dll
2009-06-25 20:40:21 0 ----a-w- c:\program files\AUTOEXEC.BAT
.
=================== ROOTKIT ====================
.
Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net
Windows 5.1.2600 Disk: Hitachi_HTS541060G9AT00 rev.MB3OA61A -> Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3
.
device: opened successfully
user: MBR read successfully
.
Disk trace:
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys >>UNKNOWN [0x89DBB4D0]<<
_asm { PUSH EBP; MOV EBP, ESP; PUSH ECX; MOV EAX, [EBP+0x8]; CMP EAX, [0x89dc17d0]; MOV EAX, [0x89dc184c]; PUSH EBX; PUSH ESI; MOV ESI, [EBP+0xc]; MOV EBX, [ESI+0x60]; PUSH EDI; JNZ 0x20; MOV [EBP+0x8], EAX; }
1 ntkrnlpa!IofCallDriver[0x804EE120] -> \Device\Harddisk0\DR0[0x89DCCAB8]
3 CLASSPNP[0xBA8E8FD7] -> ntkrnlpa!IofCallDriver[0x804EE120] -> [0x89D85030]
\Driver\atapi[0x89DA9DF0] -> IRP_MJ_CREATE -> 0x89DBB4D0
error: Read A device attached to the system is not functioning.
kernel: MBR read successfully
_asm { XOR AX, AX; MOV SS, AX; MOV SP, 0x7c00; STI ; PUSH AX; POP ES; PUSH AX; POP DS; CLD ; MOV SI, 0x7c1b; MOV DI, 0x61b; PUSH AX; PUSH DI; MOV CX, 0x1e5; REP MOVSB ; RETF ; MOV BP, 0x7be; MOV CL, 0x4; CMP [BP+0x0], CH; JL 0x2e; JNZ 0x3a; }
detected disk devices:
detected hooks:
\Driver\atapi DriverStartIo -> 0x89DBB31B
user & kernel MBR OK
Warning: possible TDL3 rootkit infection !
.
============= FINISH: 23:37:52.60 ===============

Attached Files



BC AdBot (Login to Remove)

 


#2 RPMcMurphy

RPMcMurphy

    Bleeping *^#@%~


  • Malware Response Team
  • 3,970 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:12:51 AM

Posted 06 August 2011 - 01:24 PM

Hello and welcome. Please follow these guidelines while we work on your PC:
  • Malware removal is a sometimes lengthy and tedious process. Please stick with the thread until I’ve given you the “All clear.” Absence of symptoms does not mean your machine is clean!
  • Please do not run any scans or install/uninstall any applications without being directed to do so.
  • Please note that the forum is very busy and if I don't hear from you within five days this thread will be closed.
Please post your GMER log for me - I need to see that before we get started.

Threads are closed after 5 days of inactivity.

ASAP & UNITE Member


The help you receive here is free. If you wish to show your appreciation, then you may btn_donate_SM.gif


#3 bigpinkears

bigpinkears
  • Topic Starter

  • Members
  • 17 posts
  • OFFLINE
  •  
  • Local time:12:51 AM

Posted 07 August 2011 - 12:28 AM

Hi. :-)

Here is the GMER log:

GMER 1.0.15.15641 - http://www.gmer.net
Rootkit scan 2011-08-05 00:43:43
Windows 5.1.2600 Service Pack 3 Harddisk0\DR0 -> \Device\Ide\IdePort0 Hitachi_HTS541060G9AT00 rev.MB3OA61A
Running: gmer.exe; Driver: C:\DOCUME~1\ANONYM~1\LOCALS~1\Temp\awncqfog.sys


---- System - GMER 1.0.15 ----

SSDT BAFAEABC ZwClose
SSDT BAFAEA76 ZwCreateKey
SSDT BAFAEAC6 ZwCreateSection
SSDT BAFAEA6C ZwCreateThread
SSDT BAFAEA7B ZwDeleteKey
SSDT BAFAEA85 ZwDeleteValueKey
SSDT BAFAEAB7 ZwDuplicateObject
SSDT BAFAEA8A ZwLoadKey
SSDT BAFAEA58 ZwOpenProcess
SSDT BAFAEA5D ZwOpenThread
SSDT BAFAEA94 ZwReplaceKey
SSDT BAFAEA8F ZwRestoreKey
SSDT BAFAEACB ZwSetContextThread
SSDT BAFAEA80 ZwSetValueKey
SSDT BAFAEA67 ZwTerminateProcess

---- Kernel code sections - GMER 1.0.15 ----

.text ntkrnlpa.exe!ZwCallbackReturn + 23C8 80501BF0 4 Bytes JMP AB36BAFA
.text ntkrnlpa.exe!ZwCallbackReturn + 2408 80501C30 4 Bytes JMP E38ABAFA
.text ntkrnlpa.exe!ZwCallbackReturn + 242C 80501C54 4 Bytes JMP B15ABAFA
.text ntkrnlpa.exe!ZwCallbackReturn + 2438 80501C60 4 Bytes JMP D08EBAFA
.text ntkrnlpa.exe!ZwCallbackReturn + 2460 80501C88 4 Bytes JMP AC42BAFA
.text ...
? C:\DOCUME~1\ANONYM~1\LOCALS~1\Temp\mbr.sys The system cannot find the file specified. !

---- User code sections - GMER 1.0.15 ----

.text C:\WINDOWS\Explorer.EXE[1636] ntdll.dll!NtProtectVirtualMemory 7C90D6D0 5 Bytes JMP 00B6000A
.text C:\WINDOWS\Explorer.EXE[1636] ntdll.dll!NtWriteVirtualMemory 7C90DF90 5 Bytes JMP 00B7000A
.text C:\WINDOWS\Explorer.EXE[1636] ntdll.dll!KiUserExceptionDispatcher 7C90E45C 5 Bytes JMP 00A2000C
.text C:\WINDOWS\System32\svchost.exe[2892] ntdll.dll!NtProtectVirtualMemory 7C90D6D0 5 Bytes JMP 007F000A
.text C:\WINDOWS\System32\svchost.exe[2892] ntdll.dll!NtWriteVirtualMemory 7C90DF90 5 Bytes JMP 0080000A
.text C:\WINDOWS\System32\svchost.exe[2892] ntdll.dll!KiUserExceptionDispatcher 7C90E45C 5 Bytes JMP 007E000C
.text C:\WINDOWS\System32\svchost.exe[2892] USER32.dll!GetCursorPos 7E42974E 5 Bytes JMP 01A3000A
.text C:\WINDOWS\System32\svchost.exe[2892] USER32.dll!WindowFromPoint 7E429766 5 Bytes JMP 01A4000A
.text C:\WINDOWS\System32\svchost.exe[2892] USER32.dll!GetForegroundWindow 7E429823 5 Bytes JMP 01C2000A
.text C:\WINDOWS\System32\svchost.exe[2892] ole32.dll!CoCreateInstance 7750057E 5 Bytes JMP 01A2000A
.text C:\Program Files\Internet Explorer\iexplore.exe[3804] ntdll.dll!NtProtectVirtualMemory 7C90D6D0 5 Bytes JMP 00EE000A
.text C:\Program Files\Internet Explorer\iexplore.exe[3804] ntdll.dll!NtWriteVirtualMemory 7C90DF90 5 Bytes JMP 00EF000A
.text C:\Program Files\Internet Explorer\iexplore.exe[3804] ntdll.dll!KiUserExceptionDispatcher 7C90E45C 5 Bytes JMP 00ED000C

---- Devices - GMER 1.0.15 ----

Device \Driver\atapi -> DriverStartIo \Device\Ide\IdePort0 89DBB31B
Device \Driver\atapi -> DriverStartIo \Device\Ide\IdeDeviceP0T0L0-3 89DBB31B
Device \Driver\atapi -> DriverStartIo \Device\Ide\IdePort1 89DBB31B
Device \Driver\atapi -> DriverStartIo \Device\Ide\IdeDeviceP1T0L0-e 89DBB31B
Device \Driver\BTHUSB \Device\0000008b bthport.sys (Bluetooth Bus Driver/Microsoft Corporation)
Device \Driver\BTHUSB \Device\0000008d bthport.sys (Bluetooth Bus Driver/Microsoft Corporation)

---- Registry - GMER 1.0.15 ----

Reg HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\0016411b7f5d
Reg HKLM\SYSTEM\ControlSet003\Services\BTHPORT\Parameters\Keys\0016411b7f5d (not active ControlSet)

---- Disk sectors - GMER 1.0.15 ----

Disk \Device\Harddisk0\DR0 TDL4@MBR code has been found <-- ROOTKIT !!!
Disk \Device\Harddisk0\DR0 sector 00: rootkit-like behavior

---- EOF - GMER 1.0.15 ----

#4 RPMcMurphy

RPMcMurphy

    Bleeping *^#@%~


  • Malware Response Team
  • 3,970 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:12:51 AM

Posted 07 August 2011 - 07:57 AM

bigpinkears:

Please do this next:

Posted Image Download TDSSKiller.zip and extract TDSSKiller.exe to your desktop
  • Execute TDSSKiller.exe by doubleclicking on it.
  • Press Start Scan
  • If Malicious objects are found then ensure Cure is selected. Important - If there is no option to "Cure" it is critical that you select "Skip"
  • Then click Continue > Reboot now
  • Once complete, a log will be produced in c:\. It will be named for example, TDSSKiller.2.4.0.0_24.07.2010_13.10.52_log.txt
  • Post that log, please.
Posted Image Download ComboFix from one of the following locations:
Link 1
Link 2

VERY IMPORTANT !!! Save ComboFix.exe to your Desktop

* IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link
  • Double click on ComboFix.exe & follow the prompts.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

Posted Image

  • Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

Posted Image

  • Click on Yes, to continue scanning for malware.
When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.
Notes:
1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.


Please include the following in your next post:
  • TDSSKiller log
  • ComboFix log

Threads are closed after 5 days of inactivity.

ASAP & UNITE Member


The help you receive here is free. If you wish to show your appreciation, then you may btn_donate_SM.gif


#5 bigpinkears

bigpinkears
  • Topic Starter

  • Members
  • 17 posts
  • OFFLINE
  •  
  • Local time:12:51 AM

Posted 07 August 2011 - 03:00 PM

I have to say forst that combofix told me that my antivirus was active, even though it had been disabled. There was no instance that I could see of it running in taskmanager, and I had disabled it via msconfig before running combofix. Weird. Also, I got a message saying there was an update available, but I was scared to say yes as I hadn't been instructed to do so. (I figured it could have been some remaining malware on my system giving me the message, trying to trick me into downloading more malware).

I figure now that I probably did wrong. I'm sorry if I did, and I will move promptly to correct my error if instructed.


TDSS log:

2011/08/07 13:21:01.0953 0684 TDSS rootkit removing tool 2.5.14.0 Aug 5 2011 16:09:29
2011/08/07 13:21:01.0984 0684 ================================================================================
2011/08/07 13:21:01.0984 0684 SystemInfo:
2011/08/07 13:21:01.0984 0684
2011/08/07 13:21:01.0984 0684 OS Version: 5.1.2600 ServicePack: 3.0
2011/08/07 13:21:01.0984 0684 Product type: Workstation
2011/08/07 13:21:01.0984 0684 ComputerName: YOUR-F2CA69FF86
2011/08/07 13:21:01.0984 0684 UserName: anonymous
2011/08/07 13:21:01.0984 0684 Windows directory: C:\WINDOWS
2011/08/07 13:21:01.0984 0684 System windows directory: C:\WINDOWS
2011/08/07 13:21:01.0984 0684 Processor architecture: Intel x86
2011/08/07 13:21:01.0984 0684 Number of processors: 1
2011/08/07 13:21:01.0984 0684 Page size: 0x1000
2011/08/07 13:21:01.0984 0684 Boot type: Normal boot
2011/08/07 13:21:01.0984 0684 ================================================================================
2011/08/07 13:21:03.0812 0684 Initialize success
2011/08/07 13:21:08.0421 3352 ================================================================================
2011/08/07 13:21:08.0421 3352 Scan started
2011/08/07 13:21:08.0421 3352 Mode: Manual;
2011/08/07 13:21:08.0421 3352 ================================================================================
2011/08/07 13:21:09.0781 3352 ACPI (8fd99680a539792a30e97944fdaecf17) C:\WINDOWS\system32\DRIVERS\ACPI.sys
2011/08/07 13:21:09.0828 3352 ACPIEC (9859c0f6936e723e4892d7141b1327d5) C:\WINDOWS\system32\drivers\ACPIEC.sys
2011/08/07 13:21:09.0937 3352 aec (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys
2011/08/07 13:21:09.0984 3352 AegisP (375eb0b97e3950adef3633c27a82438b) C:\WINDOWS\system32\DRIVERS\AegisP.sys
2011/08/07 13:21:10.0031 3352 AFD (322d0e36693d6e24a2398bee62a268cd) C:\WINDOWS\System32\drivers\afd.sys
2011/08/07 13:21:10.0687 3352 ApfiltrService (090880e9bf20f928bc341f96d27c019e) C:\WINDOWS\system32\DRIVERS\Apfiltr.sys
2011/08/07 13:21:10.0796 3352 AsyncMac (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys
2011/08/07 13:21:10.0828 3352 atapi (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys
2011/08/07 13:21:10.0875 3352 Atmarpc (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys
2011/08/07 13:21:10.0921 3352 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys
2011/08/07 13:21:11.0046 3352 avgio (0b497c79824f8e1bf22fa6aacd3de3a0) C:\Program Files\Avira\AntiVir Desktop\avgio.sys
2011/08/07 13:21:11.0218 3352 avgntflt (1e4114685de1ffa9675e09c6a1fb3f4b) C:\WINDOWS\system32\DRIVERS\avgntflt.sys
2011/08/07 13:21:11.0250 3352 avipbb (0f78d3dae6dedd99ae54c9491c62adf2) C:\WINDOWS\system32\DRIVERS\avipbb.sys
2011/08/07 13:21:11.0296 3352 b57w2k (3a3a82ffd268bcfb7ae6a48cecf00ad9) C:\WINDOWS\system32\DRIVERS\b57xp32.sys
2011/08/07 13:21:11.0390 3352 BASFND (3d87b0484be1093c6614062701f375c5) C:\WINDOWS\system32\Drivers\BASFND.sys
2011/08/07 13:21:11.0468 3352 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys
2011/08/07 13:21:11.0531 3352 BthEnum (b279426e3c0c344893ed78a613a73bde) C:\WINDOWS\system32\DRIVERS\BthEnum.sys
2011/08/07 13:21:11.0578 3352 BthPan (80602b8746d3738f5886ce3d67ef06b6) C:\WINDOWS\system32\DRIVERS\bthpan.sys
2011/08/07 13:21:11.0640 3352 BTHPORT (10b85171b90c449f8da71c2640b797e9) C:\WINDOWS\system32\Drivers\BTHport.sys
2011/08/07 13:21:11.0687 3352 BTHUSB (61364cd71ef63b0f038b7e9df00f1efa) C:\WINDOWS\system32\Drivers\BTHUSB.sys
2011/08/07 13:21:11.0765 3352 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys
2011/08/07 13:21:11.0843 3352 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys
2011/08/07 13:21:11.0906 3352 Cdfs (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys
2011/08/07 13:21:11.0937 3352 Cdrom (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys
2011/08/07 13:21:12.0015 3352 CmBatt (0f6c187d38d98f8df904589a5f94d411) C:\WINDOWS\system32\DRIVERS\CmBatt.sys
2011/08/07 13:21:12.0078 3352 Compbatt (6e4c9f21f0fae8940661144f41b13203) C:\WINDOWS\system32\DRIVERS\compbatt.sys
2011/08/07 13:21:12.0375 3352 Disk (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys
2011/08/07 13:21:12.0453 3352 dmboot (d992fe1274bde0f84ad826acae022a41) C:\WINDOWS\system32\drivers\dmboot.sys
2011/08/07 13:21:12.0531 3352 dmio (7c824cf7bbde77d95c08005717a95f6f) C:\WINDOWS\system32\drivers\dmio.sys
2011/08/07 13:21:12.0562 3352 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys
2011/08/07 13:21:12.0609 3352 DMusic (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys
2011/08/07 13:21:12.0687 3352 drmkaud (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys
2011/08/07 13:21:12.0750 3352 Fastfat (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys
2011/08/07 13:21:12.0828 3352 Fdc (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\drivers\Fdc.sys
2011/08/07 13:21:12.0875 3352 Fips (d45926117eb9fa946a6af572fbe1caa3) C:\WINDOWS\system32\drivers\Fips.sys
2011/08/07 13:21:12.0906 3352 Flpydisk (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\drivers\Flpydisk.sys
2011/08/07 13:21:12.0953 3352 FltMgr (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\DRIVERS\fltMgr.sys
2011/08/07 13:21:12.0984 3352 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys
2011/08/07 13:21:13.0015 3352 Ftdisk (6ac26732762483366c3969c9e4d2259d) C:\WINDOWS\system32\DRIVERS\ftdisk.sys
2011/08/07 13:21:13.0062 3352 Gpc (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys
2011/08/07 13:21:13.0125 3352 GTIPCI21 (ca835331825599b938e37525796d3549) C:\WINDOWS\system32\DRIVERS\gtipci21.sys
2011/08/07 13:21:13.0281 3352 HidUsb (ccf82c5ec8a7326c3066de870c06daf1) C:\WINDOWS\system32\DRIVERS\hidusb.sys
2011/08/07 13:21:13.0390 3352 HSFHWICH (a84bbbdd125d370593004f6429f8445c) C:\WINDOWS\system32\DRIVERS\HSFHWICH.sys
2011/08/07 13:21:13.0468 3352 HSF_DPV (b678fa91cf4a1c19b462d8db04cd02ab) C:\WINDOWS\system32\DRIVERS\HSF_DPV.SYS
2011/08/07 13:21:13.0562 3352 HTTP (f6aacf5bce2893e0c1754afeb672e5c9) C:\WINDOWS\system32\Drivers\HTTP.sys
2011/08/07 13:21:13.0671 3352 i8042prt (4a0b06aa8943c1e332520f7440c0aa30) C:\WINDOWS\system32\DRIVERS\i8042prt.sys
2011/08/07 13:21:13.0765 3352 ialm (643162fbc619e35d3f1a90a095a5bb42) C:\WINDOWS\system32\DRIVERS\ialmnt5.sys
2011/08/07 13:21:13.0906 3352 Imapi (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys
2011/08/07 13:21:13.0984 3352 IntelIde (b5466a9250342a7aa0cd1fba13420678) C:\WINDOWS\system32\DRIVERS\intelide.sys
2011/08/07 13:21:14.0015 3352 intelppm (8c953733d8f36eb2133f5bb58808b66b) C:\WINDOWS\system32\DRIVERS\intelppm.sys
2011/08/07 13:21:14.0062 3352 Ip6Fw (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\DRIVERS\Ip6Fw.sys
2011/08/07 13:21:14.0093 3352 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
2011/08/07 13:21:14.0125 3352 IpInIp (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys
2011/08/07 13:21:14.0187 3352 IpNat (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys
2011/08/07 13:21:14.0265 3352 IPSec (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys
2011/08/07 13:21:14.0312 3352 irda (aca5e7b54409f9cb5eed97ed0c81120e) C:\WINDOWS\system32\DRIVERS\irda.sys
2011/08/07 13:21:14.0359 3352 IRENUM (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys
2011/08/07 13:21:14.0421 3352 isapnp (05a299ec56e52649b1cf2fc52d20f2d7) C:\WINDOWS\system32\DRIVERS\isapnp.sys
2011/08/07 13:21:14.0468 3352 Kbdclass (463c1ec80cd17420a542b7f36a36f128) C:\WINDOWS\system32\DRIVERS\kbdclass.sys
2011/08/07 13:21:14.0546 3352 kmixer (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys
2011/08/07 13:21:14.0593 3352 KSecDD (1705745d900dabf2d89f90ebaddc7517) C:\WINDOWS\system32\drivers\KSecDD.sys
2011/08/07 13:21:14.0703 3352 mdmxsdk (3c318b9cd391371bed62126581ee9961) C:\WINDOWS\system32\DRIVERS\mdmxsdk.sys
2011/08/07 13:21:14.0750 3352 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys
2011/08/07 13:21:14.0796 3352 Modem (dfcbad3cec1c5f964962ae10e0bcc8e1) C:\WINDOWS\system32\drivers\Modem.sys
2011/08/07 13:21:14.0828 3352 Mouclass (35c9e97194c8cfb8430125f8dbc34d04) C:\WINDOWS\system32\DRIVERS\mouclass.sys
2011/08/07 13:21:14.0890 3352 mouhid (b1c303e17fb9d46e87a98e4ba6769685) C:\WINDOWS\system32\DRIVERS\mouhid.sys
2011/08/07 13:21:15.0000 3352 MountMgr (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys
2011/08/07 13:21:15.0062 3352 MRxDAV (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys
2011/08/07 13:21:15.0140 3352 MRxSmb (68755f0ff16070178b54674fe5b847b0) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
2011/08/07 13:21:15.0203 3352 Msfs (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys
2011/08/07 13:21:15.0250 3352 MSKSSRV (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys
2011/08/07 13:21:15.0281 3352 MSPCLOCK (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys
2011/08/07 13:21:15.0312 3352 MSPQM (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys
2011/08/07 13:21:15.0359 3352 mssmbios (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys
2011/08/07 13:21:15.0390 3352 Mup (2f625d11385b1a94360bfc70aaefdee1) C:\WINDOWS\system32\drivers\Mup.sys
2011/08/07 13:21:15.0453 3352 NDIS (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys
2011/08/07 13:21:15.0484 3352 NdisTapi (1ab3d00c991ab086e69db84b6c0ed78f) C:\WINDOWS\system32\DRIVERS\ndistapi.sys
2011/08/07 13:21:15.0562 3352 Ndisuio (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys
2011/08/07 13:21:15.0609 3352 NdisWan (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys
2011/08/07 13:21:15.0640 3352 NDProxy (6215023940cfd3702b46abc304e1d45a) C:\WINDOWS\system32\drivers\NDProxy.sys
2011/08/07 13:21:15.0671 3352 NetBIOS (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys
2011/08/07 13:21:15.0734 3352 NetBT (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys
2011/08/07 13:21:15.0781 3352 Npfs (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys
2011/08/07 13:21:15.0890 3352 Ntfs (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys
2011/08/07 13:21:15.0984 3352 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys
2011/08/07 13:21:16.0062 3352 NWADI (6f1455b88a1bf5dadac344d647208a81) C:\WINDOWS\system32\DRIVERS\NWADIenum.sys
2011/08/07 13:21:16.0109 3352 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
2011/08/07 13:21:16.0140 3352 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
2011/08/07 13:21:16.0203 3352 Parport (5575faf8f97ce5e713d108c2a58d7c7c) C:\WINDOWS\system32\DRIVERS\parport.sys
2011/08/07 13:21:16.0250 3352 PartMgr (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys
2011/08/07 13:21:16.0281 3352 ParVdm (70e98b3fd8e963a6a46a2e6247e0bea1) C:\WINDOWS\system32\drivers\ParVdm.sys
2011/08/07 13:21:16.0328 3352 PCASp50 (803c8e7f4d00fe832c1f3871514fec85) C:\WINDOWS\system32\Drivers\PCASp50.sys
2011/08/07 13:21:16.0359 3352 PCI (a219903ccf74233761d92bef471a07b1) C:\WINDOWS\system32\DRIVERS\pci.sys
2011/08/07 13:21:16.0421 3352 PCIIde (ccf5f451bb1a5a2a522a76e670000ff0) C:\WINDOWS\system32\drivers\PCIIde.sys
2011/08/07 13:21:16.0453 3352 Pcmcia (9e89ef60e9ee05e3f2eef2da7397f1c1) C:\WINDOWS\system32\DRIVERS\pcmcia.sys
2011/08/07 13:21:16.0703 3352 PptpMiniport (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys
2011/08/07 13:21:16.0734 3352 PSched (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys
2011/08/07 13:21:16.0781 3352 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys
2011/08/07 13:21:16.0828 3352 PxHelp20 (e42e3433dbb4cffe8fdd91eab29aea8e) C:\WINDOWS\system32\Drivers\PxHelp20.sys
2011/08/07 13:21:17.0000 3352 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys
2011/08/07 13:21:17.0062 3352 Rasirda (0207d26ddf796a193ccd9f83047bb5fc) C:\WINDOWS\system32\DRIVERS\rasirda.sys
2011/08/07 13:21:17.0109 3352 Rasl2tp (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
2011/08/07 13:21:17.0156 3352 RasPppoe (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys
2011/08/07 13:21:17.0187 3352 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys
2011/08/07 13:21:17.0234 3352 Rdbss (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys
2011/08/07 13:21:17.0265 3352 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
2011/08/07 13:21:17.0328 3352 RDPWD (6728e45b66f93c08f11de2e316fc70dd) C:\WINDOWS\system32\drivers\RDPWD.sys
2011/08/07 13:21:17.0390 3352 redbook (f828dd7e1419b6653894a8f97a0094c5) C:\WINDOWS\system32\DRIVERS\redbook.sys
2011/08/07 13:21:17.0453 3352 RFCOMM (851c30df2807fcfa21e4c681a7d6440e) C:\WINDOWS\system32\DRIVERS\rfcomm.sys
2011/08/07 13:21:17.0531 3352 s24trans (e2c6abcbefb1d44f6aaeb1cd5d6062d4) C:\WINDOWS\system32\DRIVERS\s24trans.sys
2011/08/07 13:21:17.0593 3352 Secdrv (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys
2011/08/07 13:21:17.0703 3352 serenum (0f29512ccd6bead730039fb4bd2c85ce) C:\WINDOWS\system32\DRIVERS\serenum.sys
2011/08/07 13:21:17.0750 3352 Serial (cca207a8896d4c6a0c9ce29a4ae411a7) C:\WINDOWS\system32\DRIVERS\serial.sys
2011/08/07 13:21:17.0796 3352 Sfloppy (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\drivers\Sfloppy.sys
2011/08/07 13:21:17.0890 3352 SMCIRDA (707647a1aa0edb6cbef61b0c75c28ed3) C:\WINDOWS\system32\DRIVERS\smcirda.sys
2011/08/07 13:21:17.0937 3352 splitter (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys
2011/08/07 13:21:18.0000 3352 sr (76bb022c2fb6902fd5bdd4f78fc13a5d) C:\WINDOWS\system32\DRIVERS\sr.sys
2011/08/07 13:21:18.0062 3352 Srv (5252605079810904e31c332e241cd59b) C:\WINDOWS\system32\DRIVERS\srv.sys
2011/08/07 13:21:18.0109 3352 ssmdrv (a36ee93698802cd899f98bfd553d8185) C:\WINDOWS\system32\DRIVERS\ssmdrv.sys
2011/08/07 13:21:18.0250 3352 STAC97 (305cc42945a713347f978d78566113f3) C:\WINDOWS\system32\drivers\STAC97.sys
2011/08/07 13:21:18.0296 3352 swenum (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys
2011/08/07 13:21:18.0375 3352 swmidi (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys
2011/08/07 13:21:18.0500 3352 sysaudio (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys
2011/08/07 13:21:18.0578 3352 Tcpip (93ea8d04ec73a85db02eb8805988f733) C:\WINDOWS\system32\DRIVERS\tcpip.sys
2011/08/07 13:21:18.0625 3352 TDPIPE (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys
2011/08/07 13:21:18.0671 3352 TDTCP (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys
2011/08/07 13:21:18.0750 3352 TermDD (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys
2011/08/07 13:21:18.0859 3352 Udfs (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys
2011/08/07 13:21:18.0984 3352 Update (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys
2011/08/07 13:21:19.0078 3352 usbccgp (173f317ce0db8e21322e71b7e60a27e8) C:\WINDOWS\system32\DRIVERS\usbccgp.sys
2011/08/07 13:21:19.0125 3352 usbehci (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys
2011/08/07 13:21:19.0312 3352 usbhub (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys
2011/08/07 13:21:19.0343 3352 usbprint (a717c8721046828520c9edf31288fc00) C:\WINDOWS\system32\DRIVERS\usbprint.sys
2011/08/07 13:21:19.0406 3352 USBSTOR (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
2011/08/07 13:21:19.0468 3352 usbuhci (26496f9dee2d787fc3e61ad54821ffe6) C:\WINDOWS\system32\DRIVERS\usbuhci.sys
2011/08/07 13:21:19.0546 3352 VgaSave (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys
2011/08/07 13:21:19.0625 3352 VolSnap (4c8fcb5cc53aab716d810740fe59d025) C:\WINDOWS\system32\drivers\VolSnap.sys
2011/08/07 13:21:19.0812 3352 w29n51 (d6006de6a6ed423d8016a03bc50cbe6b) C:\WINDOWS\system32\DRIVERS\w29n51.sys
2011/08/07 13:21:19.0968 3352 Wanarp (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys
2011/08/07 13:21:20.0046 3352 wdmaud (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys
2011/08/07 13:21:20.0250 3352 winachsf (0c5b9cf1bdf998750d9c5eeb5f8c55ac) C:\WINDOWS\system32\DRIVERS\HSF_CNXT.sys
2011/08/07 13:21:20.0421 3352 MBR (0x1B8) (2839639fa37b8353e792a2a30a12ced3) \Device\Harddisk0\DR0
2011/08/07 13:21:20.0437 3352 \Device\Harddisk0\DR0 - detected Rootkit.Win32.TDSS.tdl4 (0)
2011/08/07 13:21:20.0484 3352 Boot (0x1200) (199d40dafbb4ab90bbaa9e52402e15da) \Device\Harddisk0\DR0\Partition0
2011/08/07 13:21:20.0500 3352 ================================================================================
2011/08/07 13:21:20.0500 3352 Scan finished
2011/08/07 13:21:20.0500 3352 ================================================================================
2011/08/07 13:21:20.0515 3112 Detected object count: 1
2011/08/07 13:21:20.0515 3112 Actual detected object count: 1
2011/08/07 13:21:33.0140 3112 \Device\Harddisk0\DR0 (Rootkit.Win32.TDSS.tdl4) - will be cured after reboot
2011/08/07 13:21:33.0140 3112 \Device\Harddisk0\DR0 - ok
2011/08/07 13:21:33.0140 3112 Rootkit.Win32.TDSS.tdl4(\Device\Harddisk0\DR0) - User select action: Cure
2011/08/07 13:21:42.0078 3696 Deinitialize success



Combofix log:

ComboFix 11-08-07.01 - anonymous 08/07/2011 14:26:37.1.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.2039.1662 [GMT -5:00]
Running from: c:\documents and settings\anonymous\Desktop\ComboFix.exe
AV: AntiVir Desktop *Enabled/Outdated* {AD166499-45F9-482A-A743-FDD3350758C7}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\2vp8ni25.default\extensions\{378fd848-d9d0-4e47-b678-f11751a4a3f5}
c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\2vp8ni25.default\extensions\{378fd848-d9d0-4e47-b678-f11751a4a3f5}\chrome.manifest
c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\2vp8ni25.default\extensions\{378fd848-d9d0-4e47-b678-f11751a4a3f5}\chrome\xulcache.jar
c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\2vp8ni25.default\extensions\{378fd848-d9d0-4e47-b678-f11751a4a3f5}\defaults\preferences\xulcache.js
c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\2vp8ni25.default\extensions\{378fd848-d9d0-4e47-b678-f11751a4a3f5}\install.rdf
c:\documents and settings\anonymous\ptgpbysigl.tmp
c:\documents and settings\anonymous\Templates\y1bey2j6x1n8n3i061280ivc5rn3p1o6c4h5e147k467
c:\program files\Veoh Networks\VeohWebPlayer\ConduitInstaller_veoh.exe
c:\windows\mscntl.dll
c:\windows\system32\drivers\fad.sys
.
.
((((((((((((((((((((((((( Files Created from 2011-07-07 to 2011-08-07 )))))))))))))))))))))))))))))))
.
.
2011-08-05 00:18 . 2011-08-05 00:18 -------- d-----w- c:\program files\Common Files\Java
2011-08-05 00:16 . 2011-08-05 00:15 476904 ----a-w- c:\program files\Mozilla Firefox\plugins\npdeployJava1.dll
2011-08-05 00:16 . 2011-08-05 00:15 73728 ----a-w- c:\windows\system32\javacpl.cpl
2011-08-05 00:16 . 2011-08-05 00:15 472808 ----a-w- c:\windows\system32\deployJava1.dll
2011-08-05 00:15 . 2011-08-05 00:15 -------- d-----w- c:\program files\Java
2011-08-05 00:14 . 2011-08-05 00:14 909600 ----a-w- c:\program files\Mozilla Firefox\jre-6u26-windows-i586-iftw.exe
2011-08-04 01:56 . 2011-08-04 01:56 -------- d-----w- c:\documents and settings\All Users\Application Data\pD00000BgPnD00000
2011-08-03 04:22 . 2011-08-03 04:22 -------- d-----w- c:\documents and settings\Administrator\Application Data\Malwarebytes
2011-08-03 02:34 . 2011-08-03 02:34 -------- d-----w- c:\documents and settings\anonymous\Local Settings\Application Data\Help
2011-08-03 00:11 . 2011-08-03 00:11 -------- d-----w- c:\documents and settings\anonymous\Application Data\Malwarebytes
2011-08-03 00:11 . 2011-07-07 00:52 41272 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-08-03 00:11 . 2011-08-03 00:11 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2011-08-03 00:11 . 2011-08-03 00:11 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2011-08-03 00:11 . 2011-07-07 00:52 22712 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-08-03 00:10 . 2011-08-03 00:10 9466208 ----a-w- c:\program files\Mozilla Firefox\mbam-setup-1.51.1.1800.exe
2011-08-02 09:46 . 2011-08-02 09:46 -------- d-s---w- c:\documents and settings\LocalService\UserData
2011-08-01 19:44 . 2011-08-01 19:45 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Adobe
2011-08-01 16:51 . 2008-04-14 05:17 25856 -c--a-w- c:\windows\system32\dllcache\usbprint.sys
2011-08-01 16:51 . 2008-04-14 05:17 25856 ----a-w- c:\windows\system32\drivers\usbprint.sys
2011-08-01 16:51 . 2008-04-14 05:15 32128 -c--a-w- c:\windows\system32\dllcache\usbccgp.sys
2011-08-01 16:51 . 2008-04-14 05:15 32128 ----a-w- c:\windows\system32\drivers\usbccgp.sys
2011-07-31 00:44 . 2011-07-31 00:44 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Identities
2011-07-29 23:07 . 2011-08-03 00:48 -------- d-----w- c:\documents and settings\All Users\Application Data\cC10513OhNdL10513
2011-07-29 23:06 . 2011-07-29 23:06 -------- d-----w- C:\Adobe
2011-07-29 04:39 . 2011-07-29 04:39 -------- d-----w- c:\program files\Solveig Multimedia
2011-07-29 04:39 . 2011-07-29 04:39 -------- d-----w- c:\program files\Common Files\Solveig Multimedia
2011-07-29 04:37 . 2011-07-29 04:37 5851084 ----a-w- c:\program files\Mozilla Firefox\SolveigMM_AVI_Trimmer_2_0_1106_20_Beta.exe
2011-07-29 04:31 . 2011-07-29 04:31 -------- d-----w- c:\program files\Pando Networks
2011-07-29 04:30 . 2011-07-29 04:30 2110336 ----a-w- c:\program files\Mozilla Firefox\VideoSpin_2_0_Setup-pdlm.exe
2011-07-29 03:50 . 2011-08-03 03:52 -------- d-----w- c:\program files\Common Files\DVDVideoSoft
2011-07-29 03:50 . 2002-01-05 20:37 344064 ----a-w- c:\windows\system32\msvcr70.dll
2011-07-29 03:49 . 2011-07-29 03:50 -------- d-----w- c:\documents and settings\anonymous\Application Data\GetRightToGo
2011-07-28 08:46 . 2011-07-28 08:46 -------- d-s---w- c:\documents and settings\NetworkService\UserData
2011-07-28 06:00 . 2011-07-28 06:00 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\Mozilla
2011-07-28 03:38 . 2011-07-28 03:38 -------- d-----w- c:\documents and settings\Administrator\Application Data\Avira
2011-07-24 07:40 . 2011-07-28 06:17 -------- d-----w- c:\program files\musicjacker
2011-07-24 07:40 . 2011-07-24 07:40 -------- d-----w- c:\documents and settings\All Users\Application Data\musicjacker
2011-07-18 07:12 . 2011-07-18 14:37 -------- d-----w- c:\program files\Banshee Screamer Alarm
2011-07-16 00:06 . 2011-07-16 00:06 -------- d-----w- c:\documents and settings\anonymous\Application Data\DDMSettings
2011-07-15 23:18 . 2011-07-15 23:35 -------- d-----w- c:\documents and settings\All Users\Application Data\DivX
2011-07-10 02:55 . 2011-07-10 02:55 -------- d-----w- c:\program files\Veoh Networks
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-07-10 23:44 . 2011-07-06 09:44 66616 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2011-07-10 23:44 . 2011-07-06 09:44 138192 ----a-w- c:\windows\system32\drivers\avipbb.sys
2011-07-05 20:06 . 2011-07-05 20:06 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-06-02 17:53 . 2011-06-02 17:53 94208 ----a-w- c:\windows\system32\dpl100.dll
2009-06-25 20:40 . 2009-06-25 20:40 0 ----a-w- c:\program files\AUTOEXEC.BAT
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"igfxtray"="c:\windows\system32\igfxtray.exe" [2006-09-15 94208]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2006-09-15 77824]
"Broadcom Wireless Manager UI"="c:\windows\system32\WLTRAY.exe" [2007-03-17 1392640]
"IntelZeroConfig"="c:\program files\Intel\Wireless\bin\ZCfgSvc.exe" [2007-02-21 819200]
"IntelWireless"="c:\program files\Intel\Wireless\Bin\ifrmewrk.exe" [2007-02-21 970752]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-28 35696]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2008-08-21 110592]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-08-21 15360]
.
[HKLM\~\startupfolder\C:^Documents and Settings^anonymous^Start Menu^Programs^Startup^Banshee Screamer Alarm.lnk]
path=c:\documents and settings\anonymous\Start Menu\Programs\Startup\Banshee Screamer Alarm.lnk
backup=c:\windows\pss\Banshee Screamer Alarm.lnkStartup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\avgnt]
2011-04-21 12:53 281768 ----a-w- c:\program files\Avira\AntiVir Desktop\avgnt.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DivXUpdate]
2011-03-21 18:56 1230704 ----a-w- c:\program files\DivX\DivX Update\DivXUpdate.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"wuauserv"=2 (0x2)
"ERSvc"=2 (0x2)
"wscsvc32"=2 (0x2)
"mnmsrvc"=3 (0x3)
"VSS"=3 (0x3)
"upnphost"=3 (0x3)
"SSDPSRV"=3 (0x3)
"AntiVirSchedulerService"=2 (0x2)
"JavaQuickStarterService"=2 (0x2)
"AntiVirService"=2 (0x2)
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
"DisableNotifications"= 1 (0x1)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\WINDOWS\\system32\\sessmgr.exe"=
.
R3 GTIPCI21;GTIPCI21;c:\windows\system32\drivers\gtipci21.sys [6/25/2009 4:05 PM 88192]
S4 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [7/6/2011 4:44 AM 136360]
S4 wscsvc32;Security Center ;c:\windows\system32\msvcirt32.exe --> c:\windows\system32\msvcirt32.exe [?]
.
Contents of the 'Scheduled Tasks' folder
.
.
------- Supplementary Scan -------
.
uStart Page = about:blank
TCP: DhcpNameServer = 208.180.42.68 208.180.42.100
FF - ProfilePath - c:\documents and settings\anonymous\Application Data\Mozilla\Firefox\Profiles\ky76goi6.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com
FF - prefs.js: network.proxy.http - 127.0.0.1
FF - prefs.js: network.proxy.http_port - 54808
FF - prefs.js: network.proxy.type - 0
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}
FF - Ext: DivX Plus Web Player HTML5 &lt;video&gt;: {23fcfd51-4958-4f00-80a3-ae97e717ed8b} - c:\program files\DivX\DivX Plus Web Player\firefox\DivXHTML5
FF - Ext: Java Quick Starter: jqs@sun.com - c:\program files\Java\jre6\lib\deploy\jqs\ff
FF - user.js: network.cookie.cookieBehavior - 0
FF - user.js: privacy.clearOnShutdown.cookies - false
FF - user.js: security.warn_viewing_mixed - false
FF - user.js: security.warn_viewing_mixed.show_once - false
FF - user.js: security.warn_submit_insecure - false
FF - user.js: security.warn_submit_insecure.show_once - false
.
.
------- File Associations -------
.
exefile="c:\documents and settings\NetworkService\Local Settings\Application Data\ovo.exe" -a "%1" %*
.
- - - - ORPHANS REMOVED - - - -
.
HKU-Default-Run-Dbasinuyozewaha - c:\windows\mscntl.dll
MSConfigStartUp-SunJavaUpdateSched - c:\program files\Java\jre6\bin\jusched.exe
MSConfigStartUp-{2A3F3C17-C9CC-EC38-7EA1-5C56CA18B0D9} - c:\documents and settings\anonymous\Application Data\Oqeh\ycip.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-08-07 14:33
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'winlogon.exe'(908)
c:\windows\System32\BCMLogon.dll
.
Completion time: 2011-08-07 14:35:55
ComboFix-quarantined-files.txt 2011-08-07 19:35
.
Pre-Run: 51,836,153,856 bytes free
Post-Run: 52,162,170,880 bytes free
.
WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect
.
- - End Of File - - 3AB82DE912B5DB132DFCE6CE3374D05F

#6 RPMcMurphy

RPMcMurphy

    Bleeping *^#@%~


  • Malware Response Team
  • 3,970 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:12:51 AM

Posted 07 August 2011 - 04:00 PM

bigpinkears:

There was no harm in ignoring the update, but this time please allow it to update. Please do this next:

Posted Image Open Notepad Go to Start> All Programs> Accessories> Notepad ( this will only work with Notepad ) and copy all the text inside the Codebox by highlighting it all and pressing CTRL C on your keyboard, then paste it into Notepad, make sure there is no space before and above File::

File::
c:\windows\system32\msvcirt32.exe
Driver::
wscsvc32
DirLook::
c:\documents and settings\All Users\Application Data\pD00000BgPnD00000
c:\documents and settings\All Users\Application Data\cC10513OhNdL10513
Firefox::
FF - ProfilePath - c:\documents and settings\anonymous\Application Data\Mozilla\Firefox\Profiles\ky76goi6.default\
FF - prefs.js: network.proxy.http - 127.0.0.1
FF - prefs.js: network.proxy.http_port - 54808
FF - prefs.js: network.proxy.type - 0

Save this as CFScript to your desktop.

Then disable your security programs and drag the CFScript into ComboFix.exe as you see in the screenshot below.

Posted Image


This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply.

Posted Image You have this program installed, Malwarebytes' Anti-Malware (MBAM). Please update it and run a scan.

Open MBAM
  • Click the Update tab
  • Click Check for Updates
  • If an update is found, it will download and install the latest version.
  • The program will close to update and reopen.
  • Once the program has loaded, select "Perform Quick Scan", then click Scan.
  • The scan may take some time to finish,so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Uncheck any entries from C:\System Volume Information or C:\Qoobox
  • Make sure that everything else is checked, and click Remove Selected.
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  • Copy&Paste the entire report in your next reply.
Extra Note:
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediately.

Please include the following in your next post:
  • ComboFix log
  • MBAM log

Threads are closed after 5 days of inactivity.

ASAP & UNITE Member


The help you receive here is free. If you wish to show your appreciation, then you may btn_donate_SM.gif


#7 bigpinkears

bigpinkears
  • Topic Starter

  • Members
  • 17 posts
  • OFFLINE
  •  
  • Local time:12:51 AM

Posted 07 August 2011 - 06:49 PM

Done. :-)

combofix log:

ComboFix 11-08-07.03 - anonymous 08/07/2011 17:55:35.2.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.2039.1692 [GMT -5:00]
Running from: c:\documents and settings\anonymous\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\anonymous\Desktop\cfscript.txt
AV: AntiVir Desktop *Enabled/Outdated* {AD166499-45F9-482A-A743-FDD3350758C7}
.
FILE ::
"c:\windows\system32\msvcirt32.exe"
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Legacy_WSCSVC32
-------\Service_wscsvc32
.
.
((((((((((((((((((((((((( Files Created from 2011-07-07 to 2011-08-07 )))))))))))))))))))))))))))))))
.
.
2011-08-05 00:18 . 2011-08-05 00:18 -------- d-----w- c:\program files\Common Files\Java
2011-08-05 00:16 . 2011-08-05 00:15 476904 ----a-w- c:\program files\Mozilla Firefox\plugins\npdeployJava1.dll
2011-08-05 00:16 . 2011-08-05 00:15 73728 ----a-w- c:\windows\system32\javacpl.cpl
2011-08-05 00:16 . 2011-08-05 00:15 472808 ----a-w- c:\windows\system32\deployJava1.dll
2011-08-05 00:15 . 2011-08-05 00:15 -------- d-----w- c:\program files\Java
2011-08-05 00:14 . 2011-08-05 00:14 909600 ----a-w- c:\program files\Mozilla Firefox\jre-6u26-windows-i586-iftw.exe
2011-08-04 01:56 . 2011-08-04 01:56 -------- d-----w- c:\documents and settings\All Users\Application Data\pD00000BgPnD00000
2011-08-03 04:22 . 2011-08-03 04:22 -------- d-----w- c:\documents and settings\Administrator\Application Data\Malwarebytes
2011-08-03 02:34 . 2011-08-03 02:34 -------- d-----w- c:\documents and settings\anonymous\Local Settings\Application Data\Help
2011-08-03 00:11 . 2011-08-03 00:11 -------- d-----w- c:\documents and settings\anonymous\Application Data\Malwarebytes
2011-08-03 00:11 . 2011-07-07 00:52 41272 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-08-03 00:11 . 2011-08-03 00:11 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2011-08-03 00:11 . 2011-08-03 00:11 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2011-08-03 00:11 . 2011-07-07 00:52 22712 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-08-03 00:10 . 2011-08-03 00:10 9466208 ----a-w- c:\program files\Mozilla Firefox\mbam-setup-1.51.1.1800.exe
2011-08-02 09:46 . 2011-08-02 09:46 -------- d-s---w- c:\documents and settings\LocalService\UserData
2011-08-01 19:44 . 2011-08-01 19:45 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Adobe
2011-08-01 16:51 . 2008-04-14 05:17 25856 -c--a-w- c:\windows\system32\dllcache\usbprint.sys
2011-08-01 16:51 . 2008-04-14 05:17 25856 ----a-w- c:\windows\system32\drivers\usbprint.sys
2011-08-01 16:51 . 2008-04-14 05:15 32128 -c--a-w- c:\windows\system32\dllcache\usbccgp.sys
2011-08-01 16:51 . 2008-04-14 05:15 32128 ----a-w- c:\windows\system32\drivers\usbccgp.sys
2011-07-31 00:44 . 2011-07-31 00:44 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Identities
2011-07-29 23:07 . 2011-08-03 00:48 -------- d-----w- c:\documents and settings\All Users\Application Data\cC10513OhNdL10513
2011-07-29 23:06 . 2011-07-29 23:06 -------- d-----w- C:\Adobe
2011-07-29 04:39 . 2011-07-29 04:39 -------- d-----w- c:\program files\Solveig Multimedia
2011-07-29 04:39 . 2011-07-29 04:39 -------- d-----w- c:\program files\Common Files\Solveig Multimedia
2011-07-29 04:37 . 2011-07-29 04:37 5851084 ----a-w- c:\program files\Mozilla Firefox\SolveigMM_AVI_Trimmer_2_0_1106_20_Beta.exe
2011-07-29 04:31 . 2011-07-29 04:31 -------- d-----w- c:\program files\Pando Networks
2011-07-29 04:30 . 2011-07-29 04:30 2110336 ----a-w- c:\program files\Mozilla Firefox\VideoSpin_2_0_Setup-pdlm.exe
2011-07-29 03:50 . 2011-08-03 03:52 -------- d-----w- c:\program files\Common Files\DVDVideoSoft
2011-07-29 03:50 . 2002-01-05 20:37 344064 ----a-w- c:\windows\system32\msvcr70.dll
2011-07-29 03:49 . 2011-07-29 03:50 -------- d-----w- c:\documents and settings\anonymous\Application Data\GetRightToGo
2011-07-28 08:46 . 2011-07-28 08:46 -------- d-s---w- c:\documents and settings\NetworkService\UserData
2011-07-28 06:00 . 2011-07-28 06:00 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\Mozilla
2011-07-28 03:38 . 2011-07-28 03:38 -------- d-----w- c:\documents and settings\Administrator\Application Data\Avira
2011-07-24 07:40 . 2011-07-28 06:17 -------- d-----w- c:\program files\musicjacker
2011-07-24 07:40 . 2011-07-24 07:40 -------- d-----w- c:\documents and settings\All Users\Application Data\musicjacker
2011-07-18 07:12 . 2011-07-18 14:37 -------- d-----w- c:\program files\Banshee Screamer Alarm
2011-07-16 00:06 . 2011-07-16 00:06 -------- d-----w- c:\documents and settings\anonymous\Application Data\DDMSettings
2011-07-15 23:18 . 2011-07-15 23:35 -------- d-----w- c:\documents and settings\All Users\Application Data\DivX
2011-07-10 02:55 . 2011-07-10 02:55 -------- d-----w- c:\program files\Veoh Networks
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-07-10 23:44 . 2011-07-06 09:44 66616 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2011-07-10 23:44 . 2011-07-06 09:44 138192 ----a-w- c:\windows\system32\drivers\avipbb.sys
2011-07-05 20:06 . 2011-07-05 20:06 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-06-02 17:53 . 2011-06-02 17:53 94208 ----a-w- c:\windows\system32\dpl100.dll
2009-06-25 20:40 . 2009-06-25 20:40 0 ----a-w- c:\program files\AUTOEXEC.BAT
.
.
(((((((((((((((((((((((((((((((((((((((((((( Look )))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
---- Directory of c:\documents and settings\All Users\Application Data\cC10513OhNdL10513 ----
.
2011-07-29 23:07 . 2011-07-29 23:07 208 ----a-w- c:\documents and settings\All Users\Application Data\cC10513OhNdL10513\cC10513OhNdL10513
.
---- Directory of c:\documents and settings\All Users\Application Data\pD00000BgPnD00000 ----
.
.
.
((((((((((((((((((((((((((((( SnapShot@2011-08-07_19.33.43 )))))))))))))))))))))))))))))))))))))))))
.
- 2009-06-25 20:24 . 2011-08-07 19:10 40394 c:\windows\system32\perfc009.dat
+ 2009-06-25 20:24 . 2011-08-07 22:52 40394 c:\windows\system32\perfc009.dat
+ 2009-06-25 20:24 . 2011-08-07 22:52 312172 c:\windows\system32\perfh009.dat
- 2009-06-25 20:24 . 2011-08-07 19:10 312172 c:\windows\system32\perfh009.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"igfxtray"="c:\windows\system32\igfxtray.exe" [2006-09-15 94208]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2006-09-15 77824]
"Broadcom Wireless Manager UI"="c:\windows\system32\WLTRAY.exe" [2007-03-17 1392640]
"IntelZeroConfig"="c:\program files\Intel\Wireless\bin\ZCfgSvc.exe" [2007-02-21 819200]
"IntelWireless"="c:\program files\Intel\Wireless\Bin\ifrmewrk.exe" [2007-02-21 970752]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-28 35696]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2008-08-21 110592]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-08-21 15360]
.
[HKLM\~\startupfolder\C:^Documents and Settings^anonymous^Start Menu^Programs^Startup^Banshee Screamer Alarm.lnk]
path=c:\documents and settings\anonymous\Start Menu\Programs\Startup\Banshee Screamer Alarm.lnk
backup=c:\windows\pss\Banshee Screamer Alarm.lnkStartup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\avgnt]
2011-04-21 12:53 281768 ----a-w- c:\program files\Avira\AntiVir Desktop\avgnt.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DivXUpdate]
2011-03-21 18:56 1230704 ----a-w- c:\program files\DivX\DivX Update\DivXUpdate.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"wuauserv"=2 (0x2)
"ERSvc"=2 (0x2)
"wscsvc32"=2 (0x2)
"mnmsrvc"=3 (0x3)
"VSS"=3 (0x3)
"upnphost"=3 (0x3)
"SSDPSRV"=3 (0x3)
"AntiVirSchedulerService"=2 (0x2)
"JavaQuickStarterService"=2 (0x2)
"AntiVirService"=2 (0x2)
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
"DisableNotifications"= 1 (0x1)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\WINDOWS\\system32\\sessmgr.exe"=
.
R3 GTIPCI21;GTIPCI21;c:\windows\system32\drivers\gtipci21.sys [6/25/2009 4:05 PM 88192]
S4 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [7/6/2011 4:44 AM 136360]
.
.
------- Supplementary Scan -------
.
uStart Page = about:blank
TCP: DhcpNameServer = 208.180.42.68 208.180.42.100
FF - ProfilePath - c:\documents and settings\anonymous\Application Data\Mozilla\Firefox\Profiles\ky76goi6.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}
FF - Ext: DivX Plus Web Player HTML5 &lt;video&gt;: {23fcfd51-4958-4f00-80a3-ae97e717ed8b} - c:\program files\DivX\DivX Plus Web Player\firefox\DivXHTML5
FF - Ext: Java Quick Starter: jqs@sun.com - c:\program files\Java\jre6\lib\deploy\jqs\ff
FF - user.js: network.cookie.cookieBehavior - 0
FF - user.js: privacy.clearOnShutdown.cookies - false
FF - user.js: security.warn_viewing_mixed - false
FF - user.js: security.warn_viewing_mixed.show_once - false
FF - user.js: security.warn_submit_insecure - false
FF - user.js: security.warn_submit_insecure.show_once - false
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-08-07 18:03
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'winlogon.exe'(908)
c:\windows\System32\BCMLogon.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Intel\Wireless\Bin\EvtEng.exe
c:\program files\Intel\Wireless\Bin\S24EvMon.exe
c:\program files\Intel\Wireless\Bin\WLKeeper.exe
c:\windows\System32\WLTRYSVC.EXE
c:\windows\System32\bcmwltry.exe
c:\windows\System32\SCardSvr.exe
c:\windows\system32\basfipm.exe
c:\program files\Intel\Wireless\Bin\RegSrvc.exe
c:\windows\system32\rundll32.exe
c:\windows\system32\wscntfy.exe
c:\program files\Intel\Wireless\Bin\Dot1XCfg.exe
.
**************************************************************************
.
Completion time: 2011-08-07 18:04:48 - machine was rebooted
ComboFix-quarantined-files.txt 2011-08-07 23:04
ComboFix2.txt 2011-08-07 19:35
.
Pre-Run: 52,165,095,424 bytes free
Post-Run: 52,115,877,888 bytes free
.
- - End Of File - - 28CCE1F4EA58137EA786B4DC6613EA06



mbam log:

Malwarebytes' Anti-Malware 1.51.1.1800
www.malwarebytes.org

Database version: 7402

Windows 5.1.2600 Service Pack 3
Internet Explorer 6.0.2900.5512

8/7/2011 6:10:31 PM
mbam-log-2011-08-07 (18-10-31).txt

Scan type: Quick scan
Objects scanned: 152239
Time elapsed: 1 minute(s), 59 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

#8 RPMcMurphy

RPMcMurphy

    Bleeping *^#@%~


  • Malware Response Team
  • 3,970 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:12:51 AM

Posted 07 August 2011 - 08:28 PM

bigpinkears:

How is your computer running now? Please do this next:

Posted Image Please go to here to run an online scan with ESET.
    • Turn off the real time scanner of any existing antivirus program while performing the online scan
    • Tick the box next to YES, I accept the Terms of Use.
    • Click Start
    • When asked, allow the activex control to install
    • Click Start
    • Make sure that the option Remove found threats is unticked, and the option Scan unwanted applications is checked
    • Click on Advanced Settings and ensure these options are ticked:
    • Scan for potentially unwanted applications
    • Scan for potentially unsafe applications
    • Enable Anti-Stealth Technology
  • Click Scan
  • Wait for the scan to finish
  • If any threats were found, click the 'List of found threats' , then click Export to text file....
  • Save it to your desktop, then please copy and paste that log as a reply to this topic.
Please include the following in your next post:
  • How is the computer running?
  • ESET log

Edited by RPMcMurphy, 07 August 2011 - 08:29 PM.

Threads are closed after 5 days of inactivity.

ASAP & UNITE Member


The help you receive here is free. If you wish to show your appreciation, then you may btn_donate_SM.gif


#9 bigpinkears

bigpinkears
  • Topic Starter

  • Members
  • 17 posts
  • OFFLINE
  •  
  • Local time:12:51 AM

Posted 07 August 2011 - 10:10 PM

Computer is running a bit better, but still having problms with browsers. IE works well for a bit, then gives me an error saying it has to close. Seems liek this happens when I go to facebook, or when I have more than 3 windows open. Firefox still freezes, but not every time I use it. When it does freeze, after a long time it will actually unfreeze and allow me to click on links.

Computer will actually restart when I choose restart, and will actually shutdown when I choose shutdown. Before, it would hang instead of going off. I would have to push the power button to get it to shut off.

ESET log:

C:\Adobe\plugs\mmc2395656.txt a variant of Win32/Kryptik.RFP trojan
C:\Documents and Settings\anonymous\My Documents\Downloads\VeohWebPlayerSetup_eng.exe Win32/OpenCandy application
C:\Documents and Settings\LocalService\Application Data\Sun\Java\Deployment\cache\6.0\37\3e9bc225-223ca572 a variant of Win32/Kryptik.RBH trojan
C:\Documents and Settings\LocalService\Application Data\Sun\Java\Deployment\cache\6.0\9\5a715689-226683e1 a variant of Win32/Kryptik.RBH trojan
C:\Documents and Settings\NetworkService\Application Data\Sun\Java\Deployment\cache\6.0\37\3f088925-10527751 Java/Agent.DD trojan
C:\Documents and Settings\NetworkService\Application Data\Sun\Java\Deployment\cache\6.0\54\522adcf6-7b991c96 a variant of Win32/Kryptik.REC trojan
C:\Program Files\HijackThis\backups\backup-20110803-210512-168-womo.exe a variant of Win32/Kryptik.REC trojan
C:\Program Files\HijackThis\backups\backup-20110803-210512-827-nuyfi.exe a variant of Win32/Kryptik.REC trojan
C:\Program Files\Veoh Networks\VeohWebPlayer\OCSetupHlp.dll Win32/OpenCandy application
C:\Qoobox\Quarantine\C\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\2vp8ni25.default\extensions\{378fd848-d9d0-4e47-b678-f11751a4a3f5}\chrome.manifest.vir Win32/TrojanDownloader.Tracur.F trojan
C:\Qoobox\Quarantine\C\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\2vp8ni25.default\extensions\{378fd848-d9d0-4e47-b678-f11751a4a3f5}\chrome\xulcache.jar.vir JS/Agent.NDJ trojan
C:\Qoobox\Quarantine\C\WINDOWS\mscntl.dll.vir a variant of Win32/Kryptik.RDY trojan
C:\System Volume Information\_restore{4BA7FC6A-54C5-4511-8A0A-248FF18915DD}\RP1\A0000007.exe a variant of Win32/Kryptik.REC trojan
C:\System Volume Information\_restore{4BA7FC6A-54C5-4511-8A0A-248FF18915DD}\RP1\A0000008.exe a variant of Win32/Kryptik.REC trojan
C:\System Volume Information\_restore{4BA7FC6A-54C5-4511-8A0A-248FF18915DD}\RP2\A0006395.manifest Win32/TrojanDownloader.Tracur.F trojan
C:\System Volume Information\_restore{4BA7FC6A-54C5-4511-8A0A-248FF18915DD}\RP2\A0006397.dll a variant of Win32/Kryptik.RDY trojan

#10 RPMcMurphy

RPMcMurphy

    Bleeping *^#@%~


  • Malware Response Team
  • 3,970 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:12:51 AM

Posted 07 August 2011 - 10:18 PM

bigpinkears:

Please do this next:

Posted Image Open Notepad Go to Start> All Programs> Accessories> Notepad ( this will only work with Notepad ) and copy all the text inside the Codebox by highlighting it all and pressing CTRL C on your keyboard, then paste it into Notepad, make sure there is no space before and above File::

File::
C:\Adobe\plugs\mmc2395656.txt
C:\Documents and Settings\anonymous\My Documents\Downloads\VeohWebPlayerSetup_eng.exe
C:\Documents and Settings\LocalService\Application Data\Sun\Java\Deployment\cache\6.0\37\3e9bc225-223ca572
C:\Documents and Settings\LocalService\Application Data\Sun\Java\Deployment\cache\6.0\9\5a715689-226683e1
C:\Documents and Settings\NetworkService\Application Data\Sun\Java\Deployment\cache\6.0\37\3f088925-10527751
C:\Documents and Settings\NetworkService\Application Data\Sun\Java\Deployment\cache\6.0\54\522adcf6-7b991c96

Save this as CFScript to your desktop.

Then disable your security programs and drag the CFScript into ComboFix.exe as you see in the screenshot below.

Posted Image


This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply.

Please include the following in your next post:
  • How is the computer running now?
  • ComboFix log

Threads are closed after 5 days of inactivity.

ASAP & UNITE Member


The help you receive here is free. If you wish to show your appreciation, then you may btn_donate_SM.gif


#11 bigpinkears

bigpinkears
  • Topic Starter

  • Members
  • 17 posts
  • OFFLINE
  •  
  • Local time:12:51 AM

Posted 07 August 2011 - 11:54 PM

In IE, when I go to facebook, I keep getting the message 'Internet Explorer has encountered a problem and needs to close. We are sorry for the inconvenience.' I don't seem to get error messages going anywhere else in IE. And when I click on search results from google, there is no more redirecting to different webpages, and no more popups.

Firefox is now freezing pretty much immediately after I go to any webpage, and refuses to thaw. Well, that's no totally true. I can go to a search engine first, but when I click on a link and go to another webpage, the page will load mostly, but never completely, and will then freeze.

Still shutting down and restarting from the menu as it should.


Here is the combofix log:


ComboFix 11-08-07.03 - anonymous 08/07/2011 23:24:50.3.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.2039.1649 [GMT -5:00]
Running from: c:\documents and settings\anonymous\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\anonymous\Desktop\cfscript.txt
AV: AntiVir Desktop *Enabled/Outdated* {AD166499-45F9-482A-A743-FDD3350758C7}
.
FILE ::
"c:\adobe\plugs\mmc2395656.txt"
"c:\documents and settings\anonymous\My Documents\Downloads\VeohWebPlayerSetup_eng.exe"
"c:\documents and settings\LocalService\Application Data\Sun\Java\Deployment\cache\6.0\37\3e9bc225-223ca572"
"c:\documents and settings\LocalService\Application Data\Sun\Java\Deployment\cache\6.0\9\5a715689-226683e1"
"c:\documents and settings\NetworkService\Application Data\Sun\Java\Deployment\cache\6.0\37\3f088925-10527751"
"c:\documents and settings\NetworkService\Application Data\Sun\Java\Deployment\cache\6.0\54\522adcf6-7b991c96"
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\adobe\plugs\mmc2395656.txt
c:\documents and settings\anonymous\My Documents\Downloads\VeohWebPlayerSetup_eng.exe
c:\documents and settings\LocalService\Application Data\Sun\Java\Deployment\cache\6.0\37\3e9bc225-223ca572
c:\documents and settings\LocalService\Application Data\Sun\Java\Deployment\cache\6.0\9\5a715689-226683e1
c:\documents and settings\NetworkService\Application Data\Sun\Java\Deployment\cache\6.0\37\3f088925-10527751
c:\documents and settings\NetworkService\Application Data\Sun\Java\Deployment\cache\6.0\54\522adcf6-7b991c96
.
.
((((((((((((((((((((((((( Files Created from 2011-07-08 to 2011-08-08 )))))))))))))))))))))))))))))))
.
.
2011-08-08 01:37 . 2011-08-08 01:37 -------- d-----w- c:\program files\ESET
2011-08-05 00:18 . 2011-08-05 00:18 -------- d-----w- c:\program files\Common Files\Java
2011-08-05 00:16 . 2011-08-05 00:15 476904 ----a-w- c:\program files\Mozilla Firefox\plugins\npdeployJava1.dll
2011-08-05 00:16 . 2011-08-05 00:15 73728 ----a-w- c:\windows\system32\javacpl.cpl
2011-08-05 00:16 . 2011-08-05 00:15 472808 ----a-w- c:\windows\system32\deployJava1.dll
2011-08-05 00:15 . 2011-08-05 00:15 -------- d-----w- c:\program files\Java
2011-08-05 00:14 . 2011-08-05 00:14 909600 ----a-w- c:\program files\Mozilla Firefox\jre-6u26-windows-i586-iftw.exe
2011-08-04 01:56 . 2011-08-04 01:56 -------- d-----w- c:\documents and settings\All Users\Application Data\pD00000BgPnD00000
2011-08-03 04:22 . 2011-08-03 04:22 -------- d-----w- c:\documents and settings\Administrator\Application Data\Malwarebytes
2011-08-03 02:34 . 2011-08-03 02:34 -------- d-----w- c:\documents and settings\anonymous\Local Settings\Application Data\Help
2011-08-03 00:11 . 2011-08-03 00:11 -------- d-----w- c:\documents and settings\anonymous\Application Data\Malwarebytes
2011-08-03 00:11 . 2011-07-07 00:52 41272 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-08-03 00:11 . 2011-08-03 00:11 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2011-08-03 00:11 . 2011-08-03 00:11 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2011-08-03 00:11 . 2011-07-07 00:52 22712 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-08-03 00:10 . 2011-08-03 00:10 9466208 ----a-w- c:\program files\Mozilla Firefox\mbam-setup-1.51.1.1800.exe
2011-08-02 09:46 . 2011-08-02 09:46 -------- d-s---w- c:\documents and settings\LocalService\UserData
2011-08-01 19:44 . 2011-08-01 19:45 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Adobe
2011-08-01 16:51 . 2008-04-14 05:17 25856 -c--a-w- c:\windows\system32\dllcache\usbprint.sys
2011-08-01 16:51 . 2008-04-14 05:17 25856 ----a-w- c:\windows\system32\drivers\usbprint.sys
2011-08-01 16:51 . 2008-04-14 05:15 32128 -c--a-w- c:\windows\system32\dllcache\usbccgp.sys
2011-08-01 16:51 . 2008-04-14 05:15 32128 ----a-w- c:\windows\system32\drivers\usbccgp.sys
2011-07-31 00:44 . 2011-07-31 00:44 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Identities
2011-07-29 23:07 . 2011-08-03 00:48 -------- d-----w- c:\documents and settings\All Users\Application Data\cC10513OhNdL10513
2011-07-29 23:06 . 2011-07-29 23:06 -------- d-----w- C:\Adobe
2011-07-29 04:39 . 2011-07-29 04:39 -------- d-----w- c:\program files\Solveig Multimedia
2011-07-29 04:39 . 2011-07-29 04:39 -------- d-----w- c:\program files\Common Files\Solveig Multimedia
2011-07-29 04:37 . 2011-07-29 04:37 5851084 ----a-w- c:\program files\Mozilla Firefox\SolveigMM_AVI_Trimmer_2_0_1106_20_Beta.exe
2011-07-29 04:31 . 2011-07-29 04:31 -------- d-----w- c:\program files\Pando Networks
2011-07-29 04:30 . 2011-07-29 04:30 2110336 ----a-w- c:\program files\Mozilla Firefox\VideoSpin_2_0_Setup-pdlm.exe
2011-07-29 03:50 . 2011-08-03 03:52 -------- d-----w- c:\program files\Common Files\DVDVideoSoft
2011-07-29 03:50 . 2002-01-05 20:37 344064 ----a-w- c:\windows\system32\msvcr70.dll
2011-07-29 03:49 . 2011-07-29 03:50 -------- d-----w- c:\documents and settings\anonymous\Application Data\GetRightToGo
2011-07-28 08:46 . 2011-07-28 08:46 -------- d-s---w- c:\documents and settings\NetworkService\UserData
2011-07-28 06:00 . 2011-07-28 06:00 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\Mozilla
2011-07-28 03:38 . 2011-07-28 03:38 -------- d-----w- c:\documents and settings\Administrator\Application Data\Avira
2011-07-24 07:40 . 2011-07-28 06:17 -------- d-----w- c:\program files\musicjacker
2011-07-24 07:40 . 2011-07-24 07:40 -------- d-----w- c:\documents and settings\All Users\Application Data\musicjacker
2011-07-18 07:12 . 2011-07-18 14:37 -------- d-----w- c:\program files\Banshee Screamer Alarm
2011-07-16 00:06 . 2011-07-16 00:06 -------- d-----w- c:\documents and settings\anonymous\Application Data\DDMSettings
2011-07-15 23:18 . 2011-07-15 23:35 -------- d-----w- c:\documents and settings\All Users\Application Data\DivX
2011-07-10 02:55 . 2011-07-10 02:55 -------- d-----w- c:\program files\Veoh Networks
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-07-10 23:44 . 2011-07-06 09:44 66616 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2011-07-10 23:44 . 2011-07-06 09:44 138192 ----a-w- c:\windows\system32\drivers\avipbb.sys
2011-07-05 20:06 . 2011-07-05 20:06 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-06-02 17:53 . 2011-06-02 17:53 94208 ----a-w- c:\windows\system32\dpl100.dll
2009-06-25 20:40 . 2009-06-25 20:40 0 ----a-w- c:\program files\AUTOEXEC.BAT
.
.
((((((((((((((((((((((((((((( SnapShot@2011-08-07_19.33.43 )))))))))))))))))))))))))))))))))))))))))
.
- 2009-06-25 20:24 . 2011-08-07 19:10 40394 c:\windows\system32\perfc009.dat
+ 2009-06-25 20:24 . 2011-08-07 23:07 40394 c:\windows\system32\perfc009.dat
+ 2009-06-25 20:24 . 2011-08-07 23:07 312172 c:\windows\system32\perfh009.dat
- 2009-06-25 20:24 . 2011-08-07 19:10 312172 c:\windows\system32\perfh009.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"igfxtray"="c:\windows\system32\igfxtray.exe" [2006-09-15 94208]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2006-09-15 77824]
"Broadcom Wireless Manager UI"="c:\windows\system32\WLTRAY.exe" [2007-03-17 1392640]
"IntelZeroConfig"="c:\program files\Intel\Wireless\bin\ZCfgSvc.exe" [2007-02-21 819200]
"IntelWireless"="c:\program files\Intel\Wireless\Bin\ifrmewrk.exe" [2007-02-21 970752]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-28 35696]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2008-08-21 110592]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-08-21 15360]
.
[HKLM\~\startupfolder\C:^Documents and Settings^anonymous^Start Menu^Programs^Startup^Banshee Screamer Alarm.lnk]
path=c:\documents and settings\anonymous\Start Menu\Programs\Startup\Banshee Screamer Alarm.lnk
backup=c:\windows\pss\Banshee Screamer Alarm.lnkStartup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\avgnt]
2011-04-21 12:53 281768 ----a-w- c:\program files\Avira\AntiVir Desktop\avgnt.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DivXUpdate]
2011-03-21 18:56 1230704 ----a-w- c:\program files\DivX\DivX Update\DivXUpdate.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"wuauserv"=2 (0x2)
"ERSvc"=2 (0x2)
"wscsvc32"=2 (0x2)
"mnmsrvc"=3 (0x3)
"VSS"=3 (0x3)
"upnphost"=3 (0x3)
"SSDPSRV"=3 (0x3)
"AntiVirSchedulerService"=2 (0x2)
"JavaQuickStarterService"=2 (0x2)
"AntiVirService"=2 (0x2)
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
"DisableNotifications"= 1 (0x1)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\WINDOWS\\system32\\sessmgr.exe"=
.
R3 GTIPCI21;GTIPCI21;c:\windows\system32\drivers\gtipci21.sys [6/25/2009 4:05 PM 88192]
S4 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [7/6/2011 4:44 AM 136360]
.
.
------- Supplementary Scan -------
.
uStart Page = about:blank
TCP: DhcpNameServer = 208.180.42.68 208.180.42.100
FF - ProfilePath - c:\documents and settings\anonymous\Application Data\Mozilla\Firefox\Profiles\ky76goi6.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}
FF - Ext: DivX Plus Web Player HTML5 &lt;video&gt;: {23fcfd51-4958-4f00-80a3-ae97e717ed8b} - c:\program files\DivX\DivX Plus Web Player\firefox\DivXHTML5
FF - Ext: Java Quick Starter: jqs@sun.com - c:\program files\Java\jre6\lib\deploy\jqs\ff
FF - user.js: network.cookie.cookieBehavior - 0
FF - user.js: privacy.clearOnShutdown.cookies - false
FF - user.js: security.warn_viewing_mixed - false
FF - user.js: security.warn_viewing_mixed.show_once - false
FF - user.js: security.warn_submit_insecure - false
FF - user.js: security.warn_submit_insecure.show_once - false
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-08-07 23:29
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'winlogon.exe'(908)
c:\windows\System32\BCMLogon.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Intel\Wireless\Bin\EvtEng.exe
c:\program files\Intel\Wireless\Bin\S24EvMon.exe
c:\program files\Intel\Wireless\Bin\WLKeeper.exe
c:\windows\System32\WLTRYSVC.EXE
c:\windows\System32\bcmwltry.exe
c:\windows\System32\SCardSvr.exe
c:\windows\system32\basfipm.exe
c:\program files\Intel\Wireless\Bin\RegSrvc.exe
c:\windows\system32\rundll32.exe
c:\windows\system32\wscntfy.exe
c:\program files\Intel\Wireless\Bin\Dot1XCfg.exe
.
**************************************************************************
.
Completion time: 2011-08-07 23:31:24 - machine was rebooted
ComboFix-quarantined-files.txt 2011-08-08 04:31
ComboFix2.txt 2011-08-07 23:04
ComboFix3.txt 2011-08-07 19:35
.
Pre-Run: 52,002,971,648 bytes free
Post-Run: 51,987,836,928 bytes free
.
- - End Of File - - CD0319D201EB1F07186AB56E591CBE27

#12 CatByte

CatByte

    bleepin' tiger


  • Malware Response Team
  • 14,664 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Location:Canada
  • Local time:12:51 AM

Posted 08 August 2011 - 05:35 PM

Hi

RPMcMurphy is on vacation and asked if I'd stop by to help until he gets back.

Please do the following:

Download TFC to your desktop
Mirror
  • Close any open windows.
  • Double click the TFC icon to run the program
  • TFC will close all open programs itself in order to run,
  • Click the Start button to begin the process.
  • Allow TFC to run uninterrupted.
  • The program should not take long to finish it's job
  • Once its finished it should automatically reboot your machine,
  • if it doesn't, manually reboot to ensure a complete clean
It's normal after running TFC cleaner that the PC will be slower to boot the first time.


NEXT

Reset IE back to default

visit this MS site and use the FixIt button (use the FixIt button on the page, not the popup fixit button, they are two different things)

http://support.microsoft.com/kb/923737


NEXT

Reset all your preferences in FireFox

http://support.mozilla.com/en-US/kb/Resetting%20preferences?s=reset+firefox+back+to+default&as=s


NEXT

  • Go to Start > Control Panel, and choose Network Connections.
  • Right click on your default connection, usually Local Area Connection for cable and DSL or Dial-up Connection if you are using Dial-up, and choose Properties.
  • Click the Networking tab
  • Double-click on the Internet Protocol (TCP/IP) item.
  • Write down the settings in case you should need to change them back.
  • Select the radio button that says "Obtain DNS servers automatically".
  • Click OK twice to get out of the properties screen and restart your computer.
  • If not prompted to reboot go ahead and reboot manually.

In I.E.
  • Check internet options settings.
  • Tools > Internet Options > Connections
  • LAN settings
  • Choose "automatically detect settings"
  • uncheck both proxy settings boxes

In FireFox
  • Click on Advanced -> Network -> Settings…
  • the No Proxy option should be selected


Reset your Router:

  • This can be done by inserting something tiny like a paper clip end or pencil tip into a small hole labeled "reset" located on the back of the router.
  • Press and hold down the small button inside until the lights on the front of the router blink off and then on again (usually about 10 seconds).
  • If you don’t know the router's default password, you can look it up. HERE
  • You also need to reconfigure any security settings you had in place prior to the reset.
  • You may also need to consult with your Internet service provider to find out which DNS servers your network should be using.

NEXT

  • Go to Start > Run > type: cmd
  • Press OK or Hit Enter.
  • At the command prompt, type or copy/paste: ipconfig /flushdns (note the space between “..g /f…” it needs to be there)
  • Hit Enter.
  • You will get a confirmation that the flush was successful.
  • Close the command box.


let me know if that makes any difference

Microsoft MVP - 2010, 2011, 2012, 2013, 2014, 2015


#13 bigpinkears

bigpinkears
  • Topic Starter

  • Members
  • 17 posts
  • OFFLINE
  •  
  • Local time:12:51 AM

Posted 08 August 2011 - 10:43 PM

Hi Catbyte.

I ran TFC. Unfortunately, I can't follow directions for resetting browsers, as the info applies to newer versions of these browsers. I have IE 6 and Firefox 3.6.18. I don't want to update them to the newer versions, as I had a good deal of trouble with newer versions on a different computer that is very like this one, and has the same OS. Is there another way?

Edited by bigpinkears, 08 August 2011 - 10:46 PM.


#14 CatByte

CatByte

    bleepin' tiger


  • Malware Response Team
  • 14,664 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Location:Canada
  • Local time:12:51 AM

Posted 09 August 2011 - 06:31 AM

what type of trouble did you have? The software is updated to improve security loopholes and it is always wise to have the latest versions.

Microsoft MVP - 2010, 2011, 2012, 2013, 2014, 2015


#15 CatByte

CatByte

    bleepin' tiger


  • Malware Response Team
  • 14,664 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Location:Canada
  • Local time:12:51 AM

Posted 14 August 2011 - 08:21 AM

Due to the lack of feedback, this topic is now closed.In the event you still have problems, please send me or any Moderator a Private Message and ask them to reopen this topic within the next 5 days. Please include a link to your topic in the Private Message. Thank you.

Microsoft MVP - 2010, 2011, 2012, 2013, 2014, 2015





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users