[tdc5013]

I tried to send it off but because the internet isnt working I couldnt.

What's interesting is that now it's saying that a network cable is unplugged, rather than there just not being any activity, ive checked and everything is plugged in fine though.

Here's my hijack log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 01:02:16, on 14/05/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\explorer.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.google.ca
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

--
End of file - 4991 bytes





Here is my ComboFix log:

XP_user
sx
5C82-0010-8011-0000-2930-9253-1036

Windows XP 5.1
IA32
WinAspi: -
ahead WinASPI: File 'C:\Program Files\Nero\Nero 7\Core\Wnaspi32.dll': Ver=2.0.1.74, size=164112 bytes, created 02/11/2004 13:54:32

NT-SPTI used
Nero Version: 7.0.0.0 (Nero Express)
Recorder: <ATAPI DVD DC 16X8X5> Version: 103 - HA 1 TA 0 - 7.0.0.0
Adapter driver: <IDE> HA 1
Drive buffer : 2048kB
Bus Type : via Inquiry data (1) -> ATAPI, detected: ?
Connected to MMC as unknown drive with class-nr : 1
Drive is autodetected - recorder class:
CD-ROM: <ER1109X YRD531K >Version: 1.0 - HA 1 TA 1 - 7.0.0.0
Adapter driver: <SCSI> HA 1

=== Scsi-Device-Map ===
DiskPeripheral : MAXTOR 6L080J4 atapi Port 0 ID 0 DMA: On
DiskPeripheral : ST3400832A atapi Port 0 ID 1 DMA: On
CdRomPeripheral : ATAPI DVD DC 16X8X5 atapi Port 1 ID 0 DMA: On
CdRomPeripheral : ER1109X YRD531K 1.0 aoht1nqj Port 2 ID 0 DMA: Off

=== CDRom-Device-Map ===
ATAPI DVD DC 16X8X5 D: CDRom0
ER1109X YRD531K G: CDRom1
=======================

AutoRun : 1
Excluded drive IDs:
WriteBufferSize: 74448896 (0) Byte
ShowDrvBufStat : 0
BUFE : 0
Physical memory : 511MB (523760kB)
Free physical memory: 16MB (16888kB)
Memory in use : 96 %
Uncached PFiles: 0x0
Use Inquiry : 1
Global Bus Type: default (0)
Check supported media : Disabled (0)

9.7.2007
ISO compilation
18:41:45 #1 Text 0 File Isodoc.cpp, Line 6410
Iso document burn settings
------------------------------------------
Determine maximum speed : FALSE
Simulate : FALSE
Write : TRUE
Finalize CD : FALSE
Multisession : TRUE
Multisession type: : Start multisession
Burning mode : DAO
Mode : 1
ISO Level : 1 (Max. of 11 = 8 + 3 char)
Character set : ISO 9660
Joliet : TRUE
Allow pathdepth more than 8 directories : TRUE
Allow more than 255 characters in path : TRUE
Write ISO9660 ;1 file extensions : TRUE

18:41:45 #2 Text 0 File ThreadedTransfer.cpp, Line 525
ReadBuffer-Pipe got 262144KB of Memory

18:41:45 #3 Text 0 File Reader.cpp, Line 124
Reader running

18:41:45 #4 Text 0 File Writer.cpp, Line 113
Writer D: ATAPI DVD DC 16X8X5 running

18:41:45 #5 ISO9660GEN -11 File Geniso.cpp, Line 3304
First writeable address = 0 (0x00000000)

18:41:45 #6 Text 0 File Burncd.cpp, Line 3301
Turn on Disc-At-Once, using DVD media

18:41:45 #7 Text 0 File DlgWaitCD.cpp, Line 277
Last possible write address on media: 2298495 (510:46.45, 4489MB)
Last address to be written: 2150559 (477:54.09, 4200MB)

18:41:45 #8 Text 0 File DlgWaitCD.cpp, Line 289
Write in overburning mode: NO (enabled: CD)

18:41:45 #9 Text 0 File DlgWaitCD.cpp, Line 2568
Recorder: ATAPI DVD DC 16X8X5, Media type: DVD-R
Disc Manufacturer: Prodis - cF01
Disc Application Code: 64, Disc Physical Code: 193

18:41:45 #10 Text 0 File DlgWaitCD.cpp, Line 456
>>> Protocol of DlgWaitCD activities: <<<
=========================================

18:41:45 #11 Text 0 File ThreadedTransferInterface.cpp, Line 846
Setup items (after recorder preparation)
0: TRM_DATA_MODE1 ()
2 indices, index0 (150) not provided
original disc pos #0 + 2150560 (2150560) = #2150560/477:54.10
relocatable, disc pos for caching/writing not required/ required, no patch infos
-> TRM_DATA_MODE1, 2048, config 0, wanted index0 0 blocks, length 2150560 blocks [D: ATAPI DVD DC 16X8X5]
--------------------------------------------------------------

18:41:45 #12 Text 0 File ThreadedTransferInterface.cpp, Line 1058
Prepare recorder [D: ATAPI DVD DC 16X8X5] for write in CUE-sheet-DAO
DAO infos:
==========
MCN: ""
TOCType: 0x00; Session Closed, disc not fixated
Tracks 1 to 1:
1: TRM_DATA_MODE1, 2048/0x00, FilePos 0 0 4404346880, ISRC ""
DAO layout:
===========
__Start_|____Track_|_Idx_|_CtrlAdr_|_RecDep__________
0 | lead-in | 0 | 0x41 | 0x00
0 | 1 | 0 | 0x41 | 0x00
0 | 1 | 1 | 0x41 | 0x00
2150560 | lead-out | 1 | 0x41 | 0x00

18:41:45 #13 Text 0 File SCSIPassThrough.cpp, Line 34
SPTILockVolume - completed successfully for FCTL_LOCK_VOLUME

18:41:45 #14 Phase 24 File dlgbrnst.cpp, Line 1724
Caching of files started

18:56:24 #15 TRANSFER -15 File ThreadedTransfer.cpp, Line 1779
Cache file too small - not all files could be cached

18:56:39 #16 Text 0 File Burncd.cpp, Line 4129
Cache writing successful.

18:56:39 #17 Phase 25 File dlgbrnst.cpp, Line 1724
Caching of files completed

18:57:46 #18 Phase 36 File dlgbrnst.cpp, Line 1724
Burn process started at 8x (11,080 KB/s)

18:57:46 #19 Text 0 File ThreadedTransferInterface.cpp, Line 2669
Verifying disc position of item 0 (relocatable, disc pos, no patch infos, orig at #0): write at #0

18:57:46 #20 Text 0 File DVDR.cpp, Line 2469
Recording mode: Sequential Recording Mode for Multisession

18:57:46 #21 Text 0 File MMC.cpp, Line 21541
Set BUFE: Seamless Link -> ON

18:57:46 #22 Text 0 File DVDR.cpp, Line 2624
Start write address at LBA 0
DVD high compatibility mode: Yes

18:57:46 #23 Text 0 File Cdrdrv.cpp, Line 8385
---- DVD Structure: Physical Format Information (00h) ----
Layer: 0, Address: 0 (0 h), AGID: 0; Length: 2050
Book Type: DVD-R (2), Part Version: 2.0x (5), Extended Part Version: 0.0 (0)
Disc Size: 120 mm, Maximum Rate: 10.08 Mbps (2 h)
Number of Layers: 1, Track Path: Parallel Track Path (PTP), Layer Type: recordable
Linear Density: 0,267 um/bit, Track Density: 0,74 um/track
Starting Physical Sector Number of Data Area: 30000 h (DVD-ROM, DVD-R/-RW, DVD+R/+RW)
End Physical Sector Number of Data Area: 0 h
End Sector Number in Layer 0: 0 h (LBN: FFFD0000 h, 4193920 MB)
Data in Burst Cutting Area (BCA) does not exist
Start sector number of the current Border-Out: 2FE10 h
Start sector number of the next Border-In: 2FFA0 h
Media Specific [16..63]:
00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
00 02 FE 10 00 02 FF A0 - 00 00 00 00 00 00 00 00 ..þ...ÿ.........
00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................

19:25:47 #24 TRANSFER -25 File Reader.cpp, Line 364
Error reading data

19:25:47 #25 Text 0 File Reader.cpp, Line 367
Exception value: -1

19:25:54 #26 Text 0 File ThreadedTransfer.cpp, Line 228
all writers idle, stopping conversion

19:25:54 #27 Text 0 File DVDR.cpp, Line 2866
EndDAO: Last written address was 1178463

19:26:00 #28 Phase 133 File dlgbrnst.cpp, Line 1724
Writing short lead-out

19:29:52 #29 Phase 38 File dlgbrnst.cpp, Line 1724
Burn process failed at 8x (11,080 KB/s)


Existing drivers:
File 'Drivers\CDRALW2K.SYS': Ver=8.0.0.212 , size=2560 bytes, created 23/04/2007 01:15:25
File 'Drivers\PXHELP20.SYS': Ver=3.00.43J, size=36624 bytes, created 23/04/2007 01:15:25 (Prassi/Veritas driver for win 2K)
File 'Drivers\scsiport.sys': Ver=5.1.2600.2180 (xpsp_sp2_rtm.040803-2158), size=96256 bytes, created 04/08/2004 03:59:42 (Adapter driver for src)

Registry Keys:
HKLM\Software\Microsoft\Windows NT\CurrentVersion\WinLogon\AllocateCDROMs : 0 (Security Option)

[dvk01]

try this next

go to start/connect to/show all connections

right click your connection & select enable if it says disabled

if it says connected, select disable & then enable

see what that does

[tdc5013]

Yeah, that doesnt work.

I also tried using a different ethernet cable, but still nothing (it just went back to saying no connectivity).

[dvk01]

we have cleaned out the malware & thus is sounding like a hardware fault now

I suspect that the actual nic card has gone wrong

it does happen

I will move this back to networking & let the guys there carry on with it

[tdc5013]

If it is the NIC card, is this an easy fix? Or will I need a new mother board..

[dvk01]

it is easy to replace a nic card
but first lets see what the networking gurus come up with

[dvk01]

lets just check something and see what error messages have been logged

this is an easy way for me to see those and others

Download OTScanIt.exe to your Desktop and double-click on it to extract the files. It will create a folder named OTScanIt on your desktop.

• Close any open browsers.
• Open the OTScanit folder and double-click on OTScanit.exe to start the program.
• If your Real protection or Antivirus intervenes with OTScanIt, allow it to run.
• In the Processes group click Non-Microsoft
• In the Services group click Non-Microsoft
• In the [b]Drivers[b] group click Non-Microsoft
• In the Registry group click ALL
• In the File String Search group select ALL
• In the Rootkit Search group select YESL
• In the Files Created Within group click 30 days Make sure Non-Microsoft only is CHECKED
• In the Files Modified Within group select 30 days Make sure Non-Microsoft only is CHECKED
  and then make sure include unicode names is checked
  in the Additional scans sections please press select ALL and check non-microsoft only
• Now on the toolbar at the top select "Scan all users" then click the Run Scan button
• The program will be scanning huge amounts of data so depending on your system it could take a long time to complete. Let it run unhindered until it finishes.
• When the scan is complete Notepad will open with the report file loaded in it.
• Save that notepad file

Use the Reply button and attach the notepad file here. I will review it when it comes in.

It will be much too big to copy & paste here

if it is too large to attach and sometimes it is depending on numbers of error messages & newly created files then zip it first & upload the zip file

[TerryNet]

EDIT: first do the stack repair (post #8) again.

Please briefly summarize the current situation/problem, and show ...

Start, Run, CMD, OK to open a command prompt:
(For Vista type CMD in the Search box after Start)

Type the following command:

IPCONFIG /ALL

Right click in the command window and choose Select All, then hit Enter.
Paste the results in a message here.

If necessary use a text file and removable media to copy the results to a computer with internet access.

[tdc5013]

got it

[tdc5013]

hey i just redid the stack and it's working again. I haven't restarted yet, I'll reply in a sec to see if all is still good after I have done that

[tdc5013]

Yep it's working again, I think that second stack repair fixed it.

Shall I mark the threat as Solved or do you need anymore info?

[dvk01]

OTscan it is showing a few disc errors in teh event viewer section

I would suggest a scandisc to see if there are any damaged sectors etc
as you have solved the original problem lets clear up after the malware removal

*Follow these steps to uninstall Combofix and tools used in the removal of malware*
* Click *START* then *RUN*
* Now type *Combofix /u* in the runbox and click *OK*. Note the *space* between the *X* and the *U*, it needs to be there.


Then on otscanit press cleanup on the top bar & follow prompts
then
Turn off system restore by following instructions here
for XP http://www.thespykiller.co.uk/index.php?page=8
or for Vista http://www.bleepingcomputer.com/tuto...torial143.html

That will purge the restore folder and clear any malware that has been put in there. Then reboot & then re-enable system restore & create a new restore point. Now Empty Recycle bin on desktop

go here http://www.thespykiller.co.uk/index.php?page=3 for info on how to tighten your security settings and how to help prevent future attacks.

and scan here http://secunia.com/software_inspector/ for out of date & vulnerable common applications on your computer

Then pay an urgent visit to windows update & make sure you are fully updated, that will help to plug the security holes that let these pests on in the first place

[tdc5013]

when I try to do the run thing it says that windows cannot find combofix

[dvk01]

do start/run & type

combofix.exe /u

let me know what happens

[tdc5013]

same thing again, couldnt be found