Login | Live Chat & Podcast at 1:00PM Eastern on Sunday! |
 Search | |
| |
15-Mar-2008, 02:34 AM
#16 | |||||
| ...Gosh! I've already noticed comp running faster!  here are the logs....SDFix: Version 1.157 Run by Chum Family on Sat 03/15/2008 at 12:11 AM Microsoft Windows XP [Version 5.1.2600] Running From: C:\SDFix Checking Services : Name: CbEvtSvc Path: %SystemRoot%\System32\CbEvtSvc.exe -k netsvcs CbEvtSvc - Deleted Restoring Windows Registry Values Restoring Windows Default Hosts File Rebooting Checking Files : Trojan Files Found: C:\WINDOWS\fvtkqajp\1.png - Deleted C:\WINDOWS\fvtkqajp\2.png - Deleted C:\WINDOWS\fvtkqajp\3.png - Deleted C:\WINDOWS\fvtkqajp\4.png - Deleted C:\WINDOWS\fvtkqajp\5.png - Deleted C:\WINDOWS\fvtkqajp\6.png - Deleted C:\WINDOWS\fvtkqajp\7.png - Deleted C:\WINDOWS\fvtkqajp\8.png - Deleted C:\WINDOWS\fvtkqajp\9.png - Deleted C:\WINDOWS\fvtkqajp\bottom-rc.gif - Deleted C:\WINDOWS\fvtkqajp\config.png - Deleted C:\WINDOWS\fvtkqajp\content.png - Deleted C:\WINDOWS\fvtkqajp\download.gif - Deleted C:\WINDOWS\fvtkqajp\frame-bg.gif - Deleted C:\WINDOWS\fvtkqajp\frame-bottom-left.gif - Deleted C:\WINDOWS\fvtkqajp\frame-h1bg.gif - Deleted C:\WINDOWS\fvtkqajp\head.png - Deleted C:\WINDOWS\fvtkqajp\icon.png - Deleted C:\WINDOWS\fvtkqajp\indexwp.html - Deleted C:\WINDOWS\fvtkqajp\main.css - Deleted C:\WINDOWS\fvtkqajp\memory-prots.png - Deleted C:\WINDOWS\fvtkqajp\net.png - Deleted C:\WINDOWS\fvtkqajp\pc.gif - Deleted C:\WINDOWS\fvtkqajp\pc-mag.gif - Deleted C:\WINDOWS\fvtkqajp\poloska1.png - Deleted C:\WINDOWS\fvtkqajp\poloska2.png - Deleted C:\WINDOWS\fvtkqajp\poloska3.png - Deleted C:\WINDOWS\fvtkqajp\promowp1.html - Deleted C:\WINDOWS\fvtkqajp\promowp2.html - Deleted C:\WINDOWS\fvtkqajp\promowp3.html - Deleted C:\WINDOWS\fvtkqajp\promowp4.html - Deleted C:\WINDOWS\fvtkqajp\promowp5.html - Deleted C:\WINDOWS\fvtkqajp\reg.png - Deleted C:\WINDOWS\fvtkqajp\repair.png - Deleted C:\WINDOWS\fvtkqajp\scr-1.png - Deleted C:\WINDOWS\fvtkqajp\scr-2.png - Deleted C:\WINDOWS\fvtkqajp\start.png - Deleted C:\WINDOWS\fvtkqajp\styles.css - Deleted C:\WINDOWS\fvtkqajp\top-rc.gif - Deleted C:\WINDOWS\fvtkqajp\vline.gif - Deleted C:\WINDOWS\fvtkqajp\wp.png - Deleted C:\WINDOWS\qpcjpkct\1.png - Deleted C:\WINDOWS\qpcjpkct\2.png - Deleted C:\WINDOWS\qpcjpkct\3.png - Deleted C:\WINDOWS\qpcjpkct\4.png - Deleted C:\WINDOWS\qpcjpkct\5.png - Deleted C:\WINDOWS\qpcjpkct\6.png - Deleted C:\WINDOWS\qpcjpkct\7.png - Deleted C:\WINDOWS\qpcjpkct\8.png - Deleted C:\WINDOWS\qpcjpkct\9.png - Deleted C:\WINDOWS\qpcjpkct\bottom-rc.gif - Deleted C:\WINDOWS\qpcjpkct\config.png - Deleted C:\WINDOWS\qpcjpkct\content.png - Deleted C:\WINDOWS\qpcjpkct\download.gif - Deleted C:\WINDOWS\qpcjpkct\frame-bg.gif - Deleted C:\WINDOWS\qpcjpkct\frame-bottom-left.gif - Deleted C:\WINDOWS\qpcjpkct\frame-h1bg.gif - Deleted C:\WINDOWS\qpcjpkct\head.png - Deleted C:\WINDOWS\qpcjpkct\icon.png - Deleted C:\WINDOWS\qpcjpkct\indexwp.html - Deleted C:\WINDOWS\qpcjpkct\main.css - Deleted C:\WINDOWS\qpcjpkct\memory-prots.png - Deleted C:\WINDOWS\qpcjpkct\net.png - Deleted C:\WINDOWS\qpcjpkct\pc.gif - Deleted C:\WINDOWS\qpcjpkct\pc-mag.gif - Deleted C:\WINDOWS\qpcjpkct\poloska1.png - Deleted C:\WINDOWS\qpcjpkct\poloska2.png - Deleted C:\WINDOWS\qpcjpkct\poloska3.png - Deleted C:\WINDOWS\qpcjpkct\promowp1.html - Deleted C:\WINDOWS\qpcjpkct\promowp2.html - Deleted C:\WINDOWS\qpcjpkct\promowp3.html - Deleted C:\WINDOWS\qpcjpkct\promowp4.html - Deleted C:\WINDOWS\qpcjpkct\promowp5.html - Deleted C:\WINDOWS\qpcjpkct\reg.png - Deleted C:\WINDOWS\qpcjpkct\repair.png - Deleted C:\WINDOWS\qpcjpkct\scr-1.png - Deleted C:\WINDOWS\qpcjpkct\scr-2.png - Deleted C:\WINDOWS\qpcjpkct\start.png - Deleted C:\WINDOWS\qpcjpkct\styles.css - Deleted C:\WINDOWS\qpcjpkct\top-rc.gif - Deleted C:\WINDOWS\qpcjpkct\vline.gif - Deleted C:\WINDOWS\qpcjpkct\wp.png - Deleted C:\WINDOWS\system32\CbEvtSvc.exe - Deleted Removing Temp Files ADS Check : Final Check : catchme 0.3.1344.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-03-15 00:16:34 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden services & system hive ... scanning hidden registry entries ... [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Autop layHandlers\CancelAutoplay\CLSID] "\30 A?E?2?A?E?D?8?F?-?5?6?9?5?-?4?a?6?d?-?9?7?0?9?-?1?4?E?5?1?C?D?1?7?B?1?C?'?"="" scanning hidden files ... scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 Remaining Services : Authorized Application Key Export: [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameter s\firewallpolicy\standardprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enable d:@xpsp2res.dll,-22019" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameter s\firewallpolicy\domainprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enable d:@xpsp2res.dll,-22019" Remaining Files : File Backups: - C:\SDFix\backups\backups.zip Files with Hidden Attributes : Tue 28 Aug 2007 4 A..H. --- "C:\WINDOWS\uccspecb.sys" Thu 31 May 2007 1,758,800 ...H. --- "C:\Program Files\7 Lands\7Lands.exe" Mon 10 Sep 2007 26,260,808 ...H. --- "C:\Program Files\Cafe Mahjongg\cafe mahjongg.exe" Fri 4 May 2007 954,368 ...H. --- "C:\Program Files\Luxor Mahjong\Luxor Mahjong.exe" Wed 6 Jun 2007 1,574,480 ...H. --- "C:\Program Files\Magic Tale\Magic Tale.exe" Sun 13 May 2007 4,348 ..SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak" Fri 15 Jul 2005 4,348 A..H. --- "C:\Documents and Settings\Chum Family\License Backup\drmv1key.bak" Fri 20 Apr 2007 20 A..H. --- "C:\Documents and Settings\Chum Family\License Backup\drmv1lic.bak" Sat 10 Mar 2007 10,060 A.SH. --- "C:\Documents and Settings\Chum Family\License Backup\drmv2key.bak" Fri 25 May 2007 0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv02.tmp" Sun 13 May 2007 4,348 A..H. --- "C:\Documents and Settings\Chum Family\My Documents\License Backup\drmv1key.bak" Sun 13 May 2007 20 A..H. --- "C:\Documents and Settings\Chum Family\My Documents\License Backup\drmv1lic.bak" Sun 13 May 2007 400 A.SH. --- "C:\Documents and Settings\Chum Family\My Documents\License Backup\drmv2key.bak" Fri 14 Mar 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\585dc2612ebcefc90e7dee4c276ee95e\ BIT3.tmp" Fri 14 Mar 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\a877011d990fb4875b54ce0706b47f90\ BIT4.tmp" Wed 12 Mar 2008 3,691 ...HR --- "C:\Documents and Settings\Chum Family\Application Data\SecuROM\UserData\securom_v7_01.bak" Finished! Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 12:21:28 AM, on 3/15/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\System32\CTsvcCDA.exe C:\Program Files\nHancer 32bit\nHancerService.exe C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\System32\MsPMSPSv.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Creative\SBAudigy2ZS\Surround Mixer\CTSysVol.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1 O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy2ZS\Surround Mixer\CTSysVol.exe /r O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKCU\..\Run: [NVIDIA nTune] "C:\Program Files\NVIDIA Corporation\nTune\nTuneCmd.exe" clear O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {0D6709DD-4ED8-40CA-B459-2757AEEF7BEE} (Dldrv2 Control) - http://download.gigabyte.com.tw/object/Dldrv.ocx O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll O16 - DPF: {38F5F92F-BD40-40DF-A569-6C1FCB638190} (InSPECS3_0 Control) - http://www.mushkin.com/_detect/InSPECS3_0.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/micr...?1184214392984 O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.systemrequirementslab.com/sysreqlab2.cab O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/micr...?1184214368265 O16 - DPF: {74C861A1-D548-4916-BC8A-FDE92EDFF62C} - http://mediaplayer.walmart.com/installer/install.cab O16 - DPF: {9522B3FB-7A2B-4646-8AF6-36E7F593073C} (cpbrkpie Control) - http://a19.g.akamai.net/7/19/7125/40...ft/Coupons.cab O16 - DPF: {ED28050F-D713-43BA-A376-DCC5C35407D5} (MsnMusicAx Class) - http://entimg.msn.com/client/msnmusax5217.cab O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll O23 - Service: CAISafe - Computer Associates International, Inc. - C:\Program Files\Yahoo!\Antivirus\ISafe.exe O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe O23 - Service: Diskeeper - Executive Software International, Inc. - C:\Program Files\Executive Software\DiskeeperLite\DKService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe O23 - Service: nHancer Support (nHancer) - KSE - Korndörfer Software Engineering - C:\Program Files\nHancer 32bit\nHancerService.exe O23 - Service: nTune Service (nTuneService) - NVIDIA - C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: SiSoftware Database Agent Service (SandraDataSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite XI.SP1a\Win32\RpcDataSrv.exe O23 - Service: SiSoftware Sandra Agent Service (SandraTheSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite XI.SP1a\RpcSandraSrv.exe O23 - Service: VET Message Service (VETMSGNT) - Computer Associates International, Inc. - C:\Program Files\Yahoo!\Antivirus\VetMsg.exe -- End of file - 5059 bytes
__________________ Chum  |
| |
15-Mar-2008, 02:58 AM
#17 | |||||
| Hi, If you see this, I have had to add some items to the codebox below...make sure you re-run ComboFix with this new script, then post the log, I am sorry I missed these and hit the Reply button too soon! So what do you think about the keylogger, was it installed by someone, or just came in with the malware load? Combofix shows it's date of creaton as 2008-03-14 (Friday) We can wait on that one anyway.
----------------------------------------------------------- Open notepad and copy/paste the text in the codebox below into it: Save this as CFScript.txt and, Save As Type: All Files (*.*) Code: KILLALL:: File:: C:\WINDOWS\OHIHMHMJ.DLL C:\WINDOWS\OHIHMHMJ.DLL C:\WINDOWS\crgxcfmn.exe C:\Documents and Settings\All Users\Application Data\mncpslih.dll RenV:: C:\unzipped\Fantasy_7775\Unicorn Paradise .exe Folder:: C:\WINDOWS\qpcjpkct C:\WINDOWS\fvtkqajp C:\Program Files\stc C:\Program Files\180solutions C:\Program Files\180searchassistant Registry:: [-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\mncpslih] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer\run] "Ysuq7w51iJ"=- Then drag the CFScript.txt into ComboFix.exe as you see in the screenshot below.  This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply together with a new HijackThis log.
__________________ Mung (computer term), the act of making several incremental changes to an item that combine to destroy it Donate directly to help the site TSG Library TSG's Welcome Guide- Tips, Rules, How to use TSG and more! Last edited by Byteman; 15-Mar-2008 at 03:16 AM.. |
15-Mar-2008, 03:16 AM
#18 | |||||
|
__________________ Mung (computer term), the act of making several incremental changes to an item that combine to destroy it Donate directly to help the site TSG Library TSG's Welcome Guide- Tips, Rules, How to use TSG and more! |
15-Mar-2008, 11:39 PM
#22 | |||||
|
__________________ Mung (computer term), the act of making several incremental changes to an item that combine to destroy it Donate directly to help the site TSG Library TSG's Welcome Guide- Tips, Rules, How to use TSG and more! |
18-Mar-2008, 01:51 AM
#24 | |||||
|
__________________ Mung (computer term), the act of making several incremental changes to an item that combine to destroy it Donate directly to help the site TSG Library TSG's Welcome Guide- Tips, Rules, How to use TSG and more! Last edited by Byteman; 18-Mar-2008 at 02:05 AM.. |
18-Mar-2008, 07:33 PM
#25 | |||||
|
__________________ Mung (computer term), the act of making several incremental changes to an item that combine to destroy it Donate directly to help the site TSG Library TSG's Welcome Guide- Tips, Rules, How to use TSG and more! |
19-Mar-2008, 03:45 PM
#27 | |||||
| Hi, First, please post a brand new Hijackthis log....I will take a look at it. [color=blue][b]Please wait until I have posted back Make sure these settings are done: Quote:
Open Windows Explorer and go to C:\Program Files\Sysmnt\Unins000.exe that or a similar looking uninstaller file should be there, please try again to see if one is present...if there is not any uninstaller, or it does not work, do this please: We are going to again run ComboFix....you MUST do the turning off of protective programs, using the list in the link below as guide, before running ComboFix (each time):
-----------------------------------------------------------
Open notepad and copy/paste the text in the codebox below into it: Quote:
Then drag the CFScript.txt into ComboFix.exe as you see in the screenshot below. This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply.
__________________ Mung (computer term), the act of making several incremental changes to an item that combine to destroy it Donate directly to help the site TSG Library TSG's Welcome Guide- Tips, Rules, How to use TSG and more! |
 |
| |
| Currently Active Users Viewing This Thread: 1 (0 members and 1 guests) | |
| Thread Tools | |
| |
| You Are Using:  |
Advertisements do not imply our endorsement of that product or service. All times are GMT -4. The time now is 04:05 PM. Copyright © 1996 - 2011 TechGuy, Inc. All rights reserved. |  |
Facebook
Twitter
TechGuy.tv
TSG Mobile