Advertisement
Advertisement
 Search | |
| |
31-Jul-2008, 06:08 AM
#1 | |||||||
| Solved: buritos.exe Hi Everyone, I have been infected by a very sticky Trogen. It came in a email that posed as an invoice from UPS and was sent from a college. Unfortunatly due to the fact I had not had sleep in 36 hours (Just come home from my first daughters birth) when I read my email I opened the zip file and clicked on the file that said something like Invoice.exe. Note something I would usually do I can assure you. When the file didnt open the invoice and my PC started shutting down. I suddenly realized what I'd clicked on  and turned of the PC  . The next day I went about trying to remove the Trogen. I found the following extra tasks were being launched... buritos.exe (HKLM\...\run) - Located in c:\Windows\buritos.exe braviax.exe (HKLM\...\run) - Located in c:\Windows\System32\braviax.exe lphc5joj0ea2r.exe (HKLM\...\run) - Located in c:\Windows\System32\lphc5joj0ea2r.exe rhc1joj0ea2r.exe (HKCU\...\run) - Located in c:\Program Files\rhc1joj0ea2r\rhc1joj0ea2r.exe 9.tmp (Changes every time the system restarts & is running as the SYSTEM user - I cannot find its mount point) I installed and run the HijackThis but nothing happens. Both the latest version and 1.99.1 So I went to safe mode and tried removing the files manually. When I restarted and logged back in as the infected user it got most upset and shut down the computer. I then created a limited user and a Administrator in safe mode, restarted and logged back in. So far it has not logged me out again. All the tasks have re-appeared! The trogen has installed a fake spyware removal tool I have seen in the past, it has a red cross icon in the task bar and tells the user "Your Computer is Infected ..... etc" then says click here to remove it. The desktop image has been changed to say "Warning spyware detected on your computer. Install an antivirus or spyware remover to clean your computer". It is on a blue background with yellow. This message also shows just before the windows login screen shows when the computer starts up! Adaware detected something but had no idea what it was and asked me to send details. I did not remove it. This is a worrying Trojen and I cannot find a solution on the NET! I will check back on this thread every few days to see what people have to say. Sorry I would check more often but I'm a bit busy at the moment what with a new baby girl and all.  Thanks for taking the time to read my post.  Last edited by robin.alden; 31-Jul-2008 at 06:19 AM.. |
01-Aug-2008, 08:35 PM
#2 | |||||||
 HijackThis Log OK, I have added a HijackThis log. I had to rename HijackThis.exe to get it to work. I also renamed the folders it was in too just in case. (Thanks to PCcruncher for this advice ).I also noticed tanker guy managed to remove this infection using this program http://www.malwarebytes.org/mbam.php. I have decided not to remove the infection yet incase there is anything to be learnt from my logs. Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 12:23:27 p.m., on 2/08/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16674) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\eHome\ehRecvr.exe C:\WINDOWS\eHome\ehSched.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Live Mesh\Remote Desktop\wlcrasvc.exe C:\WINDOWS\system32\SearchIndexer.exe C:\WINDOWS\ehome\mcrdsvc.exe C:\WINDOWS\system32\dllhost.exe C:\WINDOWS\System32\alg.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\rsvp.exe C:\Program Files\Google\Update\GoogleUpdate.exe C:\WINDOWS\TEMP\D585.tmp C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\lphc5joj0ea2r.exe C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\system32\SearchProtocolHost.exe C:\WINDOWS\system32\SearchFilterHost.exe C:\Program Files\Trend Micros\aHijackThis\Temp.exe C:\WINDOWS\system32\wbem\wmiprvse.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=74005 F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\ntos.exe, O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll O3 - Toolbar: Viewpoint Toolbar - {F8AD5AA5-D966-4667-9DAF-2561D68B2012} - C:\Program Files\Common Files\Viewpoint\Toolbar Runtime\3.8.0\IEViewBar.dll O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto O4 - HKLM\..\Run: [braviax] C:\WINDOWS\system32\braviax.exe O4 - HKLM\..\Run: [lphc5joj0ea2r] C:\WINDOWS\system32\lphc5joj0ea2r.exe O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-18\..\Run: [Nokia.PCSync] "C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" /NoDialog (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [Nokia.PCSync] "C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" /NoDialog (User 'Default user') O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_04\bin\npjpi160_04.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_04\bin\npjpi160_04.dll O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\PROGRA~1\Skype\Phone\IEPlugin\SKYPEI~1.DLL O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://appldnld.apple.com.edgesuite....x/qtplugin.cab O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www4.snapfish.co.nz/SnapfishActivia.cab O16 - DPF: {4871A87A-BFDD-4106-8153-FFDE2BAC2967} (DLM Control) - http://dlm.tools.akamai.com/dlmanage...ex-2.2.3.5.cab O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w2/resources/MSNPUpld.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/ge...nt/swflash.cab O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O20 - AppInit_DLLs: karina.dat O20 - Winlogon Notify: crypt - C:\WINDOWS\SYSTEM32\crypts.dll O20 - Winlogon Notify: wlcrdplauncher - C:\Program Files\Live Mesh\Remote Desktop\wlcrdplauncher.dll O23 - Service: Google Update Service (gupdate1c8d8c839b4ffe2) (gupdate1c8d8c839b4ffe2) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe -- End of file - 5268 bytes Last edited by robin.alden; 02-Aug-2008 at 05:22 PM.. |
01-Aug-2008, 09:38 PM
#3 | |||||||
 Blue screen Hmm, went to bath the baby came back and my pc had a blue screen stating something like WQL_IRL or similar . I pressed <CTRL> <ALT> <DEL> and the windows startup screen (the one with the windows logo and the progress bar) was showing but with like EGA colors . I hit ESC and the login screen appeared.The login screen still had me logged in  with the applications I was using showing as running (4 running tasks). I logged in and everything is back as I left the PC 20mins ago.I'm guessing the PC tried to go to standby and the infection didn't like that. I have never before seen a PC recover from a blue screen. I have disabled my data partition as I have seen talk of buritos.exe killing files. The worst that can happen now is the infection destroys the windows partition or perhaps my MBR. Last edited by robin.alden; 02-Aug-2008 at 05:23 PM.. Reason: I found the key when it happened again. |
04-Aug-2008, 02:42 AM
#5 | |||||||
| Virus Program Hi AcaCandy. I dont usually run a anti virus as I dont typically do things that attract viruses. Unfortunatly on this occasion due to sleep deprivation I was caught out.  |
07-Aug-2008, 05:56 AM
#7 | |||||||
 Looking better Hi cybertech, Well thats better. I ran SDFix (had to rename it to make it start). When it finished I noticed it had killed all the nasty tasks bar one that was still showing in the Task Manager (lphc5joj02a2r.exe). I plugged the Internet back in so I could post the results. About 30 secs after I did that the fake antivirus application had downloaded again and most of the tasks were back. I was curious to know where the program came from so I re-ran SDFix and this time before I re-connected the network I started a network packet sniffer. The Trogen contacted "www . avpx2008 . com" using HTTP and downloaded enough data to install the fake virus and associated tasks, then they showed up in the Task Manager. I have the etherreal logs if you want them. Next I ran combofix.exe (which I didn't need to rename) by dropping the XP Boot disk image onto ComboFix.exe as per the instructions. Now all the offending tasks appear to have been cleaned and my computer is back to peace and quiet free from nasties. I have attached the Logs in the following posts. Hopefully it is now all clean. If so thanks for the help , If not what next? |
07-Aug-2008, 05:57 AM
#8 | |||||||
| SDFix Report SDFix: Version 1.213 Run by Administrator on Wed 06/08/2008 at 10:09 p.m. Microsoft Windows XP [Version 5.1.2600] Running From: C:\SDFix Checking Services : Restoring Default Security Values Restoring Default Hosts File Restoring Default Desktop Wallpaper Resetting AppInit_DLLs value Rebooting Infected beep.sys Found! beep.sys File Locations: "C:\WINDOWS\system32\dllcache\beep.sys" 27648 29/07/2008 10:24 a.m. "C:\WINDOWS\system32\drivers\beep.sys" 27648 29/07/2008 10:24 a.m. Infected File Listed Below: C:\WINDOWS\system32\dllcache\beep.sys C:\WINDOWS\system32\drivers\beep.sys File copied to Backups Folder Attempting to replace beep.sys with original version Original beep.sys Restored "C:\WINDOWS\system32\dllcache\beep.sys" 4224 03/08/2008 04:05 a.m. "C:\WINDOWS\system32\drivers\beep.sys" 4224 03/08/2008 04:05 a.m. Checking Files : Trojan Files Found: C:\Program Files\rhc1joj0ea2r\database.dat - Deleted C:\Program Files\rhc1joj0ea2r\license.txt - Deleted C:\Program Files\rhc1joj0ea2r\MFC71.dll - Deleted C:\Program Files\rhc1joj0ea2r\MFC71ENU.DLL - Deleted C:\Program Files\rhc1joj0ea2r\msvcp71.dll - Deleted C:\Program Files\rhc1joj0ea2r\msvcr71.dll - Deleted C:\Program Files\rhc1joj0ea2r\rhc1joj0ea2r.exe - Deleted C:\Program Files\rhc1joj0ea2r\rhc1joj0ea2r.exe.local - Deleted C:\Program Files\rhc1joj0ea2r\Uninstall.exe - Deleted C:\WINDOWS\SYSTEM32\PPHC5J~1.EXE - Deleted C:\WINDOWS\SYSTEM32\PHC5JO~1.BMP - Deleted C:\Documents and Settings\All Users\Start Menu\Programs\Antivirus XP 2008\Antivirus XP 2008.lnk - Deleted C:\Documents and Settings\All Users\Start Menu\Programs\Antivirus XP 2008\How to Register Antivirus XP 2008.lnk - Deleted C:\Documents and Settings\All Users\Start Menu\Programs\Antivirus XP 2008\License Agreement.lnk - Deleted C:\Documents and Settings\All Users\Start Menu\Programs\Antivirus XP 2008\Register Antivirus XP 2008.lnk - Deleted C:\Documents and Settings\All Users\Start Menu\Programs\Antivirus XP 2008\Uninstall.lnk - Deleted C:\WINDOWS\system32\12.tmp - Deleted C:\Documents and Settings\All Users\Desktop\Antivirus XP 2008.lnk - Deleted C:\Documents and Settings\All Users\Start Menu\Programs\Antivirus XP 2008.lnk - Deleted C:\WINDOWS\buritos.exe - Deleted C:\WINDOWS\cru629.dat - Deleted C:\WINDOWS\karina.dat - Deleted C:\WINDOWS\system32\braviax.exe - Deleted C:\WINDOWS\system32\buritos.exe - Deleted C:\WINDOWS\system32\cru629.dat - Deleted C:\WINDOWS\system32\crypts.dll - Deleted C:\WINDOWS\system32\delself.bat - Deleted C:\WINDOWS\system32\karina.dat - Deleted C:\WINDOWS\system32\winivstr.exe - Deleted C:\WINDOWS\system32\ntos.exe - Deleted C:\Documents and Settings\Limited User\Application Data\wsnpoem\audio.dll.cla - Deleted C:\WINDOWS\system32\wsnpoem\audio.dll.cla - Deleted C:\Documents and Settings\Limited User\Application Data\wsnpoem\video.dll - Deleted C:\WINDOWS\system32\wsnpoem\video.dll - Deleted C:\Documents and Settings\Limited User\Application Data\wsnpoem\audio.dll - Deleted C:\WINDOWS\system32\wsnpoem\audio.dll - Deleted Folder C:\Documents and Settings\All Users\Start Menu\Programs\Antivirus XP 2008 - Removed Folder C:\WINDOWS\system32\wsnpoem - Removed Removing Temp Files ADS Check : Final Check : catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-08-06 23:29:52 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden services & system hive ... [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Key s\000a3a639c7c] "000d3aa752e4"=hex:0a,1d,d7,f7,6d,12,df,ac,66,9b,65,02,fd,b8,55,b6 "0007a4b64478"=hex:23,ed,1b,2d,4b,a0,1b,49,d9,7e,63,e3,93,75,71,5d [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Key s\000d3aa7bc1d] "00092d04f89f"=hex:7f,f2,26,2c,be,7a,12,3f,44,32,90,b5,3b,e2,cf,a9 "000d3aa752e4"=hex:7b,27,c6,07,44,65,ee,28,73,32,c0,0f,17,60,59,dc "001e3a7cd256"=hex:c6,33,d1,3a,a8,62,8c,fc,51,fa,3f,0a,01,81,6e,1e [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\d347prt\Cfg\0Jf40] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Epoch] "Epoch"=dword:00008bea [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg] "s0"=dword:d71ec9a2 "s1"=dword:a8020f67 "s2"=dword:7152433a "h0"=dword:00000001 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED6 1418462E24595C90D04] "p0"="C:\Program Files\Alcohol Soft\Alcohol 52\" "h0"=dword:00000000 "ujdew"=hex:e7,6d,ed,bc,5d,89,93,fd,62,47,1b,9a,6c,e8,14,e3,44,c7,09,49,45, .. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Inter faces\{3D7F9281-6AFB-4AC3-A2C0-D117C80816FC}] "LeaseObtainedTime"=dword:48998ab3 "T1"=dword:48998b32 "T2"=dword:48998b92 "LeaseTerminatesTime"=dword:48998bb2 "DhcpRetryTime"=dword:0000007e [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\{3D7F9281-6AFB-4AC3-A2C0-D117C80816FC}\Parameters\Tcpip] "LeaseObtainedTime"=dword:48998ab3 "T1"=dword:48998b32 "T2"=dword:48998b92 "LeaseTerminatesTime"=dword:48998bb2 [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\BTHPORT\Parameters\Keys\00 0a3a639c7c] "000d3aa752e4"=hex:0a,1d,d7,f7,6d,12,df,ac,66,9b,65,02,fd,b8,55,b6 "0007a4b64478"=hex:23,ed,1b,2d,4b,a0,1b,49,d9,7e,63,e3,93,75,71,5d [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\BTHPORT\Parameters\Keys\00 0d3aa7bc1d] "00092d04f89f"=hex:7f,f2,26,2c,be,7a,12,3f,44,32,90,b5,3b,e2,cf,a9 "000d3aa752e4"=hex:7b,27,c6,07,44,65,ee,28,73,32,c0,0f,17,60,59,dc "001e3a7cd256"=hex:c6,33,d1,3a,a8,62,8c,fc,51,fa,3f,0a,01,81,6e,1e [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\0D79C293C1ED61418 462E24595C90D04] "p0"="C:\Program Files\Alcohol Soft\Alcohol 52\" "h0"=dword:00000000 "ujdew"=hex:e7,6d,ed,bc,5d,89,93,fd,62,47,1b,9a,6c,e8,14,e3,44,c7,09,49,45, .. scanning hidden registry entries ... scanning hidden files ... scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 Remaining Services : Authorized Application Key Export: [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameter s\firewallpolicy\standardprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enable d:@xpsp2res.dll,-22019" "C:\\Program Files\\InterVideo\\DVD7\\WinDVD.exe"="C:\\Program Files\\InterVideo\\DVD7\\WinDVD.exe:*  isabled:WinDVD""O:\\Games\\UT2003\\System\\UT2003.exe"="O:\\Games\\UT2003\\System\\UT2003. exe:*:Enabled:UT2003" "C:\\Program Files\\EA GAMES\\Battlefield 2\\bf2_w32ded.exe"="C:\\Program Files\\EA GAMES\\Battlefield 2\\bf2_w32ded.exe:*:Enabled:bf2_w32ded" "C:\\Program Files\\SiSoftware\\SiSoftware Sandra Lite 2007.SP1\\sandra.exe"="C:\\Program Files\\SiSoftware\\SiSoftware Sandra Lite 2007.SP1\\sandra.exe:*:Enabled:SiSoftware Sandra Lite" "C:\\Program Files\\SiSoftware\\SiSoftware Sandra Lite 2007.SP1\\RpcSandraSrv.exe"="C:\\Program Files\\SiSoftware\\SiSoftware Sandra Lite 2007.SP1\\RpcSandraSrv.exe:*:Enabled:SiSoftware Sandra Lite" "C:\\Program Files\\SiSoftware\\SiSoftware Sandra Lite 2007.SP1\\Win32\\RpcDataSrv.exe"="C:\\Program Files\\SiSoftware\\SiSoftware Sandra Lite 2007.SP1\\Win32\\RpcDataSrv.exe:*:Enabled:SiSoftware Sandra Lite" "C:\\Program Files\\EA GAMES\\Battlefield 2\\BF2.exe"="C:\\Program Files\\EA GAMES\\Battlefield 2\\BF2.exe:*:Enabled:Battlefield 2" "C:\\Program Files\\TOCA III\\RD3.exe"="C:\\Program Files\\TOCA III\\RD3.exe:*:Enabled:Launch ToCA Race Driver 3." "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" "C:\\Program Files\\Messenger\\msmsgs.exe"="C:\\Program Files\\Messenger\\msmsgs.exe:*:Enabled:Windows Messenger" "C:\\Program Files\\Firaxis Games\\Sid Meier's Civilization 4\\Civilization4.exe"="C:\\Program Files\\Firaxis Games\\Sid Meier's Civilization 4\\Civilization4.exe:*:Enabled:Sid Meier's Civilization 4" "C:\\Program Files\\Firaxis Games\\Sid Meier's Civilization 4\\Warlords\\Civ4Warlords.exe"="C:\\Program Files\\Firaxis Games\\Sid Meier's Civilization 4\\Warlords\\Civ4Warlords.exe:*:Enabled:Sid Meier's Civilization 4 Warlords" "C:\\Program Files\\Firaxis Games\\Sid Meier's Civilization 4\\Warlords\\Civ4Warlords_PitBoss.exe"="C:\\Program Files\\Firaxis Games\\Sid Meier's Civilization 4\\Warlords\\Civ4Warlords_PitBoss.exe:*:Enabled:Sid Meier's Civilization 4 Pitboss" "C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"="C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook" "C:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"="C:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE:*:Enabled:Microsoft Office Groove" "C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"="C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE:*:Enabled:Microsoft Office OneNote" "O:\\Games\\World In Conflict\\Installed\\wic.exe"="O:\\Games\\World In Conflict\\Installed\\wic.exe:*:Enabled:World in Conflict" "O:\\Games\\World In Conflict\\Installed\\wic_online.exe"="O:\\Games\\World In Conflict\\Installed\\wic_online.exe:*:Enabled:World in Conflict - Online Only" "O:\\Games\\World In Conflict\\Installed\\wic_ds.exe"="O:\\Games\\World In Conflict\\Installed\\wic_ds.exe:*:Enabled:World in Conflict - Dedicated Server" "C:\\Program Files\\Joost\\xulrunner\\tvprunner.exe"="C:\\Program Files\\Joost\\xulrunner\\tvprunner.exe:*:Enabled:tvprunner" "C:\\Program Files\\Bonjour\\mDNSResponder.exe"="C:\\Program Files\\Bonjour\\mDNSResponder.exe:*:Enabled:Bonjour" "C:\\Program Files\\iTunes\\iTunes.exe"="C:\\Program Files\\iTunes\\iTunes.exe:*:Enabled:iTunes" "O:\\Programs\\Autodesk\\Backburner\\monitor.exe"="O:\\Programs\\Autodesk\\ Backburner\\monitor.exe:*:Enabled:backburner 2.3 monitor" "O:\\Programs\\Autodesk\\Backburner\\manager.exe"="O:\\Programs\\Autodesk\\ Backburner\\manager.exe:*:Enabled:backburner 2.3 manager" "O:\\Programs\\Autodesk\\Backburner\\server.exe"="O:\\Programs\\Autodesk\\B ackburner\\server.exe:*:Enabled:backburner 2.3 server" "O:\\Programs\\Autodesk\\3D Studio Max\\3dsmax.exe"="O:\\Programs\\Autodesk\\3D Studio Max\\3dsmax.exe:*:Enabled:Autodesk 3ds Max 2008 32-bit" "C:\\Documents and Settings\\MediaCenter\\Local Settings\\Application Data\\Microsoft\\Live Mesh\\GacBase\\Moe.exe"="C:\\Documents and Settings\\MediaCenter\\Local Settings\\Application Data\\Microsoft\\Live Mesh\\GacBase\\Moe.exe:*:Enabled:Live Mesh" "C:\\Program Files\\Skype\\Phone\\Skype.exe"="C:\\Program Files\\Skype\\Phone\\Skype.exe:*:Enabled:Skype" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameter s\firewallpolicy\domainprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enable d:@xpsp2res.dll,-22019" "C:\\Program Files\\SiSoftware\\SiSoftware Sandra Lite 2007.SP1\\sandra.exe"="C:\\Program Files\\SiSoftware\\SiSoftware Sandra Lite 2007.SP1\\sandra.exe:*:Enabled:SiSoftware Sandra Lite" "C:\\Program Files\\SiSoftware\\SiSoftware Sandra Lite 2007.SP1\\RpcSandraSrv.exe"="C:\\Program Files\\SiSoftware\\SiSoftware Sandra Lite 2007.SP1\\RpcSandraSrv.exe:*:Enabled:SiSoftware Sandra Lite" "C:\\Program Files\\SiSoftware\\SiSoftware Sandra Lite 2007.SP1\\Win32\\RpcDataSrv.exe"="C:\\Program Files\\SiSoftware\\SiSoftware Sandra Lite 2007.SP1\\Win32\\RpcDataSrv.exe:*:Enabled:SiSoftware Sandra Lite" "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" Remaining Files : File Backups: - C:\SDFix\backups\backups.zip Files with Hidden Attributes : Tue 1 Jan 2008 56 A.SH. --- "C:\Documents and Settings\All Users\Application Data\dc64vg9.sys" Sun 4 Jun 2006 4,348 A.SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak" Sun 4 Jun 2006 401 A.SH. --- "C:\Documents and Settings\All Users\DRM\DRMv13.bak" Mon 18 Dec 2006 0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp" Wed 19 Apr 2006 4,348 A..H. --- "C:\Documents and Settings\MediaCenter\My Documents\License Backup\drmv1key.bak" Wed 19 Apr 2006 401 A..H. --- "C:\Documents and Settings\MediaCenter\My Documents\License Backup\drmv1lic.bak" Mon 6 Feb 2006 312 A.SH. --- "C:\Documents and Settings\MediaCenter\My Documents\License Backup\drmv2key.bak" Fri 14 Dec 2007 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\0a67b6c406b1d7e0f5c1e6f6d44a3f6e\ BIT7.tmp" Fri 14 Dec 2007 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\26924cbc8132a10b438ce6e2b49d4652\ BIT5.tmp" Fri 14 Dec 2007 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\2769b111678c52099a3b3123b12f2325\ BIT9.tmp" Mon 28 Apr 2008 7,134,072 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\932c84dd1bf7c1257fcc650981219d45\ BIT6A0.tmp" Fri 14 Dec 2007 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\b69c46c5109d0f8b0dee9fab84906813\ BIT8.tmp" Mon 28 Jan 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\bc066f3f60df1b38218903dd0d40ce98\ BIT6.tmp" Tue 29 Apr 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\be9cebb68dd8282073067488451b3f0b\ BIT8.tmp" Fri 14 Dec 2007 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\d77b9b5b8fed23dd91f50d167cce60d3\ BITA.tmp" Mon 28 Apr 2008 13,293,000 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\e598a7d762acb3677048798428b92f3f\ BIT6A1.tmp" Fri 14 Dec 2007 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\fa6c916bb150f8a929e7a4ffdfbc120f\ BIT6.tmp" Thu 8 May 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\fd0264849c01086f3c6b505dc02dbd44\ BIT5.tmp" Sun 6 Jul 2008 77,312 ...H. --- "C:\Documents and Settings\MediaCenter\Application Data\Microsoft\Word\~WRL0003.tmp" Sat 6 Oct 2007 888 ...HR --- "C:\Documents and Settings\MediaCenter\Application Data\SecuROM\UserData\securom_v7_01.bak" Sat 3 May 2008 79,872 ...H. --- "C:\Documents and Settings\MediaCenter\Local Settings\Temporary Internet Files\Content.MSO\~WRL0005.tmp" Wed 6 Aug 2008 5,946 A.SH. --- "C:\Documents and Settings\All Users\Documents\Recorded TV\TempRec\TempSBE\SBE4.tmp" Wed 6 Aug 2008 5,946 A.SH. --- "C:\Documents and Settings\All Users\Documents\Recorded TV\TempRec\TempSBE\SBE5.tmp" Finished! |
07-Aug-2008, 05:58 AM
#9 | |||||||
| ComboFix Report |
07-Aug-2008, 06:00 AM
#10 | |||||||
| HijackThis Report |
07-Aug-2008, 02:37 PM
#11 | ||||||
| Print these instructions or save them to Notepad!
Quote:
 Then drag the CFScript.txt into the ComboFix.exe as shown in the screenshot below. This will start ComboFix again. It may ask to reboot. Post the contents of Combofix.txt in your next reply.  Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version of Java components and upgrade the application. Beware it is NOT supported for use in 9x or ME and probably will not install in those systemsUpgrading Java:
I don't see any anti-virus software running. Go >>here<< and select one of the free anti-virus programs to load. Run Malwarebytes and post the resulting log with a new Hijackthis log and the ComboFix log. |
15-Aug-2008, 08:10 PM
#12 | |||||||
| Done and new Logs |
15-Aug-2008, 08:11 PM
#13 | |||||||
| Combofix Log |
15-Aug-2008, 08:12 PM
#14 | |||||||
| HijackThis log |
Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.
If you're not already familiar with forums, watch our Welcome Guide to get started.
| |
| Currently Active Users Viewing This Thread: 1 (0 members and 1 guests) | |
| Thread Tools | |
| |
