Login | Live Chat & Podcast at 1:00PM Eastern on Sunday! |
 Search | |
| |
25-Oct-2009, 03:35 PM
#1 | |||||
| What is this error message ? Virus maybe ? Last edited by kleinconejos23; 26-Oct-2009 at 01:19 AM.. |
| |
26-Oct-2009, 01:21 AM
#2 | |||||
| |
28-Oct-2009, 12:40 AM
#3 | |||||
| |
06-Nov-2009, 09:30 AM
#4 | |||||
| Please reply.  |
08-Nov-2009, 05:59 PM
#5 | ||||||
| Welcome to TSG  Download Combofix from this webpage: http://www.bleepingcomputer.com/comb...o-use-combofix **Note: It is important that it is saved directly to your desktop** -------------------------------------------------------------------- 1. Close any open browsers. 2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix. -------------------------------------------------------------------- Double click on combofix.exe & follow the prompts.
Do not mouseclick combofix's window while it's running. That may cause it to stall
__________________ Microsoft Valuable Professional Consumer--Security 2007-2010 Please make a donation to keep the site running. All proceeds go directly to the site!!! Donate Here |
13-Nov-2009, 10:06 PM
#6 | |||||
| Thank God there is someone who replied to my post. And I manage to let my computer show the hidden files and folders with this step i found in Google. Quote:
Quote:
Here is my ComboFix log. Code: ComboFix 09-11-13.04 - Administrator 11/13/2009 18:34.1.1 - NTFSx86 NETWORK
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.958.772 [GMT 8:00]
Running from: c:\documents and settings\Administrator\My Documents\Downloads\Programs\ComboFix.exe
AV: avast! antivirus 4.8.1351 [VPS 091112-1] *On-access scanning enabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\explore.exe
c:\windows\system\services.exe
c:\windows\system32\drivers\system.exe
c:\windows\system32\msupdte.exe
c:\windows\winlogon.exe
.
((((((((((((((((((((((((( Files Created from 2009-10-13 to 2009-11-13 )))))))))))))))))))))))))))))))
.
2009-11-13 09:29 . 2009-11-13 09:29 -------- d-----w- c:\program files\Trend Micro
2009-11-06 13:43 . 2009-11-06 14:04 -------- d-----w- c:\program files\DreamerRO
2009-11-05 16:30 . 2009-11-05 16:31 550230 ----a-w- c:\documents and settings\Administrator\Application Data\IDM\DwnlData\Administrator\RAG_SETUP0618_314\ RAG_SETUP0618.exe
2009-11-04 01:26 . 2009-11-04 01:26 -------- d-----w- c:\documents and settings\Administrator\Application Data\Micro-Sys
2009-11-04 01:26 . 2009-11-04 01:26 -------- d-----w- c:\program files\Micro-Sys Software
2009-10-31 01:17 . 2009-10-31 01:17 -------- d-----w- c:\documents and settings\Administrator\Application Data\Thinstall
2009-10-31 01:17 . 2009-10-31 01:17 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\Thinstall
2009-10-30 20:37 . 2009-10-30 20:37 -------- d-----w- C:\found.000
2009-10-26 09:02 . 2009-10-26 09:03 174203 ----a-w- c:\documents and settings\Administrator\Application Data\IDM\DwnlData\Administrator\FlyakiteOSXv3.5_28 5\FlyakiteOSXv3.5.exe
2009-10-22 13:21 . 2009-10-22 13:21 -------- d-----w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2009-10-22 13:21 . 2009-10-22 13:21 -------- d-----w- c:\program files\SUPERAntiSpyware
2009-10-22 13:21 . 2009-10-22 13:21 -------- d-----w- c:\documents and settings\Administrator\Application Data\SUPERAntiSpyware.com
2009-10-22 13:20 . 2009-10-22 13:20 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2009-10-21 06:28 . 2009-10-21 06:28 -------- d-----w- c:\documents and settings\Administrator\Application Data\2K Sports
2009-10-21 02:10 . 2009-10-21 02:10 -------- d--h--w- c:\documents and settings\All Users\Application Data\CanonIJSolutionMenu
2009-10-21 02:10 . 2009-10-21 02:10 -------- d--h--w- c:\documents and settings\All Users\Application Data\CanonIJMyPrinter
2009-10-21 02:10 . 2009-11-11 22:13 -------- d-----w- c:\documents and settings\All Users\Application Data\CanonIJPLM
2009-10-21 02:07 . 2009-10-21 02:07 -------- d--h--w- c:\documents and settings\All Users\Application Data\CanonBJ
2009-10-21 02:07 . 2008-03-11 05:00 230912 ----a-w- c:\windows\system32\CNMLM9M.DLL
2009-10-21 02:07 . 2009-10-21 02:07 -------- d--h--w- c:\windows\system32\CanonIJ Uninstaller Information
2009-10-21 02:07 . 2009-10-21 02:07 -------- d--h--w- c:\program files\CanonBJ
2009-10-21 02:06 . 2009-10-21 02:10 -------- d-----w- c:\program files\Canon
2009-10-20 01:29 . 2009-10-20 01:45 -------- d-----w- c:\program files\RegCure
2009-10-19 08:24 . 2009-10-19 08:24 -------- d-----w- C:\Documents
2009-10-18 01:16 . 2009-10-18 01:24 -------- d-----w- c:\documents and settings\Administrator\Application Data\dvdcss
2009-10-17 13:24 . 2009-11-10 08:40 -------- d-----w- c:\program files\infs4
2009-10-16 15:12 . 2009-10-16 15:13 171011 ----a-w- c:\documents and settings\Administrator\Application Data\IDM\DwnlData\Administrator\daemon4304-lite_238\daemon4304-lite.exe
2009-10-16 13:23 . 2009-10-16 13:23 -------- d-----w- c:\documents and settings\All Users\Application Data\NVIDIA
2009-10-16 10:26 . 2009-03-30 00:17 386378 --sha-r- c:\windows\system32\spoiler.exe
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))) ))
.
2009-11-13 10:27 . 2009-09-23 01:50 -------- d-----w- c:\documents and settings\Administrator\Application Data\uTorrent
2009-11-13 10:22 . 2009-09-11 14:41 -------- d-----w- c:\documents and settings\Administrator\Application Data\DMCache
2009-11-13 02:57 . 2009-10-14 05:41 -------- d-----w- c:\program files\BrazenRF Client
2009-11-12 00:59 . 2009-10-01 01:30 -------- d-----w- c:\program files\Diablo II
2009-11-12 00:01 . 2009-09-11 17:36 -------- d-----w- c:\program files\Cheat Engine
2009-10-31 01:19 . 2009-08-22 12:09 3199062 ------w- c:\documents and settings\Administrator\Application Data\Thinstall\Executable File Icons Changer\%drive_D%\sRO\SeiRO.exe
2009-10-29 03:43 . 2009-09-11 13:23 88232 ----a-w- c:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-10-28 15:20 . 2009-09-11 13:19 -------- d-----w- c:\documents and settings\Administrator\Application Data\U3
2009-10-27 00:27 . 2009-09-19 07:51 -------- d-----w- c:\documents and settings\Administrator\Application Data\Nero
2009-10-25 23:58 . 2009-09-19 10:39 45056 ----a-w- c:\windows\NCUNINST.EXE
2009-10-06 10:48 . 2009-10-06 10:48 -------- d-----w- c:\program files\Microsoft.NET
2009-10-06 10:46 . 2009-10-06 10:46 -------- d-----w- c:\program files\Microsoft ActiveSync
2009-10-04 22:19 . 2009-09-11 18:24 -------- d-----w- c:\program files\4t Tray Minimizer
2009-10-04 12:55 . 2009-09-25 11:28 -------- d-----w- c:\program files\Red Alert 2 Yuri's Revenge
2009-10-02 01:13 . 2009-10-02 01:13 -------- d-----w- c:\program files\HyCam2
2009-10-01 13:35 . 2009-10-01 01:17 249856 ------w- c:\windows\Setup1.exe
2009-10-01 13:35 . 2009-10-01 01:17 73216 ----a-w- c:\windows\ST6UNST.EXE
2009-10-01 02:30 . 2009-10-01 01:17 -------- d-----w- c:\program files\Hero Editor
2009-10-01 02:26 . 2009-10-01 02:14 36774 ----a-w- c:\windows\DIIUnin.dat
2009-10-01 02:14 . 2009-10-01 02:14 94208 ----a-w- c:\windows\DIIUnin.exe
2009-10-01 02:14 . 2009-10-01 02:14 2829 ----a-w- c:\windows\DIIUnin.pif
2009-10-01 01:40 . 2009-10-01 00:48 21840 ----atw- c:\windows\system32\SIntfNT.dll
2009-10-01 01:40 . 2009-10-01 00:48 17212 ----atw- c:\windows\system32\SIntf32.dll
2009-10-01 01:40 . 2009-10-01 00:48 12067 ----atw- c:\windows\system32\SIntf16.dll
2009-10-01 00:32 . 2009-10-01 00:27 -------- d-----w- c:\documents and settings\Administrator\Application Data\DAEMON Tools Lite
2009-10-01 00:30 . 2009-10-01 00:30 -------- d-----w- c:\documents and settings\All Users\Application Data\DAEMON Tools Lite
2009-10-01 00:30 . 2009-10-01 00:30 -------- d-----w- c:\program files\DAEMON Tools Toolbar
2009-10-01 00:30 . 2009-10-01 00:30 -------- d-----w- c:\program files\DAEMON Tools Lite
2009-10-01 00:27 . 2009-10-01 00:27 721904 ----a-w- c:\windows\system32\drivers\sptd.sys
2009-09-30 17:44 . 2009-09-30 17:44 43520 ----a-w- c:\windows\system32\CmdLineExt03.dll
2009-09-30 17:11 . 2009-09-30 17:11 -------- d-----w- c:\program files\PowerISO
2009-09-27 04:01 . 2009-09-27 04:01 -------- d-----w- c:\program files\Microsoft Silverlight
2009-09-23 01:50 . 2009-09-23 01:50 -------- d-----w- c:\program files\uTorrent
2009-09-21 05:40 . 2009-09-21 05:40 98304 ----a-w- c:\windows\system32\CmdLineExt.dll
2009-09-21 05:11 . 2009-09-21 05:11 -------- d-----w- c:\program files\Rockstar Games
2009-09-21 05:11 . 2009-09-11 13:10 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-09-20 04:39 . 2009-09-19 10:29 -------- d-----w- c:\documents and settings\Administrator\Application Data\Wildfire
2009-09-19 10:37 . 2009-09-19 10:37 -------- d-----w- c:\program files\Common Files\SWF Studio
2009-09-19 10:29 . 2009-09-19 10:29 4096 ----a-w- c:\windows\d3dx.dat
2009-09-19 07:20 . 2009-09-19 07:20 -------- d-----w- c:\documents and settings\kleinski\Application Data\Yahoo!
2009-09-19 00:56 . 2009-09-11 14:48 -------- d-----w- c:\documents and settings\All Users\Application Data\NOS
2009-09-18 04:22 . 2009-09-18 04:22 -------- d-----w- c:\documents and settings\All Users\Application Data\PlayFirst
2009-09-18 04:22 . 2009-09-18 04:22 -------- d-----w- c:\documents and settings\Administrator\Application Data\PlayFirst
2009-09-18 04:22 . 2009-09-18 04:19 -------- d-----w- c:\program files\Diner Dash Hometown Hero
2009-09-17 16:06 . 2009-09-17 16:06 -------- d-----w- c:\program files\Chikka Messenger
2009-09-16 15:02 . 2009-09-16 15:02 -------- d-----w- c:\program files\Common Files\INCA Shared
2009-09-15 11:18 . 2009-09-15 11:18 -------- d-----w- c:\program files\Common Files\Adobe
2009-09-15 10:56 . 2009-09-15 10:56 -------- d-----w- c:\program files\Microtek
2009-09-15 10:56 . 2009-09-11 13:06 -------- d-----w- c:\program files\Common Files\InstallShield
2009-09-15 10:46 . 2009-09-11 14:41 -------- d-----w- c:\documents and settings\Administrator\Application Data\IDM
2009-09-14 13:15 . 2009-09-14 13:15 -------- d-----w- c:\program files\FLV Player
2009-09-13 01:29 . 2009-09-11 12:52 86327 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat
2009-09-11 17:49 . 2009-09-11 17:49 59776 ----a-w- c:\documents and settings\Administrator\Application Data\IDM\DwnlData\Administrator\piaipRCHack_v1.08_ 21\piaipRCHack_v1.08.exe
2009-09-11 15:03 . 2009-09-11 15:03 0 ----a-w- c:\windows\nsreg.dat
2009-09-11 14:41 . 2009-09-11 14:41 116144 ----a-w- c:\documents and settings\Administrator\Application Data\IDM\idmmzcc2\components\idmmzcc.dll
2009-09-11 13:34 . 2009-09-11 13:34 410984 ----a-w- c:\windows\system32\deploytk.dll
2009-09-11 13:33 . 2009-09-11 13:33 152576 ----a-w- c:\documents and settings\Administrator\Application Data\Sun\Java\jre1.6.0_14\lzma.dll
2009-09-11 13:10 . 2009-09-11 13:10 315392 ----a-w- c:\windows\HideWin.exe
2009-09-11 12:50 . 2009-09-11 12:50 21640 ----a-w- c:\windows\system32\emptyregdb.dat
2009-08-17 16:10 . 2009-09-11 13:21 1279456 ----a-w- c:\windows\system32\aswBoot.exe
2009-08-17 16:06 . 2009-09-11 13:21 93392 ----a-w- c:\windows\system32\drivers\aswmon.sys
2009-08-17 16:06 . 2009-09-11 13:21 94160 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2009-08-17 16:05 . 2009-09-11 13:21 114768 ----a-w- c:\windows\system32\drivers\aswSP.sys
2009-08-17 16:05 . 2009-09-11 13:21 20560 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2009-08-17 16:04 . 2009-09-11 13:21 51376 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2009-08-17 16:04 . 2009-09-11 13:21 23152 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2009-08-17 16:03 . 2009-09-11 13:21 26944 ----a-w- c:\windows\system32\drivers\aavmker4.sys
2009-08-17 16:02 . 2009-09-11 13:21 97480 ----a-w- c:\windows\system32\AvastSS.scr
2009-03-30 00:17 . 2009-10-16 10:26 386378 --sha-r- c:\windows\system32\spoiler.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\Run]
"RocketDock"="c:\program files\RocketDock\RocketDock.exe" [2007-09-02 495616]
"IDMan"="c:\program files\Internet Download Manager\IDMan.exe" [2009-09-11 2553264]
"uTorrent"="c:\program files\uTorrent\uTorrent.exe" [2009-09-23 288560]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" [2009-04-23 691656]
"STYLEXP"="c:\program files\TGTSoft\StyleXP\StyleXP.exe" [2006-05-24 1372160]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp. exe" [2009-08-17 81000]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-09-11 148888]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-07-12 7626752]
"nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2006-07-12 1519616]
c:\documents and settings\Administrator\Start Menu\Programs\Startup\
4t Tray Minimizer.lnk - c:\program files\4t Tray Minimizer\4t-min.exe [2009-9-12 1091584]
[hkey_local_machine\software\microsoft\windows\curr entversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2006-12-20 77824]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2007-04-19 04:41 294912 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microtek Scanner Finder.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Microtek Scanner Finder.lnk
backup=c:\windows\pss\Microtek Scanner Finder.lnkCommon Startup
[HKLM\~\services\sharedaccess\parameters\firewallpo licy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Documents and Settings\\Administrator\\Desktop\\RohanBotPh1.0.12 \\Rohanbot.exe"=
"d:\\Client\\rohanclient.exe"=
"c:\\Client\\rohanclient.exe"=
"c:\\Documents and Settings\\Administrator\\Desktop\\RohanBotPh1.0.12 \\Accescode bot\\Rohanbot.exe"=
"c:\\WINDOWS\\system32\\usmt\\migwiz.exe"=
"c:\\Program Files\\Counter-Strike 1.6\\hl.exe"=
"c:\\Documents and Settings\\Administrator\\Desktop\\games\\mad caps\\madcaps_r1a.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\BrazenRF Client\\BrazenRF.exe"=
S1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [9/11/2009 9:21 PM 114768]
S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [2/6/2008 11:58 AM 8944]
S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [2/6/2008 11:58 AM 51440]
S2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswF sBlk.sys [9/11/2009 9:21 PM 20560]
S2 ComServiceApp;COM+ Service Applicationt;c:\windows\system32\cmd.exe [8/4/2004 8:56 AM 388608]
S3 getPlusHelper;getPlus(R) Helper;c:\windows\System32\svchost.exe -k getPlusHelper [8/4/2004 8:56 AM 14336]
S3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des -service --> c:\windows\system32\GameMon.des -service [?]
S3 NTProcDrv;Process creation detector for NT.;c:\documents and settings\Administrator\Desktop\RohanBotPh1.0.12\NT ProcDrv.sys [9/11/2009 11:26 PM 3584]
S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [2/16/2006 4:51 PM 4096]
--- Other Services/Drivers In Memory ---
*NewlyCreated* - MBR
*Deregistered* - mbr
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
getPlusHelper REG_MULTI_SZ getPlusHelper
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
"c:\program files\Common Files\LightScribe\LSRunOnce.exe"
.
Contents of the 'Scheduled Tasks' folder
2009-11-11 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 09:34]
2009-11-13 c:\windows\Tasks\RegCure Program Check.job
- c:\program files\RegCure\RegCure.exe [2008-12-29 01:30]
2009-11-11 c:\windows\Tasks\RegCure.job
- c:\program files\RegCure\RegCure.exe [2008-12-29 01:30]
2009-11-13 c:\windows\Tasks\User_Feed_Synchronization-{A91EC2D7-A458-4FC6-B769-1251925EA641}.job
- c:\windows\system32\msfeedssync.exe [2009-03-08 01:31]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com
uInternet Settings,ProxyOverride = *.local
uInternet Settings,ProxyServer = 190.247.186.163:80
IE: Download all links with IDM - c:\program files\Internet Download Manager\IEGetAll.htm
IE: Download FLV video content with IDM - c:\program files\Internet Download Manager\IEGetVL.htm
IE: Download with IDM - c:\program files\Internet Download Manager\IEExt.htm
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\p99yihwe.default\
FF - prefs.js: browser.search.selectedEngine - DAEMON Search
FF - component: c:\documents and settings\Administrator\Application Data\IDM\idmmzcc2\components\idmmzcc.dll
---- FIREFOX POLICIES ----
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);
.
- - - - ORPHANS REMOVED - - - -
AddRemove-Blackout Ragnarok Online - c:\program files\Blackout Ragnarok Online\Uninstall.exe
************************************************** ************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-11-13 18:37
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
************************************************** ************************
Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net
device: opened successfully
user: MBR read successfully
called modules: ntoskrnl.exe catchme.sys CLASSPNP.SYS disk.sys ACPI.sys hal.dll >>UNKNOWN [0x855FF1F8]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\atapi -> 0x855ff1f8
Warning: possible MBR rootkit infection !
user & kernel MBR OK
Use "Recovery Console" command "fixmbr" to clear infection !
************************************************** ************************
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\n pggsvc]
"ImagePath"="c:\windows\system32\GameMon.des -service"
.
--------------------- LOCKED REGISTRY KEYS ---------------------
[HKEY_USERS\S-1-5-21-776561741-1604221776-725345543-500\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (Administrator)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:0 1,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,81,4a,6f ,ac,a8,9e,e1,49,98,ea,15,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:0 1,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,81,4a,6f ,ac,a8,9e,e1,49,98,ea,15,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{7623c43 2-ef0a-474c-8f32-526234ff7cfc}]
@Denied: (Full) (Everyone)
"Model"=dword:00000135
"Therad"=dword:00000001
"MData"=hex(0):cb,9b,ad,ef,27,7d,29,69,f5,02,f0,76 ,aa,4a,f1,7c,d3,d9,67,7f,6a,
4b,7b,ad,04,7a,b1,b5,76,9b,27,47,ef,03,46,d2,46,aa ,b7,81,ff,de,1b,59,3f,a3,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{7B8E916 4-324D-4A2E-A46D-0165FB2000EC}]
@Denied: (Full) (Everyone)
"scansk"=hex(0):3d,f2,e4,79,fb,8e,28,42,45,6f,d2,0 7,8c,0a,4b,c4,37,ba,6d,83,66,
d4,dd,45,b6,09,41,46,8d,07,33,b4,b7,97,dd,bc,8f,c3 ,11,c7,00,00,00,00,00,00,\
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'winlogon.exe'(468)
c:\program files\SUPERAntiSpyware\SASWINLO.dll
.
Completion time: 2009-11-13 18:39
ComboFix-quarantined-files.txt 2009-11-13 10:38
Pre-Run: 14,427,361,280 bytes free
Post-Run: 15,216,934,912 bytes free
WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOW S
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Micro soft Windows XP Professional" /noexecute=optin /fastdetect
- - End Of File - - 5DF94D53B8F2833719BBBE629F31499A
 I also did use a Trojan Remover. And detects this process know to be a malicious malware. Quote:
Quote:
|
15-Nov-2009, 09:44 PM
#7 | ||||||
| 1. Close any open browsers. 2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix. 3. Open notepad and copy/paste the text in the quotebox below into it: Code: File:: c:\windows\system32\spoiler.exe  Refering to the picture above, drag CFScript into ComboFix.exe When finished, it shall produce a log for you at C:\ComboFix.txt which I will require in your next reply. ============================================================ Please download QueryMountpoints.zip, extract quermountpoints.bat to your desktop. Double-Click on querymountpoints.bat and a log shall appear. Please post it in your next reply along with the ComboFix log. Thanks [b][color=red]Make sure all your usb devices are pluged in. Just don't open any.
__________________ Microsoft Valuable Professional Consumer--Security 2007-2010 Please make a donation to keep the site running. All proceeds go directly to the site!!! Donate Here |
16-Nov-2009, 03:31 AM
#8 | |||||
| |
16-Nov-2009, 03:31 AM
#9 | |||||
| |
17-Nov-2009, 10:50 PM
#10 | ||||||
|
__________________ Microsoft Valuable Professional Consumer--Security 2007-2010 Please make a donation to keep the site running. All proceeds go directly to the site!!! Donate Here |
 |
| |
| Currently Active Users Viewing This Thread: 1 (0 members and 1 guests) | |
| Thread Tools | |
| |
| You Are Using:  |
Advertisements do not imply our endorsement of that product or service. All times are GMT -4. The time now is 12:20 AM. Copyright © 1996 - 2011 TechGuy, Inc. All rights reserved. |  |
Facebook
Twitter
TechGuy.tv
TSG Mobile