Login | Live Chat & Podcast at 1:00PM Eastern on Sunday! |
 Search | |
| |
31-Oct-2009, 10:16 PM
#1 | ||||||
| Numerous Pop-ups, Redirects, possible Vundo Variant |
| |
04-Nov-2009, 07:59 AM
#3 | |||||
| Hello and welcome to TSG IMPORTANT Whatever repairs we make, are for fixing your computer problems only and by no means should be used on another computer. To make cleaning this machine easier:-
1. Multiple Anti-virus Programs You are operating your computer with multiple Anti-virus programs running in memory at once: Symantec AVG Anti-virus programs take up an enormous amount of your computer's resources when they are actively scanning your computer. Having two anti-virus programs running at the same time can cause your computer to run very slow, become unstable and even, in rare cases, crash. Please remove one of them NOW. 2. Make an uninstall list using HijackThis To access the Uninstall Manager you would do the following:
Please post this log on your next reply. 3. Download and run Combofix This tool is not a toy and not for everyday use. ComboFix SHOULD NOT be used unless requested by a forum helper Please download ComboFix from one of these locations: Link 1 Link 2 * IMPORTANT !!! Save ComboFix.exe to your Desktop
 Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:  Click on Yes, to continue scanning for malware. When finished, it will produce a log for you. Please include the C:\ComboFix.txt in your next reply along with a fresh HijackThis log. If you need help, see this link: http://www.bleepingcomputer.com/comb...o-use-combofix Please reply with:-
__________________ Teacher - Malware Removal University - You too could train to help others Topics not replied to within 3 days will be removed from my Subscribed Threads List |
07-Nov-2009, 08:00 AM
#4 | |||||
|
__________________ Teacher - Malware Removal University - You too could train to help others Topics not replied to within 3 days will be removed from my Subscribed Threads List |
08-Nov-2009, 12:30 AM
#5 | ||||||
| Muppy03, please don't quit on me. I don't know how to quit you. But seriously, my computer is still acting funky, and I have been checking it less since it is so infected. I only received an e-mail of your reply half a day ago:  Tech Support Guy Forumsto me show details 4:00 AM (16 hours ago) Dear Leonius, muppy03 has just replied to a thread you have subscribed to entitled - Numerous Pop-ups, Redirects, possible Vundo Variant - ----- I have done everything you asked for, including 1) fully deleting Symantec, as it was outdated and I couldn't update it anymore. Please see the attached .doc file for every log that you have requested, as it appears I am over the character limit if I try to post everything in the file. If you would like me to repost in plain text, please let me know and I will split the message up. Thank you, and please please help me, I have no one else to turn to for assistance with this. Thanks again, |
13-Nov-2009, 09:23 AM
#9 | |||||
|
__________________ Teacher - Malware Removal University - You too could train to help others Topics not replied to within 3 days will be removed from my Subscribed Threads List |
14-Nov-2009, 03:40 AM
#11 | |||||
| Don’t worry about MBAM for now. Open Hijack This and select Do a System Scan Only place a check next to the below lines if still present
Once selected close all windows except HJT an click on Fix Checked Please delete any copy of Combofix that you have on your desktop and re-download the latest version as described below. Download and run Combofix This tool is not a toy and not for everyday use. ComboFix SHOULD NOT be used unless requested by a forum helper Please download ComboFix from one of these locations: Link 1 Link 2 * IMPORTANT !!! Save ComboFix.exe to your Desktop
Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message: Click on Yes, to continue scanning for malware. When finished, it will produce a log for you. Please include the C:\ComboFix.txt in your next reply along with a fresh HijackThis log. If you need help, see this link: http://www.bleepingcomputer.com/comb...o-use-combofix Please reply with:-
__________________ Teacher - Malware Removal University - You too could train to help others Topics not replied to within 3 days will be removed from my Subscribed Threads List |
15-Nov-2009, 05:59 AM
#13 | ||||||
| Below is the Combofix Log, taken after using HJT (and reinstalling Combofix) as instructed: ComboFix 09-11-15.01 - Leonid 11/15/2009 1:29.3.2 - FAT32x86 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1022.588 [GMT -8:00] Running from: c:\documents and settings\Leonid\Desktop\ComboFix.exe AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF} . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\documents and settings\Leonid\Desktop\Security Tool.lnk c:\documents and settings\Leonid\Start Menu\Programs\Security Tool.lnk c:\windows\system32\fapavifa.dll c:\windows\system32\fehamito.dll c:\windows\system32\jomibeyo.exe c:\windows\system32\malusasu.dll c:\windows\system32\nubipana.dll c:\windows\system32\rewikupe.dll c:\windows\system32\riwumagu.dll c:\windows\system32\sivitidu.dll c:\windows\system32\sosilavu.dll c:\windows\system32\tasurepa.dll c:\windows\system32\tiyunike.dll c:\windows\system32\yuterahi.dll c:\windows\system32\zilozama.dll c:\windows\Tasks\rpjeqdoi.job Infected copy of c:\windows\system32\drivers\vaxscsi.sys was found and disinfected Restored copy from - Kitty ate it  . ((((((((((((((((((((((((( Files Created from 2009-10-15 to 2009-11-15 ))))))))))))))))))))))))))))))) . 2009-11-14 04:51 . 2009-09-10 22:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2009-11-14 04:51 . 2009-09-10 22:53 19160 ----a-w- c:\windows\system32\drivers\mbam.sys 2009-11-14 04:51 . 2009-11-14 04:57 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware 2009-11-12 07:07 . 2009-11-12 17:42 -------- d-----w- c:\documents and settings\All Users\Application Data\81136120 2009-11-12 07:07 . 2009-11-12 07:07 274 ----a-w- c:\documents and settings\All Users\Application Data\81136120\81136120.bat 2009-11-01 00:44 . 2009-11-01 00:44 -------- d-----w- c:\program files\Trend Micro 2009-10-20 19:59 . 2009-10-20 19:57 2064152 ----a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\avgcorex.dll 2009-10-16 18:15 . 2009-10-16 18:14 2025752 ----a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\avgtray.exe . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-11-13 01:52 . 2007-06-03 23:26 -------- d-----w- c:\program files\World of Warcraft 2009-11-08 02:00 . 2006-04-06 23:41 -------- d-----w- c:\program files\Symantec 2009-11-08 01:58 . 2006-04-06 23:41 -------- d-----w- c:\program files\Common Files\Symantec Shared 2009-10-25 21:54 . 2009-04-21 07:18 -------- d-----w- c:\documents and settings\Leonid\Application Data\uTorrent 2009-10-24 23:44 . 2009-03-14 17:21 -------- d-----w- c:\documents and settings\Leonid\Application Data\ZoomBrowser EX 2009-10-24 23:44 . 2009-03-14 17:09 -------- d-----w- c:\documents and settings\Leonid\Application Data\CameraWindowDC 2009-09-16 19:38 . 2009-09-16 19:38 -------- d-----w- c:\program files\Easy Image Converter 2009-09-16 19:38 . 2009-09-16 19:36 -------- d-----w- c:\program files\ImageConverter Plus 2009-09-16 17:49 . 2009-09-16 17:49 -------- d-----w- c:\documents and settings\All Users\Application Data\PC Drivers HeadQuarters 2009-09-16 17:49 . 2009-09-16 17:49 -------- d-----w- c:\program files\PC Drivers HeadQuarters 2009-09-15 05:25 . 2009-09-16 19:36 180224 ----a-w- c:\windows\system32\cnvshell.dll 2009-09-11 14:18 . 2005-08-16 10:18 136192 ----a-w- c:\windows\system32\msv1_0.dll 2009-09-04 21:03 . 2005-08-16 10:18 58880 ----a-w- c:\windows\system32\msasn1.dll 2009-08-29 07:36 . 2005-08-16 10:18 832512 ------w- c:\windows\system32\wininet.dll 2009-08-29 07:36 . 2005-08-16 10:18 78336 ----a-w- c:\windows\system32\ieencode.dll 2009-08-29 07:36 . 2005-08-16 10:18 17408 ----a-w- c:\windows\system32\corpol.dll 2009-08-28 15:21 . 2009-04-21 03:34 11952 ----a-w- c:\windows\system32\avgrsstx.dll 2009-08-28 15:21 . 2009-04-21 03:34 335240 ----a-w- c:\windows\system32\drivers\avgldx86.sys 2009-08-28 15:21 . 2009-04-21 03:34 27784 ----a-w- c:\windows\system32\drivers\avgmfx86.sys 2009-08-26 08:00 . 2005-08-16 10:19 247326 ----a-w- c:\windows\system32\strmdll.dll 2009-08-14 01:48 . 2009-08-14 01:48 61440 --sha-w- c:\windows\system32\fafivolo.dll 2009-08-11 00:48 . 2009-08-11 00:48 39424 --sha-w- c:\windows\system32\walowiwu.dll . ((((((((((((((((((((((((((((( SnapShot_2009-11-08_03.20.34 ))))))))))))))))))))))))))))))))))))))))) . + 2009-11-08 11:01 . 2009-05-26 11:40 382840 c:\windows\ie7updates\KB976749-IE7\spuninst\updspapi.dll + 2009-11-08 11:01 . 2009-05-26 11:40 231288 c:\windows\ie7updates\KB976749-IE7\spuninst\spuninst.exe + 2005-08-16 10:18 . 2009-10-21 04:08 3598336 c:\windows\system32\mshtml.dll - 2005-08-16 10:18 . 2009-08-29 07:36 3598336 c:\windows\system32\mshtml.dll + 2008-04-21 06:44 . 2009-10-21 04:08 3598336 c:\windows\system32\dllcache\mshtml.dll - 2008-04-21 06:44 . 2009-08-29 07:36 3598336 c:\windows\system32\dllcache\mshtml.dll + 2009-11-08 11:01 . 2009-08-29 07:36 3598336 c:\windows\ie7updates\KB976749-IE7\mshtml.dll . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2005-11-29 761947] "ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2005-06-10 81920] "ISUSPM Startup"="c:\program files\Common Files\InstallShield\UpdateService\isuspm.exe" [2005-06-10 249856] "Broadcom Wireless Manager UI"="c:\windows\system32\WLTRAY.exe" [2006-11-02 1392640] "ATICCC"="c:\program files\ATI Technologies\ATI.ACE\cli.exe" [2006-01-02 45056] "AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-11-02 2028312] "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-01-05 413696] "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-04-02 342312] "dopanakaz"="c:\windows\system32\riwumagu.dll" [BU] "SigmatelSysTrayApp"="stsystra.exe" - c:\windows\stsystra.exe [2005-11-17 397312] c:\documents and settings\All Users\Start Menu\Programs\Startup\ Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2006-3-23 24576] [hkey_local_machine\software\microsoft\windows\currentversion\explorer\Shell ExecuteHooks] "{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-25 304128] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter] 2009-08-28 15:21 11952 ----a-w- c:\windows\system32\avgrsstx.dll [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager] BootExecute REG_MULTI_SZ PDBoot.exe\0autocheck autochk *\0lsdelete [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawser vice] @="Service" [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk] path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Windows Search.lnk] path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Windows Search.lnk backup=c:\windows\pss\Windows Search.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services] "ose"=3 (0x3) "JavaQuickStarterService"=2 (0x2) "iPod Service"=3 (0x3) "Bonjour Service"=2 (0x2) [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusOverride"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\Auth orizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\Messenger\\msmsgs.exe"= "c:\\Program Files\\myTunes Redux\\mDNSResponder.exe"= "c:\\Program Files\\Mozilla Firefox\\firefox.exe"= "c:\\Program Files\\Ares\\Ares.exe"= "c:\\Program Files\\Windows Media Player\\wmplayer.exe"= "c:\\Program Files\\Warcraft III\\Warcraft III.exe"= "c:\\Program Files\\AIM\\aim.exe"= "c:\\Program Files\\Java\\jre1.5.0_07\\bin\\javaw.exe"= "c:\\Documents and Settings\\Leonid\\Desktop\\utorrent.exe"= "c:\\WINDOWS\\system32\\ElectricSheep.scr"= "c:\\Program Files\\Starcraft\\StarCraft.exe"= "c:\\Program Files\\MAIET\\Gunz\\GunzLauncher.exe"= "c:\\Program Files\\MSN Messenger\\msnmsgr.exe"= "c:\\Program Files\\MSN Messenger\\livecall.exe"= "c:\\Program Files\\World of Warcraft\\BackgroundDownloader.exe"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= "c:\\Program Files\\Veoh Networks\\Veoh\\VeohClient.exe"= "c:\\Program Files\\World of Warcraft\\Launcher.exe"= "c:\\Program Files\\Ventrilo\\Ventrilo.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\AVG\\AVG8\\avgupd.exe"= "c:\\Program Files\\AVG\\AVG8\\avgnsx.exe"= "c:\\Program Files\\uTorrent\\uTorrent.exe"= "c:\\Program Files\\Bonjour\\mDNSResponder.exe"= "c:\\Program Files\\iTunes\\iTunes.exe"= "c:\\Program Files\\World of Warcraft\\WoW-3.1.3.9947-to-3.2.0.10192-enUS-downloader.exe"= "c:\\Program Files\\World of Warcraft\\WoW-3.2.0.10192-to-3.2.0.10314-enUS-downloader.exe"= "c:\\Program Files\\World of Warcraft\\WoW-3.2.0.10314-to-3.2.2.10482-enUS-downloader.exe"= "c:\\Program Files\\World of Warcraft\\WoW-3.2.2.10482-to-3.2.2.10505-enUS-downloader.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\Glob allyOpenPorts\List] "3724:TCP"= 3724:TCP:Blizzard Downloader "6112:TCP"= 6112:TCP:Blizzard Downloader R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [4/20/2009 7:34 PM 335240] R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [4/20/2009 7:34 PM 108552] R2 AnonMgmtSvc;Anonymizer Management Service;c:\program files\Anonymizer\Anonymizer Software\Common\AnonMgmtSvc.exe [11/17/2008 12:58 PM 37560] R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [4/20/2009 7:34 PM 297752] S2 Aruba VPN Service;Aruba VPN Service;c:\program files\McGill NetConnect 2.0\ArubaService.exe [8/25/2006 6:52 PM 65536] S2 btvrwjueif;btvrwjueif;\??\c:\windows\system32\drivers\lvtwloip.sys --> c:\windows\system32\drivers\lvtwloip.sys [?] --- Other Services/Drivers In Memory --- *Deregistered* - mbr . Contents of the 'Scheduled Tasks' folder 2009-11-11 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 16:34] . . ------- Supplementary Scan ------- . uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8 uStart Page = hxxp://www.google.com/ uInternet Settings,ProxyOverride = *.local FF - ProfilePath - c:\documents and settings\Leonid\Application Data\Mozilla\Firefox\Profiles\7ncsfgzt.default\ FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com FF - component: c:\program files\AVG\AVG8\Firefox\components\avgssff.dll FF - plugin: c:\documents and settings\Leonid\Application Data\Mozilla\Firefox\Profiles\7ncsfgzt.default\extensions\moveplayer@movene tworks.com\platform\WINNT_x86-msvc\plugins\npmnqmp071303000006.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\npmozax.dll FF - plugin: c:\program files\Veoh Networks\Veoh\Plugins\noreg\NPVeohVersion.dll FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ . - - - - ORPHANS REMOVED - - - - BHO-{c60e2585-2232-4f66-8900-df7122736c1f} - tasurepa.dll HKLM-Run-vuzofazuvi - sosilavu.dll SharedTaskScheduler-{cc3388ee-40fe-473d-8076-b9e015883c4b} - c:\windows\system32\riwumagu.dll SSODL-nofipebif-{cc3388ee-40fe-473d-8076-b9e015883c4b} - c:\windows\system32\riwumagu.dll ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-11-15 01:45 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net device: opened successfully user: MBR read successfully called modules: ntkrnlpa.exe >>UNKNOWN [0x87187398]<< kernel: MBR read successfully detected MBR rootkit hooks: \Driver\Disk -> 0x87187398 Warning: possible MBR rootkit infection ! user & kernel MBR OK Use "Recovery Console" command "fixmbr" to clear infection ! ************************************************************************** . --------------------- DLLs Loaded Under Running Processes --------------------- - - - - - - - > 'winlogon.exe'(988) c:\windows\system32\Ati2evxx.dll c:\windows\System32\BCMLogon.dll - - - - - - - > 'explorer.exe'(3596) c:\windows\system32\WININET.dll c:\windows\system32\ieframe.dll c:\windows\system32\WPDShServiceObj.dll c:\windows\system32\PortableDeviceTypes.dll c:\windows\system32\PortableDeviceApi.dll c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.3053_x-ww_b80fa8ca\MSVCR80.dll c:\program files\Microsoft Office\OFFICE11\msohev.dll . ------------------------ Other Running Processes ------------------------ . c:\windows\system32\Ati2evxx.exe c:\windows\System32\bcmwltry.exe c:\program files\Lavasoft\Ad-Aware\aawservice.exe c:\windows\system32\Ati2evxx.exe c:\windows\system32\LEXBCES.EXE c:\windows\system32\LEXPPS.EXE c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe c:\program files\Bonjour\mDNSResponder.exe c:\windows\eHome\ehRecvr.exe c:\windows\eHome\ehSched.exe c:\windows\system32\Rundll32.exe c:\windows\system32\Rundll32.exe c:\program files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe c:\progra~1\AVG\AVG8\avgrsx.exe c:\progra~1\AVG\AVG8\avgnsx.exe c:\program files\Raxco\PerfectDisk10\PDAgent.exe c:\program files\Canon\CAL\CALMAIN.exe c:\windows\ehome\mcrdsvc.exe c:\windows\system32\SearchIndexer.exe c:\windows\system32\dllhost.exe c:\program files\iPod\bin\iPodService.exe . ************************************************************************** . Completion time: 2009-11-15 01:53 - machine was rebooted ComboFix-quarantined-files.txt 2009-11-15 09:53 ComboFix2.txt 2009-11-08 03:30 ComboFix3.txt 2009-07-01 17:56 Pre-Run: 20,778,692,608 bytes free Post-Run: 20,742,922,240 bytes free - - End Of File - - D5A4F2F25C7B7DC4B00CF871B58C41F9 |
15-Nov-2009, 06:25 AM
#14 | |||||
| Try not to use the computer, unless it is essential until you are clean, thanks. Please give me an update on how things are running after doing the following. Open Hijack This and select Do a System Scan Only place a check next to the below lines if still present
Once selected close all windows except HJT an click on Fix Checked IMPORTANT Please Disable Antivirus before doing the following. COMBOFIX-Script A word of warning: Please do not run ComboFix on your own. This tool is not a toy and not for everyday use.
Please reply with:-
__________________ Teacher - Malware Removal University - You too could train to help others Topics not replied to within 3 days will be removed from my Subscribed Threads List |
15-Nov-2009, 03:17 PM
#15 | ||||||
| Hello, Here is the new Combofix log: ComboFix 09-11-15.01 - Leonid 11/15/2009 2:40.4.2 - FAT32x86 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1022.583 [GMT -8:00] Running from: c:\documents and settings\Leonid\Desktop\ComboFix.exe Command switches used :: c:\documents and settings\Leonid\Desktop\CFScript.txt AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF} FILE :: "c:\documents and settings\All Users\Application Data\81136120\81136120.bat" "c:\windows\system32\fafivolo.dll" "c:\windows\system32\riwumagu.dll" "c:\windows\system32\walowiwu.dll" . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\documents and settings\All Users\Application Data\81136120 c:\documents and settings\All Users\Application Data\81136120\81136120.bat c:\windows\system32\drivers\sptd.sys c:\windows\system32\fafivolo.dll c:\windows\system32\walowiwu.dll Infected copy of c:\windows\system32\drivers\vaxscsi.sys was found and disinfected Restored copy from - Kitty ate it . ((((((((((((((((((((((((( Files Created from 2009-10-15 to 2009-11-15 ))))))))))))))))))))))))))))))) . 2009-11-14 04:51 . 2009-09-10 22:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2009-11-14 04:51 . 2009-09-10 22:53 19160 ----a-w- c:\windows\system32\drivers\mbam.sys 2009-11-14 04:51 . 2009-11-14 04:57 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware 2009-11-01 00:44 . 2009-11-01 00:44 -------- d-----w- c:\program files\Trend Micro 2009-10-20 19:59 . 2009-10-20 19:57 2064152 ----a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\avgcorex.dll 2009-10-16 18:15 . 2009-10-16 18:14 2025752 ----a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\avgtray.exe . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-11-13 01:52 . 2007-06-03 23:26 -------- d-----w- c:\program files\World of Warcraft 2009-11-08 02:00 . 2006-04-06 23:41 -------- d-----w- c:\program files\Symantec 2009-11-08 01:58 . 2006-04-06 23:41 -------- d-----w- c:\program files\Common Files\Symantec Shared 2009-10-25 21:54 . 2009-04-21 07:18 -------- d-----w- c:\documents and settings\Leonid\Application Data\uTorrent 2009-10-24 23:44 . 2009-03-14 17:21 -------- d-----w- c:\documents and settings\Leonid\Application Data\ZoomBrowser EX 2009-10-24 23:44 . 2009-03-14 17:09 -------- d-----w- c:\documents and settings\Leonid\Application Data\CameraWindowDC 2009-09-16 19:38 . 2009-09-16 19:38 -------- d-----w- c:\program files\Easy Image Converter 2009-09-16 19:38 . 2009-09-16 19:36 -------- d-----w- c:\program files\ImageConverter Plus 2009-09-16 17:49 . 2009-09-16 17:49 -------- d-----w- c:\documents and settings\All Users\Application Data\PC Drivers HeadQuarters 2009-09-16 17:49 . 2009-09-16 17:49 -------- d-----w- c:\program files\PC Drivers HeadQuarters 2009-09-15 05:25 . 2009-09-16 19:36 180224 ----a-w- c:\windows\system32\cnvshell.dll 2009-09-11 14:18 . 2005-08-16 10:18 136192 ----a-w- c:\windows\system32\msv1_0.dll 2009-09-04 21:03 . 2005-08-16 10:18 58880 ----a-w- c:\windows\system32\msasn1.dll 2009-08-29 07:36 . 2005-08-16 10:18 832512 ------w- c:\windows\system32\wininet.dll 2009-08-29 07:36 . 2005-08-16 10:18 78336 ----a-w- c:\windows\system32\ieencode.dll 2009-08-29 07:36 . 2005-08-16 10:18 17408 ----a-w- c:\windows\system32\corpol.dll 2009-08-28 15:21 . 2009-04-21 03:34 11952 ----a-w- c:\windows\system32\avgrsstx.dll 2009-08-28 15:21 . 2009-04-21 03:34 335240 ----a-w- c:\windows\system32\drivers\avgldx86.sys 2009-08-28 15:21 . 2009-04-21 03:34 27784 ----a-w- c:\windows\system32\drivers\avgmfx86.sys 2009-08-26 08:00 . 2005-08-16 10:19 247326 ----a-w- c:\windows\system32\strmdll.dll . ((((((((((((((((((((((((((((( SnapShot_2009-11-08_03.20.34 ))))))))))))))))))))))))))))))))))))))))) . + 2009-11-08 11:01 . 2009-05-26 11:40 382840 c:\windows\ie7updates\KB976749-IE7\spuninst\updspapi.dll + 2009-11-08 11:01 . 2009-05-26 11:40 231288 c:\windows\ie7updates\KB976749-IE7\spuninst\spuninst.exe + 2005-08-16 10:18 . 2009-10-21 04:08 3598336 c:\windows\system32\mshtml.dll - 2005-08-16 10:18 . 2009-08-29 07:36 3598336 c:\windows\system32\mshtml.dll + 2008-04-21 06:44 . 2009-10-21 04:08 3598336 c:\windows\system32\dllcache\mshtml.dll - 2008-04-21 06:44 . 2009-08-29 07:36 3598336 c:\windows\system32\dllcache\mshtml.dll + 2009-11-08 11:01 . 2009-08-29 07:36 3598336 c:\windows\ie7updates\KB976749-IE7\mshtml.dll . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2005-11-29 761947] "ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2005-06-10 81920] "ISUSPM Startup"="c:\program files\Common Files\InstallShield\UpdateService\isuspm.exe" [2005-06-10 249856] "Broadcom Wireless Manager UI"="c:\windows\system32\WLTRAY.exe" [2006-11-02 1392640] "ATICCC"="c:\program files\ATI Technologies\ATI.ACE\cli.exe" [2006-01-02 45056] "AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-11-02 2028312] "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-01-05 413696] "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-04-02 342312] "SigmatelSysTrayApp"="stsystra.exe" - c:\windows\stsystra.exe [2005-11-17 397312] c:\documents and settings\All Users\Start Menu\Programs\Startup\ Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2006-3-23 24576] [hkey_local_machine\software\microsoft\windows\currentversion\explorer\Shell ExecuteHooks] "{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-25 304128] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter] 2009-08-28 15:21 11952 ----a-w- c:\windows\system32\avgrsstx.dll [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager] BootExecute REG_MULTI_SZ PDBoot.exe\0autocheck autochk *\0lsdelete [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawser vice] @="Service" [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk] path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Windows Search.lnk] path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Windows Search.lnk backup=c:\windows\pss\Windows Search.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services] "ose"=3 (0x3) "JavaQuickStarterService"=2 (0x2) "iPod Service"=3 (0x3) "Bonjour Service"=2 (0x2) [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusOverride"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\Auth orizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\Messenger\\msmsgs.exe"= "c:\\Program Files\\myTunes Redux\\mDNSResponder.exe"= "c:\\Program Files\\Mozilla Firefox\\firefox.exe"= "c:\\Program Files\\Ares\\Ares.exe"= "c:\\Program Files\\Windows Media Player\\wmplayer.exe"= "c:\\Program Files\\Warcraft III\\Warcraft III.exe"= "c:\\Program Files\\AIM\\aim.exe"= "c:\\Program Files\\Java\\jre1.5.0_07\\bin\\javaw.exe"= "c:\\Documents and Settings\\Leonid\\Desktop\\utorrent.exe"= "c:\\WINDOWS\\system32\\ElectricSheep.scr"= "c:\\Program Files\\Starcraft\\StarCraft.exe"= "c:\\Program Files\\MAIET\\Gunz\\GunzLauncher.exe"= "c:\\Program Files\\MSN Messenger\\msnmsgr.exe"= "c:\\Program Files\\MSN Messenger\\livecall.exe"= "c:\\Program Files\\World of Warcraft\\BackgroundDownloader.exe"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= "c:\\Program Files\\Veoh Networks\\Veoh\\VeohClient.exe"= "c:\\Program Files\\World of Warcraft\\Launcher.exe"= "c:\\Program Files\\Ventrilo\\Ventrilo.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\AVG\\AVG8\\avgupd.exe"= "c:\\Program Files\\AVG\\AVG8\\avgnsx.exe"= "c:\\Program Files\\uTorrent\\uTorrent.exe"= "c:\\Program Files\\Bonjour\\mDNSResponder.exe"= "c:\\Program Files\\iTunes\\iTunes.exe"= "c:\\Program Files\\World of Warcraft\\WoW-3.1.3.9947-to-3.2.0.10192-enUS-downloader.exe"= "c:\\Program Files\\World of Warcraft\\WoW-3.2.0.10192-to-3.2.0.10314-enUS-downloader.exe"= "c:\\Program Files\\World of Warcraft\\WoW-3.2.0.10314-to-3.2.2.10482-enUS-downloader.exe"= "c:\\Program Files\\World of Warcraft\\WoW-3.2.2.10482-to-3.2.2.10505-enUS-downloader.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\Glob allyOpenPorts\List] "3724:TCP"= 3724:TCP:Blizzard Downloader "6112:TCP"= 6112:TCP:Blizzard Downloader R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [4/20/2009 7:34 PM 335240] R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [4/20/2009 7:34 PM 108552] R2 AnonMgmtSvc;Anonymizer Management Service;c:\program files\Anonymizer\Anonymizer Software\Common\AnonMgmtSvc.exe [11/17/2008 12:58 PM 37560] R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [4/20/2009 7:34 PM 297752] S2 Aruba VPN Service;Aruba VPN Service;c:\program files\McGill NetConnect 2.0\ArubaService.exe [8/25/2006 6:52 PM 65536] S2 btvrwjueif;btvrwjueif;\??\c:\windows\system32\drivers\lvtwloip.sys --> c:\windows\system32\drivers\lvtwloip.sys [?] --- Other Services/Drivers In Memory --- *Deregistered* - mbr . Contents of the 'Scheduled Tasks' folder 2009-11-11 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 16:34] . . ------- Supplementary Scan ------- . uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8 uStart Page = hxxp://www.google.com/ uInternet Settings,ProxyOverride = *.local FF - ProfilePath - c:\documents and settings\Leonid\Application Data\Mozilla\Firefox\Profiles\7ncsfgzt.default\ FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com FF - component: c:\program files\AVG\AVG8\Firefox\components\avgssff.dll FF - plugin: c:\documents and settings\Leonid\Application Data\Mozilla\Firefox\Profiles\7ncsfgzt.default\extensions\moveplayer@movene tworks.com\platform\WINNT_x86-msvc\plugins\npmnqmp071303000006.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\npmozax.dll FF - plugin: c:\program files\Veoh Networks\Veoh\Plugins\noreg\NPVeohVersion.dll FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ . ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-11-15 02:56 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . --------------------- DLLs Loaded Under Running Processes --------------------- - - - - - - - > 'winlogon.exe'(928) c:\windows\system32\Ati2evxx.dll c:\windows\System32\BCMLogon.dll - - - - - - - > 'explorer.exe'(3584) c:\windows\system32\WININET.dll c:\windows\system32\ieframe.dll c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.3053_x-ww_b80fa8ca\MSVCR80.dll c:\windows\system32\WPDShServiceObj.dll c:\windows\system32\PortableDeviceTypes.dll c:\windows\system32\PortableDeviceApi.dll . ------------------------ Other Running Processes ------------------------ . c:\windows\system32\Ati2evxx.exe c:\windows\System32\bcmwltry.exe c:\program files\Lavasoft\Ad-Aware\aawservice.exe c:\windows\system32\Ati2evxx.exe c:\windows\system32\LEXBCES.EXE c:\windows\system32\LEXPPS.EXE c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe c:\program files\Bonjour\mDNSResponder.exe c:\windows\eHome\ehRecvr.exe c:\windows\eHome\ehSched.exe c:\program files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe c:\program files\Raxco\PerfectDisk10\PDAgent.exe c:\progra~1\AVG\AVG8\avgrsx.exe c:\progra~1\AVG\AVG8\avgnsx.exe c:\program files\Canon\CAL\CALMAIN.exe c:\windows\ehome\mcrdsvc.exe c:\windows\system32\SearchIndexer.exe c:\windows\system32\dllhost.exe c:\program files\iPod\bin\iPodService.exe c:\windows\SoftwareDistribution\Download\Install\windows-kb890830-v3.1.exe f:\ab8a8e192e2e44e5ef82fe52\mrtstub.exe c:\windows\system32\MRT.exe . ************************************************************************** . Completion time: 2009-11-15 03:08 - machine was rebooted ComboFix-quarantined-files.txt 2009-11-15 11:07 ComboFix2.txt 2009-11-15 09:53 ComboFix3.txt 2009-11-08 03:30 ComboFix4.txt 2009-07-01 17:56 Pre-Run: 20,730,372,096 bytes free Post-Run: 20,609,761,280 bytes free - - End Of File - - C29DD823625D86D90A1F7809ED19D3A7 |
 |
| Tags |
| popup, redirect |
| |
| Currently Active Users Viewing This Thread: 1 (0 members and 1 guests) | |
| Thread Tools | |
| |
| You Are Using:  |
Advertisements do not imply our endorsement of that product or service. All times are GMT -4. The time now is 05:23 PM. Copyright © 1996 - 2011 TechGuy, Inc. All rights reserved. |  |
Facebook
Twitter
TechGuy.tv
TSG Mobile