Login | Live Chat & Podcast at 1:00PM Eastern on Sunday! |
 Search | |
| |
12-Nov-2009, 04:41 AM
#1 | |||||
| "Personal Guard 2009" infection, contiues still after Malwarebytes scan. |
| |
12-Nov-2009, 05:16 AM
#2 | |||||
|
__________________ Teacher - Malware Removal University - You too could train to help others Topics not replied to within 3 days will be removed from my Subscribed Threads List |
12-Nov-2009, 06:32 PM
#3 | |||||
| |
12-Nov-2009, 06:43 PM
#4 | |||||
| Download and run Combofix This tool is not a toy and not for everyday use. ComboFix SHOULD NOT be used unless requested by a forum helper Please download ComboFix from one of these locations: Link 1 Link 2 * IMPORTANT !!! Save ComboFix.exe to your Desktop
 Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:  Click on Yes, to continue scanning for malware. When finished, it will produce a log for you. Please include the C:\ComboFix.txt in your next reply along with a fresh HijackThis log. If you need help, see this link: http://www.bleepingcomputer.com/comb...o-use-combofix Please reply with:-
__________________ Teacher - Malware Removal University - You too could train to help others Topics not replied to within 3 days will be removed from my Subscribed Threads List |
12-Nov-2009, 08:49 PM
#5 | |||||
| Ok here is the ComboFix log. ComboFix 09-11-13.04 - Alan 11/12/2009 16:08.1.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1023.315 [GMT -8:00] Running from: c:\documents and settings\Alan\Desktop\ComboFix.exe * Created a new restore point . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\bold.log c:\documents and settings\Administrator.SK\Local Settings\Application Data\{EDE2837D-5533-415A-8E74-F2ED954576E7} c:\documents and settings\Administrator.SK\Local Settings\Application Data\{EDE2837D-5533-415A-8E74-F2ED954576E7}\chrome.manifest c:\documents and settings\Administrator.SK\Local Settings\Application Data\{EDE2837D-5533-415A-8E74-F2ED954576E7}\chrome\content\_cfg.js c:\documents and settings\Administrator.SK\Local Settings\Application Data\{EDE2837D-5533-415A-8E74-F2ED954576E7}\chrome\content\overlay.xul c:\documents and settings\Administrator.SK\Local Settings\Application Data\{EDE2837D-5533-415A-8E74-F2ED954576E7}\install.rdf c:\documents and settings\Alan\Local Settings\Application Data\{A231D774-96C0-4E5D-A2A4-8AD13F6762E1} c:\documents and settings\Alan\Local Settings\Application Data\{A231D774-96C0-4E5D-A2A4-8AD13F6762E1}\chrome.manifest c:\documents and settings\Alan\Local Settings\Application Data\{A231D774-96C0-4E5D-A2A4-8AD13F6762E1}\chrome\content\_cfg.js c:\documents and settings\Alan\Local Settings\Application Data\{A231D774-96C0-4E5D-A2A4-8AD13F6762E1}\chrome\content\overlay.xul c:\documents and settings\Alan\Local Settings\Application Data\{A231D774-96C0-4E5D-A2A4-8AD13F6762E1}\install.rdf c:\documents and settings\All Users\Application Data\xynaz.reg c:\documents and settings\All Users\Microsoft AData c:\documents and settings\All Users\Microsoft AData\sysnet.dll c:\documents and settings\All Users\Microsoft AData\t.sid c:\program files\Personal Guard 2009 c:\program files\Personal Guard 2009\config.scf c:\program files\Personal Guard 2009\personalguard.exe c:\program files\Shared c:\program files\WinPCap c:\program files\WinPCap\rpcapd.exe c:\windows\abukiriyijikere.dll c:\windows\acadupay.dll c:\windows\acalucasicu.dll c:\windows\acinabonatana.dll c:\windows\acoxacodeneqehex.dll c:\windows\adawusuy.dll c:\windows\afoximiba.dll c:\windows\afusegad.dll c:\windows\agepiran.dll c:\windows\agogutag.dll c:\windows\agoziyemamerihes.dll c:\windows\ahamakigejimiji.dll c:\windows\ahemoxobuz.dll c:\windows\aheqeluw.dll c:\windows\aherojew.dll c:\windows\ahiyaloqetugu.dll c:\windows\ajaheseh.dll c:\windows\ajefafahin.dll c:\windows\ajoxahowilojihu.dll c:\windows\akadupayazadahi.dll c:\windows\aleliroquqofolin.dll c:\windows\alemogoy.dll c:\windows\alikedomigiv.dll c:\windows\alixipug.dll c:\windows\amaxoret.dll c:\windows\amefawin.dll c:\windows\amipavurogehu.dll c:\windows\amuduqiyalo.dll c:\windows\anukacegalaju.dll c:\windows\apelewizuteroy.dll c:\windows\apeqeluw.dll c:\windows\aqawogilimelumor.dll c:\windows\aqayuruwokuq.dll c:\windows\aqifasufo.dll c:\windows\aqokigeji.dll c:\windows\aqosamav.dll c:\windows\aquworitulusas.dll c:\windows\aregejopevogani.dll c:\windows\aribabuyu.dll c:\windows\asiqoboxebo.dll c:\windows\atopomukimu.dll c:\windows\atotuzar.dll c:\windows\atujoxum.dll c:\windows\avayiteg.dll c:\windows\avivomuyixu.dll c:\windows\avoxubexuyiru.dll c:\windows\avulixibugojud.dll c:\windows\awacogotobuhuw.dll c:\windows\awapeciluvuneb.dll c:\windows\awidamap.dll c:\windows\awobeguyoyamu.dll c:\windows\awusizeb.dll c:\windows\axojecuxiqivoq.dll c:\windows\axosocac.dll c:\windows\ayahoyopogic.dll c:\windows\ayametapediwi.dll c:\windows\ayewatebicog.dll c:\windows\ayodocayewiduce.dll c:\windows\azitesuzupijafer.dll c:\windows\certsystem.exe c:\windows\cykulolyz.vbs c:\windows\Downloaded Program Files\IDropPTB.dll c:\windows\ebosaqitihumen.dll c:\windows\ebovadebiberer.dll c:\windows\ebudalumihu.dll c:\windows\ecawobey.dll c:\windows\ecosizebazobifuy.dll c:\windows\ecupucusez.dll c:\windows\ecutetabejuy.dll c:\windows\eduwigam.dll c:\windows\eferijego.dll c:\windows\egaquyepiyijiwan.dll c:\windows\egipolog.dll c:\windows\ehahopira.dll c:\windows\ehakudatugap.dll c:\windows\ehojomowapupiy.dll c:\windows\ehureheg.dll c:\windows\ehusizebazob.dll c:\windows\ehuyiluyirogo.dll c:\windows\ejixecuguveka.dll c:\windows\ekayutez.dll c:\windows\ekedaribiy.dll c:\windows\ekiretubed.dll c:\windows\ekudiqata.dll c:\windows\elilugoqoralo.dll c:\windows\elirixatabivepas.dll c:\windows\elokifasocukexu.dll c:\windows\elumanewohisiquy.dll c:\windows\emeseriyovuzi.dll c:\windows\emetifef.dll c:\windows\emetocedo.dll c:\windows\emoyuyev.dll c:\windows\emufodizir.dll c:\windows\enimelumorunif.dll c:\windows\enodetak.dll c:\windows\enojicec.dll c:\windows\enukanuga.dll c:\windows\eqiditemekok.dll c:\windows\eqiveruqapiw.dll c:\windows\eratetab.dll c:\windows\esapacupodo.dll c:\windows\esebajoganisap.dll c:\windows\eseleqay.dll c:\windows\eseqonofajahiga.dll c:\windows\esezoqos.dll c:\windows\esizoyiziyemam.dll c:\windows\etuhigafekutege.dll c:\windows\evakefuperulaz.dll c:\windows\evanasow.dll c:\windows\evepikebeg.dll c:\windows\evobuvogepu.dll c:\windows\evuwagurin.dll c:\windows\ewosuyeganowet.dll c:\windows\exegusudihoso.dll c:\windows\exucujoful.dll c:\windows\exugonaman.dll c:\windows\eyebabuy.dll c:\windows\eyemowem.dll c:\windows\eyeqonofajahiga.dll c:\windows\eyoritulusasiyuw.dll c:\windows\eyoteboyobubo.dll c:\windows\eyutehobekeyojiy.dll c:\windows\ezacanar.dll c:\windows\ezaqexejivan.dll c:\windows\ibamayob.dll c:\windows\icamelum.dll c:\windows\icenodus.dll c:\windows\icibakezakoboxa.dll c:\windows\icipajeb.dll c:\windows\icixuzayahe.dll c:\windows\idovigamepix.dll c:\windows\ifawevev.dll c:\windows\ifiqanej.dll c:\windows\ifisobogiseyite.dll c:\windows\ifisohomatumoy.dll c:\windows\ifudanesumi.dll c:\windows\igavenup.dll c:\windows\igayiqamab.dll c:\windows\igelutihol.dll c:\windows\igucarezatecu.dll c:\windows\iguxudipotafa.dll c:\windows\ihayomebufebosuy.dll c:\windows\ihehelehizu.dll c:\windows\ihoravucuyafupe.dll c:\windows\ijukegubix.dll c:\windows\ikupetiyogovito.dll c:\windows\imoruzif.dll c:\windows\imotijih.dll c:\windows\inarikomemapiqiy.dll c:\windows\inerajoza.dll c:\windows\inujigul.dll c:\windows\ipazucocalir.dll c:\windows\ipeworit.dll c:\windows\ipininozumahohew.dll c:\windows\ipiyupadewi.dll c:\windows\iqeseyom.dll c:\windows\iqiyuwam.dll c:\windows\irijiwawanubilil.dll c:\windows\iripajeboy.dll c:\windows\iroyiyohu.dll c:\windows\irulukelikuf.dll c:\windows\iteyiluy.dll c:\windows\itinoweturet.dll c:\windows\itituxun.dll c:\windows\itokamik.dll c:\windows\ivovabowinew.dll c:\windows\ivubuhuwonez.dll c:\windows\iwagalaj.dll c:\windows\iwefihutafuzacan.dll c:\windows\iwehocim.dll c:\windows\iwixipugofore.dll c:\windows\iwutasoy.dll c:\windows\ixapiyeciferab.dll c:\windows\ixineput.dll c:\windows\ixoposit.dll c:\windows\iyajiyuhax.dll c:\windows\iyayiwogil.dll c:\windows\iyelodasodefakor.dll c:\windows\iyiyiviy.dll c:\windows\izewujonafazeq.dll c:\windows\izeziqipuzimoc.dll c:\windows\izovukubon.dll c:\windows\izufaneroko.dll c:\windows\izupiyep.dll c:\windows\izurikom.dll c:\windows\lylineme.inf c:\windows\microsoftdef.dll c:\windows\obebuxidet.dll c:\windows\obekihibazu.dll c:\windows\ocipaniyawe.dll c:\windows\odogaxeyu.dll c:\windows\odosesoxikayisu.dll c:\windows\odujekumiboludos.dll c:\windows\ofegutag.dll c:\windows\ofibituyihita.dll c:\windows\ofofuyipidu.dll c:\windows\ogadotex.dll c:\windows\ogeneputehobek.dll c:\windows\ogujabowixani.dll c:\windows\ohanepubikehejon.dll c:\windows\ohobuhuw.dll c:\windows\ohucucafuv.dll c:\windows\ojudibotaxar.dll c:\windows\ojurehegurixu.dll c:\windows\okekumib.dll c:\windows\okiraqilaquvacax.dll c:\windows\okizusuq.dll c:\windows\olagifobawutiles.dll c:\windows\oluvimupagidi.dll c:\windows\omapubitukixuyoy.dll c:\windows\omemupagidimeqa.dll c:\windows\omexaxet.dll c:\windows\omixufap.dll c:\windows\omoqijiw.dll c:\windows\oneginuk.dll c:\windows\onenagog.dll c:\windows\onufutufum.dll c:\windows\onuwadageqe.dll c:\windows\opeganis.dll c:\windows\oqidoyatupekamos.dll c:\windows\oqosukasevegu.dll c:\windows\oqudozotuqo.dll c:\windows\oqugoxoy.dll c:\windows\oquhubimudutibo.dll c:\windows\oragimogoyi.dll c:\windows\oreyabeguyo.dll c:\windows\oribazovecebezu.dll c:\windows\orufumuligizoyow.dll c:\windows\osuxebuxe.dll c:\windows\otabamis.dll c:\windows\otekepem.dll c:\windows\otelovawubixax.dll c:\windows\otonanerul.dll c:\windows\otorigapuqazef.dll c:\windows\ovagacut.dll c:\windows\overokowucafoju.dll c:\windows\ovipetiy.dll c:\windows\oviyamuzage.dll c:\windows\owimijigokimaki.dll c:\windows\owobeceb.dll c:\windows\oxelaguzeyaweb.dll c:\windows\oxequpalir.dll c:\windows\oxuyiyohu.dll c:\windows\oyewadageqe.dll c:\windows\ozacumiru.dll c:\windows\ozogogagimogoyi.dll c:\windows\ozuwejog.dll c:\windows\regred.exe c:\windows\securits.com c:\windows\spoov.exe c:\windows\system32\badaliyo.dll c:\windows\system32\beruheza.dll.tmp c:\windows\system32\drivers\npf.sys c:\windows\system32\godadoju.dll.tmp c:\windows\system32\kikububu.dll c:\windows\system32\Packet.dll c:\windows\system32\pthreadVC.dll c:\windows\system32\rowirisa.dll.tmp c:\windows\system32\sezanozi.dll.tmp c:\windows\system32\WanPacket.dll c:\windows\system32\winsc.exe c:\windows\system32\wpcap.dll c:\windows\Tasks\qzewbtub.job c:\windows\ubacuguvekanuga.dll c:\windows\ucewucob.dll c:\windows\ucitiyayiyohu.dll c:\windows\uduzuhifucize.dll c:\windows\ufanomozolocemu.dll c:\windows\ufemadavak.dll c:\windows\ufigajimon.dll c:\windows\ufucanuv.dll c:\windows\ufukajom.dll c:\windows\ugawiroz.dll c:\windows\ugutecofiruj.dll c:\windows\uguyeyog.dll c:\windows\uhabokogikewejo.dll c:\windows\ujadimen.dll c:\windows\ujavesaz.dll c:\windows\ujecedofibujidi.dll c:\windows\ujobogis.dll c:\windows\ujucoziqowuka.dll c:\windows\ujupubitukix.dll c:\windows\ujuwadageqewipe.dll c:\windows\ujuwopoze.dll c:\windows\ukavuwoxutapimo.dll c:\windows\ukudocay.dll c:\windows\ukumumus.dll c:\windows\ulusukase.dll c:\windows\umaxesab.dll c:\windows\unavutamu.dll c:\windows\unejozapowije.dll c:\windows\unomepozadutodi.dll c:\windows\uporedoxira.dll c:\windows\upusigegobe.dll c:\windows\upuwejog.dll c:\windows\uqawegum.dll c:\windows\uqebawutil.dll c:\windows\uqokijir.dll c:\windows\uraniyawe.dll c:\windows\ureqaxalaza.dll c:\windows\uretezivanomozo.dll c:\windows\usakumibol.dll c:\windows\usawugonajero.dll c:\windows\usexplorer.exe c:\windows\usukogib.dll c:\windows\utekabad.dll c:\windows\utikimak.dll c:\windows\utiwujonafazeq.dll c:\windows\uwaduvakadevi.dll c:\windows\uweleriwesozomu.dll c:\windows\uwelikolakefuper.dll c:\windows\uweqixiwu.dll c:\windows\uwiticab.dll c:\windows\uworeqonofaja.dll c:\windows\uxawepewapa.dll c:\windows\uxemuwes.dll c:\windows\uxepiwamikux.dll c:\windows\uxogimogoyineba.dll c:\windows\uyakumibol.dll c:\windows\uyinaqaf.dll c:\windows\uzekoconisixe.dll c:\windows\yfydo.exe . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_npf -------\Service_npf ((((((((((((((((((((((((( Files Created from 2009-10-13 to 2009-11-13 ))))))))))))))))))))))))))))))) . 2009-11-13 00:29 . 2009-11-13 00:30 -------- d-----w- c:\windows\LastGood 2009-11-06 19:16 . 2009-09-10 22:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2009-11-06 19:16 . 2009-09-10 22:53 19160 ----a-w- c:\windows\system32\drivers\mbam.sys 2009-11-06 19:16 . 2001-01-01 14:59 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware 2009-11-06 19:02 . 2009-11-06 19:02 -------- d-----w- c:\windows\system32\wbem\Repository 2009-11-06 18:50 . 2009-11-06 18:50 516096 ----a-w- c:\windows\system32\config\systemprofile\NTUSER(3).DAT 2009-11-06 18:48 . 2009-11-07 16:40 14511666 --sh--r- C:\AVG7DB_F.DAT 2009-11-06 18:46 . 2009-11-13 00:30 -------- d-----w- c:\documents and settings\Alan\Application Data\AVG7 2009-11-06 18:46 . 2009-11-06 18:46 4928 ----a-w- c:\windows\system32\drivers\avg7rsw.sys 2009-11-06 18:46 . 2009-11-06 18:46 18944 ----a-w- c:\windows\system32\drivers\avg7rsxp.sys 2009-11-06 18:46 . 2009-11-06 18:46 343168 ----a-w- c:\windows\system32\drivers\avg7core.sys 2009-11-06 18:46 . 2009-11-06 18:46 -------- d-----w- c:\documents and settings\All Users\Application Data\Grisoft 2009-11-02 06:40 . 2009-09-03 09:17 15688 ----a-w- c:\windows\system32\lsdelete.exe 2009-11-02 06:33 . 2009-09-23 12:55 64288 ----a-w- c:\windows\system32\drivers\Lbd.sys 2009-11-02 06:32 . 2009-10-03 08:15 2924848 -c--a-w- c:\documents and settings\All Users\Application Data\{CFBD8779-FAAB-4357-84F2-1EC8619FADA6}\Ad-AwareInstallation.exe 2009-11-02 06:32 . 2001-01-01 08:20 -------- dc-h--w- c:\documents and settings\All Users\Application Data\{CFBD8779-FAAB-4357-84F2-1EC8619FADA6} 2009-11-01 07:01 . 2009-11-01 07:01 512000 ----a-w- c:\windows\system32\config\systemprofile\NTUSER(2).DAT 2009-11-01 01:24 . 2009-11-01 01:24 -------- d-----w- c:\documents and settings\Alan\Local Settings\Application Data\Scansoft 2009-10-31 22:22 . 2001-01-01 14:03 -------- d-----w- c:\documents and settings\Alan\Local Settings\Application Data\Temp 2009-10-30 20:13 . 2009-10-30 20:13 -------- d-----w- c:\documents and settings\Alan\Application Data\Watchtower 2009-10-30 18:32 . 2001-01-01 08:20 -------- d-----w- c:\documents and settings\Alan\Local Settings\Application Data\Yahoo! . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-11-06 18:55 . 2009-11-06 18:55 4904 ----a-w- c:\windows\system32\PerfStringBackup.TMP 2009-10-30 18:51 . 2008-01-04 05:39 -------- d-----w- c:\documents and settings\Alan\Application Data\Autodesk 2009-10-30 18:50 . 2008-01-07 17:54 -------- d-----w- c:\documents and settings\Alan\Application Data\Ventrilo 2009-10-30 18:50 . 2008-02-01 20:03 -------- d-----w- c:\documents and settings\Alan\Application Data\LimeWire 2009-09-24 01:34 . 2007-12-31 08:56 122192 ----a-w- c:\documents and settings\Alan\Local Settings\Application Data\GDIPFONTCACHEV1.DAT 2009-09-23 03:52 . 2009-09-23 03:50 -------- d-----w- c:\program files\Windows Live Safety Center 2009-09-23 03:42 . 2009-09-23 03:42 122248 ----a-w- c:\documents and settings\Administrator.SK\Local Settings\Application Data\GDIPFONTCACHEV1.DAT 2009-09-23 03:28 . 2009-09-19 22:00 0 ----a-w- c:\windows\Mtofoyobuboboge.bin 2009-09-19 22:00 . 2009-09-19 22:00 120 ----a-w- c:\windows\Cqebo.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2009-11-11 2001648] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ehTray"="c:\windows\ehome\ehtray.exe" [2004-08-10 59392] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-08-13 8466432] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-08-13 81920] "TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-01-04 185896] "Acrobat Assistant 8.0"="c:\program files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe" [2007-05-11 624248] "SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_04\bin\jusched.exe" [2007-12-14 144784] "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-09-06 413696] "HP Software Update"="c:\program files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe" [2006-01-14 49152] "SSBkgdUpdate"="c:\program files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2006-10-25 210472] "PaperPort PTD"="c:\program files\ScanSoft\PaperPort\pptd40nt.exe" [2007-01-30 30248] "IndexSearch"="c:\program files\ScanSoft\PaperPort\IndexSearch.exe" [2007-01-30 46632] "PPort11reminder"="c:\program files\ScanSoft\PaperPort\Ereg\Ereg.exe" [2007-02-01 255528] "BrMfcWnd"="c:\program files\Brother\Brmfcmon\BrMfcWnd.exe" [2007-03-23 663552] "ControlCenter3"="c:\program files\Brother\ControlCenter3\brctrcen.exe" [2007-01-26 65536] "AVG7_CC"="c:\progra~1\Grisoft\AVG7\avgcc.exe" [2009-11-06 280623] "AVG7_EMC"="c:\progra~1\Grisoft\AVG7\avgemc.exe" [2009-11-06 173108] "AVG7_RegCleaner"="c:\progra~1\Grisoft\AVG7\avgregcl.exe" [2009-11-06 69683] "Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2009-09-10 1312080] "Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2006-11-04 866584] "AlcxMonitor"="ALCXMNTR.EXE" - c:\windows\ALCXMNTR.EXE [2004-09-07 57344] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "AVG7_Run"="c:\progra~1\Grisoft\AVG7\avgw.exe" [2009-11-06 56366] [hkey_local_machine\software\microsoft\windows\currentversion\explorer\Shell ExecuteHooks] "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon] 2009-09-03 22:21 548352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavaso ft Ad-Aware Service] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxs ervice] @="" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcore service] @="" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDef end] @="Service" [HKLM\~\startupfolder\C:^Documents and Settings^Alan^Start Menu^Programs^Startup^MagicDisc.lnk] backup=c:\windows\pss\MagicDisc.lnkStartup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^AutoCAD Startup Accelerator.lnk] backup=c:\windows\pss\AutoCAD Startup Accelerator.lnkCommon Startup HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\04a9f4ff HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\bejituyoko HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CPM079ac763 [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services] "iPod Service"=3 (0x3) "FLEXnet Licensing Service"=3 (0x3) "Bonjour Service"=2 (0x2) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\Auth orizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\BitTorrent\\bittorrent.exe"= "c:\\Program Files\\Bonjour\\mDNSResponder.exe"= "c:\\Program Files\\LimeWire\\LimeWire.exe"= "c:\\Program Files\\Autodesk\\Backburner\\monitor.exe"= "c:\\Program Files\\Autodesk\\Backburner\\manager.exe"= "c:\\Program Files\\Autodesk\\Backburner\\server.exe"= "c:\\Program Files\\Autodesk\\VIZ2008\\3dsviz.exe"= "c:\\Program Files\\iTunes\\iTunes.exe"= "c:\\Program Files\\Synergy\\synergys.exe"= "c:\\Program Files\\Common Files\\Apple\\Mobile Device Support\\bin\\AppleMobileDeviceService.exe"= "c:\\WINDOWS\\system32\\HPZipm12.exe"= "c:\\Program Files\\Compact Wireless-G USB Adapter Wireless Network Monitor\\WUSB54GC.exe"= "c:\\Program Files\\Windows Defender\\MsMpEng.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\Glob allyOpenPorts\List] "24800:TCP"= 24800:TCP:*  isabled:synergyR0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [11/1/2009 10:33 PM 64288] R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [11/11/2009 10:44 AM 9968] R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [11/11/2009 10:44 AM 74480] R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [9/24/2009 3:17 AM 1169232] R2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [11/3/2006 7:19 PM 13592] R3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [11/11/2009 10:44 AM 7408] S2 mi-raysat_VIZ2008_32;mental ray 3.5 Satellite for Autodesk VIZ 2008;c:\program files\Autodesk\VIZ2008\mentalray\satellite\raysat_VIZ2008_32server.exe [3/7/2007 2:32 PM 65536] --- Other Services/Drivers In Memory --- *NewlyCreated* - MBR *Deregistered* - mbr . Contents of the 'Scheduled Tasks' folder 2009-11-13 c:\windows\Tasks\Ad-Aware Update (Weekly).job - c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-10-01 13:06] 2009-11-13 c:\windows\Tasks\MP Scheduled Scan.job - c:\program files\Windows Defender\MpCmdRun.exe [2006-11-04 03:20] . . ------- Supplementary Scan ------- . uStart Page = hxxp://www.yahoo.com/ mStart Page = hxxp://www.google.com uInternet Settings,ProxyOverride = *.local IE: Append to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html IE: Convert link target to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html IE: Convert link target to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html IE: Convert selected links to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html IE: Convert selected links to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html IE: Convert selection to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html IE: Convert selection to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html IE: Convert to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 FF - ProfilePath - c:\documents and settings\Alan\Application Data\Mozilla\Firefox\Profiles\16qf8o40.default\ FF - plugin: c:\documents and settings\Alan\Application Data\Move Networks\plugins\npqmp071505000011.dll FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ ---- FIREFOX POLICIES ---- c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true); . - - - - ORPHANS REMOVED - - - - SharedTaskScheduler-{cb504d93-0ae6-4bf0-99ad-c1d928400a3c} - (no file) SSODL-SysNet-{3311CA6A-88D2-45B7-BF9D-2CE715FFCDB2} - c:\documents and settings\All Users\Microsoft AData\sysnet.dll SSODL-zulayahej-{cb504d93-0ae6-4bf0-99ad-c1d928400a3c} - (no file) SafeBoot-aawservice ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-11-12 16:29 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... c:\windows\LastGood c:\windows\TEMP\TMP0000005572D052C66E91B27E 524288 bytes executable c:\windows\system32\wuauclt.exe.wusetup.188296.bak 51224 bytes executable c:\windows\system32\wuaueng.dll.wusetup.195843.bak 1809944 bytes executable scan completed successfully hidden files: 4 ************************************************************************** . --------------------- LOCKED REGISTRY KEYS --------------------- [HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Run\OptionalCo mponents\IMAIL] @DACL=(02 0000) "Installed"="1" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Run\OptionalCo mponents\MAPI] @DACL=(02 0000) "NoChange"="1" "Installed"="1" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Run\OptionalCo mponents\MSFS] @DACL=(02 0000) "Installed"="1" . --------------------- DLLs Loaded Under Running Processes --------------------- - - - - - - - > 'winlogon.exe'(940) c:\windows\system32\GTGina.dll c:\program files\SUPERAntiSpyware\SASWINLO.dll c:\windows\system32\WININET.dll - - - - - - - > 'explorer.exe'(3496) c:\windows\system32\WININET.dll c:\windows\system32\ieframe.dll . ------------------------ Other Running Processes ------------------------ . c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe c:\program files\Common Files\Autodesk Shared\Service\AdskScSrv.exe c:\progra~1\Grisoft\AVG7\avgamsvr.exe c:\progra~1\Grisoft\AVG7\avgupsvc.exe c:\windows\eHome\ehRecvr.exe c:\windows\eHome\ehSched.exe c:\windows\system32\nvsvc32.exe c:\windows\system32\HPZipm12.exe c:\program files\Compact Wireless-G USB Adapter Wireless Network Monitor\WLService.exe c:\program files\Compact Wireless-G USB Adapter Wireless Network Monitor\WUSB54GC.exe c:\windows\system32\wbem\unsecapp.exe c:\windows\system32\dllhost.exe c:\windows\system32\wscntfy.exe c:\program files\Lavasoft\Ad-Aware\AAWTray.exe c:\windows\system32\RUNDLL32.EXE c:\windows\eHome\ehmsas.exe c:\program files\Brother\ControlCenter3\brccMCtl.exe c:\program files\Brother\Brmfcmon\BrMfcmon.exe c:\program files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe c:\program files\Java\jre1.6.0_04\bin\jucheck.exe . ************************************************************************** . Completion time: 2009-11-12 16:42 - machine was rebooted ComboFix-quarantined-files.txt 2009-11-13 00:42 Pre-Run: 125,336,432,640 bytes free Post-Run: 125,821,014,016 bytes free WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems] c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Windows XP Media Center Edition" /noexecute=optin /fastdetect Current=4 Default=4 Failed=3 LastKnownGood=5 Sets=1,2,3,4,5 - - End Of File - - 696F4F1B943066B0CF40564F656C4EBD |
12-Nov-2009, 08:50 PM
#6 | |||||
| |
12-Nov-2009, 10:10 PM
#7 | |||||
|
__________________ Teacher - Malware Removal University - You too could train to help others Topics not replied to within 3 days will be removed from my Subscribed Threads List |
12-Nov-2009, 10:40 PM
#8 | |||||
| |
13-Nov-2009, 08:13 AM
#9 | |||||
| How is the computer running now? Download and Run ATF Cleaner Download ATF (Atribune Temp File) Cleaner© by Atribune to your desktop. Make sure that all browser windows are closed.
COMBOFIX-Script A word of warning: Please do not run ComboFix on your own. This tool is not a toy and not for everyday use.
Please reply with:-
__________________ Teacher - Malware Removal University - You too could train to help others Topics not replied to within 3 days will be removed from my Subscribed Threads List |
13-Nov-2009, 03:21 PM
#10 | |||||
| |
13-Nov-2009, 08:32 PM
#11 | |||||
|
__________________ Teacher - Malware Removal University - You too could train to help others Topics not replied to within 3 days will be removed from my Subscribed Threads List |
14-Nov-2009, 02:21 AM
#12 | |||||
| |
14-Nov-2009, 04:03 AM
#13 | |||||
|
__________________ Teacher - Malware Removal University - You too could train to help others Topics not replied to within 3 days will be removed from my Subscribed Threads List |
14-Nov-2009, 04:30 AM
#14 | |||||
| |
14-Nov-2009, 05:08 AM
#15 | |||||
|
__________________ Teacher - Malware Removal University - You too could train to help others Topics not replied to within 3 days will be removed from my Subscribed Threads List |
 |
| |
| Currently Active Users Viewing This Thread: 1 (0 members and 1 guests) | |
| Thread Tools | |
| |
| You Are Using:  |
Advertisements do not imply our endorsement of that product or service. All times are GMT -4. The time now is 10:26 PM. Copyright © 1996 - 2011 TechGuy, Inc. All rights reserved. |  |
Facebook
Twitter
TechGuy.tv
TSG Mobile