Login | Live Chat & Podcast at 1:00PM Eastern on Sunday! |
 Search | |
| |
13-Nov-2009, 12:43 AM
#1 | ||||||
 Computer seems to be FUBAR |
| |
16-Nov-2009, 03:35 PM
#2 | ||||||
| |
17-Nov-2009, 08:01 AM
#3 | |||||
| Hello and welcome to TSG IMPORTANT Whatever repairs we make, are for fixing your computer problems only and by no means should be used on another computer. To make cleaning this machine easier:-
1. Do you have any AntiVirus Software installed? Looking over your log it seems that you don't. Anti-virus software is a program that detects; cleans and erases harmful virus files on a Computer; Web server or Network. Unchecked, virus files can unintentionally be forwarded to others and thereby spread infection. Because new viruses regularly emerge, anti-virus software should be updated frequently. Anti-virus software scans the computer memory and disk drives for malicious code. They alert the user if a virus is present and will clean; delete (or quarantine) infected files or directories. If you have none installed Please download a free anti-virus software from one these excellent vendors NOW: 1) Antivir PersonalEdition Classic- Free anti-virus software for Windows. Detects and removes more than 50,000 viruses. Free support. Please note the following if you decide on Antivir Personal Edition Quote:
It is strongly recommended that you run only one antivirus program at a time. Having more than one antivirus program active in memory uses additional resources and can result in program conflicts and false virus alerts. If you choose to install more than one antivirus program on your computer then only one of them should be active in memory at a time. 2. Make an uninstall list using HijackThis To access the Uninstall Manager you would do the following:
Please post this log on your next reply. 3. Download and run Combofix This tool is not a toy and not for everyday use. ComboFix SHOULD NOT be used unless requested by a forum helper Please download ComboFix from one of these locations: Link 1 Link 2 * IMPORTANT !!! Save ComboFix.exe to your Desktop
 Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:  Click on Yes, to continue scanning for malware. When finished, it will produce a log for you. Please include the C:\ComboFix.txt in your next reply along with a fresh HijackThis log. If you need help, see this link: http://www.bleepingcomputer.com/comb...o-use-combofix Please reply with:-
__________________ Teacher - Malware Removal University - You too could train to help others Topics not replied to within 3 days will be removed from my Subscribed Threads List |
17-Nov-2009, 05:40 PM
#4 | ||||||
| Last edited by generalcatfish; 17-Nov-2009 at 05:53 PM.. |
17-Nov-2009, 06:41 PM
#6 | ||||||
| okay, here's the combofix log: === ComboFix 09-11-18.04 - GeneralCatfish 11/17/2009 14:02.1.2 - x86 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2559.2016 [GMT -8:00] Running from: c:\documents and settings\GeneralCatfish\Desktop\123.exe * Created a new restore point . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\docume~1\TYLERC~1\LOCALS~1\Temp\tmp2.tmp c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat c:\documents and settings\GeneralCatfish\Start Menu\Programs\Security Tool.lnk c:\windows\jestertb.dll c:\windows\system32\__c001B4BE.dat c:\windows\system32\__c00F623C.exe c:\windows\system32\Agent.OMZ.Fix.exe c:\windows\system32\bodalene.dll c:\windows\system32\config\systemprofile\Start Menu\Programs\Windows Police Pro c:\windows\system32\config\systemprofile\Start Menu\Programs\Windows Police Pro\Windows Police Pro.lnk c:\windows\system32\drivers\H8SRTdxiqowqpuc.sys c:\windows\system32\dumphive.exe c:\windows\system32\gaduvoma.dll c:\windows\system32\h8srtcfg.dat c:\windows\system32\H8SRTiyueeryqqh.dat c:\windows\system32\h8srtmain.dll c:\windows\system32\H8SRTnstaecfqtd.dll c:\windows\system32\H8SRTpdkbwwdffh.dll c:\windows\system32\h8srttmp.db c:\windows\system32\H8SRTwpqlmdpbpy.dll c:\windows\system32\H8SRTxnspwswrud.dll c:\windows\system32\H8SRTxrsmkgrpuq.db c:\windows\system32\hibunevo.dll c:\windows\system32\hutikovu.dll c:\windows\system32\IEDFix.exe c:\windows\system32\lebenesa.dll c:\windows\system32\lotakine.dll c:\windows\system32\muhoyawa.dll c:\windows\system32\o4Patch.exe c:\windows\system32\Process.exe c:\windows\system32\SrchSTS.exe c:\windows\system32\tadagagu.dll c:\windows\system32\tmp.reg c:\windows\system32\VCCLSID.exe c:\windows\system32\vmss c:\windows\system32\WS2Fix.exe c:\windows\Tasks\At1.job c:\windows\Tasks\At10.job c:\windows\Tasks\At11.job c:\windows\Tasks\At12.job c:\windows\Tasks\At13.job c:\windows\Tasks\At14.job c:\windows\Tasks\At15.job c:\windows\Tasks\At16.job c:\windows\Tasks\At17.job c:\windows\Tasks\At18.job c:\windows\Tasks\At19.job c:\windows\Tasks\At2.job c:\windows\Tasks\At20.job c:\windows\Tasks\At21.job c:\windows\Tasks\At22.job c:\windows\Tasks\At23.job c:\windows\Tasks\At24.job c:\windows\Tasks\At3.job c:\windows\Tasks\At4.job c:\windows\Tasks\At5.job c:\windows\Tasks\At6.job c:\windows\Tasks\At7.job c:\windows\Tasks\At8.job c:\windows\Tasks\At9.job c:\windows\Tasks\sdslzvox.job c:\windows\Temp\tmp3.tmp C:\xcrashdump.dat ----- BITS: Possible infected sites ----- hxxp://77.74.48.116 . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Service_H8SRTd.sys -------\Legacy_H8SRTd.sys ((((((((((((((((((((((((( Files Created from 2009-10-17 to 2009-11-17 ))))))))))))))))))))))))))))))) . 2009-11-17 21:25 . 2009-09-15 11:56 93424 ----a-w- c:\windows\system32\drivers\aswmon.sys 2009-11-17 21:25 . 2009-09-15 11:56 94160 ----a-w- c:\windows\system32\drivers\aswmon2.sys 2009-11-17 21:25 . 2009-09-15 11:55 114768 ----a-w- c:\windows\system32\drivers\aswSP.sys 2009-11-17 21:25 . 2009-09-15 11:55 20560 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys 2009-11-17 21:25 . 2009-09-15 11:54 52368 ----a-w- c:\windows\system32\drivers\aswTdi.sys 2009-11-17 21:25 . 2009-09-15 11:54 23152 ----a-w- c:\windows\system32\drivers\aswRdr.sys 2009-11-17 21:25 . 2009-09-15 11:53 27408 ----a-w- c:\windows\system32\drivers\aavmker4.sys 2009-11-17 21:25 . 2009-09-15 11:53 97480 ----a-w- c:\windows\system32\AvastSS.scr 2009-11-17 21:25 . 2009-09-15 11:59 1279968 ----a-w- c:\windows\system32\aswBoot.exe 2009-11-17 21:25 . 2009-11-17 21:25 -------- d-----w- c:\program files\Alwil Software 2009-11-17 05:41 . 2009-11-17 05:36 15880 ----a-w- c:\windows\system32\lsdelete.exe 2009-11-17 05:37 . 2009-09-23 12:55 64288 ----a-w- c:\windows\system32\drivers\Lbd.sys 2009-11-17 05:35 . 2009-11-17 05:35 640608 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\AutoLaunch.exe 2009-11-17 05:35 . 2009-11-17 05:35 815760 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\Ad-AwareCommand.exe 2009-11-17 05:35 . 2009-11-17 05:35 822904 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\Ad-AwareAdmin.exe 2009-11-17 05:35 . 2009-11-17 05:35 1638104 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\Ad-Aware.exe 2009-11-17 05:35 . 2009-11-17 05:35 788368 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\AAWTray.exe 2009-11-17 05:35 . 2009-11-17 05:35 1179232 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\AAWService.exe 2009-11-17 05:34 . 2009-11-17 05:34 -------- dc-h--w- c:\documents and settings\All Users\Application Data\{CFBD8779-FAAB-4357-84F2-1EC8619FADA6} 2009-11-17 05:34 . 2009-10-03 08:15 2924848 -c--a-w- c:\documents and settings\All Users\Application Data\{CFBD8779-FAAB-4357-84F2-1EC8619FADA6}\Ad-AwareInstallation.exe 2009-11-17 05:33 . 2009-11-17 05:34 -------- d-----w- c:\documents and settings\All Users\Application Data\Lavasoft 2009-11-17 05:18 . 2009-11-17 05:18 76264 ----a-w- c:\documents and settings\GeneralCatfish\Application Data\CC\uninstall.exe 2009-11-17 05:18 . 2009-11-17 05:41 -------- d-----w- c:\documents and settings\GeneralCatfish\Application Data\CC 2009-11-16 19:25 . 2009-11-16 19:25 -------- d-----w- c:\program files\Trend Micro 2009-11-16 09:19 . 2009-11-16 09:19 -------- d-sh--w- c:\documents and settings\LocalService\IETldCache 2009-11-15 13:57 . 2009-11-15 13:57 551424 ----a-w- c:\documents and settings\GeneralCatfish\Application Data\CC\agent.exe 2009-11-09 22:24 . 2009-09-10 22:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2009-11-09 22:24 . 2009-11-11 20:03 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware 2009-11-09 22:24 . 2009-09-10 22:53 19160 ----a-w- c:\windows\system32\drivers\mbam.sys 2009-11-09 21:36 . 2009-11-09 21:36 826 ----a-w- c:\windows\system32\wininit.dll 2009-11-04 03:01 . 2009-11-04 03:01 -------- d-sh--w- c:\documents and settings\Default User\IETldCache . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-11-17 05:33 . 2005-01-28 19:07 -------- d-----w- c:\program files\Lavasoft 2009-11-16 19:38 . 2008-01-30 22:31 -------- d-----w- c:\program files\Steam 2009-11-12 06:34 . 2006-03-15 01:31 -------- d-----w- c:\program files\Better File Rename 2009-11-12 01:35 . 2008-09-13 06:41 -------- d-----w- c:\program files\City of Heroes 2009-11-11 03:04 . 2009-09-28 19:26 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help 2009-11-09 22:10 . 2009-05-21 16:18 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP 2009-11-06 06:31 . 2009-03-19 22:40 -------- d-----w- c:\program files\CoHTest 2009-11-04 03:27 . 2003-12-29 02:01 93760 ----a-w- c:\documents and settings\GeneralCatfish\Local Settings\Application Data\GDIPFONTCACHEV1.DAT 2009-11-04 03:04 . 2009-09-28 19:35 -------- d-----w- c:\program files\Microsoft Works 2009-11-01 00:02 . 2004-12-29 18:44 -------- d-----w- c:\program files\LimeWire 2009-10-28 07:36 . 2009-09-15 06:47 0 ----a-w- c:\documents and settings\GeneralCatfish\ntuser.tmp 2009-10-01 13:52 . 2009-02-05 22:43 -------- d-----w- c:\program files\SystemRequirementsLab 2009-09-28 19:32 . 2009-09-28 19:32 -------- d-----w- c:\program files\Microsoft.NET 2009-09-28 19:28 . 2009-09-28 19:28 -------- d-----w- c:\program files\Microsoft Visual Studio 8 2009-09-28 19:18 . 2009-09-28 19:18 -------- d-----w- c:\program files\FolderSize 2009-09-21 21:15 . 2009-09-21 21:15 -------- d-----w- c:\documents and settings\GeneralCatfish\Application Data\Malwarebytes 2009-09-21 21:15 . 2009-09-21 21:15 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes 2009-09-16 01:45 . 2009-09-16 01:45 15086 ----a-r- c:\documents and settings\GeneralCatfish\Application Data\Microsoft\Installer\{E4406BD5-1FEF-4489-A714-AEDBDB9C6678}\_8C4F28E4C012222A3FD3AC.exe 2009-09-16 01:45 . 2009-09-16 01:45 15086 ----a-r- c:\documents and settings\GeneralCatfish\Application Data\Microsoft\Installer\{E4406BD5-1FEF-4489-A714-AEDBDB9C6678}\_6FEFF9B68218417F98F549.exe 2009-09-16 01:45 . 2009-09-16 01:45 15086 ----a-r- c:\documents and settings\GeneralCatfish\Application Data\Microsoft\Installer\{E4406BD5-1FEF-4489-A714-AEDBDB9C6678}\_38E7ABF9A1E5B8A7494755.exe 2009-09-11 14:18 . 2003-03-31 12:00 136192 ----a-w- c:\windows\system32\msv1_0.dll 2009-09-04 21:03 . 2003-03-31 12:00 58880 ----a-w- c:\windows\system32\msasn1.dll 2009-08-29 08:08 . 2004-02-07 01:05 916480 ----a-w- c:\windows\system32\wininet.dll 2009-08-27 21:58 . 2009-07-21 19:24 25 ----a-w- c:\windows\popcinfot.dat 2009-08-26 08:00 . 2003-03-31 12:00 247326 ----a-w- c:\windows\system32\strmdll.dll 2005-04-24 16:51 . 2005-04-24 16:51 25993 --sha-w- c:\windows\system\ssvipat.tmp 2009-08-16 08:17 . 2009-08-16 08:17 520192 --sha-w- c:\windows\system32\bimefili.exe 2009-08-13 00:20 . 2009-08-13 00:20 61440 --sha-w- c:\windows\system32\miziwiva.dll 2009-08-17 21:17 . 2009-08-17 21:17 39424 --sha-w- c:\windows\system32\penipure.dll 2009-08-11 19:32 . 2009-08-11 19:32 397312 --sha-w- c:\windows\system32\piwinala.exe 2009-08-16 08:17 . 2009-08-16 08:17 60928 --sha-w- c:\windows\system32\razadupe.dll 2009-08-17 21:17 . 2009-08-17 21:17 45056 --sha-w- c:\windows\system32\sapawoma.dll 2009-08-17 05:13 . 2009-08-17 05:13 39424 --sha-w- c:\windows\system32\wiwuzoza.dll 2009-08-16 09:17 . 2009-08-16 09:17 60928 --sha-w- c:\windows\system32\yivilaje.dll 2009-08-17 05:13 . 2009-08-17 05:13 45056 --sha-w- c:\windows\system32\yunukino.dll . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2005-10-26 155648] "WD Drive Manager"="c:\program files\Western Digital\WD Drive Manager\WDBtnMgrUI.exe" [2008-07-24 450560] "WD Anywhere Backup"="c:\program files\WD\WD Anywhere Backup\MemeoLauncher2.exe" [2009-04-17 197856] "nwiz"="c:\program files\NVIDIA Corporation\nView\nwiz.exe" [2009-08-13 1657376] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-08-17 13877248] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-08-17 86016] "Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\a4hNpQwEG.exe" [2009-11-11 1312080] "GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce] "RunNarrator"="Narrator.exe" - c:\windows\system32\narrator.exe [2008-04-14 53760] c:\documents and settings\GeneralCatfish\Start Menu\Programs\Startup\ OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2008-10-25 98696] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "midi2"=cbxt3usr.dll [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavaso ft Ad-Aware Service] @="Service" [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Acrobat Assistant.lnk] backup=c:\windows\pss\Acrobat Assistant.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^America Online 9.0 Tray Icon.lnk] backup=c:\windows\pss\America Online 9.0 Tray Icon.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk] path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Find Fast.lnk] backup=c:\windows\pss\Microsoft Find Fast.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^My Essentials Wireless USB Utility.lnk] path=c:\documents and settings\All Users\Start Menu\Programs\Startup\My Essentials Wireless USB Utility.lnk backup=c:\windows\pss\My Essentials Wireless USB Utility.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Office Startup.lnk] backup=c:\windows\pss\Office Startup.lnkCommon Startup HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Daily Weather Forecast HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MMTray [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services] "x10nets"=3 (0x3) "WANMiniportService"=2 (0x2) "Viewpoint Manager Service"=2 (0x2) "Pml Driver HPZ12"=3 (0x3) "NVSvc"=2 (0x2) "Norton AntiVirus Server"=2 (0x2) "NetSvc"=3 (0x3) "Macromedia Licensing Service"=3 (0x3) "iPodService"=3 (0x3) "IDriverT"=3 (0x3) "IAANTMon"=2 (0x2) "DefWatch"=2 (0x2) "ATI Smart"=2 (0x2) "Ati HotKey Poller"=2 (0x2) "AOLService"=2 (0x2) "AOL ACS"=2 (0x2) "Adobe LM Service"=3 (0x3) [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusOverride"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\Auth orizedApplications\List] "c:\\Program Files\\mIRC\\mirc.exe"= "c:\\mIrc\\TechBOT\\TechBOTv1.0\\mirc.exe"= "c:\\Program Files\\AIM\\aim.exe"= "c:\\WINDOWS\\system32\\sessmgr.exe"= "c:\\Program Files\\iTunes\\iTunes.exe"= "c:\\WINDOWS\\system32\\ftp.exe"= "c:\\Program Files\\ScifienceStudios\\ChexQuest\\Legacy.exe"= "c:\\StubInstaller.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\Steam\\steamapps\\piemanmoo\\team fortress 2\\hl2.exe"= "c:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe"= "c:\\Program Files\\Common Files\\AOL\\1127968127\\ee\\aolsoftware.exe"= "c:\\Program Files\\Java\\j2re1.4.2_04\\bin\\javaw.exe"= "c:\\Program Files\\Steam\\steamapps\\piemanmoo\\source 2007 dedicated server\\srcds.exe"= "c:\\HLServer\\orangebox\\srcds.exe"= "c:\\Program Files\\Steam\\steamapps\\common\\ultimate doom\\ultimate.bat"= "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\America Online 9.0a\\waol.exe"= "c:\\WINDOWS\\system32\\dpvsetup.exe"= "c:\\Program Files\\Ventrilo\\Ventrilo.exe"= "c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"= "c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"= "c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"= "c:\\Program Files\\Steam\\steam.exe"= "c:\\Program Files\\Steam\\steamapps\\common\\left 4 dead 2 demo\\left4dead2.exe"= "c:\\Program Files\\Steam\\steamapps\\common\\left 4 dead\\left4dead.exe"= "c:\\Program Files\\Western Digital\\WD Drive Manager\\WDBtnMgrUI.exe"= "c:\\WINDOWS\\system32\\drwtsn32.exe"= "c:\\Program Files\\America Online 9.0a\\shellrestart.exe"= [HKLM\~\services\\antiSpywareApp\\ver2_0_32_1\\AOLSP Scheduler.exe"=] "c:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe"= "c:\\Program Files\\FolderSize\\FolderSizeSvc.exe"= "c:\\Program Files\\Lavasoft\\Ad-Aware\\AAWTray.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\Glob allyOpenPorts\List] "4662:TCP"= 4662:TCP:*  isabled:4662R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [11/16/2009 9:37 PM 64288] R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [11/17/2009 1:25 PM 114768] R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [11/17/2009 1:25 PM 20560] R2 cbxt3krn;YAMAHA CBX Driver;c:\windows\system32\drivers\cbxt3krn.sys [2/17/2008 1:29 PM 9760] R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [9/24/2009 3:17 AM 1179232] R2 MemeoBackgroundService;MemeoBackgroundService;c:\program files\WD\WD Anywhere Backup\MemeoBackgroundService.exe [4/17/2009 9:51 AM 25824] R2 WDBtnMgrSvc.exe;WD Drive Manager Service;c:\program files\Western Digital\WD Drive Manager\WDBtnMgrSvc.exe [7/24/2008 2:22 PM 102400] S1 cyydlzpq;cyydlzpq;\??\c:\windows\system32\drivers\cyydlzpq.sys --> c:\windows\system32\drivers\cyydlzpq.sys [?] S3 OMAWGU(Belkin Corporation);My Essential G USB Adapter(Belkin Corporation);c:\windows\system32\drivers\OMAWGU.sys [1/16/2008 2:03 PM 408064] S3 PLCMP532;PLCMP532 NDIS Protocol Driver; [x] S3 PLCND532;PLCND532 NDIS Protocol Driver;c:\windows\system32\drivers\PLCND532.sys [10/25/2007 9:50 AM 26656] S3 SCREAMINGBDRIVER;Screaming Bee Audio;c:\windows\system32\drivers\ScreamingBAudio.sys [4/6/2009 12:19 PM 23064] S3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\drivers\wdcsam.sys [3/22/2009 3:46 PM 11520] S4 Plnsprregudk;Plnsprregudk; [x] S4 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [4/8/2007 2:59 PM 24652] --- Other Services/Drivers In Memory --- *Deregistered* - mbr . Contents of the 'Scheduled Tasks' folder 2009-11-17 c:\windows\Tasks\Ad-Aware Update (Weekly).job - c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-10-01 05:35] 2009-11-11 c:\windows\Tasks\Virus-Update.job - c:\virus_updates\Virus-Update.bat [2003-12-23 23:51] . . ------- Supplementary Scan ------- . uStart Page = hxxp://www.google.com/ IE: &AOL Toolbar search - c:\program files\AOL Toolbar\toolbar.dll/SEARCH.HTML IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000 Trusted Zone: 1 Trusted Zone: google.com\www Trusted Zone: moviemistakes.com\www Trusted Zone: weebls-stuff.com\www TCP: {9A386B7A-704B-4DFA-9797-2EFE3CE5529D} = 77.74.48.113 DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} - hxxp://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab DPF: {40F576AD-8680-4F9E-9490-99D069CD665F} - hxxp://srtest-cdn.systemrequirementslab.com.s3.amazonaws.com/bin/sysreqlabdetect.cab . - - - - ORPHANS REMOVED - - - - BHO-{1b1f623c-f18d-4023-8f2f-c5d8d6de4482} - jukabama.dll BHO-{76EDE2E3-8EB5-4308-905B-301F654B2F61} - (no file) HKLM-Run-17906427 - c:\documents and settings\All Users\Application Data\17906427\17906427.exe HKLM-Run-geruvawuz - c:\windows\system32\hibunevo.dll HKLM-Run-ruhawedera - wewusigo.dll SharedTaskScheduler-{54cc2684-f888-4242-866b-da4a608e3a1c} - c:\windows\system32\rumerubo.dll SharedTaskScheduler-{3fe658a4-e696-4a05-b1eb-6c8cbb449b66} - c:\windows\system32\hibunevo.dll SSODL-poguhimef-{54cc2684-f888-4242-866b-da4a608e3a1c} - c:\windows\system32\rumerubo.dll SSODL-benalafod-{3fe658a4-e696-4a05-b1eb-6c8cbb449b66} - c:\windows\system32\hibunevo.dll Notify-ssqrs - ssqrs.dll Notify-tapivss - (no file) Notify-vturp - (no file) ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-11-17 14:21 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . --------------------- LOCKED REGISTRY KEYS --------------------- [HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Reinstall\ŘP*] "DisplayName"="?\13?\13" "DeviceDesc"="?\13?\13" "ProviderName"="" "MFG"="???\\" "ReinstallString"="c:\\WINDOWS\\System32\\ReinstallBackups\\?\13\\DriverFil es\\.INF" "DeviceInstanceIds"=multi:"08449.inf\00" . --------------------- DLLs Loaded Under Running Processes --------------------- - - - - - - - > 'winlogon.exe'(712) c:\windows\system32\Ati2evxx.dll - - - - - - - > 'explorer.exe'(1180) c:\windows\system32\WININET.dll c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.3053_x-ww_b80fa8ca\MSVCR80.dll c:\windows\system32\ieframe.dll c:\windows\system32\webcheck.dll c:\windows\system32\hnetcfg.dll . ------------------------ Other Running Processes ------------------------ . c:\program files\Alwil Software\Avast4\aswUpdSv.exe c:\windows\system32\RUNDLL32.EXE c:\progra~1\COMMON~1\AOL\ACS\AOLacsd.exe c:\program files\FolderSize\FolderSizeSvc.exe c:\windows\System32\wbem\unsecapp.exe c:\program files\WD\WD Anywhere Backup\MemeoBackup.exe c:\windows\system32\wscntfy.exe c:\program files\Lavasoft\Ad-Aware\AAWTray.exe . ************************************************************************** . Completion time: 2009-11-17 14:34 - machine was rebooted ComboFix-quarantined-files.txt 2009-11-17 22:34 Pre-Run: 7,458,717,696 bytes free Post-Run: 11,495,374,848 bytes free WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems] c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect /NoExecute=OptIn - - End Of File - - 452F400695F071926242A9336B90C062 === |
17-Nov-2009, 06:43 PM
#7 | ||||||
| |
17-Nov-2009, 07:53 PM
#8 | |||||
| Please update me on how system is running after doing the following. Please go to Virus Total <http://www.virustotal.com/> or Jotti and upload c:\documents and settings\GeneralCatfish\Application Data\Microsoft\Installer\{E4406BD5-1FEF-4489-A714-AEDBDB9C6678}\_8C4F28E4C012222A3FD3AC.exe for scanning. For Virus Total 1. Please copy and paste c:\documents and settings\GeneralCatfish\Application Data\Microsoft\Installer\{E4406BD5-1FEF-4489-A714-AEDBDB9C6678}\_8C4F28E4C012222A3FD3AC.exe in the text box next to the Browse button. 2. Click on Send File. For Jotti 1. Please copy and paste c:\documents and settings\GeneralCatfish\Application Data\Microsoft\Installer\{E4406BD5-1FEF-4489-A714-AEDBDB9C6678}\_8C4F28E4C012222A3FD3AC.exe in the text box next to the Browse button. 2. Click on Submit. Please post back the results of the scan in your next post. Open Hijack This and select Do a System Scan Only place a check next to the below lines if still present
Once selected close all windows except HJT an click on Fix Checked COMBOFIX-Script A word of warning: Please do not run ComboFix on your own. This tool is not a toy and not for everyday use.
Please reply with:-
__________________ Teacher - Malware Removal University - You too could train to help others Topics not replied to within 3 days will be removed from my Subscribed Threads List |
17-Nov-2009, 08:03 PM
#9 | ||||||
| |
17-Nov-2009, 08:19 PM
#10 | ||||||
| Now, here's the combofix log: ===ComboFix 09-11-18.04 - GeneralCatfish 11/17/2009 16:07.2.2 - x86 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2559.2017 [GMT -8:00] Running from: c:\documents and settings\GeneralCatfish\Desktop\123.exe Command switches used :: c:\documents and settings\GeneralCatfish\Desktop\CFScript.txt AV: avast! antivirus 4.8.0 [VPS 091023-0] *On-access scanning disabled* (Outdated) {7591DB91-41F0-48A3-B128-1A293FD8233D} FILE :: "c:\windows\system\ssvipat.tmp" "c:\windows\system32\bimefili.exe" "c:\windows\system32\miziwiva.dll" "c:\windows\system32\penipure.dll" "c:\windows\system32\piwinala.exe" "c:\windows\system32\razadupe.dll" "c:\windows\system32\sapawoma.dll" "c:\windows\system32\wiwuzoza.dll" "c:\windows\system32\yivilaje.dll" "c:\windows\system32\yunukino.dll" "c:\windows\Tasks\Virus-Update.job" . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\windows\system\ssvipat.tmp c:\windows\system32\bimefili.exe c:\windows\system32\miziwiva.dll c:\windows\system32\penipure.dll c:\windows\system32\piwinala.exe c:\windows\system32\razadupe.dll c:\windows\system32\sapawoma.dll c:\windows\system32\wiwuzoza.dll c:\windows\system32\yivilaje.dll c:\windows\system32\yunukino.dll c:\windows\Tasks\Virus-Update.job . ((((((((((((((((((((((((( Files Created from 2009-10-18 to 2009-11-18 ))))))))))))))))))))))))))))))) . 2009-11-17 21:25 . 2009-09-15 11:56 93424 ----a-w- c:\windows\system32\drivers\aswmon.sys 2009-11-17 21:25 . 2009-09-15 11:56 94160 ----a-w- c:\windows\system32\drivers\aswmon2.sys 2009-11-17 21:25 . 2009-09-15 11:55 114768 ----a-w- c:\windows\system32\drivers\aswSP.sys 2009-11-17 21:25 . 2009-09-15 11:55 20560 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys 2009-11-17 21:25 . 2009-09-15 11:54 52368 ----a-w- c:\windows\system32\drivers\aswTdi.sys 2009-11-17 21:25 . 2009-09-15 11:54 23152 ----a-w- c:\windows\system32\drivers\aswRdr.sys 2009-11-17 21:25 . 2009-09-15 11:53 27408 ----a-w- c:\windows\system32\drivers\aavmker4.sys 2009-11-17 21:25 . 2009-09-15 11:53 97480 ----a-w- c:\windows\system32\AvastSS.scr 2009-11-17 21:25 . 2009-09-15 11:59 1279968 ----a-w- c:\windows\system32\aswBoot.exe 2009-11-17 21:25 . 2009-11-17 21:25 -------- d-----w- c:\program files\Alwil Software 2009-11-17 05:41 . 2009-11-17 05:36 15880 ----a-w- c:\windows\system32\lsdelete.exe 2009-11-17 05:37 . 2009-09-23 12:55 64288 ----a-w- c:\windows\system32\drivers\Lbd.sys 2009-11-17 05:35 . 2009-11-17 05:35 640608 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\AutoLaunch.exe 2009-11-17 05:35 . 2009-11-17 05:35 815760 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\Ad-AwareCommand.exe 2009-11-17 05:35 . 2009-11-17 05:35 822904 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\Ad-AwareAdmin.exe 2009-11-17 05:35 . 2009-11-17 05:35 1638104 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\Ad-Aware.exe 2009-11-17 05:35 . 2009-11-17 05:35 788368 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\AAWTray.exe 2009-11-17 05:35 . 2009-11-17 05:35 1179232 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\AAWService.exe 2009-11-17 05:34 . 2009-11-17 05:34 -------- dc-h--w- c:\documents and settings\All Users\Application Data\{CFBD8779-FAAB-4357-84F2-1EC8619FADA6} 2009-11-17 05:34 . 2009-10-03 08:15 2924848 -c--a-w- c:\documents and settings\All Users\Application Data\{CFBD8779-FAAB-4357-84F2-1EC8619FADA6}\Ad-AwareInstallation.exe 2009-11-17 05:33 . 2009-11-17 05:34 -------- d-----w- c:\documents and settings\All Users\Application Data\Lavasoft 2009-11-17 05:18 . 2009-11-17 05:18 76264 ----a-w- c:\documents and settings\GeneralCatfish\Application Data\CC\uninstall.exe 2009-11-17 05:18 . 2009-11-17 05:41 -------- d-----w- c:\documents and settings\GeneralCatfish\Application Data\CC 2009-11-16 19:25 . 2009-11-16 19:25 -------- d-----w- c:\program files\Trend Micro 2009-11-16 09:19 . 2009-11-16 09:19 -------- d-sh--w- c:\documents and settings\LocalService\IETldCache 2009-11-15 13:57 . 2009-11-15 13:57 551424 ----a-w- c:\documents and settings\GeneralCatfish\Application Data\CC\agent.exe 2009-11-09 22:24 . 2009-11-17 22:53 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware 2009-11-09 21:36 . 2009-11-09 21:36 826 ----a-w- c:\windows\system32\wininit.dll 2009-11-04 03:01 . 2009-11-04 03:01 -------- d-sh--w- c:\documents and settings\Default User\IETldCache . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-11-18 00:01 . 2008-01-30 22:31 -------- d-----w- c:\program files\Steam 2009-11-17 22:55 . 2009-05-21 16:18 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP 2009-11-17 22:52 . 2005-01-28 19:07 -------- d-----w- c:\program files\Lavasoft 2009-11-17 22:52 . 2005-01-28 19:07 -------- d-----w- c:\documents and settings\GeneralCatfish\Application Data\Lavasoft 2009-11-12 06:34 . 2006-03-15 01:31 -------- d-----w- c:\program files\Better File Rename 2009-11-12 01:35 . 2008-09-13 06:41 -------- d-----w- c:\program files\City of Heroes 2009-11-11 03:04 . 2009-09-28 19:26 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help 2009-11-06 06:31 . 2009-03-19 22:40 -------- d-----w- c:\program files\CoHTest 2009-11-04 03:27 . 2003-12-29 02:01 93760 ----a-w- c:\documents and settings\GeneralCatfish\Local Settings\Application Data\GDIPFONTCACHEV1.DAT 2009-11-04 03:04 . 2009-09-28 19:35 -------- d-----w- c:\program files\Microsoft Works 2009-11-01 00:02 . 2004-12-29 18:44 -------- d-----w- c:\program files\LimeWire 2009-10-28 07:36 . 2009-09-15 06:47 0 ----a-w- c:\documents and settings\GeneralCatfish\ntuser.tmp 2009-10-01 13:52 . 2009-02-05 22:43 -------- d-----w- c:\program files\SystemRequirementsLab 2009-09-28 19:32 . 2009-09-28 19:32 -------- d-----w- c:\program files\Microsoft.NET 2009-09-28 19:28 . 2009-09-28 19:28 -------- d-----w- c:\program files\Microsoft Visual Studio 8 2009-09-28 19:18 . 2009-09-28 19:18 -------- d-----w- c:\program files\FolderSize 2009-09-21 21:15 . 2009-09-21 21:15 -------- d-----w- c:\documents and settings\GeneralCatfish\Application Data\Malwarebytes 2009-09-21 21:15 . 2009-09-21 21:15 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes 2009-09-16 01:45 . 2009-09-16 01:45 15086 ----a-r- c:\documents and settings\GeneralCatfish\Application Data\Microsoft\Installer\{E4406BD5-1FEF-4489-A714-AEDBDB9C6678}\_8C4F28E4C012222A3FD3AC.exe 2009-09-16 01:45 . 2009-09-16 01:45 15086 ----a-r- c:\documents and settings\GeneralCatfish\Application Data\Microsoft\Installer\{E4406BD5-1FEF-4489-A714-AEDBDB9C6678}\_6FEFF9B68218417F98F549.exe 2009-09-16 01:45 . 2009-09-16 01:45 15086 ----a-r- c:\documents and settings\GeneralCatfish\Application Data\Microsoft\Installer\{E4406BD5-1FEF-4489-A714-AEDBDB9C6678}\_38E7ABF9A1E5B8A7494755.exe 2009-09-11 14:18 . 2003-03-31 12:00 136192 ----a-w- c:\windows\system32\msv1_0.dll 2009-09-04 21:03 . 2003-03-31 12:00 58880 ----a-w- c:\windows\system32\msasn1.dll 2009-08-29 08:08 . 2004-02-07 01:05 916480 ------w- c:\windows\system32\wininet.dll 2009-08-27 21:58 . 2009-07-21 19:24 25 ----a-w- c:\windows\popcinfot.dat 2009-08-26 08:00 . 2003-03-31 12:00 247326 ----a-w- c:\windows\system32\strmdll.dll . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2005-10-26 155648] "WD Drive Manager"="c:\program files\Western Digital\WD Drive Manager\WDBtnMgrUI.exe" [2008-07-24 450560] "WD Anywhere Backup"="c:\program files\WD\WD Anywhere Backup\MemeoLauncher2.exe" [2009-04-17 197856] "nwiz"="c:\program files\NVIDIA Corporation\nView\nwiz.exe" [2009-08-13 1657376] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-08-17 13877248] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-08-17 86016] "Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\a4hNpQwEG.exe" [2009-11-11 1312080] "GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce] "RunNarrator"="Narrator.exe" - c:\windows\system32\narrator.exe [2008-04-14 53760] c:\documents and settings\GeneralCatfish\Start Menu\Programs\Startup\ OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2008-10-25 98696] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "midi2"=cbxt3usr.dll [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavaso ft Ad-Aware Service] @="Service" [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Acrobat Assistant.lnk] backup=c:\windows\pss\Acrobat Assistant.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^America Online 9.0 Tray Icon.lnk] backup=c:\windows\pss\America Online 9.0 Tray Icon.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk] path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Find Fast.lnk] backup=c:\windows\pss\Microsoft Find Fast.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^My Essentials Wireless USB Utility.lnk] path=c:\documents and settings\All Users\Start Menu\Programs\Startup\My Essentials Wireless USB Utility.lnk backup=c:\windows\pss\My Essentials Wireless USB Utility.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Office Startup.lnk] backup=c:\windows\pss\Office Startup.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services] "x10nets"=3 (0x3) "WANMiniportService"=2 (0x2) "Viewpoint Manager Service"=2 (0x2) "Pml Driver HPZ12"=3 (0x3) "NVSvc"=2 (0x2) "Norton AntiVirus Server"=2 (0x2) "NetSvc"=3 (0x3) "Macromedia Licensing Service"=3 (0x3) "iPodService"=3 (0x3) "IDriverT"=3 (0x3) "IAANTMon"=2 (0x2) "DefWatch"=2 (0x2) "ATI Smart"=2 (0x2) "Ati HotKey Poller"=2 (0x2) "AOLService"=2 (0x2) "AOL ACS"=2 (0x2) "Adobe LM Service"=3 (0x3) [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusOverride"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\Auth orizedApplications\List] "c:\\Program Files\\mIRC\\mirc.exe"= "c:\\mIrc\\TechBOT\\TechBOTv1.0\\mirc.exe"= "c:\\Program Files\\AIM\\aim.exe"= "c:\\WINDOWS\\system32\\sessmgr.exe"= "c:\\Program Files\\iTunes\\iTunes.exe"= "c:\\WINDOWS\\system32\\ftp.exe"= "c:\\Program Files\\ScifienceStudios\\ChexQuest\\Legacy.exe"= "c:\\StubInstaller.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\Steam\\steamapps\\piemanmoo\\team fortress 2\\hl2.exe"= "c:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe"= "c:\\Program Files\\Common Files\\AOL\\1127968127\\ee\\aolsoftware.exe"= "c:\\Program Files\\Java\\j2re1.4.2_04\\bin\\javaw.exe"= "c:\\Program Files\\Steam\\steamapps\\piemanmoo\\source 2007 dedicated server\\srcds.exe"= "c:\\HLServer\\orangebox\\srcds.exe"= "c:\\Program Files\\Steam\\steamapps\\common\\ultimate doom\\ultimate.bat"= "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\America Online 9.0a\\waol.exe"= "c:\\WINDOWS\\system32\\dpvsetup.exe"= "c:\\Program Files\\Ventrilo\\Ventrilo.exe"= "c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"= "c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"= "c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"= "c:\\Program Files\\Steam\\steam.exe"= "c:\\Program Files\\Steam\\steamapps\\common\\left 4 dead\\left4dead.exe"= "c:\\Program Files\\Western Digital\\WD Drive Manager\\WDBtnMgrUI.exe"= "c:\\WINDOWS\\system32\\drwtsn32.exe"= "c:\\Program Files\\America Online 9.0a\\shellrestart.exe"= [HKLM\~\services\\antiSpywareApp\\ver2_0_32_1\\AOLSP Scheduler.exe"=] "c:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe"= "c:\\Program Files\\FolderSize\\FolderSizeSvc.exe"= "c:\\Program Files\\Lavasoft\\Ad-Aware\\AAWTray.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\Glob allyOpenPorts\List] "4662:TCP"= 4662:TCP:* isabled:4662R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [11/16/2009 9:37 PM 64288] R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [11/17/2009 1:25 PM 114768] R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [11/17/2009 1:25 PM 20560] R2 cbxt3krn;YAMAHA CBX Driver;c:\windows\system32\drivers\cbxt3krn.sys [2/17/2008 1:29 PM 9760] R2 MemeoBackgroundService;MemeoBackgroundService;c:\program files\WD\WD Anywhere Backup\MemeoBackgroundService.exe [4/17/2009 9:51 AM 25824] R2 WDBtnMgrSvc.exe;WD Drive Manager Service;c:\program files\Western Digital\WD Drive Manager\WDBtnMgrSvc.exe [7/24/2008 2:22 PM 102400] S1 cyydlzpq;cyydlzpq;\??\c:\windows\system32\drivers\cyydlzpq.sys --> c:\windows\system32\drivers\cyydlzpq.sys [?] S2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [9/24/2009 3:17 AM 1179232] S3 OMAWGU(Belkin Corporation);My Essential G USB Adapter(Belkin Corporation);c:\windows\system32\drivers\OMAWGU.sys [1/16/2008 2:03 PM 408064] S3 PLCMP532;PLCMP532 NDIS Protocol Driver; [x] S3 PLCND532;PLCND532 NDIS Protocol Driver;c:\windows\system32\drivers\PLCND532.sys [10/25/2007 9:50 AM 26656] S3 SCREAMINGBDRIVER;Screaming Bee Audio;c:\windows\system32\drivers\ScreamingBAudio.sys [4/6/2009 12:19 PM 23064] S3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\drivers\wdcsam.sys [3/22/2009 3:46 PM 11520] S4 Plnsprregudk;Plnsprregudk; [x] S4 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [4/8/2007 2:59 PM 24652] --- Other Services/Drivers In Memory --- *Deregistered* - mbr *Deregistered* - PROCEXP113 . Contents of the 'Scheduled Tasks' folder 2009-11-17 c:\windows\Tasks\Ad-Aware Update (Weekly).job - c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-10-01 05:35] . . ------- Supplementary Scan ------- . uStart Page = hxxp://www.google.com/ IE: &AOL Toolbar search - c:\program files\AOL Toolbar\toolbar.dll/SEARCH.HTML IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000 DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} - hxxp://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab DPF: {40F576AD-8680-4F9E-9490-99D069CD665F} - hxxp://srtest-cdn.systemrequirementslab.com.s3.amazonaws.com/bin/sysreqlabdetect.cab . ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-11-17 16:13 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . --------------------- LOCKED REGISTRY KEYS --------------------- [HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Reinstall\ŘP*] "DisplayName"="?\13?\13" "DeviceDesc"="?\13?\13" "ProviderName"="" "MFG"="???\\" "ReinstallString"="c:\\WINDOWS\\System32\\ReinstallBackups\\?\13\\DriverFil es\\.INF" "DeviceInstanceIds"=multi:"08449.inf\00" . --------------------- DLLs Loaded Under Running Processes --------------------- - - - - - - - > 'winlogon.exe'(712) c:\windows\system32\Ati2evxx.dll . Completion time: 2009-11-17 16:16 ComboFix-quarantined-files.txt 2009-11-18 00:15 ComboFix2.txt 2009-11-17 22:34 Pre-Run: 14,435,815,424 bytes free Post-Run: 14,419,681,280 bytes free - - End Of File - - 0682661538EF194FC4E17F42A4536136 === and a new HJT file: ===Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 4:18:47 PM, on 11/17/2009 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v8.00 (8.00.6001.18702) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Western Digital\WD Drive Manager\WDBtnMgrUI.exe C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe C:\WINDOWS\system32\spoolsv.exe C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe C:\Program Files\FolderSize\FolderSizeSvc.exe C:\Program Files\WD\WD Anywhere Backup\MemeoBackgroundService.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Western Digital\WD Drive Manager\WDBtnMgrSvc.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\explorer.exe C:\Program Files\internet explorer\iexplore.exe C:\Program Files\internet explorer\iexplore.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Acrobat\ActiveX\AcroIEHelper.ocx O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [WD Drive Manager] C:\Program Files\Western Digital\WD Drive Manager\WDBtnMgrUI.exe O4 - HKLM\..\Run: [WD Anywhere Backup] C:\Program Files\WD\WD Anywhere Backup\MemeoLauncher2.exe --silent O4 - HKLM\..\Run: [nwiz] C:\Program Files\NVIDIA Corporation\nView\nwiz.exe /install O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\a4hNpQwEG.exe" /runcleanupscript O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user') O4 - Startup: OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra button: Flash Decompiler SWF Capture tool - {86B4FC19-8FA4-4FD3-B243-9AEDB42FA2D5} - C:\PROGRA~1\ELTIMA~1\FLASHD~1\iebt.dll (HKCU) O9 - Extra 'Tools' menuitem: Flash Decompiler SWF Capture tool menu - {86B4FC19-8FA4-4FD3-B243-9AEDB42FA2D5} - C:\PROGRA~1\ELTIMA~1\FLASHD~1\iebt.dll (HKCU) O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - http://www.nvidia.com/content/Driver...sysreqlab3.cab O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} (System Requirements Lab) - http://www.nvidia.com/content/Driver...reqlab_nvd.cab O16 - DPF: {37DF41B2-61DB-4CAC-A755-CFB3C7EE7F40} (AOL Content Update) - http://esupport.aol.com/help/acp2/en...ach_core_1.cab O16 - DPF: {40F576AD-8680-4F9E-9490-99D069CD665F} (System Requirements Lab Class) - http://srtest-cdn.systemrequirements...qlabdetect.cab O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/...toUploader.cab O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsof...?1146437535187 O16 - DPF: {74DBCB52-F298-4110-951D-AD2FF67BC8AB} (NVIDIA Smart Scan) - http://www.nvidia.com/content/Driver...aSmartScan.cab O16 - DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539} (Crucial cpcScan) - http://www.crucial.com/controls/cpcScanner.cab O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/Ms...Downloader.cab O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: Folder Size (FolderSize) - Brio - C:\Program Files\FolderSize\FolderSizeSvc.exe O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe O23 - Service: Macromedia Licensing Service - Macromedia - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe O23 - Service: MemeoBackgroundService - Memeo - C:\Program Files\WD\WD Anywhere Backup\MemeoBackgroundService.exe O23 - Service: WD Drive Manager Service (WDBtnMgrSvc.exe) - WDC - C:\Program Files\Western Digital\WD Drive Manager\WDBtnMgrSvc.exe -- End of file - 7883 bytes === So far, it seems like my computer is back to it's old glory, but i'll wait until i get the all-clear first |
17-Nov-2009, 08:53 PM
#11 | |||||
|
__________________ Teacher - Malware Removal University - You too could train to help others Topics not replied to within 3 days will be removed from my Subscribed Threads List |
19-Nov-2009, 01:41 AM
#13 | ||||||
| |
19-Nov-2009, 01:41 AM
#14 | ||||||
| |
19-Nov-2009, 03:32 AM
#15 | |||||
|
__________________ Teacher - Malware Removal University - You too could train to help others Topics not replied to within 3 days will be removed from my Subscribed Threads List |
 |
| |
| Currently Active Users Viewing This Thread: 1 (0 members and 1 guests) | |
| Thread Tools | |
| |
| You Are Using:  |
Advertisements do not imply our endorsement of that product or service. All times are GMT -4. The time now is 12:01 AM. Copyright © 1996 - 2011 TechGuy, Inc. All rights reserved. |  |
Facebook
Twitter
TechGuy.tv
TSG Mobile