Login | Live Chat & Podcast at 1:00PM Eastern on Sunday! |
 Search | |
| |
18-Nov-2009, 03:19 PM
#1 | ||||||
| Internet Redirect and Pop-ups |
| |
19-Nov-2009, 03:30 AM
#2 | ||||||
| Hello jssun, Please download ComboFix from one of these locations: Link 1 Link 2 * IMPORTANT !!! Save ComboFix.exe to your Desktop
**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.  Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:  Click on Yes, to continue scanning for malware. When finished, it will produce a log for you. Please include the C:\ComboFix.txt in your next reply.
__________________ Manners are the basis of a civilised society and make everyone's lives just a little happier. They cost nothing but they are worth so much. |
19-Nov-2009, 06:52 PM
#3 | ||||||
| Thanks for the very clear directions. ComboFix log ComboFix 09-11-19.03 - Jess Lindsay 11/19/2009 17:16.1.2 - x86 Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.2046.1471 [GMT -5:00] Running from: c:\documents and settings\Jess Lindsay\Desktop\clean up\ComboFix.exe AV: Norton Internet Security *On-access scanning disabled* (Updated) {E10A9785-9598-4754-B552-92431C1C35F8} FW: Norton Internet Security *disabled* {7C21A4C9-F61F-4AC4-B722-A6E19C16F220} . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\install.exe c:\windows\AegisP.inf c:\windows\system32\lsprst7.dll Infected copy of c:\windows\system32\DRIVERS\iaStor.sys was found and disinfected Restored copy from - Kitty ate it  . ((((((((((((((((((((((((( Files Created from 2009-10-19 to 2009-11-19 ))))))))))))))))))))))))))))))) . 2009-11-19 20:37 . 2009-11-17 20:45 84912 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20091119.004\NAVENG.SYS 2009-11-19 20:37 . 2009-11-17 20:45 177520 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20091119.004\NAVENG32.DLL 2009-11-19 20:37 . 2009-11-17 20:45 1647984 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20091119.004\NAVEX32A.DLL 2009-11-19 20:37 . 2009-11-17 20:45 1323568 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20091119.004\NAVEX15.SYS 2009-11-19 20:37 . 2009-11-17 20:45 371248 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20091119.004\EECTRL.SYS 2009-11-19 20:37 . 2009-11-17 20:45 2747952 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20091119.004\CCERASER.DLL 2009-11-19 20:37 . 2009-11-17 20:45 259440 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20091119.004\ECMSVR32.DLL 2009-11-19 20:37 . 2009-11-17 20:45 102448 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20091119.004\ERASER.SYS 2009-11-18 00:56 . 2009-06-30 14:37 28552 ----a-w- c:\windows\system32\drivers\pavboot.sys 2009-11-13 00:04 . 2009-10-28 22:37 343088 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20091111.001\IDSvix86.sys 2009-11-13 00:04 . 2009-10-28 22:37 329592 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20091111.001\IDSXpx86.sys 2009-11-13 00:04 . 2009-10-28 22:37 811896 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20091111.001\Scxpx86.dll 2009-11-13 00:04 . 2009-10-28 22:37 488312 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20091111.001\IDSxpx86.dll 2009-11-13 00:04 . 2009-10-28 22:37 466992 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20091111.001\IDSviA64.sys 2009-11-12 01:24 . 2009-10-28 22:37 811896 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20091107.001\Scxpx86.dll 2009-11-12 01:24 . 2009-10-28 22:37 329592 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20091107.001\IDSXpx86.sys 2009-11-12 01:24 . 2009-10-28 22:37 488312 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20091107.001\IDSxpx86.dll 2009-11-12 01:24 . 2009-10-28 22:37 343088 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20091107.001\IDSvix86.sys 2009-11-12 01:24 . 2009-10-28 22:37 466992 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20091107.001\IDSviA64.sys 2009-11-09 20:19 . 2009-11-09 20:19 -------- d-----w- c:\documents and settings\Jess Lindsay\Application Data\Malwarebytes 2009-11-09 20:19 . 2009-09-10 19:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2009-11-09 20:19 . 2009-11-09 20:19 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes 2009-11-09 20:19 . 2009-11-09 20:19 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware 2009-11-09 20:19 . 2009-09-10 19:53 19160 ----a-w- c:\windows\system32\drivers\mbam.sys 2009-11-08 21:49 . 2009-11-08 21:49 -------- d-----w- c:\program files\Panda Security 2009-11-06 19:57 . 2009-10-28 22:37 343088 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20091105.001\IDSvix86.sys 2009-11-06 19:57 . 2009-10-28 22:37 329592 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20091105.001\IDSXpx86.sys 2009-11-06 19:57 . 2009-10-28 22:37 811896 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20091105.001\Scxpx86.dll 2009-11-06 19:57 . 2009-10-28 22:37 488312 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20091105.001\IDSxpx86.dll 2009-11-06 19:57 . 2009-10-28 22:37 466992 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20091105.001\IDSviA64.sys 2009-10-28 22:37 . 2009-10-28 22:37 343088 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\BinHub\IDSvix86.sys 2009-10-28 22:37 . 2009-10-28 22:37 329592 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\BinHub\IDSXpx86.sys 2009-10-28 22:37 . 2009-10-28 22:37 811896 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\BinHub\Scxpx86.dll 2009-10-28 22:37 . 2009-10-28 22:37 488312 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\BinHub\IDSxpx86.dll 2009-10-28 22:37 . 2009-10-28 22:37 466992 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\BinHub\IDSviA64.sys 2009-10-25 20:50 . 2009-10-25 20:50 -------- d-----w- c:\windows\ServicePackFiles 2009-10-23 13:17 . 2009-06-05 07:42 655872 ------w- c:\windows\system32\dllcache\mstscax.dll . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-11-19 22:33 . 2008-02-14 17:14 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP 2009-11-19 07:55 . 2009-03-14 01:24 -------- d-----w- c:\program files\Spyware Doctor 2009-11-15 06:07 . 2006-05-10 10:02 5427 ----a-w- c:\windows\system32\EGATHDRV.SYS 2009-11-14 02:07 . 2008-05-06 03:40 -------- d-----w- c:\documents and settings\Jess Lindsay\Application Data\LimeWire 2009-11-04 16:23 . 2009-04-14 23:19 -------- d-----w- c:\documents and settings\Jess Lindsay\Application Data\HPAppData 2009-10-26 23:10 . 2008-02-10 17:46 -------- d-----w- c:\program files\DivX 2009-10-16 02:58 . 2009-01-14 23:39 -------- d-----w- c:\documents and settings\Jess Lindsay\Application Data\Juniper Networks 2009-10-16 02:58 . 2009-01-14 23:42 -------- d-----w- c:\program files\Juniper Networks 2009-10-16 02:58 . 2009-01-14 23:40 37021 ----a-w- c:\documents and settings\Jess Lindsay\Application Data\Juniper Networks\Setup\uninstall.exe 2009-09-29 15:50 . 2006-06-09 16:15 -------- d-----w- c:\program files\SPSS 2009-09-20 03:09 . 2009-09-20 03:09 127872 ----a-w- c:\documents and settings\Jess Lindsay\Application Data\Move Networks\uninstall.exe 2009-09-20 03:08 . 2009-06-16 06:35 4183416 ----a-w- c:\documents and settings\Jess Lindsay\Application Data\Move Networks\plugins\npqmp071503000010.dll 2009-09-20 03:08 . 2009-09-20 03:08 1686272 ----a-w- c:\documents and settings\Jess Lindsay\Application Data\Move Networks\MoveMediaPlayerWin_071503000010.exe 2009-09-16 00:59 . 2009-03-11 02:11 60808 ----a-w- c:\windows\system32\S32EVNT1.DLL 2009-09-16 00:59 . 2009-03-11 02:11 124976 ----a-w- c:\windows\system32\drivers\SYMEVENT.SYS 2009-09-11 14:03 . 1980-01-01 07:00 136192 ----a-w- c:\windows\system32\msv1_0.dll 2009-09-04 20:45 . 1980-01-01 07:00 58880 ----a-w- c:\windows\system32\msasn1.dll 2009-08-29 07:36 . 1980-01-01 07:00 832512 ----a-w- c:\windows\system32\wininet.dll 2009-08-29 07:36 . 1980-01-01 07:00 78336 ------w- c:\windows\system32\ieencode.dll 2009-08-29 07:36 . 1980-01-01 07:00 17408 ------w- c:\windows\system32\corpol.dll 2009-08-26 08:16 . 1980-01-01 07:00 247326 ------w- c:\windows\system32\strmdll.dll 2009-08-22 07:21 . 2009-09-22 06:45 36400 ----a-r- c:\windows\system32\drivers\SymIM.sys . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SynTPLpr"="c:\program files\Synaptics\SynTP\SynTPLpr.exe" [2005-09-15 110592] "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2005-09-15 512000] "ATICCC"="c:\program files\ATI Technologies\ATI.ACE\cli.exe" [2005-08-12 45056] "ACWLIcon"="c:\program files\ThinkPad\ConnectUtilities\ACWLIcon.exe" [2006-04-17 98304] "PWRMGRTR"="c:\progra~1\ThinkPad\UTILIT~1\PWRMGRTR.DLL" [2005-12-07 151552] "BLOG"="c:\progra~1\ThinkPad\UTILIT~1\BatLogEx.DLL" [2005-12-07 208896] "cssauth"="c:\program files\IBM ThinkVantage\Client Security Solution\cssauth.exe" [2006-08-21 1997568] "ISTray"="c:\program files\Spyware Doctor\pctsTray.exe" [2009-03-14 1168264] "HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-10-15 49152] "hpqSRMon"="c:\program files\HP\Digital Imaging\bin\hpqSRMon.exe" [2007-08-22 80896] "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2006-09-01 282624] "Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2009-09-10 1312080] "TpShocks"="TpShocks.exe" - c:\windows\system32\TpShocks.exe [2005-11-07 106496] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce] "configmsi"="rmdir" [X] "supportdir"="rmdir" [X] c:\documents and settings\All Users\Start Menu\Programs\Startup\ HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2007-10-14 214360] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\psfus] 2005-12-08 21:59 39936 ------w- c:\windows\system32\psqlpwd.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tpfnf2] 2005-07-06 06:45 28672 ------w- c:\windows\system32\notifyf2.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tphotkey] 2005-12-01 03:16 24576 ------w- c:\windows\system32\tphklock.dll [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] Notification Packages REG_MULTI_SZ scecli psqlpwd [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxs ervice] @="" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcore service] @="" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SymEFA .sys] @="FSFilter Activity Monitor" [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Acrobat Speed Launcher.lnk] path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Acrobat Speed Launcher.lnk backup=c:\windows\pss\Adobe Acrobat Speed Launcher.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk] path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Bluetooth.lnk] path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Bluetooth.lnk backup=c:\windows\pss\Bluetooth.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Digital Line Detect.lnk] path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Digital Line Detect.lnk backup=c:\windows\pss\Digital Line Detect.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk] path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Image Zone Fast Start.lnk] path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HP Image Zone Fast Start.lnk backup=c:\windows\pss\HP Image Zone Fast Start.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^JHSecure VPN Client.lnk] path=c:\documents and settings\All Users\Start Menu\Programs\Startup\JHSecure VPN Client.lnk backup=c:\windows\pss\JHSecure VPN Client.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services] "Emproxy"=3 (0x3) "Movielink Core Service"=2 (0x2) "iPod Service"=3 (0x3) "McSysmon"=3 (0x3) "McProxy"=2 (0x2) "WMPNetworkSvc"=2 (0x2) "dsNcService"=2 (0x2) [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\Auth orizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\ThinkVantage\\SystemUpdate\\jre\\bin\\javaw.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"= "c:\\Program Files\\Microsoft ActiveSync\\WCESCOMM.EXE"= "c:\\Program Files\\iTunes\\iTunes.exe"= "c:\\Program Files\\Java\\jre1.6.0_03\\bin\\javaw.exe"= "c:\\Program Files\\LimeWire\\LimeWire.exe"= "c:\\Program Files\\uTorrent\\uTorrent.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\Glob allyOpenPorts\List] "50261:TCP"= 50261:TCP:Lime "50261:UDP"= 50261:UDP:Lime2 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\Icmp Settings] "AllowInboundEchoRequest"= 1 (0x1) R0 ANCSQ;ANCSQ;c:\windows\system32\drivers\ANCSQ.sys [8/21/2006 1:04 AM 6912] R0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [11/17/2009 7:56 PM 28552] R0 pssnap;Paramount Software Snapshot Filter;c:\windows\system32\drivers\pssnap.sys [5/20/2008 7:32 AM 15328] R0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\NIS\1007020.00B\SymEFA.sys [9/15/2009 7:59 PM 310320] R1 BHDrvx86;Symantec Heuristics Driver;c:\windows\system32\drivers\NIS\1007020.00B\BHDrvx86.sys [9/15/2009 7:59 PM 259632] R1 ccHP;Symantec Hash Provider;c:\windows\system32\drivers\NIS\1007020.00B\cchpx86.sys [9/15/2009 7:59 PM 482432] R1 IDSxpx86;IDSxpx86;c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20091111.001\IDSXpx86.sys [11/12/2009 7:04 PM 329592] R1 OxFWLF;OxFWLF;c:\windows\system32\drivers\OxFWLF.sys [12/7/2007 12:33 PM 12043] R2 ibmfilter;ibmfilter;c:\windows\system32\drivers\ibmfilter.sys [12/21/2005 7:14 PM 12544] R2 Norton Internet Security;Norton Internet Security;c:\program files\Norton Internet Security\Engine\16.7.2.11\ccSvcHst.exe [9/15/2009 7:59 PM 117640] R2 PrivateDisk;PrivateDisk;c:\program files\IBM ThinkVantage\SafeGuard PrivateDisk\privatediskm.sys [11/15/2005 3:11 PM 46142] R2 ReflectService;Macrium Reflect Image Mounting Service;c:\program files\Macrium\Reflect\ReflectService.exe [8/6/2008 10:34 AM 216032] R2 sdAuxService;PC Tools Auxiliary Service;c:\program files\Spyware Doctor\pctsAuxs.exe [3/13/2009 8:24 PM 356920] R2 smi2;smi2;c:\program files\SMI2\smi2.sys [12/21/2005 6:45 PM 3968] R2 smihlp;SMI helper driver;c:\program files\ThinkVantage Fingerprint Software\smihlp.sys [12/8/2005 4:44 PM 3328] R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [9/15/2009 7:42 PM 102448] R3 swmx01;Sierra Wireless USB MUX Driver (#01);c:\windows\system32\drivers\swmx01.sys [11/18/2005 6:21 PM 58624] R3 SWNC5E01;Sierra Wireless MUX NDIS Driver (#01);c:\windows\system32\drivers\SWNC5E01.sys [8/5/2005 5:42 PM 73600] S3 OxUSBLF;OxUSBLF;c:\windows\system32\drivers\OxUSBLF.sys [12/7/2007 12:33 PM 7296] S3 SWI32;SWI32;\??\c:\program files\ThinkVantage\SystemUpdate\session\7cwc05ww\SWI32.sys --> c:\program files\ThinkVantage\SystemUpdate\session\7cwc05ww\SWI32.sys [?] S3 TPISYSID;TPISYSID;\??\c:\program files\ThinkVantage\SystemUpdate\session\7bwc14ww\TPISYSID.sys --> c:\program files\ThinkVantage\SystemUpdate\session\7bwc14ww\TPISYSID.sys [?] --- Other Services/Drivers In Memory --- *Deregistered* - mchInjDrv [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12 hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc . Contents of the 'Scheduled Tasks' folder 2009-08-13 c:\windows\Tasks\jusched.job - c:\program files\Java\jre6\bin\jusched.exe [2009-03-15 15:51] 2009-11-18 c:\windows\Tasks\User_Feed_Synchronization-{22F025BE-9FED-49A0-B9DC-0777DA919B33}.job - c:\windows\system32\msfeedssync.exe [2006-10-17 15:58] . . ------- Supplementary Scan ------- . uStart Page = hxxp://news.bbc.co.uk/ uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8 IE: Convert link target to Adobe PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html IE: Convert link target to existing PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html IE: Convert selected links to Adobe PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html IE: Convert selected links to existing PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html IE: Convert selection to Adobe PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html IE: Convert selection to existing PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html IE: Convert to Adobe PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html IE: Convert to existing PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\OFFICE11\EXCEL.EXE/3000 IE: Send To &Bluetooth - c:\program files\ThinkPad\Bluetooth Software\btsendto_ie_ctx.htm . - - - - ORPHANS REMOVED - - - - Notify-ACNotify - ACNotify.dll Notify-NavLogon - (no file) ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-11-19 17:37 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Norton Internet Security] "ImagePath"="\"c:\program files\Norton Internet Security\Engine\16.7.2.11\ccSvcHst.exe\" /s \"Norton Internet Security\" /m \"c:\program files\Norton Internet Security\Engine\16.7.2.11\diMaster.dll\" /prefetch:1" . --------------------- LOCKED REGISTRY KEYS --------------------- [HKEY_LOCAL_MACHINE\software\Microsoft\Environment*] "Licence0"="04F0D21-79D8-7A25-D702-433F" . --------------------- DLLs Loaded Under Running Processes --------------------- - - - - - - - > 'winlogon.exe'(1528) c:\program files\ThinkPad\ConnectUtilities\ACNotify.dll c:\program files\ThinkPad\ConnectUtilities\AcSvcStub.dll c:\program files\ThinkPad\ConnectUtilities\AcLocSettings.dll c:\program files\ThinkPad\ConnectUtilities\ACHelper.dll c:\windows\system32\Ati2evxx.dll c:\windows\system32\psqlpwd.dll c:\program files\ThinkVantage Fingerprint Software\infra.dll c:\program files\ThinkVantage Fingerprint Software\homefus2.dll c:\windows\system32\biologon.dll c:\program files\ThinkVantage Fingerprint Software\homepass.dll c:\program files\ThinkVantage Fingerprint Software\bio.dll c:\program files\ThinkVantage Fingerprint Software\remote.dll c:\program files\ThinkVantage Fingerprint Software\ps2css.dll c:\windows\system32\tphklock.dll c:\windows\system32\netprovcredman.dll - - - - - - - > 'lsass.exe'(1584) c:\windows\system32\psqlpwd.dll c:\program files\ThinkVantage Fingerprint Software\infra.dll c:\program files\ThinkVantage Fingerprint Software\homefus2.dll - - - - - - - > 'explorer.exe'(5032) c:\windows\system32\WININET.dll c:\windows\system32\PROCHLP.DLL c:\windows\system32\ieframe.dll c:\windows\system32\WPDShServiceObj.dll c:\windows\system32\btncopy.dll c:\windows\system32\PortableDeviceTypes.dll c:\windows\system32\PortableDeviceApi.dll . ------------------------ Other Running Processes ------------------------ . c:\windows\system32\ibmpmsvc.exe c:\windows\system32\Ati2evxx.exe c:\program files\Intel\Wireless\Bin\S24EvMon.exe c:\windows\system32\IPSSVC.EXE c:\program files\ThinkPad\Bluetooth Software\bin\btwdins.exe c:\program files\Diskeeper Corporation\Diskeeper\DkService.exe c:\program files\Juniper Networks\Common Files\dsNcService.exe c:\program files\Intel\Wireless\Bin\EvtEng.exe c:\program files\Java\jre6\bin\jqs.exe c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE c:\program files\Intel\Wireless\Bin\RegSrvc.exe c:\program files\Spyware Doctor\pctsSvc.exe c:\windows\System32\TPHDEXLG.EXE c:\windows\system32\Ati2evxx.exe c:\program files\IBM ThinkVantage\Client Security Solution\ibmtcsd.exe c:\program files\IBM ThinkVantage\Rescue and Recovery\rrservice.exe c:\windows\system32\rundll32.exe c:\program files\IBM ThinkVantage\Common\Scheduler\tvtsched.exe c:\program files\IBM ThinkVantage\Client Security Solution\pwmgr.exe c:\program files\ThinkPad\ConnectUtilities\AcSvc.exe c:\windows\system32\wscntfy.exe c:\program files\ThinkPad\ConnectUtilities\SvcGuiHlpr.exe . ************************************************************************** . Completion time: 2009-11-19 17:41 - machine was rebooted ComboFix-quarantined-files.txt 2009-11-19 22:41 Pre-Run: 2,700,210,176 bytes free Post-Run: 2,548,408,320 bytes free WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems] c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect - - End Of File - - 164101C72679AB3FE2709BE61BD168B4 Currently able to click on search results from Google without being redirected, and so far no pop-ups. |
19-Nov-2009, 07:14 PM
#4 | ||||||
| Hello jssun, Making progress.  In this post we will just check to see that the rootkit has been totally removed. They can regenerate if the associated file hasn't been removed at the same time as the system file culprit is replaced (which is what ComboFix did). Now Download GMER from here Unzip it to the desktop. **Caution** These types of scans can produce false positives. Do NOT take any action on any "<--- ROOKIT" entries unless advised by a trained Security Analyst. Open the program and click on the Rootkit tab. Make sure all the boxes on the right of the screen are checked, EXCEPT for ‘Show All’. Click on Scan. When the scan has run click Copy and paste the results (if any) into this thread.
__________________ Manners are the basis of a civilised society and make everyone's lives just a little happier. They cost nothing but they are worth so much. |
19-Nov-2009, 08:38 PM
#6 | ||||||
|
__________________ Manners are the basis of a civilised society and make everyone's lives just a little happier. They cost nothing but they are worth so much. |
 |
| |
| Currently Active Users Viewing This Thread: 1 (0 members and 1 guests) | |
| Thread Tools | |
| |
| You Are Using:  |
Advertisements do not imply our endorsement of that product or service. All times are GMT -4. The time now is 01:16 AM. Copyright © 1996 - 2011 TechGuy, Inc. All rights reserved. |  |
Facebook
Twitter
TechGuy.tv
TSG Mobile