| Live Chat & Podcast at 1:00PM Eastern on Sunday! |
Advertisement
Advertisement
 Search | |
| |
11-Aug-2010, 01:39 AM
#1 | |||||||
| win32/Alureon.h infection |
11-Aug-2010, 07:43 AM
#2 | ||||||
| Please read carefully and follow these steps.
__________________ I gotta hold on to my angst. I preserve it because I need it. It keeps me sharp, on the edge, where I gotta be. |
11-Aug-2010, 05:43 PM
#3 | |||||||
| tdss report |
11-Aug-2010, 05:49 PM
#4 | ||||||
| |
11-Aug-2010, 07:47 PM
#5 | |||||||
| |
12-Aug-2010, 08:36 AM
#6 | ||||||
| |
12-Aug-2010, 10:24 AM
#7 | |||||||
| |
12-Aug-2010, 10:25 AM
#8 | ||||||
| one more scan Download ComboFix here : Link 1 Link 2 * IMPORTANT !!! Save ComboFix.exe to your Desktop
**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.  Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:  Click on Yes, to continue scanning for malware. When finished, it shall produce a log for you. Please include the C:\ComboFix.txt log in your next reply.
__________________ I gotta hold on to my angst. I preserve it because I need it. It keeps me sharp, on the edge, where I gotta be. |
12-Aug-2010, 01:36 PM
#9 | |||||||
 Here is the Combofix log. Does it look bad or is this a pretty easy one?  ComboFix 10-08-11.05 - Maria 08/12/2010 11:22:45.1.2 - x86 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2038.1280 [GMT -6:00] Running from: c:\documents and settings\Maria\Desktop\ComboFix.exe . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\documents and settings\All Users\Favorites\_favdata.dat c:\documents and settings\Gay Deitrich-MacLean\GoToAssistDownloadHelper.exe c:\documents and settings\Maria\Local Settings\Application Data\{77C43D31-112A-493E-9424-4E0D0D3ECA48} c:\documents and settings\Maria\Local Settings\Application Data\{77C43D31-112A-493E-9424-4E0D0D3ECA48}\chrome.manifest c:\documents and settings\Maria\Local Settings\Application Data\{77C43D31-112A-493E-9424-4E0D0D3ECA48}\chrome\content\_cfg.js c:\documents and settings\Maria\Local Settings\Application Data\{77C43D31-112A-493E-9424-4E0D0D3ECA48}\chrome\content\overlay.xul c:\documents and settings\Maria\Local Settings\Application Data\{77C43D31-112A-493E-9424-4E0D0D3ECA48}\install.rdf . ((((((((((((((((((((((((( Files Created from 2010-07-12 to 2010-08-12 ))))))))))))))))))))))))))))))) . 2010-08-12 13:22 . 2010-08-12 13:22 -------- d-----w- c:\windows\LastGood 2010-08-11 05:36 . 2010-08-11 05:36 388096 ----a-r- c:\documents and settings\Maria\Application Data\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe 2010-08-11 05:36 . 2010-08-11 05:36 -------- d-----w- c:\program files\Trend Micro 2010-08-09 23:33 . 2010-08-09 23:33 -------- d-----w- C:\temp 2010-08-09 23:33 . 2010-08-09 23:33 -------- d-----w- c:\program files\Common Files\supportsoft 2010-08-09 04:42 . 2010-08-09 04:42 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\aiywhocqg 2010-07-29 22:37 . 2010-07-29 22:37 -------- d--h--w- c:\windows\system32\GroupPolicy 2010-07-29 05:18 . 2010-07-29 05:18 503808 ----a-w- c:\documents and settings\Maria\Application Data\Sun\Java\Deployment\cache\6.0\46\f84c6ae-19d578af-n\msvcp71.dll 2010-07-29 05:18 . 2010-07-29 05:18 499712 ----a-w- c:\documents and settings\Maria\Application Data\Sun\Java\Deployment\cache\6.0\46\f84c6ae-19d578af-n\jmc.dll 2010-07-29 05:18 . 2010-07-29 05:18 348160 ----a-w- c:\documents and settings\Maria\Application Data\Sun\Java\Deployment\cache\6.0\46\f84c6ae-19d578af-n\msvcr71.dll 2010-07-29 03:37 . 2010-08-10 05:29 -------- d-----w- c:\program files\Windows Live Safety Center 2010-07-22 15:31 . 2010-07-30 22:02 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Adobe 2010-07-20 00:46 . 2010-07-20 00:46 -------- d-sh--w- c:\documents and settings\LocalService\IETldCache 2010-07-18 04:40 . 2010-08-11 14:18 664 ----a-w- c:\windows\system32\d3d9caps.dat 2010-07-18 04:30 . 2010-07-30 07:14 120 ----a-w- c:\windows\Pqutuvom.dat 2010-07-18 04:30 . 2010-07-30 06:16 0 ----a-w- c:\windows\Dnoxodigipamepoz.bin 2010-07-18 04:27 . 2010-07-18 04:27 -------- d-----w- c:\documents and settings\All Users\Application Data\33257626 2010-07-14 03:52 . 2010-06-14 14:31 744448 ------w- c:\windows\system32\dllcache\helpsvc.exe . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2010-08-12 17:15 . 2007-11-17 04:44 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help 2010-08-12 13:06 . 2008-01-12 22:50 -------- d-----w- c:\documents and settings\Maria\Application Data\Wave Systems Corp 2010-08-11 21:32 . 2004-08-11 23:09 57600 ----a-w- c:\windows\system32\drivers\redbook.sys 2010-07-30 17:32 . 2010-08-09 04:43 184970 ----a-w- c:\windows\pchealth\helpctr\Config\Cache\Professional_32_1033.dat 2010-07-29 12:39 . 2007-11-17 04:53 -------- d-----w- c:\program files\Google 2010-07-29 05:52 . 2009-08-21 21:50 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple Computer 2010-07-27 06:30 . 2010-07-27 06:30 8462336 ----a-w- c:\windows\system32\SET5B.tmp 2010-06-30 12:31 . 2010-06-30 12:31 149504 ----a-w- c:\windows\system32\SET5F.tmp 2010-06-24 23:51 . 2010-06-24 23:51 11077120 ----a-w- c:\windows\system32\SET71.tmp 2010-06-24 12:22 . 2010-08-12 13:25 916480 ----a-w- c:\windows\system32\SET66.tmp 2010-06-24 12:22 . 2010-08-12 13:25 1210368 ----a-w- c:\windows\system32\SET67.tmp 2010-06-24 12:22 . 2010-08-12 13:25 5951488 ----a-w- c:\windows\system32\SET6A.tmp 2010-06-24 12:21 . 2010-08-12 13:25 599040 ----a-w- c:\windows\system32\SET6C.tmp 2010-06-24 12:21 . 2010-08-12 13:25 55296 ----a-w- c:\windows\system32\SET6B.tmp 2010-06-24 12:21 . 2010-08-12 13:25 1986560 ----a-w- c:\windows\system32\SET6F.tmp 2010-06-23 03:39 . 2010-06-23 03:39 501936 ----a-w- c:\documents and settings\All Users\Application Data\Google\Google Toolbar\Update\gtb1D.tmp.exe 2010-06-17 14:03 . 2004-08-11 23:00 80384 ----a-w- c:\windows\system32\iccvid.dll 2010-06-14 14:31 . 2004-08-11 23:12 744448 ----a-w- c:\windows\pchealth\helpctr\binaries\helpsvc.exe . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Apoint"="c:\program files\Apoint\Apoint.exe" [2007-04-16 159744] "Dell QuickSet"="c:\program files\Dell\QuickSet\quickset.exe" [2007-05-14 1191936] "SigmatelSysTrayApp"="stsystra.exe" [2007-02-19 303104] "Document Manager"="c:\program files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe" [2007-01-30 102400] "SecureUpgrade"="c:\program files\Wave Systems Corp\SecureUpgrade.exe" [2007-01-22 212992] "Broadcom Wireless Manager UI"="c:\windows\system32\WLTRAY.exe" [2007-03-16 1392640] "KADxMain"="c:\windows\system32\KADxMain.exe" [2006-11-02 282624] "OpwareSE2"="c:\program files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe" [2003-05-08 49152] "IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-05-16 138008] "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-05-18 162584] "Persistence"="c:\windows\system32\igfxpers.exe" [2007-05-18 138008] "HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2006-12-11 49152] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-10-11 149280] c:\documents and settings\Gay Deitrich-MacLean\Start Menu\Programs\Startup\ HotSync Manager.lnk - c:\palm\HOTSYNC.EXE [2004-4-13 299008] OpenOffice.org 3.1.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2009-8-18 384000] c:\documents and settings\All Users\Start Menu\Programs\Startup\ Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2007-11-16 50688] HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2008-3-25 214360] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\GoToAssist] 2007-12-29 22:39 10792 ----a-w- c:\program files\Citrix\GoToAssist\480\g2awinlogon.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=c:\windows\system32\wxvault.dll [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] Authentication Packages REG_MULTI_SZ msv1_0 wvauth [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SymEFA .sys] @="FSFilter Activity Monitor" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acrobat Assistant 8.0] 2008-10-15 04:38 623992 ----a-w- c:\program files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acrobat Speed Launch] 2008-10-15 08:03 45936 ----a-w- c:\program files\Adobe\Acrobat 8.0\Acrobat\Acrobat_sl.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] 2008-04-14 00:12 1695232 ----a-w- c:\program files\Messenger\msmsgs.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PDVDDXSrv] 2006-10-20 23:23 118784 ------w- c:\program files\CyberLink\PowerDVD DX\PDVDDXSrv.exe [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\Auth orizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\Bonjour\\mDNSResponder.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\Glob allyOpenPorts\List] "3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009 R0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\N360\0308000.029\SymEFA.sys [2/3/2010 8:04 AM 310320] R1 BHDrvx86;Symantec Heuristics Driver;c:\windows\system32\drivers\N360\0308000.029\BHDrvx86.sys [2/3/2010 8:04 AM 259632] R1 ccHP;Symantec Hash Provider;c:\windows\system32\drivers\N360\0308000.029\cchpx86.sys [2/3/2010 8:04 AM 482432] R1 IDSxpx86;IDSxpx86;c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20100809.001\IDSXpx86.sys [8/10/2010 8:40 PM 331640] R2 ASFIPmon;Broadcom ASF IP and SMBIOS Mailbox Monitor;c:\program files\Broadcom\ASFIPMon\AsfIpMon.exe [12/19/2006 2:21 PM 79432] R2 LxrSII1d;Secure II Driver;c:\windows\system32\drivers\LxrSII1d.sys [2/10/2008 9:07 PM 72672] R2 N360;Norton 360;c:\program files\Norton 360\Engine\3.8.0.41\ccSvcHst.exe [2/3/2010 8:04 AM 117640] R2 Wave UCSPlus;Wave UCSPlus;c:\windows\system32\dllhost.exe [8/11/2004 5:00 PM 5120] R3 DXEC01;DXEC01;c:\windows\system32\drivers\dxec01.sys [11/2/2006 12:32 PM 97536] R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [5/28/2010 5:59 PM 102448] --- Other Services/Drivers In Memory --- *NewlyCreated* - KLMDB *Deregistered* - klmdb [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12 hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc . Contents of the 'Scheduled Tasks' folder . . ------- Supplementary Scan ------- . uStart Page = www.google.com/ig/dell?hl=en&client=dell-usuk-rel&channel=us&ibd=3071116 uInternet Settings,ProxyOverride = *.local IE: Append to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html IE: Convert link target to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html IE: Convert link target to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html IE: Convert selected links to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html IE: Convert selected links to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html IE: Convert selection to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html IE: Convert selection to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html IE: Convert to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000 IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html LSP: c:\windows\system32\biolsp.dll . - - - - ORPHANS REMOVED - - - - WebBrowser-{604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - (no file) SafeBoot-klmdb.sys MSConfigStartUp-Google Desktop Search - c:\program files\Google\Google Desktop Search\GoogleDesktop.exe MSConfigStartUp-Slojipotaf - c:\windows\MOECG4S.dll MSConfigStartUp-swg - c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe ************************************************************************** scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: ************************************************************************** [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\N360] "ImagePath"="\"c:\program files\Norton 360\Engine\3.8.0.41\ccSvcHst.exe\" /s \"N360\" /m \"c:\program files\Norton 360\Engine\3.8.0.41\diMaster.dll\" /prefetch:1" . --------------------- LOCKED REGISTRY KEYS --------------------- [HKEY_USERS\S-1-5-21-291229962-128485444-1085441291-1005\Software\Microsoft\Windows\CurrentVersion\Qnefu*] @Allowed: (Read) (RestrictedCode) @Allowed: (Read) (RestrictedCode) [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10h_Ac tiveX.exe,-101" [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation] "Enabled"=dword:00000001 [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32] @="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe" [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" [HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}] @Denied: (A 2) (Everyone) @="IFlashBroker4" [HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" [HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . --------------------- DLLs Loaded Under Running Processes --------------------- - - - - - - - > 'winlogon.exe'(1300) c:\windows\system32\wxvault.dll c:\windows\system32\detoured.dll c:\program files\Citrix\GoToAssist\480\G2AWinLogon.dll c:\windows\System32\BCMLogon.dll c:\windows\system32\igfxdev.dll - - - - - - - > 'winlogon.exe'(1044) c:\windows\system32\wxvault.dll c:\windows\system32\detoured.dll c:\program files\Citrix\GoToAssist\480\G2AWinLogon.dll c:\windows\System32\BCMLogon.dll c:\windows\system32\igfxdev.dll - - - - - - - > 'lsass.exe'(1356) c:\windows\system32\wxvault.dll c:\windows\system32\detoured.dll c:\windows\system32\wvauth.dll c:\windows\system32\biolsp.dll . Completion time: 2010-08-12 11:32:40 ComboFix-quarantined-files.txt 2010-08-12 17:32 Pre-Run: 138,064,162,816 bytes free Post-Run: 138,263,388,160 bytes free WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS [operating systems] c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect - - End Of File - - A819B3B091D9600491235E3AA706B3D8 |
13-Aug-2010, 01:14 PM
#10 | ||||||
|
__________________ I gotta hold on to my angst. I preserve it because I need it. It keeps me sharp, on the edge, where I gotta be. |
13-Aug-2010, 06:06 PM
#11 | |||||||
| |
14-Aug-2010, 12:04 AM
#12 | |||||||
| |
14-Aug-2010, 06:53 AM
#13 | ||||||
| Your logs are clean Follow these steps to uninstall Combofix and tools used in the removal of malware Uninstall ComboFix Remove Combofix now that we're done with it.
__________________ I gotta hold on to my angst. I preserve it because I need it. It keeps me sharp, on the edge, where I gotta be. |
14-Aug-2010, 08:46 AM
#14 | |||||||
| Last edited by puregoldschlager; 14-Aug-2010 at 08:47 AM.. Reason: spelling error |
16-Aug-2010, 01:55 PM
#15 | ||||||
| |
Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.
If you're not already familiar with forums, watch our Welcome Guide to get started.
| Tags |
| alureon.h, virus removal |
| |
| Currently Active Users Viewing This Thread: 1 (0 members and 1 guests) | |
| Thread Tools | |
| |
Similar Threads | ||||
| Title | Thread Starter | Forum | Replies | Last Post |
| Win32 Alureon.H | Illuminate | Virus & Other Malware Removal | 2 | 24-Aug-2010 08:03 AM |
| win32/Alureon.h wont go away | Rws6 | Virus & Other Malware Removal | 15 | 02-Aug-2010 04:26 PM |
| Google Redirecting, Win32\Alureon.H, unable to update | LibbyLou | Virus & Other Malware Removal | 14 | 15-Jul-2010 04:19 PM |
| Can Anyone Help Me Out? Please! Win32/Alureon Computer Infected | summer61910 | Virus & Other Malware Removal | 5 | 17-May-2010 12:21 AM |
| Win32/Alureon.co | SirPorpington | Virus & Other Malware Removal | 1 | 18-Apr-2010 02:35 AM |
