Solved: Worms, worms, and more worms.

Status
This thread has been Locked and is not open to further replies. Please start a New Thread if you're having a similar issue. View our Welcome Guide to learn how to use this site.

cromaczs07

Thread Starter
Joined
Feb 20, 2006
Messages
310
I am having problems with infected flash drives. Usually we share files, but when we started having flash drives that could not be opened by double clicking, our computers went crazy.

It usually affect the svchosts processes. It duplicates them. Fresh drives will have autorun.inf, when these are deleted, flash drives will no longer be opened.

Thank you very much!

Logfile of HijackThis v1.99.1
Scan saved at 08:48, on 2008-03-26
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Retrospect\Retrospect 7.5\retrorun.exe
C:\WINDOWS\system32\tcpsvcs.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\Rainlendar2\Rainlendar2.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Documents and Settings\mambaltazar\Start Menu\Programs\Startup\PopChat.exe
C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.sweetim.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.sweetim.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 192.168.10.3:3128
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
O4 - HKCU\..\Run: [Rainlendar2] C:\Program Files\Rainlendar2\Rainlendar2.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: PopChat.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: PalTalk - {4EAFEF58-EEFA-4116-983D-03B49BCBFFFE} - C:\Program Files\Paltalk Messenger\Paltalk.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = philrice.local
O17 - HKLM\Software\..\Telephony: DomainName = philrice.local
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = philrice.local
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = philrice.local
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: LiveUpdate - Unknown owner - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE (file missing)
O23 - Service: Retrospect Launcher (RetroLauncher) - EMC Corporation - C:\Program Files\Retrospect\Retrospect 7.5\retrorun.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe

ComboFix 08-03-25.1 - mambaltazar 2008-03-26 8:42:11.15 - FAT32x86
Running from: G:\DOWNLOADS\ComboFix.exe
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((( Files Created from 2008-02-26 to 2008-03-26 )))))))))))))))))))))))))))))))
.

2008-03-26 08:04 . 2008-03-26 08:04 <DIR> d-------- C:\Documents and Settings\Rockrokra\Application Data\AVG7
2008-03-25 22:43 . 2008-03-25 22:42 117,067 -r-hs---- C:\gicchk2s.exe
2008-03-25 22:42 . 2008-03-24 13:12 114,602 -r-hs---- C:\tgtighg.cmd
2008-03-25 15:58 . 2008-03-25 15:58 <DIR> d-------- C:\Program Files\Lavasoft
2008-03-25 15:58 . 2008-03-25 15:58 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\Lavasoft
2008-03-25 09:12 . 2007-10-19 12:36 1,774,432 --a------ C:\Rootkit_Detective.exe
2008-03-24 09:39 . 2008-03-24 09:39 <DIR> d-------- C:\Program Files\Trend Micro
2008-03-18 10:35 . 2008-03-18 10:35 <DIR> d--hs---- C:\FOUND.054
2008-03-14 14:40 . 2004-08-03 22:31 20,992 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\RTL8139.sys
2008-03-14 14:40 . 2004-08-03 22:31 20,992 --a------ C:\WINDOWS\SYSTEM32\dllcache\rtl8139.sys
2008-03-13 17:26 . 2008-03-13 17:26 0 --a------ C:\V
2008-03-13 17:26 . 2008-03-13 17:26 0 --a------ C:\neopocott
2008-03-13 17:22 . 2008-03-13 17:22 <DIR> d-------- C:\neogeo
2008-03-10 08:05 . 2008-03-10 08:05 <DIR> d--hs---- C:\FOUND.053
2008-03-05 20:37 . 2008-03-05 20:37 <DIR> d--hs---- C:\FOUND.052

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-03-14 06:42 3,818 --sha-w C:\WINDOWS\SYSTEM32\KGyGaAvL.sys
2008-03-07 09:44 47,536 ----a-w C:\Documents and Settings\mambaltazar\Application Data\GDIPFONTCACHEV1.DAT
2008-02-20 02:18 --------- d-----w C:\Program Files\Camtech
2008-02-07 05:12 --------- d-----w C:\Program Files\Macrogaming
2008-02-04 05:10 --------- d-----w C:\Documents and Settings\mambaltazar\Application Data\Talkback
2008-02-04 05:09 --------- d-----w C:\Documents and Settings\mambaltazar\Application Data\Thunderbird
2008-02-04 05:08 --------- d-----w C:\Program Files\Mozilla Thunderbird
2008-01-31 06:58 --------- d-----w C:\Program Files\PC Wizard 2008
2008-01-28 13:57 --------- d-----w C:\Program Files\Paltalk Messenger
2006-12-28 17:44 24,192 ----a-w C:\Documents and Settings\MBaltazar\usbsermptxp.sys
2006-12-28 17:44 22,768 ----a-w C:\Documents and Settings\MBaltazar\usbsermpt.sys
2006-09-08 02:03 45,392 ----a-w C:\Documents and Settings\MBaltazar\Application Data\GDIPFONTCACHEV1.DAT
2005-09-01 05:31 266 --sh--w C:\Program Files\desktop.ini
2005-09-01 05:31 11,079 ---h--w C:\Program Files\folder.htt
2005-10-13 13:27 422,400 --sha-r C:\WINDOWS\x2.64.exe
2005-05-13 09:12 217,073 --sha-r C:\WINDOWS\meta4.exe
2005-10-24 03:13 66,560 --sha-r C:\WINDOWS\MOTA113.exe
2005-06-26 07:32 616,448 --sha-r C:\WINDOWS\SYSTEM32\cygwin1.dll
2005-06-21 14:37 45,568 --sha-r C:\WINDOWS\SYSTEM32\cygz.dll
2005-12-22 12:23 816,640 --sha-r C:\WINDOWS\SYSTEM32\smab.dll
2005-10-07 11:14 308,224 --sha-r C:\WINDOWS\SYSTEM32\avisynth.dll
2004-01-24 16:00 70,656 --sha-r C:\WINDOWS\SYSTEM32\i420vfw.dll
2004-01-24 16:00 70,656 --sha-r C:\WINDOWS\SYSTEM32\yv12vfw.dll
2005-02-28 05:16 240,128 --sha-r C:\WINDOWS\SYSTEM32\x.264.exe
2005-07-14 04:31 27,648 --sha-r C:\WINDOWS\SYSTEM32\AVSredirect.dll
2007-06-07 01:04 56 --sh--r C:\WINDOWS\SYSTEM32\1614B4F5DA.sys
2007-09-08 19:14 386 --sha-r C:\WINDOWS\SYSTEM32\__.bat
2007-09-08 19:31 740 --sha-r C:\WINDOWS\SYSTEM32\__.reg
2007-09-08 19:13 1,063 --sha-r C:\WINDOWS\SYSTEM32\__.vbs
.

((((((((((((((((((((((((((((( snapshot_2008-03-14_12.23.55.99 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-03-25 07:58:32 1,038,336 ----a-r C:\WINDOWS\Installer\{DED53B0B-B67C-4244-AE6A-D6FD3C28D1EF}\Icon0E6AB9FC.exe
+ 2008-03-25 07:58:32 178,688 ----a-r C:\WINDOWS\Installer\{DED53B0B-B67C-4244-AE6A-D6FD3C28D1EF}\Icon0E6AB9FC1.exe
+ 2008-03-25 07:58:32 171,008 ----a-r C:\WINDOWS\Installer\{DED53B0B-B67C-4244-AE6A-D6FD3C28D1EF}\IconDED53B0B.exe
+ 2008-03-25 07:58:32 8,704 ----a-r C:\WINDOWS\Installer\{DED53B0B-B67C-4244-AE6A-D6FD3C28D1EF}\IconDED53B0B1.exe
+ 2007-07-11 05:37:26 6,272 ----a-w C:\WINDOWS\SYSTEM32\DRIVERS\AWRTPD.sys
+ 2007-08-07 04:58:08 8,320 ----a-w C:\WINDOWS\SYSTEM32\DRIVERS\AWRTRD.sys
+ 2007-08-07 04:56:58 9,344 ----a-w C:\WINDOWS\SYSTEM32\DRIVERS\NSDriver.sys
- 2007-09-24 14:30:28 135,168 ----a-w C:\WINDOWS\SYSTEM32\java.exe
+ 2008-02-21 17:23:36 135,168 ----a-w C:\WINDOWS\SYSTEM32\java.exe
- 2007-09-24 14:30:30 135,168 ----a-w C:\WINDOWS\SYSTEM32\javaw.exe
+ 2008-02-21 17:23:40 135,168 ----a-w C:\WINDOWS\SYSTEM32\javaw.exe
- 2007-09-24 15:31:42 139,264 ----a-w C:\WINDOWS\SYSTEM32\javaws.exe
+ 2008-02-21 18:33:32 139,264 ----a-w C:\WINDOWS\SYSTEM32\javaws.exe
+ 2007-12-14 03:32:52 12,632 ----a-w C:\WINDOWS\SYSTEM32\lsdelete.exe
- 2007-12-13 09:11:30 578,680 ----a-w C:\WINDOWS\SYSTEM32\Restore\rstrlog.dat
+ 2008-03-24 05:20:48 184,828 ----a-w C:\WINDOWS\SYSTEM32\Restore\rstrlog.dat
+ 2008-03-26 00:25:26 16,384 ----a-w C:\WINDOWS\TEMP\Perflib_Perfdata_19c.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Yahoo! Pager"="C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.exe" [2007-06-11 18:16 4670968]
"Rainlendar2"="C:\Program Files\Rainlendar2\Rainlendar2.exe" [2007-07-24 15:12 1298432]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-03 22:56 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ISUSPM Startup"="C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" [2005-08-11 16:30 249856]
"ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2005-08-11 16:30 81920]
"SoundMan"="SOUNDMAN.EXE" [2006-03-01 16:22 577536 C:\WINDOWS\SOUNDMAN.EXE]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2008-01-23 21:16 579072]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2008-01-23 21:16 219136]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"RunNarrator"="Narrator.exe" [2004-08-03 22:56 53760 C:\WINDOWS\SYSTEM32\narrator.exe]
"tscuninstall"="C:\WINDOWS\system32\tscupgrd.exe" [2004-08-04 04:59 44544]

C:\Documents and Settings\mambaltazar\Start Menu\Programs\Startup\
PopChat.exe [1999-01-30 03:36:42 594432]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"DisableCAD"= 0 (0x0)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2006-12-20 13:55 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
C:\Program Files\SUPERAntiSpyware\SASWINLO.dll 2007-04-19 13:41 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^Acrobat Assistant.lnk]
path=C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\Acrobat Assistant.lnk
backup=C:\WINDOWS\pss\Acrobat Assistant.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^Adobe Gamma Loader.exe.lnk]
path=C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\Adobe Gamma Loader.exe.lnk
backup=C:\WINDOWS\pss\Adobe Gamma Loader.exe.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^Adobe Gamma Loader.lnk]
path=C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk
backup=C:\WINDOWS\pss\Adobe Gamma Loader.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^PalTalk.lnk]
path=C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\PalTalk.lnk
backup=C:\WINDOWS\pss\PalTalk.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^TurboNote.lnk]
path=C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\TurboNote.lnk
backup=C:\WINDOWS\pss\TurboNote.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^WinZip Quick Pick.lnk]
path=C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\WinZip Quick Pick.lnk
backup=C:\WINDOWS\pss\WinZip Quick Pick.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\C-Media Mixer]
--a------ 2006-01-11 17:17 1581056 C:\WINDOWS\mixer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DeviceDiscovery]
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Component Manager]
--a------ 2003-10-23 19:51 233472 C:\Program Files\HP\hpcoretech\hpcmpmgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
--a------ 2003-06-25 11:24 49152 C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPDJ Taskbar Utility]
--a------ 2003-07-28 21:43 188416 C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb09.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
--a------ 2004-08-04 01:06 1667584 C:\Program Files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCSuiteTrayApplication]
C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PcSync]
C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sony Ericsson PC Suite]
-ra------ 2005-10-26 17:17 159744 C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
-ra------ 2006-03-01 16:22 577536 C:\WINDOWS\SOUNDMAN.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a------ 2005-11-10 13:03 36975 C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\svchosts]
D:\svchosts.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UnlockerAssistant]
--a------ 2006-05-06 21:29 6656 C:\Program Files\Unlocker\UnlockerAssistant.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VTTimer]
-ra------ 2005-03-08 03:33 53248 C:\WINDOWS\SYSTEM32\VTTimer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VTTrayp]
-ra------ 2005-11-01 04:15 163840 C:\WINDOWS\SYSTEM32\VTTrayp.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\YeppStudioAgent]
C:\Program Files\Samsung\SamsungMediaStudio4.1\SamsungMediaStudioAgent.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 0 (0x0)

R0 videX32;videX32;C:\WINDOWS\system32\DRIVERS\videX32.sys [2006-02-23 11:38]
R0 xfilt;VIA SATA IDE Hot-plug Driver;C:\WINDOWS\system32\DRIVERS\xfilt.sys [2006-02-23 11:39]
S3 ess;ESS Audio Driver (WDM);C:\WINDOWS\system32\drivers\ess.sys [2001-08-17 12:19]
S3 k600bus;Sony Ericsson 600i driver (WDM);C:\WINDOWS\system32\DRIVERS\k600bus.sys [2005-05-11 19:12]
S3 k600mdfl;Sony Ericsson 600i USB WMC Modem Filter;C:\WINDOWS\system32\DRIVERS\k600mdfl.sys [2005-05-11 19:12]
S3 k600mdm;Sony Ericsson 600i USB WMC Modem Drivers;C:\WINDOWS\system32\DRIVERS\k600mdm.sys [2005-05-11 19:12]
S3 k600mgmt;Sony Ericsson 600i USB WMC Device Management Drivers;C:\WINDOWS\system32\DRIVERS\k600mgmt.sys [2005-05-11 19:12]
S3 k600obex;Sony Ericsson 600i USB WMC OBEX Interface Drivers;C:\WINDOWS\system32\DRIVERS\k600obex.sys [2005-05-11 19:12]
S3 NtApm;NT Apm/Legacy Interface Driver;C:\WINDOWS\system32\DRIVERS\NtApm.sys [2001-08-23 12:00]
S3 p2pgasvc;Peer Networking Group Authentication;C:\WINDOWS\system32\svchost.exe [2004-08-03 22:56]
S3 p2pimsvc;Peer Networking Identity Manager;C:\WINDOWS\system32\svchost.exe [2004-08-03 22:56]
S3 p2psvc;Peer Networking;C:\WINDOWS\system32\svchost.exe [2004-08-03 22:56]
S3 PNRPSvc;Peer Name Resolution Protocol;C:\WINDOWS\system32\svchost.exe [2004-08-03 22:56]
S3 SiSV6306;SiSV6306;C:\WINDOWS\system32\DRIVERS\SiS6306p.sys [2001-08-17 12:50]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
p2psvc REG_MULTI_SZ p2psvc p2pimsvc p2pgasvc PNRPSvc

.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-26 08:45:09
Windows 5.1.2600 Service Pack 2 FAT NTAPI

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-03-26 8:46:05
ComboFix-quarantined-files.txt 2008-03-26 00:46:02
ComboFix5.txt 2008-01-18 04:42:32
ComboFix4.txt 2008-03-14 04:24:28
ComboFix3.txt 2008-03-24 07:13:38
ComboFix2.txt 2008-03-25 15:18:56
 

JSntgRvr

José
Retired Moderator and Malware Specialist
Joined
Jul 1, 2003
Messages
18,552
Hi, cromaczs07 :)

  • Copy the entire contents of the Quote Box below to Notepad.
  • Name the file as CFScript.txt
  • Change the Save as Type to All Files
  • and Save it on the desktop
Code:
File::
C:\gicchk2s.exe
C:\tgtighg.cmd
C:\WINDOWS\SYSTEM32\__.bat
C:\WINDOWS\SYSTEM32\__.reg
C:\WINDOWS\SYSTEM32\__.vbs

Registry::
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\svchosts]


Once saved, referring to the picture above, drag CFScript.txt into ComboFix.exe, and post back the resulting reportalong with a Hijackthis log..

Jotti File Submission:
  • Please go to Jotti's malware scan
  • Copy and paste the following file paths into the "File to upload & scan"box on the top of the page one by one:
    • C:\WINDOWS\x2.64.exe
      C:\WINDOWS\meta4.exe
      C:\WINDOWS\MOTA113.exe
      C:\WINDOWS\SYSTEM32\cygwin1.dll
      C:\WINDOWS\SYSTEM32\cygz.dll
      C:\WINDOWS\SYSTEM32\smab.dll
      C:\WINDOWS\SYSTEM32\avisynth.dll
      C:\WINDOWS\SYSTEM32\i420vfw.dll
      C:\WINDOWS\SYSTEM32\yv12vfw.dll
      C:\WINDOWS\SYSTEM32\x.264.exe
      C:\WINDOWS\SYSTEM32\AVSredirect.dll
      C:\WINDOWS\SYSTEM32\1614B4F5DA.sys
  • Click on the submit button
  • Please post any finding on these files in your next reply.
 

cromaczs07

Thread Starter
Joined
Feb 20, 2006
Messages
310
Sir J!

Jotti will take time. In the meantime, here is my combofix log. Thanks!


ComboFix 08-03-25.1 - mambaltazar 2008-03-26 10:45:08.16 - FAT32x86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.173 [GMT 8:00]
Running from: C:\Documents and Settings\mambaltazar\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\mambaltazar\Desktop\CFScript.txt
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::
C:\gicchk2s.exe
C:\tgtighg.cmd
C:\WINDOWS\SYSTEM32\__.bat
C:\WINDOWS\SYSTEM32\__.reg
C:\WINDOWS\SYSTEM32\__.vbs
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\gicchk2s.exe
C:\tgtighg.cmd
C:\WINDOWS\SYSTEM32\__.bat
C:\WINDOWS\SYSTEM32\__.reg
C:\WINDOWS\SYSTEM32\__.vbs

.
((((((((((((((((((((((((( Files Created from 2008-02-26 to 2008-03-26 )))))))))))))))))))))))))))))))
.

2008-03-26 08:04 . 2008-03-26 08:04 <DIR> d-------- C:\Documents and Settings\Rockrokra\Application Data\AVG7
2008-03-25 15:58 . 2008-03-25 15:58 <DIR> d-------- C:\Program Files\Lavasoft
2008-03-25 15:58 . 2008-03-25 15:58 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\Lavasoft
2008-03-25 09:12 . 2007-10-19 12:36 1,774,432 --a------ C:\Rootkit_Detective.exe
2008-03-24 09:39 . 2008-03-24 09:39 <DIR> d-------- C:\Program Files\Trend Micro
2008-03-18 10:35 . 2008-03-18 10:35 <DIR> d--hs---- C:\FOUND.054
2008-03-14 14:40 . 2004-08-03 22:31 20,992 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\RTL8139.sys
2008-03-14 14:40 . 2004-08-03 22:31 20,992 --a------ C:\WINDOWS\SYSTEM32\dllcache\rtl8139.sys
2008-03-13 17:26 . 2008-03-13 17:26 0 --a------ C:\V
2008-03-13 17:26 . 2008-03-13 17:26 0 --a------ C:\neopocott
2008-03-13 17:22 . 2008-03-13 17:22 <DIR> d-------- C:\neogeo
2008-03-10 08:05 . 2008-03-10 08:05 <DIR> d--hs---- C:\FOUND.053
2008-03-05 20:37 . 2008-03-05 20:37 <DIR> d--hs---- C:\FOUND.052

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-03-14 06:42 3,818 --sha-w C:\WINDOWS\SYSTEM32\KGyGaAvL.sys
2008-03-07 09:44 47,536 ----a-w C:\Documents and Settings\mambaltazar\Application Data\GDIPFONTCACHEV1.DAT
2008-02-20 02:18 --------- d-----w C:\Program Files\Camtech
2008-02-07 05:12 --------- d-----w C:\Program Files\Macrogaming
2008-02-04 05:10 --------- d-----w C:\Documents and Settings\mambaltazar\Application Data\Talkback
2008-02-04 05:09 --------- d-----w C:\Documents and Settings\mambaltazar\Application Data\Thunderbird
2008-02-04 05:08 --------- d-----w C:\Program Files\Mozilla Thunderbird
2008-01-31 06:58 --------- d-----w C:\Program Files\PC Wizard 2008
2008-01-28 13:57 --------- d-----w C:\Program Files\Paltalk Messenger
2006-12-28 17:44 24,192 ----a-w C:\Documents and Settings\MBaltazar\usbsermptxp.sys
2006-12-28 17:44 22,768 ----a-w C:\Documents and Settings\MBaltazar\usbsermpt.sys
2006-09-08 02:03 45,392 ----a-w C:\Documents and Settings\MBaltazar\Application Data\GDIPFONTCACHEV1.DAT
2005-09-01 05:31 266 --sh--w C:\Program Files\desktop.ini
2005-09-01 05:31 11,079 ---h--w C:\Program Files\folder.htt
2005-10-13 13:27 422,400 --sha-r C:\WINDOWS\x2.64.exe
2005-05-13 09:12 217,073 --sha-r C:\WINDOWS\meta4.exe
2005-10-24 03:13 66,560 --sha-r C:\WINDOWS\MOTA113.exe
2005-06-26 07:32 616,448 --sha-r C:\WINDOWS\SYSTEM32\cygwin1.dll
2005-06-21 14:37 45,568 --sha-r C:\WINDOWS\SYSTEM32\cygz.dll
2005-12-22 12:23 816,640 --sha-r C:\WINDOWS\SYSTEM32\smab.dll
2005-10-07 11:14 308,224 --sha-r C:\WINDOWS\SYSTEM32\avisynth.dll
2004-01-24 16:00 70,656 --sha-r C:\WINDOWS\SYSTEM32\i420vfw.dll
2004-01-24 16:00 70,656 --sha-r C:\WINDOWS\SYSTEM32\yv12vfw.dll
2005-02-28 05:16 240,128 --sha-r C:\WINDOWS\SYSTEM32\x.264.exe
2005-07-14 04:31 27,648 --sha-r C:\WINDOWS\SYSTEM32\AVSredirect.dll
2007-06-07 01:04 56 --sh--r C:\WINDOWS\SYSTEM32\1614B4F5DA.sys
.

((((((((((((((((((((((((((((( snapshot_2008-03-14_12.23.55.99 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-03-25 07:58:32 1,038,336 ----a-r C:\WINDOWS\Installer\{DED53B0B-B67C-4244-AE6A-D6FD3C28D1EF}\Icon0E6AB9FC.exe
+ 2008-03-25 07:58:32 178,688 ----a-r C:\WINDOWS\Installer\{DED53B0B-B67C-4244-AE6A-D6FD3C28D1EF}\Icon0E6AB9FC1.exe
+ 2008-03-25 07:58:32 171,008 ----a-r C:\WINDOWS\Installer\{DED53B0B-B67C-4244-AE6A-D6FD3C28D1EF}\IconDED53B0B.exe
+ 2008-03-25 07:58:32 8,704 ----a-r C:\WINDOWS\Installer\{DED53B0B-B67C-4244-AE6A-D6FD3C28D1EF}\IconDED53B0B1.exe
+ 2007-07-11 05:37:26 6,272 ----a-w C:\WINDOWS\SYSTEM32\DRIVERS\AWRTPD.sys
+ 2007-08-07 04:58:08 8,320 ----a-w C:\WINDOWS\SYSTEM32\DRIVERS\AWRTRD.sys
+ 2007-08-07 04:56:58 9,344 ----a-w C:\WINDOWS\SYSTEM32\DRIVERS\NSDriver.sys
- 2007-09-24 14:30:28 135,168 ----a-w C:\WINDOWS\SYSTEM32\java.exe
+ 2008-02-21 17:23:36 135,168 ----a-w C:\WINDOWS\SYSTEM32\java.exe
- 2007-09-24 14:30:30 135,168 ----a-w C:\WINDOWS\SYSTEM32\javaw.exe
+ 2008-02-21 17:23:40 135,168 ----a-w C:\WINDOWS\SYSTEM32\javaw.exe
- 2007-09-24 15:31:42 139,264 ----a-w C:\WINDOWS\SYSTEM32\javaws.exe
+ 2008-02-21 18:33:32 139,264 ----a-w C:\WINDOWS\SYSTEM32\javaws.exe
+ 2007-12-14 03:32:52 12,632 ----a-w C:\WINDOWS\SYSTEM32\lsdelete.exe
- 2007-12-13 09:11:30 578,680 ----a-w C:\WINDOWS\SYSTEM32\Restore\rstrlog.dat
+ 2008-03-24 05:20:48 184,828 ----a-w C:\WINDOWS\SYSTEM32\Restore\rstrlog.dat
+ 2008-03-26 00:25:26 16,384 ----a-w C:\WINDOWS\TEMP\Perflib_Perfdata_19c.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Yahoo! Pager"="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" [2007-06-11 18:16 4670968]
"Rainlendar2"="C:\Program Files\Rainlendar2\Rainlendar2.exe" [2007-07-24 15:12 1298432]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-03 22:56 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ISUSPM Startup"="C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" [2005-08-11 16:30 249856]
"ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2005-08-11 16:30 81920]
"SoundMan"="SOUNDMAN.EXE" [2006-03-01 16:22 577536 C:\WINDOWS\SOUNDMAN.EXE]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2008-01-23 21:16 579072]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2008-01-23 21:16 219136]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"RunNarrator"="Narrator.exe" [2004-08-03 22:56 53760 C:\WINDOWS\SYSTEM32\narrator.exe]
"tscuninstall"="C:\WINDOWS\system32\tscupgrd.exe" [2004-08-04 04:59 44544]

C:\Documents and Settings\mambaltazar\Start Menu\Programs\Startup\
PopChat.exe [1999-01-30 03:36:42 594432]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"DisableCAD"= 0 (0x0)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2006-12-20 13:55 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
C:\Program Files\SUPERAntiSpyware\SASWINLO.dll 2007-04-19 13:41 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^Acrobat Assistant.lnk]
path=C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\Acrobat Assistant.lnk
backup=C:\WINDOWS\pss\Acrobat Assistant.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^Adobe Gamma Loader.exe.lnk]
path=C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\Adobe Gamma Loader.exe.lnk
backup=C:\WINDOWS\pss\Adobe Gamma Loader.exe.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^Adobe Gamma Loader.lnk]
path=C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk
backup=C:\WINDOWS\pss\Adobe Gamma Loader.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^PalTalk.lnk]
path=C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\PalTalk.lnk
backup=C:\WINDOWS\pss\PalTalk.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^TurboNote.lnk]
path=C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\TurboNote.lnk
backup=C:\WINDOWS\pss\TurboNote.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^WinZip Quick Pick.lnk]
path=C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\WinZip Quick Pick.lnk
backup=C:\WINDOWS\pss\WinZip Quick Pick.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\C-Media Mixer]
--a------ 2006-01-11 17:17 1581056 C:\WINDOWS\mixer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DeviceDiscovery]
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Component Manager]
--a------ 2003-10-23 19:51 233472 C:\Program Files\HP\hpcoretech\hpcmpmgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
--a------ 2003-06-25 11:24 49152 C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPDJ Taskbar Utility]
--a------ 2003-07-28 21:43 188416 C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb09.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
--a------ 2004-08-04 01:06 1667584 C:\Program Files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCSuiteTrayApplication]
C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PcSync]
C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sony Ericsson PC Suite]
-ra------ 2005-10-26 17:17 159744 C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
-ra------ 2006-03-01 16:22 577536 C:\WINDOWS\SOUNDMAN.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a------ 2005-11-10 13:03 36975 C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\svchosts]
D:\svchosts.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UnlockerAssistant]
--a------ 2006-05-06 21:29 6656 C:\Program Files\Unlocker\UnlockerAssistant.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VTTimer]
-ra------ 2005-03-08 03:33 53248 C:\WINDOWS\SYSTEM32\VTTimer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VTTrayp]
-ra------ 2005-11-01 04:15 163840 C:\WINDOWS\SYSTEM32\VTTrayp.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\YeppStudioAgent]
C:\Program Files\Samsung\SamsungMediaStudio4.1\SamsungMediaStudioAgent.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 0 (0x0)

R0 videX32;videX32;C:\WINDOWS\system32\DRIVERS\videX32.sys [2006-02-23 11:38]
R0 xfilt;VIA SATA IDE Hot-plug Driver;C:\WINDOWS\system32\DRIVERS\xfilt.sys [2006-02-23 11:39]
S3 ess;ESS Audio Driver (WDM);C:\WINDOWS\system32\drivers\ess.sys [2001-08-17 12:19]
S3 k600bus;Sony Ericsson 600i driver (WDM);C:\WINDOWS\system32\DRIVERS\k600bus.sys [2005-05-11 19:12]
S3 k600mdfl;Sony Ericsson 600i USB WMC Modem Filter;C:\WINDOWS\system32\DRIVERS\k600mdfl.sys [2005-05-11 19:12]
S3 k600mdm;Sony Ericsson 600i USB WMC Modem Drivers;C:\WINDOWS\system32\DRIVERS\k600mdm.sys [2005-05-11 19:12]
S3 k600mgmt;Sony Ericsson 600i USB WMC Device Management Drivers;C:\WINDOWS\system32\DRIVERS\k600mgmt.sys [2005-05-11 19:12]
S3 k600obex;Sony Ericsson 600i USB WMC OBEX Interface Drivers;C:\WINDOWS\system32\DRIVERS\k600obex.sys [2005-05-11 19:12]
S3 NtApm;NT Apm/Legacy Interface Driver;C:\WINDOWS\system32\DRIVERS\NtApm.sys [2001-08-23 12:00]
S3 p2pgasvc;Peer Networking Group Authentication;C:\WINDOWS\system32\svchost.exe [2004-08-03 22:56]
S3 p2pimsvc;Peer Networking Identity Manager;C:\WINDOWS\system32\svchost.exe [2004-08-03 22:56]
S3 p2psvc;Peer Networking;C:\WINDOWS\system32\svchost.exe [2004-08-03 22:56]
S3 PNRPSvc;Peer Name Resolution Protocol;C:\WINDOWS\system32\svchost.exe [2004-08-03 22:56]
S3 SiSV6306;SiSV6306;C:\WINDOWS\system32\DRIVERS\SiS6306p.sys [2001-08-17 12:50]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
p2psvc REG_MULTI_SZ p2psvc p2pimsvc p2pgasvc PNRPSvc

.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-26 10:47:47
Windows 5.1.2600 Service Pack 2 FAT NTAPI

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-03-26 10:48:15
ComboFix-quarantined-files.txt 2008-03-26 02:48:14
ComboFix5.txt 2008-03-14 04:24:28
ComboFix4.txt 2008-03-24 07:13:38
ComboFix3.txt 2008-03-25 15:18:56
ComboFix2.txt 2008-03-26 00:46:06
 

cromaczs07

Thread Starter
Joined
Feb 20, 2006
Messages
310
Hi Sir J!

Jotti found 4 "possibly malware" files in the list that you've enumerated:

C:\WINDOWS\MOTA113.exe
C:\WINDOWS\SYSTEM32\cygwin1.dll
C:\WINDOWS\SYSTEM32\cygz.dll
C:\WINDOWS\SYSTEM32\AVSredirect.dll
 

JSntgRvr

José
Retired Moderator and Malware Specialist
Joined
Jul 1, 2003
Messages
18,552
Hi Sir J!

Jotti found 4 "possibly malware" files in the list that you've enumerated:

C:\WINDOWS\MOTA113.exe
C:\WINDOWS\SYSTEM32\cygwin1.dll
C:\WINDOWS\SYSTEM32\cygz.dll
C:\WINDOWS\SYSTEM32\AVSredirect.dll
That could be a False Positive. Have you installed a media program named "SUPER"?

How is the computer doing otherwise?
 

cromaczs07

Thread Starter
Joined
Feb 20, 2006
Messages
310
yes i think so. but i really can't remember exactly what it does.

AVG has prompted me again a threat... same files that we have deleted from you first reply. It is visible in all drives.

Thanks!

AVG has identified 20 possible threats, it managed to delete 8 files.
 

JSntgRvr

José
Retired Moderator and Malware Specialist
Joined
Jul 1, 2003
Messages
18,552
If they respond to SUPER, keep them.

If you can see the the ones detected by AVG, remove them. They all should be part of the same infection. Must be careful with those external drives.
 

cromaczs07

Thread Starter
Joined
Feb 20, 2006
Messages
310
Sir J, for the last look. The svchosts processes are suspicious, do you think they are fine?

Logfile of HijackThis v1.99.1
Scan saved at 10:44, on 2008-03-27
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Retrospect\Retrospect 7.5\retrorun.exe
C:\WINDOWS\system32\tcpsvcs.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\Rainlendar2\Rainlendar2.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Documents and Settings\mambaltazar\Start Menu\Programs\Startup\PopChat.exe
C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.sweetim.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.sweetim.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 192.168.10.3:3128
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
O4 - HKCU\..\Run: [Rainlendar2] C:\Program Files\Rainlendar2\Rainlendar2.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: PopChat.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: PalTalk - {4EAFEF58-EEFA-4116-983D-03B49BCBFFFE} - C:\Program Files\Paltalk Messenger\Paltalk.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = philrice.local
O17 - HKLM\Software\..\Telephony: DomainName = philrice.local
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = philrice.local
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = philrice.local
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: LiveUpdate - Unknown owner - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE (file missing)
O23 - Service: Retrospect Launcher (RetroLauncher) - EMC Corporation - C:\Program Files\Retrospect\Retrospect 7.5\retrorun.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
 

JSntgRvr

José
Retired Moderator and Malware Specialist
Joined
Jul 1, 2003
Messages
18,552
Hi, cromaczs07 :)

Multiple entries for svchost.exe are normal in XP. You did have a D:\svchosts.exe, which is malware in one of your external drives. Look at the difference, it has an extra "s". If found in one of your external drives, please remove. But the C:\WINDOWS\System32\svchost.exe file is legit.
 
Status
This thread has been Locked and is not open to further replies. Please start a New Thread if you're having a similar issue. View our Welcome Guide to learn how to use this site.

Users Who Are Viewing This Thread (Users: 0, Guests: 1)

As Seen On
As Seen On...

Welcome to Tech Support Guy!

Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.

If you're not already familiar with forums, watch our Welcome Guide to get started.

Join over 807,865 other people just like you!

Latest posts

Staff online

Top