1. Computer problem? Tech Support Guy is completely free -- paid for by advertisers and donations. Click here to join today! If you're new to Tech Support Guy, we highly recommend that you visit our Guide for New Members.

Solved: Worms, worms, and more worms.

Discussion in 'Virus & Other Malware Removal' started by cromaczs07, Mar 25, 2008.

Thread Status:
Not open for further replies.
Advertisement
  1. cromaczs07

    cromaczs07 Thread Starter

    Joined:
    Feb 20, 2006
    Messages:
    310
    I am having problems with infected flash drives. Usually we share files, but when we started having flash drives that could not be opened by double clicking, our computers went crazy.

    It usually affect the svchosts processes. It duplicates them. Fresh drives will have autorun.inf, when these are deleted, flash drives will no longer be opened.

    Thank you very much!

    Logfile of HijackThis v1.99.1
    Scan saved at 08:48, on 2008-03-26
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
    C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
    C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
    C:\Program Files\Retrospect\Retrospect 7.5\retrorun.exe
    C:\WINDOWS\system32\tcpsvcs.exe
    C:\WINDOWS\System32\snmp.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
    C:\WINDOWS\SOUNDMAN.EXE
    C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
    C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
    C:\Program Files\Rainlendar2\Rainlendar2.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Documents and Settings\mambaltazar\Start Menu\Programs\Startup\PopChat.exe
    C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\WINDOWS\explorer.exe
    C:\WINDOWS\system32\notepad.exe
    C:\Program Files\hijackthis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.sweetim.com/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.sweetim.com
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 192.168.10.3:3128
    R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup
    O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
    O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
    O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
    O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
    O4 - HKCU\..\Run: [Rainlendar2] C:\Program Files\Rainlendar2\Rainlendar2.exe
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - Startup: PopChat.exe
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra button: PalTalk - {4EAFEF58-EEFA-4116-983D-03B49BCBFFFE} - C:\Program Files\Paltalk Messenger\Paltalk.exe (file missing)
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
    O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = philrice.local
    O17 - HKLM\Software\..\Telephony: DomainName = philrice.local
    O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = philrice.local
    O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = philrice.local
    O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
    O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
    O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
    O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
    O23 - Service: LiveUpdate - Unknown owner - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE (file missing)
    O23 - Service: Retrospect Launcher (RetroLauncher) - EMC Corporation - C:\Program Files\Retrospect\Retrospect 7.5\retrorun.exe
    O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
    O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe

    ComboFix 08-03-25.1 - mambaltazar 2008-03-26 8:42:11.15 - FAT32x86
    Running from: G:\DOWNLOADS\ComboFix.exe
    * Created a new restore point

    WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
    .

    ((((((((((((((((((((((((( Files Created from 2008-02-26 to 2008-03-26 )))))))))))))))))))))))))))))))
    .

    2008-03-26 08:04 . 2008-03-26 08:04 <DIR> d-------- C:\Documents and Settings\Rockrokra\Application Data\AVG7
    2008-03-25 22:43 . 2008-03-25 22:42 117,067 -r-hs---- C:\gicchk2s.exe
    2008-03-25 22:42 . 2008-03-24 13:12 114,602 -r-hs---- C:\tgtighg.cmd
    2008-03-25 15:58 . 2008-03-25 15:58 <DIR> d-------- C:\Program Files\Lavasoft
    2008-03-25 15:58 . 2008-03-25 15:58 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\Lavasoft
    2008-03-25 09:12 . 2007-10-19 12:36 1,774,432 --a------ C:\Rootkit_Detective.exe
    2008-03-24 09:39 . 2008-03-24 09:39 <DIR> d-------- C:\Program Files\Trend Micro
    2008-03-18 10:35 . 2008-03-18 10:35 <DIR> d--hs---- C:\FOUND.054
    2008-03-14 14:40 . 2004-08-03 22:31 20,992 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\RTL8139.sys
    2008-03-14 14:40 . 2004-08-03 22:31 20,992 --a------ C:\WINDOWS\SYSTEM32\dllcache\rtl8139.sys
    2008-03-13 17:26 . 2008-03-13 17:26 0 --a------ C:\V
    2008-03-13 17:26 . 2008-03-13 17:26 0 --a------ C:\neopocott
    2008-03-13 17:22 . 2008-03-13 17:22 <DIR> d-------- C:\neogeo
    2008-03-10 08:05 . 2008-03-10 08:05 <DIR> d--hs---- C:\FOUND.053
    2008-03-05 20:37 . 2008-03-05 20:37 <DIR> d--hs---- C:\FOUND.052

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-03-14 06:42 3,818 --sha-w C:\WINDOWS\SYSTEM32\KGyGaAvL.sys
    2008-03-07 09:44 47,536 ----a-w C:\Documents and Settings\mambaltazar\Application Data\GDIPFONTCACHEV1.DAT
    2008-02-20 02:18 --------- d-----w C:\Program Files\Camtech
    2008-02-07 05:12 --------- d-----w C:\Program Files\Macrogaming
    2008-02-04 05:10 --------- d-----w C:\Documents and Settings\mambaltazar\Application Data\Talkback
    2008-02-04 05:09 --------- d-----w C:\Documents and Settings\mambaltazar\Application Data\Thunderbird
    2008-02-04 05:08 --------- d-----w C:\Program Files\Mozilla Thunderbird
    2008-01-31 06:58 --------- d-----w C:\Program Files\PC Wizard 2008
    2008-01-28 13:57 --------- d-----w C:\Program Files\Paltalk Messenger
    2006-12-28 17:44 24,192 ----a-w C:\Documents and Settings\MBaltazar\usbsermptxp.sys
    2006-12-28 17:44 22,768 ----a-w C:\Documents and Settings\MBaltazar\usbsermpt.sys
    2006-09-08 02:03 45,392 ----a-w C:\Documents and Settings\MBaltazar\Application Data\GDIPFONTCACHEV1.DAT
    2005-09-01 05:31 266 --sh--w C:\Program Files\desktop.ini
    2005-09-01 05:31 11,079 ---h--w C:\Program Files\folder.htt
    2005-10-13 13:27 422,400 --sha-r C:\WINDOWS\x2.64.exe
    2005-05-13 09:12 217,073 --sha-r C:\WINDOWS\meta4.exe
    2005-10-24 03:13 66,560 --sha-r C:\WINDOWS\MOTA113.exe
    2005-06-26 07:32 616,448 --sha-r C:\WINDOWS\SYSTEM32\cygwin1.dll
    2005-06-21 14:37 45,568 --sha-r C:\WINDOWS\SYSTEM32\cygz.dll
    2005-12-22 12:23 816,640 --sha-r C:\WINDOWS\SYSTEM32\smab.dll
    2005-10-07 11:14 308,224 --sha-r C:\WINDOWS\SYSTEM32\avisynth.dll
    2004-01-24 16:00 70,656 --sha-r C:\WINDOWS\SYSTEM32\i420vfw.dll
    2004-01-24 16:00 70,656 --sha-r C:\WINDOWS\SYSTEM32\yv12vfw.dll
    2005-02-28 05:16 240,128 --sha-r C:\WINDOWS\SYSTEM32\x.264.exe
    2005-07-14 04:31 27,648 --sha-r C:\WINDOWS\SYSTEM32\AVSredirect.dll
    2007-06-07 01:04 56 --sh--r C:\WINDOWS\SYSTEM32\1614B4F5DA.sys
    2007-09-08 19:14 386 --sha-r C:\WINDOWS\SYSTEM32\__.bat
    2007-09-08 19:31 740 --sha-r C:\WINDOWS\SYSTEM32\__.reg
    2007-09-08 19:13 1,063 --sha-r C:\WINDOWS\SYSTEM32\__.vbs
    .

    ((((((((((((((((((((((((((((( snapshot_2008-03-14_12.23.55.99 )))))))))))))))))))))))))))))))))))))))))
    .
    + 2008-03-25 07:58:32 1,038,336 ----a-r C:\WINDOWS\Installer\{DED53B0B-B67C-4244-AE6A-D6FD3C28D1EF}\Icon0E6AB9FC.exe
    + 2008-03-25 07:58:32 178,688 ----a-r C:\WINDOWS\Installer\{DED53B0B-B67C-4244-AE6A-D6FD3C28D1EF}\Icon0E6AB9FC1.exe
    + 2008-03-25 07:58:32 171,008 ----a-r C:\WINDOWS\Installer\{DED53B0B-B67C-4244-AE6A-D6FD3C28D1EF}\IconDED53B0B.exe
    + 2008-03-25 07:58:32 8,704 ----a-r C:\WINDOWS\Installer\{DED53B0B-B67C-4244-AE6A-D6FD3C28D1EF}\IconDED53B0B1.exe
    + 2007-07-11 05:37:26 6,272 ----a-w C:\WINDOWS\SYSTEM32\DRIVERS\AWRTPD.sys
    + 2007-08-07 04:58:08 8,320 ----a-w C:\WINDOWS\SYSTEM32\DRIVERS\AWRTRD.sys
    + 2007-08-07 04:56:58 9,344 ----a-w C:\WINDOWS\SYSTEM32\DRIVERS\NSDriver.sys
    - 2007-09-24 14:30:28 135,168 ----a-w C:\WINDOWS\SYSTEM32\java.exe
    + 2008-02-21 17:23:36 135,168 ----a-w C:\WINDOWS\SYSTEM32\java.exe
    - 2007-09-24 14:30:30 135,168 ----a-w C:\WINDOWS\SYSTEM32\javaw.exe
    + 2008-02-21 17:23:40 135,168 ----a-w C:\WINDOWS\SYSTEM32\javaw.exe
    - 2007-09-24 15:31:42 139,264 ----a-w C:\WINDOWS\SYSTEM32\javaws.exe
    + 2008-02-21 18:33:32 139,264 ----a-w C:\WINDOWS\SYSTEM32\javaws.exe
    + 2007-12-14 03:32:52 12,632 ----a-w C:\WINDOWS\SYSTEM32\lsdelete.exe
    - 2007-12-13 09:11:30 578,680 ----a-w C:\WINDOWS\SYSTEM32\Restore\rstrlog.dat
    + 2008-03-24 05:20:48 184,828 ----a-w C:\WINDOWS\SYSTEM32\Restore\rstrlog.dat
    + 2008-03-26 00:25:26 16,384 ----a-w C:\WINDOWS\TEMP\Perflib_Perfdata_19c.dat
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Yahoo! Pager"="C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.exe" [2007-06-11 18:16 4670968]
    "Rainlendar2"="C:\Program Files\Rainlendar2\Rainlendar2.exe" [2007-07-24 15:12 1298432]
    "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-03 22:56 15360]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "ISUSPM Startup"="C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" [2005-08-11 16:30 249856]
    "ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2005-08-11 16:30 81920]
    "SoundMan"="SOUNDMAN.EXE" [2006-03-01 16:22 577536 C:\WINDOWS\SOUNDMAN.EXE]
    "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784]
    "AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2008-01-23 21:16 579072]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2008-01-23 21:16 219136]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
    "RunNarrator"="Narrator.exe" [2004-08-03 22:56 53760 C:\WINDOWS\SYSTEM32\narrator.exe]
    "tscuninstall"="C:\WINDOWS\system32\tscupgrd.exe" [2004-08-04 04:59 44544]

    C:\Documents and Settings\mambaltazar\Start Menu\Programs\Startup\
    PopChat.exe [1999-01-30 03:36:42 594432]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
    "DisableCAD"= 0 (0x0)

    [hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
    "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2006-12-20 13:55 77824]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
    C:\Program Files\SUPERAntiSpyware\SASWINLO.dll 2007-04-19 13:41 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^Acrobat Assistant.lnk]
    path=C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\Acrobat Assistant.lnk
    backup=C:\WINDOWS\pss\Acrobat Assistant.lnkCommon Startup

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^Adobe Gamma Loader.exe.lnk]
    path=C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\Adobe Gamma Loader.exe.lnk
    backup=C:\WINDOWS\pss\Adobe Gamma Loader.exe.lnkCommon Startup

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^Adobe Gamma Loader.lnk]
    path=C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk
    backup=C:\WINDOWS\pss\Adobe Gamma Loader.lnkCommon Startup

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^Microsoft Office.lnk]
    path=C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\Microsoft Office.lnk
    backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^PalTalk.lnk]
    path=C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\PalTalk.lnk
    backup=C:\WINDOWS\pss\PalTalk.lnkCommon Startup

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^TurboNote.lnk]
    path=C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\TurboNote.lnk
    backup=C:\WINDOWS\pss\TurboNote.lnkCommon Startup

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^WinZip Quick Pick.lnk]
    path=C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\WinZip Quick Pick.lnk
    backup=C:\WINDOWS\pss\WinZip Quick Pick.lnkCommon Startup

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\C-Media Mixer]
    --a------ 2006-01-11 17:17 1581056 C:\WINDOWS\mixer.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DeviceDiscovery]
    C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Component Manager]
    --a------ 2003-10-23 19:51 233472 C:\Program Files\HP\hpcoretech\hpcmpmgr.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
    --a------ 2003-06-25 11:24 49152 C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPDJ Taskbar Utility]
    --a------ 2003-07-28 21:43 188416 C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb09.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
    --a------ 2004-08-04 01:06 1667584 C:\Program Files\Messenger\msmsgs.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCSuiteTrayApplication]
    C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PcSync]
    C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
    C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sony Ericsson PC Suite]
    -ra------ 2005-10-26 17:17 159744 C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
    -ra------ 2006-03-01 16:22 577536 C:\WINDOWS\SOUNDMAN.EXE

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
    --a------ 2005-11-10 13:03 36975 C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\svchosts]
    D:\svchosts.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UnlockerAssistant]
    --a------ 2006-05-06 21:29 6656 C:\Program Files\Unlocker\UnlockerAssistant.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VTTimer]
    -ra------ 2005-03-08 03:33 53248 C:\WINDOWS\SYSTEM32\VTTimer.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VTTrayp]
    -ra------ 2005-11-01 04:15 163840 C:\WINDOWS\SYSTEM32\VTTrayp.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\YeppStudioAgent]
    C:\Program Files\Samsung\SamsungMediaStudio4.1\SamsungMediaStudioAgent.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
    "DisableMonitoring"=dword:00000001

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
    "AllowInboundEchoRequest"= 0 (0x0)

    R0 videX32;videX32;C:\WINDOWS\system32\DRIVERS\videX32.sys [2006-02-23 11:38]
    R0 xfilt;VIA SATA IDE Hot-plug Driver;C:\WINDOWS\system32\DRIVERS\xfilt.sys [2006-02-23 11:39]
    S3 ess;ESS Audio Driver (WDM);C:\WINDOWS\system32\drivers\ess.sys [2001-08-17 12:19]
    S3 k600bus;Sony Ericsson 600i driver (WDM);C:\WINDOWS\system32\DRIVERS\k600bus.sys [2005-05-11 19:12]
    S3 k600mdfl;Sony Ericsson 600i USB WMC Modem Filter;C:\WINDOWS\system32\DRIVERS\k600mdfl.sys [2005-05-11 19:12]
    S3 k600mdm;Sony Ericsson 600i USB WMC Modem Drivers;C:\WINDOWS\system32\DRIVERS\k600mdm.sys [2005-05-11 19:12]
    S3 k600mgmt;Sony Ericsson 600i USB WMC Device Management Drivers;C:\WINDOWS\system32\DRIVERS\k600mgmt.sys [2005-05-11 19:12]
    S3 k600obex;Sony Ericsson 600i USB WMC OBEX Interface Drivers;C:\WINDOWS\system32\DRIVERS\k600obex.sys [2005-05-11 19:12]
    S3 NtApm;NT Apm/Legacy Interface Driver;C:\WINDOWS\system32\DRIVERS\NtApm.sys [2001-08-23 12:00]
    S3 p2pgasvc;Peer Networking Group Authentication;C:\WINDOWS\system32\svchost.exe [2004-08-03 22:56]
    S3 p2pimsvc;Peer Networking Identity Manager;C:\WINDOWS\system32\svchost.exe [2004-08-03 22:56]
    S3 p2psvc;Peer Networking;C:\WINDOWS\system32\svchost.exe [2004-08-03 22:56]
    S3 PNRPSvc;Peer Name Resolution Protocol;C:\WINDOWS\system32\svchost.exe [2004-08-03 22:56]
    S3 SiSV6306;SiSV6306;C:\WINDOWS\system32\DRIVERS\SiS6306p.sys [2001-08-17 12:50]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
    p2psvc REG_MULTI_SZ p2psvc p2pimsvc p2pgasvc PNRPSvc

    .
    **************************************************************************

    catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-03-26 08:45:09
    Windows 5.1.2600 Service Pack 2 FAT NTAPI

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    Completion time: 2008-03-26 8:46:05
    ComboFix-quarantined-files.txt 2008-03-26 00:46:02
    ComboFix5.txt 2008-01-18 04:42:32
    ComboFix4.txt 2008-03-14 04:24:28
    ComboFix3.txt 2008-03-24 07:13:38
    ComboFix2.txt 2008-03-25 15:18:56
     
  2. JSntgRvr

    JSntgRvr Retired Moderator and Malware Specialist

    Joined:
    Jul 1, 2003
    Messages:
    18,552
    First Name:
    José
    Hi, cromaczs07 :)

    • Copy the entire contents of the Quote Box below to Notepad.
    • Name the file as CFScript.txt
    • Change the Save as Type to All Files
    • and Save it on the desktop
    Code:
    File::
    C:\gicchk2s.exe
    C:\tgtighg.cmd
    C:\WINDOWS\SYSTEM32\__.bat
    C:\WINDOWS\SYSTEM32\__.reg
    C:\WINDOWS\SYSTEM32\__.vbs
    
    Registry::
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\svchosts]
    [​IMG]

    Once saved, referring to the picture above, drag CFScript.txt into ComboFix.exe, and post back the resulting reportalong with a Hijackthis log..

    Jotti File Submission:
    • Please go to Jotti's malware scan
    • Copy and paste the following file paths into the "File to upload & scan"box on the top of the page one by one:
      • C:\WINDOWS\x2.64.exe
        C:\WINDOWS\meta4.exe
        C:\WINDOWS\MOTA113.exe
        C:\WINDOWS\SYSTEM32\cygwin1.dll
        C:\WINDOWS\SYSTEM32\cygz.dll
        C:\WINDOWS\SYSTEM32\smab.dll
        C:\WINDOWS\SYSTEM32\avisynth.dll
        C:\WINDOWS\SYSTEM32\i420vfw.dll
        C:\WINDOWS\SYSTEM32\yv12vfw.dll
        C:\WINDOWS\SYSTEM32\x.264.exe
        C:\WINDOWS\SYSTEM32\AVSredirect.dll
        C:\WINDOWS\SYSTEM32\1614B4F5DA.sys
    • Click on the submit button
    • Please post any finding on these files in your next reply.
     
  3. cromaczs07

    cromaczs07 Thread Starter

    Joined:
    Feb 20, 2006
    Messages:
    310
    Sir J!

    Jotti will take time. In the meantime, here is my combofix log. Thanks!


    ComboFix 08-03-25.1 - mambaltazar 2008-03-26 10:45:08.16 - FAT32x86
    Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.173 [GMT 8:00]
    Running from: C:\Documents and Settings\mambaltazar\Desktop\ComboFix.exe
    Command switches used :: C:\Documents and Settings\mambaltazar\Desktop\CFScript.txt
    * Created a new restore point

    WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

    FILE ::
    C:\gicchk2s.exe
    C:\tgtighg.cmd
    C:\WINDOWS\SYSTEM32\__.bat
    C:\WINDOWS\SYSTEM32\__.reg
    C:\WINDOWS\SYSTEM32\__.vbs
    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    C:\gicchk2s.exe
    C:\tgtighg.cmd
    C:\WINDOWS\SYSTEM32\__.bat
    C:\WINDOWS\SYSTEM32\__.reg
    C:\WINDOWS\SYSTEM32\__.vbs

    .
    ((((((((((((((((((((((((( Files Created from 2008-02-26 to 2008-03-26 )))))))))))))))))))))))))))))))
    .

    2008-03-26 08:04 . 2008-03-26 08:04 <DIR> d-------- C:\Documents and Settings\Rockrokra\Application Data\AVG7
    2008-03-25 15:58 . 2008-03-25 15:58 <DIR> d-------- C:\Program Files\Lavasoft
    2008-03-25 15:58 . 2008-03-25 15:58 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\Lavasoft
    2008-03-25 09:12 . 2007-10-19 12:36 1,774,432 --a------ C:\Rootkit_Detective.exe
    2008-03-24 09:39 . 2008-03-24 09:39 <DIR> d-------- C:\Program Files\Trend Micro
    2008-03-18 10:35 . 2008-03-18 10:35 <DIR> d--hs---- C:\FOUND.054
    2008-03-14 14:40 . 2004-08-03 22:31 20,992 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\RTL8139.sys
    2008-03-14 14:40 . 2004-08-03 22:31 20,992 --a------ C:\WINDOWS\SYSTEM32\dllcache\rtl8139.sys
    2008-03-13 17:26 . 2008-03-13 17:26 0 --a------ C:\V
    2008-03-13 17:26 . 2008-03-13 17:26 0 --a------ C:\neopocott
    2008-03-13 17:22 . 2008-03-13 17:22 <DIR> d-------- C:\neogeo
    2008-03-10 08:05 . 2008-03-10 08:05 <DIR> d--hs---- C:\FOUND.053
    2008-03-05 20:37 . 2008-03-05 20:37 <DIR> d--hs---- C:\FOUND.052

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-03-14 06:42 3,818 --sha-w C:\WINDOWS\SYSTEM32\KGyGaAvL.sys
    2008-03-07 09:44 47,536 ----a-w C:\Documents and Settings\mambaltazar\Application Data\GDIPFONTCACHEV1.DAT
    2008-02-20 02:18 --------- d-----w C:\Program Files\Camtech
    2008-02-07 05:12 --------- d-----w C:\Program Files\Macrogaming
    2008-02-04 05:10 --------- d-----w C:\Documents and Settings\mambaltazar\Application Data\Talkback
    2008-02-04 05:09 --------- d-----w C:\Documents and Settings\mambaltazar\Application Data\Thunderbird
    2008-02-04 05:08 --------- d-----w C:\Program Files\Mozilla Thunderbird
    2008-01-31 06:58 --------- d-----w C:\Program Files\PC Wizard 2008
    2008-01-28 13:57 --------- d-----w C:\Program Files\Paltalk Messenger
    2006-12-28 17:44 24,192 ----a-w C:\Documents and Settings\MBaltazar\usbsermptxp.sys
    2006-12-28 17:44 22,768 ----a-w C:\Documents and Settings\MBaltazar\usbsermpt.sys
    2006-09-08 02:03 45,392 ----a-w C:\Documents and Settings\MBaltazar\Application Data\GDIPFONTCACHEV1.DAT
    2005-09-01 05:31 266 --sh--w C:\Program Files\desktop.ini
    2005-09-01 05:31 11,079 ---h--w C:\Program Files\folder.htt
    2005-10-13 13:27 422,400 --sha-r C:\WINDOWS\x2.64.exe
    2005-05-13 09:12 217,073 --sha-r C:\WINDOWS\meta4.exe
    2005-10-24 03:13 66,560 --sha-r C:\WINDOWS\MOTA113.exe
    2005-06-26 07:32 616,448 --sha-r C:\WINDOWS\SYSTEM32\cygwin1.dll
    2005-06-21 14:37 45,568 --sha-r C:\WINDOWS\SYSTEM32\cygz.dll
    2005-12-22 12:23 816,640 --sha-r C:\WINDOWS\SYSTEM32\smab.dll
    2005-10-07 11:14 308,224 --sha-r C:\WINDOWS\SYSTEM32\avisynth.dll
    2004-01-24 16:00 70,656 --sha-r C:\WINDOWS\SYSTEM32\i420vfw.dll
    2004-01-24 16:00 70,656 --sha-r C:\WINDOWS\SYSTEM32\yv12vfw.dll
    2005-02-28 05:16 240,128 --sha-r C:\WINDOWS\SYSTEM32\x.264.exe
    2005-07-14 04:31 27,648 --sha-r C:\WINDOWS\SYSTEM32\AVSredirect.dll
    2007-06-07 01:04 56 --sh--r C:\WINDOWS\SYSTEM32\1614B4F5DA.sys
    .

    ((((((((((((((((((((((((((((( snapshot_2008-03-14_12.23.55.99 )))))))))))))))))))))))))))))))))))))))))
    .
    + 2008-03-25 07:58:32 1,038,336 ----a-r C:\WINDOWS\Installer\{DED53B0B-B67C-4244-AE6A-D6FD3C28D1EF}\Icon0E6AB9FC.exe
    + 2008-03-25 07:58:32 178,688 ----a-r C:\WINDOWS\Installer\{DED53B0B-B67C-4244-AE6A-D6FD3C28D1EF}\Icon0E6AB9FC1.exe
    + 2008-03-25 07:58:32 171,008 ----a-r C:\WINDOWS\Installer\{DED53B0B-B67C-4244-AE6A-D6FD3C28D1EF}\IconDED53B0B.exe
    + 2008-03-25 07:58:32 8,704 ----a-r C:\WINDOWS\Installer\{DED53B0B-B67C-4244-AE6A-D6FD3C28D1EF}\IconDED53B0B1.exe
    + 2007-07-11 05:37:26 6,272 ----a-w C:\WINDOWS\SYSTEM32\DRIVERS\AWRTPD.sys
    + 2007-08-07 04:58:08 8,320 ----a-w C:\WINDOWS\SYSTEM32\DRIVERS\AWRTRD.sys
    + 2007-08-07 04:56:58 9,344 ----a-w C:\WINDOWS\SYSTEM32\DRIVERS\NSDriver.sys
    - 2007-09-24 14:30:28 135,168 ----a-w C:\WINDOWS\SYSTEM32\java.exe
    + 2008-02-21 17:23:36 135,168 ----a-w C:\WINDOWS\SYSTEM32\java.exe
    - 2007-09-24 14:30:30 135,168 ----a-w C:\WINDOWS\SYSTEM32\javaw.exe
    + 2008-02-21 17:23:40 135,168 ----a-w C:\WINDOWS\SYSTEM32\javaw.exe
    - 2007-09-24 15:31:42 139,264 ----a-w C:\WINDOWS\SYSTEM32\javaws.exe
    + 2008-02-21 18:33:32 139,264 ----a-w C:\WINDOWS\SYSTEM32\javaws.exe
    + 2007-12-14 03:32:52 12,632 ----a-w C:\WINDOWS\SYSTEM32\lsdelete.exe
    - 2007-12-13 09:11:30 578,680 ----a-w C:\WINDOWS\SYSTEM32\Restore\rstrlog.dat
    + 2008-03-24 05:20:48 184,828 ----a-w C:\WINDOWS\SYSTEM32\Restore\rstrlog.dat
    + 2008-03-26 00:25:26 16,384 ----a-w C:\WINDOWS\TEMP\Perflib_Perfdata_19c.dat
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Yahoo! Pager"="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" [2007-06-11 18:16 4670968]
    "Rainlendar2"="C:\Program Files\Rainlendar2\Rainlendar2.exe" [2007-07-24 15:12 1298432]
    "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-03 22:56 15360]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "ISUSPM Startup"="C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" [2005-08-11 16:30 249856]
    "ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2005-08-11 16:30 81920]
    "SoundMan"="SOUNDMAN.EXE" [2006-03-01 16:22 577536 C:\WINDOWS\SOUNDMAN.EXE]
    "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784]
    "AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2008-01-23 21:16 579072]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2008-01-23 21:16 219136]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
    "RunNarrator"="Narrator.exe" [2004-08-03 22:56 53760 C:\WINDOWS\SYSTEM32\narrator.exe]
    "tscuninstall"="C:\WINDOWS\system32\tscupgrd.exe" [2004-08-04 04:59 44544]

    C:\Documents and Settings\mambaltazar\Start Menu\Programs\Startup\
    PopChat.exe [1999-01-30 03:36:42 594432]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
    "DisableCAD"= 0 (0x0)

    [hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
    "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2006-12-20 13:55 77824]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
    C:\Program Files\SUPERAntiSpyware\SASWINLO.dll 2007-04-19 13:41 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^Acrobat Assistant.lnk]
    path=C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\Acrobat Assistant.lnk
    backup=C:\WINDOWS\pss\Acrobat Assistant.lnkCommon Startup

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^Adobe Gamma Loader.exe.lnk]
    path=C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\Adobe Gamma Loader.exe.lnk
    backup=C:\WINDOWS\pss\Adobe Gamma Loader.exe.lnkCommon Startup

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^Adobe Gamma Loader.lnk]
    path=C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk
    backup=C:\WINDOWS\pss\Adobe Gamma Loader.lnkCommon Startup

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^Microsoft Office.lnk]
    path=C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\Microsoft Office.lnk
    backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^PalTalk.lnk]
    path=C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\PalTalk.lnk
    backup=C:\WINDOWS\pss\PalTalk.lnkCommon Startup

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^TurboNote.lnk]
    path=C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\TurboNote.lnk
    backup=C:\WINDOWS\pss\TurboNote.lnkCommon Startup

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^WinZip Quick Pick.lnk]
    path=C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\WinZip Quick Pick.lnk
    backup=C:\WINDOWS\pss\WinZip Quick Pick.lnkCommon Startup

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\C-Media Mixer]
    --a------ 2006-01-11 17:17 1581056 C:\WINDOWS\mixer.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DeviceDiscovery]
    C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Component Manager]
    --a------ 2003-10-23 19:51 233472 C:\Program Files\HP\hpcoretech\hpcmpmgr.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
    --a------ 2003-06-25 11:24 49152 C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPDJ Taskbar Utility]
    --a------ 2003-07-28 21:43 188416 C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb09.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
    --a------ 2004-08-04 01:06 1667584 C:\Program Files\Messenger\msmsgs.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCSuiteTrayApplication]
    C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PcSync]
    C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
    C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sony Ericsson PC Suite]
    -ra------ 2005-10-26 17:17 159744 C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
    -ra------ 2006-03-01 16:22 577536 C:\WINDOWS\SOUNDMAN.EXE

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
    --a------ 2005-11-10 13:03 36975 C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\svchosts]
    D:\svchosts.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UnlockerAssistant]
    --a------ 2006-05-06 21:29 6656 C:\Program Files\Unlocker\UnlockerAssistant.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VTTimer]
    -ra------ 2005-03-08 03:33 53248 C:\WINDOWS\SYSTEM32\VTTimer.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VTTrayp]
    -ra------ 2005-11-01 04:15 163840 C:\WINDOWS\SYSTEM32\VTTrayp.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\YeppStudioAgent]
    C:\Program Files\Samsung\SamsungMediaStudio4.1\SamsungMediaStudioAgent.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
    "DisableMonitoring"=dword:00000001

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
    "AllowInboundEchoRequest"= 0 (0x0)

    R0 videX32;videX32;C:\WINDOWS\system32\DRIVERS\videX32.sys [2006-02-23 11:38]
    R0 xfilt;VIA SATA IDE Hot-plug Driver;C:\WINDOWS\system32\DRIVERS\xfilt.sys [2006-02-23 11:39]
    S3 ess;ESS Audio Driver (WDM);C:\WINDOWS\system32\drivers\ess.sys [2001-08-17 12:19]
    S3 k600bus;Sony Ericsson 600i driver (WDM);C:\WINDOWS\system32\DRIVERS\k600bus.sys [2005-05-11 19:12]
    S3 k600mdfl;Sony Ericsson 600i USB WMC Modem Filter;C:\WINDOWS\system32\DRIVERS\k600mdfl.sys [2005-05-11 19:12]
    S3 k600mdm;Sony Ericsson 600i USB WMC Modem Drivers;C:\WINDOWS\system32\DRIVERS\k600mdm.sys [2005-05-11 19:12]
    S3 k600mgmt;Sony Ericsson 600i USB WMC Device Management Drivers;C:\WINDOWS\system32\DRIVERS\k600mgmt.sys [2005-05-11 19:12]
    S3 k600obex;Sony Ericsson 600i USB WMC OBEX Interface Drivers;C:\WINDOWS\system32\DRIVERS\k600obex.sys [2005-05-11 19:12]
    S3 NtApm;NT Apm/Legacy Interface Driver;C:\WINDOWS\system32\DRIVERS\NtApm.sys [2001-08-23 12:00]
    S3 p2pgasvc;Peer Networking Group Authentication;C:\WINDOWS\system32\svchost.exe [2004-08-03 22:56]
    S3 p2pimsvc;Peer Networking Identity Manager;C:\WINDOWS\system32\svchost.exe [2004-08-03 22:56]
    S3 p2psvc;Peer Networking;C:\WINDOWS\system32\svchost.exe [2004-08-03 22:56]
    S3 PNRPSvc;Peer Name Resolution Protocol;C:\WINDOWS\system32\svchost.exe [2004-08-03 22:56]
    S3 SiSV6306;SiSV6306;C:\WINDOWS\system32\DRIVERS\SiS6306p.sys [2001-08-17 12:50]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
    p2psvc REG_MULTI_SZ p2psvc p2pimsvc p2pgasvc PNRPSvc

    .
    **************************************************************************

    catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-03-26 10:47:47
    Windows 5.1.2600 Service Pack 2 FAT NTAPI

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    Completion time: 2008-03-26 10:48:15
    ComboFix-quarantined-files.txt 2008-03-26 02:48:14
    ComboFix5.txt 2008-03-14 04:24:28
    ComboFix4.txt 2008-03-24 07:13:38
    ComboFix3.txt 2008-03-25 15:18:56
    ComboFix2.txt 2008-03-26 00:46:06
     
  4. cromaczs07

    cromaczs07 Thread Starter

    Joined:
    Feb 20, 2006
    Messages:
    310
    Hi Sir J!

    Jotti found 4 "possibly malware" files in the list that you've enumerated:

    C:\WINDOWS\MOTA113.exe
    C:\WINDOWS\SYSTEM32\cygwin1.dll
    C:\WINDOWS\SYSTEM32\cygz.dll
    C:\WINDOWS\SYSTEM32\AVSredirect.dll
     
  5. JSntgRvr

    JSntgRvr Retired Moderator and Malware Specialist

    Joined:
    Jul 1, 2003
    Messages:
    18,552
    First Name:
    José
    That could be a False Positive. Have you installed a media program named "SUPER"?

    How is the computer doing otherwise?
     
  6. cromaczs07

    cromaczs07 Thread Starter

    Joined:
    Feb 20, 2006
    Messages:
    310
    yes i think so. but i really can't remember exactly what it does.

    AVG has prompted me again a threat... same files that we have deleted from you first reply. It is visible in all drives.

    Thanks!

    AVG has identified 20 possible threats, it managed to delete 8 files.
     
  7. JSntgRvr

    JSntgRvr Retired Moderator and Malware Specialist

    Joined:
    Jul 1, 2003
    Messages:
    18,552
    First Name:
    José
    If they respond to SUPER, keep them.

    If you can see the the ones detected by AVG, remove them. They all should be part of the same infection. Must be careful with those external drives.
     
  8. cromaczs07

    cromaczs07 Thread Starter

    Joined:
    Feb 20, 2006
    Messages:
    310
    Sir J, for the last look. The svchosts processes are suspicious, do you think they are fine?

    Logfile of HijackThis v1.99.1
    Scan saved at 10:44, on 2008-03-27
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
    C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
    C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
    C:\Program Files\Retrospect\Retrospect 7.5\retrorun.exe
    C:\WINDOWS\system32\tcpsvcs.exe
    C:\WINDOWS\System32\snmp.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
    C:\WINDOWS\SOUNDMAN.EXE
    C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
    C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
    C:\Program Files\Rainlendar2\Rainlendar2.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Documents and Settings\mambaltazar\Start Menu\Programs\Startup\PopChat.exe
    C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\hijackthis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.sweetim.com/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.sweetim.com
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 192.168.10.3:3128
    R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup
    O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
    O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
    O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
    O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
    O4 - HKCU\..\Run: [Rainlendar2] C:\Program Files\Rainlendar2\Rainlendar2.exe
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - Startup: PopChat.exe
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra button: PalTalk - {4EAFEF58-EEFA-4116-983D-03B49BCBFFFE} - C:\Program Files\Paltalk Messenger\Paltalk.exe (file missing)
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
    O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = philrice.local
    O17 - HKLM\Software\..\Telephony: DomainName = philrice.local
    O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = philrice.local
    O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = philrice.local
    O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
    O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
    O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
    O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
    O23 - Service: LiveUpdate - Unknown owner - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE (file missing)
    O23 - Service: Retrospect Launcher (RetroLauncher) - EMC Corporation - C:\Program Files\Retrospect\Retrospect 7.5\retrorun.exe
    O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
    O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
     
  9. JSntgRvr

    JSntgRvr Retired Moderator and Malware Specialist

    Joined:
    Jul 1, 2003
    Messages:
    18,552
    First Name:
    José
    Hi, cromaczs07 :)

    Multiple entries for svchost.exe are normal in XP. You did have a D:\svchosts.exe, which is malware in one of your external drives. Look at the difference, it has an extra "s". If found in one of your external drives, please remove. But the C:\WINDOWS\System32\svchost.exe file is legit.
     
  10. cromaczs07

    cromaczs07 Thread Starter

    Joined:
    Feb 20, 2006
    Messages:
    310
    Thank you very much Sir J!
     
  11. Sponsor

As Seen On
As Seen On...

Welcome to Tech Support Guy!

Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.

If you're not already familiar with forums, watch our Welcome Guide to get started.

Join over 733,556 other people just like you!

Thread Status:
Not open for further replies.

Short URL to this thread: https://techguy.org/697099

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Dismiss Notice