Thread: Unwanted popups and malware in the system
View Single Post
Old 11-13-2008, 06:05 AM   #4 (permalink)
jmash
Registered User
 
Join Date: May 2008
Posts: 18
OS: xp SP2


Re: Unwanted popups and malware in the system
Dear Chemist,

Please let me know how to download and run HijackThis.

After I ran ComboFix it restarted the machine and then I had to end some of the scanner softwares from task manager because the ComboFix was running after restart. So I am not sure if the following log is valid. Please check.

Meanwhile here is the ComboFix.txt:


ComboFix 08-11-11.01 - Cav.Bal 2008-11-13 12:23:40.6 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.136 [GMT 0:00]
Running from: c:\documents and settings\Cav.bal\Desktop\ComboFix.exe
.
The following files were disabled during the run:
c:\winnt\system32\adubes.dll


((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\winnt\BMf33cb4e5.txt
c:\winnt\BMf33cb4e5.xml
c:\winnt\dcbdcatys32_081027a.dll
c:\winnt\IE4 Error Log.txt
c:\winnt\Install.txt
c:\winnt\system\sgcxcxxaspf081027.exe
c:\winnt\system32\_proxy.dll
c:\winnt\system32\adubes.dll.vir
c:\winnt\system32\afisicx.exe
c:\winnt\system32\comsa32.sys
c:\winnt\system32\fhattach.dll
c:\winnt\system32\fhpatch.dll
c:\winnt\system32\inf\scsys16_081027.dll
c:\winnt\system32\inf\sppdcrs081027.scr
c:\winnt\system32\inf\svchoct.exe
c:\winnt\system32\IPHACTION.dll
c:\winnt\system32\IPHOST.dll
c:\winnt\system32\iphy.dll
c:\winnt\system32\IpSvchostF.dll
c:\winnt\system32\mabidwe.exe
c:\winnt\system32\MegasearchBarSetup.dlltmp
c:\winnt\system32\MSINET.oca
c:\winnt\system32\mywfhit.ini
c:\winnt\system32\mywfhit.ini.tmp
c:\winnt\system32\noytcyr.exe
c:\winnt\system32\roytctm.exe
c:\winnt\system32\soxpeca.exe
c:\winnt\system32\tdydowkc.exe
c:\winnt\system32\tmp0_644666688371.bk
c:\winnt\system32\tpszxyd.sys
c:\winnt\system32\wsldoekd.exe
c:\winnt\tawisys.ini
c:\winnt\wftadfi16_081027a.dll

Infected copy of c:\winnt\system32\spoolsv.exe was found and disinfected
Restored copy from - c:\winnt\system32\dllcache\spoolsv.exe

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_AFISICX
-------\Legacy_MABIDWE
-------\Legacy_NOYTCYR
-------\Legacy_ROYTCTM
-------\Legacy_SEIUCTOL
-------\Legacy_SOXPECA
-------\Legacy_TDYDOWKC
-------\Legacy_WSLDOEKD
-------\Service_afisicx
-------\Service_mabidwe
-------\Service_noytcyr
-------\Service_roytctm
-------\Service_seiuctol
-------\Service_soxpeca
-------\Service_tdydowkc
-------\Service_wsldoekd


((((((((((((((((((((((((( Files Created from 2008-10-13 to 2008-11-13 )))))))))))))))))))))))))))))))
.

2008-11-12 15:15 . 2008-11-12 21:53 <DIR> d-------- c:\program files\Visual CertExam Suite
2008-11-10 18:51 . 2008-11-10 18:51 <DIR> d-------- c:\program files\Microsoft Silverlight
2008-11-10 17:52 . 2008-11-13 12:47 54,156 --ah----- c:\winnt\QTFont.qfn
2008-11-10 17:52 . 2008-11-13 12:33 1,409 --a------ c:\winnt\QTFont.for
2008-11-10 17:51 . 2008-11-10 17:51 21,504 --a------ c:\winnt\system32\2.8-Install.exe
2008-11-10 17:40 . 2008-11-10 17:40 <DIR> d-------- c:\documents and settings\All Users\~Backup
2008-11-09 12:31 . 2008-11-09 12:31 <DIR> d--hs---- C:\window
2008-10-26 08:42 . 2008-11-06 11:32 <DIR> d-------- c:\winnt\system32\1024
2008-10-26 08:42 . 2008-10-26 08:42 108,336 --a------ c:\winnt\system32\MSWINSCK.OCX
2008-10-25 09:04 . 2008-10-25 09:04 68,832 ---hs---- c:\winnt\system32\yt8a.exe
2008-10-21 10:00 . 2008-11-13 08:04 <DIR> d-------- c:\documents and settings\Cav.bal\Application Data\skypePM
2008-10-21 10:00 . 2008-10-21 10:00 56 --ah----- c:\winnt\system32\ezsidmv.dat
2008-10-21 09:56 . 2008-11-13 11:59 <DIR> d-------- c:\documents and settings\Cav.bal\Application Data\Skype
2008-10-21 09:55 . 2008-11-05 20:56 <DIR> d-------- c:\program files\Google
2008-10-21 09:54 . 2008-10-21 09:55 <DIR> d-------- c:\program files\Skype
2008-10-21 09:54 . 2008-10-21 09:54 <DIR> d-------- c:\program files\Common Files\Skype
2008-10-21 09:54 . 2008-10-21 09:54 <DIR> d-------- c:\documents and settings\All Users\Application Data\Skype

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-11-13 12:38 --------- d-----w c:\program files\OfficeScan NT
2008-11-12 15:15 --------- d--h--w c:\program files\InstallShield Installation Information
2008-11-06 20:49 --------- d---a-w c:\documents and settings\All Users\Application Data\TEMP
2008-11-06 20:48 --------- d-----w c:\program files\SpywareBlaster
2008-11-05 21:03 --------- d-----w c:\program files\SpywareGuard
2008-10-06 09:04 201 ---ha-w c:\documents and settings\Cav.bal\Application Data\hpothb07.dat
2008-10-06 09:03 172 ---ha-w c:\documents and settings\Anthony.D.Roberts\hpothb07.dat
2008-10-06 09:03 0 ---ha-w c:\documents and settings\All Users\hpothb07.dat
2006-02-13 16:20 32,064 ----a-w c:\documents and settings\Cav.bal\Application Data\GDIPFONTCACHEV1.DAT
2005-04-26 08:48 57,344 ----a-w c:\program files\internet explorer\plugins\PluginWrapper.dll
2007-04-17 20:42 32,768 --sha-w c:\winnt\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012007041720070418\index.dat
.
c:\winnt\system32\svchost.exe ... Infected -- Win32.Qhost !!


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CatUserRun"="exec32" [X]
"Yahoo! Pager"="c:\program files\Yahoo!\Messenger\YahooMessenger.exe" [2007-03-27 4670968]
"ctfmon.exe"="c:\winnt\system32\ctfmon.exe" [2004-08-04 15360]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2008-09-29 21755688]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HotKeysCmds"="c:\winnt\System32\hkcmd.exe" [2003-01-24 114688]
"RightFAX Print-to-Fax Driver"="c:\program files\RightFax\\FaxCtrl.exe" [2003-07-17 114688]
"Synchronization Manager"="c:\winnt\system32\mobsync.exe" [2004-08-04 143360]
"NeroCheck"="c:\program files\Ahead\\Nero\NeroCheck.exe" [2001-07-09 155648]
"DirXconnect settings"="c:\\PROGRA~1\Sie\DIRXDI~1\dxdSetup.exe" [2000-03-21 106561]
"OfficeScanNT Monitor"="c:\program files\OfficeScan NT\pccntmon.exe" [2007-01-08 356429]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2004-09-07 77824]
"Java Profiles Fix"="c:\program files\Java\Profile Fix\Java_Profile.exe" [2003-04-30 32768]
"JavaProfileFix2"="c:\program files\Java\Profile Fix\Java_Profile_2.exe" [2004-03-04 36864]
"SIECACST"="c:\program files\Sie\Card API\bin\siecacst.exe" [2005-02-01 45056]
"Discovery User Input"="c:\discovery\User Input\userin32.exe" [2005-11-10 212992]
"JavaProfileFix3"="c:\program files\Java\Profile Fix\JAVA_Fix 3.exe" [2005-12-06 53248]
"Migrator"="c:\program files\CryptoEx\Migrator\Migrator.exe" [2004-10-26 290816]
"CryptoExTrayV3"="c:\program files\CryptoEx\Common\CexTray.exe" [2005-03-01 909312]
"SchedulingAgent_nDG"="c:\program files\ManageSoft\Schedule Agent\ndschedag.exe" [2006-07-27 1183744]
"SSBkgdUpdate"="c:\program files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2003-10-14 155648]
"PaperPort PTD"="c:\program files\ScanSoft\PaperPort\pptd40nt.exe" [2005-03-17 57393]
"IndexSearch"="c:\program files\ScanSoft\PaperPort\IndexSearch.exe" [2005-03-17 40960]
"BrMfcWnd"="c:\program files\Brother\Brmfcmon\BrMfcWnd.exe" [2006-03-28 622592]
"SetDefPrt"="c:\program files\Brother\Brmfl06a\BrStDvPt.exe" [2005-01-26 49152]
"ControlCenter3"="c:\program files\Brother\ControlCenter3\brctrcen.exe" [2006-04-10 61440]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0\bin\jusched.exe" [2008-01-09 77824]
"yt8a"="c:\winnt\system32\yt8a.exe" [2008-10-25 68832]

c:\documents and settings\Cav.bal\Start Menu\Programs\Startup\
SpywareGuard.lnk - c:\program files\SpywareGuard\sgmain.exe [2003-08-29 360448]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"disablecad"= 0 (0x0)
"MaxGPOScriptWait"= 1800 (0x708)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"ConnectHomeDirToRoot"= 0 (0x0)
"HideLogonScripts"= 0 (0x0)
"EnableProfileQuota"= 1 (0x1)
"ProfileQuotaMessage"= You have exceeded your profile storage space. Before you can log off, you need to move some items from your profile to network or local storage.
"MaxProfileSize"= 10240 (0x2800)
"WarnUserTimeout"= 15 (0xf)

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoPublishingWizard"= 1 (0x1)
"NoWebServices"= 1 (0x1)
"NoOnlinePrintsWizard"= 1 (0x1)
"NoWelcomeScreen"= 1 (0x1)
"NoMSAppLogo5ChannelNotify"= 1 (0x1)
"NoBandCustomize"= 0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"Btn_Back"= 0 (0x0)
"Btn_Forward"= 0 (0x0)
"Btn_Stop"= 0 (0x0)
"Btn_Refresh"= 0 (0x0)
"Btn_Home"= 0 (0x0)
"Btn_Search"= 0 (0x0)
"Btn_History"= 0 (0x0)
"Btn_Favorites"= 0 (0x0)
"Btn_Media"= 0 (0x0)
"Btn_Folders"= 0 (0x0)
"Btn_Fullscreen"= 0 (0x0)
"Btn_Tools"= 0 (0x0)
"Btn_MailNews"= 0 (0x0)
"Btn_Size"= 0 (0x0)
"Btn_Print"= 0 (0x0)
"Btn_Edit"= 0 (0x0)
"Btn_Discussions"= 0 (0x0)
"Btn_Cut"= 0 (0x0)
"Btn_Copy"= 0 (0x0)
"Btn_Paste"= 0 (0x0)
"Btn_Encoding"= 0 (0x0)
"Btn_PrintPreview"= 0 (0x0)
"NoFavoritesMenu"= 0 (0x0)
"NoLogoff"= 0 (0x0)
"NoDeletePrinter"= 0 (0x0)
"NoAddPrinter"= 0 (0x0)
"NoPrinterTabs"= 0 (0x0)
"PromptRunasInstallNetPath"= 1 (0x1)
"MemCheckBoxInRunDlg"= 1 (0x1)
"DisallowCpl"= 1 (0x1)
"NoThumbnailCache"= 1 (0x1)
"ForceStartMenuLogOff"= 1 (0x1)
"NoResolveSearch"= 1 (0x1)
"NoResolveTrack"= 1 (0x1)
"GreyMSIAds"= 1 (0x1)
"NoRecentDocsNetHood"= 1 (0x1)
"DisablePersonalDirChange"= 1 (0x1)
"NoWelcomeScreen"= 1 (0x1)
"NoAutoUpdate"= 1 (0x1)
"StartRunNoHOMEPATH"= 1 (0x1)
"EnforceShellExtensionSecurity"= 0 (0x0)

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"Btn_Back"= 0 (0x0)
"Btn_Forward"= 0 (0x0)
"Btn_Stop"= 0 (0x0)
"Btn_Refresh"= 0 (0x0)
"Btn_Home"= 0 (0x0)
"Btn_Search"= 0 (0x0)
"Btn_History"= 0 (0x0)
"Btn_Favorites"= 0 (0x0)
"Btn_Media"= 0 (0x0)
"Btn_Folders"= 0 (0x0)
"Btn_Fullscreen"= 0 (0x0)
"Btn_Tools"= 0 (0x0)
"Btn_MailNews"= 0 (0x0)
"Btn_Size"= 0 (0x0)
"Btn_Print"= 0 (0x0)
"Btn_Edit"= 0 (0x0)
"Btn_Discussions"= 0 (0x0)
"Btn_Cut"= 0 (0x0)
"Btn_Copy"= 0 (0x0)
"Btn_Paste"= 0 (0x0)
"Btn_Encoding"= 0 (0x0)
"Btn_PrintPreview"= 0 (0x0)
"NoActiveDesktopChanges"= 0 (0x0)
"NoFavoritesMenu"= 0 (0x0)
"NoSetActiveDesktop"= 0 (0x0)
"NoLogoff"= 0 (0x0)
"NoClose"= 0 (0x0)
"NoSetFolders"= 0 (0x0)
"EnforceShellExtensionSecurity"= 0 (0x0)
"NoDeletePrinter"= 0 (0x0)
"NoAddPrinter"= 0 (0x0)
"NoPrinterTabs"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\policies\microsoft\windows\windowsupdate\au]
"NoAutoUpdate"= 1 (0x1)

[HKEY_CURRENT_USER\software\microsoft\windows nt\currentversion\winlogon]
"Shell"="SGPro.exe /shell"

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\CexTrayWinLogon]
2005-01-26 12:25 57344 c:\program files\CryptoEx\Common\CexTrayWinLogon.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\Machine\Scripts\Shutdown\0\0]
"Script"=CBEShutdown.bat

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\Machine\Scripts\Shutdown\1\0]
"Script"=bnls299acmdline.bat

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\Machine\Scripts\Startup\0\0]
"Script"=catstart.cmd

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\Machine\Scripts\Startup\1\0]
"Script"=\\GB001.Sie.net\sysvol\GB001.Sie.net\scripts\CatPC\CAT Basic Environment\Setup\Setup.bat

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\Machine\Scripts\Startup\2\0]
"Script"=DeployCentennialAgent.cmd

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\Machine\Scripts\Startup\3\0]
"Script"=bnls299acmdline.bat

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1960408961-725345543-468838394-1152\Scripts\Logoff\0\0]
"Script"=CBELogoff.bat

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1960408961-725345543-468838394-31563\Scripts\Logoff\0\0]
"Script"=CBELogoff.bat

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1960408961-725345543-468838394-34625\Scripts\Logoff\0\0]
"Script"=CBELogoff.bat

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-450047656-3918250416-1063027673-500\Scripts\Logoff\0\0]
"Script"=CBELogoff.bat

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINNT\\system32\\yt8a.exe"=


*Newly Created Service* - MACROMEDIA_LICENSING_SERVICE
*Newly Created Service* - NTRTSCAN
.
- - - - ORPHANS REMOVED - - - -

HKCU-Run-MsnMsgr - c:\program files\MSN Messenger\MsnMsgr.Exe


.
------- Supplementary Scan -------
.
FireFox -: Profile - c:\documents and settings\Cav.bal\Application Data\Mozilla\Firefox\Profiles\r3vgz5qw.default\
FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.google.com/
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-11-13 12:44:00
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...


c:\documents and settings\Cav.bal\Application Data\skypePM\2008-11-09-1.ezlog 62712 bytes
c:\documents and settings\Cav.bal\Application Data\skypePM\2008-11-10-2.ezlog 39080 bytes
c:\documents and settings\Cav.bal\Application Data\skypePM\2008-11-11-0.ezlog 8896 bytes
c:\documents and settings\Cav.bal\Application Data\skypePM\2008-11-11-1.ezlog 8896 bytes

scan completed successfully
hidden files: 4

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\msftesql]
"ImagePath"="\"c:\program files\Microsoft SQL Server\MSSQL.2\MSSQL\Binn\msftesql.exe\" -s:MSSQL.2 -f:MSSQLSERVER"
.
------------------------ Other Running Processes ------------------------
.
c:\winnt\system32\scardsvr.exe
c:\program files\Sie\CAT Bulletin Board\CBBS.exe
c:\window\svchost.exe
c:\program files\Common Files\Microsoft Shared\VS7Debug\MDM.EXE
c:\program files\ManageSoft\Launcher\mgsdl.exe
c:\winnt\system32\mnmsrvc.exe
c:\program files\ManageSoft\Launcher\ndserv.exe
c:\winnt\system32\rundll32.exe
c:\program files\ManageSoft\Schedule Agent\ndinit.exe
c:\program files\openft\bin\secserv.exe
c:\program files\OfficeScan NT\tmlisten.exe
c:\program files\ManageSoft\Schedule Agent\ndtask.exe
c:\program files\openft\bin\neactrls.exe
c:\winnt\TEMP\JEFAEB.EXE
c:\program files\Sie\CAT Bulletin Board\CBB.exe
c:\program files\RightFax\FaxCtrl.exe
c:\program files\CryptoEx\Common\EASServer.exe
c:\program files\ManageSoft\Schedule Agent\ndtask.exe
c:\program files\OfficeScan NT\POP3Trap.exe
c:\program files\SpywareGuard\sgbhp.exe
c:\winnt\system32\taskmgr.exe
c:\program files\OfficeScan NT\ntrtscan.exe
.
**************************************************************************
.
Completion time: 2008-11-13 13:00:50 - machine was rebooted
ComboFix-quarantined-files.txt 2008-11-13 13:00:39

Pre-Run: 4,182,388,736 bytes free
Post-Run: 5,090,881,536 bytes free

313





Thanks,
jmash
jmash is offline