HI;
Unsuccessfull submission of file. I dragged CFScript.txt to the ComboFix icon but wasn't prompted to update it. It may have updated ok but it didn't launch itself, so i ran it myself. I was not prompted that any file was captured or to be sent for analysis.
I got two warning windows from the 'Registry Editor' saying "Cannot export Aati8fkxx.sys" and "Cannot Export Bati8fkxx.sys". Then my PC crashed.
Steganos is a security suite for incription and trace destruction but I deleted it all before doing anything else. I followed all of your directions and didn't do anything we havn't talked about.
I rebooted my PC to retrieve the log file prduced from ComboFix this time which was as follows:
ComboFix 08-11-11.01 - User 2008-11-13 14:43:08.2 - NTFSx86
Running from: c:\documents and settings\User\Desktop\ComboFix.exe
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
F:\autorun.inf
.
((((((((((((((((((((((((( Files Created from 2008-10-13 to 2008-11-13 )))))))))))))))))))))))))))))))
.
2008-11-13 14:37 . 2008-11-13 14:36 388,608 --a------ c:\windows\system32\CF22326.exe.vir
2008-11-06 10:13 . 2008-11-06 10:13 <DIR> d-------- C:\rsit
2008-11-06 10:13 . 2008-11-06 10:13 <DIR> d-------- c:\program files\trend micro
2008-11-06 09:13 . 2008-11-06 09:28 250 --a------ c:\windows\gmer.ini
2008-11-03 15:51 . 2008-11-10 15:31 <DIR> d--h----- C:\$AVG8.VAULT$
2008-11-03 14:45 . 2008-11-03 14:45 97,928 --a------ c:\windows\system32\drivers\avgldx86.sys
2008-11-03 14:45 . 2008-11-03 14:45 76,040 --a------ c:\windows\system32\drivers\avgtdix.sys
2008-11-03 14:45 . 2008-11-03 14:45 10,520 --a------ c:\windows\system32\avgrsstx.dll
2008-11-03 14:44 . 2008-11-03 14:44 <DIR> d-------- c:\windows\system32\drivers\Avg
2008-10-29 13:21 . 2008-10-29 13:21 <DIR> d-------- c:\program files\Common Files\Adobe AIR
2008-10-29 11:53 . 2008-10-30 08:30 <DIR> d-------- c:\program files\NOS
2008-10-29 11:53 . 2008-10-30 08:30 <DIR> d-------- c:\documents and settings\All Users\Application Data\NOS
2008-10-23 13:23 . 2008-10-23 13:23 <DIR> d-------- c:\documents and settings\User\Application Data\Malwarebytes
2008-10-23 13:22 . 2008-10-23 13:22 <DIR> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes
2008-10-23 12:08 . 2008-10-23 12:08 19,463 --a------ c:\windows\enujuf.dll
2008-10-23 12:08 . 2008-10-23 12:08 16,139 --a------ c:\windows\system32\janoh.dl
2008-10-23 12:08 . 2008-10-23 12:08 13,357 --a------ c:\windows\yqobakicuw.com
2008-10-23 12:08 . 2008-10-23 12:08 13,331 --a------ c:\documents and settings\All Users\Application Data\arabutoc.bin
2008-10-23 12:08 . 2008-10-23 12:08 12,693 --a------ c:\program files\Common Files\jogikot.dat
2008-10-23 12:08 . 2008-10-23 12:08 10,570 --a------ c:\windows\system32\afyxatibov.com
2008-10-23 11:24 . 2008-10-23 11:24 <DIR> d-a------ c:\documents and settings\All Users\Application Data\TEMP
2008-10-23 08:49 . 2008-10-23 08:49 <DIR> d-------- c:\program files\AVG
2008-10-23 08:49 . 2008-11-03 14:43 <DIR> d-------- c:\documents and settings\All Users\Application Data\avg8
2008-10-22 10:07 . 2008-10-22 10:07 0 --a------ c:\windows\SPYXX.INI
2008-10-22 08:39 . 2008-10-22 08:39 19,362 --a------ c:\program files\Common Files\norydo.scr
2008-10-22 08:39 . 2008-10-22 08:39 19,323 --a------ c:\windows\nemygih.ban
2008-10-22 08:39 . 2008-10-22 08:39 18,074 --a------ c:\program files\Common Files\pilopirowo.exe
2008-10-22 08:39 . 2008-10-22 08:39 17,291 --a------ c:\windows\kazewe.dat
2008-10-22 08:39 . 2008-10-22 08:39 16,478 --a------ c:\windows\system32\icilaw._dl
2008-10-22 08:39 . 2008-10-22 08:39 15,079 --a------ c:\windows\darany.sys
2008-10-22 08:39 . 2008-10-22 08:39 14,340 --a------ c:\windows\qocepy.exe
2008-10-22 08:13 . 2008-11-13 09:09 32,512 --a------ c:\windows\system32\drivers\ati8fkxx.sys
2008-10-14 14:24 . 2008-10-14 14:24 <DIR> d-------- c:\documents and settings\User\Application Data\Yahoo!
2008-10-14 14:24 . 2008-10-14 14:24 <DIR> d-------- c:\documents and settings\All Users\Application Data\Yahoo! Companion
2008-10-14 14:21 . 2008-10-14 14:22 <DIR> d-------- c:\program files\Yahoo!
2008-10-14 14:19 . 2008-10-14 14:23 <DIR> d-------- c:\program files\jZip
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-11-13 14:27 --------- d-----w c:\program files\BOINC
2008-11-13 14:18 --------- d-----w c:\program files\Common Files\Wise Installation Wizard
2008-11-13 14:15 --------- d--h--w c:\program files\InstallShield Installation Information
2008-11-13 14:15 --------- d-----w c:\program files\Common Files\IXLA Limited
2008-11-13 14:12 --------- d-----w c:\program files\SureThing
2008-11-13 14:11 --------- d-----w c:\program files\Common Files\SureThing Shared
2008-11-13 09:10 14,336 ----a-w c:\windows\system32\svchost.exe
2008-11-13 09:10 14,336 ----a-w c:\windows\system32\dllcache\svchost.exe
2008-11-03 12:28 --------- d-----w c:\documents and settings\User\Application Data\wsInspector
2008-10-29 13:00 --------- d-----w c:\program files\Common Files\Adobe
2008-10-23 12:08 18,480 ----a-w c:\program files\Common Files\usacyw.db
2008-09-28 10:13 591,296 ----a-w C:\WebmailPlugin.dll
2002-11-18 05:26 61,440 ------w c:\windows\inf\i386\onetUSD.dll
2002-10-24 07:29 36,864 ------w c:\windows\inf\i386\Vizmicro.dll
2002-10-24 07:28 172,032 ------w c:\windows\inf\i386\viceo.dll
2002-10-24 07:02 225,280 ------w c:\windows\inf\i386\rtscan.dll
2001-08-03 17:29 13,824 ------w c:\windows\inf\i386\Usbscan.sys
2008-04-10 17:55 2,396,160 ----a-w c:\program files\mozilla firefox\plugins\fluxcore.dll
2007-10-10 18:02 36,864 ----a-w c:\program files\mozilla firefox\plugins\fluxcryp.dll
2008-04-10 17:55 360,448 ----a-w c:\program files\mozilla firefox\plugins\fluxdx8.dll
2008-04-10 17:55 413,696 ----a-w c:\program files\mozilla firefox\plugins\fluxdx9.dll
2008-04-10 17:55 314,880 ----a-w c:\program files\mozilla firefox\plugins\FluxIM.dll
2007-10-24 17:16 53,760 ----a-w c:\program files\mozilla firefox\plugins\HawkNL.dll
2007-12-11 09:39 479,232 ----a-w c:\program files\mozilla firefox\plugins\libavcodec.dll
.
((((((((((((((((((((((((((((( snapshot@2008-11-13_10.26.52.25 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-11-04 08:49:08 407,104 ----a-w c:\windows\system32\FNTCACHE.DAT
+ 2008-11-13 14:20:13 406,304 ----a-w c:\windows\system32\FNTCACHE.DAT
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"zBrowser Launcher"="c:\program files\Logitech\iTouch\iTouch.exe" [2004-03-18 892928]
"EM_EXEC"="c:\progra~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE" [2002-05-24 28672]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2008-11-03 1234712]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2004-08-04 15360]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-03-13 39264]
c:\documents and settings\All Users\Start Menu\Programs\Startup\
BOINC Manager.lnk - c:\program files\BOINC\boincmgr.exe [2005-03-08 1150976]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"ForceClassicControlPanel"= 1 (0x1)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=karna.dat??,avgrsstx.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.rtmp"= Roxio_DivX.dll
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LDM]
--a------ 2003-08-18 11:05 16384 c:\program files\Logitech\Desktop Messenger\8876480\Program\backWeb-8876480.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"AntiVirusOverride"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\PandaAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\PandaFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\system32\\usmt\\migwiz.exe"=
"c:\\Perl\\EngInSite Perl Editor\\perle.exe"=
"c:\\WINDOWS\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Perl\\bin\\perl.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Stylus Studio 2007 XML Home Edition Release 2\\bin\\Struzzo.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Opera\\Opera.exe"=
"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\SmartFTP Client\\SmartFTP.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgemc.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"c:\\Program Files\\BOINC\\boinc.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"80:TCP"= 80:TCP:*:Disabled:@xpsp2res.dll,-22004
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44AE4113-C121-10CC-1F32-A0BC12E2014D}]
c:\windows\system32\msapplg.exe
.
Contents of the 'Scheduled Tasks' folder
2008-09-10 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 14:57]
2008-11-13 c:\windows\Tasks\Symantec NetDetect.job
- c:\program files\Symantec\LiveUpdate\NDETECT.EXE []
2008-11-06 c:\windows\Tasks\Update Dynamic D.N.S.job
- c:\progra~1\No-IP\DUC20.exe [2005-05-11 15:33]
.
- - - - ORPHANS REMOVED - - - -
HKU-Default-Run-SSS5 - c:\program files\Steganos Security Suite 5\steganos5.exe
HKU-Default-Run-SSS5SAFE - c:\program files\Steganos Security Suite 5\safe.exe
HKU-Default-Run-SSS5SPM - c:\program files\Steganos Security Suite 5\spm.exe
SafeBoot-ati8fkxx.sys
.
------- Supplementary Scan -------
.
FireFox -: Profile - c:\documents and settings\User\Application Data\Mozilla\Firefox\Profiles\
0g35jg5f.default\
FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.airproducts.com/apdirect/
FF -: plugin - c:\program files\DivX\DivX Content Uploader\npUpload.dll
FF -: plugin - c:\program files\Mozilla Firefox\plugins\NPTURNMED.dll
FF -: plugin - c:\program files\Mozilla Firefox\plugins\npvideoegg-loader.dll
FF -: plugin - c:\program files\Mozilla Firefox\plugins\npvideoegg-publisherloader.dll
FF -: plugin - c:\program files\Mozilla Firefox\plugins\npvideoegg-updaterloader.dll
FF -: plugin - c:\program files\VideoEgg\Loader\2364\npvideoegg-loader.dll
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.net
Rootkit scan 2008-11-13 14:59:57
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2008-11-13 15:23:59
ComboFix-quarantined-files.txt 2008-11-13 15:23:50
ComboFix2.txt 2008-11-13 10:31:02
Pre-Run: 13,234,507,776 bytes free
Post-Run: 13,219,569,664 bytes free
174 --- E O F --- 2007-07-11 08:16:16
Then I ran HijackThis which produced the following log:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:43:00, on 13/11/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Apache Software Foundation\Apache2.2\bin\httpd.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Apache Software Foundation\Apache2.2\bin\httpd.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\Program Files\Logitech\iTouch\iTouch.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\system32\ctfmon.exe
c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\Program Files\BOINC\boincmgr.exe
C:\Program Files\BOINC\boinc.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\User\Desktop\HiJackThis.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe (file missing)
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
--
End of file - 1693 bytes
I had AVG antivirus switched off but i think it may have quarenteend the missing files or something??
HELP;
Eoghan