|
|
|
|
|||||
|
|
|
|
|
|
|||
| Welcome
to Tech Support Forum home to more then 136,000 problems solved. Issues
have included: Spyware, Malware, Virus Issues, Windows, Microsoft,
Linux, Networking, Security, Hardware, and Gaming Getting your
problem solved is as easy as: 1. Registering for a free account 2. Asking your question 3. Receiving an answer Registered members: * See fewer ads. * And much more..
|
| Want to know how to post a question? click here | Having problems with spyware and pop-ups? First Steps |
|
|||||||
| HijackThis Log Help Get Rid Of Malware With Help From Our Analysts. Follow the "First Steps" link at the top right of each page before posting for help. |
 |
|
|
Thread Tools |
08-09-2007, 09:33 AM
|
#1 (permalink) |
|
Registered User
Join Date: Aug 2007
Posts: 22
OS: WIN XP
|
Trojan.PSW.QQPass.b
I have contracted a Trojan virus from my travels in Asia. My friend suggested that I post on this forum to get some help! The most noticeable thing that this Trojan virus does is it changes the date and time settings! It is also known that it is a password seeking virus. The other friends who have travelled to Asia with me have also gotten the virus and we would like to stop it as soon as possible. I have included the log file below.
Logfile of HijackThis v1.99.1 Scan saved at 11:39:20 PM, on 08/08/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Intel\Wireless\Bin\EvtEng.exe C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe C:\Program Files\Intel\Wireless\Bin\ZcfgSvc.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe C:\WINDOWS\system32\spoolsv.exe C:\PROGRA~1\Intel\Wireless\Bin\1XConfig.exe C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe C:\Program Files\Symantec AntiVirus\DefWatch.exe C:\Program Files\Intel\Wireless\Bin\OProtSvc.exe C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Symantec AntiVirus\Rtvscan.exe C:\WINDOWS\ATK0100\HControl.exe C:\WINDOWS\system32\igfxtray.exe C:\WINDOWS\system32\hkcmd.exe C:\WINDOWS\system32\igfxpers.exe C:\Program Files\ASUS\ASUS Live Update\ALU.exe C:\Program Files\ASUS\Wireless Console\wcourier.exe C:\Program Files\Synaptics\SynTP\SynTPLpr.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\WINDOWS\SOUNDMAN.EXE C:\WINDOWS\ALCMTR.EXE C:\Program Files\ASUS\Power4 Gear\BatteryLife.exe C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe C:\Program Files\Intel\Wireless\Bin\EOUWiz.exe C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe C:\WINDOWS\system32\tdvwate.exe C:\WINDOWS\system32\aishiph.exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\PROGRA~1\SYMANT~1\VPTray.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\MSN Messenger\MsnMsgr.Exe C:\Program Files\Rainlendar2\Rainlendar2.exe C:\Program Files\SetPoint\SetPoint.exe C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng1.exe C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe C:\WINDOWS\ATK0100\ATKOSD.exe C:\Program Files\Common Files\Logitech\KHAL\KHALMNPR.EXE C:\Program Files\Mozilla Firefox\firefox.exe C:\WINDOWS\system32\igfxsrvc.exe C:\Program Files\Microsoft Office\Office12\WINWORD.EXE C:\Program Files\Adobe\Acrobat 6.0\Acrobat\Acrobat.exe C:\WINDOWS\system32\WISPTIS.EXE C:\WINDOWS\system32\conime.exe C:\Program Files\Help\HelpMe.exe O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O4 - HKLM\..\Run: [HControl] C:\WINDOWS\ATK0100\HControl.exe O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe O4 - HKLM\..\Run: [ASUS Live Update] C:\Program Files\ASUS\ASUS Live Update\ALU.exe O4 - HKLM\..\Run: [Wireless Console] C:\Program Files\ASUS\Wireless Console\wcourier.exe O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE O4 - HKLM\..\Run: [Power_Gear] C:\Program Files\ASUS\Power4 Gear\BatteryLife.exe 1 O4 - HKLM\..\Run: [IntelWireless] C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe /tf Intel PROSet/Wireless O4 - HKLM\..\Run: [EOUApp] C:\Program Files\Intel\Wireless\Bin\EOUWiz.exe O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32 O4 - HKLM\..\Run: [IMEKRMIG6.1] C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [lvhkflo] C:\WINDOWS\system32\tdvwate.exe O4 - HKLM\..\Run: [oblipto] C:\WINDOWS\system32\aishiph.exe O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Enterprise O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background O4 - HKCU\..\Run: [Rainlendar2] C:\Program Files\Rainlendar2\Rainlendar2.exe O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Startup: OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\SetPoint\SetPoint.exe O4 - Global Startup: Bluetooth Manager.lnk = ? O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O9 - Extra button: FirstClass? - {02011FE3-C22B-451d-9A25-BF4DBB38B8E7} - C:\WINDOWS\Downloaded Program Files\fcplugin.dll O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O14 - IERESET.INF: START_PAGE_URL=http://www.asus.com O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/...toUploader.cab O16 - DPF: {9C196458-4145-46AF-8A77-1506878DFECA} (FirstClass?Control) - http://fcis.oise.utoronto.ca/ClientD...s/fcplugin.cab O18 - Protocol: fcp - {B3133379-8789-4D3C-9593-C205D7297501} - C:\WINDOWS\Downloaded Program Files\fcplugin.dll O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll O20 - Winlogon Notify: IntelWireless - C:\Program Files\Intel\Wireless\Bin\LgNotify.dll O20 - Winlogon Notify: NavLogon - C:\WINDOWS\system32\NavLogon.dll O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Unknown owner - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe (file missing) O23 - Service: OwnershipProtocol - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\OProtSvc.exe O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe |
|
     
|
|
08-09-2007, 11:54 PM
|
#2 (permalink) |
|
Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy
Join Date: May 2005
Posts: 20,794
OS: XP
|
Re: Trojan.PSW.QQPass.b
Do a HijackThis scan & place a check next to these items and select "Fix checked":
O4 - HKLM\..\Run: [lvhkflo] C:\WINDOWS\system32\tdvwate.exe O4 - HKLM\..\Run: [oblipto] C:\WINDOWS\system32\aishiph.exe --------------- 1. Download this file - http://download.bleepingcomputer.com...a/ComboFix.exe * IMPORTANT !!! Place combofix.exe on your Desktop  2. Go to  → Run → paste in the single line command & click OK"%userprofile%\desktop\combofix.exe" /killall3. When finished, it shall produce a log for you. Post that log & a fresh HJT log in your next reply Note: Do not mouseclick combofix's window whilst it's running. That may cause it to stall |
|
|
|
|
08-26-2007, 10:35 PM
|
#3 (permalink) |
|
Registered User
Join Date: Aug 2007
Posts: 22
OS: WIN XP
|
Re: Trojan.PSW.QQPass.b
ComboFix 07-08-26.3 - "Melody Li" 2007-08-27 3:30:26.1 - FAT32x86
Microsoft Windows XP Professional 5.1.2600.2.950.886.1033.18.15 [GMT -4:00] ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) C:\WINDOWS\system32\msconfig.dll D:\Autorun.inf ((((((((((((((((((((((((( Files Created from 2007-07-27 to 2007-08-27 ))))))))))))))))))))))))))))))) 2007-08-27 03:33 <DIR> d-------- C:\WINDOWS\LastGood.Tmp 2007-08-27 03:27 <DIR> d--hs---- C:\FOUND.002 2007-08-27 03:24 51,200 --a------ C:\WINDOWS\nircmd.exe 2007-08-17 07:52 <DIR> d-------- C:\Program Files\ParaUSB 2007-08-17 07:52 <DIR> d-------- C:\Program Files\MFLPRO 2007-08-13 18:07 <DIR> d--hs---- C:\FOUND.001 2007-08-13 13:56 2,560 --------- C:\WINDOWS\system32\drivers\cdralw2k.sys 2007-08-13 13:56 2,432 --------- C:\WINDOWS\system32\drivers\cdr4_xp.sys 2007-08-13 13:53 <DIR> d-------- C:\Program Files\Picasa2 2007-08-13 13:53 <DIR> d-------- C:\Program Files\Google 2007-08-12 07:38 25,856 --a------ C:\WINDOWS\system32\drivers\usbprint.sys 2007-08-12 07:38 25,856 --a------ C:\WINDOWS\system32\dllcache\usbprint.sys 2007-08-10 14:20 <DIR> d-------- C:\WINDOWS\system32\LogFiles 2007-08-08 23:14 <DIR> d-------- C:\Program Files\Help 2007-08-08 10:45 1,277 --a------ C:\WINDOWS\mozver.dat 2007-08-03 13:12 <DIR> d-------- C:\Program Files\Symantec AntiVirus 2007-08-03 11:41 42,496 --a------ C:\WINDOWS\system32\sexit.dat 2007-08-03 11:22 <DIR> d-------- C:\Program Files\SymNetDrv 2007-08-03 11:02 24,461 ---hs---- C:\WINDOWS\system32\tdvwate.exe 2007-08-03 11:02 24,461 ---hs---- C:\WINDOWS\system32\aishiph.exe 2007-08-01 14:56 <DIR> d-------- C:\Program Files\FirstClass 2007-08-01 12:11 <DIR> d--hs---- C:\FOUND.000 2007-07-30 09:21 <DIR> d-------- C:\DOCUME~1\MELODY~1\APPLIC~1\Inspiration Software 2007-07-27 23:27 <DIR> d-------- C:\WINDOWS\speech 2007-07-27 23:26 <DIR> d-------- C:\Program Files\Inspiration 8 IE (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-08-27 03:36 24576 --a------ C:\WINDOWS\system32\MSCONFIG.DLL 2007-07-30 19:19 92504 --a------ C:\WINDOWS\system32\dllcache\cdm.dll 2007-07-30 19:19 92504 --a------ C:\WINDOWS\system32\cdm.dll 2007-07-30 19:19 549720 --a------ C:\WINDOWS\system32\wuapi.dll 2007-07-30 19:19 549720 --a------ C:\WINDOWS\system32\dllcache\wuapi.dll 2007-07-30 19:19 53080 --a------ C:\WINDOWS\system32\wuauclt.exe 2007-07-30 19:19 53080 --a------ C:\WINDOWS\system32\dllcache\wuauclt.exe 2007-07-30 19:19 325976 --a------ C:\WINDOWS\system32\wucltui.dll 2007-07-30 19:19 325976 --a------ C:\WINDOWS\system32\dllcache\wucltui.dll 2007-07-30 19:19 203096 --a------ C:\WINDOWS\system32\wuweb.dll 2007-07-30 19:19 203096 --a------ C:\WINDOWS\system32\dllcache\wuweb.dll 2007-07-30 19:19 1712984 --a------ C:\WINDOWS\system32\wuaueng.dll 2007-07-30 19:19 1712984 --a------ C:\WINDOWS\system32\dllcache\wuaueng.dll 2007-07-24 14:36 --------- d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\FirstClass 2007-07-17 14:38 --------- d-------- C:\Program Files\MSXML 4.0 2007-07-17 14:14 --------- d-------- C:\Program Files\Rainlendar2 2007-07-17 11:39 --------- d-------- C:\DOCUME~1\MELODY~1\APPLIC~1\AdobeUM 2007-07-17 09:49 --------- d-------- C:\DOCUME~1\MELODY~1\APPLIC~1\Opera 2007-07-17 00:50 --------- d-------- C:\Program Files\MSN Messenger 2007-07-17 00:47 --------- d-------- C:\DOCUME~1\MELODY~1\APPLIC~1\Talkback 2007-07-16 21:07 --------- d-------- C:\Program Files\DivX 2007-07-16 21:07 --------- d-------- C:\Program Files\DefilerPak 2007-07-16 21:03 --------- d-------- C:\Program Files\Common Files\Ahead 2007-07-16 21:03 --------- d-------- C:\Program Files\Ahead 2007-07-16 20:55 --------- d-------- C:\Program Files\Common Files\Adobe Systems Shared 2007-07-16 20:55 --------- d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Adobe Systems 2007-07-12 22:15 --------- d-------- C:\Program Files\Microsoft Works 2007-07-12 22:09 --------- d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft Help 2007-06-04 23:17 24461 ---hs---- C:\WINDOWS\system32\meex.com ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "HControl"="C:\WINDOWS\ATK0100\HControl.exe" [2005-05-12 00:15] "IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2005-06-07 20:02] "HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2005-06-07 19:59] "Persistence"="C:\WINDOWS\system32\igfxpers.exe" [2005-06-07 20:03] "ASUS Live Update"="C:\Program Files\ASUS\ASUS Live Update\ALU.exe" [2003-09-19 12:54] "Wireless Console"="C:\Program Files\ASUS\Wireless Console\wcourier.exe" [2005-06-20 19:16] "Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" [2005-05-20 14:46 C:\WINDOWS\KHALMNPR.Exe] "SynTPLpr"="C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [2004-12-21 23:23] "SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2004-12-21 23:23] "SoundMan"="SOUNDMAN.EXE" [2005-01-05 00:40 C:\WINDOWS\SoundMan.exe] "AlcWzrd"="ALCWZRD.EXE" [2005-01-05 00:02 C:\WINDOWS\ALCWZRD.EXE] "Power_Gear"="C:\Program Files\ASUS\Power4 Gear\BatteryLife.exe" [2004-09-21 16:55] "IntelWireless"="C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" [2004-10-15 11:27] "EOUApp"="C:\Program Files\Intel\Wireless\Bin\EOUWiz.exe" [2004-10-15 11:31] "GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 00:47] "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50] "IMJPMIG8.1"="C:\WINDOWS\IME\imjp8_1\IMJPMIG.exe" [2004-08-04 20:00] "IMEKRMIG6.1"="C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE" [2004-08-04 20:00] "MSPY2002"="C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-04 20:00] "PHIME2002ASync"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-04 20:00] "PHIME2002A"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-04 20:00] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 03:06] "Symantec NetDriver Monitor"="C:\PROGRA~1\SYMNET~1\SNDMon.exe" [2007-08-03 13:14] "ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2006-07-19 19:26] "vptray"="C:\PROGRA~1\SYMANT~1\VPTray.exe" [2006-09-27 20:33] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 04:00] "Picasa Media Detector"="C:\Program Files\Picasa2\PicasaMediaDetector.exe" [2007-06-15 19:15] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 20:00] "MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-01-19 12:54] "Rainlendar2"="C:\Program Files\Rainlendar2\Rainlendar2.exe" [2007-04-15 02:31] C:\DOCUME~1\MELODY~1\STARTM~1\PROGRAMS\STARTUP\ Adobe Gamma.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-03-16 19:16:50] OneNote 2007 Screen Clipper and Launcher.lnk - C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE [2006-10-26 20:24:54] OFFICE 翑忒.EXE [2007-08-21 05:57:34] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\IntelWireless] C:\Program Files\Intel\Wireless\Bin\LgNotify.dll 2004-10-15 11:27 110592 C:\Program Files\Intel\Wireless\Bin\LgNotify.dll SafeBoot registry key needs repairs. This machine cannot enter Safe Mode. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E967-E325-11CE-BFC1-08002BE10318}] @="DiskDrive" R0 risdptsk;risdptsk;C:\WINDOWS\system32\DRIVERS\risdptsk.sys R3 Cam5603D;ASUS Mobile Vision Camera W5-A01;C:\WINDOWS\system32\Drivers\BisonCam.sys S3 L8042mou;Logitech SetPoint PS/2 Mouse Filter Driver;C:\WINDOWS\system32\DRIVERS\L8042mou.Sys [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{41d12cda-3b86-11dc-8a65-0013d4d3a316}] AutoRun\command- F:\oblipto.exe explore\Command- F:\oblipto.exe open\Command- F:\oblipto.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{7b2fcd4e-50b0-11dc-8aa0-0013d4d3a316}] AutoRun\command- F:\oblipto.exe explore\Command- F:\oblipto.exe open\Command- F:\oblipto.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d8bcb9ee-34dc-11dc-8a4e-0013d4d3a316}] AutoRun\command- G:\oblipto.exe explore\Command- G:\oblipto.exe open\Command- G:\oblipto.exe ************************************************************************** catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-08-27 03:36:36 Windows 5.1.2600 Service Pack 2 FAT NTAPI scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** Completion time: 2007-08-27 3:38:08 - machine was rebooted C:\ComboFix-quarantined-files.txt ... 2007-08-27 03:38 --- E O F --- HJT Logfile Logfile of HijackThis v1.99.1 Scan saved at 3:41:48 AM, on 27/08/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Intel\Wireless\Bin\EvtEng.exe C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe C:\Program Files\Intel\Wireless\Bin\ZcfgSvc.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe C:\WINDOWS\system32\conime.exe C:\WINDOWS\system32\spoolsv.exe C:\PROGRA~1\Intel\Wireless\Bin\1XConfig.exe C:\WINDOWS\ATK0100\HControl.exe C:\WINDOWS\system32\igfxtray.exe C:\WINDOWS\system32\hkcmd.exe C:\WINDOWS\system32\igfxpers.exe C:\Program Files\ASUS\ASUS Live Update\ALU.exe C:\Program Files\ASUS\Wireless Console\wcourier.exe C:\Program Files\Synaptics\SynTP\SynTPLpr.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\WINDOWS\SOUNDMAN.EXE C:\Program Files\ASUS\Power4 Gear\BatteryLife.exe C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe C:\Program Files\Intel\Wireless\Bin\EOUWiz.exe C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\PROGRA~1\SYMANT~1\VPTray.exe C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe C:\Program Files\Picasa2\PicasaMediaDetector.exe C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\MSN Messenger\MsnMsgr.Exe C:\Program Files\Rainlendar2\Rainlendar2.exe C:\Program Files\SetPoint\SetPoint.exe C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng1.exe C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe C:\WINDOWS\ATK0100\ATKOSD.exe C:\Program Files\Common Files\Logitech\KHAL\KHALMNPR.EXE C:\Program Files\Symantec AntiVirus\DefWatch.exe C:\Program Files\Intel\Wireless\Bin\OProtSvc.exe C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Symantec AntiVirus\Rtvscan.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\system32\notepad.exe C:\WINDOWS\system32\wscntfy.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Help\HelpMe.exe O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O4 - HKLM\..\Run: [HControl] C:\WINDOWS\ATK0100\HControl.exe O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe O4 - HKLM\..\Run: [ASUS Live Update] C:\Program Files\ASUS\ASUS Live Update\ALU.exe O4 - HKLM\..\Run: [Wireless Console] C:\Program Files\ASUS\Wireless Console\wcourier.exe O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE O4 - HKLM\..\Run: [Power_Gear] C:\Program Files\ASUS\Power4 Gear\BatteryLife.exe 1 O4 - HKLM\..\Run: [IntelWireless] C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe /tf Intel PROSet/Wireless O4 - HKLM\..\Run: [EOUApp] C:\Program Files\Intel\Wireless\Bin\EOUWiz.exe O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32 O4 - HKLM\..\Run: [IMEKRMIG6.1] C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Enterprise O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" O4 - HKLM\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background O4 - HKCU\..\Run: [Rainlendar2] C:\Program Files\Rainlendar2\Rainlendar2.exe O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Startup: OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE O4 - Startup: OFFICE 翑忒.EXE O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\SetPoint\SetPoint.exe O4 - Global Startup: Bluetooth Manager.lnk = ? O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O9 - Extra button: FirstClass? - {02011FE3-C22B-451d-9A25-BF4DBB38B8E7} - C:\WINDOWS\Downloaded Program Files\fcplugin.dll O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O14 - IERESET.INF: START_PAGE_URL=http://www.asus.com O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/...toUploader.cab O16 - DPF: {9C196458-4145-46AF-8A77-1506878DFECA} (FirstClass?Control) - http://fcis.oise.utoronto.ca/ClientD...s/fcplugin.cab O18 - Protocol: fcp - {B3133379-8789-4D3C-9593-C205D7297501} - C:\WINDOWS\Downloaded Program Files\fcplugin.dll O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll O20 - Winlogon Notify: IntelWireless - C:\Program Files\Intel\Wireless\Bin\LgNotify.dll O20 - Winlogon Notify: NavLogon - C:\WINDOWS\system32\NavLogon.dll O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Unknown owner - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe (file missing) O23 - Service: OwnershipProtocol - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\OProtSvc.exe O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe |
|
|
|
|
08-27-2007, 12:08 AM
|
#4 (permalink) |
|
Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy
Join Date: May 2005
Posts: 20,794
OS: XP
|
Re: Trojan.PSW.QQPass.b
Do a HijackThis scan & place a check next to these items and select "Fix checked":
O4 - Startup: OFFICE ??.EXE --------------- Open notepad and copy/paste the text in the quotebox below into it: Code:
http://www.techsupportforum.com/security-center/hijackthis-log-help/173176-trojan-psw-qqpass-b.html#post1022459
Collect::
C:\WINDOWS\system32\sexit.dat
C:\WINDOWS\system32\tdvwate.exe
C:\WINDOWS\system32\aishiph.exe
C:\WINDOWS\system32\MSCONFIG.DLL
C:\WINDOWS\system32\meex.com
F:\oblipto.exe
G:\oblipto.exe
Suspect::
C:\Program Files\Help\HelpMe.exe
DirLook::
C:\Program Files\Help
Registry::
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E967-E325-11CE-BFC1-08002BE10318}]
@="DiskDrive"
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{41d12cda-3b86-11dc-8a65-0013d4d3a316}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{7b2fcd4e-50b0-11dc-8aa0-0013d4d3a316}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d8bcb9ee-34dc-11dc-8a4e-0013d4d3a316}]
 Refering to the picture above, drag CFScript.txt into ComboFix.exe When finished, it shall produce a log for you, C:\ComboFix.txt. Post that log in your next reply. Additonally, ComboFix will generate a zipped file on your Desktop, called Submit [Date Time].zip Please submit this file before proceeding to the next step. --------------- Click here perform an online scan >> Online Scanner --------------- In your next post, please include fresh logs from:
|
|
|
|
|
08-27-2007, 04:39 PM
|
#5 (permalink) |
|
Registered User
Join Date: Aug 2007
Posts: 22
OS: WIN XP
|
Re: Trojan.PSW.QQPass.b
Other than a lot of rebooting and shutting down on it's own. The computer seems to be operating like normal. It has been like this since my Symantec antivirus quarantined the file and partially dealt with the 33[1].exe file.
1. Fresh HijackThis logfile. A- {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O14 - IERESET.INF: START_PAGE_URL=http://www.asus.com O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english...an_unicode.cab O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/...toUploader.cab O16 - DPF: {9C196458-4145-46AF-8A77-1506878DFECA} (FirstClass?Control) - http://fcis.oise.utoronto.ca/ClientD...s/fcplugin.cab O18 - Protocol: fcp - {B3133379-8789-4D3C-9593-C205D7297501} - C:\WINDOWS\Downloaded Program Files\fcplugin.dll O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll O20 - Winlogon Notify: IntelWireless - C:\Program Files\Intel\Wireless\Bin\LgNotify.dll O20 - Winlogon Notify: NavLogon - C:\WINDOWS\system32\NavLogon.dll O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Unknown owner - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe (file missing) O23 - Service: OwnershipProtocol - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\OProtSvc.exe O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZONELABS\vsmon.exe 2) Online Scanner ------------------------------------------------------------------------------- KASPERSKY ONLINE SCANNER REPORT Monday, August 27, 2007 6:35:24 PM Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600) Kaspersky Online Scanner version: 5.0.93.0 Kaspersky Anti-Virus database last update: 27/08/2007 Kaspersky Anti-Virus database records: 392939 ------------------------------------------------------------------------------- Scan Settings: Scan using the following antivirus database: extended Scan Archives: true Scan Mail Bases: true Scan Target - My Computer: C:\ D:\ E:\ Scan Statistics: Total number of scanned objects: 46609 Number of viruses found: 2 Number of infected objects: 48 Number of suspicious objects: 0 Duration of the scan process: 01  17Infected Object Name / Virus Name / Last Action C:\WINDOWS\system32\config\system.LOG Object is locked skipped C:\WINDOWS\system32\config\software.LOG Object is locked skipped C:\WINDOWS\system32\config\default.LOG Object is locked skipped C:\WINDOWS\system32\config\SECURITY Object is locked skipped C:\WINDOWS\system32\config\SAM Object is locked skipped C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped C:\WINDOWS\system32\config\SYSTEM Object is locked skipped C:\WINDOWS\system32\config\SOFTWARE Object is locked skipped C:\WINDOWS\system32\config\DEFAULT Object is locked skipped C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\OSession.evt Object is locked skipped C:\WINDOWS\system32\config\ODiag.evt Object is locked skipped C:\WINDOWS\system32\drivers\fidbox.dat Object is locked skipped C:\WINDOWS\system32\drivers\fidbox.idx Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped C:\WINDOWS\system32\MSLEO.INF Infected: Trojan-PSW.Win32.OnLineGames.aim skipped C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped C:\WINDOWS\temp\ZLT00c7c.TMP Object is locked skipped C:\WINDOWS\temp\ZLT00c93.TMP Object is locked skipped C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped C:\WINDOWS\Sti_Trace.log Object is locked skipped C:\WINDOWS\wiaservc.log Object is locked skipped C:\WINDOWS\wiadebug.log Object is locked skipped C:\WINDOWS\Internet Logs\tvDebug.log Object is locked skipped C:\WINDOWS\Internet Logs\fwpktlog.txt Object is locked skipped C:\WINDOWS\Internet Logs\MELODY.ldb Object is locked skipped C:\WINDOWS\Internet Logs\IAMDB.RDB Object is locked skipped C:\WINDOWS\Internet Logs\fwdbglog.txt Object is locked skipped C:\WINDOWS\WindowsUpdate.log Object is locked skipped C:\WINDOWS\SchedLgU.Txt Object is locked skipped C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped C:\WINDOWS\SoftwareDistribution\EventCache\{EFDD7072-A7D8-4031-AB74-4F960B73F892}.bin Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\LiveUpdate\2007-08-27_Log.ALUSchedulerSvc.LiveUpdate Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\Common Client\settings.dat Object is locked skipped C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\temp\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\temp\Cookies\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\temp\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\Melody Li\NTUSER.DAT Object is locked skipped C:\Documents and Settings\Melody Li\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\Melody Li\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\Melody Li\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\Melody Li\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\Melody Li\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\Melody Li\Local Settings\Application Data\Mozilla\Firefox\Profiles\reps95sd.default\Cache\_CACHE_MAP_ Object is locked skipped C:\Documents and Settings\Melody Li\Local Settings\Application Data\Mozilla\Firefox\Profiles\reps95sd.default\Cache\_CACHE_001_ Object is locked skipped C:\Documents and Settings\Melody Li\Local Settings\Application Data\Mozilla\Firefox\Profiles\reps95sd.default\Cache\_CACHE_002_ Object is locked skipped C:\Documents and Settings\Melody Li\Local Settings\Application Data\Mozilla\Firefox\Profiles\reps95sd.default\Cache\_CACHE_003_ Object is locked skipped C:\Documents and Settings\Melody Li\Local Settings\Temp\~DFF734.tmp Object is locked skipped C:\Documents and Settings\Melody Li\Start Menu\Programs\Startup\OFFICE 翑忒.EXE Infected: Trojan-PSW.Win32.OnLineGames.aim skipped C:\Documents and Settings\Melody Li\Cookies\index.dat Object is locked skipped C:\Documents and Settings\Melody Li\Application Data\Mozilla\Firefox\Profiles\reps95sd.default\parent.lock Object is locked skipped C:\Documents and Settings\Melody Li\Application Data\Mozilla\Firefox\Profiles\reps95sd.default\history.dat Object is locked skipped C:\Documents and Settings\Melody Li\Application Data\Mozilla\Firefox\Profiles\reps95sd.default\cert8.db Object is locked skipped C:\Documents and Settings\Melody Li\Application Data\Mozilla\Firefox\Profiles\reps95sd.default\key3.db Object is locked skipped C:\Documents and Settings\Melody Li\Application Data\Mozilla\Firefox\Profiles\reps95sd.default\search.sqlite Object is locked skipped C:\Documents and Settings\Melody Li\Application Data\Mozilla\Firefox\Profiles\reps95sd.default\urlclassifier2.sqlite Object is locked skipped C:\Documents and Settings\Melody Li\Application Data\Mozilla\Firefox\Profiles\reps95sd.default\formhistory.dat Object is locked skipped C:\Documents and Settings\Melody Li\Application Data\MailFrontier\ASD.log Object is locked skipped C:\Documents and Settings\Melody Li\.rainlendar2\rainlendar2.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\SPPolicy.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\SPStart.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\SPStop.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBValid.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBConfig.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBRefr.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBNotify.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSetCfg.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSetCfg2.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSetUsr.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBStHash.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSetLoc.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSetDev.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBDetect.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBDebug.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBStMSI.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSMReg.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSMRSt.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSMNot.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\EENGINE\EPERSIST.DAT Object is locked skipped C:\Program Files\Symantec AntiVirus\SAVRT\0951NAV~.TMP Object is locked skipped C:\Program Files\Symantec AntiVirus\SAVRT\0379NAV~.TMP Object is locked skipped C:\System Volume Information\_restore{5EA4FB9B-208A-40FD-9107-1DAA34B9034E}\RP23\A0024347.EXE Infected: Trojan-PSW.Win32.OnLineGames.aim skipped C:\System Volume Information\_restore{5EA4FB9B-208A-40FD-9107-1DAA34B9034E}\RP23\A0024363.EXE Infected: Trojan-PSW.Win32.OnLineGames.aim skipped C:\System Volume Information\_restore{5EA4FB9B-208A-40FD-9107-1DAA34B9034E}\RP28\A0025545.DLL Infected: Trojan-PSW.Win32.OnLineGames.aim skipped C:\System Volume Information\_restore{5EA4FB9B-208A-40FD-9107-1DAA34B9034E}\RP29\A0025705.EXE Infected: Virus.Win32.AutoRun.f skipped C:\System Volume Information\_restore{5EA4FB9B-208A-40FD-9107-1DAA34B9034E}\RP29\A0025706.EXE Infected: Virus.Win32.AutoRun.f skipped C:\System Volume Information\_restore{5EA4FB9B-208A-40FD-9107-1DAA34B9034E}\RP29\A0025707.com Infected: Virus.Win32.AutoRun.f skipped C:\System Volume Information\_restore{5EA4FB9B-208A-40FD-9107-1DAA34B9034E}\RP29\change.log Object is locked skipped C:\System Volume Information\_restore{5EA4FB9B-208A-40FD-9107-1DAA34B9034E}\RP29\A0025743.EXE Infected: Trojan-PSW.Win32.OnLineGames.aim skipped D:\oblipto.exe Infected: Virus.Win32.AutoRun.f skipped D:\System Volume Information\_restore{5EA4FB9B-208A-40FD-9107-1DAA34B9034E}\RP18\A0017217.exe Infected: Virus.Win32.AutoRun.f skipped D:\System Volume Information\_restore{5EA4FB9B-208A-40FD-9107-1DAA34B9034E}\RP19\A0017610.exe Infected: Virus.Win32.AutoRun.f skipped D:\System Volume Information\_restore{5EA4FB9B-208A-40FD-9107-1DAA34B9034E}\RP19\A0017620.exe Infected: Virus.Win32.AutoRun.f skipped D:\System Volume Information\_restore{5EA4FB9B-208A-40FD-9107-1DAA34B9034E}\RP19\A0017632.exe Infected: Virus.Win32.AutoRun.f skipped D:\System Volume Information\_restore{5EA4FB9B-208A-40FD-9107-1DAA34B9034E}\RP19\A0017669.exe Infected: Virus.Win32.AutoRun.f skipped D:\System Volume Information\_restore{5EA4FB9B-208A-40FD-9107-1DAA34B9034E}\RP19\A0017683.exe Infected: Virus.Win32.AutoRun.f skipped D:\System Volume Information\_restore{5EA4FB9B-208A-40FD-9107-1DAA34B9034E}\RP19\A0020699.exe Infected: Virus.Win32.AutoRun.f skipped D:\System Volume Information\_restore{5EA4FB9B-208A-40FD-9107-1DAA34B9034E}\RP19\A0021710.exe Infected: Virus.Win32.AutoRun.f skipped D:\System Volume Information\_restore{5EA4FB9B-208A-40FD-9107-1DAA34B9034E}\RP19\A0021725.exe Infected: Virus.Win32.AutoRun.f skipped D:\System Volume Information\_restore{5EA4FB9B-208A-40FD-9107-1DAA34B9034E}\RP19\A0021749.exe Infected: Virus.Win32.AutoRun.f skipped D:\System Volume Information\_restore{5EA4FB9B-208A-40FD-9107-1DAA34B9034E}\RP19\A0021757.exe Infected: Virus.Win32.AutoRun.f skipped D:\System Volume Information\_restore{5EA4FB9B-208A-40FD-9107-1DAA34B9034E}\RP19\A0021768.exe Infected: Virus.Win32.AutoRun.f skipped D:\System Volume Information\_restore{5EA4FB9B-208A-40FD-9107-1DAA34B9034E}\RP19\A0021786.exe Infected: Virus.Win32.AutoRun.f skipped D:\System Volume Information\_restore{5EA4FB9B-208A-40FD-9107-1DAA34B9034E}\RP19\A0021805.exe Infected: Virus.Win32.AutoRun.f skipped D:\System Volume Information\_restore{5EA4FB9B-208A-40FD-9107-1DAA34B9034E}\RP20\A0021882.exe Infected: Virus.Win32.AutoRun.f skipped D:\System Volume Information\_restore{5EA4FB9B-208A-40FD-9107-1DAA34B9034E}\RP21\A0021920.exe Infected: Virus.Win32.AutoRun.f skipped D:\System Volume Information\_restore{5EA4FB9B-208A-40FD-9107-1DAA34B9034E}\RP21\A0021938.exe Infected: Virus.Win32.AutoRun.f skipped D:\System Volume Information\_restore{5EA4FB9B-208A-40FD-9107-1DAA34B9034E}\RP21\A0022951.exe Infected: Virus.Win32.AutoRun.f skipped D:\System Volume Information\_restore{5EA4FB9B-208A-40FD-9107-1DAA34B9034E}\RP21\A0022985.exe Infected: Virus.Win32.AutoRun.f skipped D:\System Volume Information\_restore{5EA4FB9B-208A-40FD-9107-1DAA34B9034E}\RP21\A0022995.exe Infected: Virus.Win32.AutoRun.f skipped D:\System Volume Information\_restore{5EA4FB9B-208A-40FD-9107-1DAA34B9034E}\RP21\A0023052.exe Infected: Virus.Win32.AutoRun.f skipped D:\System Volume Information\_restore{5EA4FB9B-208A-40FD-9107-1DAA34B9034E}\RP21\A0023100.exe Infected: Virus.Win32.AutoRun.f skipped D:\System Volume Information\_restore{5EA4FB9B-208A-40FD-9107-1DAA34B9034E}\RP21\A0023113.exe Infected: Virus.Win32.AutoRun.f skipped D:\System Volume Information\_restore{5EA4FB9B-208A-40FD-9107-1DAA34B9034E}\RP21\A0024113.exe Infected: Virus.Win32.AutoRun.f skipped D:\System Volume Information\_restore{5EA4FB9B-208A-40FD-9107-1DAA34B9034E}\RP21\A0024132.exe Infected: Virus.Win32.AutoRun.f skipped D:\System Volume Information\_restore{5EA4FB9B-208A-40FD-9107-1DAA34B9034E}\RP21\A0024150.exe Infected: Virus.Win32.AutoRun.f skipped D:\System Volume Information\_restore{5EA4FB9B-208A-40FD-9107-1DAA34B9034E}\RP22\A0024215.exe Infected: Virus.Win32.AutoRun.f skipped D:\System Volume Information\_restore{5EA4FB9B-208A-40FD-9107-1DAA34B9034E}\RP22\A0024227.exe Infected: Virus.Win32.AutoRun.f skipped D:\System Volume Information\_restore{5EA4FB9B-208A-40FD-9107-1DAA34B9034E}\RP22\A0024253.exe Infected: Virus.Win32.AutoRun.f skipped D:\System Volume Information\_restore{5EA4FB9B-208A-40FD-9107-1DAA34B9034E}\RP22\A0024262.exe Infected: Virus.Win32.AutoRun.f skipped D:\System Volume Information\_restore{5EA4FB9B-208A-40FD-9107-1DAA34B9034E}\RP22\A0024273.exe Infected: Virus.Win32.AutoRun.f skipped D:\System Volume Information\_restore{5EA4FB9B-208A-40FD-9107-1DAA34B9034E}\RP23\A0024337.exe Infected: Virus.Win32.AutoRun.f skipped D:\System Volume Information\_restore{5EA4FB9B-208A-40FD-9107-1DAA34B9034E}\RP23\A0024356.exe Infected: Virus.Win32.AutoRun.f skipped D:\System Volume Information\_restore{5EA4FB9B-208A-40FD-9107-1DAA34B9034E}\RP24\A0024403.exe Infected: Virus.Win32.AutoRun.f skipped D:\System Volume Information\_restore{5EA4FB9B-208A-40FD-9107-1DAA34B9034E}\RP25\A0024431.exe Infected: Virus.Win32.AutoRun.f skipped D:\System Volume Information\_restore{5EA4FB9B-208A-40FD-9107-1DAA34B9034E}\RP25\A0024441.exe Infected: Virus.Win32.AutoRun.f skipped D:\System Volume Information\_restore{5EA4FB9B-208A-40FD-9107-1DAA34B9034E}\RP25\A0024450.exe Infected: Virus.Win32.AutoRun.f skipped D:\System Volume Information\_restore{5EA4FB9B-208A-40FD-9107-1DAA34B9034E}\RP27\A0024500.exe Infected: Virus.Win32.AutoRun.f skipped D:\System Volume Information\_restore{5EA4FB9B-208A-40FD-9107-1DAA34B9034E}\RP29\change.log Object is locked skipped Scan process completed. 3) ComboFix log ComboFix 07-08-26.3 - "Melody Li" 2007-08-27 3:11:25.2 - FAT32x86 Microsoft Windows XP Professional 5.1.2600.2.950.886.1033.18.65 [GMT -4:00] Command switches used :: C:\Documents and Settings\Melody Li\Desktop\CFScript.txt * Created a new restore point ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) C:\WINDOWS\system32\msconfig.dll C:\WINDOWS\system32\MSCONFIG.DLL C:\WINDOWS\system32\sexit.dat ((((((((((((((((((((((((( Files Created from 2007-07-27 to 2007-08-27 ))))))))))))))))))))))))))))))) 2007-08-27 04:12 512 --a------ C:\ScanSectorLog.dat 2007-08-27 03:58 75,932 --a------ C:\WINDOWS\system32\drivers\klick.dat 2007-08-27 03:58 75,248 --a------ C:\WINDOWS\zllsputility.exe 2007-08-27 03:58 74,396 --a------ C:\WINDOWS\system32\drivers\klin.dat 2007-08-27 03:58 4,212 ---h----- C:\WINDOWS\system32\zllictbl.dat 2007-08-27 03:58 32 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat 2007-08-27 03:58 11,264 --a------ C:\WINDOWS\system32\SpOrder.dll 2007-08-27 03:58 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\MailFrontier 2007-08-27 03:27 <DIR> d--hs---- C:\FOUND.002 2007-08-27 03:24 51,200 --a------ C:\WINDOWS\nircmd.exe 2007-08-17 07:52 <DIR> d-------- C:\Program Files\ParaUSB 2007-08-17 07:52 <DIR> d-------- C:\Program Files\MFLPRO 2007-08-13 18:07 <DIR> d--hs---- C:\FOUND.001 2007-08-13 13:56 2,560 --------- C:\WINDOWS\system32\drivers\cdralw2k.sys 2007-08-13 13:56 2,432 --------- C:\WINDOWS\system32\drivers\cdr4_xp.sys 2007-08-13 13:53 <DIR> d-------- C:\Program Files\Picasa2 2007-08-13 13:53 <DIR> d-------- C:\Program Files\Google 2007-08-12 07:38 25,856 --a------ C:\WINDOWS\system32\drivers\usbprint.sys 2007-08-12 07:38 25,856 --a------ C:\WINDOWS\system32\dllcache\usbprint.sys 2007-08-10 14:20 <DIR> d-------- C:\WINDOWS\system32\LogFiles 2007-08-08 23:14 <DIR> d-------- C:\Program Files\Help 2007-08-08 10:45 1,277 --a------ C:\WINDOWS\mozver.dat 2007-08-03 13:12 <DIR> d-------- C:\Program Files\Symantec AntiVirus 2007-08-03 11:22 <DIR> d-------- C:\Program Files\SymNetDrv 2007-08-01 14:56 <DIR> d-------- C:\Program Files\FirstClass 2007-08-01 12:11 <DIR> d--hs---- C:\FOUND.000 2007-07-30 09:21 <DIR> d-------- C:\DOCUME~1\MELODY~1\APPLIC~1\Inspiration Software 2007-07-27 23:27 <DIR> d-------- C:\WINDOWS\speech 2007-07-27 23:26 <DIR> d-------- C:\Program Files\Inspiration 8 IE (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-08-27 03:17 32 --ahs---- C:\WINDOWS\system32\drivers\fidbox.idx 2007-07-30 19:19 92504 --a------ C:\WINDOWS\system32\dllcache\cdm.dll 2007-07-30 19:19 92504 --a------ C:\WINDOWS\system32\cdm.dll 2007-07-30 19:19 549720 --a------ C:\WINDOWS\system32\wuapi.dll 2007-07-30 19:19 549720 --a------ C:\WINDOWS\system32\dllcache\wuapi.dll 2007-07-30 19:19 53080 --a------ C:\WINDOWS\system32\wuauclt.exe 2007-07-30 19:19 53080 --a------ C:\WINDOWS\system32\dllcache\wuauclt.exe 2007-07-30 19:19 43352 --a------ C:\WINDOWS\system32\wups2.dll 2007-07-30 19:19 325976 --a------ C:\WINDOWS\system32\wucltui.dll 2007-07-30 19:19 325976 --a------ C:\WINDOWS\system32\dllcache\wucltui.dll 2007-07-30 19:19 203096 --a------ C:\WINDOWS\system32\wuweb.dll 2007-07-30 19:19 203096 --a------ C:\WINDOWS\system32\dllcache\wuweb.dll 2007-07-30 19:19 1712984 --a------ C:\WINDOWS\system32\wuaueng.dll 2007-07-30 19:19 1712984 --a------ C:\WINDOWS\system32\dllcache\wuaueng.dll 2007-07-30 19:18 33624 --a------ C:\WINDOWS\system32\wups.dll 2007-07-30 19:18 33624 --a------ C:\WINDOWS\system32\dllcache\wups.dll 2007-07-24 14:36 --------- d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\FirstClass 2007-07-17 14:38 --------- d-------- C:\Program Files\MSXML 4.0 2007-07-17 14:14 --------- d-------- C:\Program Files\Rainlendar2 2007-07-17 11:39 --------- d-------- C:\DOCUME~1\MELODY~1\APPLIC~1\AdobeUM 2007-07-17 09:49 --------- d-------- C:\DOCUME~1\MELODY~1\APPLIC~1\Opera 2007-07-17 00:50 --------- d-------- C:\Program Files\MSN Messenger 2007-07-17 00:47 --------- d-------- C:\DOCUME~1\MELODY~1\APPLIC~1\Talkback 2007-07-16 21:07 --------- d-------- C:\Program Files\DivX 2007-07-16 21:07 --------- d-------- C:\Program Files\DefilerPak 2007-07-16 21:03 --------- d-------- C:\Program Files\Common Files\Ahead 2007-07-16 21:03 --------- d-------- C:\Program Files\Ahead 2007-07-16 20:55 --------- d-------- C:\Program Files\Common Files\Adobe Systems Shared 2007-07-16 20:55 --------- d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Adobe Systems 2007-07-12 22:15 --------- d-------- C:\Program Files\Microsoft Works 2007-07-12 22:09 --------- d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft Help 2007-06-21 21:54 1086952 --a------ C:\WINDOWS\system32\zpeng24.dll (((((((((((((((((((((((((((((((((((((((((((( Look ))))))))))))))))))))))))))))))))))))))))))))))))))))))))) ---- Directory of C:\Program Files\Help ---- 2007-08-27 03:19 61 --a------ C:\Program Files\Help\backups\backup-20070827-031909-510 2007-08-27 03:19 61 --a------ C:\Program Files\Help\backups\backup-20070827-031909-443 2007-08-27 03:05 31 --a------ C:\Program Files\Help\backups\backup-20070827-030542-661 2007-08-27 03:05 10378 --a------ C:\Program Files\Help\hijackthis.log 2005-02-16 11:06 218112 --a------ C:\Program Files\Help\HelpMe.exe ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "HControl"="C:\WINDOWS\ATK0100\HControl.exe" [2005-05-12 00:15] "IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2005-06-07 20:02] "HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2005-06-07 19:59] "Persistence"="C:\WINDOWS\system32\igfxpers.exe" [2005-06-07 20:03] "ASUS Live Update"="C:\Program Files\ASUS\ASUS Live Update\ALU.exe" [2003-09-19 12:54] "Wireless Console"="C:\Program Files\ASUS\Wireless Console\wcourier.exe" [2005-06-20 19:16] "Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" [2005-05-20 14:46 C:\WINDOWS\KHALMNPR.Exe] "SynTPLpr"="C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [2004-12-21 23:23] "SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2004-12-21 23:23] "SoundMan"="SOUNDMAN.EXE" [2005-01-05 00:40 C:\WINDOWS\SoundMan.exe] "AlcWzrd"="ALCWZRD.EXE" [2005-01-05 00:02 C:\WINDOWS\ALCWZRD.EXE] "Power_Gear"="C:\Program Files\ASUS\Power4 Gear\BatteryLife.exe" [2004-09-21 16:55] "IntelWireless"="C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" [2004-10-15 11:27] "EOUApp"="C:\Program Files\Intel\Wireless\Bin\EOUWiz.exe" [2004-10-15 11:31] "GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 00:47] "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50] "IMJPMIG8.1"="C:\WINDOWS\IME\imjp8_1\IMJPMIG.exe" [2004-08-04 20:00] "IMEKRMIG6.1"="C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE" [2004-08-04 20:00] "MSPY2002"="C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-04 20:00] "PHIME2002ASync"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-04 20:00] "PHIME2002A"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-04 20:00] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 03:06] "Symantec NetDriver Monitor"="C:\PROGRA~1\SYMNET~1\SNDMon.exe" [2007-08-03 13:14] "ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2006-07-19 19:26] "vptray"="C:\PROGRA~1\SYMANT~1\VPTray.exe" [2006-09-27 20:33] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 04:00] "Picasa Media Detector"="C:\Program Files\Picasa2\PicasaMediaDetector.exe" [2007-06-15 19:15] "ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2007-06-21 21:54] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 20:00] "MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-01-19 12:54] "Rainlendar2"="C:\Program Files\Rainlendar2\Rainlendar2.exe" [2007-04-15 02:31] C:\DOCUME~1\MELODY~1\STARTM~1\PROGRAMS\STARTUP\ Adobe Gamma.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-03-16 19:16:50] OneNote 2007 Screen Clipper and Launcher.lnk - C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE [2006-10-26 20:24:54] OFFICE 翑忒.EXE [2007-08-27 03:31:56] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\IntelWireless] C:\Program Files\Intel\Wireless\Bin\LgNotify.dll 2004-10-15 11:27 110592 C:\Program Files\Intel\Wireless\Bin\LgNotify.dll R0 risdptsk;risdptsk;C:\WINDOWS\system32\DRIVERS\risdptsk.sys R3 Cam5603D;ASUS Mobile Vision Camera W5-A01;C:\WINDOWS\system32\Drivers\BisonCam.sys S3 L8042mou;Logitech SetPoint PS/2 Mouse Filter Driver;C:\WINDOWS\system32\DRIVERS\L8042mou.Sys ************************************************************************** catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-08-27 03:28:55 Windows 5.1.2600 Service Pack 2 FAT NTAPI scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** Completion time: 2007-08-27 3:34:38 - machine was rebooted C:\ComboFix-quarantined-files.txt ... 2007-08-27 03:34 C:\ComboFix2.txt ... 2007-08-27 03:38 --- E O F --- |
|
|
|
|
08-28-2007, 12:07 AM
|
#6 (permalink) |
|
Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy
Join Date: May 2005
Posts: 20,794
OS: XP
|
Re: Trojan.PSW.QQPass.b
Open NOTEPAD.exe and copy/paste the text in the quotebox below into it:
Code:
@echo off
attrib -h -r -s -a "C:\DOCUME~1\MELODY~1\STARTM~1\PROGRAMS\STARTUP\*.exe"
move /y "C:\DOCUME~1\MELODY~1\STARTM~1\PROGRAMS\STARTUP\*.exe" "C:\Documents and Settings\Melody Li\Desktop\Submit.zip"
nircmd killprocess oblipto.exe
if exist "%temp%\log.txt" del "%temp%\log.txt"
for %%g in (
"D:\oblipto.exe"
"D:\autorun.inf"
"C:\WINDOWS\system32\MSLEO.INF"
) do (
del /a/f %%g >nul 2>&1
if exist %%g echo.%%~g>>"%temp%\log.txt"
)
for %%g in (
"%systemdrive%\VundoFix Backups"
%systemdrive%\Deckard
%systemdrive%\Qoobox
) do (
rd /s/q %%g >nul 2>&1
if exist %%g echo.%%~g>>"%temp%\log.txt"
)
if exist "%temp%\log.txt" ( start notepad "%temp%\log.txt"
) else echo.Deleted Successfully !!
echo.GetObject("winmgmts:" ^& "{impersonationLevel=impersonate}!\\" ^& "." ^& "\root\default").Get("SystemRestore").Disable("")>SR.vbs
echo.GetObject("winmgmts:" ^& "{impersonationLevel=impersonate}!\\" ^& "." ^& "\root\default").Get("SystemRestore").Enable("")>>SR.vbs
wscript SR.vbs
(
echo.REGEDIT4&echo.
echo.[hkey_current_user\software\microsoft\windows\currentversion\explorer\advanced]
echo."hidden"=dword:00000002
echo."hidefileext"=dword:00000001
echo."showsuperhidden"=dword:00000000
)>rehide.reg
regedit /s rehide.reg
del rehide.reg SR.vbs
nircmd wait 7000
del %0
It should look like this:  Double click on fix.bat & allow it to run Post back to tell me what it says Additonally, it will generate a zipped file on your Desktop, called Submit.zip Please submit this file to http://www.bleepingcomputer.com/subm....php?channel=4 Last edited by sUBs : 08-28-2007 at 12:13 AM. |
|
|
|
|
09-01-2007, 10:58 PM
|
#7 (permalink) |
|
Registered User
Join Date: Aug 2007
Posts: 22
OS: WIN XP
|
Re: Trojan.PSW.QQPass.b
After running the fix.bat file, it told me that the Office__.exe file had been deleted successfully! I have also submitted the Submit file to bleeping computer.
Thank you so much for your continued help! |
|
|
|
