|
|
|
|
|||||
|
|
|
|
|
|
|||
| Welcome
to Tech Support Forum home to more then 136,000 problems solved. Issues
have included: Spyware, Malware, Virus Issues, Windows, Microsoft,
Linux, Networking, Security, Hardware, and Gaming Getting your
problem solved is as easy as: 1. Registering for a free account 2. Asking your question 3. Receiving an answer Registered members: * See fewer ads. * And much more..
|
| Want to know how to post a question? click here | Having problems with spyware and pop-ups? First Steps |
|
|||||||
| Resolved HJT Threads Resolved spyware and popup issues. |
|
|
Thread Tools |
10-20-2007, 12:32 PM
|
#1 (permalink) |
|
Registered User
Join Date: Mar 2006
Posts: 12
OS: WinXP
|
Worm-cmd.com? Need help. :(
Hello, it has been so long since I have been here, but, it seems I've gotten myself into something again! I have a few issues it seems, they may all be related as they all just started at the sametime. I ran spybot search&destroy before I came here as well as AD-aware, to try and remove the problems. Both said they would have to delete things at the boot-up. So I let them run again, and they still couldn't remove them, saying that is may be something in the physical memory.
My computer is now running very slowly and unstable. I am getting pop-ups. My browser is crashing(which also kept happening when I was trying to do the step where you do the online scan with Panda, I'm afraid I was unable to succeed at that.). Both S&D and Ad-Aware, mentioned "cmd.com" as being on there. Also, something called "Command Services", "Hotsearchbar", "PSW.WOW", "Smitfraud-C.CoreService", "AdRevolver", "BurstMedia", "DirectTrack", "Double Click", "FastClick", "MediaPlex", "WebTrends live". Those are all on there. And I just got them now(ran S&D), I will not remove them until told to. As I am writing this, I am either getting pop-ups, or freezing for absurd amounts of time. I will paste the logs and attach the files requested. Hope we can fix this sometime soon together. Thank you for all time and help given. Deckard's System Scanner v20071014.68 Run by Charlie on 2007-10-20 13:01:39 Computer is in Normal Mode. -------------------------------------------------------------------------------- -- System Restore -------------------------------------------------------------- Successfully created a Deckard's System Scanner Restore Point. -- Last 5 Restore Point(s) -- 65: 2007-10-20 18:01:45 UTC - RP363 - Deckard's System Scanner Restore Point 64: 2007-10-20 17:57:31 UTC - RP362 - Software Distribution Service 3.0 63: 2007-10-20 16:00:49 UTC - RP361 - Restore Operation 62: 2007-10-20 07:01:12 UTC - RP360 - Installed AUM405Patch 61: 2007-10-20 06:56:05 UTC - RP359 - Installed Adobe Bridge 1.0 -- First Restore Point -- 1: 2007-10-19 17:20:08 UTC - RP299 - System Checkpoint Backed up registry hives. Performed disk cleanup. -- HijackThis (run as Charlie.exe) --------------------------------------------- Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 1:02:09 PM, on 10/20/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Firebird\Firebird_1_5\bin\fbguard.exe C:\WINDOWS\System32\nvsvc32.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Linksys Wireless-G PCI Network Adapter with SpeedBooster\WLService.exe C:\Program Files\Linksys Wireless-G PCI Network Adapter with SpeedBooster\WMP54GSv1_1.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Firebird\Firebird_1_5\bin\fbserver.exe C:\WINDOWS\system32\wscntfy.exe C:\Program Files\iTunes\iTunesHelper.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Logitech\SetPoint\SetPoint.exe C:\Program Files\Common Files\Logitech\khalshared\KHALMNPR.EXE C:\WINDOWS\System32\svchost.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Internet Explorer\iexplore.exe C:\WINDOWS\system32\wuauclt.exe C:\Documents and Settings\Charlie\Local Settings\Temporary Internet Files\Content.IE5\ZAJTZN2X\dss[1].exe C:\PROGRA~1\TRENDM~1\HIJACK~1\Charlie.exe O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {07B0CC50-22A8-45C3-AE15-3142D2912A17} - C:\Program Files\MSN\hokeqo4444.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll O2 - BHO: (no name) - {79A3F681-2B62-4A7D-A5AD-6A3B63A3DDAE} - C:\Program Files\MSN\hokeqo83122.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: (no name) - {86882CA4-BE70-4BCE-AEA5-CF40EB8E0BC3} - C:\WINDOWS\system32\cbxvwuv.dll O2 - BHO: (no name) - {E0ACD1A4-A739-4F03-BE72-A1C225921341} - C:\WINDOWS\system32\awvvv.dll O2 - BHO: IKatzu Class - {EA5159DF-E413-4878-8AE2-D921D41BB942} - C:\WINDOWS\system32\bkindiil.dll O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] "C:\Program Files\Common Files\Logitech\khalshared\KHALMNPR.EXE" O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [QuickTime Task] "D:\qttask.exe" -atboottime O4 - HKLM\..\Run: [NVMixerTray] "C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe" O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "D:\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [winlog] winlog.exe O4 - HKLM\..\RunServices: [winlog] winlog.exe O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background O4 - HKCU\..\Run: [ArtChk] C:\WINDOWS\system32\artchker.exe O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Logitech SetPoint.lnk = ? O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/pr02...s/MSNPUpld.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/wind...?1190591394218 O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O20 - Winlogon Notify: cbxvwuv - C:\WINDOWS\SYSTEM32\cbxvwuv.dll O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - C:\Program Files\Ares\chatServer.exe O23 - Service: Firebird Guardian - DefaultInstance (FirebirdGuardianDefaultInstance) - The Firebird Project - C:\Program Files\Firebird\Firebird_1_5\bin\fbguard.exe O23 - Service: Firebird Server - DefaultInstance (FirebirdServerDefaultInstance) - The Firebird Project - C:\Program Files\Firebird\Firebird_1_5\bin\fbserver.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: WMP54GSSVC - GEMTEKS - C:\Program Files\Linksys Wireless-G PCI Network Adapter with SpeedBooster\WLService.exe O24 - Desktop Component 0: (no name) - C:\Program Files\ComPlus Applications\profsyxyrti.html -- End of file - 6663 bytes -- File Associations ----------------------------------------------------------- All associations okay. -- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------- R1 core - c:\windows\system32\drivers\core.sys R2 AegisP (AEGIS Protocol (IEEE 802.1x) v3.2.0.3) - c:\windows\system32\drivers\aegisp.sys <Not Verified; Meetinghouse Data Communications; AEGIS Client 3.2.0.3> R2 LBeepKE - c:\windows\system32\drivers\lbeepke.sys <Not Verified; Logitech Inc.; Logitech SetPoint> R3 GTNDIS5 (GTNDIS5 NDIS Protocol Driver) - c:\windows\system32\gtndis5.sys <Not Verified; Printing Communications Assoc., Inc. (PCAUSA); PCAUSA Rawether for Windows> -- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled -------------------- R2 Apple Mobile Device - "c:\program files\common files\apple\mobile device support\bin\applemobiledeviceservice.exe" <Not Verified; Apple, Inc.; Apple Mobile Device Service> R2 FirebirdGuardianDefaultInstance (Firebird Guardian - DefaultInstance) - c:\program files\firebird\firebird_1_5\bin\fbguard.exe -s <Not Verified; The Firebird Project; Firebird SQL Server> R3 FirebirdServerDefaultInstance (Firebird Server - DefaultInstance) - c:\program files\firebird\firebird_1_5\bin\fbserver.exe -s <Not Verified; The Firebird Project; Firebird SQL Server> S3 AresChatServer (Ares Chatroom server) - c:\program files\ares\chatserver.exe <Not Verified; Ares Development Group; Ares Chat Server> -- Device Manager: Disabled ---------------------------------------------------- Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318} Description: 1394 Net Adapter Device ID: V1394\NIC1394\D838A5508D00 Manufacturer: Microsoft Name: 1394 Net Adapter PNP Device ID: V1394\NIC1394\D838A5508D00 Service: NIC1394 Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318} Description: NVIDIA nForce Networking Controller Device ID: {1A3E09BE-1E45-494B-9174-D7385B45BBF5}\NVNET_DEV0057\4&2DF285A8&0&01 Manufacturer: NVIDIA Name: NVIDIA nForce Networking Controller PNP Device ID: {1A3E09BE-1E45-494B-9174-D7385B45BBF5}\NVNET_DEV0057\4&2DF285A8&0&01 Service: NVENETFD -- Scheduled Tasks ------------------------------------------------------------- 2007-10-19 19:40:15 284 --a------ C:\WINDOWS\Tasks\AppleSoftwareUpdate.job -- Files created between 2007-09-20 and 2007-10-20 ----------------------------- 2007-10-20 12:56:55 0 d-------- C:\WINDOWS\LastGood 2007-10-20 12:50:02 118784 --a------ C:\WINDOWS\system32\MSSTDFMT.DLL <Not Verified; Microsoft Corporation; MSSTDFMT Object Library> 2007-10-20 12:50:02 0 d-------- C:\Program Files\SpywareBlaster 2007-10-20 11:37:34 0 d-------- C:\WINDOWS\system32\ActiveScan 2007-10-20 11:22:41 0 d-------- C:\Program Files\Trend Micro 2007-10-20 11  51 0 dr-h----- C:\Documents and Settings\Charlie\Recent2007-10-20 10:41:08 0 ---hs---- C:\WINDOWS\system32\tracert.com 2007-10-20 10:41:08 0 ---hs---- C:\WINDOWS\system32\tasklist.com 2007-10-20 10:41:08 0 ---hs---- C:\WINDOWS\system32\taskkill.com 2007-10-20 10:41:08 0 ---hs---- C:\WINDOWS\system32\regedit.com 2007-10-20 10:41:08 0 ---hs---- C:\WINDOWS\system32\ping.com 2007-10-20 10:41:08 0 ---hs---- C:\WINDOWS\system32\netstat.com 2007-10-20 10:41:08 0 ---hs---- C:\WINDOWS\system32\cmd.com 2007-10-20 10:41:08 62464 --a------ C:\WINDOWS\system32\bszip.dll <Not Verified; BigSpeedSoft; BigSpeed Zip DLL> 2007-10-20 02:18:32 44922 --a------ C:\WINDOWS\system32\IKatzuUninstall.exe 2007-10-20 02:18:32 118784 --a------ C:\WINDOWS\system32\artchker.exe 2007-10-20 02:18:31 169147 --a------ C:\WINDOWS\TTC-4444.exe 2007-10-20 02:18:30 45056 --a------ C:\WINDOWS\system32\katzpvydp.exe <Not Verified; Upads.Biz; IKatzu App> 2007-10-20 02:18:30 45056 --a------ C:\WINDOWS\system32\katzppd.exe <Not Verified; Upads.Biz; IKatzu App> 2007-10-20 02:18:27 421888 --a------ C:\WINDOWS\system32\bkindiil.dll <Not Verified; ; IKatzu Search Ads> 2007-10-20 02:18:24 0 d--hs---- C:\WINDOWS\V2lja2Vk 2007-10-20 02:18:24 35840 --a------ C:\WINDOWS\tsitra1000106.exe 2007-10-20 02:18:24 24576 --a------ C:\WINDOWS\system32\msxml3a.dll <Not Verified; Microsoft Corporation; Microsoft XML Core Services> 2007-10-20 02:18:21 72960 -----n--- C:\WINDOWS\system32\drivers\core.sys 2007-10-20 02:18:18 0 d-------- C:\WINDOWS\system32\xx1 2007-10-20 02:18:18 0 d-------- C:\WINDOWS\system32\od2 2007-10-20 02:18:18 0 d-------- C:\WINDOWS\system32\ib1 2007-10-20 02:18:18 0 d-------- C:\WINDOWS\system32\cp1 2007-10-20 02:18:18 0 d-------- C:\WINDOWS\system32\bo2 2007-10-20 02:18:18 0 d-------- C:\WINDOWS\system32\ap1 2007-10-20 02:18:17 0 d-------- C:\WINDOWS\system32\oTt04e 2007-10-20 02:18:17 0 d-------- C:\Temp 2007-10-20 01:40:44 0 d-------- C:\Documents and Settings\All Users\Application Data\Adobe Systems 2007-10-20 01:40:01 0 d-------- C:\Program Files\Common Files\Adobe Systems Shared 2007-10-19 12:20:40 6293 ---hs---- C:\WINDOWS\system32\vvvwa.bak1 2007-10-19 12:19:54 312416 --a------ C:\WINDOWS\system32\awvvv.dll 2007-10-19 12:15:27 35840 --a------ C:\WINDOWS\tsitra1000140.exe 2007-10-19 12:14:50 35840 --a------ C:\WINDOWS\system32\cbxvwuv.dll 2007-10-19 12:14:36 0 d--hs---- C:\Program Files\outlook 2007-10-16 09:04:54 53248 --a------ C:\WINDOWS\b122.exe 2007-09-27 21:07:54 0 d-------- C:\Documents and Settings\Charlie\Application Data\dvdcss 2007-09-22 20:23:31 0 d-------- C:\Program Files\Google 2007-09-21 10:23:58 0 d-------- C:\WINDOWS\Logo Design Studio 2007-09-21 10:23:58 0 d-------- C:\Program Files\Summitsoft 2007-09-20 23:14:39 180224 --a------ C:\WINDOWS\system32\xvidvfw.dll 2007-09-20 23:14:39 765952 --a------ C:\WINDOWS\system32\xvidcore.dll 2007-09-20 23:14:39 0 d-------- C:\Program Files\Xvid -- Find3M Report --------------------------------------------------------------- 2007-10-20 11:57:30 0 d-------- C:\Program Files\Linksys Wireless-G PCI Network Adapter with SpeedBooster 2007-10-20 11:57:14 0 d-------- C:\Program Files\iTunes 2007-10-20 11:57:01 0 d-------- C:\Program Files\MSN Messenger 2007-10-20 02:14:31 0 d-------- C:\Documents and Settings\Charlie\Application Data\Adobe 2007-10-20 01:55:12 0 d--h----- C:\Program Files\InstallShield Installation Information 2007-10-20 01:41:55 0 d-------- C:\Program Files\Common Files\Adobe 2007-10-20 01:40:01 0 d-------- C:\Program Files\Common Files 2007-10-19 22:31:54 0 d-------- C:\Documents and Settings\Charlie\Application Data\LimeWire 2007-10-16 15:15:10 0 d-------- C:\Documents and Settings\Charlie\Application Data\Skype 2007-10-07 15:42:17 0 d-------- C:\Documents and Settings\Charlie\Application Data\Apple Computer 2007-10-06 22:46:44 0 d-------- C:\Program Files\Sociolotron <SOCIOL~1> 2007-09-20 23:11:36 0 d-------- C:\Program Files\Apple Software Update 2007-09-20 21:37:30 367942 --a------ C:\Program Files\EventLog.log 2007-09-20 21:37:29 544 --a------ C:\Program Files\SAMBC.ini 2007-09-20 21:37:29 395 --a------ C:\Program Files\SAMBC.gui.xml 2007-09-20 21:37:29 59994 --a------ C:\Program Files\SAMBC.core.xml 2007-09-09 10:43:37 0 d-------- C:\Program Files\SecondLife 2007-09-08 12:53:49 0 d-------- C:\Documents and Settings\Charlie\Application Data\SecondLife 2007-08-20 19:16:24 0 d-------- C:\Program Files\Ares 2007-08-14 15:09:32 112 --a------ C:\WINDOWS\HOSTK100.DAT 2007-08-05 12:12:01 29399 --a------ C:\Documents and Settings\Charlie\Application Data\Pamela_Crash_46B604E1.zip 2007-07-27 21:48:19 180224 --a------ C:\WINDOWS\system32\RemoteControl.dll <Not Verified; ; Pamela Remote Control Dynamic Link Library> -- Registry Dump --------------------------------------------------------------- *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{07B0CC50-22A8-45C3-AE15-3142D2912A17}] 08/02/2007 08:43 AM 282624 --a------ C:\Program Files\MSN\hokeqo4444.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{79A3F681-2B62-4A7D-A5AD-6A3B63A3DDAE}] 08/02/2007 08:43 AM 282624 --a------ C:\Program Files\MSN\hokeqo83122.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{86882CA4-BE70-4BCE-AEA5-CF40EB8E0BC3}] 10/19/2007 12:14 PM 35840 --a------ C:\WINDOWS\system32\cbxvwuv.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{E0ACD1A4-A739-4F03-BE72-A1C225921341}] 10/19/2007 12:19 PM 312416 --a------ C:\WINDOWS\system32\awvvv.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{EA5159DF-E413-4878-8AE2-D921D41BB942}] 10/20/2007 02:18 AM 421888 --a------ C:\WINDOWS\system32\bkindiil.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="C:\WINDOWS\System32\NvCpl.dll" [10/22/2006 01:22 PM] "nwiz"="nwiz.exe" [10/22/2006 01:22 PM C:\WINDOWS\system32\nwiz.exe] "Logitech Hardware Abstraction Layer"="C:\Program Files\Common Files\Logitech\khalshared\KHALMNPR.EXE" [07/19/2006 01:03 PM] "Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [07/19/2006 01:03 PM C:\WINDOWS\KHALMNPR.Exe] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [06/28/2007 09:14 AM] "QuickTime Task"="D:\qttask.exe" [06/29/2007 06:24 AM] "NVMixerTray"="C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe" [12/20/2004 05:12 PM] "Adobe Reader Speed Launcher"="D:\Adobe\Reader 8.0\Reader\Reader_sl.exe" [05/11/2007 03:06 AM] "winlog"="winlog.exe" [] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [08/04/2004 02:56 AM] "MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [01/19/2007 12:54 PM] "ArtChk"="C:\WINDOWS\system32\artchker.exe" [10/20/2007 02:18 AM] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runservices] "winlog"=winlog.exe C:\Documents and Settings\Charlie\Start Menu\Programs\Startup\ Adobe Gamma.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [3/16/2005 7:16:50 PM] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ Logitech SetPoint.lnk - C:\Program Files\Logitech\SetPoint\SetPoint.exe [1/13/2007 9:16:54 AM] [HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0] Source= C:\Program Files\ComPlus Applications\profsyxyrti.html FriendlyName= [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] "{86882CA4-BE70-4BCE-AEA5-CF40EB8E0BC3}"= C:\WINDOWS\system32\cbxvwuv.dll [10/19/2007 12:14 PM 35840] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\cbxvwuv] cbxvwuv.dll 10/19/2007 12:14 PM 35840 C:\WINDOWS\system32\cbxvwuv.dll [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] "Authentication Packages"= msv1_0 C:\WINDOWS\system32\awvvv.dll [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vds] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}] @="Volume shadow copy" -- End of Deckard's System Scanner: finished at 2007-10-20 13:03:03 ------------ |
|
     |
|
10-22-2007, 09:54 AM
|
#2 (permalink) |
|
Analyst, Security Team
Join Date: Feb 2005
Location: Eire
Posts: 1,911
OS: Vista, Ubuntu 8.04
|
Re: Worm-cmd.com? Need help. :(
Hi WickedL
You are quite heavily infected, so this will take a few runs to clean out please stick with me until you are pronounced clean =========================== Please read this post completely before begining the fix. If there's anything that you do not understand, kindly ask your questions before proceeding. Please ensure that there aren't any opened browsers when you are carrying out the procedures below. Save the following instructions in Notepad as this webpage would not be available when you're carrying out the fix. IT IS IMPORTANT THAT YOU DON'T MISS A STEP & PERFORM EVERYTHING IN THE RIGHT ORDER. =============================================== Additional Downloads Please download these additional files/programs. Do not run them until instructed to do so. Unless otherwise stated, they should be stored in same directory as the HiJackThis program. =============================================== We will be cleaning out the Temp folders so before proceeding any further, please move dss[1].exe from C:\Documents and Settings\Charlie\Local Settings\Temporary Internet Files\Content.IE5\ZAJTZN2X\ to your Desktop =============================================== Download Combofix and save it to your desktop. **Note: It is important that it is saved directly to your desktop** =============================================== 1. Close any open browsers. 2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix. =============================================== Double click on combofix.exe & follow the prompts.
Do not mouseclick combofix's window while it's running. That may cause it to stall ================= Please Run a scan with HiJackThis and save the log ================= In your next post, please include fresh logs from:
|
|
|
|
|
10-22-2007, 07:35 PM
|
#3 (permalink) |
|
Registered User
Join Date: Mar 2006
Posts: 12
OS: WinXP
|
Re: Worm-cmd.com? Need help. :(
Hello, alba.
Sadly, I can not even complete the nextstep:We will be cleaning out the Temp folders so before proceeding any further, please move dss[1].exe from C:\Documents and Settings\Charlie\Local Settings\Temporary Internet Files\Content.IE5\ZAJTZN2X\ to your Desktop The above mentioned folder/file will not turn up in my search. I am not sure if the file is hidden or not though. I aplogize for the delayed response. If there is a certain time that you will be on, that may help a bit more. Any suggestions that I should try out? Almost tempted to just go buy a new hard drive. HeHe. Thank you for all given. :) |
|
|
|
|
10-23-2007, 12:08 AM
|
#4 (permalink) |
|
Analyst, Security Team
Join Date: Feb 2005
Location: Eire
Posts: 1,911
OS: Vista, Ubuntu 8.04
|
Re: Worm-cmd.com? Need help. :(
Hi ya
no worries, move on to the rest of my instructions, I will be back on tonight but after you have completed my instructions keep internet surfing down to a minimum as there will be some infection present. Dont worry the first run will clean out a lot  |
|
|
|
|
10-23-2007, 11:56 AM
|
#5 (permalink) |
|
Registered User
Join Date: Mar 2006
Posts: 12
OS: WinXP
|
Re: Worm-cmd.com? Need help. :(
Here are the ComboFix and HijackThis logs, hope it helps:
Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 12:50:42 PM, on 10/23/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Firebird\Firebird_1_5\bin\fbguard.exe C:\WINDOWS\System32\nvsvc32.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Linksys Wireless-G PCI Network Adapter with SpeedBooster\WLService.exe C:\Program Files\Linksys Wireless-G PCI Network Adapter with SpeedBooster\WMP54GSv1_1.exe C:\Program Files\Firebird\Firebird_1_5\bin\fbserver.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\wscntfy.exe C:\Program Files\iTunes\iTunesHelper.exe D:\Adobe\Reader 8.0\Reader\Reader_sl.exe C:\WINDOWS\system32\sms_msn40.exe C:\WINDOWS\system32\sms_msn.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Logitech\SetPoint\SetPoint.exe C:\Program Files\Common Files\Logitech\khalshared\KHALMNPR.EXE C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\ngpw40.exe C:\Program Files\iPod\bin\iPodService.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: ngsh35.clsIS - {279A1B41-6CAC-4ABF-B39C-72C8E489F685} - C:\WINDOWS\system32\ngsh35.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll O2 - BHO: (no name) - {7D9CB362-375B-4FB9-8024-E55079CC69D1}" - (no file) O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: IKatzu Class - {EA5159DF-E413-4878-8AE2-D921D41BB942} - C:\WINDOWS\system32\bkindiil.dll O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] "C:\Program Files\Common Files\Logitech\khalshared\KHALMNPR.EXE" O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [QuickTime Task] "D:\qttask.exe" -atboottime O4 - HKLM\..\Run: [NVMixerTray] "C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe" O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "D:\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [sms_msn40] C:\WINDOWS\system32\sms_msn40.exe O4 - HKLM\..\Run: [sms_msn] C:\WINDOWS\system32\sms_msn.exe O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background O4 - HKCU\..\Run: [ArtChk] C:\WINDOWS\system32\artchker.exe O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Logitech SetPoint.lnk = ? O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/pr02...s/MSNPUpld.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/wind...?1190591394218 O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - C:\Program Files\Ares\chatServer.exe O23 - Service: Firebird Guardian - DefaultInstance (FirebirdGuardianDefaultInstance) - The Firebird Project - C:\Program Files\Firebird\Firebird_1_5\bin\fbguard.exe O23 - Service: Firebird Server - DefaultInstance (FirebirdServerDefaultInstance) - The Firebird Project - C:\Program Files\Firebird\Firebird_1_5\bin\fbserver.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: WMP54GSSVC - GEMTEKS - C:\Program Files\Linksys Wireless-G PCI Network Adapter with SpeedBooster\WLService.exe -- End of file - 6373 bytes ComboFix: ComboFix 07-10-23.1 - Charlie 2007-10-23 12:43:51.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1455 [GMT -5:00] Running from: C:\Documents and Settings\Charlie\Desktop\ComboFix.exe * Created a new restore point . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Program Files\ComPlus Applications\profsyxyrti.html C:\Program Files\MSN\hokeqo4444.dll C:\Program Files\MSN\hokeqo83122.dll C:\Program Files\outlook C:\Program Files\outlook\p.zip C:\Temp\1cb C:\Temp\1cb\syscheck.log C:\Temp\fCOe C:\Temp\fCOe\tOasF.log C:\temp\tn3 C:\WINDOWS\b122.exe C:\WINDOWS\system32\awvvv.dll C:\WINDOWS\system32\bszip.dll C:\WINDOWS\system32\cbxvwuv.dll C:\WINDOWS\system32\cmd.com C:\WINDOWS\system32\drivers\core.cache.dsk C:\WINDOWS\system32\drivers\core.sys C:\WINDOWS\system32\netstat.com C:\WINDOWS\system32\oTt04e C:\WINDOWS\system32\oTt04e\oTt04e1080.exe C:\WINDOWS\system32\pac.txt C:\WINDOWS\system32\ping.com C:\WINDOWS\system32\regedit.com C:\WINDOWS\system32\taskkill.com C:\WINDOWS\system32\tasklist.com C:\WINDOWS\system32\tracert.com C:\WINDOWS\system32\vvvwa.bak1 C:\WINDOWS\system32\vvvwa.ini C:\WINDOWS\tsitra1000106.exe C:\WINDOWS\tsitra1000140.exe C:\WINDOWS\TTC-4444.exe . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\LEGACY_CMDSERVICE -------\LEGACY_CORE -------\LEGACY_NETWORK_MONITOR -------\cmdService -------\core ((((((((((((((((((((((((( Files Created from 2007-09-23 to 2007-10-23 ))))))))))))))))))))))))))))))) . 2007-10-23 12:42 51,200 --a------ C:\WINDOWS\NirCmd.exe 2007-10-22 02:20 664 --a------ C:\WINDOWS\system32\d3d9caps.dat 2007-10-20 19:10 <DIR> d-------- C:\Program Files\BitTorrent Absolute Downloader 2007-10-20 19:10 81,977 --a------ C:\WINDOWS\system32\ngsh35.dll 2007-10-20 19:10 81,977 --a------ C:\WINDOWS\system\sngsh35.dll 2007-10-20 19:10 65,593 --a------ C:\WINDOWS\system32\ngsh40.dll 2007-10-20 19:10 65,593 --a------ C:\WINDOWS\Sngsh40.dll 2007-10-20 19:10 49,152 --a------ C:\WINDOWS\system32\RegClass.dll 2007-10-20 19:10 28,672 --a------ C:\WINDOWS\system32\ngpw40.exe 2007-10-20 19:10 28,672 --a------ C:\WINDOWS\sngpw40.exe 2007-10-20 19:10 20,480 --a------ C:\WINDOWS\system32\sms_msn.exe 2007-10-20 19:10 16,384 --a------ C:\WINDOWS\system32\sms_msn40.exe 2007-10-20 12:56 584,192 -----c--- C:\WINDOWS\system32\dllcache\rpcrt4.dll 2007-10-20 12:50 <DIR> d-------- C:\Program Files\SpywareBlaster 2007-10-20 12:50 118,784 --a------ C:\WINDOWS\system32\MSSTDFMT.DLL 2007-10-20 11:37 <DIR> d-------- C:\WINDOWS\system32\ActiveScan 2007-10-20 11:22 <DIR> d-------- C:\Program Files\Trend Micro 2007-10-20 10:45 102,664 --a------ C:\WINDOWS\system32\drivers\tmcomm.sys 2007-10-20 02:18 <DIR> d-------- C:\Temp 2007-10-20 01:40 <DIR> d-------- C:\Program Files\Common Files\Adobe Systems Shared 2007-09-30 13:03 462,848 --a------ C:\WINDOWS\system32\ltkrn13n.dll 2007-09-30 13:03 450,560 --a------ C:\WINDOWS\system32\ltimg13n.dll 2007-09-30 13:03 401,408 --a------ C:\WINDOWS\system32\lfcmp13n.dll 2007-09-30 13:03 299,008 --a------ C:\WINDOWS\system32\ltdis13n.dll 2007-09-30 13:03 206,336 --a------ C:\WINDOWS\system32\ltefx13n.dll 2007-09-30 13:03 163,840 --a------ C:\WINDOWS\system32\ltfil13n.dll 2007-09-30 13:03 159,744 --a------ C:\WINDOWS\system32\lfpng13n.dll 2007-09-30 13:03 69,632 --a------ C:\WINDOWS\system32\lfgif13n.dll 2007-09-30 13:03 57,344 --a------ C:\WINDOWS\system32\lfbmp13n.dll 2007-09-27 21:07 <DIR> d-------- C:\Documents and Settings\Charlie\Application Data\dvdcss 2007-09-23 18:58 221,184 --a------ C:\WINDOWS\system32\wmpns.dll . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2007-10-23 07:46 --------- d-----w C:\Documents and Settings\Charlie\Application Data\LimeWire 2007-10-22 07:46 --------- d-----w C:\Program Files\Linksys Wireless-G PCI Network Adapter with SpeedBooster 2007-10-22 07:45 --------- d-----w C:\Program Files\iTunes 2007-10-21 01:27 --------- d-----w C:\Documents and Settings\Charlie\Application Data\Skype 2007-10-20 16:57 --------- d-----w C:\Program Files\MSN Messenger 2007-10-20 06:55 --------- d--h--w C:\Program Files\InstallShield Installation Information 2007-10-20 06:41 --------- d-----w C:\Program Files\Common Files\Adobe 2007-10-07 20:42 --------- d-----w C:\Documents and Settings\Charlie\Application Data\Apple Computer 2007-10-07 03:46 --------- d-----w C:\Program Files\Sociolotron 2007-09-23 01:23 --------- d-----w C:\Program Files\Google 2007-09-21 15:23 --------- d-----w C:\Program Files\Summitsoft 2007-09-21 04:14 --------- d-----w C:\Program Files\Xvid 2007-09-21 04:11 --------- d-----w C:\Program Files\Apple Software Update 2007-09-21 02:37 59,994 ----a-w C:\Program Files\SAMBC.core.xml 2007-09-21 02:37 544 ----a-w C:\Program Files\SAMBC.ini 2007-09-21 02:37 395 ----a-w C:\Program Files\SAMBC.gui.xml 2007-09-21 02:37 367,942 ----a-w C:\Program Files\EventLog.log 2007-09-09 15:43 --------- d-----w C:\Program Files\SecondLife 2007-09-08 17:53 --------- d-----w C:\Documents and Settings\Charlie\Application Data\SecondLife 2007-08-05 17:12 29,399 ----a-w C:\Documents and Settings\Charlie\Application Data\Pamela_Crash_46B604E1.zip 2007-01-06 02:29 33,118 ----a-w C:\Program Files\uninstall.exe 2005-12-07 12:48 4,573,184 ----a-w C:\Program Files\SAMBC.exe 2005-08-04 17:26 10,136 -c--a-w C:\Program Files\license.txt 2005-07-20 22:24 348,510,372 ----a-w C:\Program Files\setup.exe 2004-12-12 16:05 1,523,796 ----a-w C:\Program Files\fbclient.dll 2004-10-19 06:53 25,014 ----a-w C:\Program Files\splash_bc.jpg 2004-10-17 15:11 213 -c--a-w C:\Program Files\restore_firebird.bat 2004-07-13 16:05 133 -c--a-w C:\Program Files\aliases.conf 2004-07-13 16:05 132,796 -c--a-w C:\Program Files\firebird.msg 2004-04-18 16:05 19,646 ----a-w C:\Program Files\firebird.conf 2000-08-28 18:19 401,462 ----a-w C:\Program Files\msvcp60.dll 2005-07-29 21:24:26 472 --sha-r C:\WINDOWS\V2lja2Vk\pZ53uZp4.vbs . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{279A1B41-6CAC-4ABF-B39C-72C8E489F685}] 2007-10-20 19:10 81977 --a------ C:\WINDOWS\system32\ngsh35.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{7D9CB362-375B-4FB9-8024-E55079CC69D1}"] SteelWerX Registry Console Tool 2.0 Written by Bobbi Flekman 2006 (C) Error: Key: clsid\{7d9cb362-375b-4fb9-8024-e55079cc69d1}\inprocserver32 /ve | sed /reg_.*:\\/!d;s/.*\t// does not exist! [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{EA5159DF-E413-4878-8AE2-D921D41BB942}] 2007-10-20 02:18 421888 --a------ C:\WINDOWS\system32\bkindiil.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="C:\WINDOWS\System32\NvCpl.dll" [2006-10-22 13:22] "nwiz"="nwiz.exe" [2006-10-22 13:22 C:\WINDOWS\system32\nwiz.exe] "Logitech Hardware Abstraction Layer"="C:\Program Files\Common Files\Logitech\khalshared\KHALMNPR.EXE" [2006-07-19 13:03] "Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2006-07-19 13:03 C:\WINDOWS\KHALMNPR.Exe] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-06-28 09:14] "QuickTime Task"="D:\qttask.exe" [2007-06-29 06:24] "NVMixerTray"="C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe" [2004-12-20 17:12] "Adobe Reader Speed Launcher"="D:\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 03:06] "sms_msn40"="C:\WINDOWS\system32\sms_msn40.exe" [2007-10-20 19:10] "sms_msn"="C:\WINDOWS\system32\sms_msn.exe" [2007-10-20 19:10] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 02:56] "MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-01-19 12:54] "ArtChk"="C:\WINDOWS\system32\artchker.exe" [2007-10-20 02:18] [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] "Authentication Packages"= msv1_0 C:\WINDOWS\system32\awvvv.dll R2 FirebirdGuardianDefaultInstance;Firebird Guardian - DefaultInstance;C:\Program Files\Firebird\Firebird_1_5\bin\fbguard.exe -s R2 LBeepKE;LBeepKE;C:\WINDOWS\system32\Drivers\LBeepKE.sys R3 FirebirdServerDefaultInstance;Firebird Server - DefaultInstance;C:\Program Files\Firebird\Firebird_1_5\bin\fbserver.exe -s R3 PhilCam8116;Logitech QuickCam Pro 3000(PID_08B0);C:\WINDOWS\system32\DRIVERS\CamDrL21.sys . Contents of the 'Scheduled Tasks' folder "2007-10-20 00:40:15 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job" . ************************************************************************** catchme 0.3.1232 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-10-23 12:48:25 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2007-10-23 12:49:01 - machine was rebooted . --- E O F --- |
|
|
|
|
10-23-2007, 02:39 PM
|
#6 (permalink) |
|
Analyst, Security Team
Join Date: Feb 2005
Location: Eire
Posts: 1,911
OS: Vista, Ubuntu 8.04
|
Re: Worm-cmd.com? Need help. :(
Hi WickedL
Do you recognize these files C:\WINDOWS\V2lja2Vk\pZ53uZp4.vbs C:\Documents and Settings\Charlie\Application Data\Pamela_Crash_46B604E1.zip Please read this post completely before begining the fix. If there's anything that you do not understand, kindly ask your questions before proceeding. Please ensure that there aren't any opened browsers when you are carrying out the procedures below. Save the following instructions in Notepad as this webpage would not be available when you're carrying out the fix. IT IS IMPORTANT THAT YOU DON'T MISS A STEP & PERFORM EVERYTHING IN THE RIGHT ORDER. ================== Open notepad and copy/paste the text in the code box below into it: Code:
File::
C:\WINDOWS\system32\d3d9caps.dat
C:\WINDOWS\system32\ngsh35.dll
C:\WINDOWS\system\sngsh35.dll
C:\WINDOWS\system32\ngsh40.dll
C:\WINDOWS\Sngsh40.dll
C:\WINDOWS\system32\awvvv.dll
Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{279A1B41-6CAC-4ABF-B39C-72C8E489F685}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{7D9CB362-375B-4FB9-8024-E55079CC69D1}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{EA5159DF-E413-4878-8AE2-D921D41BB942}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"sms_msn40"=-
"sms_msn"=-
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ArtChk"= -
 Refering to the picture above, drag CFScript.txt into ComboFix.exe When finished, it shall produce a log for you, C:\ComboFix.txt. Post that log in your next reply. Note: Do not mouseclick combofix's window whilst it's running. That may cause it to stall =============================== Establish an internet connection & perform an online scan with Internet Explorer at Kaspersky Online Scanner Answer Yes, when prompted to install an ActiveX component.
Note for Internet Explorer 7 users: If at any time you have trouble with the accept button of the licence, click on the Zoom tool located at the right bottom of the IE window and set the zoom to 75 %. Once the license accepted, reset to 100%. ================= Please Run a scan with HiJackThis and save the log ================= In your next post, please include fresh logs from:
|
|
|
|
|
10-24-2007, 12:02 AM
|
#7 (permalink) |
|
Registered User
Join Date: Mar 2006
Posts: 12
OS: WinXP
|
Re: Worm-cmd.com? Need help. :(
Hiyas, alba. Thanks for your patience. That scan took...2:22 minutes, would have posted sooner of possible. :) Shows...5490 infected files and 15 virsues. Crazy. Many I have no clue what they are or most. I also did not know what the two files you mentioned are. Here are the logs: Online Scan is attached;
HijackThis: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 12:54:06 AM, on 10/24/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Firebird\Firebird_1_5\bin\fbguard.exe C:\WINDOWS\System32\nvsvc32.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Linksys Wireless-G PCI Network Adapter with SpeedBooster\WLService.exe C:\Program Files\Linksys Wireless-G PCI Network Adapter with SpeedBooster\WMP54GSv1_1.exe C:\Program Files\Firebird\Firebird_1_5\bin\fbserver.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\wscntfy.exe C:\Program Files\iTunes\iTunesHelper.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Logitech\SetPoint\SetPoint.exe C:\Program Files\Common Files\Logitech\khalshared\KHALMNPR.EXE C:\WINDOWS\System32\svchost.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\SecondLife\SecondLife.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\WINDOWS\system32\drwtsn32.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll O2 - BHO: (no name) - {7D9CB362-375B-4FB9-8024-E55079CC69D1}" - (no file) O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] "C:\Program Files\Common Files\Logitech\khalshared\KHALMNPR.EXE" O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [QuickTime Task] "D:\qttask.exe" -atboottime O4 - HKLM\..\Run: [NVMixerTray] "C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe" O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "D:\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Logitech SetPoint.lnk = ? O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english...an_unicode.cab O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/pr02...s/MSNPUpld.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/wind...?1190591394218 O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - C:\Program Files\Ares\chatServer.exe O23 - Service: Firebird Guardian - DefaultInstance (FirebirdGuardianDefaultInstance) - The Firebird Project - C:\Program Files\Firebird\Firebird_1_5\bin\fbguard.exe O23 - Service: Firebird Server - DefaultInstance (FirebirdServerDefaultInstance) - The Firebird Project - C:\Program Files\Firebird\Firebird_1_5\bin\fbserver.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: WMP54GSSVC - GEMTEKS - C:\Program Files\Linksys Wireless-G PCI Network Adapter with SpeedBooster\WLService.exe -- End of file - 6074 bytes ComboFix: ComboFix 07-10-23.1 - Charlie 2007-10-23 12:43:51.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1455 [GMT -5:00] Running from: C:\Documents and Settings\Charlie\Desktop\ComboFix.exe * Created a new restore point . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Program Files\ComPlus Applications\profsyxyrti.html C:\Program Files\MSN\hokeqo4444.dll C:\Program Files\MSN\hokeqo83122.dll C:\Program Files\outlook C:\Program Files\outlook\p.zip C:\Temp\1cb C:\Temp\1cb\syscheck.log C:\Temp\fCOe C:\Temp\fCOe\tOasF.log C:\temp\tn3 C:\WINDOWS\b122.exe C:\WINDOWS\system32\awvvv.dll C:\WINDOWS\system32\bszip.dll C:\WINDOWS\system32\cbxvwuv.dll C:\WINDOWS\system32\cmd.com C:\WINDOWS\system32\drivers\core.cache.dsk C:\WINDOWS\system32\drivers\core.sys C:\WINDOWS\system32\netstat.com C:\WINDOWS\system32\oTt04e C:\WINDOWS\system32\oTt04e\oTt04e1080.exe C:\WINDOWS\system32\pac.txt C:\WINDOWS\system32\ping.com C:\WINDOWS\system32\regedit.com C:\WINDOWS\system32\taskkill.com C:\WINDOWS\system32\tasklist.com C:\WINDOWS\system32\tracert.com C:\WINDOWS\system32\vvvwa.bak1 C:\WINDOWS\system32\vvvwa.ini C:\WINDOWS\tsitra1000106.exe C:\WINDOWS\tsitra1000140.exe C:\WINDOWS\TTC-4444.exe . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\LEGACY_CMDSERVICE -------\LEGACY_CORE -------\LEGACY_NETWORK_MONITOR -------\cmdService -------\core ((((((((((((((((((((((((( Files Created from 2007-09-23 to 2007-10-23 ))))))))))))))))))))))))))))))) . 2007-10-23 12:42 51,200 --a------ C:\WINDOWS\NirCmd.exe 2007-10-22 02:20 664 --a------ C:\WINDOWS\system32\d3d9caps.dat 2007-10-20 19:10 <DIR> d-------- C:\Program Files\BitTorrent Absolute Downloader 2007-10-20 19:10 81,977 --a------ C:\WINDOWS\system32\ngsh35.dll 2007-10-20 19:10 81,977 --a------ C:\WINDOWS\system\sngsh35.dll 2007-10-20 19:10 65,593 --a------ C:\WINDOWS\system32\ngsh40.dll 2007-10-20 19:10 65,593 --a------ C:\WINDOWS\Sngsh40.dll 2007-10-20 19:10 49,152 --a------ C:\WINDOWS\system32\RegClass.dll 2007-10-20 19:10 28,672 --a------ C:\WINDOWS\system32\ngpw40.exe 2007-10-20 19:10 28,672 --a------ C:\WINDOWS\sngpw40.exe 2007-10-20 19:10 20,480 --a------ C:\WINDOWS\system32\sms_msn.exe 2007-10-20 19:10 16,384 --a------ C:\WINDOWS\system32\sms_msn40.exe 2007-10-20 12:56 584,192 -----c--- C:\WINDOWS\system32\dllcache\rpcrt4.dll 2007-10-20 12:50 <DIR> d-------- C:\Program Files\SpywareBlaster 2007-10-20 12:50 118,784 --a------ C:\WINDOWS\system32\MSSTDFMT.DLL 2007-10-20 11:37 <DIR> d-------- C:\WINDOWS\system32\ActiveScan 2007-10-20 11:22 <DIR> d-------- C:\Program Files\Trend Micro 2007-10-20 10:45 102,664 --a------ C:\WINDOWS\system32\drivers\tmcomm.sys 2007-10-20 02:18 <DIR> d-------- C:\Temp 2007-10-20 01:40 <DIR> d-------- C:\Program Files\Common Files\Adobe Systems Shared 2007-09-30 13:03 462,848 --a------ C:\WINDOWS\system32\ltkrn13n.dll 2007-09-30 13:03 450,560 --a------ C:\WINDOWS\system32\ltimg13n.dll 2007-09-30 13:03 401,408 --a------ C:\WINDOWS\system32\lfcmp13n.dll 2007-09-30 13:03 299,008 --a------ C:\WINDOWS\system32\ltdis13n.dll 2007-09-30 13:03 206,336 --a------ C:\WINDOWS\system32\ltefx13n.dll 2007-09-30 13:03 163,840 --a------ C:\WINDOWS\system32\ltfil13n.dll 2007-09-30 13:03 159,744 --a------ C:\WINDOWS\system32\lfpng13n.dll 2007-09-30 13:03 69,632 --a------ C:\WINDOWS\system32\lfgif13n.dll 2007-09-30 13:03 57,344 --a------ C:\WINDOWS\system32\lfbmp13n.dll 2007-09-27 21:07 <DIR> d-------- C:\Documents and Settings\Charlie\Application Data\dvdcss 2007-09-23 18:58 221,184 --a------ C:\WINDOWS\system32\wmpns.dll . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2007-10-23 07:46 --------- d-----w C:\Documents and Settings\Charlie\Application Data\LimeWire 2007-10-22 07:46 --------- d-----w C:\Program Files\Linksys Wireless-G PCI Network Adapter with SpeedBooster 2007-10-22 07:45 --------- d-----w C:\Program Files\iTunes 2007-10-21 01:27 --------- d-----w C:\Documents and Settings\Charlie\Application Data\Skype 2007-10-20 16:57 --------- d-----w C:\Program Files\MSN Messenger 2007-10-20 06:55 --------- d--h--w C:\Program Files\InstallShield Installation Information 2007-10-20 06:41 --------- d-----w C:\Program Files\Common Files\Adobe 2007-10-07 20:42 --------- d-----w C:\Documents and Settings\Charlie\Application Data\Apple Computer 2007-10-07 03:46 --------- d-----w C:\Program Files\Sociolotron 2007-09-23 01:23 --------- d-----w C:\Program Files\Google 2007-09-21 15:23 --------- d-----w C:\Program Files\Summitsoft 2007-09-21 04:14 --------- d-----w C:\Program Files\Xvid 2007-09-21 04:11 --------- d-----w C:\Program Files\Apple Software Update 2007-09-21 02:37 59,994 ----a-w C:\Program Files\SAMBC.core.xml 2007-09-21 02:37 544 ----a-w C:\Program Files\SAMBC.ini 2007-09-21 02:37 395 ----a-w C:\Program Files\SAMBC.gui.xml 2007-09-21 02:37 367,942 ----a-w C:\Program Files\EventLog.log 2007-09-09 15:43 --------- d-----w C:\Program Files\SecondLife 2007-09-08 17:53 --------- d-----w C:\Documents and Settings\Charlie\Application Data\SecondLife 2007-08-05 17:12 29,399 ----a-w C:\Documents and Settings\Charlie\Application Data\Pamela_Crash_46B604E1.zip 2007-01-06 02:29 33,118 ----a-w C:\Program Files\uninstall.exe 2005-12-07 12:48 4,573,184 ----a-w C:\Program Files\SAMBC.exe 2005-08-04 17:26 10,136 -c--a-w C:\Program Files\license.txt 2005-07-20 22:24 348,510,372 ----a-w C:\Program Files\setup.exe 2004-12-12 16:05 1,523,796 ----a-w C:\Program Files\fbclient.dll 2004-10-19 06:53 25,014 ----a-w C:\Program Files\splash_bc.jpg 2004-10-17 15:11 213 -c--a-w C:\Program Files\restore_firebird.bat 2004-07-13 16:05 133 -c--a-w C:\Program Files\aliases.conf 2004-07-13 16:05 132,796 -c--a-w C:\Program Files\firebird.msg 2004-04-18 16:05 19,646 ----a-w C:\Program Files\firebird.conf 2000-08-28 18:19 401,462 ----a-w C:\Program Files\msvcp60.dll 2005-07-29 21:24:26 472 --sha-r C:\WINDOWS\V2lja2Vk\pZ53uZp4.vbs . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{279A1B41-6CAC-4ABF-B39C-72C8E489F685}] 2007-10-20 19:10 81977 --a------ C:\WINDOWS\system32\ngsh35.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{7D9CB362-375B-4FB9-8024-E55079CC69D1}"] SteelWerX Registry Console Tool 2.0 Written by Bobbi Flekman 2006 (C) Error: Key: clsid\{7d9cb362-375b-4fb9-8024-e55079cc69d1}\inprocserver32 /ve | sed /reg_.*:\\/!d;s/.*\t// does not exist! [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{EA5159DF-E413-4878-8AE2-D921D41BB942}] 2007-10-20 02:18 421888 --a------ C:\WINDOWS\system32\bkindiil.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="C:\WINDOWS\System32\NvCpl.dll" [2006-10-22 13:22] "nwiz"="nwiz.exe" [2006-10-22 13:22 C:\WINDOWS\system32\nwiz.exe] "Logitech Hardware Abstraction Layer"="C:\Program Files\Common Files\Logitech\khalshared\KHALMNPR.EXE" [2006-07-19 13:03] "Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2006-07-19 13:03 C:\WINDOWS\KHALMNPR.Exe] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-06-28 09:14] "QuickTime Task"="D:\qttask.exe" [2007-06-29 06:24] "NVMixerTray"="C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe" [2004-12-20 17:12] "Adobe Reader Speed Launcher"="D:\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 03:06] "sms_msn40"="C:\WINDOWS\system32\sms_msn40.exe" [2007-10-20 19:10] "sms_msn"="C:\WINDOWS\system32\sms_msn.exe" [2007-10-20 19:10] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 02:56] "MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-01-19 12:54] "ArtChk"="C:\WINDOWS\system32\artchker.exe" [2007-10-20 02:18] [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] "Authentication Packages"= msv1_0 C:\WINDOWS\system32\awvvv.dll R2 FirebirdGuardianDefaultInstance;Firebird Guardian - DefaultInstance;C:\Program Files\Firebird\Firebird_1_5\bin\fbguard.exe -s R2 LBeepKE;LBeepKE;C:\WINDOWS\system32\Drivers\LBeepKE.sys R3 FirebirdServerDefaultInstance;Firebird Server - DefaultInstance;C:\Program Files\Firebird\Firebird_1_5\bin\fbserver.exe -s R3 PhilCam8116;Logitech QuickCam Pro 3000(PID_08B0);C:\WINDOWS\system32\DRIVERS\CamDrL21.sys . Contents of the 'Scheduled Tasks' folder "2007-10-20 00:40:15 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job" . ************************************************************************** catchme 0.3.1232 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-10-23 12:48:25 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2007-10-23 12:49:01 - machine was rebooted . --- E O F --- |
|
|
|
|
10-24-2007, 10:16 AM
|
#8 (permalink) |
|
Analyst, Security Team
Join Date: Feb 2005
Location: Eire
Posts: 1,911
OS: Vista, Ubuntu 8.04
|
Re: Worm-cmd.com? Need help. :(
Hi You have posted the wrong combofix file, but as it is that is ok we need to run it again anyway, Go to your C:\ drive and delete any ComboFix.txt files that are there before we run it again that will save any confusion  ============================== Most of the infected files are in D:\Downloads\Shared\ I am afraid you will have to delete everything there. The safest way is to just to delete the folder and make a new one ============================= Open notepad and copy/paste the text in the code box below into it: Code:
File:: C:\WINDOWS\sngpw40.exe C:\WINDOWS\system32\ngpw40.exe C:\WINDOWS\system32\sms_msn.exe C:\WINDOWS\system32\sms_msn40.exe C:\WINDOWS\system32\stup3.exe C:\Documents and Settings\Charlie\Application Data\Pamela_Crash_46B604E1.zip Folder:: C:\WINDOWS\system32\cp1 C:\WINDOWS\system32\ib1 C:\WINDOWS\V2lja2Vk Refering to the picture above, drag CFScript.txt into ComboFix.exe When finished, it shall produce a log for you, C:\ComboFix.txt. Post that log in your next reply. Note: Do not mouseclick combofix's window whilst it's running. That may cause it to stall ============================================== We need to run a different online scanner but once you have deleted the Downloads folder it wont take as long hopefully Go here and do the BitDefender online virus scan.
================= Please Run a scan with HiJackThis and save the log ================= In your next post, please include fresh logs from:
|
