|
|
|
|
|||||
|
|
|
|
|
|
|||
| Welcome
to Tech Support Forum home to more then 136,000 problems solved. Issues
have included: Spyware, Malware, Virus Issues, Windows, Microsoft,
Linux, Networking, Security, Hardware, and Gaming Getting your
problem solved is as easy as: 1. Registering for a free account 2. Asking your question 3. Receiving an answer Registered members: * See fewer ads. * And much more..
|
| Want to know how to post a question? click here | Having problems with spyware and pop-ups? First Steps |
|
|||||||
| Resolved HJT Threads Resolved spyware and popup issues. |
|
|
Thread Tools |
06-27-2008, 05:58 PM
|
#1 (permalink) |
|
Registered User
Join Date: Jun 2008
Posts: 10
OS: Windows XP
|
Malware Downloaded to my System - DeeWoo, OuterInfo, CoolWebSearch plus others
Hey All,
I was on a joke website and I don't know if my Active X was enabled or if I clicked on an ad pop up when I was trying to close it, but something happened and I was swamped with some nasty programs. Desktop background changed to "spyware found", the computer tries to start up Internet Explorer and head to advertisements and other sites, registry setting was changed to prevent opening up Task Manager and the registry setting would change back if you tried to correct it. When I finally got Task Manager up, things like 444.470, rundll32.exe, iedll.exe, iexplore.exe and others were running. I quickly unplugged my network cable and I ran the free AdAware version that I have on my machine and it found some stuff, but didn't clean everything. I removed some tax information that I have on my machine to a flash drive. WARNING---Since this was my first infestation and before I knew I was in over my head and found your website, I attempted to clean up my machine myself. I knew the date and time I was infected and could tell what files were modified at that time, so I knew they were bad programs. If it is helpful, I can provide a list of the filenames modified at the time of infestation from the C:\Windows and C:\Windows\System32 directory. I deleted a couple and they reappeared shortly after, so I then created blank text files, renamed them to the bad file name executable and put them into the C:\Windows and C:\Windows\System32 directory. That way the virus wouldn't try to create them again, since it thought the bad files were there. I only did this for about 10 or so files before I realized that they might be tied to my OS and I could be doing some damage. I actually have most of the original bad files zipped up and saved on a flash drive, so I can put most of them back if that is the best thing to do. Then I found your website and followed the steps: STEP 1 -- please see paragraph above, I tried to disinfect myself before knowing what was up. I still have most of the files, should I put them back and run DSS.exe again? STEP 2 Panda seemed to hang when I tried to disinfect. Deckard's System Scanner v20071014.68 Run by Owner on 2008-06-27 19:10:39 Computer is in Normal Mode. -------------------------------------------------------------------------------- -- System Restore -------------------------------------------------------------- Successfully created a Deckard's System Scanner Restore Point. -- Last 5 Restore Point(s) -- 67: 2008-06-28 00:11:01 UTC - RP802 - Deckard's System Scanner Restore Point 66: 2008-06-26 23:11:41 UTC - RP801 - Removed Norton Security Center 65: 2008-06-26 01:02:01 UTC - RP800 - System Checkpoint 64: 2008-06-25 00:02:01 UTC - RP799 - System Checkpoint 63: 2008-06-23 23:02:01 UTC - RP798 - System Checkpoint -- First Restore Point -- 1: 2008-06-19 19:19:15 UTC - RP736 - System Checkpoint Backed up registry hives. Performed disk cleanup. Total Physical Memory: 495 MiB (512 MiB recommended). -- HijackThis Clone ------------------------------------------------------------ Emulating logfile of Trend Micro HijackThis v2.0.2 Scan saved at 2008-06-27 19:16:11 Platform: Windows XP Service Pack 2 (5.01.2600) MSIE: Internet Explorer (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\system32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\LEXPPS.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS C:\WINDOWS\system32\svchost.exe C:\Program Files\Canon\CAL\CALMAIN.exe C:\WINDOWS\explorer.exe C:\Program Files\Digital Media Reader\shwiconEM.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\system32\igfxtray.exe C:\WINDOWS\system32\hkcmd.exe C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe C:\Program Files\QuickTime\QTTask.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\Common Files\??curity\ping.exe C:\Program Files\Southwest Airlines\Ding\Ding.exe C:\Program Files\WinZip\WZQKPICK.EXE C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe C:\Program Files\iPod\bin\iPodService.exe C:\WINDOWS\?ymantec\r?gsvr32.exe C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\rundll32.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Documents and Settings\Owner\Desktop\dss.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.google.com/ie R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/ R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.google.com/search?q=%s R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.goole.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com/ie R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie R1 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\iftuyszv.exe, O2 - BHO: {142c4fb9-8f65-0a0b-b1d4-fc1d4f0aca52} - {25aca0f4-d1cf-4d1b-b0a0-56f89bf4c241} - C:\WINDOWS\system32\ezmjvd.dll O2 - BHO: (no name) - {9C28EAFB-FF50-4F42-8D39-A006129CC907} - C:\WINDOWS\system32\pmnmMGVo.dll O2 - BHO: (no name) - {A43CA8C3-8FAD-42CE-B06C-3CD1EBA7BBC8} - C:\WINDOWS\system32\ljJBqopo.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\GoogleToolbar3.dll O2 - BHO: (no name) - {AE66B448-22AE-0C57-AA38-09A2919B49B5} - C:\WINDOWS\system32\zqb.dll (file missing) O2 - BHO: (no name) - {F833ED4C-26FF-0301-FF38-09A2919B43B4} - C:\WINDOWS\system32\fizywppd.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\GoogleToolbar3.dll O4 - HKLM\..\Run: [SunKistEM] C:\Program Files\Digital Media Reader\shwiconem.exe O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" O4 - HKLM\..\Run: [Recguard] %WINDIR%\SMINST\RECGUARD.EXE O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [{6C-C6-63-3D-DW}] C:\windows\system32\vlwnw64.exe DWram1 O4 - HKLM\..\Run: [ExploreUpdSched] C:\WINDOWS\system32\mcntmadm.exe DWram1 O4 - HKLM\..\Run: [AntiSpywareMaster] C:\Program Files\AntiSpywareMaster\asm.exe O4 - HKLM\..\Run: [msci] C:\DOCUME~1\Owner\LOCALS~1\Temp\2008626181022_mcinfo.exe /insfin O4 - HKLM\..\Run: [Cleanup] C:\DOCUME~1\Owner\LOCALS~1\Temp\2008626181034_mcappins.exe /v=3 /cleanup O4 - HKLM\..\Run: [a846c692] rundll32.exe "C:\WINDOWS\system32\gwshqhfj.dll",b O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.0.720.3640\GoogleToolbarNotifier.exe O4 - HKCU\..\Run: [Cpue] "C:\PROGRA~1\COMMON~1\CURITY~1\ping.exe" -vt yazb O4 - HKCU\..\Run: [Nvqfoa] C:\WINDOWS\?ymantec\r?gsvr32.exe O4 - Startup: Picture Motion Browser Media Check Tool.lnk = ? O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: DING!.lnk = C:\Program Files\Southwest Airlines\Ding\Ding.exe O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE O7 - HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableTaskMgr=1 O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - CmdMapping - (file missing) O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - (file missing) O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (file missing) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O15 - Trusted Zone: *.avsystemcare.com (HKLM) O15 - Trusted Zone: *.gomyhit.com (HKLM) O15 - Trusted Zone: *.imageservr.com (HKLM) O15 - Trusted Zone: *.imagesrvr.com (HKLM) O15 - Trusted Zone: *.onerateld.com (HKLM) O15 - Trusted Zone: *.safetydownload.com (HKLM) O15 - Trusted Zone: *.storageguardsoft.com (HKLM) O15 - Trusted Zone: *.trustedantivirus.com (HKLM) O15 - Trusted Zone: *.virusschlacht.com (HKLM) O15 - Trusted Zone: https://*.update.microsoft.com (HKCU) O15 - Trusted Zone: http://*.update.microsoft.com (HKCU) O15 - Trusted Zone: https://update.microsoft.com (HKCU) O15 - Trusted Zone: http://update.microsoft.com (HKCU) O15 - Trusted Zone: http://download.windowsupdate.com (HKCU) O16 - DPF: {7584C670-2274-4EFB-B00B-D6AABA6D3850} (Microsoft RDP Client Control (redist)) - https://remote.schwab.com/svordp/,Da....com+msrdp.cab O16 - DPF: {E5F5D008-DD2C-4D32-977D-1A0ADF03058B} (JuniperSetupSP1 Control) - https://remote.schwab.com/dana-cache...erSetupSP1.cab O18 - Protocol: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll O18 - Protocol: mso-offdap - {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Program Files\Common Files\Microsoft Shared\Web Components\10\OWC10.DLL O18 - Protocol: mso-offdap11 - {32505114-5902-49B2-880A-1F7738E5A384} - C:\Program Files\Common Files\Microsoft Shared\Web Components\11\OWC11.DLL O18 - Filter: text/xml - {807553E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL O20 - Winlogon Notify: pmnmMGVo - C:\WINDOWS\system32\pmnmMGVo.dll O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE O23 - Service: MsSecurity Updated (MsSecurity1.209.4) - Unknown owner - C:\WINDOWS\444.470 O23 - Service: PrismXL - New Boundary Technologies, Inc. - C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS -- End of file - 8691 bytes -- File Associations ----------------------------------------------------------- All associations okay. -- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------- R1 rdbsss - c:\windows\system32\drivers\rdbsss.sys R2 ASCTRM - c:\windows\system32\drivers\asctrm.sys <Not Verified; Windows (R) 2000 DDK provider; Windows (R) 2000 DDK driver> R3 SunkFilt (Alcor Micro Corp Reader) - c:\windows\system32\drivers\sunkfilt.sys <Not Verified; Alcor Micro Corp.; SunkFilt> S3 wanatw (WAN Miniport (ATW)) - c:\windows\system32\drivers\wanatw4.sys (file missing) -- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled -------------------- R2 Apple Mobile Device - "c:\program files\common files\apple\mobile device support\bin\applemobiledeviceservice.exe" <Not Verified; Apple, Inc.; Apple Mobile Device Service> R2 CCALib8 (Canon Camera Access Library 8) - c:\program files\canon\cal\calmain.exe <Not Verified; Canon Inc.; > S2 MsSecurity1.209.4 (MsSecurity Updated) - c:\windows\444.470 service -- Device Manager: Disabled ---------------------------------------------------- No disabled devices found. -- Scheduled Tasks ------------------------------------------------------------- 2008-06-24 09:01:03 284 --a------ C:\WINDOWS\Tasks\AppleSoftwareUpdate.job 2005-07-01 13:37:53 258 --a------ C:\WINDOWS\Tasks\ISP signup reminder 3.job 2005-07-01 13:37:52 258 --a------ C:\WINDOWS\Tasks\ISP signup reminder 1.job -- Files created between 2008-05-27 and 2008-06-27 ----------------------------- 2008-06-27 18:53:07 0 d-------- C:\ie-spyad_zo 2008-06-27 18:48:44 0 d-------- C:\Documents and Settings\All Users\Application Data\TEMP 2008-06-27 18:48:01 0 d-------- C:\Program Files\SpywareBlaster 2008-06-27 18:47:11 322518 --a------ C:\ie-spyad_zo.exe 2008-06-27 18:47:10 0 d-------- C:\ZonedOut 2008-06-27 12:10:08 81920 --a------ C:\WINDOWS\system32\gwshqhfj.dll 2008-06-27 12:10:06 103424 --a------ C:\WINDOWS\system32\ezmjvd.dll 2008-06-27 12:10:05 103424 --a------ C:\WINDOWS\system32\kxyrauit.dll 2008-06-27 12:09:58 90624 --a------ C:\WINDOWS\system32\tuqxayem.dll 2008-06-27 12:07:00 80384 -----n--- C:\WINDOWS\system32\ripfuneu.dll 2008-06-27 11:54:57 80384 -----n--- C:\WINDOWS\system32\iinxhwus.dll 2008-06-27 11:51:57 80384 -----n--- C:\WINDOWS\system32\ymuqhcyw.dll 2008-06-27 10:51:57 80384 -----n--- C:\WINDOWS\system32\iluimpbh.dll 2008-06-27 10:48:57 80384 -----n--- C:\WINDOWS\system32\afimyjyx.dll 2008-06-27 09:48:57 80384 -----n--- C:\WINDOWS\system32\wqxtbyho.dll 2008-06-27 09:45:57 80384 -----n--- C:\WINDOWS\system32\kqnpnaxw.dll 2008-06-27 08:45:57 80384 -----n--- C:\WINDOWS\system32\gpvrirtf.dll 2008-06-27 08:42:57 80384 -----n--- C:\WINDOWS\system32\idkmpgtj.dll 2008-06-27 07:59:50 0 d-------- C:\WINDOWS\LastGood 2008-06-27 07:59:27 0 d-------- C:\Program Files\Panda Security 2008-06-27 07:51:29 60928 --a------ C:\WINDOWS\system32\fizywppd.dll 2008-06-27 07:51:29 0 d-------- C:\Program Files\??sks 2008-06-27 07:43:00 80384 -----n--- C:\WINDOWS\system32\lkvmdvev.dll 2008-06-27 07:40:00 80384 -----n--- C:\WINDOWS\system32\rsmktqjh.dll 2008-06-27 06:40:00 80384 -----n--- C:\WINDOWS\system32\mpdsoqvj.dll 2008-06-27 06:37:00 80384 -----n--- C:\WINDOWS\system32\exaoypoq.dll 2008-06-27 05:37:00 80384 -----n--- C:\WINDOWS\system32\suqlhwwk.dll 2008-06-27 05:34:00 80384 -----n--- C:\WINDOWS\system32\emipobkh.dll 2008-06-27 04:34:00 80384 -----n--- C:\WINDOWS\system32\qkyabsui.dll 2008-06-27 04:31:00 80384 -----n--- C:\WINDOWS\system32\faqfwoex.dll 2008-06-27 03:31:00 80384 -----n--- C:\WINDOWS\system32\jlmbjknx.dll 2008-06-27 03:28:00 80384 -----n--- C:\WINDOWS\system32\jereqvjl.dll 2008-06-27 02:28:00 80384 -----n--- C:\WINDOWS\system32\spbbqyhj.dll 2008-06-27 02:25:00 80384 -----n--- C:\WINDOWS\system32\etshehwl.dll 2008-06-27 01:25:00 80384 -----n--- C:\WINDOWS\system32\toatfsxa.dll 2008-06-27 01:22:00 80384 -----n--- C:\WINDOWS\system32\urthgnjr.dll 2008-06-27 00:22:00 80384 -----n--- C:\WINDOWS\system32\qxtcwtsu.dll 2008-06-27 00:19:00 80384 -----n--- C:\WINDOWS\system32\asukqthd.dll 2008-06-26 23:19:00 80384 -----n--- C:\WINDOWS\system32\qhyjiigt.dll 2008-06-26 23:16:00 80384 -----n--- C:\WINDOWS\system32\vnyiwcmk.dll 2008-06-26 22:16:00 80384 -----n--- C:\WINDOWS\system32\hiemqgyf.dll 2008-06-26 22:13:00 80384 -----n--- C:\WINDOWS\system32\xcmqrchp.dll 2008-06-26 21:38:16 0 d-------- C:\Bad 2008-06-26 21:13:00 80384 -----n--- C:\WINDOWS\system32\wywbthpe.dll 2008-06-26 21:10:00 80384 -----n--- C:\WINDOWS\system32\pcyeqipk.dll 2008-06-26 20:10:00 80384 -----n--- C:\WINDOWS\system32\rqnhjfwq.dll 2008-06-26 20:07:00 80384 -----n--- C:\WINDOWS\system32\yheiplvd.dll 2008-06-26 19:07:00 80384 -----n--- C:\WINDOWS\system32\sbgdayqb.dll 2008-06-26 19:04:00 80384 -----n--- C:\WINDOWS\system32\imgwtgkn.dll 2008-06-26 18:04:00 80384 -----n--- C:\WINDOWS\system32\nielyqsq.dll 2008-06-26 18:01:00 80384 -----n--- C:\WINDOWS\system32\yhqlpwhd.dll 2008-06-26 18:00:27 80384 -----n--- C:\WINDOWS\system32\khvipnnn.dll 2008-06-22 15:10:00 80384 -----n--- C:\WINDOWS\system32\vwgpsbed.dll 2008-06-21 20:43:00 0 --a------ C:\WINDOWS\olehelp.exe 2008-06-21 15:07:13 80384 -----n--- C:\WINDOWS\system32\wrauqwvk.dll 2008-06-19 18:51:30 0 --a------ C:\WINDOWS\msupdate.exe 2008-06-19 14:26:38 0 --a------ C:\WINDOWS\y.exe 2008-06-19 14:26:38 0 --a------ C:\WINDOWS\xplugin.dll 2008-06-19 14:26:37 0 --a------ C:\WINDOWS\x.exe 2008-06-19 14:26:37 20224 --a------ C:\WINDOWS\winmgnt.exe 2008-06-19 14:26:37 19712 --a------ C:\WINDOWS\window.exe 2008-06-19 14:26:37 17408 --a------ C:\WINDOWS\winajbm.dll 2008-06-19 14:26:37 18432 --a------ C:\WINDOWS\win64.exe 2008-06-19 14:26:37 27648 --a------ C:\WINDOWS\win32e.exe 2008-06-19 14:26:36 26368 --a------ C:\WINDOWS\waol.exe 2008-06-19 14:26:36 25344 --a------ C:\WINDOWS\users32.exe 2008-06-19 14:26:36 23296 --a------ C:\WINDOWS\time.exe 2008-06-19 14:26:36 32000 --a------ C:\WINDOWS\systemcritical.exe 2008-06-19 14:26:35 12288 --a------ C:\WINDOWS\systeem.exe 2008-06-19 14:26:35 27392 --a------ C:\WINDOWS\svcinit.exe 2008-06-19 14:26:35 26624 --a------ C:\WINDOWS\svchost32.exe 2008-06-19 14:26:35 19968 --a------ C:\WINDOWS\sistem.exe 2008-06-19 14:26:35 21248 --a------ C:\WINDOWS\searchword.dll 2008-06-19 14:26:34 28416 --a------ C:\WINDOWS\rundll16.exe 2008-06-19 14:26:34 21248 --a------ C:\WINDOWS\quicken.exe 2008-06-19 14:26:34 15872 --a------ C:\WINDOWS\qttasks.exe 2008-06-19 14:26:34 29952 --a------ C:\WINDOWS\notepad32.exe 2008-06-19 14:26:33 22784 --a------ C:\WINDOWS\mtwirl32.dll 2008-06-19 14:26:33 30720 --a------ C:\WINDOWS\mswsc20.dll 2008-06-19 14:26:33 10752 --a------ C:\WINDOWS\mswsc10.dll 2008-06-19 14:26:33 24064 --a------ C:\WINDOWS\msspi.dll 2008-06-19 14:26:32 28416 --a------ C:\WINDOWS\msconfd.dll 2008-06-19 14:26:32 9216 --a------ C:\WINDOWS\loader.exe 2008-06-19 14:26:32 15104 --a------ C:\WINDOWS\internet.exe 2008-06-19 14:26:32 20992 --a------ C:\WINDOWS\inetinf.exe 2008-06-19 14:26:32 0 --a------ C:\WINDOWS\iexplorer.exe 2008-06-19 14:26:32 0 --a------ C:\WINDOWS\iedll.exe 2008-06-19 14:26:32 25344 --a------ C:\WINDOWS\helpcvs.exe 2008-06-19 14:26:31 15360 --a------ C:\WINDOWS\gfmnaaa.dll 2008-06-19 14:26:31 22272 --a------ C:\WINDOWS\funny.exe 2008-06-19 14:26:31 29696 --a------ C:\WINDOWS\funniest.exe 2008-06-19 14:26:31 22272 --a------ C:\WINDOWS\explorer32.exe 2008-06-19 14:26:31 30208 --a------ C:\WINDOWS\explore.exe 2008-06-19 14:26:30 24320 --a------ C:\WINDOWS\editpad.exe 2008-06-19 14:26:30 23808 --a------ C:\WINDOWS\dnsrelay.dll 2008-06-19 14:26:30 16128 --a------ C:\WINDOWS\directx32.exe 2008-06-19 14:26:30 29696 --a------ C:\WINDOWS\ctrlpan.dll 2008-06-19 14:26:29 27904 --a------ C:\WINDOWS\ctfmon32.exe 2008-06-19 14:26:29 25600 --a------ C:\WINDOWS\cpan.dll 2008-06-19 14:26:29 21760 --a------ C:\WINDOWS\clrssn.exe 2008-06-19 14:26:28 29184 --a------ C:\WINDOWS\avpcc.dll 2008-06-19 14:26:28 19456 --a------ C:\WINDOWS\accesss.exe 2008-06-19 14:24:52 0 --a------ C:\WINDOWS\system32\vlwnw64.exe 2008-06-19 14:24:32 0 d-------- C:\Documents and Settings\LocalService\Application Data\NetMon 2008-06-19 14:21:13 80384 -----n--- C:\WINDOWS\system32\bdvwoipr.dll 2008-06-19 14:20:57 25088 --a------ C:\WINDOWS\system32\byXPFXrR.dll 2008-06-19 14:19:00 670785 --ahs---- C:\WINDOWS\system32\opoqBJjl.ini2 2008-06-19 14:18:49 322048 --a------ C:\WINDOWS\system32\ljJBqopo.dll 2008-06-19 14:14:37 0 d-------- C:\Documents and Settings\NetworkService\Application Data\Macromedia 2008-06-19 14:14:25 0 --a------ C:\WINDOWS\system32\winpfz33.sys 2008-06-19 14:14:20 0 d-------- C:\Program Files\Outerinfo 2008-06-19 14:14:19 0 d-------- C:\WINDOWS\?ymantec 2008-06-19 14:14:18 0 dr------- C:\Documents and Settings\NetworkService\Favorites 2008-06-19 14:14:13 0 --a------ C:\WINDOWS\system32\mcntmadm.exe 2008-06-19 14:14:12 0 --a------ C:\WINDOWS\system32\hljwugsf.bin 2008-06-19 14:14:05 0 d-------- C:\Documents and Settings\NetworkService\Application Data\NetMon 2008-06-19 14:14:00 0 --a------ C:\WINDOWS\system32\iftuyszv.exe 2008-06-19 14:14:00 88537 --a------ C:\WINDOWS\lfn.exe <Not Verified; Microsoft; XML Media> 2008-06-19 14:13:59 1989 --a------ C:\WINDOWS\uninstall_nmon.vbs 2008-06-19 14:13:58 0 d--hs---- C:\WINDOWS\IA 2008-06-19 14:13:57 0 --a------ C:\WINDOWS\system32\rwwnw64d.exe 2008-06-19 14:13:53 0 --a------ C:\WINDOWS\mrofinu1000106.exe 2008-06-19 14:13:50 86144 -----n--- C:\WINDOWS\system32\drivers\rdbsss.sys 2008-06-19 14:13:46 0 --a------ C:\WINDOWS\mrofinu572.exe 2008-06-19 14:13:45 0 d-------- C:\WINDOWS\system32\eb10 2008-06-19 14:13:45 0 d-------- C:\WINDOWS\system32\bgi 2008-06-19 14:13:45 0 d-------- C:\WINDOWS\system32\axc 2008-06-19 14:13:45 0 d-------- C:\WINDOWS\system32\1049a 2008-06-19 14:13:44 41723 ---hs---- C:\Program Files\Common Files\Yazzle1281OinUninstaller.exe 2008-06-19 14:13:43 0 d-------- C:\Program Files\Common Files\??curity 2008-06-19 14:13:37 0 d-------- C:\WINDOWS\system32\netrax01 2008-06-19 14:13:35 25088 --a------ C:\WINDOWS\system32\pmnmMGVo.dll 2008-06-07 10:29:30 0 d-------- C:\Ray Pure Genius Doubles -- Find3M Report --------------------------------------------------------------- 2008-06-27 07:51:29 0 d-------- C:\Program Files\??sks 2008-06-26 18:12:27 0 d-------- C:\Program Files\Common Files\Symantec Shared 2008-06-19 14:13:44 0 d-------- C:\Program Files\Common Files 2008-06-19 14:13:44 0 d-------- C:\Program Files\Common Files\??curity 2008-06-19 13:32:22 0 d-------- C:\Documents and Settings\Owner\Application Data\Juniper Networks 2008-06-11 20:16:09 0 d-------- C:\Documents and Settings\Owner\Application Data\Move Networks 2008-06-07 20:12:10 0 d-------- C:\Program Files\Common Files\Adobe 2008-06-07 20:10:22 0 d-------- C:\Documents and Settings\Owner\Application Data\AdobeUM -- Registry Dump --------------------------------------------------------------- *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{25aca0f4-d1cf-4d1b-b0a0-56f89bf4c241}] 06/27/2008 12:10 PM 103424 --a------ C:\WINDOWS\system32\ezmjvd.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{9C28EAFB-FF50-4F42-8D39-A006129CC907}] 06/19/2008 02:13 PM 25088 --a------ C:\WINDOWS\system32\pmnmMGVo.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A43CA8C3-8FAD-42CE-B06C-3CD1EBA7BBC8}] 06/19/2008 02:18 PM 322048 --a------ C:\WINDOWS\system32\ljJBqopo.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{AE66B448-22AE-0C57-AA38-09A2919B49B5}] C:\WINDOWS\system32\zqb.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F833ED4C-26FF-0301-FF38-09A2919B43B4}] 05/29/2008 01:34 PM 60928 --a------ C:\WINDOWS\system32\fizywppd.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SunKistEM"="C:\Program Files\Digital Media Reader\shwiconem.exe" [11/15/2004 05:04 PM] "@"="" [] "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [07/09/2001 01:50 PM] "IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [08/20/2004 05:55 PM] "HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [08/20/2004 05:51 PM] "RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [11/02/2004 10:24 PM] "Recguard"="%WINDIR%\SMINST\RECGUARD.EXE" [] "Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" [06/07/2005 12:46 AM] "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [03/28/2008 11:37 PM] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [03/30/2008 10:36 AM] "{6C-C6-63-3D-DW}"="C:\windows\system32\vlwnw64.exe" [06/21/2008 04:13 PM] "ExploreUpdSched"="C:\WINDOWS\system32\mcntmadm.exe" [06/21/2008 03:53 PM] "AntiSpywareMaster"="C:\Program Files\AntiSpywareMaster\asm.exe" [] "msci"="C:\DOCUME~1\Owner\LOCALS~1\Temp\2008626181022_mcinfo.exe" [] "Cleanup"="C:\DOCUME~1\Owner\LOCALS~1\Temp\2008626181034_mcappins.exe" [] "a846c692"="C:\WINDOWS\system32\gwshqhfj.dll" [06/27/2008 12:10 PM] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [10/13/2004 11:24 AM] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\1.0.720.3640\GoogleToolbarNotifier.exe" [] "Cpue"="C:\PROGRA~1\COMMON~1\CURITY~1\ping.exe" [06/19/2008 02:13 PM] "Nvqfoa"="C:\WINDOWS\?ymantec\r?gsvr32.exe" [05/29/2008 01:35 PM] C:\Documents and Settings\Owner\Start Menu\Programs\Startup\ Picture Motion Browser Media Check Tool.lnk - C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe [1/27/2008 3:11:43 PM] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [4/23/2008 3:38:16 AM] DING!.lnk - C:\Program Files\Southwest Airlines\Ding\Ding.exe [5/17/2005 2:22:42 PM] WinZip Quick Pick.lnk - C:\Program Files\WinZip\WZQKPICK.EXE [8/31/2006 10:09:25 PM] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "DisableTaskMgr"=1 (0x1) [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system] "DisableTaskMgr"=0 (0x0) [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] "{9C28EAFB-FF50-4F42-8D39-A006129CC907}"= C:\WINDOWS\system32\pmnmMGVo.dll [06/19/2008 02:13 PM 25088] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon] "Userinit"="C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\iftuyszv.exe," [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\pmnmMGVo] pmnmMGVo.dll 06/19/2008 02:13 PM 25088 C:\WINDOWS\system32\pmnmMGVo.dll [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] "Authentication Packages"= msv1_0 C:\WINDOWS\system32\ljJBqopo [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders] SecurityProviders msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll, ntoskrnl.dll [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{da41a284-a859-11dc-9488-0013204adce0}] AutoRun\command- L:\LaunchU3.exe -a *Newly Created Service* - APPMGMT *Newly Created Service* - RKPAVPROC -- End of Deckard's System Scanner: finished at 2008-06-27 19:17:46 ------------ |
|
     |
|
07-01-2008, 03:18 AM
|
#2 (permalink) |
|
Moderator, Analyst, Security Team
Join Date: Oct 2006
Location: Důn Čideann,Scotland.
Posts: 2,785
OS: XP
|
Re: Malware Downloaded to my System - DeeWoo, OuterInfo, CoolWebSearch plus others
Hello and welcome to TSF
Please subscribe to this thread to get immediate notification of replies as soon as they are posted. To do this click Thread Tools, then click Subscribe to this Thread. Make sure it is set to Instant Notification, then click Subscribe. ======== Please follow all instructions and in which order they come, if you have any questions, please ask before proceeding. Its important that you follow this through until i give you the all clear, a lack of symptoms does not mean that it is no longer present. Please Do Not Attach logs to your posts unless you are advised to do so. ======== Please print out or copy this page to Notepad in order to assist you when carrying out the following instructions. ======== Click > Start > Control Panel > Add / Remove Programs and uninstall the following programs (if they exist): Viewpoint Media Player<---Viewpoint is considered as foistware instead of malware since it is installed without users approval but doesn't spy or do anything "bad". This will change from what we know in 2006 read this article: http://www.clickz.com/news/article.php/3561546 Additional Information Here and Here Deewoo Network Manager removal ========= Download SDFix and save it to your Desktop. Double click SDFix.exe and it will extract the files to %systemdrive% (Drive that contains the Windows Directory, typically C:SDFix) Please then reboot your computer in Safe Mode by doing the following :
========== Please visit this webpage for instructions for downloading and running ComboFix: http://www.bleepingcomputer.com/comb...o-use-combofix Please ensure you read this guide carefully and install the Recovery Console first. The Windows Recovery Console will allow you to boot up into a special recovery mode. This allows us to help you in the case that your computer has a problem after an attempted removal of malware. It is a simple procedure that will only take a few moments of your time. Once the Recovery Console is installed using ComboFix, you should see a message that says: The Recovery Console was successfully installed.  Please continue as follows: Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix. Click Yes to allow ComboFix to continue scanning for malware. When the tool is finished, it will produce a report for you. ========== Open HijackThis and click on 'Do a System Scan and save a Logfile'. Save the log file and post it here. ========== Logs Required Report.txt C:\Combofix.txt Hijackthis Log
__________________
Member of ASAP since 2007 Member of UNITE since 2008 **Notice to BT customers** Trial of BT-Phorm spyware to start 30th September, 2008- for more information please visit No DPI website for more information.  Phorm, previously known as 121Media were responsible for the Apropos rootkit, see Here for more information on said rootkit. If we have helped you in anyway,please consider Donating Last edited by TheBruce1 : 07-01-2008 at 03:22 AM. |
|
|
|
|
07-01-2008, 08:55 PM
|
#3 (permalink) |
|
Registered User
Join Date: Jun 2008
Posts: 10
OS: Windows XP
|
Re: Malware Downloaded to my System - DeeWoo, OuterInfo, CoolWebSearch plus others
Thank you for replying. I deleted Viewpoint Media Player and followed the rest of your instructions. The three logs are copied below....
SDFix: Version 1.199 Run by Owner on Tue 07/01/2008 at 09:39 PM Microsoft Windows XP [Version 5.1.2600] Running From: C:\SDFix Checking Services : Name : MsSecurity1.209.4 Path : C:\WINDOWS\444.470 service MsSecurity1.209.4 - Deleted Restoring Default Security Values Restoring Default Hosts File Restoring Default Desktop Wallpaper Rebooting Checking Files : Trojan Files Found: C:\WINDOWS\system32\pmnmMGVo.dll - Deleted C:\WINDOWS\SYSTEM32\IFTUYSZV.EXE - Deleted C:\WINDOWS\SYSTEM32\MCNTMADM.EXE - Deleted C:\WINDOWS\SYSTEM32\RWWNW64D.EXE - Deleted C:\WINDOWS\SYSTEM32\VLWNW64.EXE - Deleted C:\WINDOWS\IEDLL.EXE - Deleted C:\WINDOWS\IEXPLO~1.EXE - Deleted C:\WINDOWS\MROFIN~1.EXE - Deleted C:\WINDOWS\MROFIN~2.EXE - Deleted C:\WINDOWS\MSUPDATE.EXE - Deleted C:\WINDOWS\OLEHELP.EXE - Deleted C:\WINDOWS\X.EXE - Deleted C:\WINDOWS\Y.EXE - Deleted C:\Documents and Settings\All Users\Start Menu\Programs\AntiSpywareMaster\AntiSpywareMaster.lnk - Deleted C:\Documents and Settings\All Users\Start Menu\Programs\AntiSpywareMaster\Uninstall AntiSpywareMaster.lnk - Deleted C:\Documents and Settings\Owner\Application Data\Microsoft\Internet Explorer\Quick Launch\AntiSpywareMaster.lnk - Deleted C:\Documents and Settings\LocalService\Application Data\NetMon\domains.txt - Deleted C:\Documents and Settings\LocalService\Application Data\NetMon\log.txt - Deleted C:\Temp\1cb\syscheck.log - Deleted C:\WINDOWS\system32\netrax01\netrax011065.exe - Deleted C:\Program Files\Common Files\Yazzle1281OinAdmin.exe - Deleted C:\Program Files\Common Files\Yazzle1281OinUninstaller.exe - Deleted C:\WINDOWS\x.exe - Deleted C:\WINDOWS\y.exe - Deleted C:\WINDOWS\mrofinu1000106.exe - Deleted C:\WINDOWS\mrofinu572.exe - Deleted C:\WINDOWS\mrofinu572.exe.tmp - Deleted C:\WINDOWS\accesss.exe - Deleted C:\WINDOWS\astctl32.ocx - Deleted C:\WINDOWS\avpcc.dll - Deleted C:\WINDOWS\clrssn.exe - Deleted C:\WINDOWS\cpan.dll - Deleted C:\WINDOWS\ctfmon32.exe - Deleted C:\WINDOWS\ctrlpan.dll - Deleted C:\WINDOWS\default.htm - Deleted C:\WINDOWS\directx32.exe - Deleted C:\WINDOWS\dnsrelay.dll - Deleted C:\WINDOWS\editpad.exe - Deleted C:\WINDOWS\explore.exe - Deleted C:\WINDOWS\explorer32.exe - Deleted C:\WINDOWS\funniest.exe - Deleted C:\WINDOWS\funny.exe - Deleted C:\WINDOWS\gfmnaaa.dll - Deleted C:\WINDOWS\helpcvs.exe - Deleted C:\WINDOWS\iedll.exe - Deleted C:\WINDOWS\iexplorer.exe - Deleted C:\WINDOWS\inetinf.exe - Deleted C:\WINDOWS\internet.exe - Deleted C:\WINDOWS\loader.exe - Deleted C:\WINDOWS\megavid.cdt - Deleted C:\WINDOWS\msconfd.dll - Deleted C:\WINDOWS\msspi.dll - Deleted C:\WINDOWS\msupdate.exe - Deleted C:\WINDOWS\mswsc10.dll - Deleted C:\WINDOWS\mswsc20.dll - Deleted C:\WINDOWS\mtwirl32.dll - Deleted C:\WINDOWS\muotr.so - Deleted C:\WINDOWS\notepad32.exe - Deleted C:\WINDOWS\olehelp.exe - Deleted C:\WINDOWS\qttasks.exe - Deleted C:\WINDOWS\quicken.exe - Deleted C:\WINDOWS\rundll16.exe - Deleted C:\WINDOWS\rundll32.vbe - Deleted C:\WINDOWS\searchword.dll - Deleted C:\WINDOWS\sistem.exe - Deleted C:\WINDOWS\svchost32.exe - Deleted C:\WINDOWS\svcinit.exe - Deleted C:\WINDOWS\systeem.exe - Deleted C:\WINDOWS\systemcritical.exe - Deleted C:\WINDOWS\system32\hljwugsf.bin - Deleted C:\WINDOWS\system32\iftuyszv.exe - Deleted C:\WINDOWS\system32\msnav32.ax - Deleted C:\WINDOWS\system32\pac.txt - Deleted C:\WINDOWS\system32\rwwnw64d.exe - Deleted C:\WINDOWS\system32\zxdnt3d.cfg - Deleted C:\WINDOWS\time.exe - Deleted C:\WINDOWS\uninstall_nmon.vbs - Deleted C:\WINDOWS\users32.exe - Deleted C:\WINDOWS\waol.exe - Deleted C:\WINDOWS\win32e.exe - Deleted C:\WINDOWS\win64.exe - Deleted C:\WINDOWS\winajbm.dll - Deleted C:\WINDOWS\window.exe - Deleted C:\WINDOWS\winmgnt.exe - Deleted C:\WINDOWS\xplugin.dll - Deleted C:\WINDOWS\xxxvideo.hta - Deleted Could Not Remove C:\WINDOWS\system32\drivers\core.cache.dsk Folder C:\Documents and Settings\All Users\Start Menu\Programs\SecurePCCleaner - Removed Folder C:\Documents and Settings\LocalService\Application Data\NetMon - Removed Folder C:\Temp\1cb - Removed Folder C:\Temp\tn3 - Removed Folder C:\WINDOWS\system32\netrax01 - Removed Removing Temp Files ADS Check : Final Check : catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-07-01 21:52:02 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden services & system hive ... scanning hidden registry entries ... scanning hidden files ... scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 Remaining Services : Authorized Application Key Export: [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "C:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe"="C:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe:*:Disabled:AOL" "C:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe"="C:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe:*:Disabled:AOL" "C:\\Program Files\\America Online 9.0\\waol.exe"="C:\\Program Files\\America Online 9.0\\waol.exe:*:Disabled:AOL" "C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE"="C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE:*:Enabled:Internet Explorer" "C:\\Program Files\\Bonjour\\mDNSResponder.exe"="C:\\Program Files\\Bonjour\\mDNSResponder.exe:*:Enabled:Bonjour" "C:\\Program Files\\Real\\RealPlayer\\realplay.exe"="C:\\Program Files\\Real\\RealPlayer\\realplay.exe:*:Enabled:RealPlayer" "C:\\Program Files\\Neoteris\\Secure Application Manager\\dsSamProxy.exe"="C:\\Program Files\\Neoteris\\Secure Application Manager\\dsSamProxy.exe:*:Enabled:Secure Application Manager Proxy" "C:\\Program Files\\Juniper Networks\\Secure Application Manager\\dsSamProxy.exe"="C:\\Program Files\\Juniper Networks\\Secure Application Manager\\dsSamProxy.exe:*:Disabled:Secure Application Manager Proxy" "C:\\Program Files\\TurboTax\\Deluxe 2006\\32bit\\ttax.exe"="C:\\Program Files\\TurboTax\\Deluxe 2006\\32bit\\ttax.exe:LocalSubNet:Enabled:TurboTax" "C:\\Program Files\\TurboTax\\Deluxe 2006\\32bit\\updatemgr.exe"="C:\\Program Files\\TurboTax\\Deluxe 2006\\32bit\\updatemgr.exe:LocalSubNet:Enabled:TurboTax Update Manager" "C:\\Program Files\\TurboTax\\Deluxe 2007\\32bit\\ttax.exe"="C:\\Program Files\\TurboTax\\Deluxe 2007\\32bit\\ttax.exe:LocalSubNet:Enabled:TurboTax" "C:\\Program Files\\TurboTax\\Deluxe 2007\\32bit\\updatemgr.exe"="C:\\Program Files\\TurboTax\\Deluxe 2007\\32bit\\updatemgr.exe:LocalSubNet:Enabled:TurboTax Update Manager" "C:\\Program Files\\iTunes\\iTunes.exe"="C:\\Program Files\\iTunes\\iTunes.exe:*:Enabled:iTunes" "C:\\WINDOWS\\system32\\mmc.exe"="C:\\WINDOWS\\system32\\mmc.exe:*:Enabled:Microsoft Management Console" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "C:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe"="C:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe:*:Enabled:AOL" "C:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe"="C:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe:*:Enabled:AOL" "C:\\Program Files\\America Online 9.0\\waol.exe"="C:\\Program Files\\America Online 9.0\\waol.exe:*:Enabled:AOL" Remaining Files : C:\WINDOWS\system32\drivers\core.cache.dsk Found File Backups: - C:\SDFix\backups\backups.zip Files with Hidden Attributes : Fri 1 Jul 2005 0 A.SH. --- "C:\WINDOWS\SMINST\HPCD.sys" Thu 29 May 2008 230,400 ..SHR --- "C:\WINDOWS\?ymantec\r?gsvr32.exe" Thu 19 Jun 2008 68,608 ..SHR --- "C:\Program Files\Common Files\??curity\ping.exe" Tue 30 Jan 2007 0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp" Mon 2 Oct 2006 50,280 ...H. --- "C:\Program Files\Common Files\Adobe\ESD\DLMCleanup.exe" Mon 12 Feb 2007 3,096,576 A..H. --- "C:\Documents and Settings\Owner\Application Data\U3\temp\Launchpad Removal.exe" Thu 19 Jun 2008 41,723 A.SH. --- "C:\Deckard\System Scanner\backup\DOCUME~1\Owner\LOCALS~1\Temp\~nsu.tmp\Au_.exe" Wed 30 Apr 2008 32,855 ..SHR --- "C:\Deckard\System Scanner\backup\DOCUME~1\Owner\LOCALS~1\Temp\Juniper Networks\setup\NeoterisSetupApp.exe" Finished! ComboFix 08-06-30.2 - Owner 2008-07-01 22:13:20.1 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.160 [GMT -5:00] Running from: C:\Documents and Settings\Owner\Desktop\ComboFix.exe Command switches used :: C:\Documents and Settings\Owner\Desktop\WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe * Created a new restore point . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\NetworkService\Application Data\NetMon C:\Documents and Settings\NetworkService\Application Data\NetMon\domains.txt C:\Documents and Settings\NetworkService\Application Data\NetMon\log.txt C:\Program Files\Common Files\curity~1 C:\Program Files\Common Files\curity~1\??curity\ C:\Program Files\Common Files\curity~1\ping.exe C:\Program Files\outerinfo C:\Program Files\outerinfo\FF\chrome.manifest C:\Program Files\outerinfo\FF\components\FF.dll C:\Program Files\outerinfo\FF\components\OuterinfoAds.xpt C:\Program Files\outerinfo\FF\install.rdf C:\Program Files\sks~1 C:\temp\tn3 C:\WINDOWS\444.470 C:\WINDOWS\IA C:\WINDOWS\IA\KE.vbs C:\WINDOWS\lfn.exe C:\WINDOWS\mainms.vpi C:\WINDOWS\pskt.ini C:\WINDOWS\system32\axsftaot.ini C:\WINDOWS\system32\bqyadgbs.ini C:\WINDOWS\system32\byXPFXrR.dll C:\WINDOWS\system32\dcgubjjs.dll C:\WINDOWS\system32\debspgwv.ini C:\WINDOWS\system32\dhtqkusa.ini C:\WINDOWS\system32\dhwplqhy.ini C:\WINDOWS\system32\drivers\rdbsss.sys C:\WINDOWS\system32\dvlpiehy.ini C:\WINDOWS\system32\ephtbwyw.ini C:\WINDOWS\system32\ezmjvd.dll C:\WINDOWS\system32\fizywppd.dll C:\WINDOWS\system32\ftrirvpg.ini C:\WINDOWS\system32\fygqmeih.ini C:\WINDOWS\system32\gwshqhfj.dll C:\WINDOWS\system32\hbpmiuli.ini C:\WINDOWS\system32\hhugai.dll C:\WINDOWS\system32\hjqtkmsr.ini C:\WINDOWS\system32\hkbopime.ini C:\WINDOWS\system32\iusbaykq.ini C:\WINDOWS\system32\jfhqhswg.ini C:\WINDOWS\system32\jhyqbbps.ini C:\WINDOWS\system32\jtgpmkdi.ini C:\WINDOWS\system32\jvqosdpm.ini C:\WINDOWS\system32\kgcjblwt.dll C:\WINDOWS\system32\kmcwiynv.ini C:\WINDOWS\system32\kpiqeycp.ini C:\WINDOWS\system32\kvwquarw.ini C:\WINDOWS\system32\kwwhlqus.ini C:\WINDOWS\system32\kxyrauit.dll C:\WINDOWS\system32\ljJBqopo.dll C:\WINDOWS\system32\ljvqerej.ini C:\WINDOWS\system32\lwhehste.ini C:\WINDOWS\system32\MSINET.oca C:\WINDOWS\system32\nkgtwgmi.ini C:\WINDOWS\system32\nnnpivhk.ini C:\WINDOWS\system32\ohybtxqw.ini C:\WINDOWS\system32\opoqBJjl.ini C:\WINDOWS\system32\opoqBJjl.ini2 C:\WINDOWS\system32\pdprtgsy.dll C:\WINDOWS\system32\phcrqmcx.ini C:\WINDOWS\system32\qopyoaxe.ini C:\WINDOWS\system32\qsqylein.ini C:\WINDOWS\system32\qwfjhnqr.ini C:\WINDOWS\system32\rjnghtru.ini C:\WINDOWS\system32\rpgcnfby.dll C:\WINDOWS\system32\rpiowvdb.ini C:\WINDOWS\system32\suwhxnii.ini C:\WINDOWS\system32\tgiijyhq.ini C:\WINDOWS\system32\tuqxayem.dll C:\WINDOWS\system32\uenufpir.ini C:\WINDOWS\system32\ustwctxq.ini C:\WINDOWS\system32\vevdmvkl.ini C:\WINDOWS\system32\winpfz33.sys C:\WINDOWS\system32\wxanpnqk.ini C:\WINDOWS\system32\wychqumy.ini C:\WINDOWS\system32\xeowfqaf.ini C:\WINDOWS\system32\xnkjbmlj.ini C:\WINDOWS\system32\xyjymifa.ini C:\WINDOWS\system32\zzeuwc.dll C:\WINDOWS\ymante~1 C:\WINDOWS\ymante~1\r?gsvr32.exe D:\Autorun.inf . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_CMDSERVICE -------\Legacy_RDBSSS -------\Service_cmdService -------\Service_rdbsss ((((((((((((((((((((((((( Files Created from 2008-06-02 to 2008-07-02 ))))))))))))))))))))))))))))))) . 2008-07-01 21:48 . 2008-07-01 21:48 167,976 --a------ C:\WINDOWS\system32\drivers\core.cache.dsk 2008-07-01 21:33 . 2008-07-01 21:34 <DIR> d-------- C:\WINDOWS\ERUNT 2008-07-01 21:28 . 2008-07-01 21:56 <DIR> d-------- C:\SDFix 2008-06-27 19:10 . 2008-06-27 19:10 <DIR> d-------- C:\Deckard 2008-06-27 18:53 . 2008-06-27 18:53 <DIR> d-------- C:\ie-spyad_zo 2008-06-27 18:48 . 2008-06-27 18:49 <DIR> d-------- C:\Program Files\SpywareBlaster 2008-06-27 18:48 . 2008-06-27 18:48 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\TEMP 2008-06-27 18:47 . 2008-06-27 18:47 <DIR> d-------- C:\ZonedOut 2008-06-27 18:47 . 2008-06-26 14:13 2,869,536 --a------ C:\spywareblastersetup41.exe 2008-06-27 18:47 . 2008-02-05 15:59 322,518 --a------ C:\ie-spyad_zo.exe 2008-06-27 12:16 . 2008-06-27 12:16 9,662 --a------ C:\WINDOWS\system32\ZoneAlarmIconUS.ico 2008-06-27 12:09 . 2008-07-01 21:08 110,419 --a------ C:\WINDOWS\BMab75f50e.xml 2008-06-27 07:59 . 2008-06-27 08:00 <DIR> d-------- C:\Program Files\Panda Security 2008-06-26 21:38 . 2008-06-27 18:33 <DIR> d-------- C:\Bad 2008-06-19 14:13 . 2008-06-19 14:13 <DIR> d-------- C:\WINDOWS\system32\eb10 2008-06-19 14:13 . 2008-06-27 18:33 <DIR> d-------- C:\WINDOWS\system32\bgi 2008-06-19 14:13 . 2008-06-19 14:13 <DIR> d-------- C:\WINDOWS\system32\axc 2008-06-19 14:13 . 2008-06-19 14:47 <DIR> d-------- C:\WINDOWS\system32\1049a 2008-06-19 14:13 . 2008-06-19 14:13 <DIR> d-------- C:\temp\itmp4 2008-06-10 17:34 . 2008-04-14 06:01 272,128 --a------ C:\WINDOWS\system32\drivers\bthport.sys 2008-06-10 17:34 . 2008-04-14 06:01 272,128 --a--c--- C:\WINDOWS\system32\dllcache\bthport.sys 2008-06-07 10:29 . 2008-06-07 10:29 <DIR> d-------- C:\Ray Pure Genius Doubles . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-07-02 02:14 --------- d-----w C:\Documents and Settings\All Users\Application Data\Viewpoint 2008-07-01 01:53 --------- d-----w C:\Program Files\Symantec 2008-06-26 23:12 --------- d-----w C:\Program Files\Common Files\Symantec Shared 2008-06-26 23:10 --------- d-----w C:\Documents and Settings\All Users\Application Data\McAfee.com 2008-06-19 18:32 --------- d-----w C:\Documents and Settings\Owner\Application Data\Juniper Networks 2008-06-12 01:16 --------- d-----w C:\Documents and Settings\Owner\Application Data\Move Networks 2008-06-08 01:12 --------- d-----w C:\Program Files\Common Files\Adobe 2008-06-08 01:10 --------- d-----w C:\Documents and Settings\Owner\Application Data\AdobeUM 2008-05-08 12:28 202,752 ----a-w C:\WINDOWS\system32\drivers\rmcast.sys 2008-04-12 22:21 1,179,658 ----a-w C:\f5d7230-4v5_us_fw_7.01.06.bin 2005-11-26 03:52 0 ----a-w C:\Documents and Settings\Owner\Application Data\wklnhst.dat 2005-07-01 19:08 0 --sha-w C:\WINDOWS\SMINST\HPCD.sys . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Nvqfoa"="C:\WINDOWS\?ymantec\r?gsvr32.exe" [?] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SunKistEM"="C:\Program Files\Digital Media Reader\shwiconem.exe" [2004-11-15 17:04 135168] "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 13:50 155648] "IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2004-08-20 17:55 155648] "HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2004-08-20 17:51 118784] "RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2004-11-02 22:24 32768] "Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" [2005-06-07 00:46 57344] "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-03-28 23:37 413696] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-03-30 10:36 267048] C:\Documents and Settings\Owner\Start Menu\Programs\Startup\ Picture Motion Browser Media Check Tool.lnk - C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe [2008-01-27 15:11:43 344064] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2008-04-23 03:38:16 29696] DING!.lnk - C:\Program Files\Southwest Airlines\Ding\Ding.exe [2005-05-17 14:22:42 462848] WinZip Quick Pick.lnk - C:\Program Files\WinZip\WZQKPICK.EXE [2006-08-31 22:09:25 122880] [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders] SecurityProviders msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll, ntoskrnl.dll [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE"= "C:\\Program Files\\Real\\RealPlayer\\realplay.exe"= "C:\\Program Files\\Juniper Networks\\Secure Application Manager\\dsSamProxy.exe"= "C:\\Program Files\\iTunes\\iTunes.exe"= "C:\\WINDOWS\\system32\\mmc.exe"= R1 NEOFLTR_600_13073;Juniper Networks TDI Filter Driver (NEOFLTR_600_13073);C:\WINDOWS\system32\Drivers\NEOFLTR_600_13073.SYS [2008-04-30 14:54] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{da41a284-a859-11dc-9488-0013204adce0}] \Shell\AutoRun\command - L:\LaunchU3.exe -a . Contents of the 'Scheduled Tasks' folder "2008-06-24 14:01:03 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job" - C:\Program Files\Apple Software Update\SoftwareUpdate.exe "2005-07-01 18:37:52 C:\WINDOWS\Tasks\ISP signup reminder 1.job" - C:\WINDOWS\system32\OOBE\oobebaln.exe "2005-07-01 18:37:53 C:\WINDOWS\Tasks\ISP signup reminder 3.job" - C:\WINDOWS\system32\OOBE\oobebaln.exe . - - - - ORPHANS REMOVED - - - - BHO-{AE66B448-22AE-0C57-AA38-09A2919B49B5} - C:\WINDOWS\system32\zqb.dll HKCU-Run-swg - C:\Program Files\Google\GoogleToolbarNotifier\1.0.720.3640\GoogleToolbarNotifier.exe HKCU-Run-Cpue - C:\PROGRA~1\COMMON~1\CURITY~1\ping.exe HKLM-Run-{6C-C6-63-3D-DW} - C:\windows\system32\vlwnw64.exe HKLM-Run-a846c692 - C:\WINDOWS\system32\gwshqhfj.dll HKLM-Run-BMab75f50e - C:\WINDOWS\system32\dcgubjjs.dll ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-07-01 22:20:25 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . ------------------------ Other Running Processes ------------------------ . C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\LEXPPS.EXE C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\rundll32.exe C:\PROGRA~1\WinZip\WZQKPICK.EXE C:\Program Files\Canon\CAL\CALMAIN.exe C:\Program Files\iPod\bin\iPodService.exe C:\WINDOWS\system32\wscntfy.exe . ************************************************************************** . Completion time: 2008-07-01 22:26:16 - machine was rebooted ComboFix-quarantined-files.txt 2008-07-02 03:26:13 Pre-Run: 25,979,449,344 bytes free Post-Run: 26,009,219,072 bytes free WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems] multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect C:\CMDCONS\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons 224 --- E O F --- 2008-06-11 04:00:33 Deckard's System Scanner v20071014.68 Run by Owner on 2008-07-01 22:52:39 Computer is in Normal Mode. -------------------------------------------------------------------------------- Total Physical Memory: 495 MiB (512 MiB recommended). -- HijackThis (run as Owner.exe) ----------------------------------------------- Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 10:54:28 PM, on 7/1/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\LEXPPS.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS C:\WINDOWS\system32\svchost.exe C:\Program Files\Digital Media Reader\shwiconem.exe C:\WINDOWS\system32\igfxtray.exe C:\WINDOWS\system32\hkcmd.exe C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe C:\Program Files\QuickTime\QTTask.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Southwest Airlines\Ding\Ding.exe C:\Program Files\WinZip\WZQKPICK.EXE C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe C:\Program Files\Canon\CAL\CALMAIN.exe C:\Program Files\iPod\bin\iPodService.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\explorer.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Documents and Settings\Owner\Desktop\dss.exe C:\PROGRA~1\TRENDM~1\HIJACK~1\Owner.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.goole.com O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - (no file) O3 - Toolbar: (no name) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - (no file) O4 - HKLM\..\Run: [SunKistEM] C:\Program Files\Digital Media Reader\shwiconem.exe O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" O4 - HKLM\..\Run: [Recguard] %WINDIR%\SMINST\RECGUARD.EXE O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKCU\..\Run: [Nvqfoa] C:\WINDOWS\?ymantec\r?gsvr32.exe O4 - Startup: Picture Motion Browser Media Check Tool.lnk = C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: DING!.lnk = C:\Program Files\Southwest Airlines\Ding\Ding.exe O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O15 - Trusted Zone: http://download.windowsupdate.com O15 - Trusted Zone: *.avsystemcare.com (HKLM) O15 - Trusted Zone: *.gomyhit.com (HKLM) O15 - Trusted Zone: *.imageservr.com (HKLM) O15 - Trusted Zone: *.imagesrvr.com (HKLM) O15 - Trusted Zone: *.onerateld.com (HKLM) O15 - Trusted Zone: *.safetydownload.com (HKLM) O15 - Trusted Zone: *.storageguardsoft.com (HKLM) O15 - Trusted Zone: *.trustedantivirus.com (HKLM) O15 - Trusted Zone: *.virusschlacht.com (HKLM) O16 - DPF: {7584C670-2274-4EFB-B00B-D6AABA6D3850} (Microsoft RDP Client Control (redist)) - https://remote.schwab.com/svordp/,Da....com+msrdp.cab O16 - DPF: {E5F5D008-DD2C-4D32-977D-1A0ADF03058B} (JuniperSetupSP1 Control) - https://remote.schwab.com/dana-cache...erSetupSP1.cab O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE O23 - Service: PrismXL - New Boundary Technologies, Inc. - C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS -- End of file - 5627 bytes -- Files created between 2008-06-01 and 2008-07-01 ----------------------------- 2008-07-01 22:52:48 0 d-------- C:\Program Files\Trend Micro 2008-07-01 22:13:06 0 d-------- C:\cmdcons 2008-07-01 22:10:10 68096 --a------ C:\WINDOWS\zip.exe 2008-07-01 22:10:10 49152 --a------ C:\WINDOWS\VFind.exe 2008-07-01 22:10:10 212480 --a------ C:\WINDOWS\swxcacls.exe <Not Verified; SteelWerX; SteelWerX Extended Configurator ACLists> 2008-07-01 22:10:10 136704 --a------ C:\WINDOWS\swsc.exe <Not Verified; SteelWerX; SteelWerX Service Controller> 2008-07-01 22:10:10 161792 --a------ C:\WINDOWS\swreg.exe <Not Verified; SteelWerX; SteelWerX Registry Editor> 2008-07-01 22:10:10 98816 --a------ C:\WINDOWS\sed.exe 2008-07-01 22:10:10 80412 --a------ C:\WINDOWS\grep.exe 2008-07-01 22:10:10 89504 --a------ C:\WINDOWS\fdsv.exe <Not Verified; Smallfrogs Studio; > 2008-07-01 21:33:53 0 d-------- C:\WINDOWS\ERUNT 2008-06-27 18:53:07 0 d-------- C:\ie-spyad_zo 2008-06-27 18:48:44 0 d-------- C:\Documents and Settings\All Users\Application Data\TEMP 2008-06-27 18:48:01 0 d-------- C:\Program Files\SpywareBlaster 2008-06-27 18:47:11 322518 --a------ C:\ie-spyad_zo.exe 2008-06-27 18:47:10 0 d-------- C:\ZonedOut 2008-06-27 07:59:27 0 d-------- C:\Program Files\Panda Security 2008-06-26 21:38:16 0 d-------- C:\Bad 2008-06-19 14:14:37 0 d-------- C:\Documents and Settings\NetworkService\Application Data\Macromedia 2008-06-19 14:14:18 0 dr------- C:\Documents and Settings\NetworkService\Favorites 2008-06-19 14:13:45 0 d-------- C:\WINDOWS\system32\eb10 2008-06-19 14:13:45 0 d-------- C:\WINDOWS\system32\bgi 2008-06-19 14:13:45 0 d-------- C:\WINDOWS\system32\axc 2008-06-19 14:13:45 0 d-------- C:\WINDOWS\system32\1049a 2008-06-07 10:29:30 0 d-------- C:\Ray Pure Genius Doubles -- Find3M Report --------------------------------------------------------------- 2008-07-01 22:13:32 0 d-------- C:\Program Files\Common Files 2008-06-30 20:53:55 0 d-------- C:\Program Files\Symantec 2008-06-26 18:12:27 0 d-------- C:\Program Files\Common Files\Symantec Shared 2008-06-19 13:32:22 0 d-------- C:\Documents and Settings\Owner\Application Data\Juniper Networks 2008-06-11 20:16:09 0 d-------- C:\Documents and Settings\Owner\Application Data\Move Networks 2008-06-07 20:12:10 0 d-------- C:\Program Files\Common Files\Adobe 2008-06-07 20:10:22 0 d-------- C:\Documents and Settings\Owner\Application Data\AdobeUM -- Registry Dump --------------------------------------------------------------- *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SunKistEM"="C:\Program Files\Digital Media Reader\shwiconem.exe" [11/15/2004 05:04 PM] "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [07/09/2001 01:50 PM] "IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [08/20/2004 05:55 PM] "HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [08/20/2004 05:51 PM] "RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [11/02/2004 10:24 PM] "Recguard"="%WINDIR%\SMINST\RECGUARD.EXE" [] "Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" [06/07/2005 12:46 AM] "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [03/28/2008 11:37 PM] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [03/30/2008 10:36 AM] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Nvqfoa"="C:\WINDOWS\?ymantec\r?gsvr32.exe" [] C:\Documents and Settings\Owner\Start Menu\Programs\Startup\ Picture Motion Browser Media Check Tool.lnk - C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe [1/27/2008 3:11:43 PM] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [4/23/2008 3:38:16 AM] DING!.lnk - C:\Program Files\Southwest Airlines\Ding\Ding.exe [5/17/2005 2:22:42 PM] WinZip Quick Pick.lnk - C:\Program Files\WinZip\WZQKPICK.EXE [8/31/2006 10:09:25 PM] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "DisableRegistryTools"=0 (0x0) "HideLegacyLogonScripts"=0 (0x0) "HideLogoffScripts"=0 (0x0) "RunLogonScriptSync"=1 (0x1) "RunStartupScriptSync"=0 (0x0) "HideStartupScripts"=0 (0x0) [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system] "HideLegacyLogonScripts"=0 (0x0) "HideLogoffScripts"=0 (0x0) "RunLogonScriptSync"=1 (0x1) "RunStartupScriptSync"=0 (0x0) "HideStartupScripts"=0 (0x0) [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders] SecurityProviders msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll, ntoskrnl.dll [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{da41a284-a859-11dc-9488-0013204adce0}] AutoRun\command- L:\LaunchU3.exe -a -- End of Deckard's System Scanner: finished at 2008-07-01 22:54:49 ------------ |
|
|
|
|
07-02-2008, 05:14 AM
|
#4 (permalink) | |
|
Moderator, Analyst, Security Team
Join Date: Oct 2006
Location: Důn Čideann,Scotland.
Posts: 2,785
OS: XP
|
Re: Malware Downloaded to my System - DeeWoo, OuterInfo, CoolWebSearch plus others
Hello again
Download ATF-Cleaner by Atribune to your desktop. Do not run just yet, we will shortly ======= Click > Start > Control Panel > Add / Remove Programs and uninstall the following programs (if they exist): Outerinfo ======== Open HijackThis and click on 'Do a System Scan Only'. Check the following entries (If they still exist, make sure you do not miss any) O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - (no file) O3 - Toolbar: (no name) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - (no file) O4 - HKCU\..\Run: [Nvqfoa] C:\WINDOWS\?ymantec\r?gsvr32.exe O15 - Trusted Zone: http://download.windowsupdate.com O15 - Trusted Zone: *.avsystemcare.com (HKLM) O15 - Trusted Zone: *.gomyhit.com (HKLM) O15 - Trusted Zone: *.imageservr.com (HKLM) O15 - Trusted Zone: *.imagesrvr.com (HKLM) O15 - Trusted Zone: *.onerateld.com (HKLM) O15 - Trusted Zone: *.safetydownload.com (HKLM) O15 - Trusted Zone: *.storageguardsoft.com (HKLM) O15 - Trusted Zone: *.trustedantivirus.com (HKLM) O15 - Trusted Zone: *.virusschlacht.com (HKLM) Please remember to close all other windows, including browsers then click Fix checked. ======== Open notepad and copy/paste the text in the quotebox below into it: Quote:
 Refering to the picture above, drag CFscript into ComboFix.exe Follow the prompts, and post the resulting log, C:\ComboFix.txt Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system. Warning: Do not mouseclick combofix's window whilst it's running. That may cause it to stall ========== JAVA OUTDATED Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update.
========== Double-click ATF Cleaner.exe to open it Under Main choose: Windows Temp Current User Temp All Users Temp Cookies Temporary Internet Files Prefetch Java Cache *The other boxes are optional* Then click the Empty Selected button. If you have Firefox installed: Click Firefox at the top and choose: Select All Click the Empty Selected button. NOTE: If you would like to keep your saved passwords, please click NO at the prompt. If you have Opera installed: Click Opera at the top and choose: Select All Click the Empty Selected button. NOTE: If you would like to keep your saved passwords, please click NO at the prompt. Click Exit on the Main menu to close the program. =========== No AntiVirus Onboard I see no evidence of an AntiVirus program on your system. This must be resolved. Here are a few very good free Antivirus products which are available:Select one of these, or another of your choice. Download, install, update definitions, and run a full system scan. =========== Open HijackThis and click on 'Do a System Scan and save a Logfile'. Save the log file and post it here. =========== Logs Required C;\Combofix.txt Results from AV scan Hijackthis Log How is you system behaving now.
__________________
Member of ASAP since 2007 Member of UNITE since 2008 **Notice to BT customers** Trial of BT-Phorm spyware to start 30th September, 2008- for more information please visit No DPI website for more information. Phorm, previously known as 121Media were responsible for the Apropos rootkit, see Here for more information on said rootkit. If we have helped you in anyway,please consider Donating |
|
|
|
|
