sharoncrunch

Hi...I hope someone can resolve this one for me: My pc was infected with Conficker in late Jan/ early Feb. I system recovered, disinfected, and scanned with malwarebytes, AVG, Superantispyware, as well as Mcafee til everything came up clean. All I had connected was the router, cable modem, and Dell 720 printer or Brother MFC420CN--I'd alternate. Before the virus was discovered, both printers began printing blank pages, when they were working fine before.

The pc is a dinosaur--a Compaq Presario and it's running on Windows XP SP3. It is connected to my cable modem and router. My daughter's laptop, a Dell Inspiron 1200, also running WinXP SP3, was also infected, disinfected, and scanned til everything read ok.

Early last month, some of the same symptoms crept back--my security programs couldn't be opened/disappeared; ie was gone, etc...i was unable to start in safe mode and shortly after Windows couldn't be read/found at all. When first trying to start in safe mode, hal.dll couldn't be found...then more files...then finally nothing.

Disinfected...Ran all the malware removal tools again; applied all patches; etc...til scans came up clean.

Decided to reinstall printer...updated drivers...same problem...printer "printed" blank pages. Ink is ok; settings ok... That was 2 days ago.

Today my desktop icons are a lot larger and my system is running sooo slowly! I tried starting in Safe mode, but was unable to: hal.dll couldn't be found. I am able to start up in regular mode, though.

I need some real guidance as to how to proceed...What's up with my system? And what's the best way to fix it??

I am so aggravated with this, it's not even funny

Ried

Hello sharoncrunch,

We need something to work with here. Please follow the instructions in our sticky topic New Instructions - Read This Before Posting for Malware Removal Help and post the requested logs in your next reply.

sharoncrunch

Will do!

Ried

These scans only take a couple of minutes. The sooner you post them, the sooner we can get stared.

sharoncrunch

Reid, I am still waiting for the gmer to finish scanning; it's been running for about 3 hrs now.

I want to mention, that last month McAfee and Malwarebytes found Trojan.BHO--2 of them--on my system.

As soon as the scan is finished, I'll post results.

sharoncrunch

Below are the requested logs. Please let me know whatever else you need.


DDS (Ver_09-03-16.01) - NTFSx86
Run by Owner at 15:25:50.85 on Mon 04/20/2009
Internet Explorer: 7.0.5730.13 BrowserJavaVersion: 1.6.0_13
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.503.117 [GMT -4:00]

AV: McAfee VirusScan *On-access scanning enabled* (Updated)
FW: McAfee Personal Firewall *enabled*

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\windows\system\hpsysdrv.exe
C:\HP\KBD\KBD.EXE
C:\WINDOWS\AGRSMMSG.exe
C:\WINDOWS\ALCXMNTR.EXE
C:\WINDOWS\System32\igfxtray.exe
C:\Program Files\McAfee.com\Agent\mcagent.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\QuickTime\QTTask.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Documents and Settings\Owner\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\IObit\Advanced SystemCare 3\AWC.exe
C:\Program Files\MozyHome\mozystat.exe
C:\Program Files\OpenOffice.org 3\program\soffice.exe
C:\Program Files\OpenOffice.org 3\program\soffice.bin
svchost.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\Program Files\MozyHome\mozybackup.exe
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\Documents and Settings\Owner\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Owner\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
C:\Documents and Settings\Owner\My Documents\Downloads\gmer (1)\gmer.exe
C:\Documents and Settings\Owner\My Documents\Downloads\dds (2).scr

============== Pseudo HJT Report ===============

uSearch Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q304&bd=presario&pf=desktop
uDefault_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q304&bd=presario&pf=desktop
uDefault_Search_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q304&bd=presario&pf=desktop
uSearch Bar = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q304&bd=presario&pf=desktop
mSearch Bar = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q304&bd=presario&pf=desktop
uInternet Settings,ProxyOverride = localhost;*.local
BHO: AcroIEHlprObj Class: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 6.0\reader\activex\AcroIEHelper.dll
BHO: SSVHelper Class: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre6\bin\ssv.dll
BHO: scriptproxy: {7db2d5a0-7241-4e79-b68d-6309f01c5231} - c:\program files\mcafee\virusscan\scriptsn.dll
BHO: {7E853D72-626A-48EC-A868-BA8D5E23E045} - No File
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File
uRun: [SUPERAntiSpyware] c:\program files\superantispyware\SUPERAntiSpyware.exe
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [Google Update] "c:\documents and settings\owner\local settings\application data\google\update\GoogleUpdate.exe" /c
uRun: [MsnMsgr] "c:\program files\msn messenger\MsnMsgr.Exe" /background
uRun: [Advanced SystemCare 3] "c:\program files\iobit\advanced systemcare 3\AWC.exe" /startup
mRun: [hpsysdrv] c:\windows\system\hpsysdrv.exe
mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
mRun: [KBD] c:\hp\kbd\KBD.EXE
mRun: [TkBellExe] "c:\program files\common files\real\update_ob\realsched.exe" -osboot
mRun: [Recguard] c:\windows\sminst\RECGUARD.EXE
mRun: [VTTimer] VTTimer.exe
mRun: [AGRSMMSG] AGRSMMSG.exe
mRun: [PS2] c:\windows\system32\ps2.exe
mRun: [AlcxMonitor] ALCXMNTR.EXE
mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
mRun: [mcagent_exe] c:\program files\mcafee.com\agent\mcagent.exe /runkey
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
StartupFolder: c:\docume~1\owner\startm~1\programs\startup\openof~1.lnk - c:\program files\openoffice.org 3\program\quickstart.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\mozyho~1.lnk - c:\program files\mozyhome\mozystat.exe
IE: E&xport to Microsoft Excel - c:\progra~1\mi1933~1\office11\EXCEL.EXE/3000
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBC} - c:\program files\java\jre6\bin\jp2iexp.dll
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1237420152453
DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1237420140390
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
DPF: {CAFEEFAC-0014-0002-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/products/plugin/autodl/jinstall-142-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Notify: igfxcui - igfxsrvc.dll

============= SERVICES / DRIVERS ===============

R1 mfehidk;McAfee Inc. mfehidk;c:\windows\system32\drivers\mfehidk.sys [2009-3-19 201320]
R1 mozyFilter;mozyFilter;c:\windows\system32\drivers\mozy.sys [2009-3-30 53752]
R1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\SASDIFSV.SYS [2009-2-17 9968]
R1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2009-2-17 55024]
R2 McProxy;McAfee Proxy Service;c:\progra~1\common~1\mcafee\mcproxy\mcproxy.exe [2009-2-11 359248]
R2 McShield;McAfee Real-time Scanner;c:\progra~1\mcafee\viruss~1\mcshield.exe [2009-3-19 144704]
R3 McSysmon;McAfee SystemGuards;c:\progra~1\mcafee\viruss~1\mcsysmon.exe [2009-3-19 695624]
R3 mfeavfk;McAfee Inc. mfeavfk;c:\windows\system32\drivers\mfeavfk.sys [2009-3-19 79304]
R3 mfebopk;McAfee Inc. mfebopk;c:\windows\system32\drivers\mfebopk.sys [2009-3-19 35240]
R3 mfesmfk;McAfee Inc. mfesmfk;c:\windows\system32\drivers\mfesmfk.sys [2009-3-19 40488]
R3 SASENUM;SASENUM;c:\program files\superantispyware\SASENUM.SYS [2009-2-17 7408]
S3 mferkdk;McAfee Inc. mferkdk;c:\windows\system32\drivers\mferkdk.sys [2009-3-19 33832]

=============== Created Last 30 ================

2009-04-19 17:56 <DIR> --d----- c:\docume~1\owner\applic~1\IObit
2009-04-19 17:56 <DIR> --d----- c:\program files\IObit
2009-04-15 01:57 284,160 -c------ c:\windows\system32\dllcache\pdh.dll
2009-04-15 01:57 401,408 -c------ c:\windows\system32\dllcache\rpcss.dll
2009-04-15 01:57 473,600 -c------ c:\windows\system32\dllcache\fastprox.dll
2009-04-15 01:57 110,592 -c------ c:\windows\system32\dllcache\services.exe
2009-04-15 01:57 227,840 -c------ c:\windows\system32\dllcache\wmiprvse.exe
2009-04-15 01:57 729,088 -c------ c:\windows\system32\dllcache\lsasrv.dll
2009-04-15 01:57 617,472 -c------ c:\windows\system32\dllcache\advapi32.dll
2009-04-15 01:57 453,120 -c------ c:\windows\system32\dllcache\wmiprvsd.dll
2009-04-15 01:57 714,752 -c------ c:\windows\system32\dllcache\ntdll.dll
2009-04-15 01:57 2,560 -------- c:\windows\system32\xpsp4res.dll
2009-04-15 01:57 1,203,922 -c------ c:\windows\system32\dllcache\sysmain.sdb
2009-04-15 01:57 215,552 -c------ c:\windows\system32\dllcache\wordpad.exe
2009-04-13 14:37 299,520 a------- c:\windows\uninst.exe
2009-04-13 14:36 297 a------- c:\windows\dellstat.ini
2009-04-13 14:31 25,856 ac------ c:\windows\system32\dllcache\usbprint.sys
2009-04-13 14:31 25,856 a------- c:\windows\system32\drivers\usbprint.sys
2009-04-10 23:18 <DIR> --d----- c:\documents and settings\owner\Contacts
2009-04-10 23:11 <DIR> --d----- c:\program files\MSN Messenger
2009-04-09 20:38 <DIR> --d----- c:\docume~1\alluse~1\applic~1\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
2009-03-30 17:01 53,752 a------- c:\windows\system32\drivers\mozy.sys
2009-03-30 17:01 <DIR> --d----- c:\program files\MozyHome
2009-03-30 16:19 <DIR> --d----- C:\New Folder (3)
2009-03-30 16:17 <DIR> --d----- C:\New Folder (2)
2009-03-29 23:32 <DIR> --d----- C:\New Folder
2009-03-29 22:32 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Softland
2009-03-29 22:32 <DIR> --d----- c:\docume~1\owner\applic~1\Softland
2009-03-29 21:12 <DIR> --d----- c:\docume~1\owner\applic~1\OpenOffice.org
2009-03-28 12:18 410,984 a------- c:\windows\system32\deploytk.dll
2009-03-28 12:18 73,728 a------- c:\windows\system32\javacpl.cpl

==================== Find3M ====================

2009-04-06 15:32 38,496 a------- c:\windows\system32\drivers\mbamswissarmy.sys
2009-04-06 15:32 15,504 a------- c:\windows\system32\drivers\mbam.sys
2009-03-19 16:32 23,400 a------- c:\windows\system32\drivers\GEARAspiWDM.sys
2009-03-19 14:36 81,395 a------- c:\windows\pchealth\helpctr\offlinecache\index.dat
2009-03-19 14:33 434,176 a------- c:\windows\pchealth\helpctr\vendors\cn=hewlett-packard,l=cupertino,s=ca,c=us\presario\xphnars4en\plugin\bin\jsharpde\motivede.dll
2009-03-19 14:33 36,864 a------- c:\windows\pchealth\helpctr\vendors\cn=hewlett-packard,l=cupertino,s=ca,c=us\presario\xphnars4en\plugin\bin\jsharpde\gnu.dll
2009-03-19 14:33 213,089 a------- c:\windows\pchealth\helpctr\vendors\cn=hewlett-packard,l=cupertino,s=ca,c=us\presario\xphnars4en\plugin\bin\jsharpde\motive.zip
2009-03-19 14:33 126,976 a------- c:\windows\pchealth\helpctr\vendors\cn=hewlett-packard,l=cupertino,s=ca,c=us\presario\xphnars4en\plugin\bin\SearchCtrl.dll
2009-03-19 14:33 49,152 a------- c:\windows\pchealth\helpctr\vendors\cn=hewlett-packard,l=cupertino,s=ca,c=us\presario\xphnars4en\plugin\bin\jsharpde\hwinv.dll
2009-03-19 14:33 69,632 a------- c:\windows\pchealth\helpctr\vendors\cn=hewlett-packard,l=cupertino,s=ca,c=us\presario\xphnars4en\plugin\bin\jsharpde\msxmlwrapper.dll
2009-03-19 14:33 307,200 a------- c:\windows\pchealth\helpctr\vendors\cn=hewlett-packard,l=cupertino,s=ca,c=us\presario\xphnars4en\plugin\bin\pchealthplugin.dll
2009-03-19 14:33 77,824 a------- c:\windows\pchealth\helpctr\vendors\cn=hewlett-packard,l=cupertino,s=ca,c=us\presario\xphnars4en\plugin\bin\FDIWrapper.dll
2009-03-18 17:54 4,132 a--shr-- c:\windows\system32\drivers\HP_PC182A-ABA SR1103WM NA430_YC_Pres_QCNC429_E43NAheREG3_4_IGamila Giovani Neon series_SMICRO-STAR INTERNATIONAL CO., LTD_V030_B3.11_T040517_WXH1_L409_M504_J40_7Intel_8Celeron_92.53_1_N10EC8139_P_Z11C1048C_K_A808624C5.MRK
2009-03-06 10:22 284,160 a------- c:\windows\system32\pdh.dll
2009-03-02 20:18 826,368 a------- c:\windows\system32\wininet.dll
2009-02-20 14:09 78,336 -------- c:\windows\system32\ieencode.dll
2009-02-09 08:10 729,088 a------- c:\windows\system32\lsasrv.dll
2009-02-09 08:10 714,752 a------- c:\windows\system32\ntdll.dll
2009-02-09 08:10 617,472 a------- c:\windows\system32\advapi32.dll
2009-02-09 08:10 401,408 a------- c:\windows\system32\rpcss.dll
2009-02-09 07:13 1,846,784 a------- c:\windows\system32\win32k.sys
2009-02-07 19:02 2,066,048 a------- c:\windows\system32\ntkrnlpa.exe
2009-02-06 07:11 110,592 a------- c:\windows\system32\services.exe
2009-02-06 07:08 2,189,056 a------- c:\windows\system32\ntoskrnl.exe
2009-02-06 06:39 35,328 a------- c:\windows\system32\sc.exe
2009-02-03 15:59 56,832 a------- c:\windows\system32\secur32.dll
2006-03-12 16:31 0 a--sh--- c:\windows\sminst\HPCD.SYS

============= FINISH: 15:27:52.60 ===============

Below is the Attatch file:

Attached Files

	ark.zip (909 Bytes, 1 views)
	Attatch.zip (2.5 KB, 1 views)

Ried

Hi sharoncrunch,

I'm not seeing any malware in the logs. Let's see if an online scan reveals anything. It can take some time, so please be patient and allow it to run it's full course:


Using Internet Explorer or Firefox, visit http://www.kaspersky.com/kos/eng/par...avwebscan.html

1. Click Accept, when prompted to download and install the program files and database of malware definitions.


2. To optimize scanning time and produce a more sensible report for review:

• Close any open programs
  
• Turn off the real time scanner of any existing antivirus program while performing the online scan

3. Click Run at the Security prompt. The program will then begin downloading and installing and will also update the database. Please be patient as this can take several minutes.

• Once the update is complete, click on My Computer under the green Scan bar to the left to start the scan.
• Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
• Do NOT be alarmed by what you see in the report. Many of the finds have likely been quarantined.
• Click View scan report at the bottom.
  
  
  
  
• Click the Save as Text button to save the file to your desktop so that you may post it in your next reply

sharoncrunch

Hi...I've not had two minutes over the past week--I am sorry for the delay posting--

Ran the Kapersky Scan and it came up clean--not a thing!! I ran it yesterday and also just now.

But Avira found 3 Appl/KillApp.A --1 in C:\hp\bin\killIt.exe--1 in a Recycler File-- 1 in SystemVol\Info\restore and 1 Appl\PsExec.F during a routinely scheduled scan on 4/25 and 4/26.

These were all quarantined.

I updated Avira and am now running a full scan.

Let me know what's next...(Incidentally, my system was running so sluggishly yesterday and was freezing up constantly).

Thanks!

Ried

What exactly did you do to try to clean this?

sharoncrunch

I guess we're both night owls tonight!

Let's see...this has been an ongoing PIA since January when I completely reinstalled (to factory contents) Windows XP(From CDs) as well as applying 4 years worth updates /patches and all other programs! (I backup now...)----This was done because I was unable to access antivirus/malware program --Mcafee-- (When icon clicked, nothing would happen).I also was unable to access IE from any location--the screen would just flash on and off. IE was the only browser installed at that time.

This was also around the time the printers began acting strangely--

Then in March when I tried to start in safe mode, just the hal.dll file was missing. When restarted, there were about 6-7 more unfound files. Next try, the what files were there displayed, then they began to disappear--one by one--until there were none. All of his was in safe mode. When I tried to restart in safe next time, the options screen came up; I selected Safe; but the windows screen (Windows logo) came up. And nothing else. I tried this a couple more times--same thing.

I did a System Recovery (no discs)--(F11). Reinstalled McAfee and ran immediately...Same with Malwarebytes and Superantispyware...Scans came back clean initially, if I recall...Made sure all updates/patches were in place. Scans were run daily. Mcafee (which I've since uninstalled) found RedAdm's, Trojan.BHO's, GenericPUP's, KillIt's, (other Kill's, too) on different occasions. I remember checking Mcafee's Network Intrusion Logs and seeing a LOT of unsolicited contacts, which I blocked and banned.

But no matter how vigilant I am, one of the scanners picks off a bug or two--pretty regularly too... Everything shows clean for a while... no security changes are made...then BOOM! Two, three, four--sometimes more-- bugs are found at once.

Ried

As you've reformatted twice now, I'd like to double check something before I send you off to our Windows Support section.

Please download mbr.exe and save it to your desktop.

Double click to run it. It will produce a log on your desktop named mbr.log.


Post that in your next reply please.

sharoncrunch

Ran the MBR...

Reads as follows:

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.5 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
kernel: MBR read successfully
user & kernel MBR ok

Ried

That rules out any rootkit on the Master Boot Record. I'm not finding any malware here. Whatever is plaguing your system seems to be OS related. As your issues involve more than just the printer, my suggestion is to post in the Windows XP Support section and let the folks there try to figure this out for you.

sharoncrunch

OK, Reid. I'll try that.

Thanks for all your help.

BTW, how do I go about transferring this post?

Ried

You cannot transfer this thread. If you do, it will get bounced right back here due to the logs posted. Simply post the pertinent, current issues you're experiencing and let them know you've been cleared from the Virus/Spyware/Malware removal help.