|
|
|
|
|||||
|
|
|
|
|
|
|||
| Welcome
to Tech Support Forum home to more then 136,000 problems solved. Issues
have included: Spyware, Malware, Virus Issues, Windows, Microsoft,
Linux, Networking, Security, Hardware, and Gaming Getting your
problem solved is as easy as: 1. Registering for a free account 2. Asking your question 3. Receiving an answer Registered members: * See fewer ads. * And much more..
|
| Want to know how to post a question? click here | Having problems with spyware and pop-ups? First Steps |
|
|||||||
| Resolved HJT Threads Resolved spyware and popup issues. |
|
|
LinkBack | Thread Tools |
06-27-2008, 06:58 PM
|
#1 (permalink) |
|
Registered User
Join Date: Jun 2008
Posts: 10
OS: Windows XP
|
Malware Downloaded to my System - DeeWoo, OuterInfo, CoolWebSearch plus others
Hey All,
I was on a joke website and I don't know if my Active X was enabled or if I clicked on an ad pop up when I was trying to close it, but something happened and I was swamped with some nasty programs. Desktop background changed to "spyware found", the computer tries to start up Internet Explorer and head to advertisements and other sites, registry setting was changed to prevent opening up Task Manager and the registry setting would change back if you tried to correct it. When I finally got Task Manager up, things like 444.470, rundll32.exe, iedll.exe, iexplore.exe and others were running. I quickly unplugged my network cable and I ran the free AdAware version that I have on my machine and it found some stuff, but didn't clean everything. I removed some tax information that I have on my machine to a flash drive. WARNING---Since this was my first infestation and before I knew I was in over my head and found your website, I attempted to clean up my machine myself. I knew the date and time I was infected and could tell what files were modified at that time, so I knew they were bad programs. If it is helpful, I can provide a list of the filenames modified at the time of infestation from the C:\Windows and C:\Windows\System32 directory. I deleted a couple and they reappeared shortly after, so I then created blank text files, renamed them to the bad file name executable and put them into the C:\Windows and C:\Windows\System32 directory. That way the virus wouldn't try to create them again, since it thought the bad files were there. I only did this for about 10 or so files before I realized that they might be tied to my OS and I could be doing some damage. I actually have most of the original bad files zipped up and saved on a flash drive, so I can put most of them back if that is the best thing to do. Then I found your website and followed the steps: STEP 1 -- please see paragraph above, I tried to disinfect myself before knowing what was up. I still have most of the files, should I put them back and run DSS.exe again? STEP 2 Panda seemed to hang when I tried to disinfect. Deckard's System Scanner v20071014.68 Run by Owner on 2008-06-27 19:10:39 Computer is in Normal Mode. -------------------------------------------------------------------------------- -- System Restore -------------------------------------------------------------- Successfully created a Deckard's System Scanner Restore Point. -- Last 5 Restore Point(s) -- 67: 2008-06-28 00:11:01 UTC - RP802 - Deckard's System Scanner Restore Point 66: 2008-06-26 23:11:41 UTC - RP801 - Removed Norton Security Center 65: 2008-06-26 01:02:01 UTC - RP800 - System Checkpoint 64: 2008-06-25 00:02:01 UTC - RP799 - System Checkpoint 63: 2008-06-23 23:02:01 UTC - RP798 - System Checkpoint -- First Restore Point -- 1: 2008-06-19 19:19:15 UTC - RP736 - System Checkpoint Backed up registry hives. Performed disk cleanup. Total Physical Memory: 495 MiB (512 MiB recommended). -- HijackThis Clone ------------------------------------------------------------ Emulating logfile of Trend Micro HijackThis v2.0.2 Scan saved at 2008-06-27 19:16:11 Platform: Windows XP Service Pack 2 (5.01.2600) MSIE: Internet Explorer (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\system32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\LEXPPS.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS C:\WINDOWS\system32\svchost.exe C:\Program Files\Canon\CAL\CALMAIN.exe C:\WINDOWS\explorer.exe C:\Program Files\Digital Media Reader\shwiconEM.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\system32\igfxtray.exe C:\WINDOWS\system32\hkcmd.exe C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe C:\Program Files\QuickTime\QTTask.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\Common Files\??curity\ping.exe C:\Program Files\Southwest Airlines\Ding\Ding.exe C:\Program Files\WinZip\WZQKPICK.EXE C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe C:\Program Files\iPod\bin\iPodService.exe C:\WINDOWS\?ymantec\r?gsvr32.exe C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\rundll32.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Documents and Settings\Owner\Desktop\dss.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.google.com/ie R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/ R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.google.com/search?q=%s R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.goole.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com/ie R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie R1 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\iftuyszv.exe, O2 - BHO: {142c4fb9-8f65-0a0b-b1d4-fc1d4f0aca52} - {25aca0f4-d1cf-4d1b-b0a0-56f89bf4c241} - C:\WINDOWS\system32\ezmjvd.dll O2 - BHO: (no name) - {9C28EAFB-FF50-4F42-8D39-A006129CC907} - C:\WINDOWS\system32\pmnmMGVo.dll O2 - BHO: (no name) - {A43CA8C3-8FAD-42CE-B06C-3CD1EBA7BBC8} - C:\WINDOWS\system32\ljJBqopo.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\GoogleToolbar3.dll O2 - BHO: (no name) - {AE66B448-22AE-0C57-AA38-09A2919B49B5} - C:\WINDOWS\system32\zqb.dll (file missing) O2 - BHO: (no name) - {F833ED4C-26FF-0301-FF38-09A2919B43B4} - C:\WINDOWS\system32\fizywppd.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\GoogleToolbar3.dll O4 - HKLM\..\Run: [SunKistEM] C:\Program Files\Digital Media Reader\shwiconem.exe O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" O4 - HKLM\..\Run: [Recguard] %WINDIR%\SMINST\RECGUARD.EXE O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [{6C-C6-63-3D-DW}] C:\windows\system32\vlwnw64.exe DWram1 O4 - HKLM\..\Run: [ExploreUpdSched] C:\WINDOWS\system32\mcntmadm.exe DWram1 O4 - HKLM\..\Run: [AntiSpywareMaster] C:\Program Files\AntiSpywareMaster\asm.exe O4 - HKLM\..\Run: [msci] C:\DOCUME~1\Owner\LOCALS~1\Temp\2008626181022_mcinfo.exe /insfin O4 - HKLM\..\Run: [Cleanup] C:\DOCUME~1\Owner\LOCALS~1\Temp\2008626181034_mcappins.exe /v=3 /cleanup O4 - HKLM\..\Run: [a846c692] rundll32.exe "C:\WINDOWS\system32\gwshqhfj.dll",b O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.0.720.3640\GoogleToolbarNotifier.exe O4 - HKCU\..\Run: [Cpue] "C:\PROGRA~1\COMMON~1\CURITY~1\ping.exe" -vt yazb O4 - HKCU\..\Run: [Nvqfoa] C:\WINDOWS\?ymantec\r?gsvr32.exe O4 - Startup: Picture Motion Browser Media Check Tool.lnk = ? O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: DING!.lnk = C:\Program Files\Southwest Airlines\Ding\Ding.exe O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE O7 - HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableTaskMgr=1 O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - CmdMapping - (file missing) O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - (file missing) O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (file missing) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O15 - Trusted Zone: *.avsystemcare.com (HKLM) O15 - Trusted Zone: *.gomyhit.com (HKLM) O15 - Trusted Zone: *.imageservr.com (HKLM) O15 - Trusted Zone: *.imagesrvr.com (HKLM) O15 - Trusted Zone: *.onerateld.com (HKLM) O15 - Trusted Zone: *.safetydownload.com (HKLM) O15 - Trusted Zone: *.storageguardsoft.com (HKLM) O15 - Trusted Zone: *.trustedantivirus.com (HKLM) O15 - Trusted Zone: *.virusschlacht.com (HKLM) O15 - Trusted Zone: https://*.update.microsoft.com (HKCU) O15 - Trusted Zone: http://*.update.microsoft.com (HKCU) O15 - Trusted Zone: https://update.microsoft.com (HKCU) O15 - Trusted Zone: http://update.microsoft.com (HKCU) O15 - Trusted Zone: http://download.windowsupdate.com (HKCU) O16 - DPF: {7584C670-2274-4EFB-B00B-D6AABA6D3850} (Microsoft RDP Client Control (redist)) - https://remote.schwab.com/svordp/,Da....com+msrdp.cab O16 - DPF: {E5F5D008-DD2C-4D32-977D-1A0ADF03058B} (JuniperSetupSP1 Control) - https://remote.schwab.com/dana-cache...erSetupSP1.cab O18 - Protocol: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll O18 - Protocol: mso-offdap - {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Program Files\Common Files\Microsoft Shared\Web Components\10\OWC10.DLL O18 - Protocol: mso-offdap11 - {32505114-5902-49B2-880A-1F7738E5A384} - C:\Program Files\Common Files\Microsoft Shared\Web Components\11\OWC11.DLL O18 - Filter: text/xml - {807553E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL O20 - Winlogon Notify: pmnmMGVo - C:\WINDOWS\system32\pmnmMGVo.dll O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE O23 - Service: MsSecurity Updated (MsSecurity1.209.4) - Unknown owner - C:\WINDOWS\444.470 O23 - Service: PrismXL - New Boundary Technologies, Inc. - C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS -- End of file - 8691 bytes -- File Associations ----------------------------------------------------------- All associations okay. -- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------- R1 rdbsss - c:\windows\system32\drivers\rdbsss.sys R2 ASCTRM - c:\windows\system32\drivers\asctrm.sys <Not Verified; Windows (R) 2000 DDK provider; Windows (R) 2000 DDK driver> R3 SunkFilt (Alcor Micro Corp Reader) - c:\windows\system32\drivers\sunkfilt.sys <Not Verified; Alcor Micro Corp.; SunkFilt> S3 wanatw (WAN Miniport (ATW)) - c:\windows\system32\drivers\wanatw4.sys (file missing) -- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled -------------------- R2 Apple Mobile Device - "c:\program files\common files\apple\mobile device support\bin\applemobiledeviceservice.exe" <Not Verified; Apple, Inc.; Apple Mobile Device Service> R2 CCALib8 (Canon Camera Access Library 8) - c:\program files\canon\cal\calmain.exe <Not Verified; Canon Inc.; > S2 MsSecurity1.209.4 (MsSecurity Updated) - c:\windows\444.470 service -- Device Manager: Disabled ---------------------------------------------------- No disabled devices found. -- Scheduled Tasks ------------------------------------------------------------- 2008-06-24 09:01:03 284 --a------ C:\WINDOWS\Tasks\AppleSoftwareUpdate.job 2005-07-01 13:37:53 258 --a------ C:\WINDOWS\Tasks\ISP signup reminder 3.job 2005-07-01 13:37:52 258 --a------ C:\WINDOWS\Tasks\ISP signup reminder 1.job -- Files created between 2008-05-27 and 2008-06-27 ----------------------------- 2008-06-27 18:53:07 0 d-------- C:\ie-spyad_zo 2008-06-27 18:48:44 0 d-------- C:\Documents and Settings\All Users\Application Data\TEMP 2008-06-27 18:48:01 0 d-------- C:\Program Files\SpywareBlaster 2008-06-27 18:47:11 322518 --a------ C:\ie-spyad_zo.exe 2008-06-27 18:47:10 0 d-------- C:\ZonedOut 2008-06-27 12:10:08 81920 --a------ C:\WINDOWS\system32\gwshqhfj.dll 2008-06-27 12:10:06 103424 --a------ C:\WINDOWS\system32\ezmjvd.dll 2008-06-27 12:10:05 103424 --a------ C:\WINDOWS\system32\kxyrauit.dll 2008-06-27 12:09:58 90624 --a------ C:\WINDOWS\system32\tuqxayem.dll 2008-06-27 12:07:00 80384 -----n--- C:\WINDOWS\system32\ripfuneu.dll 2008-06-27 11:54:57 80384 -----n--- C:\WINDOWS\system32\iinxhwus.dll 2008-06-27 11:51:57 80384 -----n--- C:\WINDOWS\system32\ymuqhcyw.dll 2008-06-27 10:51:57 80384 -----n--- C:\WINDOWS\system32\iluimpbh.dll 2008-06-27 10:48:57 80384 -----n--- C:\WINDOWS\system32\afimyjyx.dll 2008-06-27 09:48:57 80384 -----n--- C:\WINDOWS\system32\wqxtbyho.dll 2008-06-27 09:45:57 80384 -----n--- C:\WINDOWS\system32\kqnpnaxw.dll 2008-06-27 08:45:57 80384 -----n--- C:\WINDOWS\system32\gpvrirtf.dll 2008-06-27 08:42:57 80384 -----n--- C:\WINDOWS\system32\idkmpgtj.dll 2008-06-27 07:59:50 0 d-------- C:\WINDOWS\LastGood 2008-06-27 07:59:27 0 d-------- C:\Program Files\Panda Security 2008-06-27 07:51:29 60928 --a------ C:\WINDOWS\system32\fizywppd.dll 2008-06-27 07:51:29 0 d-------- C:\Program Files\??sks 2008-06-27 07:43:00 80384 -----n--- C:\WINDOWS\system32\lkvmdvev.dll 2008-06-27 07:40:00 80384 -----n--- C:\WINDOWS\system32\rsmktqjh.dll 2008-06-27 06:40:00 80384 -----n--- C:\WINDOWS\system32\mpdsoqvj.dll 2008-06-27 06:37:00 80384 -----n--- C:\WINDOWS\system32\exaoypoq.dll 2008-06-27 05:37:00 80384 -----n--- C:\WINDOWS\system32\suqlhwwk.dll 2008-06-27 05:34:00 80384 -----n--- C:\WINDOWS\system32\emipobkh.dll 2008-06-27 04:34:00 80384 -----n--- C:\WINDOWS\system32\qkyabsui.dll 2008-06-27 04:31:00 80384 -----n--- C:\WINDOWS\system32\faqfwoex.dll 2008-06-27 03:31:00 80384 -----n--- C:\WINDOWS\system32\jlmbjknx.dll 2008-06-27 03:28:00 80384 -----n--- C:\WINDOWS\system32\jereqvjl.dll 2008-06-27 02:28:00 80384 -----n--- C:\WINDOWS\system32\spbbqyhj.dll 2008-06-27 02:25:00 80384 -----n--- C:\WINDOWS\system32\etshehwl.dll 2008-06-27 01:25:00 80384 -----n--- C:\WINDOWS\system32\toatfsxa.dll 2008-06-27 01:22:00 80384 -----n--- C:\WINDOWS\system32\urthgnjr.dll 2008-06-27 00:22:00 80384 -----n--- C:\WINDOWS\system32\qxtcwtsu.dll 2008-06-27 00:19:00 80384 -----n--- C:\WINDOWS\system32\asukqthd.dll 2008-06-26 23:19:00 80384 -----n--- C:\WINDOWS\system32\qhyjiigt.dll 2008-06-26 23:16:00 80384 -----n--- C:\WINDOWS\system32\vnyiwcmk.dll 2008-06-26 22:16:00 80384 -----n--- C:\WINDOWS\system32\hiemqgyf.dll 2008-06-26 22:13:00 80384 -----n--- C:\WINDOWS\system32\xcmqrchp.dll 2008-06-26 21:38:16 0 d-------- C:\Bad 2008-06-26 21:13:00 80384 -----n--- C:\WINDOWS\system32\wywbthpe.dll 2008-06-26 21:10:00 80384 -----n--- C:\WINDOWS\system32\pcyeqipk.dll 2008-06-26 20:10:00 80384 -----n--- C:\WINDOWS\system32\rqnhjfwq.dll 2008-06-26 20:07:00 80384 -----n--- C:\WINDOWS\system32\yheiplvd.dll 2008-06-26 19:07:00 80384 -----n--- C:\WINDOWS\system32\sbgdayqb.dll 2008-06-26 19:04:00 80384 -----n--- C:\WINDOWS\system32\imgwtgkn.dll 2008-06-26 18:04:00 80384 -----n--- C:\WINDOWS\system32\nielyqsq.dll 2008-06-26 18:01:00 80384 -----n--- C:\WINDOWS\system32\yhqlpwhd.dll 2008-06-26 18:00:27 80384 -----n--- C:\WINDOWS\system32\khvipnnn.dll 2008-06-22 15:10:00 80384 -----n--- C:\WINDOWS\system32\vwgpsbed.dll 2008-06-21 20:43:00 0 --a------ C:\WINDOWS\olehelp.exe 2008-06-21 15:07:13 80384 -----n--- C:\WINDOWS\system32\wrauqwvk.dll 2008-06-19 18:51:30 0 --a------ C:\WINDOWS\msupdate.exe 2008-06-19 14:26:38 0 --a------ C:\WINDOWS\y.exe 2008-06-19 14:26:38 0 --a------ C:\WINDOWS\xplugin.dll 2008-06-19 14:26:37 0 --a------ C:\WINDOWS\x.exe 2008-06-19 14:26:37 20224 --a------ C:\WINDOWS\winmgnt.exe 2008-06-19 14:26:37 19712 --a------ C:\WINDOWS\window.exe 2008-06-19 14:26:37 17408 --a------ C:\WINDOWS\winajbm.dll 2008-06-19 14:26:37 18432 --a------ C:\WINDOWS\win64.exe 2008-06-19 14:26:37 27648 --a------ C:\WINDOWS\win32e.exe 2008-06-19 14:26:36 26368 --a------ C:\WINDOWS\waol.exe 2008-06-19 14:26:36 25344 --a------ C:\WINDOWS\users32.exe 2008-06-19 14:26:36 23296 --a------ C:\WINDOWS\time.exe 2008-06-19 14:26:36 32000 --a------ C:\WINDOWS\systemcritical.exe 2008-06-19 14:26:35 12288 --a------ C:\WINDOWS\systeem.exe 2008-06-19 14:26:35 27392 --a------ C:\WINDOWS\svcinit.exe 2008-06-19 14:26:35 26624 --a------ C:\WINDOWS\svchost32.exe 2008-06-19 14:26:35 19968 --a------ C:\WINDOWS\sistem.exe 2008-06-19 14:26:35 21248 --a------ C:\WINDOWS\searchword.dll 2008-06-19 14:26:34 28416 --a------ C:\WINDOWS\rundll16.exe 2008-06-19 14:26:34 21248 --a------ C:\WINDOWS\quicken.exe 2008-06-19 14:26:34 15872 --a------ C:\WINDOWS\qttasks.exe 2008-06-19 14:26:34 29952 --a------ C:\WINDOWS\notepad32.exe 2008-06-19 14:26:33 22784 --a------ C:\WINDOWS\mtwirl32.dll 2008-06-19 14:26:33 30720 --a------ C:\WINDOWS\mswsc20.dll 2008-06-19 14:26:33 10752 --a------ C:\WINDOWS\mswsc10.dll 2008-06-19 14:26:33 24064 --a------ C:\WINDOWS\msspi.dll 2008-06-19 14:26:32 28416 --a------ C:\WINDOWS\msconfd.dll 2008-06-19 14:26:32 9216 --a------ C:\WINDOWS\loader.exe 2008-06-19 14:26:32 15104 --a------ C:\WINDOWS\internet.exe 2008-06-19 14:26:32 20992 --a------ C:\WINDOWS\inetinf.exe 2008-06-19 14:26:32 0 --a------ C:\WINDOWS\iexplorer.exe 2008-06-19 14:26:32 0 --a------ C:\WINDOWS\iedll.exe 2008-06-19 14:26:32 25344 --a------ C:\WINDOWS\helpcvs.exe 2008-06-19 14:26:31 15360 --a------ C:\WINDOWS\gfmnaaa.dll 2008-06-19 14:26:31 22272 --a------ C:\WINDOWS\funny.exe 2008-06-19 14:26:31 29696 --a------ C:\WINDOWS\funniest.exe 2008-06-19 14:26:31 22272 --a------ C:\WINDOWS\explorer32.exe 2008-06-19 14:26:31 30208 --a------ C:\WINDOWS\explore.exe 2008-06-19 14:26:30 24320 --a------ C:\WINDOWS\editpad.exe 2008-06-19 14:26:30 23808 --a------ C:\WINDOWS\dnsrelay.dll 2008-06-19 14:26:30 16128 --a------ C:\WINDOWS\directx32.exe 2008-06-19 14:26:30 29696 --a------ C:\WINDOWS\ctrlpan.dll 2008-06-19 14:26:29 27904 --a------ C:\WINDOWS\ctfmon32.exe 2008-06-19 14:26:29 25600 --a------ C:\WINDOWS\cpan.dll 2008-06-19 14:26:29 21760 --a------ C:\WINDOWS\clrssn.exe 2008-06-19 14:26:28 29184 --a------ C:\WINDOWS\avpcc.dll 2008-06-19 14:26:28 19456 --a------ C:\WINDOWS\accesss.exe 2008-06-19 14:24:52 0 --a------ C:\WINDOWS\system32\vlwnw64.exe 2008-06-19 14:24:32 0 d-------- C:\Documents and Settings\LocalService\Application Data\NetMon 2008-06-19 14:21:13 80384 -----n--- C:\WINDOWS\system32\bdvwoipr.dll 2008-06-19 14:20:57 25088 --a------ C:\WINDOWS\system32\byXPFXrR.dll 2008-06-19 14:19:00 670785 --ahs---- C:\WINDOWS\system32\opoqBJjl.ini2 2008-06-19 14:18:49 322048 --a------ C:\WINDOWS\system32\ljJBqopo.dll 2008-06-19 14:14:37 0 d-------- C:\Documents and Settings\NetworkService\Application Data\Macromedia 2008-06-19 14:14:25 0 --a------ C:\WINDOWS\system32\winpfz33.sys 2008-06-19 14:14:20 0 d-------- C:\Program Files\Outerinfo 2008-06-19 14:14:19 0 d-------- C:\WINDOWS\?ymantec 2008-06-19 14:14:18 0 dr------- C:\Documents and Settings\NetworkService\Favorites 2008-06-19 14:14:13 0 --a------ C:\WINDOWS\system32\mcntmadm.exe 2008-06-19 14:14:12 0 --a------ C:\WINDOWS\system32\hljwugsf.bin 2008-06-19 14:14:05 0 d-------- C:\Documents and Settings\NetworkService\Application Data\NetMon 2008-06-19 14:14:00 0 --a------ C:\WINDOWS\system32\iftuyszv.exe 2008-06-19 14:14:00 88537 --a------ C:\WINDOWS\lfn.exe <Not Verified; Microsoft; XML Media> 2008-06-19 14:13:59 1989 --a------ C:\WINDOWS\uninstall_nmon.vbs 2008-06-19 14:13:58 0 d--hs---- C:\WINDOWS\IA 2008-06-19 14:13:57 0 --a------ C:\WINDOWS\system32\rwwnw64d.exe 2008-06-19 14:13:53 0 --a------ C:\WINDOWS\mrofinu1000106.exe 2008-06-19 14:13:50 86144 -----n--- C:\WINDOWS\system32\drivers\rdbsss.sys 2008-06-19 14:13:46 0 --a------ C:\WINDOWS\mrofinu572.exe 2008-06-19 14:13:45 0 d-------- C:\WINDOWS\system32\eb10 2008-06-19 14:13:45 0 d-------- C:\WINDOWS\system32\bgi 2008-06-19 14:13:45 0 d-------- C:\WINDOWS\system32\axc 2008-06-19 14:13:45 0 d-------- C:\WINDOWS\system32\1049a 2008-06-19 14:13:44 41723 ---hs---- C:\Program Files\Common Files\Yazzle1281OinUninstaller.exe 2008-06-19 14:13:43 0 d-------- C:\Program Files\Common Files\??curity 2008-06-19 14:13:37 0 d-------- C:\WINDOWS\system32\netrax01 2008-06-19 14:13:35 25088 --a------ C:\WINDOWS\system32\pmnmMGVo.dll 2008-06-07 10:29:30 0 d-------- C:\Ray Pure Genius Doubles -- Find3M Report --------------------------------------------------------------- 2008-06-27 07:51:29 0 d-------- C:\Program Files\??sks 2008-06-26 18:12:27 0 d-------- C:\Program Files\Common Files\Symantec Shared 2008-06-19 14:13:44 0 d-------- C:\Program Files\Common Files 2008-06-19 14:13:44 0 d-------- C:\Program Files\Common Files\??curity 2008-06-19 13:32:22 0 d-------- C:\Documents and Settings\Owner\Application Data\Juniper Networks 2008-06-11 20:16:09 0 d-------- C:\Documents and Settings\Owner\Application Data\Move Networks 2008-06-07 20:12:10 0 d-------- C:\Program Files\Common Files\Adobe 2008-06-07 20:10:22 0 d-------- C:\Documents and Settings\Owner\Application Data\AdobeUM -- Registry Dump --------------------------------------------------------------- *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{25aca0f4-d1cf-4d1b-b0a0-56f89bf4c241}] 06/27/2008 12:10 PM 103424 --a------ C:\WINDOWS\system32\ezmjvd.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{9C28EAFB-FF50-4F42-8D39-A006129CC907}] 06/19/2008 02:13 PM 25088 --a------ C:\WINDOWS\system32\pmnmMGVo.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A43CA8C3-8FAD-42CE-B06C-3CD1EBA7BBC8}] 06/19/2008 02:18 PM 322048 --a------ C:\WINDOWS\system32\ljJBqopo.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{AE66B448-22AE-0C57-AA38-09A2919B49B5}] C:\WINDOWS\system32\zqb.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F833ED4C-26FF-0301-FF38-09A2919B43B4}] 05/29/2008 01:34 PM 60928 --a------ C:\WINDOWS\system32\fizywppd.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SunKistEM"="C:\Program Files\Digital Media Reader\shwiconem.exe" [11/15/2004 05:04 PM] "@"="" [] "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [07/09/2001 01:50 PM] "IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [08/20/2004 05:55 PM] "HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [08/20/2004 05:51 PM] "RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [11/02/2004 10:24 PM] "Recguard"="%WINDIR%\SMINST\RECGUARD.EXE" [] "Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" [06/07/2005 12:46 AM] "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [03/28/2008 11:37 PM] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [03/30/2008 10:36 AM] "{6C-C6-63-3D-DW}"="C:\windows\system32\vlwnw64.exe" [06/21/2008 04:13 PM] "ExploreUpdSched"="C:\WINDOWS\system32\mcntmadm.exe" [06/21/2008 03:53 PM] "AntiSpywareMaster"="C:\Program Files\AntiSpywareMaster\asm.exe" [] "msci"="C:\DOCUME~1\Owner\LOCALS~1\Temp\2008626181022_mcinfo.exe" [] "Cleanup"="C:\DOCUME~1\Owner\LOCALS~1\Temp\2008626181034_mcappins.exe" [] "a846c692"="C:\WINDOWS\system32\gwshqhfj.dll" [06/27/2008 12:10 PM] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [10/13/2004 11:24 AM] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\1.0.720.3640\GoogleToolbarNotifier.exe" [] "Cpue"="C:\PROGRA~1\COMMON~1\CURITY~1\ping.exe" [06/19/2008 02:13 PM] "Nvqfoa"="C:\WINDOWS\?ymantec\r?gsvr32.exe" [05/29/2008 01:35 PM] C:\Documents and Settings\Owner\Start Menu\Programs\Startup\ Picture Motion Browser Media Check Tool.lnk - C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe [1/27/2008 3:11:43 PM] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [4/23/2008 3:38:16 AM] DING!.lnk - C:\Program Files\Southwest Airlines\Ding\Ding.exe [5/17/2005 2:22:42 PM] WinZip Quick Pick.lnk - C:\Program Files\WinZip\WZQKPICK.EXE [8/31/2006 10:09:25 PM] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "DisableTaskMgr"=1 (0x1) [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system] "DisableTaskMgr"=0 (0x0) [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] "{9C28EAFB-FF50-4F42-8D39-A006129CC907}"= C:\WINDOWS\system32\pmnmMGVo.dll [06/19/2008 02:13 PM 25088] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon] "Userinit"="C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\iftuyszv.exe," [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\pmnmMGVo] pmnmMGVo.dll 06/19/2008 02:13 PM 25088 C:\WINDOWS\system32\pmnmMGVo.dll [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] "Authentication Packages"= msv1_0 C:\WINDOWS\system32\ljJBqopo [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders] SecurityProviders msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll, ntoskrnl.dll [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{da41a284-a859-11dc-9488-0013204adce0}] AutoRun\command- L:\LaunchU3.exe -a *Newly Created Service* - APPMGMT *Newly Created Service* - RKPAVPROC -- End of Deckard's System Scanner: finished at 2008-06-27 19:17:46 ------------ |
|
     |
| Important Information |
|
Join the #1 Tech Support Forum Today - It's Totally Free!
TechSupportForum.com is a leading support website for your computer needs. We offer free, friendly and personalized computer support. Why pay to have your computer fixed when you can do it for free. Join TechSupportforum.com Today - Click Here |
|
07-01-2008, 04:18 AM
|
#2 (permalink) |
|
Moderator, Analyst, Security Team
Join Date: Oct 2006
Location: Důn Čideann,Scotland.
Posts: 5,093
OS: XP
|
Re: Malware Downloaded to my System - DeeWoo, OuterInfo, CoolWebSearch plus others
Hello and welcome to TSF
Please subscribe to this thread to get immediate notification of replies as soon as they are posted. To do this click Thread Tools, then click Subscribe to this Thread. Make sure it is set to Instant Notification, then click Subscribe. ======== Please follow all instructions and in which order they come, if you have any questions, please ask before proceeding. Its important that you follow this through until i give you the all clear, a lack of symptoms does not mean that it is no longer present. Please Do Not Attach logs to your posts unless you are advised to do so. ======== Please print out or copy this page to Notepad in order to assist you when carrying out the following instructions. ======== Click > Start > Control Panel > Add / Remove Programs and uninstall the following programs (if they exist): Viewpoint Media Player<---Viewpoint is considered as foistware instead of malware since it is installed without users approval but doesn't spy or do anything "bad". This will change from what we know in 2006 read this article: http://www.clickz.com/news/article.php/3561546 Additional Information Here and Here Deewoo Network Manager removal ========= Download SDFix and save it to your Desktop. Double click SDFix.exe and it will extract the files to %systemdrive% (Drive that contains the Windows Directory, typically C:SDFix) Please then reboot your computer in Safe Mode by doing the following :
========== Please visit this webpage for instructions for downloading and running ComboFix: http://www.bleepingcomputer.com/comb...o-use-combofix Please ensure you read this guide carefully and install the Recovery Console first. The Windows Recovery Console will allow you to boot up into a special recovery mode. This allows us to help you in the case that your computer has a problem after an attempted removal of malware. It is a simple procedure that will only take a few moments of your time. Once the Recovery Console is installed using ComboFix, you should see a message that says: The Recovery Console was successfully installed.  Please continue as follows: Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix. Click Yes to allow ComboFix to continue scanning for malware. When the tool is finished, it will produce a report for you. ========== Open HijackThis and click on 'Do a System Scan and save a Logfile'. Save the log file and post it here. ========== Logs Required Report.txt C:\Combofix.txt Hijackthis Log Last edited by TheBruce1; 07-01-2008 at 04:22 AM. |
|
|
|
|
07-01-2008, 09:55 PM
|
#3 (permalink) |
|
Registered User
Join Date: Jun 2008
Posts: 10
OS: Windows XP
|
Re: Malware Downloaded to my System - DeeWoo, OuterInfo, CoolWebSearch plus others
Thank you for replying. I deleted Viewpoint Media Player and followed the rest of your instructions. The three logs are copied below....
SDFix: Version 1.199 Run by Owner on Tue 07/01/2008 at 09:39 PM Microsoft Windows XP [Version 5.1.2600] Running From: C:\SDFix Checking Services : Name : MsSecurity1.209.4 Path : C:\WINDOWS\444.470 service MsSecurity1.209.4 - Deleted Restoring Default Security Values Restoring Default Hosts File Restoring Default Desktop Wallpaper Rebooting Checking Files : Trojan Files Found: C:\WINDOWS\system32\pmnmMGVo.dll - Deleted C:\WINDOWS\SYSTEM32\IFTUYSZV.EXE - Deleted C:\WINDOWS\SYSTEM32\MCNTMADM.EXE - Deleted C:\WINDOWS\SYSTEM32\RWWNW64D.EXE - Deleted C:\WINDOWS\SYSTEM32\VLWNW64.EXE - Deleted C:\WINDOWS\IEDLL.EXE - Deleted C:\WINDOWS\IEXPLO~1.EXE - Deleted C:\WINDOWS\MROFIN~1.EXE - Deleted C:\WINDOWS\MROFIN~2.EXE - Deleted C:\WINDOWS\MSUPDATE.EXE - Deleted C:\WINDOWS\OLEHELP.EXE - Deleted C:\WINDOWS\X.EXE - Deleted C:\WINDOWS\Y.EXE - Deleted C:\Documents and Settings\All Users\Start Menu\Programs\AntiSpywareMaster\AntiSpywareMaster.lnk - Deleted C:\Documents and Settings\All Users\Start Menu\Programs\AntiSpywareMaster\Uninstall AntiSpywareMaster.lnk - Deleted C:\Documents and Settings\Owner\Application Data\Microsoft\Internet Explorer\Quick Launch\AntiSpywareMaster.lnk - Deleted C:\Documents and Settings\LocalService\Application Data\NetMon\domains.txt - Deleted C:\Documents and Settings\LocalService\Application Data\NetMon\log.txt - Deleted C:\Temp\1cb\syscheck.log - Deleted C:\WINDOWS\system32\netrax01\netrax011065.exe - Deleted C:\Program Files\Common Files\Yazzle1281OinAdmin.exe - Deleted C:\Program Files\Common Files\Yazzle1281OinUninstaller.exe - Deleted C:\WINDOWS\x.exe - Deleted C:\WINDOWS\y.exe - Deleted C:\WINDOWS\mrofinu1000106.exe - Deleted C:\WINDOWS\mrofinu572.exe - Deleted C:\WINDOWS\mrofinu572.exe.tmp - Deleted C:\WINDOWS\accesss.exe - Deleted C:\WINDOWS\astctl32.ocx - Deleted C:\WINDOWS\avpcc.dll - Deleted C:\WINDOWS\clrssn.exe - Deleted C:\WINDOWS\cpan.dll - Deleted C:\WINDOWS\ctfmon32.exe - Deleted C:\WINDOWS\ctrlpan.dll - Deleted C:\WINDOWS\default.htm - Deleted C:\WINDOWS\directx32.exe - Deleted C:\WINDOWS\dnsrelay.dll - Deleted C:\WINDOWS\editpad.exe - Deleted C:\WINDOWS\explore.exe - Deleted C:\WINDOWS\explorer32.exe - Deleted C:\WINDOWS\funniest.exe - Deleted C:\WINDOWS\funny.exe - Deleted C:\WINDOWS\gfmnaaa.dll - Deleted C:\WINDOWS\helpcvs.exe - Deleted C:\WINDOWS\iedll.exe - Deleted C:\WINDOWS\iexplorer.exe - Deleted C:\WINDOWS\inetinf.exe - Deleted C:\WINDOWS\internet.exe - Deleted C:\WINDOWS\loader.exe - Deleted C:\WINDOWS\megavid.cdt - Deleted C:\WINDOWS\msconfd.dll - Deleted C:\WINDOWS\msspi.dll - Deleted C:\WINDOWS\msupdate.exe - Deleted C:\WINDOWS\mswsc10.dll - Deleted C:\WINDOWS\mswsc20.dll - Deleted C:\WINDOWS\mtwirl32.dll - Deleted C:\WINDOWS\muotr.so - Deleted C:\WINDOWS\notepad32.exe - Deleted C:\WINDOWS\olehelp.exe - Deleted C:\WINDOWS\qttasks.exe - Deleted C:\WINDOWS\quicken.exe - Deleted C:\WINDOWS\rundll16.exe - Deleted C:\WINDOWS\rundll32.vbe - Deleted C:\WINDOWS\searchword.dll - Deleted C:\WINDOWS\sistem.exe - Deleted C:\WINDOWS\svchost32.exe - Deleted C:\WINDOWS\svcinit.exe - Deleted C:\WINDOWS\systeem.exe - Deleted C:\WINDOWS\systemcritical.exe - Deleted C:\WINDOWS\system32\hljwugsf.bin - Deleted C:\WINDOWS\system32\iftuyszv.exe - Deleted C:\WINDOWS\system32\msnav32.ax - Deleted C:\WINDOWS\system32\pac.txt - Deleted C:\WINDOWS\system32\rwwnw64d.exe - Deleted C:\WINDOWS\system32\zxdnt3d.cfg - Deleted C:\WINDOWS\time.exe - Deleted C:\WINDOWS\uninstall_nmon.vbs - Deleted C:\WINDOWS\users32.exe - Deleted C:\WINDOWS\waol.exe - Deleted C:\WINDOWS\win32e.exe - Deleted C:\WINDOWS\win64.exe - Deleted C:\WINDOWS\winajbm.dll - Deleted C:\WINDOWS\window.exe - Deleted C:\WINDOWS\winmgnt.exe - Deleted C:\WINDOWS\xplugin.dll - Deleted C:\WINDOWS\xxxvideo.hta - Deleted Could Not Remove C:\WINDOWS\system32\drivers\core.cache.dsk Folder C:\Documents and Settings\All Users\Start Menu\Programs\SecurePCCleaner - Removed Folder C:\Documents and Settings\LocalService\Application Data\NetMon - Removed Folder C:\Temp\1cb - Removed Folder C:\Temp\tn3 - Removed Folder C:\WINDOWS\system32\netrax01 - Removed Removing Temp Files ADS Check : Final Check : catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-07-01 21:52:02 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden services & system hive ... scanning hidden registry entries ... scanning hidden files ... scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 Remaining Services : Authorized Application Key Export: [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "C:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe"="C:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe:*:Disabled:AOL" "C:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe"="C:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe:*:Disabled:AOL" "C:\\Program Files\\America Online 9.0\\waol.exe"="C:\\Program Files\\America Online 9.0\\waol.exe:*:Disabled:AOL" "C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE"="C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE:*:Enabled:Internet Explorer" "C:\\Program Files\\Bonjour\\mDNSResponder.exe"="C:\\Program Files\\Bonjour\\mDNSResponder.exe:*:Enabled:Bonjour" "C:\\Program Files\\Real\\RealPlayer\\realplay.exe"="C:\\Program Files\\Real\\RealPlayer\\realplay.exe:*:Enabled:RealPlayer" "C:\\Program Files\\Neoteris\\Secure Application Manager\\dsSamProxy.exe"="C:\\Program Files\\Neoteris\\Secure Application Manager\\dsSamProxy.exe:*:Enabled:Secure Application Manager Proxy" "C:\\Program Files\\Juniper Networks\\Secure Application Manager\\dsSamProxy.exe"="C:\\Program Files\\Juniper Networks\\Secure Application Manager\\dsSamProxy.exe:*:Disabled:Secure Application Manager Proxy" "C:\\Program Files\\TurboTax\\Deluxe 2006\\32bit\\ttax.exe"="C:\\Program Files\\TurboTax\\Deluxe 2006\\32bit\\ttax.exe:LocalSubNet:Enabled:TurboTax" "C:\\Program Files\\TurboTax\\Deluxe 2006\\32bit\\updatemgr.exe"="C:\\Program Files\\TurboTax\\Deluxe 2006\\32bit\\updatemgr.exe:LocalSubNet:Enabled:TurboTax Update Manager" "C:\\Program Files\\TurboTax\\Deluxe 2007\\32bit\\ttax.exe"="C:\\Program Files\\TurboTax\\Deluxe 2007\\32bit\\ttax.exe:LocalSubNet:Enabled:TurboTax" "C:\\Program Files\\TurboTax\\Deluxe 2007\\32bit\\updatemgr.exe"="C:\\Program Files\\TurboTax\\Deluxe 2007\\32bit\\updatemgr.exe:LocalSubNet:Enabled:TurboTax Update Manager" "C:\\Program Files\\iTunes\\iTunes.exe"="C:\\Program Files\\iTunes\\iTunes.exe:*:Enabled:iTunes" "C:\\WINDOWS\\system32\\mmc.exe"="C:\\WINDOWS\\system32\\mmc.exe:*:Enabled:Microsoft Management Console" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "C:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe"="C:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe:*:Enabled:AOL" "C:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe"="C:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe:*:Enabled:AOL" "C:\\Program Files\\America Online 9.0\\waol.exe"="C:\\Program Files\\America Online 9.0\\waol.exe:*:Enabled:AOL" Remaining Files : C:\WINDOWS\system32\drivers\core.cache.dsk Found File Backups: - C:\SDFix\backups\backups.zip Files with Hidden Attributes : Fri 1 Jul 2005 0 A.SH. --- "C:\WINDOWS\SMINST\HPCD.sys" Thu 29 May 2008 230,400 ..SHR --- "C:\WINDOWS\?ymantec\r?gsvr32.exe" Thu 19 Jun 2008 68,608 ..SHR --- "C:\Program Files\Common Files\??curity\ping.exe" Tue 30 Jan 2007 0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp" Mon 2 Oct 2006 50,280 ...H. --- "C:\Program Files\Common Files\Adobe\ESD\DLMCleanup.exe" Mon 12 Feb 2007 3,096,576 A..H. --- "C:\Documents and Settings\Owner\Application Data\U3\temp\Launchpad Removal.exe" Thu 19 Jun 2008 41,723 A.SH. --- "C:\Deckard\System Scanner\backup\DOCUME~1\Owner\LOCALS~1\Temp\~nsu.tmp\Au_.exe" Wed 30 Apr 2008 32,855 ..SHR --- "C:\Deckard\System Scanner\backup\DOCUME~1\Owner\LOCALS~1\Temp\Juniper Networks\setup\NeoterisSetupApp.exe" Finished! ComboFix 08-06-30.2 - Owner 2008-07-01 22:13:20.1 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.160 [GMT -5:00] Running from: C:\Documents and Settings\Owner\Desktop\ComboFix.exe Command switches used :: C:\Documents and Settings\Owner\Desktop\WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe * Created a new restore point . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\NetworkService\Application Data\NetMon C:\Documents and Settings\NetworkService\Application Data\NetMon\domains.txt C:\Documents and Settings\NetworkService\Application Data\NetMon\log.txt C:\Program Files\Common Files\curity~1 C:\Program Files\Common Files\curity~1\??curity\ C:\Program Files\Common Files\curity~1\ping.exe C:\Program Files\outerinfo C:\Program Files\outerinfo\FF\chrome.manifest C:\Program Files\outerinfo\FF\components\FF.dll C:\Program Files\outerinfo\FF\components\OuterinfoAds.xpt C:\Program Files\outerinfo\FF\install.rdf C:\Program Files\sks~1 C:\temp\tn3 C:\WINDOWS\444.470 C:\WINDOWS\IA C:\WINDOWS\IA\KE.vbs C:\WINDOWS\lfn.exe C:\WINDOWS\mainms.vpi C:\WINDOWS\pskt.ini C:\WINDOWS\system32\axsftaot.ini C:\WINDOWS\system32\bqyadgbs.ini C:\WINDOWS\system32\byXPFXrR.dll C:\WINDOWS\system32\dcgubjjs.dll C:\WINDOWS\system32\debspgwv.ini C:\WINDOWS\system32\dhtqkusa.ini C:\WINDOWS\system32\dhwplqhy.ini C:\WINDOWS\system32\drivers\rdbsss.sys C:\WINDOWS\system32\dvlpiehy.ini C:\WINDOWS\system32\ephtbwyw.ini C:\WINDOWS\system32\ezmjvd.dll C:\WINDOWS\system32\fizywppd.dll C:\WINDOWS\system32\ftrirvpg.ini C:\WINDOWS\system32\fygqmeih.ini C:\WINDOWS\system32\gwshqhfj.dll C:\WINDOWS\system32\hbpmiuli.ini C:\WINDOWS\system32\hhugai.dll C:\WINDOWS\system32\hjqtkmsr.ini C:\WINDOWS\system32\hkbopime.ini C:\WINDOWS\system32\iusbaykq.ini C:\WINDOWS\system32\jfhqhswg.ini C:\WINDOWS\system32\jhyqbbps.ini C:\WINDOWS\system32\jtgpmkdi.ini C:\WINDOWS\system32\jvqosdpm.ini C:\WINDOWS\system32\kgcjblwt.dll C:\WINDOWS\system32\kmcwiynv.ini C:\WINDOWS\system32\kpiqeycp.ini C:\WINDOWS\system32\kvwquarw.ini C:\WINDOWS\system32\kwwhlqus.ini C:\WINDOWS\system32\kxyrauit.dll C:\WINDOWS\system32\ljJBqopo.dll C:\WINDOWS\system32\ljvqerej.ini C:\WINDOWS\system32\lwhehste.ini C:\WINDOWS\system32\MSINET.oca C:\WINDOWS\system32\nkgtwgmi.ini C:\WINDOWS\system32\nnnpivhk.ini C:\WINDOWS\system32\ohybtxqw.ini C:\WINDOWS\system32\opoqBJjl.ini C:\WINDOWS\system32\opoqBJjl.ini2 C:\WINDOWS\system32\pdprtgsy.dll C:\WINDOWS\system32\phcrqmcx.ini C:\WINDOWS\system32\qopyoaxe.ini C:\WINDOWS\system32\qsqylein.ini C:\WINDOWS\system32\qwfjhnqr.ini C:\WINDOWS\system32\rjnghtru.ini C:\WINDOWS\system32\rpgcnfby.dll C:\WINDOWS\system32\rpiowvdb.ini C:\WINDOWS\system32\suwhxnii.ini C:\WINDOWS\system32\tgiijyhq.ini C:\WINDOWS\system32\tuqxayem.dll C:\WINDOWS\system32\uenufpir.ini C:\WINDOWS\system32\ustwctxq.ini C:\WINDOWS\system32\vevdmvkl.ini C:\WINDOWS\system32\winpfz33.sys C:\WINDOWS\system32\wxanpnqk.ini C:\WINDOWS\system32\wychqumy.ini C:\WINDOWS\system32\xeowfqaf.ini C:\WINDOWS\system32\xnkjbmlj.ini C:\WINDOWS\system32\xyjymifa.ini C:\WINDOWS\system32\zzeuwc.dll C:\WINDOWS\ymante~1 C:\WINDOWS\ymante~1\r?gsvr32.exe D:\Autorun.inf . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_CMDSERVICE -------\Legacy_RDBSSS -------\Service_cmdService -------\Service_rdbsss ((((((((((((((((((((((((( Files Created from 2008-06-02 to 2008-07-02 ))))))))))))))))))))))))))))))) . 2008-07-01 21:48 . 2008-07-01 21:48 167,976 --a------ C:\WINDOWS\system32\drivers\core.cache.dsk 2008-07-01 21:33 . 2008-07-01 21:34 <DIR> d-------- C:\WINDOWS\ERUNT 2008-07-01 21:28 . 2008-07-01 21:56 <DIR> d-------- C:\SDFix 2008-06-27 19:10 . 2008-06-27 19:10 <DIR> d-------- C:\Deckard 2008-06-27 18:53 . 2008-06-27 18:53 <DIR> d-------- C:\ie-spyad_zo 2008-06-27 18:48 . 2008-06-27 18:49 <DIR> d-------- C:\Program Files\SpywareBlaster 2008-06-27 18:48 . 2008-06-27 18:48 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\TEMP 2008-06-27 18:47 . 2008-06-27 18:47 <DIR> d-------- C:\ZonedOut 2008-06-27 18:47 . 2008-06-26 14:13 2,869,536 --a------ C:\spywareblastersetup41.exe 2008-06-27 18:47 . 2008-02-05 15:59 322,518 --a------ C:\ie-spyad_zo.exe 2008-06-27 12:16 . 2008-06-27 12:16 9,662 --a------ C:\WINDOWS\system32\ZoneAlarmIconUS.ico 2008-06-27 12:09 . 2008-07-01 21:08 110,419 --a------ C:\WINDOWS\BMab75f50e.xml 2008-06-27 07:59 . 2008-06-27 08:00 <DIR> d-------- C:\Program Files\Panda Security 2008-06-26 21:38 . 2008-06-27 18:33 <DIR> d-------- C:\Bad 2008-06-19 14:13 . 2008-06-19 14:13 <DIR> d-------- C:\WINDOWS\system32\eb10 2008-06-19 14:13 . 2008-06-27 18:33 <DIR> d-------- C:\WINDOWS\system32\bgi 2008-06-19 14:13 . 2008-06-19 14:13 <DIR> d-------- C:\WINDOWS\system32\axc 2008-06-19 14:13 . 2008-06-19 14:47 <DIR> d-------- C:\WINDOWS\system32\1049a 2008-06-19 14:13 . 2008-06-19 14:13 <DIR> d-------- C:\temp\itmp4 2008-06-10 17:34 . 2008-04-14 06:01 272,128 --a------ C:\WINDOWS\system32\drivers\bthport.sys 2008-06-10 17:34 . 2008-04-14 06:01 272,128 --a--c--- C:\WINDOWS\system32\dllcache\bthport.sys 2008-06-07 10:29 . 2008-06-07 10:29 <DIR> d-------- C:\Ray Pure Genius Doubles . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-07-02 02:14 --------- d-----w C:\Documents and Settings\All Users\Application Data\Viewpoint 2008-07-01 01:53 --------- d-----w C:\Program Files\Symantec 2008-06-26 23:12 --------- d-----w C:\Program Files\Common Files\Symantec Shared 2008-06-26 23:10 --------- d-----w C:\Documents and Settings\All Users\Application Data\McAfee.com 2008-06-19 18:32 --------- d-----w C:\Documents and Settings\Owner\Application Data\Juniper Networks 2008-06-12 01:16 --------- d-----w C:\Documents and Settings\Owner\Application Data\Move Networks 2008-06-08 01:12 --------- d-----w C:\Program Files\Common Files\Adobe 2008-06-08 01:10 --------- d-----w C:\Documents and Settings\Owner\Application Data\AdobeUM 2008-05-08 12:28 202,752 ----a-w C:\WINDOWS\system32\drivers\rmcast.sys 2008-04-12 22:21 1,179,658 ----a-w C:\f5d7230-4v5_us_fw_7.01.06.bin 2005-11-26 03:52 0 ----a-w C:\Documents and Settings\Owner\Application Data\wklnhst.dat 2005-07-01 19:08 0 --sha-w C:\WINDOWS\SMINST\HPCD.sys . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Nvqfoa"="C:\WINDOWS\?ymantec\r?gsvr32.exe" [?] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SunKistEM"="C:\Program Files\Digital Media Reader\shwiconem.exe" [2004-11-15 17:04 135168] "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 13:50 155648] "IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2004-08-20 17:55 155648] "HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2004-08-20 17:51 118784] "RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2004-11-02 22:24 32768] "Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" [2005-06-07 00:46 57344] "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-03-28 23:37 413696] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-03-30 10:36 267048] C:\Documents and Settings\Owner\Start Menu\Programs\Startup\ Picture Motion Browser Media Check Tool.lnk - C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe [2008-01-27 15:11:43 344064] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2008-04-23 03:38:16 29696] DING!.lnk - C:\Program Files\Southwest Airlines\Ding\Ding.exe [2005-05-17 14:22:42 462848] WinZip Quick Pick.lnk - C:\Program Files\WinZip\WZQKPICK.EXE [2006-08-31 22:09:25 122880] [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders] SecurityProviders msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll, ntoskrnl.dll [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE"= "C:\\Program Files\\Real\\RealPlayer\\realplay.exe"= "C:\\Program Files\\Juniper Networks\\Secure Application Manager\\dsSamProxy.exe"= "C:\\Program Files\\iTunes\\iTunes.exe"= "C:\\WINDOWS\\system32\\mmc.exe"= R1 NEOFLTR_600_13073;Juniper Networks TDI Filter Driver (NEOFLTR_600_13073);C:\WINDOWS\system32\Drivers\NEOFLTR_600_13073.SYS [2008-04-30 14:54] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{da41a284-a859-11dc-9488-0013204adce0}] \Shell\AutoRun\command - L:\LaunchU3.exe -a . Contents of the 'Scheduled Tasks' folder "2008-06-24 14:01:03 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job" - C:\Program Files\Apple Software Update\SoftwareUpdate.exe "2005-07-01 18:37:52 C:\WINDOWS\Tasks\ISP signup reminder 1.job" - C:\WINDOWS\system32\OOBE\oobebaln.exe "2005-07-01 18:37:53 C:\WINDOWS\Tasks\ISP signup reminder 3.job" - C:\WINDOWS\system32\OOBE\oobebaln.exe . - - - - ORPHANS REMOVED - - - - BHO-{AE66B448-22AE-0C57-AA38-09A2919B49B5} - C:\WINDOWS\system32\zqb.dll HKCU-Run-swg - C:\Program Files\Google\GoogleToolbarNotifier\1.0.720.3640\GoogleToolbarNotifier.exe HKCU-Run-Cpue - C:\PROGRA~1\COMMON~1\CURITY~1\ping.exe HKLM-Run-{6C-C6-63-3D-DW} - C:\windows\system32\vlwnw64.exe HKLM-Run-a846c692 - C:\WINDOWS\system32\gwshqhfj.dll HKLM-Run-BMab75f50e - C:\WINDOWS\system32\dcgubjjs.dll ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-07-01 22:20:25 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . ------------------------ Other Running Processes ------------------------ . C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\LEXPPS.EXE C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\rundll32.exe C:\PROGRA~1\WinZip\WZQKPICK.EXE C:\Program Files\Canon\CAL\CALMAIN.exe C:\Program Files\iPod\bin\iPodService.exe C:\WINDOWS\system32\wscntfy.exe . ************************************************************************** . Completion time: 2008-07-01 22:26:16 - machine was rebooted ComboFix-quarantined-files.txt 2008-07-02 03:26:13 Pre-Run: 25,979,449,344 bytes free Post-Run: 26,009,219,072 bytes free WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems] multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect C:\CMDCONS\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons 224 --- E O F --- 2008-06-11 04:00:33 Deckard's System Scanner v20071014.68 Run by Owner on 2008-07-01 22:52:39 Computer is in Normal Mode. -------------------------------------------------------------------------------- Total Physical Memory: 495 MiB (512 MiB recommended). -- HijackThis (run as Owner.exe) ----------------------------------------------- Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 10:54:28 PM, on 7/1/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\LEXPPS.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS C:\WINDOWS\system32\svchost.exe C:\Program Files\Digital Media Reader\shwiconem.exe C:\WINDOWS\system32\igfxtray.exe C:\WINDOWS\system32\hkcmd.exe C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe C:\Program Files\QuickTime\QTTask.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Southwest Airlines\Ding\Ding.exe C:\Program Files\WinZip\WZQKPICK.EXE C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe C:\Program Files\Canon\CAL\CALMAIN.exe C:\Program Files\iPod\bin\iPodService.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\explorer.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Documents and Settings\Owner\Desktop\dss.exe C:\PROGRA~1\TRENDM~1\HIJACK~1\Owner.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.goole.com O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - (no file) O3 - Toolbar: (no name) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - (no file) O4 - HKLM\..\Run: [SunKistEM] C:\Program Files\Digital Media Reader\shwiconem.exe O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" O4 - HKLM\..\Run: [Recguard] %WINDIR%\SMINST\RECGUARD.EXE O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKCU\..\Run: [Nvqfoa] C:\WINDOWS\?ymantec\r?gsvr32.exe O4 - Startup: Picture Motion Browser Media Check Tool.lnk = C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: DING!.lnk = C:\Program Files\Southwest Airlines\Ding\Ding.exe O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O15 - Trusted Zone: http://download.windowsupdate.com O15 - Trusted Zone: *.avsystemcare.com (HKLM) O15 - Trusted Zone: *.gomyhit.com (HKLM) O15 - Trusted Zone: *.imageservr.com (HKLM) O15 - Trusted Zone: *.imagesrvr.com (HKLM) O15 - Trusted Zone: *.onerateld.com (HKLM) O15 - Trusted Zone: *.safetydownload.com (HKLM) O15 - Trusted Zone: *.storageguardsoft.com (HKLM) O15 - Trusted Zone: *.trustedantivirus.com (HKLM) O15 - Trusted Zone: *.virusschlacht.com (HKLM) O16 - DPF: {7584C670-2274-4EFB-B00B-D6AABA6D3850} (Microsoft RDP Client Control (redist)) - https://remote.schwab.com/svordp/,Da....com+msrdp.cab O16 - DPF: {E5F5D008-DD2C-4D32-977D-1A0ADF03058B} (JuniperSetupSP1 Control) - https://remote.schwab.com/dana-cache...erSetupSP1.cab O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE O23 - Service: PrismXL - New Boundary Technologies, Inc. - C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS -- End of file - 5627 bytes -- Files created between 2008-06-01 and 2008-07-01 ----------------------------- 2008-07-01 22:52:48 0 d-------- C:\Program Files\Trend Micro 2008-07-01 22:13:06 0 d-------- C:\cmdcons 2008-07-01 22:10:10 68096 --a------ C:\WINDOWS\zip.exe 2008-07-01 22:10:10 49152 --a------ C:\WINDOWS\VFind.exe 2008-07-01 22:10:10 212480 --a------ C:\WINDOWS\swxcacls.exe <Not Verified; SteelWerX; SteelWerX Extended Configurator ACLists> 2008-07-01 22:10:10 136704 --a------ C:\WINDOWS\swsc.exe <Not Verified; SteelWerX; SteelWerX Service Controller> 2008-07-01 22:10:10 161792 --a------ C:\WINDOWS\swreg.exe <Not Verified; SteelWerX; SteelWerX Registry Editor> 2008-07-01 22:10:10 98816 --a------ C:\WINDOWS\sed.exe 2008-07-01 22:10:10 80412 --a------ C:\WINDOWS\grep.exe 2008-07-01 22:10:10 89504 --a------ C:\WINDOWS\fdsv.exe <Not Verified; Smallfrogs Studio; > 2008-07-01 21:33:53 0 d-------- C:\WINDOWS\ERUNT 2008-06-27 18:53:07 0 d-------- C:\ie-spyad_zo 2008-06-27 18:48:44 0 d-------- C:\Documents and Settings\All Users\Application Data\TEMP 2008-06-27 18:48:01 0 d-------- C:\Program Files\SpywareBlaster 2008-06-27 18:47:11 322518 --a------ C:\ie-spyad_zo.exe 2008-06-27 18:47:10 0 d-------- C:\ZonedOut 2008-06-27 07:59:27 0 d-------- C:\Program Files\Panda Security 2008-06-26 21:38:16 0 d-------- C:\Bad 2008-06-19 14:14:37 0 d-------- C:\Documents and Settings\NetworkService\Application Data\Macromedia 2008-06-19 14:14:18 0 dr------- C:\Documents and Settings\NetworkService\Favorites 2008-06-19 14:13:45 0 d-------- C:\WINDOWS\system32\eb10 2008-06-19 14:13:45 0 d-------- C:\WINDOWS\system32\bgi 2008-06-19 14:13:45 0 d-------- C:\WINDOWS\system32\axc 2008-06-19 14:13:45 0 d-------- C:\WINDOWS\system32\1049a 2008-06-07 10:29:30 0 d-------- C:\Ray Pure Genius Doubles -- Find3M Report --------------------------------------------------------------- 2008-07-01 22:13:32 0 d-------- C:\Program Files\Common Files 2008-06-30 20:53:55 0 d-------- C:\Program Files\Symantec 2008-06-26 18:12:27 0 d-------- C:\Program Files\Common Files\Symantec Shared 2008-06-19 13:32:22 0 d-------- C:\Documents and Settings\Owner\Application Data\Juniper Networks 2008-06-11 20:16:09 0 d-------- C:\Documents and Settings\Owner\Application Data\Move Networks 2008-06-07 20:12:10 0 d-------- C:\Program Files\Common Files\Adobe 2008-06-07 20:10:22 0 d-------- C:\Documents and Settings\Owner\Application Data\AdobeUM -- Registry Dump --------------------------------------------------------------- *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SunKistEM"="C:\Program Files\Digital Media Reader\shwiconem.exe" [11/15/2004 05:04 PM] "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [07/09/2001 01:50 PM] "IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [08/20/2004 05:55 PM] "HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [08/20/2004 05:51 PM] "RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [11/02/2004 10:24 PM] "Recguard"="%WINDIR%\SMINST\RECGUARD.EXE" [] "Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" [06/07/2005 12:46 AM] "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [03/28/2008 11:37 PM] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [03/30/2008 10:36 AM] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Nvqfoa"="C:\WINDOWS\?ymantec\r?gsvr32.exe" [] C:\Documents and Settings\Owner\Start Menu\Programs\Startup\ Picture Motion Browser Media Check Tool.lnk - C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe [1/27/2008 3:11:43 PM] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [4/23/2008 3:38:16 AM] DING!.lnk - C:\Program Files\Southwest Airlines\Ding\Ding.exe [5/17/2005 2:22:42 PM] WinZip Quick Pick.lnk - C:\Program Files\WinZip\WZQKPICK.EXE [8/31/2006 10:09:25 PM] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "DisableRegistryTools"=0 (0x0) "HideLegacyLogonScripts"=0 (0x0) "HideLogoffScripts"=0 (0x0) "RunLogonScriptSync"=1 (0x1) "RunStartupScriptSync"=0 (0x0) "HideStartupScripts"=0 (0x0) [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system] "HideLegacyLogonScripts"=0 (0x0) "HideLogoffScripts"=0 (0x0) "RunLogonScriptSync"=1 (0x1) "RunStartupScriptSync"=0 (0x0) "HideStartupScripts"=0 (0x0) [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders] SecurityProviders msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll, ntoskrnl.dll [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{da41a284-a859-11dc-9488-0013204adce0}] AutoRun\command- L:\LaunchU3.exe -a -- End of Deckard's System Scanner: finished at 2008-07-01 22:54:49 ------------ |
|
|
|
|
07-02-2008, 06:14 AM
|
#4 (permalink) | |
|
Moderator, Analyst, Security Team
Join Date: Oct 2006
Location: Důn Čideann,Scotland.
Posts: 5,093
OS: XP
|
Re: Malware Downloaded to my System - DeeWoo, OuterInfo, CoolWebSearch plus others
Hello again
Download ATF-Cleaner by Atribune to your desktop. Do not run just yet, we will shortly ======= Click > Start > Control Panel > Add / Remove Programs and uninstall the following programs (if they exist): Outerinfo ======== Open HijackThis and click on 'Do a System Scan Only'. Check the following entries (If they still exist, make sure you do not miss any) O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - (no file) O3 - Toolbar: (no name) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - (no file) O4 - HKCU\..\Run: [Nvqfoa] C:\WINDOWS\?ymantec\r?gsvr32.exe O15 - Trusted Zone: http://download.windowsupdate.com O15 - Trusted Zone: *.avsystemcare.com (HKLM) O15 - Trusted Zone: *.gomyhit.com (HKLM) O15 - Trusted Zone: *.imageservr.com (HKLM) O15 - Trusted Zone: *.imagesrvr.com (HKLM) O15 - Trusted Zone: *.onerateld.com (HKLM) O15 - Trusted Zone: *.safetydownload.com (HKLM) O15 - Trusted Zone: *.storageguardsoft.com (HKLM) O15 - Trusted Zone: *.trustedantivirus.com (HKLM) O15 - Trusted Zone: *.virusschlacht.com (HKLM) Please remember to close all other windows, including browsers then click Fix checked. ======== Open notepad and copy/paste the text in the quotebox below into it: Quote:
 Refering to the picture above, drag CFscript into ComboFix.exe Follow the prompts, and post the resulting log, C:\ComboFix.txt Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system. Warning: Do not mouseclick combofix's window whilst it's running. That may cause it to stall ========== JAVA OUTDATED Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update.
========== Double-click ATF Cleaner.exe to open it Under Main choose: Windows Temp Current User Temp All Users Temp Cookies Temporary Internet Files Prefetch Java Cache *The other boxes are optional* Then click the Empty Selected button. If you have Firefox installed: Click Firefox at the top and choose: Select All Click the Empty Selected button. NOTE: If you would like to keep your saved passwords, please click NO at the prompt. If you have Opera installed: Click Opera at the top and choose: Select All Click the Empty Selected button. NOTE: If you would like to keep your saved passwords, please click NO at the prompt. Click Exit on the Main menu to close the program. =========== No AntiVirus Onboard I see no evidence of an AntiVirus program on your system. This must be resolved. Here are a few very good free Antivirus products which are available:Select one of these, or another of your choice. Download, install, update definitions, and run a full system scan. =========== Open HijackThis and click on 'Do a System Scan and save a Logfile'. Save the log file and post it here. =========== Logs Required C;\Combofix.txt Results from AV scan Hijackthis Log How is you system behaving now. |
|
|
|
|
|
07-03-2008, 07:36 AM
|
#5 (permalink) |
|
Registered User
Join Date: Jun 2008
Posts: 10
OS: Windows XP
|
Re: Malware Downloaded to my System - DeeWoo, OuterInfo, CoolWebSearch plus others
Thanks again, TheBruce1. I have Ad-Aware Personal Edition on my machine, which I previously used for checking spyware. I still downloaded Avast! and ran it, but the default setting does not produce a log\report, so I didn't include an AV report below. Please let me know if I should run another scan with Avast! to produce a report. My machine shows no outward signs of any viruses right now.
I have a decent amount of personal information, especially the information that Turbo Tax uses, on my machine. Are the viruses and malware that hit my system smart enough to get to that info? Below are the ComboFix log and the Hijackthis log... ComboFix 08-06-30.2 - Owner 2008-07-02 22:08:27.2 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.210 [GMT -5:00] Running from: C:\Documents and Settings\Owner\Desktop\ComboFix.exe Command switches used :: C:\Documents and Settings\Owner\Desktop\CFscript.txt * Created a new restore point FILE :: C:\WINDOWS\BMab75f50e.xml C:\WINDOWS\system32\drivers\core.cache.dsk . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\All Users\Application Data\McAfee.com C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\McSubDB.Bak C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\mcifolog.log C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\mcini.ini C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\McSubDB.Dat C:\Documents and Settings\All Users\Application Data\Viewpoint C:\Program Files\Common Files\Symantec Shared C:\temp\itmp4 C:\temp\itmp4\mkbv4i.log C:\WINDOWS\BMab75f50e.xml C:\WINDOWS\system32\1049a C:\WINDOWS\system32\axc C:\WINDOWS\system32\axc\ashcom3e.exe C:\WINDOWS\system32\bgi C:\WINDOWS\system32\drivers\core.cache.dsk C:\WINDOWS\system32\eb10 C:\WINDOWS\system32\eb10\zvuxderr.exe . ((((((((((((((((((((((((( Files Created from 2008-06-03 to 2008-07-03 ))))))))))))))))))))))))))))))) . 2008-07-01 22:52 . 2008-07-01 22:52 <DIR> d-------- C:\Program Files\Trend Micro 2008-07-01 21:33 . 2008-07-01 21:34 <DIR> d-------- C:\WINDOWS\ERUNT 2008-07-01 21:28 . 2008-07-01 21:56 <DIR> d-------- C:\SDFix 2008-06-27 19:10 . 2008-06-27 19:10 <DIR> d-------- C:\Deckard 2008-06-27 18:53 . 2008-06-27 18:53 <DIR> d-------- C:\ie-spyad_zo 2008-06-27 18:48 . 2008-06-27 18:49 <DIR> d-------- C:\Program Files\SpywareBlaster 2008-06-27 18:48 . 2008-06-27 18:48 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\TEMP 2008-06-27 18:47 . 2008-06-27 18:47 <DIR> d-------- C:\ZonedOut 2008-06-27 18:47 . 2008-06-26 14:13 2,869,536 --a------ C:\spywareblastersetup41.exe 2008-06-27 18:47 . 2008-02-05 15:59 322,518 --a------ C:\ie-spyad_zo.exe 2008-06-27 12:16 . 2008-06-27 12:16 9,662 --a------ C:\WINDOWS\system32\ZoneAlarmIconUS.ico 2008-06-27 07:59 . 2008-06-27 08:00 <DIR> d-------- C:\Program Files\Panda Security 2008-06-10 17:34 . 2008-06-13 08:10 272,128 --a------ C:\WINDOWS\system32\drivers\bthport.sys 2008-06-10 17:34 . 2008-06-13 08:10 272,128 --a--c--- C:\WINDOWS\system32\dllcache\bthport.sys 2008-06-07 10:29 . 2008-06-07 10:29 <DIR> d-------- C:\Ray Pure Genius Doubles . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-07-01 01:53 --------- d-----w C:\Program Files\Symantec 2008-06-19 18:32 --------- d-----w C:\Documents and Settings\Owner\Application Data\Juniper Networks 2008-06-12 01:16 --------- d-----w C:\Documents and Settings\Owner\Application Data\Move Networks 2008-06-08 01:12 --------- d-----w C:\Program Files\Common Files\Adobe 2008-06-08 01:10 --------- d-----w C:\Documents and Settings\Owner\Application Data\AdobeUM 2008-05-08 12:28 202,752 ----a-w C:\WINDOWS\system32\drivers\rmcast.sys 2008-05-07 05:18 1,287,680 ----a-w C:\WINDOWS\system32\quartz.dll 2008-04-21 07:04 659,456 ----a-w C:\WINDOWS\system32\wininet.dll 2008-04-12 22:21 1,179,658 ----a-w C:\f5d7230-4v5_us_fw_7.01.06.bin 2005-11-26 03:52 0 ----a-w C:\Documents and Settings\Owner\Application Data\wklnhst.dat 2005-07-01 19:08 0 --sha-w C:\WINDOWS\SMINST\HPCD.sys . ((((((((((((((((((((((((((((( snapshot@2008-07-01_22.26.01.20 ))))))))))))))))))))))))))))))))))))))))) . - 2008-07-02 03:19:50 2,048 --s-a-w C:\WINDOWS\bootstat.dat + 2008-07-02 23:05:52 2,048 --s-a-w C:\WINDOWS\bootstat.dat - 2008-04-14 11:01:02 272,128 ------w C:\WINDOWS\Driver Cache\i386\bthport.sys + 2008-06-13 13:10:50 272,128 ------w C:\WINDOWS\Driver Cache\i386\bthport.sys . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SunKistEM"="C:\Program Files\Digital Media Reader\shwiconem.exe" [2004-11-15 17:04 135168] "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 13:50 155648] "IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2004-08-20 17:55 155648] "HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2004-08-20 17:51 118784] "RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2004-11-02 22:24 32768] "Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" [2005-06-07 00:46 57344] "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-03-28 23:37 413696] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-03-30 10:36 267048] C:\Documents and Settings\Owner\Start Menu\Programs\Startup\ Picture Motion Browser Media Check Tool.lnk - C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe [2008-01-27 15:11:43 344064] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2008-04-23 03:38:16 29696] DING!.lnk - C:\Program Files\Southwest Airlines\Ding\Ding.exe [2005-05-17 14:22:42 462848] WinZip Quick Pick.lnk - C:\Program Files\WinZip\WZQKPICK.EXE [2006-08-31 22:09:25 122880] [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders] SecurityProviders msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll, ntoskrnl.dll [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE"= "C:\\Program Files\\Real\\RealPlayer\\realplay.exe"= "C:\\Program Files\\Juniper Networks\\Secure Application Manager\\dsSamProxy.exe"= "C:\\Program Files\\iTunes\\iTunes.exe"= "C:\\WINDOWS\\system32\\mmc.exe"= R1 NEOFLTR_600_13073;Juniper Networks TDI Filter Driver (NEOFLTR_600_13073);C:\WINDOWS\system32\Drivers\NEOFLTR_600_13073.SYS [2008-04-30 14:54] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{da41a284-a859-11dc-9488-0013204adce0}] \Shell\AutoRun\command - L:\LaunchU3.exe -a *Newly Created Service* - CATCHME . Contents of the 'Scheduled Tasks' folder "2008-06-24 14:01:03 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job" - C:\Program Files\Apple Software Update\SoftwareUpdate.exe "2005-07-01 18:37:52 C:\WINDOWS\Tasks\ISP signup reminder 1.job" - C:\WINDOWS\system32\OOBE\oobebaln.exe "2005-07-01 18:37:53 C:\WINDOWS\Tasks\ISP signup reminder 3.job" - C:\WINDOWS\system32\OOBE\oobebaln.exe . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-07-02 22:10:47 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-07-02 22:14:05 ComboFix-quarantined-files.txt 2008-07-03 03:13:41 ComboFix2.txt 2008-07-02 03:26:17 Pre-Run: 25,977,872,384 bytes free Post-Run: 25,967,882,240 bytes free 126 --- E O F --- 2008-07-02 03:58:58 Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 8:14:13 AM, on 7/3/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Digital Media Reader\shwiconem.exe C:\WINDOWS\system32\igfxtray.exe C:\WINDOWS\system32\hkcmd.exe C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe C:\Program Files\QuickTime\QTTask.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\LEXPPS.EXE C:\Program Files\Southwest Airlines\Ding\Ding.exe C:\Program Files\WinZip\WZQKPICK.EXE C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS C:\WINDOWS\system32\svchost.exe C:\Program Files\Canon\CAL\CALMAIN.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.goole.com O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll O4 - HKLM\..\Run: [SunKistEM] C:\Program Files\Digital Media Reader\shwiconem.exe O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" O4 - HKLM\..\Run: [Recguard] %WINDIR%\SMINST\RECGUARD.EXE O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe" O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - Startup: Picture Motion Browser Media Check Tool.lnk = C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: DING!.lnk = C:\Program Files\Southwest Airlines\Ding\Ding.exe O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {7584C670-2274-4EFB-B00B-D6AABA6D3850} (Microsoft RDP Client Control (redist)) - https://remote.schwab.com/svordp/,Da....com+msrdp.cab O16 - DPF: {E5F5D008-DD2C-4D32-977D-1A0ADF03058B} (JuniperSetupSP1 Control) - https://remote.schwab.com/dana-cache...erSetupSP1.cab O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE O23 - Service: PrismXL - New Boundary Technologies, Inc. - C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS -- End of file - 5889 bytes |
|
|
|
|
07-03-2008, 08:06 AM
|
#6 (permalink) | ||
|
Moderator, Analyst, Security Team
Join Date: Oct 2006
Location: Důn Čideann,Scotland.
Posts: 5,093
OS: XP
|
Re: Malware Downloaded to my System - DeeWoo, OuterInfo, CoolWebSearch plus others
Quote:
Quote:
====== Establish an internet connection & perform an online scan with Internet Explorer at Kaspersky Online Scanner Click Accept, when prompted to download and install the program files and database of malware definitions.
Animated Tutorial Here To optimize scanning time and produce a more sensible report for review:
|
||
|
|
|
|
07-05-2008, 12:10 PM
|
#7 (permalink) |
|
Registered User
Join Date: Jun 2008
Posts: 10
OS: Windows XP
|
Re: Malware Downloaded to my System - DeeWoo, OuterInfo, CoolWebSearch plus others
KASPERSKY ONLINE SCANNER 7 REPORTKASPERSKY ONLINE SCANNER 7 REPORT
Saturday, July 5, 2008 Operating System: Microsoft Windows XP Home Edition Service Pack 2 (build 2600) Kaspersky Online Scanner 7 version: 7.0.25.0 Program database last update: Saturday, July 05, 2008 09:59:42 Records in database: 915351 Scan settings Scan using the following databaseextended Scan archivesyes Scan mail databasesyes Scan areaMy Computer C:\ D:\ E:\ F:\ G:\ H:\ I:\ J:\ Scan statistics Files scanned87869 Threat name8 Infected objects8 Suspicious objects0 Duration of the scan01:44:02 File nameThreat nameThreats count C:\QooBox\Quarantine\C\Program Files\Outerinfo\FF\components\FF.dll.virInfected: not-a-virus:AdWare.Win32.ZenoSearch.ad1 C:\QooBox\Quarantine\C\WINDOWS\lfn.exe.virInfected: not-virus:Hoax.Win32.Renos.vaad1 C:\QooBox\Quarantine\C\WINDOWS\system32\drivers\rdbsss.sys.zipInfected: Rootkit.Win32.Agent.aol1 C:\QooBox\Quarantine\C\WINDOWS\system32\eb10\zvuxderr.exe.virInfected: Trojan.Win32.DNSChanger.ebg1 C:\SDFix\backups\backups.zipInfected: Trojan-Downloader.Win32.VB.fao1 C:\SDFix\backups\backups.zipInfected: Trojan.Win32.Monderc.gen1 C:\SDFix\backups\backups.zipInfected: Trojan.Win32.Scapur.k1 C:\SDFix\backups\backups.zipInfected: not-a-virus:AdWare.Win32.PurityScan.gp1 The selected area was scanned. |
|
|
|
|
07-06-2008, 05:25 AM
|
#8 (permalink) | |
|
Moderator, Analyst, Security Team
Join Date: Oct 2006
Location: Důn Čideann,Scotland.
Posts: 5,093
OS: XP
|
Re: Malware Downloaded to my System - DeeWoo, OuterInfo, CoolWebSearch plus others
Hi
Open notepad and copy/paste the text in the quotebox below into it: Quote:
Refering to the picture above, drag CFscript into ComboFix.exe Follow the prompts, and post the resulting log, C:\ComboFix.txt Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system. Warning: Do not mouseclick combofix's window whilst it's running. That may cause it to stall ========= Open HijackThis and click on 'Do a System Scan and save a Logfile'. Save the log file and post it here. ========== Logs Required C:\Combofix.txt Hijackthis Log |
|
|
|
|
|
07-07-2008, 08:17 PM
|
#9 (permalink) |
|
Registered User
Join Date: Jun 2008
Posts: 10
OS: Windows XP
|
Re: Malware Downloaded to my System - DeeWoo, OuterInfo, CoolWebSearch plus others
Hi, TheBruce1. Here are the latest logs....
ComboFix 08-06-30.2 - Owner 2008-07-07 20:57:53.3 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.199 [GMT -5:00] Running from: C:\Documents and Settings\Owner\Desktop\ComboFix.exe Command switches used :: C:\Documents and Settings\Owner\Desktop\CFscript.txt * Created a new restore point FILE :: C:\WINDOWS\system32\ZoneAlarmIconUS.ico . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\system32\ZoneAlarmIconUS.ico . ((((((((((((((((((((((((( Files Created from 2008-06-08 to 2008-07-08 ))))))))))))))))))))))))))))))) . 2008-07-05 13:06 . 2008-07-05 13:06 4,350 --a------ C:\KasperskyLog.html 2008-07-02 22:24 . 2008-07-02 22:24 <DIR> d-------- C:\Program Files\Alwil Software 2008-07-02 22:21 . 2008-03-25 02:37 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl 2008-07-02 22:20 . 2008-07-02 22:20 <DIR> d-------- C:\Program Files\Common Files\Java 2008-07-01 22:52 . 2008-07-01 22:52 <DIR> d-------- C:\Program Files\Trend Micro 2008-07-01 21:33 . 2008-07-01 21:34 <DIR> d-------- C:\WINDOWS\ERUNT 2008-07-01 21:28 . 2008-07-01 21:56 <DIR> d-------- C:\SDFix 2008-06-27 19:10 . 2008-06-27 19:10 <DIR> d-------- C:\Deckard 2008-06-27 18:53 . 2008-06-27 18:53 <DIR> d-------- C:\ie-spyad_zo 2008-06-27 18:48 . 2008-06-27 18:49 <DIR> d-------- C:\Program Files\SpywareBlaster 2008-06-27 18:48 . 2008-06-27 18:48 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\TEMP 2008-06-27 18:47 . 2008-06-27 18:47 <DIR> d-------- C:\ZonedOut 2008-06-27 18:47 . 2008-06-26 14:13 2,869,536 --a------ C:\spywareblastersetup41.exe 2008-06-27 18:47 . 2008-02-05 15:59 322,518 --a------ C:\ie-spyad_zo.exe 2008-06-27 07:59 . 2008-06-27 08:00 <DIR> d-------- C:\Program Files\Panda Security 2008-06-10 17:34 . 2008-06-13 08:10 272,128 --a------ C:\WINDOWS\system32\drivers\bthport.sys 2008-06-10 17:34 . 2008-06-13 08:10 272,128 --a--c--- C:\WINDOWS\system32\dllcache\bthport.sys . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-07-03 03:21 --------- d-----w C:\Program Files\Java 2008-07-01 01:53 --------- d-----w C:\Program Files\Symantec 2008-06-19 18:32 --------- d-----w C:\Documents and Settings\Owner\Application Data\Juniper Networks 2008-06-12 01:16 --------- d-----w C:\Documents and Settings\Owner\Application Data\Move Networks 2008-06-08 01:12 --------- d-----w C:\Program Files\Common Files\Adobe 2008-06-08 01:10 --------- d-----w C:\Documents and Settings\Owner\Application Data\AdobeUM 2008-05-08 12:28 202,752 ----a-w C:\WINDOWS\system32\drivers\rmcast.sys 2008-05-07 05:18 1,287,680 ----a-w C:\WINDOWS\system32\quartz.dll 2008-04-21 07:04 659,456 ----a-w C:\WINDOWS\system32\wininet.dll 2008-04-12 22:21 1,179,658 ----a-w C:\f5d7230-4v5_us_fw_7.01.06.bin 2005-11-26 03:52 0 ----a-w C:\Documents and Settings\Owner\Application Data\wklnhst.dat 2005-07-01 19:08 0 --sha-w C:\WINDOWS\SMINST\HPCD.sys . ((((((((((((((((((((((((((((( snapshot@2008-07-01_22.26.01.20 ))))))))))))))))))))))))))))))))))))))))) . - 2008-07-02 03:19:50 2,048 --s-a-w C:\WINDOWS\bootstat.dat + 2008-07-08 01:45:15 2,048 --s-a-w C:\WINDOWS\bootstat.dat - 2008-04-14 11:01:02 272,128 ------w C:\WINDOWS\Driver Cache\i386\bthport.sys + 2008-06-13 13:10:50 272,128 ------w C:\WINDOWS\Driver Cache\i386\bthport.sys + 2008-05-15 23:24:43 1,152,888 ----a-w C:\WINDOWS\system32\aswBoot.exe + 2008-05-15 23:12:36 95,608 ----a-w C:\WINDOWS\system32\AvastSS.scr + 2008-05-15 23:13:26 26,944 ----a-w C:\WINDOWS\system32\drivers\aavmker4.sys + 2008-05-15 23:16:06 20,560 ----a-w C:\WINDOWS\system32\drivers\aswFsBlk.sys + 2008-01-17 16:34:01 93,264 ----a-w C:\WINDOWS\system32\drivers\aswmon.sys + 2008-05-15 23:18:33 94,416 ----a-w C:\WINDOWS\system32\drivers\aswmon2.sys + 2008-05-15 23:15:29 23,152 ----a-w C:\WINDOWS\system32\drivers\aswRdr.sys + 2008-05-15 23:20:32 78,416 ----a-w C:\WINDOWS\system32\drivers\aswSP.sys + 2008-05-15 23:14:11 42,912 ----a-w C:\WINDOWS\system32\drivers\aswTdi.sys - 2005-07-28 21:40:48 24,670 ----a-w C:\WINDOWS\system32\java.exe + 2008-03-25 06:28:39 135,168 ----a-w C:\WINDOWS\system32\java.exe - 2005-07-28 21:40:48 28,768 ----a-w C:\WINDOWS\system32\javaw.exe + 2008-03-25 06:28:43 135,168 ----a-w C:\WINDOWS\system32\javaw.exe + 2008-03-25 07:37:01 139,264 ----a-w C:\WINDOWS\system32\javaws.exe + 2008-07-08 01:45:25 16,384 ----atw C:\WINDOWS\TEMP\Perflib_Perfdata_51c.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SunKistEM"="C:\Program Files\Digital Media Reader\shwiconem.exe" [2004-11-15 17:04 135168] "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 13:50 155648] "IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2004-08-20 17:55 155648] "HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2004-08-20 17:51 118784] "RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2004-11-02 22:24 32768] "Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" [2005-06-07 00:46 57344] "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-03-28 23:37 413696] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-03-30 10:36 267048] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe" [2008-03-25 04:28 144784] "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2008-05-15 18:19 79224] C:\Documents and Settings\Owner\Start Menu\Programs\Startup\ Picture Motion Browser Media Check Tool.lnk - C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe [2008-01-27 15:11:43 344064] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2008-04-23 03:38:16 29696] DING!.lnk - C:\Program Files\Southwest Airlines\Ding\Ding.exe [2005-05-17 14:22:42 462848] WinZip Quick Pick.lnk - C:\Program Files\WinZip\WZQKPICK.EXE [2006-08-31 22:09:25 122880] [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders] SecurityProviders msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll, ntoskrnl.dll [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE"= "C:\\Program Files\\Real\\RealPlayer\\realplay.exe"= "C:\\Program Files\\Juniper Networks\\Secure Application Manager\\dsSamProxy.exe"= "C:\\Program Files\\iTunes\\iTunes.exe"= "C:\\WINDOWS\\system32\\mmc.exe"= R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-05-15 18:20] R1 NEOFLTR_600_13073;Juniper Networks TDI Filter Driver (NEOFLTR_600_13073);C:\WINDOWS\system32\Drivers\NEOFLTR_600_13073.SYS [2008-04-30 14:54] R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-05-15 18:16] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{da41a284-a859-11dc-9488-0013204adce0}] \Shell\AutoRun\command - L:\LaunchU3.exe -a . Contents of the 'Scheduled Tasks' folder "2008-06-24 14:01:03 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job" - C:\Program Files\Apple Software Update\SoftwareUpdate.exe "2005-07-01 18:37:52 C:\WINDOWS\Tasks\ISP signup reminder 1.job" - C:\WINDOWS\system32\OOBE\oobebaln.exe "2005-07-01 18:37:53 C:\WINDOWS\Tasks\ISP signup reminder 3.job" - C:\WINDOWS\system32\OOBE\oobebaln.exe . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-07-07 21:00:37 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-07-07 21:03:28 ComboFix-quarantined-files.txt 2008-07-08 02:02:35 ComboFix2.txt 2008-07-03 03:14:05 ComboFix3.txt 2008-07-02 03:26:17 Pre-Run: 25,662,824,448 bytes free Post-Run: 25,732,562,944 bytes free 131 --- E O F --- 2008-07-02 03:58:58 Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 9:12:03 PM, on 7/7/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\LEXPPS.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Digital Media Reader\shwiconem.exe C:\WINDOWS\system32\igfxtray.exe C:\WINDOWS\system32\hkcmd.exe C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe C:\Program Files\QuickTime\QTTask.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Program Files\Southwest Airlines\Ding\Ding.exe C:\Program Files\WinZip\WZQKPICK.EXE C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS C:\WINDOWS\system32\svchost.exe C:\Program Files\Canon\CAL\CALMAIN.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\Program Files\iPod\bin\iPodService.exe C:\WINDOWS\explorer.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.goole.com O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll O4 - HKLM\..\Run: [SunKistEM] C:\Program Files\Digital Media Reader\shwiconem.exe O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" O4 - HKLM\..\Run: [Recguard] %WINDIR%\SMINST\RECGUARD.EXE O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe" O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - Startup: Picture Motion Browser Media Check Tool.lnk = C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: DING!.lnk = C:\Program Files\Southwest Airlines\Ding\Ding.exe O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {7584C670-2274-4EFB-B00B-D6AABA6D3850} (Microsoft RDP Client Control (redist)) - https://remote.schwab.com/svordp/,Da....com+msrdp.cab O16 - DPF: {E5F5D008-DD2C-4D32-977D-1A0ADF03058B} (JuniperSetupSP1 Control) - https://remote.schwab.com/dana-cache...erSetupSP1.cab O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE O23 - Service: PrismXL - New Boundary Technologies, Inc. - C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS -- End of file - 5762 bytes |
|
|
|
|
07-08-2008, 04:45 AM
|
#10 (permalink) | |
|
Moderator, Analyst, Security Team
Join Date: Oct 2006
Location: Důn Čideann,Scotland.
Posts: 5,093
OS: XP
|
Re: Malware Downloaded to my System - DeeWoo, OuterInfo, CoolWebSearch plus others
Hello again
Open notepad and copy/paste the text in the quotebox below into it: Quote:
Refering to the picture above, drag CFscript into ComboFix.exe Follow the prompts, and post the resulting log, C:\ComboFix.txt Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system. Warning: Do not mouseclick combofix's window whilst it's running. That may cause it to stall ========= Open HijackThis and click on 'Do a System Scan and save a Logfile'. Save the log file and post it here. ========= Logs Required C:\Combofix.txt Hijackthis Log |
|
|
|
|
|
07-08-2008, 06:47 PM
|
#11 (permalink) |
|
Registered User
Join Date: Jun 2008
Posts: 10
OS: Windows XP
|
Re: Malware Downloaded to my System - DeeWoo, OuterInfo, CoolWebSearch plus others
Alright, here's the latest....
ComboFix 08-06-30.2 - Owner 2008-07-08 17:48:50.4 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.218 [GMT -5:00] Running from: C:\Documents and Settings\Owner\Desktop\ComboFix.exe Command switches used :: C:\Documents and Settings\Owner\Desktop\CFScript.txt * Created a new restore point . ((((((((((((((((((((((((( Files Created from 2008-06-08 to 2008-07-08 ))))))))))))))))))))))))))))))) . 2008-07-05 13:06 . 2008-07-05 13:06 4,350 --a------ C:\KasperskyLog.html 2008-07-02 22:24 . 2008-07-02 22:24 <DIR> d-------- C:\Program Files\Alwil Software 2008-07-02 22:21 . 2008-03-25 02:37 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl 2008-07-02 22:20 . 2008-07-02 22:20 <DIR> d-------- C:\Program Files\Common Files\Java 2008-07-01 22:52 . 2008-07-01 22:52 <DIR> d-------- C:\Program Files\Trend Micro 2008-07-01 21:33 . 2008-07-01 21:34 <DIR> d-------- C:\WINDOWS\ERUNT 2008-07-01 21:28 . 2008-07-01 21:56 <DIR> d-------- C:\SDFix 2008-06-27 19:10 . 2008-06-27 19:10 <DIR> d-------- C:\Deckard 2008-06-27 18:53 . 2008-06-27 18:53 <DIR> d-------- C:\ie-spyad_zo 2008-06-27 18:48 . 2008-06-27 18:49 <DIR> d-------- C:\Program Files\SpywareBlaster 2008-06-27 18:48 . 2008-06-27 18:48 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\TEMP 2008-06-27 18:47 . 2008-06-27 18:47 <DIR> d-------- C:\ZonedOut 2008-06-27 18:47 . 2008-06-26 14:13 2,869,536 --a------ C:\spywareblastersetup41.exe 2008-06-27 18:47 . 2008-02-05 15:59 322,518 --a------ C:\ie-spyad_zo.exe 2008-06-27 07:59 . 2008-06-27 08:00 <DIR> d-------- C:\Program Files\Panda Security 2008-06-10 17:34 . 2008-06-13 08:10 272,128 --a------ C:\WINDOWS\system32\drivers\bthport.sys 2008-06-10 17:34 . 2008-06-13 08:10 272,128 --a--c--- C:\WINDOWS\system32\dllcache\bthport.sys . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-07-03 03:21 --------- d-----w C:\Program Files\Java 2008-07-01 01:53 --------- d-----w C:\Program Files\Symantec 2008-06-19 18:32 --------- d-----w C:\Documents and Settings\Owner\Application Data\Juniper Networks 2008-06-12 01:16 --------- d-----w C:\Documents and Settings\Owner\Application Data\Move Networks 2008-06-08 01:12 --------- d-----w C:\Program Files\Common Files\Adobe 2008-06-08 01:10 --------- d-----w C:\Documents and Settings\Owner\Application Data\AdobeUM 2008-05-08 12:28 202,752 ----a-w C:\WINDOWS\system32\drivers\rmcast.sys 2008-04-12 22:21 1,179,658 ----a-w C:\f5d7230-4v5_us_fw_7.01.06.bin 2005-11-26 03:52 0 ----a-w C:\Documents and Settings\Owner\Application Data\wklnhst.dat 2005-07-01 19:08 0 --sha-w C:\WINDOWS\SMINST\HPCD.sys . ((((((((((((((((((((((((((((( snapshot@2008-07-01_22.26.01.20 ))))))))))))))))))))))))))))))))))))))))) . - 2008-07-02 03:19:50 2,048 --s-a-w C:\WINDOWS\bootstat.dat + 2008-07-08 22:52:36 2,048 --s-a-w C:\WINDOWS\bootstat.dat - 2008-04-14 11:01:02 272,128 ------w C:\WINDOWS\Driver Cache\i386\bthport.sys + 2008-06-13 13:10:50 272,128 ------w C:\WINDOWS\Driver Cache\i386\bthport.sys + 2008-05-15 23:24:43 1,152,888 ----a-w C:\WINDOWS\system32\aswBoot.exe + 2008-05-15 23:12:36 95,608 ----a-w C:\WINDOWS\system32\AvastSS.scr + 2008-05-15 23:13:26 26,944 ----a-w C:\WINDOWS\system32\drivers\aavmker4.sys + 2008-05-15 23:16:06 20,560 ----a-w C:\WINDOWS\system32\drivers\aswFsBlk.sys + 2008-01-17 16:34:01 93,264 ----a-w C:\WINDOWS\system32\drivers\aswmon.sys + 2008-05-15 23:18:33 94,416 ----a-w C:\WINDOWS\system32\drivers\aswmon2.sys + 2008-05-15 23:15:29 23,152 ----a-w C:\WINDOWS\system32\drivers\aswRdr.sys + 2008-05-15 23:20:32 78,416 ----a-w C:\WINDOWS\system32\drivers\aswSP.sys + 2008-05-15 23:14:11 42,912 ----a-w C:\WINDOWS\system32\drivers\aswTdi.sys - 2005-07-28 21:40:48 24,670 ----a-w C:\WINDOWS\system32\java.exe + 2008-03-25 06:28:39 135,168 ----a-w C:\WINDOWS\system32\java.exe - 2005-07-28 21:40:48 28,768 ----a-w C:\WINDOWS\system32\javaw.exe + 2008-03-25 06:28:43 135,168 ----a-w C:\WINDOWS\system32\javaw.exe + 2008-03-25 07:37:01 139,264 ----a-w C:\WINDOWS\system32\javaws.exe + 2008-07-08 22:52:42 16,384 ----atw C:\WINDOWS\TEMP\Perflib_Perfdata_514.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SunKistEM"="C:\Program Files\Digital Media Reader\shwiconem.exe" [2004-11-15 17:04 135168] "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 13:50 155648] "IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2004-08-20 17:55 155648] "HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2004-08-20 17:51 118784] "RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2004-11-02 22:24 32768] "Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" [2005-06-07 00:46 57344] "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-03-28 23:37 413696] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-03-30 10:36 267048] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe" [2008-03-25 04:28 144784] C:\Documents and Settings\Owner\Start Menu\Programs\Startup\ Picture Motion Browser Media Check Tool.lnk - C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe [2008-01-27 15:11:43 344064] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2008-04-23 03:38:16 29696] DING!.lnk - C:\Program Files\Southwest Airlines\Ding\Ding.exe [2005-05-17 14:22:42 462848] WinZip Quick Pick.lnk - C:\Program Files\WinZip\WZQKPICK.EXE [2006-08-31 22:09:25 122880] [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders] SecurityProviders msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll, ntoskrnl.dll [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE"= "C:\\Program Files\\Real\\RealPlayer\\realplay.exe"= "C:\\Program Files\\Juniper Networks\\Secure Application Manager\\dsSamProxy.exe"= "C:\\Program Files\\iTunes\\iTunes.exe"= "C:\\WINDOWS\\system32\\mmc.exe"= R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-05-15 18:20] R1 NEOFLTR_600_13073;Juniper Networks TDI Filter Driver (NEOFLTR_600_13073);C:\WINDOWS\system32\Drivers\NEOFLTR_600_13073.SYS [2008-04-30 14:54] R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-05-15 18:16] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{da41a284-a859-11dc-9488-0013204adce0}] \Shell\AutoRun\command - L:\LaunchU3.exe -a . Contents of the 'Scheduled Tasks' folder "2008-06-24 14:01:03 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job" - C:\Program Files\Apple Software Update\SoftwareUpdate.exe "2005-07-01 18:37:52 C:\WINDOWS\Tasks\ISP signup reminder 1.job" - C:\WINDOWS\system32\OOBE\oobebaln.exe "2005-07-01 18:37:53 C:\WINDOWS\Tasks\ISP signup reminder 3.job" - C:\WINDOWS\system32\OOBE\oobebaln.exe . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-07-08 17:53:14 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . ------------------------ Other Running Processes ------------------------ . C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\LEXPPS.EXE C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS C:\Program Files\Canon\CAL\CALMAIN.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\Program Files\iPod\bin\iPodService.exe . ************************************************************************** . Completion time: 2008-07-08 17:59:28 - machine was rebooted ComboFix-quarantined-files.txt 2008-07-08 22:59:23 ComboFix2.txt 2008-07-08 02:03:29 ComboFix3.txt 2008-07-03 03:14:05 ComboFix4.txt 2008-07-02 03:26:17 Pre-Run: 25,715,064,832 bytes free Post-Run: 25,698,922,496 bytes free 138 --- E O F --- 2008-07-02 03:58:58 Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 6:03:09 PM, on 7/8/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\LEXPPS.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS C:\WINDOWS\system32\svchost.exe C:\Program Files\Canon\CAL\CALMAIN.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\Program Files\Digital Media Reader\shwiconem.exe C:\WINDOWS\system32\igfxtray.exe C:\WINDOWS\system32\hkcmd.exe C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe C:\Program Files\QuickTime\QTTask.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe C:\Program Files\Southwest Airlines\Ding\Ding.exe C:\Program Files\WinZip\WZQKPICK.EXE C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe C:\Program Files\iPod\bin\iPodService.exe C:\WINDOWS\explorer.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.goole.com O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll O4 - HKLM\..\Run: [SunKistEM] C:\Program Files\Digital Media Reader\shwiconem.exe O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" O4 - HKLM\..\Run: [Recguard] %WINDIR%\SMINST\RECGUARD.EXE O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe" O4 - Startup: Picture Motion Browser Media Check Tool.lnk = C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: DING!.lnk = C:\Program Files\Southwest Airlines\Ding\Ding.exe O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {7584C670-2274-4EFB-B00B-D6AABA6D3850} (Microsoft RDP Client Control (redist)) - https://remote.schwab.com/svordp/,Da....com+msrdp.cab O16 - DPF: {E5F5D008-DD2C-4D32-977D-1A0ADF03058B} (JuniperSetupSP1 Control) - https://remote.schwab.com/dana-cache...erSetupSP1.cab O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE O23 - Service: PrismXL - New Boundary Technologies, Inc. - C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS -- End of file - 5731 bytes |
|
|
|
|
07-09-2008, 07:08 AM
|
#12 (permalink) | |
|
Moderator, Analyst, Security Team
Join Date: Oct 2006
Location: Důn Čideann,Scotland.
Posts: 5,093
OS: XP
|
Re: Malware Downloaded to my System - DeeWoo, OuterInfo, CoolWebSearch plus others
Hello again
Delete your current version of Combofix, then download the updated version from one of the links below. Link 1 Link 2 Link 3 **Note: It is important that it is saved directly to your desktop** ========== Open notepad and copy/paste the text in the quotebox below into it: Quote:
Refering to the picture above, drag CFscript into ComboFix.exe Follow the prompts, and post the resulting log, C:\ComboFix.txt Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system. Warning: Do not mouseclick combofix's window whilst it's running. That may cause it to stall ========== JAVA OUTDATED Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update.
========== Open HijackThis and click on 'Do a System Scan and save a Logfile'. Save the log file and post it here. ========= Logs Required C:\Combofix.txt Hijackthis Log |
|
|
|
|
|
07-10-2008, 10:22 PM
|
#13 (permalink) |
|
Registered User
Join Date: Jun 2008
Posts: 10
OS: Windows XP
|
Re: Malware Downloaded to my System - DeeWoo, OuterInfo, CoolWebSearch plus others
Thanks. Got latest Java and Combo and here are the logs...
ComboFix 08-07-10.1 - Owner 2008-07-10 22:01:32.5 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.143 [GMT -5:00] Running from: C:\Documents and Settings\Owner\Desktop\ComboFix.exe Command switches used :: C:\Documents and Settings\Owner\Desktop\CFscript.txt * Created a new restore point FILE :: C:\KasperskyLog.html C:\spywareblastersetup41.exe . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\KasperskyLog.html C:\Program Files\Symantec C:\spywareblastersetup41.exe C:\WINDOWS\system32\oeminfo.ini . ((((((((((((((((((((((((( Files Created from 2008-06-11 to 2008-07-11 ))))))))))))))))))))))))))))))) . 2008-07-02 22:24 . 2008-07-02 22:24 <DIR> d-------- C:\Program Files\Alwil Software 2008-07-02 22:21 . 2008-03-25 02:37 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl 2008-07-02 22:20 . 2008-07-02 22:20 <DIR> d-------- C:\Program Files\Common Files\Java 2008-07-01 22:52 . 2008-07-01 22:52 <DIR> d-------- C:\Program Files\Trend Micro 2008-07-01 21:33 . 2008-07-01 21:34 <DIR> d-------- C:\WINDOWS\ERUNT 2008-07-01 21:28 . 2008-07-01 21:56 <DIR> d-------- C:\SDFix 2008-06-27 19:10 . 2008-06-27 19:10 <DIR> d-------- C:\Deckard 2008-06-27 18:53 . 2008-06-27 18:53 <DIR> d-------- C:\ie-spyad_zo 2008-06-27 18:48 . 2008-06-27 18:49 <DIR> d-------- C:\Program Files\SpywareBlaster 2008-06-27 18:48 . 2008-06-27 18:48 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\TEMP 2008-06-27 18:47 . 2008-06-27 18:47 <DIR> d-------- C:\ZonedOut 2008-06-27 18:47 . 2008-02-05 15:59 322,518 --a------ C:\ie-spyad_zo.exe 2008-06-27 07:59 . 2008-06-27 08:00 <DIR> d-------- C:\Program Files\Panda Security 2008-06-20 12:41 . 2008-06-20 12:41 245,248 -----c--- C:\WINDOWS\system32\dllcache\mswsock.dll 2008-06-20 05:44 . 2008-06-20 05:44 138,368 -----c--- C:\WINDOWS\system32\dllcache\afd.sys . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-07-03 03:21 --------- d-----w C:\Program Files\Java 2008-06-20 17:41 245,248 ----a-w C:\WINDOWS\system32\mswsock.dll 2008-06-20 10:45 360,320 ----a-w C:\WINDOWS\system32\drivers\tcpip.sys 2008-06-20 10:44 138,368 ----a-w C:\WINDOWS\system32\drivers\afd.sys 2008-06-20 09:52 225,920 ----a-w C:\WINDOWS\system32\drivers\tcpip6.sys 2008-06-19 18:32 --------- d-----w C:\Documents and Settings\Owner\Application Data\Juniper Networks 2008-06-13 13:10 272,128 ----a-w C:\WINDOWS\system32\drivers\bthport.sys 2008-06-12 01:16 --------- d-----w C:\Documents and Settings\Owner\Application Data\Move Networks 2008-06-08 01:12 --------- d-----w C:\Program Files\Common Files\Adobe 2008-06-08 01:10 --------- d-----w C:\Documents and Settings\Owner\Application Data\AdobeUM 2008-05-07 05:18 1,287,680 ----a-w C:\WINDOWS\system32\quartz.dll 2008-04-21 07:04 659,456 ----a-w C:\WINDOWS\system32\wininet.dll 2008-04-12 22:21 1,179,658 ----a-w C:\f5d7230-4v5_us_fw_7.01.06.bin 2005-11-26 03:52 0 ----a-w C:\Documents and Settings\Owner\Application Data\wklnhst.dat 2005-07-01 19:08 0 --sha-w C:\WINDOWS\SMINST\HPCD.sys . ((((((((((((((((((((((((((((( snapshot@2008-07-01_22.26.01.20 ))))))))))))))))))))))))))))))))))))))))) . - 2008-07-02 03:19:50 2,048 --s-a-w C:\WINDOWS\bootstat.dat + 2008-07-11 02:16:50 2,048 --s-a-w C:\WINDOWS\bootstat.dat - 2008-04-14 11:01:02 272,128 ------w C:\WINDOWS\Driver Cache\i386\bthport.sys + 2008-06-13 13:10:50 272,128 ------w C:\WINDOWS\Driver Cache\i386\bthport.sys + 2008-05-15 23:24:43 1,152,888 ----a-w C:\WINDOWS\system32\aswBoot.exe + 2008-05-15 23:12:36 95,608 ----a-w C:\WINDOWS\system32\AvastSS.scr - 2008-04-14 11:01:02 272,128 -c--a-w C:\WINDOWS\system32\dllcache\bthport.sys + 2008-06-13 13:10:50 272,128 -c--a-w C:\WINDOWS\system32\dllcache\bthport.sys - 2008-02-20 05:32:43 148,992 -c--a-w C:\WINDOWS\system32\dllcache\dnsapi.dll + 2008-06-20 17:41:10 148,992 -c--a-w C:\WINDOWS\system32\dllcache\dnsapi.dll - 2007-10-30 17:20:55 360,064 -c--a-w C:\WINDOWS\system32\dllcache\tcpip.sys + 2008-06-20 10:45:13 360,320 -c--a-w C:\WINDOWS\system32\dllcache\tcpip.sys - 2006-08-16 09:37:30 225,664 -c--a-w C:\WINDOWS\system32\dllcache\tcpip6.sys + 2008-06-20 09:52:06 225,920 -c--a-w C:\WINDOWS\system32\dllcache\tcpip6.sys - 2008-02-20 05:32:43 148,992 ----a-w C:\WINDOWS\system32\dnsapi.dll + 2008-06-20 17:41:10 148,992 ----a-w C:\WINDOWS\system32\dnsapi.dll + 2008-05-15 23:13:26 26,944 ----a-w C:\WINDOWS\system32\drivers\aavmker4.sys + 2008-05-15 23:16:06 20,560 ----a-w C:\WINDOWS\system32\drivers\aswFsBlk.sys + 2008-01-17 16:34:01 93,264 ----a-w C:\WINDOWS\system32\drivers\aswmon.sys + 2008-05-15 23:18:33 94,416 ----a-w C:\WINDOWS\system32\drivers\aswmon2.sys + 2008-05-15 23:15:29 23,152 ----a-w C:\WINDOWS\system32\drivers\aswRdr.sys + 2008-05-15 23:20:32 78,416 ----a-w C:\WINDOWS\system32\drivers\aswSP.sys + 2008-05-15 23:14:11 42,912 ----a-w C:\WINDOWS\system32\drivers\aswTdi.sys - 2005-07-28 21:40:48 24,670 ----a-w C:\WINDOWS\system32\java.exe + 2008-03-25 06:28:39 135,168 ----a-w C:\WINDOWS\system32\java.exe - 2005-07-28 21:40:48 28,768 ----a-w C:\WINDOWS\system32\javaw.exe + 2008-03-25 06:28:43 135,168 ----a-w C:\WINDOWS\system32\javaw.exe + 2008-03-25 07:37:01 139,264 ----a-w C:\WINDOWS\system32\javaws.exe - 2008-05-29 23:35:11 17,486,968 ----a-w C:\WINDOWS\system32\MRT.exe + 2008-06-25 16:15:46 17,972,344 ----a-w C:\WINDOWS\system32\MRT.exe - 2007-11-30 11:18:51 17,272 ----a-w C:\WINDOWS\system32\spmsg.dll + 2007-11-30 12:39:22 17,272 ------w C:\WINDOWS\system32\spmsg.dll + 2008-07-11 02:17:00 16,384 ----atw C:\WINDOWS\TEMP\Perflib_Perfdata_520.dat . -- Snapshot reset to current date -- . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SunKistEM"="C:\Program Files\Digital Media Reader\shwiconem.exe" [2004-11-15 17:04 135168] "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 13:50 155648] "IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2004-08-20 17:55 155648] "HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2004-08-20 17:51 118784] "RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2004-11-02 22:24 32768] "Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" [2005-06-07 00:46 57344] "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-03-28 23:37 413696] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-03-30 10:36 267048] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe" [2008-03-25 04:28 144784] C:\Documents and Settings\Owner\Start Menu\Programs\Startup\ Picture Motion Browser Media Check Tool.lnk - C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe [2008-01-27 15:11:43 344064] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2008-04-23 03:38:16 29696] DING!.lnk - C:\Program Files\Southwest Airlines\Ding\Ding.exe [2005-05-17 14:22:42 462848] WinZip Quick Pick.lnk - C:\Program Files\WinZip\WZQKPICK.EXE [2006-08-31 22:09:25 122880] [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders] SecurityProviders msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll, ntoskrnl.dll [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE"= "C:\\Program Files\\Real\\RealPlayer\\realplay.exe"= "C:\\Program Files\\Juniper Networks\\Secure Application Manager\\dsSamProxy.exe"= "C:\\Program Files\\iTunes\\iTunes.exe"= "C:\\WINDOWS\\system32\\mmc.exe"= R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-05-15 18:20] R1 NEOFLTR_600_13073;Juniper Networks TDI Filter Driver (NEOFLTR_600_13073);C:\WINDOWS\system32\Drivers\NEOFLTR_600_13073.SYS [2008-04-30 14:54] R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-05-15 18:16] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{da41a284-a859-11dc-9488-0013204adce0}] \Shell\AutoRun\command - L:\LaunchU3.exe -a *Newly Created Service* - CATCHME . Contents of the 'Scheduled Tasks' folder "2008-06-24 14:01:03 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job" - C:\Program Files\Apple Software Update\SoftwareUpdate.exe "2005-07-01 18:37:52 C:\WINDOWS\Tasks\ISP signup reminder 1.job" - C:\WINDOWS\system32\OOBE\oobebaln.exe "2005-07-01 18:37:53 C:\WINDOWS\Tasks\ISP signup reminder 3.job" - C:\WINDOWS\system32\OOBE\oobebaln.exe . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-07-10 22:04:22 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-07-10 22:07:56 ComboFix-quarantined-files.txt 2008-07-11 03:07:16 ComboFix2.txt 2008-07-08 22:59:30 ComboFix3.txt 2008-07-08 02:03:29 ComboFix4.txt 2008-07-03 03:14:05 ComboFix5.txt 2008-07-02 03:26:17 Pre-Run: 25,577,893,888 bytes free Post-Run: 25,562,849,280 bytes free 154 --- E O F --- 2008-07-09 23:38:02 Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 11:14:52 PM, on 7/10/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\LEXPPS.EXE C:\Program Files\Digital Media Reader\shwiconem.exe C:\WINDOWS\system32\igfxtray.exe C:\WINDOWS\system32\hkcmd.exe C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe C:\Program Files\QuickTime\QTTask.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Southwest Airlines\Ding\Ding.exe C:\Program Files\WinZip\WZQKPICK.EXE C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS C:\WINDOWS\system32\svchost.exe C:\Program Files\Canon\CAL\CALMAIN.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.goole.com O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O4 - HKLM\..\Run: [SunKistEM] C:\Program Files\Digital Media Reader\shwiconem.exe O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" O4 - HKLM\..\Run: [Recguard] %WINDIR%\SMINST\RECGUARD.EXE O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" O4 - Startup: Picture Motion Browser Media Check Tool.lnk = C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: DING!.lnk = C:\Program Files\Southwest Airlines\Ding\Ding.exe O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {7584C670-2274-4EFB-B00B-D6AABA6D3850} (Microsoft RDP Client Control (redist)) - https://remote.schwab.com/svordp/,Da....com+msrdp.cab O16 - DPF: {E5F5D008-DD2C-4D32-977D-1A0ADF03058B} (JuniperSetupSP1 Control) - https://remote.schwab.com/dana-cache...erSetupSP1.cab O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE O23 - Service: PrismXL - New Boundary Technologies, Inc. - C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS -- End of file - 5682 bytes |
|
|
|
|
07-11-2008, 06:06 AM
|
#14 (permalink) | |
|
Moderator, Analyst, Security Team
Join Date: Oct 2006
Location: Důn Čideann,Scotland.
Posts: 5,093
OS: XP
|
Re: Malware Downloaded to my System - DeeWoo, OuterInfo, CoolWebSearch plus others
Hello again
Open notepad and copy/paste the text in the quotebox below into it: Quote:
Refering to the picture above, drag CFscript into ComboFix.exe Follow the prompts, and post the resulting log, C:\ComboFix.txt Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system. Warning: Do not mouseclick combofix's window whilst it's running. That may cause it to stall ======== Open HijackThis and click on 'Do a System Scan and save a Logfile'. Save the log file and post it here. ======== Logs Required C:\Combofix.txt Hijackthis Log |
|
|
|
|
|
07-12-2008, 11:35 AM
|
#15 (permalink) |
|
Registered User
Join Date: Jun 2008
Posts: 10
OS: Windows XP
|
Re: Malware Downloaded to my System - DeeWoo, OuterInfo, CoolWebSearch plus others
ComboFix 08-07-10.1 - Owner 2008-07-12 9:34:49.6 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.147 [GMT -5:00] Running from: C:\Documents and Settings\Owner\Desktop\ComboFix.exe Command switches used :: C:\Documents and Settings\Owner\Desktop\CFscript.txt * Created a new restore point . ((((((((((((((((((((((((( Files Created from 2008-06-12 to 2008-07-12 ))))))))))))))))))))))))))))))) . 2008-07-10 23:02 . 2008-07-10 23:02 <DIR> d-------- C:\Program Files\Sun 2008-07-10 23:01 . 2008-06-10 02:32 73,728 --a------ C:\WINDOWS\system32\javacpl.cpl 2008-07-10 22:56 . 2008-07-10 22:56 <DIR> d-------- C:\Program Files\Common Files\Java 2008-07-02 22:24 . 2008-07-02 22:24 <DIR> d-------- C:\Program Files\Alwil Software 2008-07-01 22:52 . 2008-07-01 22:52 <DIR> d-------- C:\Program Files\Trend Micro 2008-07-01 21:33 . 2008-07-01 21:34 <DIR> d-------- C:\WINDOWS\ERUNT 2008-07-01 21:28 . 2008-07-01 21:56 <DIR> d-------- C:\SDFix 2008-06-27 19:10 . 2008-06-27 19:10 <DIR> d-------- C:\Deckard 2008-06-27 18:53 . 2008-06-27 18:53 <DIR> d-------- C:\ie-spyad_zo 2008-06-27 18:48 . 2008-06-27 18:49 <DIR> d-------- C:\Program Files\SpywareBlaster 2008-06-27 18:48 . 2008-06-27 18:48 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\TEMP 2008-06-27 18:47 . 2008-06-27 18:47 <DIR> d-------- C:\ZonedOut 2008-06-27 18:47 . 2008-02-05 15:59 322,518 --a------ C:\ie-spyad_zo.exe 2008-06-27 07:59 . 2008-06-27 08:00 <DIR> d-------- C:\Program Files\Panda Security 2008-06-20 12:41 . 2008-06-20 12:41 245,248 -----c--- C:\WINDOWS\system32\dllcache\mswsock.dll 2008-06-20 05:44 . 2008-06-20 05:44 138,368 -----c--- C:\WINDOWS\system32\dllcache\afd.sys . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-07-11 04:01 --------- d-----w C:\Program Files\Java 2008-06-20 17:41 245,248 ----a-w C:\WINDOWS\system32\mswsock.dll 2008-06-20 10:45 360,320 ----a-w C:\WINDOWS\system32\drivers\tcpip.sys 2008-06-20 10:44 138,368 ----a-w C:\WINDOWS\system32\drivers\afd.sys 2008-06-20 09:52 225,920 ----a-w C:\WINDOWS\system32\drivers\tcpip6.sys 2008-06-19 18:32 --------- d-----w C:\Documents and Settings\Owner\Application Data\Juniper Networks 2008-06-13 13:10 272,128 ----a-w C:\WINDOWS\system32\drivers\bthport.sys 2008-06-12 01:16 --------- d-----w C:\Documents and Settings\Owner\Application Data\Move Networks 2008-06-08 01:12 --------- d-----w C:\Program Files\Common Files\Adobe 2008-06-08 01:10 --------- d-----w C:\Documents and Settings\Owner\Application Data\AdobeUM 2008-05-07 05:18 1,287,680 ----a-w C:\WINDOWS\system32\quartz.dll 2008-04-21 07:04 659,456 ----a-w C:\WINDOWS\system32\wininet.dll 2008-04-12 22:21 1,179,658 ----a-w C:\f5d7230-4v5_us_fw_7.01.06.bin 2005-11-26 03:52 0 ----a-w C:\Documents and Settings\Owner\Application Data\wklnhst.dat 2005-07-01 19:08 0 --sha-w C:\WINDOWS\SMINST\HPCD.sys . ((((((((((((((((((((((((((((( snapshot_2008-07-10_22.06.55.78 ))))))))))))))))))))))))))))))))))))))))) . - 2008-07-11 02:16:50 2,048 --s-a-w C:\WINDOWS\bootstat.dat + 2008-07-12 14:02:56 2,048 --s-a-w C:\WINDOWS\bootstat.dat - 2008-03-25 06:28:39 135,168 ----a-w C:\WINDOWS\system32\java.exe + 2008-06-10 06:21:01 135,168 ----a-w C:\WINDOWS\system32\java.exe - 2008-03-25 06:28:43 135,168 ----a-w C:\WINDOWS\system32\javaw.exe + 2008-06-10 06:21:04 135,168 ----a-w C:\WINDOWS\system32\javaw.exe - 2008-03-25 07:37:01 139,264 ----a-w C:\WINDOWS\system32\javaws.exe + 2008-06-10 07:32:34 139,264 ----a-w C:\WINDOWS\system32\javaws.exe + 2008-07-12 14:03:07 16,384 ----atw C:\WINDOWS\TEMP\Perflib_Perfdata_5ac.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SunKistEM"="C:\Program Files\Digital Media Reader\shwiconem.exe" [2004-11-15 17:04 135168] "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 13:50 155648] "IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2004-08-20 17:55 155648] "HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2004-08-20 17:51 118784] "RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2004-11-02 22:24 32768] "Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" [2005-06-07 00:46 57344] "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-03-28 23:37 413696] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-03-30 10:36 267048] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 04:27 144784] C:\Documents and Settings\Owner\Start Menu\Programs\Startup\ Picture Motion Browser Media Check Tool.lnk - C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe [2008-01-27 15:11:43 344064] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2008-04-23 03:38:16 29696] DING!.lnk - C:\Program Files\Southwest Airlines\Ding\Ding.exe [2005-05-17 14:22:42 462848] WinZip Quick Pick.lnk - C:\Program Files\WinZip\WZQKPICK.EXE [2006-08-31 22:09:25 122880] [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders] SecurityProviders msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll, ntoskrnl.dll [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE"= "C:\\Program Files\\Real\\RealPlayer\\realplay.exe"= "C:\\Program Files\\Juniper Networks\\Secure Application Manager\\dsSamProxy.exe"= "C:\\Program Files\\iTunes\\iTunes.exe"= "C:\\WINDOWS\\system32\\mmc.exe"= R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-05-15 18:20] R1 NEOFLTR_600_13073;Juniper Networks TDI Filter Driver (NEOFLTR_600_13073);C:\WINDOWS\system32\Drivers\NEOFLTR_600_13073.SYS [2008-04-30 14:54] R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-05-15 18:16] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{da41a284-a859-11dc-9488-0013204adce0}] \Shell\AutoRun\command - L:\LaunchU3.exe -a . Contents of the 'Scheduled Tasks' folder "2008-06-24 14:01:03 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job" - C:\Program Files\Apple Software Update\SoftwareUpdate.exe "2005-07-01 18:37:52 C:\WINDOWS\Tasks\ISP signup reminder 1.job" - C:\WINDOWS\system32\OOBE\oobebaln.exe "2005-07-01 18:37:53 C:\WINDOWS\Tasks\ISP signup reminder 3.job" - C:\WINDOWS\system32\OOBE\oobebaln.exe . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-07-12 09:37:46 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-07-12 9:41:25 ComboFix-quarantined-files.txt 2008-07-12 14:41:01 ComboFix2.txt 2008-07-11 03:07:57 ComboFix3.txt 2008-07-08 22:59:30 ComboFix4.txt 2008-07-08 02:03:29 ComboFix5.txt 2008-07-03 03:14:05 Pre-Run: 24,876,019,712 bytes free Post-Run: 24,864,337,920 bytes free 118 --- E O F --- 2008-07-09 23:38:02 Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 10:24:46 AM, on 7/12/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\LEXPPS.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Digital Media Reader\shwiconem.exe C:\WINDOWS\system32\igfxtray.exe C:\WINDOWS\system32\hkcmd.exe C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe C:\Program Files\QuickTime\QTTask.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe C:\Program Files\Southwest Airlines\Ding\Ding.exe C:\Program Files\WinZip\WZQKPICK.EXE C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS C:\WINDOWS\system32\svchost.exe C:\Program Files\Canon\CAL\CALMAIN.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\Program Files\iPod\bin\iPodService.exe C:\WINDOWS\explorer.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.goole.com O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O4 - HKLM\..\Run: [SunKistEM] C:\Program Files\Digital Media Reader\shwiconem.exe O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" O4 - HKLM\..\Run: [Recguard] %WINDIR%\SMINST\RECGUARD.EXE O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" O4 - Startup: Picture Motion Browser Media Check Tool.lnk = C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: DING!.lnk = C:\Program Files\Southwest Airlines\Ding\Ding.exe O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {7584C670-2274-4EFB-B00B-D6AABA6D3850} (Microsoft RDP Client Control (redist)) - https://remote.schwab.com/svordp/,Da....com+msrdp.cab O16 - DPF: {E5F5D008-DD2C-4D32-977D-1A0ADF03058B} (JuniperSetupSP1 Control) - https://remote.schwab.com/dana-cache...erSetupSP1.cab O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE O23 - Service: PrismXL - New Boundary Technologies, Inc. - C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS -- End of file - 5655 bytes |
|
|
|
|
07-13-2008, 04:19 AM
|
#16 (permalink) | |
|
Moderator, Analyst, Security Team
Join Date: Oct 2006
Location: Důn Čideann,Scotland.
Posts: 5,093
OS: XP
|
Re: Malware Downloaded to my System - DeeWoo, OuterInfo, CoolWebSearch plus others
Hello again
Go to Start->Run and type in regedit and hit OK.Go to HKEY_LOCAL_MACHINE and click on it>then right-click on HKEY_LOCAL_MACHINE and select export. Save the registry somewhere as a backup. Close the Registry Editor now. Open notepad and copy/paste the text in the quotebox below: (don't forget to copy and paste REGEDIT4) Quote:
It should look like this:  Double click on the Fix.reg file and choose Yes to merge/add it to the registry. You may delete the file afterwards. ========= Go to Start > Run and type: cmd.exe and ok. Copy and paste the below string after the prompt > and hit Enter. dir /s /a "c:\ntoskrnl*.*" > c:\find.txt & start notepad c:\find.txt Your drive will be scanned and when finished, Notepad will pop up with some information. Copy and paste it in this thread. ========= Run Deckard System Scanner again ========= Logs Required C:find.txt C:\Deckard\System Scanner\main.txt How is your system behaving now. |
|
|
|
|
|
07-14-2008, 06:58 PM
|
#17 (permalink) |
|
Registered User
Join Date: Jun 2008
Posts: 10
OS: Windows XP
|
Re: Malware Downloaded to my System - DeeWoo, OuterInfo, CoolWebSearch plus others
Hey TheBruce1,
My machine seems fine. I don't see any obvious signs of infection...it seems to run as fast as it used to, there are no pop ups or anything. Volume in drive C has no label. Volume Serial Number is A846-C63D Directory of c:\WINDOWS\$hf_mig$\KB890859\SP2QFE 03/01/2005 08:04 PM 2,179,456 ntoskrnl.exe 1 File(s) 2,179,456 bytes Directory of c:\WINDOWS\$hf_mig$\KB929338\SP2QFE 12/19/2006 11:51 AM 2,182,016 ntoskrnl.exe 1 File(s) 2,182,016 bytes Directory of c:\WINDOWS\$hf_mig$\KB931784\SP2QFE 02/28/2007 04:55 AM 2,182,144 ntoskrnl.exe 1 File(s) 2,182,144 bytes Directory of c:\WINDOWS\$NtUninstallKB929338$ 03/01/2005 07:59 PM 2,179,328 ntoskrnl.exe 1 File(s) 2,179,328 bytes Directory of c:\WINDOWS\$NtUninstallKB931784$ 12/19/2006 09:17 AM 2,180,352 ntoskrnl.exe 1 File(s) 2,180,352 bytes Directory of c:\WINDOWS\Driver Cache\i386 02/28/2007 04:10 AM 2,180,352 ntoskrnl.exe 1 File(s) 2,180,352 bytes Directory of c:\WINDOWS\I386 08/04/2004 02:00 PM 1,008,941 NTOSKRNL.EX_ 1 File(s) 1,008,941 bytes Directory of c:\WINDOWS\system32 02/28/2007 04:10 AM 2,180,352 ntoskrnl.exe 1 File(s) 2,180,352 bytes Directory of c:\WINDOWS\system32\dllcache 02/28/2007 04:10 AM 2,180,352 ntoskrnl.exe 1 File(s) 2,180,352 bytes Directory of c:\WINDOWS\system32\ReinstallBackups\0011\DriverFiles\i386 08/04/2004 02:00 PM 2,180,992 ntoskrnl.exe 1 File(s) 2,180,992 bytes Total Files Listed: 10 File(s) 20,634,285 bytes 0 Dir(s) 24,510,222,336 bytes free Deckard's System Scanner v20071014.68 Run by Owner on 2008-07-14 19:29:21 Computer is in Normal Mode. -------------------------------------------------------------------------------- Total Physical Memory: 495 MiB (512 MiB recommended). -- HijackThis (run as Owner.exe) ----------------------------------------------- Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 7:31:00 PM, on 7/14/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\LEXPPS.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Digital Media Reader\shwiconem.exe C:\WINDOWS\system32\igfxtray.exe C:\WINDOWS\system32\hkcmd.exe C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe C:\Program Files\QuickTime\QTTask.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Southwest Airlines\Ding\Ding.exe C:\Program Files\WinZip\WZQKPICK.EXE C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS C:\WINDOWS\system32\svchost.exe C:\Program Files\Canon\CAL\CALMAIN.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\iTunes\iTunes.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceHelper.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\distnoted.exe C:\Documents and Settings\Owner\Desktop\dss.exe C:\PROGRA~1\TRENDM~1\HIJACK~1\Owner.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.goole.com R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O4 - HKLM\..\Run: [SunKistEM] C:\Program Files\Digital Media Reader\shwiconem.exe O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" O4 - HKLM\..\Run: [Recguard] %WINDIR%\SMINST\RECGUARD.EXE O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - Startup: Picture Motion Browser Media Check Tool.lnk = C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: DING!.lnk = C:\Program Files\Southwest Airlines\Ding\Ding.exe O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {7584C670-2274-4EFB-B00B-D6AABA6D3850} (Microsoft RDP Client Control (redist)) - https://remote.schwab.com/svordp/,Da....com+msrdp.cab O16 - DPF: {E5F5D008-DD2C-4D32-977D-1A0ADF03058B} (JuniperSetupSP1 Control) - https://remote.schwab.com/dana-cache...erSetupSP1.cab O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE O23 - Service: PrismXL - New Boundary Technologies, Inc. - C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS -- End of file - 6321 bytes -- Files created between 2008-06-14 and 2008-07-14 ----------------------------- 2008-07-12 12:55:06 0 d-------- C:\Program Files\iTunes 2008-07-12 12:53:59 0 d-------- C:\Program Files\Bonjour 2008-07-12 12:52:56 0 d-------- C:\Program Files\QuickTime 2008-07-10 23:02:09 0 d-------- C:\Program Files\Sun 2008-07-10 22:56:23 0 d-------- C:\Program Files\Common Files\Java 2008-07-02 22:24:50 0 d-------- C:\Program Files\Alwil Software 2008-07-01 22:52:48 0 d-------- C:\Program Files\Trend Micro 2008-07-01 22:13:06 0 d-------- C:\cmdcons 2008-07-01 22:10:10 68096 --a------ C:\WINDOWS\zip.exe 2008-07-01 22:10:10 49152 --a------ C:\WINDOWS\VFind.exe 2008-07-01 22:10:10 212480 --a------ C:\WINDOWS\swxcacls.exe <Not Verified; SteelWerX; SteelWerX Extended Configurator ACLists> 2008-07-01 22:10:10 136704 --a------ C:\WINDOWS\swsc.exe <Not Verified; SteelWerX; SteelWerX Service Controller> 2008-07-01 22:10:10 161792 --a------ C:\WINDOWS\swreg.exe <Not Verified; SteelWerX; SteelWerX Registry Editor> 2008-07-01 22:10:10 98816 --a------ C:\WINDOWS\sed.exe 2008-07-01 22:10:10 80412 --a------ C:\WINDOWS\grep.exe 2008-07-01 22:10:10 89504 --a------ C:\WINDOWS\fdsv.exe <Not Verified; Smallfrogs Studio; > 2008-07-01 21:33:53 0 d-------- C:\WINDOWS\ERUNT 2008-06-27 18:53:07 0 d-------- C:\ie-spyad_zo 2008-06-27 18:48:44 0 d-------- C:\Documents and Settings\All Users\Application Data\TEMP 2008-06-27 18:48:01 0 d-------- C:\Program Files\SpywareBlaster 2008-06-27 18:47:11 322518 --a------ C:\ie-spyad_zo.exe 2008-06-27 18:47:10 0 d-------- C:\ZonedOut 2008-06-27 07:59:27 0 d-------- C:\Program Files\Panda Security 2008-06-19 14:14:37 0 d-------- C:\Documents and Settings\NetworkService\Application Data\Macromedia 2008-06-19 14:14:18 0 dr------- C:\Documents and Settings\NetworkService\Favorites -- Find3M Report --------------------------------------------------------------- 2008-07-12 12:55:12 0 d-------- C:\Program Files\iPod 2008-07-10 23:01:58 0 d-------- C:\Program Files\Java 2008-07-10 22:56:23 0 d-------- C:\Program Files\Common Files 2008-06-19 13:32:22 0 d-------- C:\Documents and Settings\Owner\Application Data\Juniper Networks 2008-06-11 20:16:09 0 d-------- C:\Documents and Settings\Owner\Application Data\Move Networks 2008-06-07 20:12:10 0 d-------- C:\Program Files\Common Files\Adobe 2008-06-07 20:10:22 0 d-------- C:\Documents and Settings\Owner\Application Data\AdobeUM -- Registry Dump --------------------------------------------------------------- *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SunKistEM"="C:\Program Files\Digital Media Reader\shwiconem.exe" [11/15/2004 05:04 PM] "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [07/09/2001 01:50 PM] "IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [08/20/2004 05:55 PM] "HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [08/20/2004 05:51 PM] "RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [11/02/2004 10:24 PM] "Recguard"="%WINDIR%\SMINST\RECGUARD.EXE" [] "Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" [06/07/2005 12:46 AM] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [06/10/2008 04:27 AM] "AppleSyncNotifier"="C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [07/10/2008 09:47 AM] "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [05/27/2008 10:50 AM] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [07/10/2008 10:51 AM] C:\Documents and Settings\Owner\Start Menu\Programs\Startup\ Picture Motion Browser Media Check Tool.lnk - C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe [1/27/2008 3:11:43 PM] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [4/23/2008 3:38:16 AM] DING!.lnk - C:\Program Files\Southwest Airlines\Ding\Ding.exe [5/17/2005 2:22:42 PM] WinZip Quick Pick.lnk - C:\Program Files\WinZip\WZQKPICK.EXE [8/31/2006 10:09:25 PM] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "DisableRegistryTools"=0 (0x0) "HideLegacyLogonScripts"=0 (0x0) "HideLogoffScripts"=0 (0x0) "RunLogonScriptSync"=1 (0x1) "RunStartupScriptSync"=0 (0x0) "HideStartupScripts"=0 (0x0) [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system] "HideLegacyLogonScripts"=0 (0x0) "HideLogoffScripts"=0 (0x0) "RunLogonScriptSync"=1 (0x1) "RunStartupScriptSync"=0 (0x0) "HideStartupScripts"=0 (0x0) [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{da41a284-a859-11dc-9488-0013204adce0}] AutoRun\command- L:\LaunchU3.exe -a -- End of Deckard's System Scanner: finished at 2008-07-14 19:31:23 ------------ |
|
|
|
|
07-15-2008, 04:29 AM
|
#18 (permalink) |
|
Moderator, Analyst, Security Team
Join Date: Oct 2006
Location: Důn Čideann,Scotland.
Posts: 5,093
OS: XP
|
Re: Malware Downloaded to my System - DeeWoo, OuterInfo, CoolWebSearch plus others
Hi,
You don't seem to have a firewall program installed. Using a firewall will allow you to give/deny access for applications that want to go online. Select one of these, or another of your choice:. ========== Delete SDFix from your desktop, also delete this folder C:\SDFix. You can keep ATF-Cleaner if you wish. =========== Well done,your logs are clean. Click start>run>type(or copy/paste command into run box): ComboFix /u Click ok. ============ Clear IE6 cookies *Open IE and click Tools *Click on Internet Options *Click on General Tab *Click on Delte Temp Files & Cookies buttons. Clear IE7 cookies *On the Internet Explorer 7 Tools menu, click Internet Options. The Internet Options box should open to the General tab. *On the General tab, in the Browsing History, click the Delete button. This will delete all the files that are currently stored in your cache [that includes cookies too]. *Click OK, and then click OK again. Clear Firefox cookies/cache • Select "Tools" • Select "Options". • Select "Privacy". • In "Settings" window put the check mark for Cookies,Cache,Browsing history and any others you want. • Click OK. • In Private area click "Clear Now". ------------------------------------------------------------------------------------------- MICROSOFT UPDATES 1.Click Start,Run, type sysdm.cpl, and then press OK. 2.Click the Automatic Updates tab, and then click to select one of the following options. We recommend that you select the Automatic (recommended). Microsoft updates are released every second Tuesday of each month,what is called "Patch Tuesday". ------------------------------------------------------------------------------------------ Useful Information and Programs to keep you safe. TrendProtect is a FREE browser plug-in that helps you avoid Web pages with unwanted content and hidden threats. TrendProtect rates the current page and pages listed in Google, MSN, and Yahoo search results. You can use the rating to decide if you want to visit or avoid a given Web page. To rate Web pages, TrendProtect refers to an extensive database that covers the following information for billions of Web pages: * Content category * Phishing scam detection * Site reputation * Page reputation WOT Free helps you avoid disingenuous Internet content by allowing you to learn from others' experiences. WOT shows you website reputations on your browser, telling you how much other users trust a website. This helps you make better decisions while browsing and avoid phishing, malware, and other types of fraud. Reputations can also be added to web search results, Gmail, Wikipedia, and other selected sites. WOT reputations are computed mainly from user testimonies. Sharing your knowledge with others is just a click away, without ever having to leave the site. We also collect data from hundreds of other sources (including PhishTank) to quickly warn you of emerging threats. Currently, WOT knows over 12 million websites. Note:Only compatible with Firefox 1.5 and higher. -------------------------------------------------------------------------------------- Alternate Browsers Try the following free alternate browsers rather than Internet Explorer Avant Firefox Opera K-Meleon ------------------------------------------------------------------------------------------ Free Antispyware Products SuperAntiSpyware Ad-Aware Spybot S&D Download SpywareBlaster 4.1 to help prevent spyware from installing in the first place. Install & update SpywareBlaster with the latest definitions. After you have updated, click the button - enable protection for all unprotected items. Download Spyware Guard to catch and block spyware before it can execute. ------------------------------------------------------------------ IE-Spyad™ is a freeware utility that places more than 4000 dubious websites and domains in the Internet Explorer Restricted List. Download and installation instructions for IE-Spyad™ Here ----------------------------------------- The MVPS Hosts file replaces your current HOSTS file with one that will restrict known ad sites from serving you unsolicited advertisements. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is the IP of your local computer. Note that if you use a company provided HOSTS file you should not use the MVPS HOSTS file. If your having trouble downloading & extracting,see link below for guidance: http://www.mvps.org/winhelp2002/hosts2.htm Once you have extracted the host file,double click on it and a new window will open. Double-click on mvps.batand follow the prompts --------------------------------------------------------------- Winpatrol - Download and install the free version of Winpatrol. A tutorial for this product is located here: Using Winpatrol to protect your computer. ---------------------------------------- SnoopFree is a programme that informs you when another programme is wanting to log your keystrokes or read your screen.Only for XP users. Update all these programs regularly. Without regular updates you will not be protected when new malicious programs are released. ============================================== Also, please take a look at these well written articles: PC Safety and Security--What Do I Need? HOW DID I GET INFECTED IN THE FIRST PLACE? by Tony Klein THE ANTI-SPYWARE TUTORIAL MAKING INTERNET EXPLORER SAFER Understanding and Using Firewalls **Be very wary with any security software that is advertised in popups or in other ways. They are not only usually of no use, but often have malware in them. Please reply to this thread once more, as we may mark this as resolved, thanks. |
|
|
|
|
07-20-2008, 04:17 PM
|
#19 (permalink) |
|
Registered User
Join Date: Jun 2008
Posts: 10
OS: Windows XP
|
Re: Malware Downloaded to my System - DeeWoo, OuterInfo, CoolWebSearch plus others
TheBruce1,
Sorry I didn't get back to you right away. Thank you so much for your work and effort. I really appreciate what you guys do and I'm donating right now. Thanks, Nipsy |
|
|
|
| Thread Tools | |
|
|
