|
|
|
|
|||||
|
|
|
|
|
|
|||
| Welcome
to Tech Support Forum home to more then 136,000 problems solved. Issues
have included: Spyware, Malware, Virus Issues, Windows, Microsoft,
Linux, Networking, Security, Hardware, and Gaming Getting your
problem solved is as easy as: 1. Registering for a free account 2. Asking your question 3. Receiving an answer Registered members: * See fewer ads. * And much more..
|
| Want to know how to post a question? click here | Having problems with spyware and pop-ups? First Steps |
|
|||||||
| Resolved HJT Threads Resolved spyware and popup issues. |
|
|
LinkBack | Thread Tools |
08-04-2008, 06:29 AM
|
#1 (permalink) |
|
Registered User
Join Date: Jul 2008
Posts: 14
OS: XP
|
Need to remove haxdoor
After the last time my OS (Windows XP) automatically updated, a warning popped up telling me it had detected, but could not remove, a backdoor.haxdoor trojan. The DSS scan produced this:
Deckard's System Scanner v20071014.68 Run by One on 2008-08-02 21:53:47 Computer is in Normal Mode. -------------------------------------------------------------------------------- -- System Restore -------------------------------------------------------------- Failed to create restore point; unknown error code 0x00000001 Backed up registry hives. Performed disk cleanup. Total Physical Memory: 448 MiB (512 MiB recommended). -- HijackThis Clone ------------------------------------------------------------ Emulating logfile of Trend Micro HijackThis v2.0.2 Scan saved at 2008-08-02 21:56:43 Platform: Windows XP Service Pack 2 (5.01.2600) MSIE: Internet Explorer (7.00.6000.16674) Boot mode: Normal Running processes: C:\WINDOWS\system32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Sygate\SPF\Smc.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\slserv.exe C:\Program Files\Spyware Terminator\sp_rsser.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\explorer.exe C:\WINDOWS\system32\VTTimer.exe C:\WINDOWS\system32\VTTrayp.exe C:\WINDOWS\soundman.exe C:\WINDOWS\sm56hlpr.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\Spyware Terminator\SpywareTerminatorShield.Exe C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\system32\msfeedssync.exe C:\Documents and Settings\One\Desktop\dss.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.powerup.com.au/ R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Packard Bell R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (file missing) O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui O4 - HKLM\..\Run: [VTTimer] VTTimer.exe O4 - HKLM\..\Run: [VTTrayp] VTtrayp.exe O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [SMSERIAL] sm56hlpr.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [SpywareTerminator] "C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe" O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - (file missing) O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\network diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\network diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {1754A1BA-A1DF-4F10-B199-AA55AA1A120F} (InstallerBehaviorFactory Class) - https://signup.msn.com/pages/MsnInstC.cab O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/actives.../as2stubie.cab O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/micr...?1216468446718 O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://zone.msn.com/binFramework/v10...o.cab34246.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/ge...sh/swflash.cab O16 - DPF: {E5D419D6-A846-4514-9FAD-97E826C84822} (HeartbeatCtl Class) - http://fdl.msn.com/zone/datafiles/heartbeat.cab O16 - DPF: {EB387D2F-E27B-4D36-979E-847D1036C65D} (QDiagHUpdateObj Class) - http://h30043.www3.hp.com/hpdj/en/check/qdiagh.cab?326 O18 - Protocol: mso-offdap11 - {32505114-5902-49B2-880A-1F7738E5A384} - C:\Program Files\Common Files\Microsoft Shared\Web Components\11\OWC11.DLL O18 - Filter: text/xml - {807553E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL O20 - Winlogon Notify: routew - C:\WINDOWS\system32\routew.dll O23 - Service: SmartLinkService (SLService) - Unknown owner - slserv.exe O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SPF\Smc.exe O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\symwsc.exe -- End of file - 6410 bytes -- File Associations ----------------------------------------------------------- .reg - regfile - shell\open\command - regedit.exe "%1" %* .scr - scrfile - shell\open\command - "%1" %* -- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------- R0 Teefer (Teefer for NT) - c:\windows\\systemroot\system32\drivers\teefer.sys (file missing) R1 sp_rsdrv2 (Spyware Terminator Driver 2) - c:\windows\system32\drivers\sp_rsdrv2.sys R1 wpsdrvnt - c:\windows\system32\drivers\wpsdrvnt.sys <Not Verified; Sygate Technologies, Inc.; wpsdrvnt> R3 viagfx - c:\windows\system32\drivers\vtmini.sys <Not Verified; Copyright (C) VIA/S3 Graphics Co, Ltd.; UniChrome(Pro) IGP Driver> S1 rotw (WIRELESS Route service) - c:\windows\system32\rotw.sys (file missing) -- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled -------------------- R2 SLService (SmartLinkService) - slserv.exe (file missing) R2 sp_rssrv (Spyware Terminator Realtime Shield Service) - "c:\program files\spyware terminator\sp_rsser.exe" <Not Verified; Crawler.com; Crawler Spyware Terminator> -- Device Manager: Disabled ---------------------------------------------------- No disabled devices found. -- Scheduled Tasks ------------------------------------------------------------- 2008-08-02 21:10:00 418 --ah----- C:\WINDOWS\Tasks\User_Feed_Synchronization-{C589FB80-3B7F-484B-B209-9D78088D82CC}.job 2004-12-18 03:19:11 258 --a------ C:\WINDOWS\Tasks\Registration reminder 3.job 2004-12-18 03:19:11 258 --a------ C:\WINDOWS\Tasks\Registration reminder 2.job 2004-12-18 03:19:10 258 --a------ C:\WINDOWS\Tasks\Registration reminder 1.job -- Files created between 2008-07-02 and 2008-08-02 ----------------------------- 2008-07-30 23:13:15 0 d-------- C:\ie-spyad_zo 2008-07-27 23:26:22 0 d-------- C:\Program Files\SpywareBlaster 2008-07-21 00:11:20 0 d-------- C:\Program Files\Microsoft CAPICOM 2.1.0.2 2008-07-16 22:38:34 0 d-------- C:\Program Files\Panda Security 2008-07-14 22:54:29 0 d-------- C:\Documents and Settings\Two\Application Data\Spyware Terminator 2008-07-14 00:37:06 0 d-------- C:\Program Files\Exterminate It! 2008-07-14 00:13:40 0 d-------- C:\HaxFix 2008-07-14 00:13:40 466502 --a------ C:\HaxFix.exe <Not Verified; Marckie; > -- Find3M Report --------------------------------------------------------------- 2008-08-01 12:03:33 0 d-------- C:\Documents and Settings\One\Application Data\Canon 2008-07-23 23:10:49 0 d-------- C:\Program Files\Spyware Terminator 2008-06-14 21:28:56 0 d-------- C:\Documents and Settings\One\Application Data\Malwarebytes 2008-06-14 21:22:58 0 d-------- C:\Documents and Settings\One\Application Data\Spyware Terminator 2008-06-14 20:57:43 0 d-------- C:\Program Files\Common Files 2008-05-29 00:29:02 0 --a------ C:\WINDOWS\system32\kl80.bin 2008-05-27 22:55:35 22322 --a------ C:\WINDOWS\system32\routew.dll 2008-05-27 22:55:35 5438 --a------ C:\WINDOWS\system32\rhs.bin -- Registry Dump --------------------------------------------------------------- *Note* empty entries & legit default entries are not shown -- End of Deckard's System Scanner: finished at 2008-08-02 21:57:25 ------------ How do I get rid of it? |
|
     |
| Sponsored Links |
|
08-06-2008, 05:01 AM
|
#2 (permalink) |
|
Analyst, Security Team
Join Date: Jun 2008
Posts: 71
OS: XP SP2
|
Re: Need to remove haxdoor
Hi there,
Please go here to install the recovery console and for a guide on using combofix. Please note: Installing the Recovery Console plays a vital part in making this process of cleaning your computer safe, don't overlook this! Now please download combofix from here or here. It is important that you save this file to your desktop. Double click combofix.exe and follow the prompts. Please, never rename Combofix unless instructed. When finished, it shall produce a log for you. Post that log and a Hijack This log in your next reply. A quick heads up, if you click on combofix's window when it's running, you may cause it to stall.
__________________
 
|
|
|
|
|
08-07-2008, 06:24 AM
|
#3 (permalink) |
|
Registered User
Join Date: Jul 2008
Posts: 14
OS: XP
|
Re: Need to remove haxdoor
When I boot up my computer, it already has a Windows Recovery option, as well as Windows XP. (And when I followed the steps in the tutorial, combofix did not install the recovery console.) Does this mean the recovery console is already installed and it's safe to run combofix?
|
|
|
|
|
08-09-2008, 06:18 AM
|
#6 (permalink) |
|
Analyst, Security Team
Join Date: Jun 2008
Posts: 71
OS: XP SP2
|
Re: Need to remove haxdoor
Hi there,
Temporarily disable Spyware Terminator, exit out of the program and see if Combofix runs. Sygate and Norton can be disabled as well http://www.bleepingcomputer.com/forums/topic114351.html After it runs please re-enable your protection programs. Otherwise, you have HaxFix.exe already I see - can you run the program and select option#1 - Make a log file. Post the log here please. Also, Click on Start, click on Run Copy and paste the following in bold in the open window and then click OK "%userprofile%\desktop\dss.exe" /config This will open up DSS configuration
Please post back both logs that open in notepad Main txt and extra txt Post back with the logs.
__________________
|
|
|
|
|
08-10-2008, 06:47 AM
|
#7 (permalink) |
|
Registered User
Join Date: Jul 2008
Posts: 14
OS: XP
|
Re: Need to remove haxdoor
I disabled everything (including Windows Firewall, which I overlooked before). Norton appears not to be installed - it's not on the Add/Remove Programs list. This time when I clicked on combofix I was able to run it, but a window titled "Error - Win32 Only" popped up claiming I have an incompatible OS (which I don't). With haxfix, the promised red DOS window appears, but only for a second before it closes itself.
Bleeping computer indeed! 
|
|
|
|
|
08-10-2008, 09:38 AM
|
#8 (permalink) |
|
Analyst, Security Team
Join Date: Jun 2008
Posts: 71
OS: XP SP2
|
Re: Need to remove haxdoor
Hi there,
1. Please download The Avenger by Swandog46 to your Desktop.
Code:
Begin copying here: Drivers to disable: rotw Drivers to delete: rotw Files to delete: C:\WINDOWS\system32\routew.dll C:\WINDOWS\system32\rhs.bin C:\WINDOWS\system32\kl80.bin C:\WINDOWS\system32\rotw.sys Registry keys to delete: HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\routew Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system. 3. Now, open the avenger folder and start The Avenger program by clicking on its icon.
See if you can get ComboFix to run then. If not please try and run HaxFix and run Deckards' System Scanner as instructed.
__________________
Last edited by Mike; 08-10-2008 at 10:00 AM. |
|
|
|
|
08-12-2008, 05:15 AM
|
#10 (permalink) |
|
Registered User
Join Date: Jul 2008
Posts: 14
OS: XP
|
Re: Need to remove haxdoor
HaxFix is still not working. Nor is Combofix - with or without the hyphen. I ran Avenger and DSS and got the following logs:
Avenger: Logfile of The Avenger Version 2.0, (c) by Swandog46 http://swandog46.geekstogo.com Platform: Windows XP ******************* Script file opened successfully. Script file read successfully. Backups directory opened successfully at C:\Avenger ******************* Beginning to process script file: Driver "rotw" disabled successfully. Driver "rotw" deleted successfully. File "C:\WINDOWS\system32\routew.dll" deleted successfully. File "C:\WINDOWS\system32\rhs.bin" deleted successfully. File "C:\WINDOWS\system32\kl80.bin" deleted successfully. Error: file "C:\WINDOWS\system32\rotw.sys" not found! Deletion of file "C:\WINDOWS\system32\rotw.sys" failed! Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND) --> the object does not exist Registry key "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\routew" deleted successfully. Completed script processing. ******************* Finished! Terminate. DSS: Deckard's System Scanner v20071014.68 Run by One on 2008-08-12 22  43Computer is in Normal Mode. -------------------------------------------------------------------------------- Total Physical Memory: 448 MiB (512 MiB recommended). -- HijackThis Clone ------------------------------------------------------------ Emulating logfile of Trend Micro HijackThis v2.0.2 Scan saved at 2008-08-12 22:07:14 Platform: Windows XP Service Pack 2 (5.01.2600) MSIE: Internet Explorer (7.00.6000.16674) Boot mode: Normal Running processes: C:\WINDOWS\system32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\slserv.exe C:\Program Files\Spyware Terminator\sp_rsser.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\explorer.exe C:\WINDOWS\system32\VTTimer.exe C:\WINDOWS\system32\VTTrayp.exe C:\WINDOWS\soundman.exe C:\WINDOWS\sm56hlpr.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\Spyware Terminator\SpywareTerminatorShield.Exe C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\system32\msfeedssync.exe C:\WINDOWS\system32\wuauclt.exe C:\Documents and Settings\One\Desktop\dss.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.powerup.com.au/ R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Packard Bell R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (file missing) O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui O4 - HKLM\..\Run: [VTTimer] VTTimer.exe O4 - HKLM\..\Run: [VTTrayp] VTtrayp.exe O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [SMSERIAL] sm56hlpr.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [SpywareTerminator] "C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe" O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - (file missing) O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\network diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\network diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {1754A1BA-A1DF-4F10-B199-AA55AA1A120F} (InstallerBehaviorFactory Class) - https://signup.msn.com/pages/MsnInstC.cab O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/micr...?1216468446718 O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://zone.msn.com/binFramework/v10...o.cab34246.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/ge...sh/swflash.cab O16 - DPF: {E5D419D6-A846-4514-9FAD-97E826C84822} (HeartbeatCtl Class) - http://fdl.msn.com/zone/datafiles/heartbeat.cab O16 - DPF: {EB387D2F-E27B-4D36-979E-847D1036C65D} (QDiagHUpdateObj Class) - http://h30043.www3.hp.com/hpdj/en/check/qdiagh.cab?326 O17 - HKLM\SYSTEM\CCS\Services\Tcpip\..\{1E3ED978-0D85-4C14-BAC1-D59F86EE75D9}: NameServer = 203.0.178.191 O18 - Protocol: mso-offdap11 - {32505114-5902-49B2-880A-1F7738E5A384} - C:\Program Files\Common Files\Microsoft Shared\Web Components\11\OWC11.DLL O18 - Filter: text/xml - {807553E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL O23 - Service: SmartLinkService (SLService) - Unknown owner - slserv.exe O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SPF\Smc.exe O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\symwsc.exe -- End of file - 6305 bytes -- Files created between 2008-07-12 and 2008-08-12 ----------------------------- 2008-08-06 23:57:29 0 d-------- C:\327882R2FWJFW 2008-07-30 23:13:15 0 d-------- C:\ie-spyad_zo 2008-07-27 23:26:22 0 d-------- C:\Program Files\SpywareBlaster 2008-07-21 00:11:20 0 d-------- C:\Program Files\Microsoft CAPICOM 2.1.0.2 2008-07-16 22:38:34 0 d-------- C:\Program Files\Panda Security 2008-07-14 22:54:29 0 d-------- C:\Documents and Settings\Two\Application Data\Spyware Terminator 2008-07-14 00:37:06 0 d-------- C:\Program Files\Exterminate It! 2008-07-14 00:13:40 0 d-------- C:\HaxFix 2008-07-14 00:13:40 466502 --a------ C:\HaxFix.exe <Not Verified; Marckie; > -- Find3M Report --------------------------------------------------------------- 2008-08-01 12:03:33 0 d-------- C:\Documents and Settings\One\Application Data\Canon 2008-07-23 23:10:49 0 d-------- C:\Program Files\Spyware Terminator 2008-06-14 21:28:56 0 d-------- C:\Documents and Settings\One\Application Data\Malwarebytes 2008-06-14 21:22:58 0 d-------- C:\Documents and Settings\One\Application Data\Spyware Terminator 2008-06-14 20:57:43 0 d-------- C:\Program Files\Common Files -- Registry Dump --------------------------------------------------------------- *Note* empty entries & legit default entries are not shown -- End of Deckard's System Scanner: finished at 2008-08-12 22:07:52 ------------ |
|
|
|
|
08-12-2008, 07:43 AM
|
#11 (permalink) |
|
Analyst, Security Team
Join Date: Jun 2008
Posts: 71
OS: XP SP2
|
Re: Need to remove haxdoor
Hmm, odd.
I didn't get the info I want from DSS, I need you to run it this way please. Click on Start, click on Run Copy and paste the following in bold in the open window and then click OK "%userprofile%\desktop\dss.exe" /config This will open up DSS configuration
Please post back both logs that open in notepad Main txt and extra txt
__________________
Last edited by Mike; 08-12-2008 at 07:44 AM. |
|
|
|
|
08-13-2008, 06:08 AM
|
#12 (permalink) |
|
Registered User
Join Date: Jul 2008
Posts: 14
OS: XP
|
Re: Need to remove haxdoor
Here they are:
Deckard's System Scanner v20071014.68 Run by One on 2008-08-13 23:03:59 Computer is in Normal Mode. -------------------------------------------------------------------------------- -- System Restore -------------------------------------------------------------- Failed to create restore point; unknown error code 0x00000001 Performed disk cleanup. Total Physical Memory: 448 MiB (512 MiB recommended). -- HijackThis Clone ------------------------------------------------------------ Emulating logfile of Trend Micro HijackThis v2.0.2 Scan saved at 2008-08-13 23:04:32 Platform: Windows XP Service Pack 2 (5.01.2600) MSIE: Internet Explorer (7.00.6000.16674) Boot mode: Normal Running processes: C:\WINDOWS\system32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Sygate\SPF\Smc.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\slserv.exe C:\Program Files\Spyware Terminator\sp_rsser.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\explorer.exe C:\WINDOWS\system32\VTTimer.exe C:\WINDOWS\system32\VTTrayp.exe C:\WINDOWS\soundman.exe C:\WINDOWS\sm56hlpr.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\Spyware Terminator\SpywareTerminatorShield.Exe C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\system32\msfeedssync.exe C:\WINDOWS\system32\wuauclt.exe C:\Documents and Settings\One\Desktop\dss.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.powerup.com.au/ R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Packard Bell R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (file missing) O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui O4 - HKLM\..\Run: [VTTimer] VTTimer.exe O4 - HKLM\..\Run: [VTTrayp] VTtrayp.exe O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [SMSERIAL] sm56hlpr.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [SpywareTerminator] "C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe" O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - (file missing) O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\network diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\network diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {1754A1BA-A1DF-4F10-B199-AA55AA1A120F} (InstallerBehaviorFactory Class) - https://signup.msn.com/pages/MsnInstC.cab O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/micr...?1216468446718 O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://zone.msn.com/binFramework/v10...o.cab34246.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/ge...sh/swflash.cab O16 - DPF: {E5D419D6-A846-4514-9FAD-97E826C84822} (HeartbeatCtl Class) - http://fdl.msn.com/zone/datafiles/heartbeat.cab O16 - DPF: {EB387D2F-E27B-4D36-979E-847D1036C65D} (QDiagHUpdateObj Class) - http://h30043.www3.hp.com/hpdj/en/check/qdiagh.cab?326 O17 - HKLM\SYSTEM\CCS\Services\Tcpip\..\{1E3ED978-0D85-4C14-BAC1-D59F86EE75D9}: NameServer = 203.0.178.191 O18 - Protocol: mso-offdap11 - {32505114-5902-49B2-880A-1F7738E5A384} - C:\Program Files\Common Files\Microsoft Shared\Web Components\11\OWC11.DLL O18 - Filter: text/xml - {807553E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL O23 - Service: SmartLinkService (SLService) - Unknown owner - slserv.exe O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SPF\Smc.exe O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\symwsc.exe -- End of file - 6342 bytes -- File Associations ----------------------------------------------------------- .reg - regfile - shell\open\command - regedit.exe "%1" %* .scr - scrfile - shell\open\command - "%1" %* -- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------- R0 Teefer (Teefer for NT) - c:\windows\\systemroot\system32\drivers\teefer.sys (file missing) R1 sp_rsdrv2 (Spyware Terminator Driver 2) - c:\windows\system32\drivers\sp_rsdrv2.sys R1 wpsdrvnt - c:\windows\system32\drivers\wpsdrvnt.sys <Not Verified; Sygate Technologies, Inc.; wpsdrvnt> R3 viagfx - c:\windows\system32\drivers\vtmini.sys <Not Verified; Copyright (C) VIA/S3 Graphics Co, Ltd.; UniChrome(Pro) IGP Driver> -- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled -------------------- R2 SLService (SmartLinkService) - slserv.exe (file missing) R2 sp_rssrv (Spyware Terminator Realtime Shield Service) - "c:\program files\spyware terminator\sp_rsser.exe" <Not Verified; Crawler.com; Crawler Spyware Terminator> -- Device Manager: Disabled ---------------------------------------------------- No disabled devices found. -- Process Modules ------------------------------------------------------------- C:\WINDOWS\explorer.exe (pid 1764) 2001-11-27 08:10:00 20552 --a------ C:\Program Files\WinZip\WZSHLSTB.DLL <Not Verified; WinZip Computing, Inc.; WinZip> -- Scheduled Tasks ------------------------------------------------------------- 2008-08-13 22:45:00 418 --ah----- C:\WINDOWS\Tasks\User_Feed_Synchronization-{C589FB80-3B7F-484B-B209-9D78088D82CC}.job 2004-12-18 03:19:11 258 --a------ C:\WINDOWS\Tasks\Registration reminder 3.job 2004-12-18 03:19:11 258 --a------ C:\WINDOWS\Tasks\Registration reminder 2.job 2004-12-18 03:19:10 258 --a------ C:\WINDOWS\Tasks\Registration reminder 1.job -- Files created between 2008-07-13 and 2008-08-13 ----------------------------- 2008-08-06 23:57:29 0 d-------- C:\327882R2FWJFW 2008-07-30 23:13:15 0 d-------- C:\ie-spyad_zo 2008-07-27 23:26:22 0 d-------- C:\Program Files\SpywareBlaster 2008-07-21 00:11:20 0 d-------- C:\Program Files\Microsoft CAPICOM 2.1.0.2 2008-07-16 22:38:34 0 d-------- C:\Program Files\Panda Security 2008-07-14 22:54:29 0 d-------- C:\Documents and Settings\Two\Application Data\Spyware Terminator 2008-07-14 00:37:06 0 d-------- C:\Program Files\Exterminate It! 2008-07-14 00:13:40 0 d-------- C:\HaxFix 2008-07-14 00:13:40 466502 --a------ C:\HaxFix.exe <Not Verified; Marckie; > -- Find3M Report --------------------------------------------------------------- 2008-08-01 12:03:33 0 d-------- C:\Documents and Settings\One\Application Data\Canon 2008-07-23 23:10:49 0 d-------- C:\Program Files\Spyware Terminator 2008-06-14 21:28:56 0 d-------- C:\Documents and Settings\One\Application Data\Malwarebytes 2008-06-14 21:22:58 0 d-------- C:\Documents and Settings\One\Application Data\Spyware Terminator 2008-06-14 20:57:43 0 d-------- C:\Program Files\Common Files -- Registry Dump --------------------------------------------------------------- *Note* empty entries & legit default entries are not shown -- End of Deckard's System Scanner: finished at 2008-08-13 23:05:51 ------------ Deckard's System Scanner v20071014.68 Extra logfile - please post this as an attachment with your post. -------------------------------------------------------------------------------- -- System Information ---------------------------------------------------------- Microsoft Windows XP Home Edition (build 2600) SP 2.0 Architecture: X86; Language: English CPU 0: Intel Pentium II processor Percentage of Memory in Use: 60% Physical Memory (total/avail): 447.48 MiB / 174.66 MiB Pagefile Memory (total/avail): 765.52 MiB / 574.63 MiB Virtual Memory (total/avail): 2047.88 MiB / 1902.39 MiB A: is Removable (No Media) C: is Fixed (NTFS) - 34.27 GiB total, 23.34 GiB free. D: is CDROM (No Media) \\.\PHYSICALDRIVE0 - Maxtor 6E040L0 - 38.29 GiB - 2 partitions \PARTITION0 - Unknown - 4.01 GiB \PARTITION1 (bootable) - Installable File System - 34.27 GiB - C: -- Security Center ------------------------------------------------------------- AUOptions is scheduled to auto-install. Windows Internal Firewall is enabled. FirstRunDisabled is set. AntiVirusDisableNotify is set. FW: Sygate Personal Firewall v4.6 (Sygate Technologies, Inc.) [HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:MSN Messenger 7.0" "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" [HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "C:\\Program Files\\LabF.com\\WinaXe_Plus\\xserver.exe"="C:\\Program Files\\LabF.com\\WinaXe_Plus\\xserver.exe:*:Enabled:xserver" "C:\\Program Files\\LabF.com\\WinaXe_Plus\\xwppeg.exe"="C:\\Program Files\\LabF.com\\WinaXe_Plus\\xwppeg.exe:*:Enabled:xwppeg" "C:\\Program Files\\OpenDX\\bin_intelnt\\dxexec.exe"="C:\\Program Files\\OpenDX\\bin_intelnt\\dxexec.exe:*:Enabled:dxexec" "C:\\Program Files\\OpenDX\\bin_intelnt\\dxui.exe"="C:\\Program Files\\OpenDX\\bin_intelnt\\dxui.exe:*:Enabled:dxui" "C:\\Program Files\\Messenger\\msmsgs.exe"="C:\\Program Files\\Messenger\\msmsgs.exe:*:Enabled:Windows Messenger" "C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:MSN Messenger 7.0" "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" "C:\\Program Files\\CA\\eTrust Antivirus\\Realmon.exe"="C:\\Program Files\\CA\\eTrust Antivirus\\Realmon.exe:*:Enabled:Realmon" "C:\\WINDOWS\\Explorer.EXE"="C:\\WINDOWS\\Explorer.EXE:*:Enabled:explorer" "\\??\\C:\\WINDOWS\\system32\\winlogon.exe"="\\??\\C:\\WINDOWS\\system32\\winlogon.exe:*:Enabled:explorer" -- Environment Variables ------------------------------------------------------- ALLUSERSPROFILE=C:\Documents and Settings\All Users APPDATA=C:\Documents and Settings\One\Application Data CLASSPATH=c:\j2sdk1.4.2-03\lib; CLIENTNAME=Console CommonProgramFiles=C:\Program Files\Common Files COMPUTERNAME=LONGBOURN ComSpec=C:\WINDOWS\system32\cmd.exe DX_WEB_BROWSER=1 FP_NO_HOST_CHECK=NO HOMEDRIVE=C: HOMEPATH=\Documents and Settings\One LOGONSERVER=\\LONGBOURN NUMBER_OF_PROCESSORS=1 OS=Windows_NT Path=c:\j2sdk1.4.2-03\bin;C:\Program Files\Common Files\MDL Shared\ISIS PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH PROCESSOR_ARCHITECTURE=x86 PROCESSOR_IDENTIFIER=x86 Family 6 Model 22 Stepping 1, GenuineIntel PROCESSOR_LEVEL=6 PROCESSOR_REVISION=1601 ProgramFiles=C:\Program Files PROMPT=$P$G QTJAVA="C:\Program Files\Java\j2re1.4.2_05\lib\ext\QTJava.zip" SESSIONNAME=Console SystemDrive=C: SystemRoot=C:\WINDOWS TEMP=C:\DOCUME~1\One\LOCALS~1\Temp TMP=C:\DOCUME~1\One\LOCALS~1\Temp USERDOMAIN=LONGBOURN USERNAME=One USERPROFILE=C:\Documents and Settings\One windir=C:\WINDOWS -- User Profiles --------------------------------------------------------------- One (admin) Two (admin) -- Add/Remove Programs --------------------------------------------------------- -- Application Event Log ------------------------------------------------------- Event Record #/Type7151 / Error Event Submitted/Written: 08/13/2008 10:40:25 PM Event ID/Source: 1802 / SecurityCenter Event Description: The Windows Security Center Service was unable to establish event queries with WMI to monitor third party AntiVirus and Firewall. Event Record #/Type7150 / Error Event Submitted/Written: 08/12/2008 10 35 PMEvent ID/Source: 1002 / Application Hang Event Description: Hanging application dss.exe, version 3.2.8.1, hang module hungapp, version 0.0.0.0, hang address 0x00000000. Event Record #/Type7148 / Error Event Submitted/Written: 08/12/2008 09:31:37 PM Event ID/Source: 1802 / SecurityCenter Event Description: The Windows Security Center Service was unable to establish event queries with WMI to monitor third party AntiVirus and Firewall. Event Record #/Type7146 / Error Event Submitted/Written: 08/11/2008 10:57:51 PM Event ID/Source: 1802 / SecurityCenter Event Description: The Windows Security Center Service was unable to establish event queries with WMI to monitor third party AntiVirus and Firewall. Event Record #/Type7144 / Error Event Submitted/Written: 08/11/2008 10:01:48 PM Event ID/Source: 1802 / SecurityCenter Event Description: The Windows Security Center Service was unable to establish event queries with WMI to monitor third party AntiVirus and Firewall. -- Security Event Log ---------------------------------------------------------- No Errors/Warnings found. -- System Event Log ------------------------------------------------------------ Event Record #/Type31784 / Error Event Submitted/Written: 08/13/2008 11:05:06 PM Event ID/Source: 7016 / Service Control Manager Event Description: The SmartLinkService service has reported an invalid current state 0. Event Record #/Type31499 / Error Event Submitted/Written: 08/02/2008 09:57:03 PM Event ID/Source: 7016 / Service Control Manager Event Description: The SmartLinkService service has reported an invalid current state 0. Event Record #/Type31293 / Warning Event Submitted/Written: 07/24/2008 00:42:15 AM Event ID/Source: 256 / PlugPlayManager Event Description: Timed out sending notification of device interface change to window of "SAS window" Event Record #/Type31132 / Error Event Submitted/Written: 07/16/2008 10:15:03 PM Event ID/Source: 7023 / Service Control Manager Event Description: The Application Management service terminated with the following error: %%126 Event Record #/Type31128 / Error Event Submitted/Written: 07/16/2008 10:15:03 PM Event ID/Source: 7023 / Service Control Manager Event Description: The Application Management service terminated with the following error: %%126 -- End of Deckard's System Scanner: finished at 2008-08-13 23:05:51 ------------ |
|
|
|
|
08-14-2008, 04:30 AM
|
#13 (permalink) |
|
Analyst, Security Team
Join Date: Jun 2008
Posts: 71
OS: XP SP2
|
Re: Need to remove haxdoor
Hi there,
Please download Malwarebytes' Anti-Malware from Here or Here Double Click mbam-setup.exe to install the application.
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly. And, Download GMER from here: http://www.gmer.net/files.php Unzip it to the desktop. Open the program and click on the Rootkit tab. Make sure all the boxes on the right of the screen are checked, EXCEPT for ‘Show All’. Click on Scan. When the scan has run click Copy and paste the results (if any) into this thread.
__________________
|
|
|
|
|
08-14-2008, 07:11 AM
|
#14 (permalink) |
|
Registered User
Join Date: Jul 2008
Posts: 14
OS: XP
|
Re: Need to remove haxdoor
Here they are:
Malwarebytes' Anti-Malware 1.24 Database version: 1052 Windows 5.1.2600 Service Pack 2 11:41:47 PM 8/14/2008 mbam-log-8-14-2008 (23-41-47).txt Scan type: Quick Scan Objects scanned: 51972 Time elapsed: 10 minute(s), 59 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected) GMER 1.0.14.14536 - http://www.gmer.net Rootkit scan 2008-08-15 00:04:19 Windows 5.1.2600 Service Pack 2 ---- System - GMER 1.0.14 ---- SSDT \??\C:\WINDOWS\system32\drivers\wpsdrvnt.sys (wpsdrvnt/Sygate Technologies, Inc.) ZwAllocateVirtualMemory [0xF7827B30] SSDT \??\C:\WINDOWS\system32\drivers\sp_rsdrv2.sys ZwClose [0xF5CD6606] SSDT \??\C:\WINDOWS\system32\drivers\sp_rsdrv2.sys ZwCreateFile [0xF5CD605A] SSDT \??\C:\WINDOWS\system32\drivers\sp_rsdrv2.sys ZwCreateKey [0xF5CD5D3C] SSDT \??\C:\WINDOWS\system32\drivers\sp_rsdrv2.sys ZwCreateSection [0xF5CD7652] SSDT \??\C:\WINDOWS\system32\drivers\wpsdrvnt.sys (wpsdrvnt/Sygate Technologies, Inc.) ZwCreateThread [0xF78276F0] SSDT \??\C:\WINDOWS\system32\drivers\sp_rsdrv2.sys ZwDeleteKey [0xF5CD5E46] SSDT \??\C:\WINDOWS\system32\drivers\sp_rsdrv2.sys ZwDeleteValueKey [0xF5CD5F30] SSDT \??\C:\WINDOWS\system32\drivers\sp_rsdrv2.sys ZwLoadDriver [0xF5CD68CC] SSDT \??\C:\WINDOWS\system32\drivers\wpsdrvnt.sys (wpsdrvnt/Sygate Technologies, Inc.) ZwMapViewOfSection [0xF7827470] SSDT \??\C:\WINDOWS\system32\drivers\sp_rsdrv2.sys ZwOpenFile [0xF5CD6362] SSDT \??\C:\WINDOWS\system32\drivers\wpsdrvnt.sys (wpsdrvnt/Sygate Technologies, Inc.) ZwProtectVirtualMemory [0xF7827C50] SSDT \??\C:\WINDOWS\system32\drivers\sp_rsdrv2.sys ZwSetValueKey [0xF5CD5BBA] SSDT \??\C:\WINDOWS\system32\drivers\wpsdrvnt.sys (wpsdrvnt/Sygate Technologies, Inc.) ZwShutdownSystem [0xF7827990] SSDT \??\C:\WINDOWS\system32\drivers\sp_rsdrv2.sys ZwTerminateProcess [0xF5CD6814] SSDT \??\C:\WINDOWS\system32\drivers\sp_rsdrv2.sys ZwWriteFile [0xF5CD6494] SSDT \??\C:\WINDOWS\system32\drivers\wpsdrvnt.sys (wpsdrvnt/Sygate Technologies, Inc.) ZwWriteVirtualMemory [0xF7827D60] ---- Kernel IAT/EAT - GMER 1.0.14 ---- IAT \SystemRoot\system32\DRIVERS\ndiswan.sys[NDIS.SYS!NdisCloseAdapter] [F72CAC70] Teefer.sys (Teefer Driver/Sygate Technologies, Inc.) IAT \SystemRoot\system32\DRIVERS\ndiswan.sys[NDIS.SYS!NdisOpenAdapter] [F72CABD0] Teefer.sys (Teefer Driver/Sygate Technologies, Inc.) IAT \SystemRoot\system32\DRIVERS\ndiswan.sys[NDIS.SYS!NdisDeregisterProtocol] [F72CAB10] Teefer.sys (Teefer Driver/Sygate Technologies, Inc.) IAT \SystemRoot\system32\DRIVERS\ndiswan.sys[NDIS.SYS!NdisRegisterProtocol] [F72CA8E0] Teefer.sys (Teefer Driver/Sygate Technologies, Inc.) IAT \SystemRoot\system32\DRIVERS\raspppoe.sys[NDIS.SYS!NdisRegisterProtocol] [F72CA8E0] Teefer.sys (Teefer Driver/Sygate Technologies, Inc.) IAT \SystemRoot\system32\DRIVERS\raspppoe.sys[NDIS.SYS!NdisOpenAdapter] [F72CABD0] Teefer.sys (Teefer Driver/Sygate Technologies, Inc.) IAT \SystemRoot\system32\DRIVERS\raspppoe.sys[NDIS.SYS!NdisCloseAdapter] [F72CAC70] Teefer.sys (Teefer Driver/Sygate Technologies, Inc.) IAT \SystemRoot\system32\DRIVERS\raspppoe.sys[NDIS.SYS!NdisDeregisterProtocol] [F72CAB10] Teefer.sys (Teefer Driver/Sygate Technologies, Inc.) IAT \SystemRoot\system32\DRIVERS\psched.sys[NDIS.SYS!NdisDeregisterProtocol] [F72CAB10] Teefer.sys (Teefer Driver/Sygate Technologies, Inc.) IAT \SystemRoot\system32\DRIVERS\psched.sys[NDIS.SYS!NdisRegisterProtocol] [F72CA8E0] Teefer.sys (Teefer Driver/Sygate Technologies, Inc.) IAT \SystemRoot\system32\DRIVERS\psched.sys[NDIS.SYS!NdisOpenAdapter] [F72CABD0] Teefer.sys (Teefer Driver/Sygate Technologies, Inc.) IAT \SystemRoot\system32\DRIVERS\psched.sys[NDIS.SYS!NdisCloseAdapter] [F72CAC70] Teefer.sys (Teefer Driver/Sygate Technologies, Inc.) IAT \SystemRoot\System32\Drivers\NDProxy.SYS[NDIS.SYS!NdisRegisterProtocol] [F72CA8E0] Teefer.sys (Teefer Driver/Sygate Technologies, Inc.) IAT \SystemRoot\System32\Drivers\NDProxy.SYS[NDIS.SYS!NdisCloseAdapter] [F72CAC70] Teefer.sys (Teefer Driver/Sygate Technologies, Inc.) IAT \SystemRoot\System32\Drivers\NDProxy.SYS[NDIS.SYS!NdisOpenAdapter] [F72CABD0] Teefer.sys (Teefer Driver/Sygate Technologies, Inc.) IAT \SystemRoot\System32\Drivers\NDProxy.SYS[NDIS.SYS!NdisDeregisterProtocol] [F72CAB10] Teefer.sys (Teefer Driver/Sygate Technologies, Inc.) IAT \SystemRoot\system32\DRIVERS\tcpip.sys[NDIS.SYS!NdisCloseAdapter] [F72CAC70] Teefer.sys (Teefer Driver/Sygate Technologies, Inc.) IAT \SystemRoot\system32\DRIVERS\tcpip.sys[NDIS.SYS!NdisOpenAdapter] [F72CABD0] Teefer.sys (Teefer Driver/Sygate Technologies, Inc.) IAT \SystemRoot\system32\DRIVERS\tcpip.sys[NDIS.SYS!NdisRegisterProtocol] [F72CA8E0] Teefer.sys (Teefer Driver/Sygate Technologies, Inc.) IAT \SystemRoot\system32\DRIVERS\wanarp.sys[NDIS.SYS!NdisDeregisterProtocol] [F72CAB10] Teefer.sys (Teefer Driver/Sygate Technologies, Inc.) IAT \SystemRoot\system32\DRIVERS\wanarp.sys[NDIS.SYS!NdisRegisterProtocol] [F72CA8E0] Teefer.sys (Teefer Driver/Sygate Technologies, Inc.) IAT \SystemRoot\system32\DRIVERS\wanarp.sys[NDIS.SYS!NdisOpenAdapter] [F72CABD0] Teefer.sys (Teefer Driver/Sygate Technologies, Inc.) IAT \SystemRoot\system32\DRIVERS\wanarp.sys[NDIS.SYS!NdisCloseAdapter] [F72CAC70] Teefer.sys (Teefer Driver/Sygate Technologies, Inc.) IAT \SystemRoot\system32\DRIVERS\ndisuio.sys[NDIS.SYS!NdisRegisterProtocol] [F72CA8E0] Teefer.sys (Teefer Driver/Sygate Technologies, Inc.) IAT \SystemRoot\system32\DRIVERS\ndisuio.sys[NDIS.SYS!NdisDeregisterProtocol] [F72CAB10] Teefer.sys (Teefer Driver/Sygate Technologies, Inc.) IAT \SystemRoot\system32\DRIVERS\ndisuio.sys[NDIS.SYS!NdisCloseAdapter] [F72CAC70] Teefer.sys (Teefer Driver/Sygate Technologies, Inc.) IAT \SystemRoot\system32\DRIVERS\ndisuio.sys[NDIS.SYS!NdisOpenAdapter] [F72CABD0] Teefer.sys (Teefer Driver/Sygate Technologies, Inc.) ---- Devices - GMER 1.0.14 ---- Device \Driver\Tcpip \Device\Ip wpsdrvnt.sys (wpsdrvnt/Sygate Technologies, Inc.) Device \Driver\Tcpip \Device\Tcp wpsdrvnt.sys (wpsdrvnt/Sygate Technologies, Inc.) Device \Driver\Tcpip \Device\Udp wpsdrvnt.sys (wpsdrvnt/Sygate Technologies, Inc.) Device \Driver\Tcpip \Device\RawIp wpsdrvnt.sys (wpsdrvnt/Sygate Technologies, Inc.) Device \Driver\Tcpip \Device\IPMULTICAST wpsdrvnt.sys (wpsdrvnt/Sygate Technologies, Inc.) ---- Registry - GMER 1.0.14 ---- Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@AppInit_DLLs Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@DeviceNotSelectedTimeout 15 Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@GDIProcessHandleQuota 10000 Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@Spooler yes Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@swapdisk Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@TransmissionRetryTimeout 90 Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@USERProcessHandleQuota 10000 ---- EOF - GMER 1.0.14 ---- |
|
|
|
|
08-14-2008, 10:45 AM
|
#15 (permalink) |
|
Analyst, Security Team
Join Date: Jun 2008
Posts: 71
OS: XP SP2
|
Re: Need to remove haxdoor
Looks good, the part about not being able to run combofix or haxfix worries me though.
I notice you have no Anti-Virus program installed on your computer. These programs are necessary in keeping your computer free of malware, without it you are very likely to get re-infected within a very short period of time. Please download AntiVir Update the program and run a full scan. Please download ATF Cleaner by Atribune.
For Technical Support, double-click the e-mail address located at the bottom of each menu. Then, Download the latest version of Java Runtime Environment (JRE) 6 Update 7. Once done, uninstall any older versions of Java through add or remove programs. Go to Kaspersky website and perform an online antivirus scan.
__________________
Last edited by Mike; 08-14-2008 at 10:46 AM. |
|
|
|
|
08-23-2008, 09:25 AM
|
#19 (permalink) |
|
Analyst, Security Team
Join Date: Jun 2008
Posts: 71
OS: XP SP2
|
Re: Need to remove haxdoor
We covered all the bases, I'm still uncomfortable with HaxFix and ComboFix not running.
Do this for me, Click START then RUN Now type Combofix /u in the runbox and click OK  Notice the space between the x and / -- That needs to be there. Now, Now please download combofix from here or here. It is important that you save this file to your desktop. Double click on the program and run it for me.
__________________
|
|
|
|
| Thread Tools | |
|
|
