Possible Infection Affecting Internet

Wheezy · 12-02-2008, 12:16 PM

Unfortunately I am back. I do love this website and appreciate all of the help you give people, but I hate why I come here! I think I may have another infection. I know it's probably irritating to see the same people all the time, but I did everything and put everything in place (as far as anti-virus protection AVG Free), but something must have slipped through. I apologize crawling back here with the same problem, but I just don't know what else I could have done...

About two days ago, a weird PDF website that came up with a Google search (that I didn't even visit) tried to execute a pop-up, which froze my Internet. From then on, my internet has been *super* slow, and I am unable to navigate to this forum, the GMER website or my anti-virus website (among others). I was able to download DDS, send it over to my desktop and run it, but gmer will not run. No matter how many times I try it, I open it and try to run it but nothing happens. But here are the logs from the DDS program.

---------------------DDS LOG---------------------

DDS (Version 1.0) - NTFSx86
Run by Shellie Waters at 13:52:41.67 on Tue 12/02/2008
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1022.624 [GMT -6:00]

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
svchost.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Program Files\Electronic Arts\EADM\Core.exe
"C:\WINDOWS\system32\drivers\svchost.exe"
C:\WINDOWS\System32\svchost.exe -k HTTPFilter
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Shellie Waters\Desktop\dds.com

============== Pseudo HJT Report ===============

uStart Page = hxxp://minnesota.twins.mlb.com/index.jsp?c_id=min
uInternet Connection Wizard,ShellNext = hxxp://www.google.com/ig/dell?hl=en&client=dell-inc&channel=us
mWinlogon: SFCDisable=-99 (0xffffff9d)
BHO: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - c:\program files\adobe\acrobat 6.0\reader\activex\AcroIEHelper.dll
BHO: {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - c:\program files\avg\avg8\avgssie.dll
BHO: {53707962-6F74-2D53-2644-206D7942484F} - c:\downlo~1\spybot~1\SDHelper.dll
BHO: {5CA3D70E-1895-11CF-8E15-001234567890} - c:\windows\system32\dla\DLASHX_W.DLL
BHO: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\program files\java\jre1.6.0_06\bin\ssv.dll
BHO: {9030D464-4C02-4ABF-8ECC-5164760863C6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: {CA6319C0-31B7-401E-A518-A07C3DB8F777} - c:\program files\bae\BAE.dll
uRun: [EA Core] c:\program files\electronic arts\eadm\Core.exe -silent
uRun: [SVCHOST.EXE] c:\windows\system32\drivers\svchost.exe
uRun: [nah_Shell] c:\documents and settings\shellie waters\nah_ettf.exe
uRun: [HPseti] "c:\documents and settings\shellie waters\application data\google\runhh6110411.exe"
mRun: [QuickTime Task] "c:\program files\qttask.exe" -atboottime
mRun: [TkBellExe] "c:\program files\common files\real\update_ob\realsched.exe" -osboot
mRun: [SunJavaUpdateSched] "c:\program files\java\jre1.6.0_06\bin\jusched.exe"
mRun: [AVG8_TRAY] c:\progra~1\avg\avg8\avgtray.exe
uPolicies-system: RunStartupScriptSync = 1 (0x1)
mPolicies-system: RunStartupScriptSync = 1 (0x1)
IE: E&xport to Microsoft Excel - c:\progra~1\micros~4\office11\EXCEL.EXE/3000
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg8\avgpp.dll
AppInit_DLLs: c:\progra~1\google\google~1\GOEC62~1.DLL,avgrsstx.dll

============= SERVICES / DRIVERS ===============

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2008-11-20 97928]
R1 AvgMfx86;AVG Free On-access Scanner Minifilter Driver x86;c:\windows\system32\drivers\avgmfx86.sys [2008-11-20 26824]
R2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\avg\avg8\avgemc.exe [2008-11-20 875288]
R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\avg\avg8\avgwdsvc.exe [2008-11-20 231704]
R2 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2008-11-20 76040]
R2 McrdSvc;Media Center Extender Service;c:\windows\ehome\mcrdsvc.exe [2005-8-5 99328]
R2 tmevtmgr;tmevtmgr;\??\c:\windows\system32\drivers\tmevtmgr.sys [2007-10-15 52368]
R2 tmpreflt;tmpreflt;c:\windows\system32\drivers\tmpreflt.sys [2007-9-17 36112]
R3 tmcfw;Trend Micro Common Firewall Service;c:\windows\system32\drivers\TM_CFW.sys [2007-9-17 333328]
S3 SaiH8000;SaiH8000;c:\windows\system32\drivers\SaiH8000.sys [2004-7-30 56576]
S4 TmPfw;Trend Micro Personal Firewall;c:\progra~1\trendm~1\intern~2\TmPfw.exe [2007-10-15 480520]
S4 tmproxy;Trend Micro Proxy Service;"c:\program files\trend micro\internet security\TmProxy.exe" [2007-10-15 648456]

=============== Created Last 30 ================

2008-12-01 01:04 161 a------- c:\documents and settings\shellie waters\nah_log.dat
2008-11-30 20:18 <DIR> --d-h--- C:\$AVG8.VAULT$
2008-11-30 20:08 80,384 a------- c:\documents and settings\shellie waters\nah_ettf.exe
2008-11-30 20:07 42,496 a------- c:\windows\system32\drivers\svchost.exe
2008-11-24 18:07 <DIR> --d----- c:\program files\3ivx
2008-11-24 18:07 <DIR> --d----- c:\program files\muvee Technologies
2008-11-24 18:07 <DIR> --d----- c:\program files\common files\muvee Technologies
2008-11-24 18:06 26,496 a------- c:\windows\system32\dllcache\usbstor.sys
2008-11-20 16:12 76,040 a------- c:\windows\system32\drivers\avgtdix.sys
2008-11-20 16:12 10,520 a------- c:\windows\system32\avgrsstx.dll
2008-11-20 16:12 97,928 a------- c:\windows\system32\drivers\avgldx86.sys
2008-11-20 16:12 <DIR> --d----- c:\windows\system32\drivers\Avg
2008-11-20 16:12 <DIR> --d----- c:\program files\AVG
2008-11-20 16:12 <DIR> --d----- c:\docume~1\alluse~1\applic~1\avg8

==================== Find3M ====================

2008-11-30 20:08 502,272 a------- c:\windows\system32\winlogon.exe
2008-11-30 20:08 295,424 a------- c:\windows\system32\termsrv.dll
2008-11-24 18:07 <DIR> --d----- c:\program files\QTComponents
2008-10-24 05:10 453,632 -------- c:\windows\system32\dllcache\mrxsmb.sys
2008-10-16 23:08 <DIR> --d----- c:\docume~1\shelli~1\applic~1\SPORE
2008-10-16 14:13 1,809,944 a------- c:\windows\system32\dllcache\wuaueng.dll
2008-10-16 14:13 202,776 a------- c:\windows\system32\dllcache\wuweb.dll
2008-10-16 14:12 323,608 a------- c:\windows\system32\dllcache\wucltui.dll
2008-10-16 14:12 561,688 a------- c:\windows\system32\dllcache\wuapi.dll
2008-10-16 14:09 92,696 a------- c:\windows\system32\dllcache\cdm.dll
2008-10-16 14:09 51,224 a------- c:\windows\system32\dllcache\wuauclt.exe
2008-10-16 14:08 34,328 a------- c:\windows\system32\dllcache\wups.dll
2008-10-16 14:06 268,648 a------- c:\windows\system32\mucltui.dll
2008-10-16 14:06 208,744 a------- c:\windows\system32\muweb.dll
2008-10-15 10:57 332,800 -------- c:\windows\system32\dllcache\netapi32.dll
2008-10-07 21:52 <DIR> --d----- c:\program files\TheSimsResource
2008-10-07 17:20 <DIR> --d----- c:\program files\SimPE
2008-09-15 05:57 1,846,016 a------- c:\windows\system32\win32k.sys
2008-09-15 05:57 1,846,016 -------- c:\windows\system32\dllcache\win32k.sys
2008-09-07 11:16 7,086 ac------ c:\windows\system32\ealregsnapshot1.reg
2008-09-04 10:42 1,106,944 a------- c:\windows\system32\msxml3.dll
2008-09-04 10:42 1,106,944 -------- c:\windows\system32\dllcache\msxml3.dll
2008-07-07 16:01 <DIR> --d----- c:\docume~1\shelli~1\applic~1\CoreFTP
2007-11-10 23:16 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Kontiki
2007-10-18 14:44 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Kaspersky Lab
2007-10-16 01:09 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Spybot - Search & Destroy
2007-10-15 18:48 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Trend Micro
2006-10-18 11:54 <DIR> --d----- c:\docume~1\shelli~1\applic~1\.BitTornado
2006-09-16 21:23 <DIR> --d----- c:\docume~1\shelli~1\applic~1\X-Chat 2
2006-09-11 19:19 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Windows Live Toolbar
2006-07-06 00:18 <DIR> --d----- c:\docume~1\shelli~1\applic~1\New Folder
2006-05-22 22:13 <DIR> --d----- c:\docume~1\shelli~1\applic~1\FileMaker
2006-04-13 20:26 <DIR> --d----- c:\docume~1\shelli~1\applic~1\Corel Photo Album
2006-04-11 02:01 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Viewpoint
2006-10-21 15:54 152 ---shr-- c:\windows\system32\11D43EA203.sys
2006-10-21 15:54 7,520 ac-sh--- c:\windows\system32\KGyGaAvL.sys

============= FINISH: 13:53:36.54 ===============

**chemist** · 12-04-2008, 08:34 AM

Hello and Welcome to TSF.

Please Subscribe to this Thread to get immediate notification of replies as soon as they are posted. To do this click Thread Tools, then click Subscribe to this Thread. Make sure it is set to Instant notification by email, then click Add Subscription.

Please note that the forum is very busy and if I don't hear from you within three days this thread will be closed.

Please copy this page to Notepad and Save it to your Desktop in order to assist you when carrying out the following instructions.

Before beginning the fix, read this post completely. If there's anything that you do not understand, kindly ask your questions before proceeding.
Ensure that there aren't any opened browsers when you are carrying out the procedures below.

It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence.

------------------------------------------------------

Download Combo-Fix to a USB drive on another computer and transfer it to your desktop.

------------------------------------------------------

Download Combo-Fix.exe and Save it to your Desktop.

* IMPORTANT !!! Save Combo-Fix.exe to your Desktop

Disable your AntiVirus and AntiSpyware applications, usually via a right-click on the System Tray icon. They may otherwise interfere with our tools

Double-click on Combo-Fix.exe & follow the prompts.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

------------------------------------------------------

If you have any questions along the way...STOP and ask them before proceeding.

Wheezy · 12-04-2008, 02:17 PM

Hi chemist. I appreciate you helping me with my problem! I ran the ComboFix with no problems. I did receive a prompt before it started which read "Rootkit detected - must reboot". So my computer rebooted and then started/completed the ComboFix. I copy/pasted the log below.

I look forward to hearing from you soon :)

--------------- Combo Fix Log ---------------

ComboFix 08-12-04.04 - Shellie Waters 2008-12-04 16:01:19.11 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.667 [GMT -6:00]
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Shellie Waters\nah_ettf.exe
c:\documents and settings\Shellie Waters\nah_log.dat
c:\windows\BM272d792e.txt
c:\windows\IE4 Error Log.txt
c:\windows\system32\drivers\svchost.exe
c:\windows\system32\drivers\TDSSmqlt.sys
c:\windows\system32\TDSSbrsr.dll
c:\windows\system32\TDSScfum.dll
c:\windows\system32\TDSSlxwp.dll
c:\windows\system32\TDSSnmxh.log
c:\windows\system32\TDSSofxh.dll
c:\windows\system32\TDSSosvd.dat
c:\windows\system32\TDSSrhym.log
c:\windows\system32\TDSSriqp.dll
c:\windows\system32\TDSSsihc.dll
c:\windows\system32\TDSStkdv.log

c:\windows\system32\winlogon.exe . . . is infected!!

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_TDSSSERV.SYS
-------\Legacy_TDSSSERV.SYS

((((((((((((((((((((((((( Files Created from 2008-11-04 to 2008-12-04 )))))))))))))))))))))))))))))))
.

2008-11-30 20:18 . 2008-12-02 02:53 <DIR> d--h----- C:\$AVG8.VAULT$
2008-11-24 18:07 . 2008-11-24 18:07 <DIR> d-------- c:\program files\muvee Technologies
2008-11-24 18:07 . 2008-11-24 18:07 <DIR> d-------- c:\program files\Common Files\muvee Technologies
2008-11-24 18:07 . 2008-11-24 18:07 <DIR> d-------- c:\program files\3ivx
2008-11-24 18:06 . 2004-08-03 23:08 26,496 --a------ c:\windows\system32\dllcache\usbstor.sys
2008-11-20 16:12 . 2008-11-30 14:54 <DIR> d-------- c:\windows\system32\drivers\Avg
2008-11-20 16:12 . 2008-11-20 16:12 <DIR> d-------- c:\program files\AVG
2008-11-20 16:12 . 2008-11-30 20:18 <DIR> d-------- c:\documents and settings\All Users\Application Data\avg8
2008-11-20 16:12 . 2008-11-20 16:12 97,928 --a------ c:\windows\system32\drivers\avgldx86.sys
2008-11-20 16:12 . 2008-11-20 16:12 76,040 --a------ c:\windows\system32\drivers\avgtdix.sys
2008-11-20 16:12 . 2008-11-20 16:12 10,520 --a------ c:\windows\system32\avgrsstx.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-12-02 20:29 --------- d---a-w c:\documents and settings\All Users\Application Data\TEMP
2008-11-25 00:07 --------- d--h--w c:\program files\InstallShield Installation Information
2008-11-25 00:07 --------- d-----w c:\program files\QTComponents
2008-10-24 11:10 453,632 ----a-w c:\windows\system32\drivers\mrxsmb.sys
2008-10-17 05:08 --------- d-----w c:\documents and settings\Shellie Waters\Application Data\SPORE
2008-10-08 03:52 --------- d-----w c:\program files\TheSimsResource
2008-10-07 23:20 --------- d-----w c:\program files\SimPE
2008-01-15 07:49 1,498 ----a-w c:\program files\Calculator.lnk
2007-06-29 11:25 8,612 -c--a-w c:\program files\QuickTime Read Me.htm
2007-06-29 11:25 749,568 -c--a-w c:\program files\QTOControl.dll
2007-06-29 11:25 684,032 -c--a-w c:\program files\QTOLibrary.dll
2007-06-29 11:25 618,496 -c--a-w c:\program files\QTInfo.exe
2007-06-29 11:25 6,124,864 ----a-w c:\program files\QuickTimePlayer.exe
2007-06-29 11:25 574,784 -c--a-w c:\program files\QTPlugin.ocx
2007-06-29 11:25 303,104 -c--a-w c:\program files\QTUIPanelControl.dll
2007-06-29 11:24 55,622 -c--a-w c:\program files\Sample.mov
2007-06-29 11:24 483,328 -c--a-w c:\program files\PictureViewer.exe
2007-06-29 11:24 286,720 ----a-w c:\program files\QTTask.exe
2007-06-29 11:24 18,663 -c--a-w c:\program files\Sample.qtif
2006-10-21 21:54 152 --sh--r c:\windows\system32\11D43EA203.sys
2006-10-21 21:54 7,520 -csha-w c:\windows\system32\KGyGaAvL.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"EA Core"="c:\program files\Electronic Arts\EADM\Core.exe" [2008-07-21 2752512]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"QuickTime Task"="c:\program files\qttask.exe" [2007-06-29 286720]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2007-09-27 185632]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_06\bin\jusched.exe" [2008-03-25 144784]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2008-11-27 1261336]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.3IV2"= 3ivxVfWCodec_dec.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Gamma Loader.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk
backup=c:\windows\pss\Adobe Gamma Loader.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Digital Line Detect.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Digital Line Detect.lnk
backup=c:\windows\pss\Digital Line Detect.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DLA]
--a--c--- 2005-09-08 04:20 122940 c:\windows\system32\DLA\DLACTRLW.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DMXLauncher]
--a--c--- 2005-10-05 02:12 94208 c:\program files\Dell\Media Experience\DMXLauncher.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ehTray]
--a--c--- 2005-09-29 13:01 67584 c:\windows\ehome\ehtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Desktop Search]
--a------ 2006-04-11 02:07 169472 c:\program files\Google\Google Desktop Search\GoogleDesktop.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IAAnotif]
--a--c--- 2005-06-17 06:56 139264 c:\program files\Intel\Intel Matrix Storage Manager\IAAnotif.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup]
--a--c--- 2005-06-10 09:44 249856 c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]
--a--c--- 2005-06-10 09:44 81920 c:\program files\Common Files\InstallShield\UpdateService\issch.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
--a------ 2007-10-04 17:14 8491008 c:\windows\system32\nvcpl.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
--a--c--- 2007-10-04 17:14 81920 c:\windows\system32\nvmctray.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2007-06-29 05:24 286720 c:\program files\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
--a------ 2007-09-27 17:02 185632 c:\program files\Common Files\Real\Update_OB\realsched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
--a--c--- 2007-10-04 17:14 1626112 c:\windows\system32\nwiz.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SigmatelSysTrayApp]
--a--c--- 2005-03-22 22:20 339968 c:\windows\stsystra.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"usnjsvc"=3 (0x3)
"tmproxy"=3 (0x3)
"TmPfw"=3 (0x3)
"TMBMServer"=2 (0x2)
"SfCtlCom"=2 (0x2)
"ose"=3 (0x3)
"NVSvc"=2 (0x2)
"NetSvc"=3 (0x3)
"MDM"=2 (0x2)
"KService"=2 (0x2)
"IAANTMon"=2 (0x2)
"ELService"=2 (0x2)

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\TrendAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\TrendFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\AVG\\AVG8\\avgemc.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\Drivers\avgldx86.sys [2008-11-20 97928]
R2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [2008-11-20 875288]
R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2008-11-20 231704]
R2 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\Drivers\avgtdix.sys [2008-11-20 76040]
R2 tmevtmgr;tmevtmgr;\??\c:\windows\system32\drivers\tmevtmgr.sys [2007-10-15 52368]
R2 tmpreflt;tmpreflt;c:\windows\system32\DRIVERS\tmpreflt.sys [2007-09-17 36112]
R3 tmcfw;Trend Micro Common Firewall Service;c:\windows\system32\DRIVERS\TM_CFW.sys [2007-09-17 333328]
S3 SaiH8000;SaiH8000;c:\windows\system32\DRIVERS\SaiH8000.sys [2004-07-30 56576]
S4 TmPfw;Trend Micro Personal Firewall;c:\progra~1\TRENDM~1\INTERN~2\TmPfw.exe [2007-10-15 480520]
S4 tmproxy;Trend Micro Proxy Service;"c:\program files\Trend Micro\Internet Security\TmProxy.exe" [2007-10-15 648456]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{361ac05d-0e0d-11da-9aa9-806d6172696f}]
\Shell\AutoRun\command - E:\setup.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e9d77a1a-b838-11dd-8c02-0013721253cd}]
\Shell\AutoRun\command - e:\system\viewer\FlipVideoforPC.exe
\Shell\Flip Video for PC\command - e:\system\viewer\FlipVideoforPC.exe
.
Contents of the 'Scheduled Tasks' folder

2008-03-20 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-06-03 12:42]
.
- - - - ORPHANS REMOVED - - - -

MSConfigStartUp-kdx - c:\program files\Kontiki\KHost.exe
MSConfigStartUp-SunJavaUpdateSched - c:\program files\Java\j2re1.4.2_03\bin\jusched.exe

.
------- Supplementary Scan -------
.
uStart Page = hxxp://minnesota.twins.mlb.com/index.jsp?c_id=min
uInternet Connection Wizard,ShellNext = hxxp://www.google.com/ig/dell?hl=en&client=dell-inc&channel=us
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
FireFox -: Profile - c:\documents and settings\Shellie Waters\Application Data\Mozilla\Firefox\Profiles\kuae1v1r.default\
FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://forums.sims2community.com/index.php
FF -: plugin - c:\program files\Adobe\Acrobat 6.0\Reader\browser\nppdf32.dll
FF -: plugin - c:\program files\Plugins\npqtplugin.dll
FF -: plugin - c:\program files\Plugins\npqtplugin2.dll
FF -: plugin - c:\program files\Plugins\npqtplugin3.dll
FF -: plugin - c:\program files\Plugins\npqtplugin4.dll
FF -: plugin - c:\program files\Plugins\npqtplugin5.dll
FF -: plugin - c:\program files\Plugins\npqtplugin6.dll
FF -: plugin - c:\program files\Plugins\npqtplugin7.dll
FF -: plugin - c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-12-04 16:07:17
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
c:\windows\ehome\ehrecvr.exe
c:\windows\ehome\ehSched.exe
c:\windows\ehome\mcrdsvc.exe
c:\program files\AVG\AVG8\avgrsx.exe
c:\windows\system32\dllhost.exe
.
**************************************************************************
.
Completion time: 2008-12-04 16:11:28 - machine was rebooted
ComboFix-quarantined-files.txt 2008-12-04 22:11:25
ComboFix2.txt 2008-05-15 04:31:37

Pre-Run: 82,254,192,640 bytes free
Post-Run: 82,198,233,088 bytes free

200 --- E O F --- 2008-12-03 11:12:07

**chemist** · 12-04-2008, 02:41 PM

Hello, Wheezy. Can you connect to the internet now?

------------------------------------------------------

Please uninstall the following via Start->(or My Computer)->Control Panel->Add or Remove Programs if it still exists:

Viewpoint Media Player<<This is considered foistware instead of malware since it is installed without users approval, but doesn't spy or do anything "bad". Please read here and here

If you decide to uninstall it, also delete the following Folders if they still exist:

C:\Program Files\Viewpoint
C:\Documents and Settings\All Users\Application Data\Viewpoint

------------------------------------------------------

I see you have WildTangent Web Driver installed on your system. Although not technically spyware, it does have built-in components to update itself and collect information about your computer. We recommend uninstalling it. Please read here for information, removal instructions, and a link to an automatic removal tool.

If you uninstall it, delete the following Folder if it still exists:

C:\Program Files\WildTangent

------------------------------------------------------

Go Start > Run and copy/paste the following single-line command into the Run box and click OK:

cmd /c Vfind -ltf "%systemdrive%\winlogon.exe" >log.txt&log.txt&del log.txt

A Notepad file will open. Post the contents of log.txt in your next reply.

------------------------------------------------------

Wheezy · 12-04-2008, 02:56 PM

Hi chemist! I am now able to connect to the internet, and I can also access this site, which I wasn't able to do before. I uninstalled the two programs you advised to uninstall. In fact, I didn't even know what the programs were and why/how they got onto my system! Here is the log that came up from the last step:

--------------- Log ---------------

-c--a-w 502,272 2004-08-10 10:00:00 C:\i386\winlogon.exe
-c--a-w 507,904 2008-04-14 00:12:39 C:\WINDOWS\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\winlogon.exe
----a-w 502,272 2004-08-10 10:00:00 C:\WINDOWS\system32\winlogon.exe
----a-w 502,272 2004-08-10 10:00:00 C:\WINDOWS\system32\dllcache\winlogon.exe

**chemist** · 12-04-2008, 03:11 PM

Please go to: VirusTotal

On the page you'll find a Browse button.
Next to the Browse button you'll see a box to enter text.
Please copy/paste the following bolded text into the box:

C:\WINDOWS\system32\winlogon.exe
Then click the Send File button just below.
This will scan the file. Please be patient.
If you get a message saying File has already been analysed: click Reanalyse file now
Once scanned, copy and paste the results in your next reply.
Please repeat for the following file:

C:\WINDOWS\system32\dllcache\winlogon.exe

------------------------------------------------------

Wheezy · 12-04-2008, 03:25 PM

I'm sorry if this is hard to read, but I saw no option to copy/paste the log information other than just using my mouse. I can change it if necessary!

I let both analyze completely without interference.

--------------- Log File #1 ---------------

File winlogon.exe received on 12.05.2008 00:14:31 (CET)
Current status: Loading ... queued waiting scanning finished NOT FOUND STOPPED
Result: 0/37 (0%)
Loading server information...
Your file is queued in position: 11.
Estimated start time is between 85 and 122 seconds.
Do not close the window until scan is complete.
The scanner that was processing your file is stopped at this moment, we are going to wait a few seconds to try to recover your result.
If you are waiting for more than five minutes you have to resend your file.
Your file is being scanned by VirusTotal in this moment,
results will be shown as they're generated.
Compact Compact
Print results Print results
Your file has expired or does not exists.
Service is stopped in this moments, your file is waiting to be scanned (position: ) for an undefined time.

You can wait for web response (automatic reload) or type your email in the form below and click "request" so the system sends you a notification when the scan is finished.
Email:

Antivirus Version Last Update Result
AhnLab-V3 2008.12.5.0 2008.12.04 -
AntiVir 7.9.0.41 2008.12.04 -
Authentium 5.1.0.4 2008.12.04 -
Avast 4.8.1281.0 2008.12.04 -
AVG 8.0.0.199 2008.12.04 -
BitDefender 7.2 2008.12.04 -
CAT-QuickHeal 10.00 2008.12.04 -
ClamAV 0.94.1 2008.12.04 -
DrWeb 4.44.0.09170 2008.12.04 -
eSafe 7.0.17.0 2008.12.04 -
eTrust-Vet 31.6.6243 2008.12.04 -
Ewido 4.0 2008.12.04 -
F-Prot 4.4.4.56 2008.12.04 -
F-Secure 8.0.14332.0 2008.12.04 -
Fortinet 3.117.0.0 2008.12.04 -
GData 19 2008.12.05 -
Ikarus T3.1.1.45.0 2008.12.04 -
K7AntiVirus 7.10.543 2008.12.04 -
Kaspersky 7.0.0.125 2008.12.04 -
McAfee 5454 2008.12.04 -
McAfee+Artemis 5454 2008.12.04 -
Microsoft 1.4205 2008.12.05 -
NOD32 3665 2008.12.04 -
Norman 5.80.02 2008.12.04 -
Panda 9.0.0.4 2008.12.04 -
PCTools 4.4.2.0 2008.12.04 -
Prevx1 V2 2008.12.05 -
Rising 21.06.32.00 2008.12.04 -
SecureWeb-Gateway 6.7.6 2008.12.04 -
Sophos 4.36.0 2008.12.04 -
Sunbelt 3.1.1832.2 2008.12.01 -
Symantec 10 2008.12.05 -
TheHacker 6.3.1.2.175 2008.12.04 -
TrendMicro 8.700.0.1004 2008.12.04 -
VBA32 3.12.8.10 2008.12.03 -
ViRobot 2008.12.4.1500 2008.12.04 -
VirusBuster 4.5.11.0 2008.12.04 -
Additional information
File size: 502272 bytes
MD5...: 01c3346c241652f43aed8e2149881bfe
SHA1..: a5396141cab8b22d9d88b28a814089537dce366a
SHA256: affd0973cd3128083417d407f62bc4a635fc25b65dbf52e91d3ab4ae2f9c1b4a
SHA512: c2b4a1fe29b84b0dfd062de79db83ef85ecb238184957649512a951e5abed874
776f0b7c128cb33cd7cbb540d68ecac3a5ab09291fccecb64660b1a874e44090
ssdeep: 6144:2YuZlm8LRlBw662R1pqrc7FmxSqVw/T+SN1TrSnmhPnpdcrFIzdFz/N5Wjy
fTNQG:2VLBhic7Qy1vSneJFDNhp8
PEiD..: -
TrID..: File type identification
Win64 Executable Generic (80.9%)
Win32 Executable Generic (8.0%)
Win32 Dynamic Link Library (generic) (7.1%)
Generic Win/DOS Executable (1.8%)
DOS Executable Generic (1.8%)
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x103d353
timedatestamp.....: 0x41107edc (Wed Aug 04 06:14:52 2004)
machinetype.......: 0x14c (I386)

( 3 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x6f288 0x6f400 6.82 5a133ab60f38b5d739d86c8290fa5a3c
.data 0x71000 0x4d90 0x2000 6.20 baa64d00a5f8a540a38a60d2aff66f30
.rsrc 0x76000 0x9030 0x9200 3.62 b93cbbc049130e1bad3ea13d7512c074

( 20 imports )
> ADVAPI32.dll: ConvertStringSecurityDescriptorToSecurityDescriptorA, A_SHAInit, A_SHAUpdate, A_SHAFinal, LsaStorePrivateData, LsaRetrievePrivateData, LsaNtStatusToWinError, CryptGetUserKey, CryptGetKeyParam, CryptEncrypt, CryptSetProvParam, CryptSignHashW, CryptDeriveKey, CryptGetProvParam, RegOpenCurrentUser, RegDeleteKeyW, AddAccessAllowedAceEx, RegSetKeySecurity, I_ScSendTSMessage, MD5Init, MD5Update, MD5Final, SetFileSecurityA, AllocateLocallyUniqueId, LsaOpenPolicy, LsaQueryInformationPolicy, LsaFreeMemory, LsaClose, RegNotifyChangeKeyValue, QueryServiceConfigW, SetKernelObjectSecurity, ConvertStringSecurityDescriptorToSecurityDescriptorW, RegEnumKeyExW, GetCurrentHwProfileW, RegCloseKey, RegQueryValueExW, RegOpenKeyW, FreeSid, SetSecurityDescriptorDacl, InitializeSecurityDescriptor, AddAccessAllowedAce, InitializeAcl, GetLengthSid, AllocateAndInitializeSid, RegOpenKeyExW, CreateProcessAsUserW, DuplicateTokenEx, CloseServiceHandle, ControlService, StartServiceW, QueryServiceStatus, OpenServiceW, OpenSCManagerW, EqualSid, GetTokenInformation, RegSetValueExW, RegCreateKeyExW, CryptGenRandom, CryptDestroyHash, CryptVerifySignatureW, CryptSetHashParam, CryptGetHashParam, CryptHashData, CryptCreateHash, CryptDecrypt, ReportEventW, RegisterEventSourceW, CryptImportKey, CryptAcquireContextW, CryptReleaseContext, CryptDestroyKey, RegEnumValueW, RegQueryInfoKeyW, RegDeleteValueW, CredFree, CredDeleteW, CredEnumerateW, CopySid, GetSidLengthRequired, GetSidSubAuthority, GetSidSubAuthorityCount, GetUserNameW, OpenThreadToken, EnumServicesStatusW, ImpersonateLoggedOnUser, RegQueryValueExA, CheckTokenMembership, DeregisterEventSource, LsaGetUserName, RevertToSelf, LookupAccountSidW, IsValidSid, SetTokenInformation, LogonUserW, LookupAccountNameW, OpenProcessToken, SynchronizeWindows31FilesAndWindowsNTRegistry, QueryWindows31FilesMigration, AdjustTokenPrivileges, RegQueryInfoKeyA
> AUTHZ.dll: AuthzInitializeResourceManager, AuthzAccessCheck, AuthziFreeAuditEventType, AuthziInitializeAuditEvent, AuthziInitializeAuditParams, AuthziInitializeAuditEventType, AuthziLogAuditEvent, AuthzFreeAuditEvent, AuthzFreeResourceManager, AuthzFreeHandle
> CRYPT32.dll: CryptImportPublicKeyInfo, CryptVerifyMessageSignature, CertCreateCertificateContext, CertSetCertificateContextProperty, CertVerifyCertificateChainPolicy, CryptSignMessage, CertCloseStore, CertComparePublicKeyInfo, CryptExportPublicKeyInfo, CertFindExtension, CryptDecryptMessage, CertGetCertificateContextProperty, CertAddCertificateContextToStore, CertOpenStore, CertVerifySubjectCertificateContext, CertGetIssuerCertificateFromStore, CertDuplicateCertificateContext, CertFreeCertificateContext, CertEnumCertificatesInStore, CryptImportPublicKeyInfoEx
> GDI32.dll: RemoveFontResourceW, AddFontResourceW
> KERNEL32.dll: WTSGetActiveConsoleSessionId, GetTimeFormatW, GetUserDefaultLCID, FileTimeToSystemTime, FileTimeToLocalFileTime, GetProcAddress, LoadLibraryW, GetModuleHandleW, SystemTimeToFileTime, GetSystemTime, SetLastError, TerminateProcess, GetCurrentProcess, CreateTimerQueueTimer, CreateThread, lstrcpynW, GetShortPathNameW, GetProfileStringW, FreeLibrary, ReleaseSemaphore, CreateSemaphoreW, GetSystemInfo, GetComputerNameW, GetEnvironmentVariableW, WaitForSingleObjectEx, LoadResource, FindResourceW, SetThreadExecutionState, DeleteTimerQueueTimer, ResetEvent, GetSystemDirectoryW, TransactNamedPipe, SetNamedPipeHandleState, GetTickCount, CreateFileW, GlobalGetAtomNameW, VirtualLock, VirtualQuery, GetDriveTypeW, Beep, OpenMutexW, QueueUserWorkItem, LeaveCriticalSection, EnterCriticalSection, DisconnectNamedPipe, SearchPathW, lstrcatW, LocalReAlloc, ExpandEnvironmentStringsW, TerminateThread, ResumeThread, GetDiskFreeSpaceExW, GlobalMemoryStatusEx, DeleteFileW, WriteProfileStringW, ReadFile, FindVolumeClose, FindNextVolumeW, FindFirstVolumeW, FormatMessageW, SetPriorityClass, MoveFileExW, WaitForMultipleObjectsEx, GetExitCodeProcess, SleepEx, InterlockedExchange, FindClose, FindFirstFileW, GetWindowsDirectoryW, SetTimerQueueTimer, GetComputerNameA, GetVersionExW, VerSetConditionMask, WriteFile, WaitNamedPipeW, WaitForMultipleObjects, ConnectNamedPipe, DuplicateHandle, OpenProcess, GetOverlappedResult, GetVersionExA, lstrcmpW, SetEnvironmentVariableW, UnregisterWait, CreateNamedPipeW, CreateRemoteThread, CreateActCtxW, GetModuleFileNameW, ExitProcess, LoadLibraryExW, SetErrorMode, SetUnhandledExceptionFilter, GetPrivateProfileStringW, LocalSize, VirtualAlloc, VirtualQueryEx, DebugBreak, CreateFileA, InitializeCriticalSection, ProcessIdToSessionId, SetInformationJobObject, AssignProcessToJobObject, TerminateJobObject, PostQueuedCompletionStatus, PulseEvent, GetQueuedCompletionStatus, CreateIoCompletionPort, CreateJobObjectW, ActivateActCtx, DeactivateActCtx, InterlockedCompareExchange, LoadLibraryA, QueryPerformanceCounter, GetSystemTimeAsFileTime, UnhandledExceptionFilter, GetModuleHandleA, GetStartupInfoA, GetCurrentProcessId, SetThreadPriority, GetCurrentThreadId, lstrcmpiW, GetProfileIntW, LoadLibraryExA, lstrcpyW, lstrlenW, Sleep, LocalAlloc, CreateEventW, GetExitCodeThread, SetThreadAffinityMask, GetProcessAffinityMask, CreateWaitableTimerW, CreateMutexW, OpenEventW, RegisterWaitForSingleObject, WaitForSingleObject, CreateProcessW, SetWaitableTimer, ReleaseMutex, SetEvent, UnregisterWaitEx, CloseHandle, lstrlenA, lstrcpyA, MultiByteToWideChar, GetACP, WideCharToMultiByte, HeapAlloc, GetProcessHeap, HeapFree, lstrcpynA, UnmapViewOfFile, MapViewOfFile, CreateFileMappingW, lstrcmpiA, GetFileSize, SetFilePointer, GlobalAlloc, GlobalFree, GetLastError, LocalFree, lstrcatA, lstrcmpA, GetLogicalDriveStringsA, GetDriveTypeA, GetVolumeInformationW, GlobalMemoryStatus, CreateMutexA, FindResourceExW, LockResource, SizeofResource, VerifyVersionInfoW, GetSystemDirectoryA, GetCurrentThread, DelayLoadFailureHook, BaseInitAppcompatCacheSupport, OpenProfileUserMapping, CloseProfileUserMapping, BaseCleanupAppcompatCacheSupport, InitializeCriticalSectionAndSpinCount, VirtualProtect, CreateEventA, TlsSetValue, DeleteCriticalSection, TlsGetValue, TlsAlloc, VirtualFree, TlsFree
> msvcrt.dll: _vsnwprintf, wcslen, wcsncpy, wcsstr, atoi, wcstok, memmove, wcschr, swprintf, swscanf, _local_unwind2, _wcslwr, wcscmp, _snwprintf, malloc, _c_exit, _exit, _XcptFilter, _cexit, exit, _acmdln, __getmainargs, _initterm, __setusermatherr, _adjust_fdiv, __p__commode, __p__fmode, __3@YAXPAX@Z, __2@YAPAXI@Z, __CxxFrameHandler, _itow, _snprintf, _wtol, _strnicmp, sscanf, wcstombs, sprintf, strchr, strncmp, atof, _ftol, isspace, __set_app_type, wcscpy, _controlfp, wcsncmp, _wcsupr, ceil, wcscat, _except_handler3, free, _wcsicmp
> NDdeApi.dll: -, -, -, -
> ntdll.dll: RtlAllocateHeap, NtPowerInformation, NtSetSystemPowerState, NtRaiseHardError, RtlDeleteCriticalSection, NtOpenSymbolicLinkObject, NtReplyPort, NtCompleteConnectPort, NtReplyWaitReceivePort, NtAcceptConnectPort, NtCreatePort, RtlConvertSidToUnicodeString, RtlFreeUnicodeString, NtLockProductActivationKeys, RtlTimeToTimeFields, NtUnmapViewOfSection, NtMapViewOfSection, NtOpenSection, NtQuerySymbolicLinkObject, NtQueryVolumeInformationFile, NtSetSecurityObject, RtlAdjustPrivilege, NtOpenFile, NtFsControlFile, RtlAllocateAndInitializeSid, RtlDestroyEnvironment, RtlFreeHeap, NtQueryInformationToken, NtShutdownSystem, RtlEnterCriticalSection, RtlLeaveCriticalSection, RtlInitializeCriticalSection, RtlCreateEnvironment, RtlQueryEnvironmentVariable_U, RtlSetEnvironmentVariable, RtlInitUnicodeString, NtOpenKey, NtQueryValueKey, RtlSubAuthoritySid, RtlInitializeSid, RtlLengthRequiredSid, NtAllocateLocallyUniqueId, RtlGetDaclSecurityDescriptor, RtlCopySid, RtlLengthSid, NtSetInformationThread, NtDuplicateToken, NtDuplicateObject, RtlEqualSid, RtlSetDaclSecurityDescriptor, NtClose, RtlOpenCurrentUser, RtlCreateSecurityDescriptor, RtlAddAce, RtlCreateAcl, RtlNtStatusToDosError, NtOpenDirectoryObject, NtQuerySystemInformation, NtCreateEvent, NtCreatePagingFile, RtlDosPathNameToNtPathName_U, RtlRegisterWait, NtSetValueKey, NtCreateKey, RtlTimeToSecondsSince1980, NtQuerySystemTime, NtPrivilegeObjectAuditAlarm, NtPrivilegeCheck, NtOpenThreadToken, NtOpenProcessToken, RtlUnhandledExceptionFilter, NtQueryInformationProcess, DbgBreakPoint, RtlCheckProcessParameters, RtlSetThreadIsCritical, RtlSetProcessIsCritical, RtlInitString, NtInitiatePowerAction, DbgPrint, NtFilterToken, NtQueryInformationJobObject, NtOpenEvent, RtlGetAce, RtlQueryInformationAcl, NtQuerySecurityObject, RtlCompareUnicodeString, NtSetInformationProcess
> PROFMAP.dll: InitializeProfileMappingApi, RemapAndMoveUserW
> PSAPI.DLL: EnumProcesses, EnumProcessModules, GetModuleBaseNameW
> REGAPI.dll: RegDefaultUserConfigQueryW, RegUserConfigQuery
> RPCRT4.dll: RpcServerRegisterIfEx, RpcServerUseProtseqEpW, RpcImpersonateClient, I_RpcMapWin32Status, RpcServerRegisterIf, RpcGetAuthorizationContextForClient, RpcFreeAuthorizationContext, RpcServerListen, RpcRevertToSelf, NdrServerCall2, UuidCreate
> Secur32.dll: GetUserNameExW, LsaLookupAuthenticationPackage, LsaRegisterLogonProcess, LsaCallAuthenticationPackage
> SETUPAPI.dll: SetupDiDestroyDeviceInfoList, SetupDiEnumDeviceInfo, SetupDiGetClassDevsW, SetupDiGetDeviceRegistryPropertyW
> USER32.dll: SetFocus, EnumWindows, CreateWindowStationW, RegisterLogonProcess, RecordShutdownReason, LoadLocalFonts, UnhookWindowsHook, SetWindowsHookW, GetWindowTextW, CallNextHookEx, DialogBoxParamW, GetWindowPlacement, GetSystemMenu, DeleteMenu, SetWindowPlacement, SetUserObjectInformationW, GetAsyncKeyState, PostThreadMessageW, SetUserObjectSecurity, CreateDesktopW, KillTimer, GetMessageTime, SetLogonNotifyWindow, UnlockWindowStation, SetTimer, ReplyMessage, UnregisterHotKey, RegisterHotKey, OpenInputDesktop, GetUserObjectInformationW, CloseDesktop, RegisterDeviceNotificationW, SetThreadDesktop, CreateWindowExW, GetMessageW, TranslateMessage, RegisterWindowMessageW, SetCursor, DefWindowProcW, FindWindowW, MessageBoxW, SendNotifyMessageW, PostQuitMessage, MsgWaitForMultipleObjects, GetWindowRect, GetSystemMetrics, PeekMessageW, DispatchMessageW, SetProcessWindowStation, UpdateWindow, ShowWindow, SetWindowPos, PostMessageW, ExitWindowsEx, EnumDisplayMonitors, SystemParametersInfoW, GetDlgItem, SendMessageW, CreateDialogParamW, DestroyWindow, GetWindowLongW, GetDlgItemTextW, EndDialog, SetWindowLongW, LoadStringW, SetWindowTextW, SetDlgItemTextW, wsprintfW, wsprintfA, LockWindowStation, MBToWCSEx, SetWindowStationUser, UpdatePerUserSystemParameters, DialogBoxIndirectParamW, wvsprintfW, SetLastErrorEx, LoadCursorW, CheckDlgButton, IsDlgButtonChecked, RegisterClassW, CloseWindowStation, LoadImageW, GetParent, GetKeyState, GetDesktopWindow, SetForegroundWindow, SwitchDesktop, OpenDesktopW
> USERENV.dll: WaitForUserPolicyForegroundProcessing, GetAllUsersProfileDirectoryW, -, -, -, -, WaitForMachinePolicyForegroundProcessing, -, -, -, UnloadUserProfile, LoadUserProfileW, GetUserProfileDirectoryW, RegisterGPNotification, CreateEnvironmentBlock, DestroyEnvironmentBlock, UnregisterGPNotification, -
> VERSION.dll: GetFileVersionInfoSizeW, GetFileVersionInfoW, VerQueryValueW
> WINSTA.dll: WinStationRequestSessionsList, WinStationQueryLogonCredentialsW, WinStationIsHelpAssistantSession, WinStationAutoReconnect, _WinStationWaitForConnect, WinStationDisconnect, _WinStationCallback, WinStationNameFromLogonIdW, _WinStationFUSCanRemoteUserDisconnect, WinStationEnumerate_IndexedW, WinStationGetMachinePolicy, WinStationQueryInformationW, WinStationFreeMemory, WinStationReset, _WinStationNotifyDisconnectPipe, WinStationConnectW, WinStationSetInformationW, WinStationShutdownSystem, WinStationCheckLoopBack, _WinStationNotifyLogon, _WinStationNotifyLogoff
> WINTRUST.dll: CryptCATCatalogInfoFromContext, CryptCATAdminCalcHashFromFileHandle, CryptCATAdminAcquireContext, CryptCATAdminEnumCatalogFromHash, CryptCATAdminReleaseCatalogContext, WTHelperProvDataFromStateData, WinVerifyTrust, WTHelperGetProvSignerFromChain, CryptCATAdminReleaseContext
> WS2_32.dll: -, getaddrinfo, -

( 0 exports )
ThreatExpert info: <a href='http://www.threatexpert.com/report.aspx?md5=01c3346c241652f43aed8e2149881bfe' target='_blank'>http://www.threatexpert.com/report.aspx?md5=01c3346c241652f43aed8e2149881bfe</a>

--------------- Log File #2 ---------------

File winlogon.exe received on 12.05.2008 00:19:50 (CET)
Current status: Loading ... queued waiting scanning finished NOT FOUND STOPPED
Result: 0/37 (0%)
Loading server information...
Your file is queued in position: 1.
Estimated start time is between 38 and 55 seconds.
Do not close the window until scan is complete.
The scanner that was processing your file is stopped at this moment, we are going to wait a few seconds to try to recover your result.
If you are waiting for more than five minutes you have to resend your file.
Your file is being scanned by VirusTotal in this moment,
results will be shown as they're generated.
Compact Compact
Print results Print results
Your file has expired or does not exists.
Service is stopped in this moments, your file is waiting to be scanned (position: ) for an undefined time.

You can wait for web response (automatic reload) or type your email in the form below and click "request" so the system sends you a notification when the scan is finished.
Email:

Antivirus Version Last Update Result
AhnLab-V3 2008.12.5.0 2008.12.04 -
AntiVir 7.9.0.41 2008.12.04 -
Authentium 5.1.0.4 2008.12.04 -
Avast 4.8.1281.0 2008.12.04 -
AVG 8.0.0.199 2008.12.04 -
BitDefender 7.2 2008.12.05 -
CAT-QuickHeal 10.00 2008.12.04 -
ClamAV 0.94.1 2008.12.04 -
DrWeb 4.44.0.09170 2008.12.04 -
eSafe 7.0.17.0 2008.12.04 -
eTrust-Vet 31.6.6243 2008.12.04 -
Ewido 4.0 2008.12.04 -
F-Prot 4.4.4.56 2008.12.04 -
F-Secure 8.0.14332.0 2008.12.04 -
Fortinet 3.117.0.0 2008.12.04 -
GData 19 2008.12.05 -
Ikarus T3.1.1.45.0 2008.12.04 -
K7AntiVirus 7.10.543 2008.12.04 -
Kaspersky 7.0.0.125 2008.12.04 -
McAfee 5454 2008.12.04 -
McAfee+Artemis 5454 2008.12.04 -
Microsoft 1.4205 2008.12.05 -
NOD32 3665 2008.12.04 -
Norman 5.80.02 2008.12.04 -
Panda 9.0.0.4 2008.12.04 -
PCTools 4.4.2.0 2008.12.04 -
Prevx1 V2 2008.12.05 -
Rising 21.06.32.00 2008.12.04 -
SecureWeb-Gateway 6.7.6 2008.12.04 -
Sophos 4.36.0 2008.12.05 -
Sunbelt 3.1.1832.2 2008.12.01 -
Symantec 10 2008.12.05 -
TheHacker 6.3.1.2.175 2008.12.04 -
TrendMicro 8.700.0.1004 2008.12.04 -
VBA32 3.12.8.10 2008.12.03 -
ViRobot 2008.12.4.1500 2008.12.04 -
VirusBuster 4.5.11.0 2008.12.04 -
Additional information
File size: 502272 bytes
MD5...: 01c3346c241652f43aed8e2149881bfe
SHA1..: a5396141cab8b22d9d88b28a814089537dce366a
SHA256: affd0973cd3128083417d407f62bc4a635fc25b65dbf52e91d3ab4ae2f9c1b4a
SHA512: c2b4a1fe29b84b0dfd062de79db83ef85ecb238184957649512a951e5abed874
776f0b7c128cb33cd7cbb540d68ecac3a5ab09291fccecb64660b1a874e44090
ssdeep: 6144:2YuZlm8LRlBw662R1pqrc7FmxSqVw/T+SN1TrSnmhPnpdcrFIzdFz/N5Wjy
fTNQG:2VLBhic7Qy1vSneJFDNhp8
PEiD..: -
TrID..: File type identification
Win64 Executable Generic (80.9%)
Win32 Executable Generic (8.0%)
Win32 Dynamic Link Library (generic) (7.1%)
Generic Win/DOS Executable (1.8%)
DOS Executable Generic (1.8%)
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x103d353
timedatestamp.....: 0x41107edc (Wed Aug 04 06:14:52 2004)
machinetype.......: 0x14c (I386)

( 3 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x6f288 0x6f400 6.82 5a133ab60f38b5d739d86c8290fa5a3c
.data 0x71000 0x4d90 0x2000 6.20 baa64d00a5f8a540a38a60d2aff66f30
.rsrc 0x76000 0x9030 0x9200 3.62 b93cbbc049130e1bad3ea13d7512c074

( 20 imports )
> ADVAPI32.dll: ConvertStringSecurityDescriptorToSecurityDescriptorA, A_SHAInit, A_SHAUpdate, A_SHAFinal, LsaStorePrivateData, LsaRetrievePrivateData, LsaNtStatusToWinError, CryptGetUserKey, CryptGetKeyParam, CryptEncrypt, CryptSetProvParam, CryptSignHashW, CryptDeriveKey, CryptGetProvParam, RegOpenCurrentUser, RegDeleteKeyW, AddAccessAllowedAceEx, RegSetKeySecurity, I_ScSendTSMessage, MD5Init, MD5Update, MD5Final, SetFileSecurityA, AllocateLocallyUniqueId, LsaOpenPolicy, LsaQueryInformationPolicy, LsaFreeMemory, LsaClose, RegNotifyChangeKeyValue, QueryServiceConfigW, SetKernelObjectSecurity, ConvertStringSecurityDescriptorToSecurityDescriptorW, RegEnumKeyExW, GetCurrentHwProfileW, RegCloseKey, RegQueryValueExW, RegOpenKeyW, FreeSid, SetSecurityDescriptorDacl, InitializeSecurityDescriptor, AddAccessAllowedAce, InitializeAcl, GetLengthSid, AllocateAndInitializeSid, RegOpenKeyExW, CreateProcessAsUserW, DuplicateTokenEx, CloseServiceHandle, ControlService, StartServiceW, QueryServiceStatus, OpenServiceW, OpenSCManagerW, EqualSid, GetTokenInformation, RegSetValueExW, RegCreateKeyExW, CryptGenRandom, CryptDestroyHash, CryptVerifySignatureW, CryptSetHashParam, CryptGetHashParam, CryptHashData, CryptCreateHash, CryptDecrypt, ReportEventW, RegisterEventSourceW, CryptImportKey, CryptAcquireContextW, CryptReleaseContext, CryptDestroyKey, RegEnumValueW, RegQueryInfoKeyW, RegDeleteValueW, CredFree, CredDeleteW, CredEnumerateW, CopySid, GetSidLengthRequired, GetSidSubAuthority, GetSidSubAuthorityCount, GetUserNameW, OpenThreadToken, EnumServicesStatusW, ImpersonateLoggedOnUser, RegQueryValueExA, CheckTokenMembership, DeregisterEventSource, LsaGetUserName, RevertToSelf, LookupAccountSidW, IsValidSid, SetTokenInformation, LogonUserW, LookupAccountNameW, OpenProcessToken, SynchronizeWindows31FilesAndWindowsNTRegistry, QueryWindows31FilesMigration, AdjustTokenPrivileges, RegQueryInfoKeyA
> AUTHZ.dll: AuthzInitializeResourceManager, AuthzAccessCheck, AuthziFreeAuditEventType, AuthziInitializeAuditEvent, AuthziInitializeAuditParams, AuthziInitializeAuditEventType, AuthziLogAuditEvent, AuthzFreeAuditEvent, AuthzFreeResourceManager, AuthzFreeHandle
> CRYPT32.dll: CryptImportPublicKeyInfo, CryptVerifyMessageSignature, CertCreateCertificateContext, CertSetCertificateContextProperty, CertVerifyCertificateChainPolicy, CryptSignMessage, CertCloseStore, CertComparePublicKeyInfo, CryptExportPublicKeyInfo, CertFindExtension, CryptDecryptMessage, CertGetCertificateContextProperty, CertAddCertificateContextToStore, CertOpenStore, CertVerifySubjectCertificateContext, CertGetIssuerCertificateFromStore, CertDuplicateCertificateContext, CertFreeCertificateContext, CertEnumCertificatesInStore, CryptImportPublicKeyInfoEx
> GDI32.dll: RemoveFontResourceW, AddFontResourceW
> KERNEL32.dll: WTSGetActiveConsoleSessionId, GetTimeFormatW, GetUserDefaultLCID, FileTimeToSystemTime, FileTimeToLocalFileTime, GetProcAddress, LoadLibraryW, GetModuleHandleW, SystemTimeToFileTime, GetSystemTime, SetLastError, TerminateProcess, GetCurrentProcess, CreateTimerQueueTimer, CreateThread, lstrcpynW, GetShortPathNameW, GetProfileStringW, FreeLibrary, ReleaseSemaphore, CreateSemaphoreW, GetSystemInfo, GetComputerNameW, GetEnvironmentVariableW, WaitForSingleObjectEx, LoadResource, FindResourceW, SetThreadExecutionState, DeleteTimerQueueTimer, ResetEvent, GetSystemDirectoryW, TransactNamedPipe, SetNamedPipeHandleState, GetTickCount, CreateFileW, GlobalGetAtomNameW, VirtualLock, VirtualQuery, GetDriveTypeW, Beep, OpenMutexW, QueueUserWorkItem, LeaveCriticalSection, EnterCriticalSection, DisconnectNamedPipe, SearchPathW, lstrcatW, LocalReAlloc, ExpandEnvironmentStringsW, TerminateThread, ResumeThread, GetDiskFreeSpaceExW, GlobalMemoryStatusEx, DeleteFileW, WriteProfileStringW, ReadFile, FindVolumeClose, FindNextVolumeW, FindFirstVolumeW, FormatMessageW, SetPriorityClass, MoveFileExW, WaitForMultipleObjectsEx, GetExitCodeProcess, SleepEx, InterlockedExchange, FindClose, FindFirstFileW, GetWindowsDirectoryW, SetTimerQueueTimer, GetComputerNameA, GetVersionExW, VerSetConditionMask, WriteFile, WaitNamedPipeW, WaitForMultipleObjects, ConnectNamedPipe, DuplicateHandle, OpenProcess, GetOverlappedResult, GetVersionExA, lstrcmpW, SetEnvironmentVariableW, UnregisterWait, CreateNamedPipeW, CreateRemoteThread, CreateActCtxW, GetModuleFileNameW, ExitProcess, LoadLibraryExW, SetErrorMode, SetUnhandledExceptionFilter, GetPrivateProfileStringW, LocalSize, VirtualAlloc, VirtualQueryEx, DebugBreak, CreateFileA, InitializeCriticalSection, ProcessIdToSessionId, SetInformationJobObject, AssignProcessToJobObject, TerminateJobObject, PostQueuedCompletionStatus, PulseEvent, GetQueuedCompletionStatus, CreateIoCompletionPort, CreateJobObjectW, ActivateActCtx, DeactivateActCtx, InterlockedCompareExchange, LoadLibraryA, QueryPerformanceCounter, GetSystemTimeAsFileTime, UnhandledExceptionFilter, GetModuleHandleA, GetStartupInfoA, GetCurrentProcessId, SetThreadPriority, GetCurrentThreadId, lstrcmpiW, GetProfileIntW, LoadLibraryExA, lstrcpyW, lstrlenW, Sleep, LocalAlloc, CreateEventW, GetExitCodeThread, SetThreadAffinityMask, GetProcessAffinityMask, CreateWaitableTimerW, CreateMutexW, OpenEventW, RegisterWaitForSingleObject, WaitForSingleObject, CreateProcessW, SetWaitableTimer, ReleaseMutex, SetEvent, UnregisterWaitEx, CloseHandle, lstrlenA, lstrcpyA, MultiByteToWideChar, GetACP, WideCharToMultiByte, HeapAlloc, GetProcessHeap, HeapFree, lstrcpynA, UnmapViewOfFile, MapViewOfFile, CreateFileMappingW, lstrcmpiA, GetFileSize, SetFilePointer, GlobalAlloc, GlobalFree, GetLastError, LocalFree, lstrcatA, lstrcmpA, GetLogicalDriveStringsA, GetDriveTypeA, GetVolumeInformationW, GlobalMemoryStatus, CreateMutexA, FindResourceExW, LockResource, SizeofResource, VerifyVersionInfoW, GetSystemDirectoryA, GetCurrentThread, DelayLoadFailureHook, BaseInitAppcompatCacheSupport, OpenProfileUserMapping, CloseProfileUserMapping, BaseCleanupAppcompatCacheSupport, InitializeCriticalSectionAndSpinCount, VirtualProtect, CreateEventA, TlsSetValue, DeleteCriticalSection, TlsGetValue, TlsAlloc, VirtualFree, TlsFree
> msvcrt.dll: _vsnwprintf, wcslen, wcsncpy, wcsstr, atoi, wcstok, memmove, wcschr, swprintf, swscanf, _local_unwind2, _wcslwr, wcscmp, _snwprintf, malloc, _c_exit, _exit, _XcptFilter, _cexit, exit, _acmdln, __getmainargs, _initterm, __setusermatherr, _adjust_fdiv, __p__commode, __p__fmode, __3@YAXPAX@Z, __2@YAPAXI@Z, __CxxFrameHandler, _itow, _snprintf, _wtol, _strnicmp, sscanf, wcstombs, sprintf, strchr, strncmp, atof, _ftol, isspace, __set_app_type, wcscpy, _controlfp, wcsncmp, _wcsupr, ceil, wcscat, _except_handler3, free, _wcsicmp
> NDdeApi.dll: -, -, -, -
> ntdll.dll: RtlAllocateHeap, NtPowerInformation, NtSetSystemPowerState, NtRaiseHardError, RtlDeleteCriticalSection, NtOpenSymbolicLinkObject, NtReplyPort, NtCompleteConnectPort, NtReplyWaitReceivePort, NtAcceptConnectPort, NtCreatePort, RtlConvertSidToUnicodeString, RtlFreeUnicodeString, NtLockProductActivationKeys, RtlTimeToTimeFields, NtUnmapViewOfSection, NtMapViewOfSection, NtOpenSection, NtQuerySymbolicLinkObject, NtQueryVolumeInformationFile, NtSetSecurityObject, RtlAdjustPrivilege, NtOpenFile, NtFsControlFile, RtlAllocateAndInitializeSid, RtlDestroyEnvironment, RtlFreeHeap, NtQueryInformationToken, NtShutdownSystem, RtlEnterCriticalSection, RtlLeaveCriticalSection, RtlInitializeCriticalSection, RtlCreateEnvironment, RtlQueryEnvironmentVariable_U, RtlSetEnvironmentVariable, RtlInitUnicodeString, NtOpenKey, NtQueryValueKey, RtlSubAuthoritySid, RtlInitializeSid, RtlLengthRequiredSid, NtAllocateLocallyUniqueId, RtlGetDaclSecurityDescriptor, RtlCopySid, RtlLengthSid, NtSetInformationThread, NtDuplicateToken, NtDuplicateObject, RtlEqualSid, RtlSetDaclSecurityDescriptor, NtClose, RtlOpenCurrentUser, RtlCreateSecurityDescriptor, RtlAddAce, RtlCreateAcl, RtlNtStatusToDosError, NtOpenDirectoryObject, NtQuerySystemInformation, NtCreateEvent, NtCreatePagingFile, RtlDosPathNameToNtPathName_U, RtlRegisterWait, NtSetValueKey, NtCreateKey, RtlTimeToSecondsSince1980, NtQuerySystemTime, NtPrivilegeObjectAuditAlarm, NtPrivilegeCheck, NtOpenThreadToken, NtOpenProcessToken, RtlUnhandledExceptionFilter, NtQueryInformationProcess, DbgBreakPoint, RtlCheckProcessParameters, RtlSetThreadIsCritical, RtlSetProcessIsCritical, RtlInitString, NtInitiatePowerAction, DbgPrint, NtFilterToken, NtQueryInformationJobObject, NtOpenEvent, RtlGetAce, RtlQueryInformationAcl, NtQuerySecurityObject, RtlCompareUnicodeString, NtSetInformationProcess
> PROFMAP.dll: InitializeProfileMappingApi, RemapAndMoveUserW
> PSAPI.DLL: EnumProcesses, EnumProcessModules, GetModuleBaseNameW
> REGAPI.dll: RegDefaultUserConfigQueryW, RegUserConfigQuery
> RPCRT4.dll: RpcServerRegisterIfEx, RpcServerUseProtseqEpW, RpcImpersonateClient, I_RpcMapWin32Status, RpcServerRegisterIf, RpcGetAuthorizationContextForClient, RpcFreeAuthorizationContext, RpcServerListen, RpcRevertToSelf, NdrServerCall2, UuidCreate
> Secur32.dll: GetUserNameExW, LsaLookupAuthenticationPackage, LsaRegisterLogonProcess, LsaCallAuthenticationPackage
> SETUPAPI.dll: SetupDiDestroyDeviceInfoList, SetupDiEnumDeviceInfo, SetupDiGetClassDevsW, SetupDiGetDeviceRegistryPropertyW
> USER32.dll: SetFocus, EnumWindows, CreateWindowStationW, RegisterLogonProcess, RecordShutdownReason, LoadLocalFonts, UnhookWindowsHook, SetWindowsHookW, GetWindowTextW, CallNextHookEx, DialogBoxParamW, GetWindowPlacement, GetSystemMenu, DeleteMenu, SetWindowPlacement, SetUserObjectInformationW, GetAsyncKeyState, PostThreadMessageW, SetUserObjectSecurity, CreateDesktopW, KillTimer, GetMessageTime, SetLogonNotifyWindow, UnlockWindowStation, SetTimer, ReplyMessage, UnregisterHotKey, RegisterHotKey, OpenInputDesktop, GetUserObjectInformationW, CloseDesktop, RegisterDeviceNotificationW, SetThreadDesktop, CreateWindowExW, GetMessageW, TranslateMessage, RegisterWindowMessageW, SetCursor, DefWindowProcW, FindWindowW, MessageBoxW, SendNotifyMessageW, PostQuitMessage, MsgWaitForMultipleObjects, GetWindowRect, GetSystemMetrics, PeekMessageW, DispatchMessageW, SetProcessWindowStation, UpdateWindow, ShowWindow, SetWindowPos, PostMessageW, ExitWindowsEx, EnumDisplayMonitors, SystemParametersInfoW, GetDlgItem, SendMessageW, CreateDialogParamW, DestroyWindow, GetWindowLongW, GetDlgItemTextW, EndDialog, SetWindowLongW, LoadStringW, SetWindowTextW, SetDlgItemTextW, wsprintfW, wsprintfA, LockWindowStation, MBToWCSEx, SetWindowStationUser, UpdatePerUserSystemParameters, DialogBoxIndirectParamW, wvsprintfW, SetLastErrorEx, LoadCursorW, CheckDlgButton, IsDlgButtonChecked, RegisterClassW, CloseWindowStation, LoadImageW, GetParent, GetKeyState, GetDesktopWindow, SetForegroundWindow, SwitchDesktop, OpenDesktopW
> USERENV.dll: WaitForUserPolicyForegroundProcessing, GetAllUsersProfileDirectoryW, -, -, -, -, WaitForMachinePolicyForegroundProcessing, -, -, -, UnloadUserProfile, LoadUserProfileW, GetUserProfileDirectoryW, RegisterGPNotification, CreateEnvironmentBlock, DestroyEnvironmentBlock, UnregisterGPNotification, -
> VERSION.dll: GetFileVersionInfoSizeW, GetFileVersionInfoW, VerQueryValueW
> WINSTA.dll: WinStationRequestSessionsList, WinStationQueryLogonCredentialsW, WinStationIsHelpAssistantSession, WinStationAutoReconnect, _WinStationWaitForConnect, WinStationDisconnect, _WinStationCallback, WinStationNameFromLogonIdW, _WinStationFUSCanRemoteUserDisconnect, WinStationEnumerate_IndexedW, WinStationGetMachinePolicy, WinStationQueryInformationW, WinStationFreeMemory, WinStationReset, _WinStationNotifyDisconnectPipe, WinStationConnectW, WinStationSetInformationW, WinStationShutdownSystem, WinStationCheckLoopBack, _WinStationNotifyLogon, _WinStationNotifyLogoff
> WINTRUST.dll: CryptCATCatalogInfoFromContext, CryptCATAdminCalcHashFromFileHandle, CryptCATAdminAcquireContext, CryptCATAdminEnumCatalogFromHash, CryptCATAdminReleaseCatalogContext, WTHelperProvDataFromStateData, WinVerifyTrust, WTHelperGetProvSignerFromChain, CryptCATAdminReleaseContext
> WS2_32.dll: -, getaddrinfo, -

( 0 exports )
ThreatExpert info: <a href='http://www.threatexpert.com/report.aspx?md5=01c3346c241652f43aed8e2149881bfe' target='_blank'>http://www.threatexpert.com/report.aspx?md5=01c3346c241652f43aed8e2149881bfe</a>

**chemist** · 12-04-2008, 05:00 PM

Hello again, Wheezy. Please tell us how your machine is behaving.

Please copy this page to Notepad and Save it to your Desktop in order to assist you when carrying out the following instructions.

Before beginning the fix, read this post completely. If there's anything that you do not understand, kindly ask your questions before proceeding.
Ensure that there aren't any opened browsers when you are carrying out the procedures below.

It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence.

------------------------------------------------------

Close any open browsers.

Disable your antivirus and antispyware applications, usually via a right-click on the System Tray icon. They may otherwise interfere with ComboFix.

Open Notepad and copy/paste all the text in the quotebox below into Notepad:

Quote:

FCopy::
C:\WINDOWS\system32\dllcache\winlogon.exe | C:\WINDOWS\system32\winlogon.exe

Save this Notepad file as CFScript.txt to your Desktop and then close the file.

Referring to the picture above, drag CFScript onto ComboFix

If you are prompted to update ComboFix, please click Yes

Your desktop may go blank. This is normal. It will return when ComboFix is done. ComboFix may reboot your machine. This is normal.

When finished, it shall produce a log for you. Please post that log, ComboFix.txt in your next reply.

Note:
Do not mouseclick ComboFix's window whilst it's running. That may cause it to stall.

------------------------------------------------------

Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system.
Please follow these steps to remove older version Java components and update.

Download the latest version of Java Runtime Environment (JRE) 6 Update 11 and Save it to your Desktop.
Scroll down to where it says Java Runtime Environment (JRE) 6 Update 11 The Java SE Runtime Environment (JRE) allows end-users to run Java applications.
Click the Download button to the right.
Select the Windows platform from the dropdown menu.
Read the License Agreement and then check the box that says: I agree to the Java SE Runtime Environment 6 License Agreement.
Click Continue
Click on the link to download Windows Offline Installation and Save the file to your Desktop.
Close any programs you may have running - especially your web browser.
Go to Start(or My Computer) > Control Panel and click on Add or Remove Programs
Click (highlight) any item with Java Runtime Environment (JRE, J2SE, Java(TM) SE or Java(TM) 6) in the name.
Click the Remove or Change/Remove button.
Repeat as many times as necessary to remove each Java version.
Reboot your computer once all Java components are removed.
Then from your desktop double-click on jre-6u11-windows-i586-p.exe to install the newest version.

After the install is complete, go back to your Control Panel and click the Java icon. (looks like a coffee cup)
- On the General tab, under Temporary Internet Files, click the Settings button.
- Next, click on the Delete Files button.
- There are two options in the window to clear the cache - Leave BOTH Checked
  - Applications and Applets
  - Trace and Log Files
- Click OK on Delete Temporary Files Window.
  Note: This deletes ALL the Downloaded Applications and Applets from the CACHE
- Click OK to leave the Temporary Files Window.
- Click OK to leave the Java Control Panel.
- Delete jre-6u11-windows-i586-p.exe from your desktop.

------------------------------------------------------

Please download ATF-Cleaner by Atribune and Save it to your Desktop.

Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.

If you use Firefox browser

Click Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.

If you use Opera browser

Click Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.

Click Exit on the Main menu to close the program.
For Technical Support, double-click the e-mail address located at the bottom of each menu.

------------------------------------------------------

Please run this online scan to help look for remnants.

Ensure your external and/or USB drives are inserted during the scan.

Establish an internet connection & perform an online scan with Internet Explorer at Kaspersky Online Scanner

Click Accept, when prompted to download and install the program files and database of malware definitions.

Click Run at any Security prompt.
The program will then begin downloading and installing and will also update the database.
Please be patient as this can take several minutes.
Once the update is complete, click on My Computer under the green Scan bar to the left to start the scan.
Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
Do NOT be alarmed by what you see in the report. Many of the finds have likely been quarantined.
Click View scan report at the bottom.
Click the Save Report As... button.
Click the Save as Text button to save the file to your desktop so that you may post it in your next reply.

**Note**

To optimize scanning time and produce a more sensible report for review:

Close any open programs.
Turn off the real-time scanner of all antivirus or antispyware programs while performing the online scan.

Note for Internet Explorer 7 users: If at any time you have trouble viewing the accept button of the license, click on the Zoom tool located at the bottom right of the IE window and set the zoom to 75%. Once the license is accepted, reset to 100%.

------------------------------------------------------
Please post the following in your next reply:

ComboFix.txt
Kaspersky report
report on system behavior

Wheezy · 12-04-2008, 08:29 PM

I was able to complete all of the steps outlined. A short time after reading your post, chemist, my anti-virus produced a pop-up stating that a "backdoor trajan" was detected. I haven't had any noticeable interference (besides that one alert pop-up), but I haven't done much on my computer during the scan. I didn't want to compromise then scan or slow it down.

Below are the logs from ComboFix and the online scan.

--------------- ComboFix Log ---------------

ComboFix 08-12-04.04 - Shellie Waters 2008-12-04 19:08:28.12 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.736 [GMT -6:00]
Running from: c:\documents and settings\Shellie Waters\Desktop\Combo-Fix.exe
Command switches used :: c:\documents and settings\Shellie Waters\Desktop\CFScript.txt
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

.
--------------- FCopy ---------------

c:\windows\system32\dllcache\winlogon.exe --> c:\windows\system32\winlogon.exe
.
((((((((((((((((((((((((( Files Created from 2008-11-05 to 2008-12-05 )))))))))))))))))))))))))))))))
.

2008-11-30 20:18 . 2008-12-04 18:42 <DIR> d--h----- C:\$AVG8.VAULT$
2008-11-24 18:07 . 2008-11-24 18:07 <DIR> d-------- c:\program files\muvee Technologies
2008-11-24 18:07 . 2008-11-24 18:07 <DIR> d-------- c:\program files\Common Files\muvee Technologies
2008-11-24 18:07 . 2008-11-24 18:07 <DIR> d-------- c:\program files\3ivx
2008-11-24 18:06 . 2004-08-03 23:08 26,496 --a------ c:\windows\system32\dllcache\usbstor.sys
2008-11-20 16:12 . 2008-11-30 14:54 <DIR> d-------- c:\windows\system32\drivers\Avg
2008-11-20 16:12 . 2008-11-20 16:12 <DIR> d-------- c:\program files\AVG
2008-11-20 16:12 . 2008-11-30 20:18 <DIR> d-------- c:\documents and settings\All Users\Application Data\avg8
2008-11-20 16:12 . 2008-11-20 16:12 97,928 --a------ c:\windows\system32\drivers\avgldx86.sys
2008-11-20 16:12 . 2008-11-20 16:12 76,040 --a------ c:\windows\system32\drivers\avgtdix.sys
2008-11-20 16:12 . 2008-11-20 16:12 10,520 --a------ c:\windows\system32\avgrsstx.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-12-02 20:29 --------- d---a-w c:\documents and settings\All Users\Application Data\TEMP
2008-12-01 02:08 295,424 ----a-w c:\windows\system32\termsrv.dll
2008-11-25 00:07 --------- d--h--w c:\program files\InstallShield Installation Information
2008-11-25 00:07 --------- d-----w c:\program files\QTComponents
2008-10-24 11:10 453,632 ----a-w c:\windows\system32\drivers\mrxsmb.sys
2008-10-24 11:10 453,632 ------w c:\windows\system32\dllcache\mrxsmb.sys
2008-10-17 05:08 --------- d-----w c:\documents and settings\Shellie Waters\Application Data\SPORE
2008-10-16 20:13 202,776 ----a-w c:\windows\system32\wuweb.dll
2008-10-16 20:13 202,776 ----a-w c:\windows\system32\dllcache\wuweb.dll
2008-10-16 20:13 1,809,944 ----a-w c:\windows\system32\wuaueng.dll
2008-10-16 20:13 1,809,944 ----a-w c:\windows\system32\dllcache\wuaueng.dll
2008-10-16 20:12 561,688 ----a-w c:\windows\system32\wuapi.dll
2008-10-16 20:12 561,688 ----a-w c:\windows\system32\dllcache\wuapi.dll
2008-10-16 20:12 323,608 ----a-w c:\windows\system32\wucltui.dll
2008-10-16 20:12 323,608 ----a-w c:\windows\system32\dllcache\wucltui.dll
2008-10-16 20:09 92,696 ----a-w c:\windows\system32\dllcache\cdm.dll
2008-10-16 20:09 92,696 ----a-w c:\windows\system32\cdm.dll
2008-10-16 20:09 51,224 ----a-w c:\windows\system32\wuauclt.exe
2008-10-16 20:09 51,224 ----a-w c:\windows\system32\dllcache\wuauclt.exe
2008-10-16 20:09 43,544 ----a-w c:\windows\system32\wups2.dll
2008-10-16 20:08 34,328 ----a-w c:\windows\system32\wups.dll
2008-10-16 20:08 34,328 ----a-w c:\windows\system32\dllcache\wups.dll
2008-10-16 20:06 268,648 ----a-w c:\windows\system32\mucltui.dll
2008-10-16 20:06 208,744 ----a-w c:\windows\system32\muweb.dll
2008-10-15 16:57 332,800 ------w c:\windows\system32\dllcache\netapi32.dll
2008-10-08 03:52 --------- d-----w c:\program files\TheSimsResource
2008-10-07 23:20 --------- d-----w c:\program files\SimPE
2008-09-15 11:57 1,846,016 ----a-w c:\windows\system32\win32k.sys
2008-09-15 11:57 1,846,016 ------w c:\windows\system32\dllcache\win32k.sys
2008-09-07 17:16 7,086 -c--a-w c:\windows\system32\ealregsnapshot1.reg
2008-01-15 07:49 1,498 ----a-w c:\program files\Calculator.lnk
2007-06-29 11:25 8,612 -c--a-w c:\program files\QuickTime Read Me.htm
2007-06-29 11:25 749,568 -c--a-w c:\program files\QTOControl.dll
2007-06-29 11:25 684,032 -c--a-w c:\program files\QTOLibrary.dll
2007-06-29 11:25 618,496 -c--a-w c:\program files\QTInfo.exe
2007-06-29 11:25 6,124,864 ----a-w c:\program files\QuickTimePlayer.exe
2007-06-29 11:25 574,784 -c--a-w c:\program files\QTPlugin.ocx
2007-06-29 11:25 303,104 -c--a-w c:\program files\QTUIPanelControl.dll
2007-06-29 11:24 55,622 -c--a-w c:\program files\Sample.mov
2007-06-29 11:24 483,328 -c--a-w c:\program files\PictureViewer.exe
2007-06-29 11:24 286,720 ----a-w c:\program files\QTTask.exe
2007-06-29 11:24 18,663 -c--a-w c:\program files\Sample.qtif
2006-10-21 21:54 152 --sh--r c:\windows\system32\11D43EA203.sys
2006-10-21 21:54 7,520 -csha-w c:\windows\system32\KGyGaAvL.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"EA Core"="c:\program files\Electronic Arts\EADM\Core.exe" [2008-07-21 2752512]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"QuickTime Task"="c:\program files\qttask.exe" [2007-06-29 286720]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2007-09-27 185632]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_06\bin\jusched.exe" [2008-03-25 144784]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2008-11-27 1261336]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.3IV2"= 3ivxVfWCodec_dec.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Gamma Loader.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk
backup=c:\windows\pss\Adobe Gamma Loader.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Digital Line Detect.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Digital Line Detect.lnk
backup=c:\windows\pss\Digital Line Detect.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DLA]
--a--c--- 2005-09-08 04:20 122940 c:\windows\system32\DLA\DLACTRLW.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DMXLauncher]
--a--c--- 2005-10-05 02:12 94208 c:\program files\Dell\Media Experience\DMXLauncher.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ehTray]
--a--c--- 2005-09-29 13:01 67584 c:\windows\ehome\ehtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Desktop Search]
--a------ 2006-04-11 02:07 169472 c:\program files\Google\Google Desktop Search\GoogleDesktop.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IAAnotif]
--a--c--- 2005-06-17 06:56 139264 c:\program files\Intel\Intel Matrix Storage Manager\IAAnotif.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup]
--a--c--- 2005-06-10 09:44 249856 c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]
--a--c--- 2005-06-10 09:44 81920 c:\program files\Common Files\InstallShield\UpdateService\issch.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
--a------ 2007-10-04 17:14 8491008 c:\windows\system32\nvcpl.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
--a--c--- 2007-10-04 17:14 81920 c:\windows\system32\nvmctray.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2007-06-29 05:24 286720 c:\program files\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
--a------ 2007-09-27 17:02 185632 c:\program files\Common Files\Real\Update_OB\realsched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
--a--c--- 2007-10-04 17:14 1626112 c:\windows\system32\nwiz.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SigmatelSysTrayApp]
--a--c--- 2005-03-22 22:20 339968 c:\windows\stsystra.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"usnjsvc"=3 (0x3)
"tmproxy"=3 (0x3)
"TmPfw"=3 (0x3)
"TMBMServer"=2 (0x2)
"SfCtlCom"=2 (0x2)
"ose"=3 (0x3)
"NVSvc"=2 (0x2)
"NetSvc"=3 (0x3)
"MDM"=2 (0x2)
"KService"=2 (0x2)
"IAANTMon"=2 (0x2)
"ELService"=2 (0x2)

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\TrendAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\TrendFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\AVG\\AVG8\\avgemc.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\Drivers\avgldx86.sys [2008-11-20 97928]
R2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [2008-11-20 875288]
R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2008-11-20 231704]
R2 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\Drivers\avgtdix.sys [2008-11-20 76040]
R2 tmevtmgr;tmevtmgr;\??\c:\windows\system32\drivers\tmevtmgr.sys [2007-10-15 52368]
R2 tmpreflt;tmpreflt;c:\windows\system32\DRIVERS\tmpreflt.sys [2007-09-17 36112]
R3 tmcfw;Trend Micro Common Firewall Service;c:\windows\system32\DRIVERS\TM_CFW.sys [2007-09-17 333328]
S3 SaiH8000;SaiH8000;c:\windows\system32\DRIVERS\SaiH8000.sys [2004-07-30 56576]
S4 TmPfw;Trend Micro Personal Firewall;c:\progra~1\TRENDM~1\INTERN~2\TmPfw.exe [2007-10-15 480520]
S4 tmproxy;Trend Micro Proxy Service;"c:\program files\Trend Micro\Internet Security\TmProxy.exe" [2007-10-15 648456]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{361ac05d-0e0d-11da-9aa9-806d6172696f}]
\Shell\AutoRun\command - E:\setup.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e9d77a1a-b838-11dd-8c02-0013721253cd}]
\Shell\AutoRun\command - e:\system\viewer\FlipVideoforPC.exe
\Shell\Flip Video for PC\command - e:\system\viewer\FlipVideoforPC.exe
.
Contents of the 'Scheduled Tasks' folder

2008-03-20 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-06-03 12:42]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://minnesota.twins.mlb.com/index.jsp?c_id=min
uInternet Connection Wizard,ShellNext = hxxp://www.google.com/ig/dell?hl=en&client=dell-inc&channel=us
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
FireFox -: Profile - c:\documents and settings\Shellie Waters\Application Data\Mozilla\Firefox\Profiles\kuae1v1r.default\
FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://forums.sims2community.com/index.php
FF -: plugin - c:\program files\Adobe\Acrobat 6.0\Reader\browser\nppdf32.dll
FF -: plugin - c:\program files\Plugins\npqtplugin.dll
FF -: plugin - c:\program files\Plugins\npqtplugin2.dll
FF -: plugin - c:\program files\Plugins\npqtplugin3.dll
FF -: plugin - c:\program files\Plugins\npqtplugin4.dll
FF -: plugin - c:\program files\Plugins\npqtplugin5.dll
FF -: plugin - c:\program files\Plugins\npqtplugin6.dll
FF -: plugin - c:\program files\Plugins\npqtplugin7.dll
FF -: plugin - c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-12-04 19:09:55
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-12-04 19:10:48
ComboFix-quarantined-files.txt 2008-12-05 01:10:43
ComboFix2.txt 2008-12-04 22:11:30
ComboFix3.txt 2008-05-15 04:31:37

Pre-Run: 82,296,320,000 bytes free
Post-Run: 82,280,804,352 bytes free

196 --- E O F --- 2008-12-03 11:12:07

--------------- Kapersky Online Scan Log ---------------

--------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER 7 REPORT
Thursday, December 4, 2008
Operating System: Microsoft Windows XP Professional Service Pack 2 (build 2600)
Kaspersky Online Scanner 7 version: 7.0.25.0
Program database last update: Thursday, December 04, 2008 20:42:50
Records in database: 1436944
--------------------------------------------------------------------------------

Scan settings:
Scan using the following database: extended
Scan archives: yes
Scan mail databases: yes

Scan area - My Computer:
C:\
D:\

Scan statistics:
Files scanned: 102005
Threat name: 7
Infected objects: 7
Suspicious objects: 0
Duration of the scan: 02:46:12

File name / Threat name / Threats count
C:\Program Files\Trend Micro\Internet Security\Quarantine\bydqykb.dll.vir Infected: not-a-virus:AdWare.Win32.Agent.ta 1
C:\Qoobox\Quarantine\C\WINDOWS\system32\drivers\svchost.exe.vir Infected: Trojan-Downloader.Win32.Agent.aswm 1
C:\Qoobox\Quarantine\C\WINDOWS\system32\drivers\TDSSmqlt.sys.vir Infected: Backdoor.Win32.TDSS.bkw 1
C:\Qoobox\Quarantine\C\WINDOWS\system32\TDSSbrsr.dll.vir Infected: Backdoor.Win32.TDSS.asz 1
C:\Qoobox\Quarantine\C\WINDOWS\system32\TDSScfum.dll.vir Infected: Trojan.Win32.Agent.arvz 1
C:\Qoobox\Quarantine\C\WINDOWS\system32\TDSSofxh.dll.vir Infected: Backdoor.Win32.TDSS.blh 1
C:\Qoobox\Quarantine\C\WINDOWS\system32\TDSSriqp.dll.vir Infected: Backdoor.Win32.TDSS.atb 1

The selected area was scanned.

Wheezy · 12-04-2008, 09:19 PM

A little update:

My web browsing seems to be back up in speed, however I did receive another pop-up alert from my AVG detecting a "trojan horse" agent. I clicked the option to "heal".

**chemist** · 12-05-2008, 04:39 AM

Hello again, Wheezy. It appears that you have two antivirus programs installed and running, TrendMicro and AVG. While this may seem like better protection, they can actually conflict with one another and cause system instability or even system hangs. Please choose one to keep and uninstall the other via Add or Remove Programs in your Control Panel.

Please run DDS.scr again and post the DDS.txt it produces. I only need to see the log from the first scan.

Wheezy · 12-05-2008, 02:15 PM

Hi, chemist. I'd like to keep AVG and uninstall Trend Micro. However, it doesn't seem to let me uninstall. I tried via control panel and (start-all programs-Trend Micro-uninstall) but nothing seems to be working. Maybe I could uninstall it through the run box? I'm not sure how to proceed...

**chemist** · 12-05-2008, 02:26 PM

Hello again, Wheezy.

Please visit this site for instructions on uninstalling TrendMicro Internet Security:

http://esupport.trendmicro.com/suppo...&id=EN-1036064

You want the third option. Let me know if you have trouble.

------------------------------------------------------

Wheezy · 12-05-2008, 02:53 PM

Thanks for the link, chemist! I followed the instructions and uninstalled Trend Micro. It uninstalled and rebooted, however now I am unable to connect to the internet at all (I'm using a laptop to write this). I also notice that the Trend Micro folder still shows up in the start menu and in my Program Files...

**chemist** · 12-05-2008, 03:33 PM

How do you connect to the internet?

Please run DDS.scr and post the DDS.txt it produces. I only need to see the log from the first scan. You can transfer the log via USB drive.

Wheezy · 12-05-2008, 03:37 PM

Hi chemist. Just minutes after you posted this, I got my internet working. I clicked on the connection icon in the lower right-hand corner of the task bar (next to the clock) and unchecked the box with the option of Trend Micro firewall. My internet connection works now, but if I shouldn't have unchecked that option please advise.

--------------- DDS Log ---------------

DDS (Version 1.0) - NTFSx86
Run by Shellie Waters at 17:33:36.68 on Fri 12/05/2008
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1022.673 [GMT -6:00]

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Java\jre6\bin\jqs.exe
svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Electronic Arts\EADM\Core.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\System32\svchost.exe -k HTTPFilter
C:\Documents and Settings\Shellie Waters\Desktop\dds.com

============== Pseudo HJT Report ===============

uStart Page = hxxp://minnesota.twins.mlb.com/index.jsp?c_id=min
uInternet Connection Wizard,ShellNext = hxxp://www.google.com/ig/dell?hl=en&client=dell-inc&channel=us
BHO: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - c:\program files\adobe\acrobat 6.0\reader\activex\AcroIEHelper.dll
BHO: {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - c:\program files\avg\avg8\avgssie.dll
BHO: {53707962-6F74-2D53-2644-206D7942484F} - c:\downlo~1\spybot~1\SDHelper.dll
BHO: {5CA3D70E-1895-11CF-8E15-001234567890} - c:\windows\system32\dla\DLASHX_W.DLL
BHO: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\program files\java\jre6\bin\ssv.dll
BHO: {9030D464-4C02-4ABF-8ECC-5164760863C6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: {CA6319C0-31B7-401E-A518-A07C3DB8F777} - c:\program files\bae\BAE.dll
BHO: {DBC80044-A445-435b-BC74-9C25C1C588A9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
uRun: [EA Core] c:\program files\electronic arts\eadm\Core.exe -silent
mRun: [QuickTime Task] "c:\program files\qttask.exe" -atboottime
mRun: [TkBellExe] "c:\program files\common files\real\update_ob\realsched.exe" -osboot
mRun: [AVG8_TRAY] c:\progra~1\avg\avg8\avgtray.exe
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
IE: E&xport to Microsoft Excel - c:\progra~1\micros~4\office11\EXCEL.EXE/3000
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg8\avgpp.dll

============= SERVICES / DRIVERS ===============

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2008-11-20 97928]
R1 AvgMfx86;AVG Free On-access Scanner Minifilter Driver x86;c:\windows\system32\drivers\avgmfx86.sys [2008-11-20 26824]
R2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\avg\avg8\avgemc.exe [2008-11-20 875288]
R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\avg\avg8\avgwdsvc.exe [2008-11-20 231704]
R2 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2008-11-20 76040]
R2 McrdSvc;Media Center Extender Service;c:\windows\ehome\mcrdsvc.exe [2005-8-5 99328]
S3 SaiH8000;SaiH8000;c:\windows\system32\drivers\SaiH8000.sys [2004-7-30 56576]

=============== Created Last 30 ================

2008-12-04 19:20 73,728 a------- c:\windows\system32\javacpl.cpl
2008-12-04 19:20 410,984 a------- c:\windows\system32\deploytk.dll
2008-12-04 19:07 <DIR> --d----- C:\Combo-Fix
2008-12-04 15:59 161,792 a------- c:\windows\SWREG.exe
2008-12-04 15:59 98,816 a------- c:\windows\sed.exe
2008-11-30 20:18 <DIR> --d-h--- C:\$AVG8.VAULT$
2008-11-24 18:07 <DIR> --d----- c:\program files\3ivx
2008-11-24 18:07 <DIR> --d----- c:\program files\muvee Technologies
2008-11-24 18:07 <DIR> --d----- c:\program files\common files\muvee Technologies
2008-11-24 18:06 26,496 a------- c:\windows\system32\dllcache\usbstor.sys
2008-11-20 16:12 76,040 a------- c:\windows\system32\drivers\avgtdix.sys
2008-11-20 16:12 10,520 a------- c:\windows\system32\avgrsstx.dll
2008-11-20 16:12 97,928 a------- c:\windows\system32\drivers\avgldx86.sys
2008-11-20 16:12 <DIR> --d----- c:\windows\system32\drivers\Avg
2008-11-20 16:12 <DIR> --d----- c:\program files\AVG
2008-11-20 16:12 <DIR> --d----- c:\docume~1\alluse~1\applic~1\avg8

==================== Find3M ====================

2008-12-05 16:39 <DIR> --d----- c:\program files\Trend Micro
2008-11-30 20:08 295,424 a------- c:\windows\system32\termsrv.dll
2008-11-24 18:07 <DIR> --d----- c:\program files\QTComponents
2008-10-24 05:10 453,632 -------- c:\windows\system32\dllcache\mrxsmb.sys
2008-10-16 23:08 <DIR> --d----- c:\docume~1\shelli~1\applic~1\SPORE
2008-10-16 14:13 1,809,944 a------- c:\windows\system32\dllcache\wuaueng.dll
2008-10-16 14:13 202,776 a------- c:\windows\system32\dllcache\wuweb.dll
2008-10-16 14:12 323,608 a------- c:\windows\system32\dllcache\wucltui.dll
2008-10-16 14:12 561,688 a------- c:\windows\system32\dllcache\wuapi.dll
2008-10-16 14:09 92,696 a------- c:\windows\system32\dllcache\cdm.dll
2008-10-16 14:09 51,224 a------- c:\windows\system32\dllcache\wuauclt.exe
2008-10-16 14:08 34,328 a------- c:\windows\system32\dllcache\wups.dll
2008-10-16 14:06 268,648 a------- c:\windows\system32\mucltui.dll
2008-10-16 14:06 208,744 a------- c:\windows\system32\muweb.dll
2008-10-15 10:57 332,800 -------- c:\windows\system32\dllcache\netapi32.dll
2008-10-07 21:52 <DIR> --d----- c:\program files\TheSimsResource
2008-10-07 17:20 <DIR> --d----- c:\program files\SimPE
2008-09-15 05:57 1,846,016 a------- c:\windows\system32\win32k.sys
2008-09-15 05:57 1,846,016 -------- c:\windows\system32\dllcache\win32k.sys
2008-09-07 11:16 7,086 ac------ c:\windows\system32\ealregsnapshot1.reg
2008-07-07 16:01 <DIR> --d----- c:\docume~1\shelli~1\applic~1\CoreFTP
2007-11-10 23:16 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Kontiki
2007-10-18 14:44 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Kaspersky Lab
2007-10-16 01:09 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Spybot - Search & Destroy
2006-10-18 11:54 <DIR> --d----- c:\docume~1\shelli~1\applic~1\.BitTornado
2006-09-16 21:23 <DIR> --d----- c:\docume~1\shelli~1\applic~1\X-Chat 2
2006-07-06 00:18 <DIR> --d----- c:\docume~1\shelli~1\applic~1\New Folder
2006-04-13 20:26 <DIR> --d----- c:\docume~1\shelli~1\applic~1\Corel Photo Album
2006-10-21 15:54 152 ---shr-- c:\windows\system32\11D43EA203.sys
2006-10-21 15:54 7,520 ac-sh--- c:\windows\system32\KGyGaAvL.sys

============= FINISH: 17:34:07.21 ===============

**chemist** · 12-05-2008, 04:13 PM

Hello again, wheezy. You did great! The Trend Micro folder is also where HijackThis resides. You can delete the folder if you don't want HijackThis anymore. How is your machine behaving? Let me know and I will give you some final instructions.

Wheezy · 12-05-2008, 04:26 PM

Hey chemist. I've been browsing for about an hour, and everything seems to be working just fine. I can access all the sites that I normally access, and Google no longer re-directs my search results to link directories. AVG seems to be working fine and says that all of its "security features are working correctly and up-to-date". I also haven't gotten any alert pop-ups from AVG since last night. Overall, everything seems to be working normally!

**chemist** · 12-05-2008, 04:44 PM

Congratulations. Well done! Your logs appear clean. You should be good to go.

As far as those infected objects listed in the Kaspersky report, those are safely tucked away in ComboFix's quarantine folder or in old System Restore Points, which we will be taking care of now.

Go to Start >> Run and Copy/Paste the following single-line command into the Run box and click OK:

combofix /u

This will uninstall ComboFix and delete ComboFix's quarantine folder. It will also implement some cleanup procedures, remove old System Restore points which contain previous infections, and create a fresh, clean System Restore point.

Please re-enable your antivirus program and any other antispyware programs disabled earlier if you haven't already.

You can safely delete any tools downloaded or any logs, files, and any shortcuts on your desktop that were created during this fix.

------------------------------------------------------

MICROSOFT UPDATES
It is very important that you get all of the critical updates for your Operating System and Internet Explorer. Keeping your OS and browser up to date will help make you less susceptible to attacks by Trojans and viruses. Please go to Microsoft and download all the critical updates to help prevent possible re-infection.

SPYWARE PREVENTION
This is a good time to set up protection against further attacks. In light of your recent problem, I'm sure you'd like to avoid any future infections. Please read these well written articles:

How Did I Get Infected In The First Place? by TonyKlein
PC Safety and Security--What Do I Need?

To help protect your computer in the future I recommend that you get the following free programs if you do not already have them:

SpywareBlaster prevents the installation of ActiveX-based malware, blocks cookies, and restricts the actions of "bad" sites in Internet Explorer. See tutorial here
IE-Spyad is another excellent program that places over 5000 dubious websites and domains in the IE Restricted list, which will help prevent attempts to infect your system. It basically prevents any downloads from the sites listed, although you will still be able to connect to the site. See tutorial here
MVPS HOSTS FILE replaces your current HOSTS file with one that will restrict known ad sites from serving you unsolicited advertisements. It basically prevents your computer from connecting to those sites by redirecting them to 127.0.0.1, which is the IP of your local computer. See guide here and for Windows Vista here
Spybot - Search & Destroy is an excellent spyware remover and also offers real-time protection against critical registry changes. Don't use the Immunize feature in Spybot if you use SpywareBlaster. See tutorial here

Keep your antivirus program and antispyware programs updated and scan with them on a regular basis.

Please respond to this thread one more time so we can mark this thread as resolved.

Wheezy · 12-05-2008, 05:12 PM

Although things seem like they are running normally, I did receive another "threat detected" pop-up message from AVG. I didn't think to snap a picture of it, but I'm just wondering if it's a legitimate threat or something from the virus vault. So if my logs are clean, is this just a false alert?

Also, if I download and install one of the prevention programs (ie SpywareBlaster), should that be used along with my AVG or instead of it? Sorry for the confusion, I just don't want to have to crawl back here in 6 months with the same problem :p

12-04-2008, 08:34 AM	#2 (permalink)
chemist Moderator, Analyst, Security Team; Rangemaster, TSF Academy Join Date: Oct 2007 Location: Georgia Posts: 8,661 OS: XP SP3	Re: Possible Infection Affecting Internet Hello and Welcome to TSF. Please Subscribe to this Thread to get immediate notification of replies as soon as they are posted. To do this click Thread Tools, then click Subscribe to this Thread. Make sure it is set to Instant notification by email, then click Add Subscription. Please note that the forum is very busy and if I don't hear from you within three days this thread will be closed. Please copy this page to Notepad and Save it to your Desktop in order to assist you when carrying out the following instructions. Before beginning the fix, read this post completely. If there's anything that you do not understand, kindly ask your questions before proceeding. Ensure that there aren't any opened browsers when you are carrying out the procedures below. It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence. ------------------------------------------------------ Download Combo-Fix to a USB drive on another computer and transfer it to your desktop. ------------------------------------------------------ Download Combo-Fix.exe and Save it to your Desktop. * IMPORTANT !!! Save Combo-Fix.exe to your Desktop Disable your AntiVirus and AntiSpyware applications, usually via a right-click on the System Tray icon. They may otherwise interfere with our tools Double-click on Combo-Fix.exe & follow the prompts. When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply. ------------------------------------------------------ If you have any questions along the way...STOP and ask them before proceeding. __________________ Our help is free but please donate Proud member of ASAP Proud member of UNITE

12-04-2008, 02:17 PM	#3 (permalink)
Wheezy TSF Supporter Join Date: Oct 2007 Location: Minnesota, USA Posts: 82 OS: Windows XP	Re: Possible Infection Affecting Internet Hi chemist. I appreciate you helping me with my problem! I ran the ComboFix with no problems. I did receive a prompt before it started which read "Rootkit detected - must reboot". So my computer rebooted and then started/completed the ComboFix. I copy/pasted the log below. I look forward to hearing from you soon :) --------------- Combo Fix Log --------------- ComboFix 08-12-04.04 - Shellie Waters 2008-12-04 16:01:19.11 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.667 [GMT -6:00] . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\documents and settings\Shellie Waters\nah_ettf.exe c:\documents and settings\Shellie Waters\nah_log.dat c:\windows\BM272d792e.txt c:\windows\IE4 Error Log.txt c:\windows\system32\drivers\svchost.exe c:\windows\system32\drivers\TDSSmqlt.sys c:\windows\system32\TDSSbrsr.dll c:\windows\system32\TDSScfum.dll c:\windows\system32\TDSSlxwp.dll c:\windows\system32\TDSSnmxh.log c:\windows\system32\TDSSofxh.dll c:\windows\system32\TDSSosvd.dat c:\windows\system32\TDSSrhym.log c:\windows\system32\TDSSriqp.dll c:\windows\system32\TDSSsihc.dll c:\windows\system32\TDSStkdv.log c:\windows\system32\winlogon.exe . . . is infected!! . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Service_TDSSSERV.SYS -------\Legacy_TDSSSERV.SYS ((((((((((((((((((((((((( Files Created from 2008-11-04 to 2008-12-04 ))))))))))))))))))))))))))))))) . 2008-11-30 20:18 . 2008-12-02 02:53 <DIR> d--h----- C:\$AVG8.VAULT$ 2008-11-24 18:07 . 2008-11-24 18:07 <DIR> d-------- c:\program files\muvee Technologies 2008-11-24 18:07 . 2008-11-24 18:07 <DIR> d-------- c:\program files\Common Files\muvee Technologies 2008-11-24 18:07 . 2008-11-24 18:07 <DIR> d-------- c:\program files\3ivx 2008-11-24 18:06 . 2004-08-03 23:08 26,496 --a------ c:\windows\system32\dllcache\usbstor.sys 2008-11-20 16:12 . 2008-11-30 14:54 <DIR> d-------- c:\windows\system32\drivers\Avg 2008-11-20 16:12 . 2008-11-20 16:12 <DIR> d-------- c:\program files\AVG 2008-11-20 16:12 . 2008-11-30 20:18 <DIR> d-------- c:\documents and settings\All Users\Application Data\avg8 2008-11-20 16:12 . 2008-11-20 16:12 97,928 --a------ c:\windows\system32\drivers\avgldx86.sys 2008-11-20 16:12 . 2008-11-20 16:12 76,040 --a------ c:\windows\system32\drivers\avgtdix.sys 2008-11-20 16:12 . 2008-11-20 16:12 10,520 --a------ c:\windows\system32\avgrsstx.dll . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-12-02 20:29 --------- d---a-w c:\documents and settings\All Users\Application Data\TEMP 2008-11-25 00:07 --------- d--h--w c:\program files\InstallShield Installation Information 2008-11-25 00:07 --------- d-----w c:\program files\QTComponents 2008-10-24 11:10 453,632 ----a-w c:\windows\system32\drivers\mrxsmb.sys 2008-10-17 05:08 --------- d-----w c:\documents and settings\Shellie Waters\Application Data\SPORE 2008-10-08 03:52 --------- d-----w c:\program files\TheSimsResource 2008-10-07 23:20 --------- d-----w c:\program files\SimPE 2008-01-15 07:49 1,498 ----a-w c:\program files\Calculator.lnk 2007-06-29 11:25 8,612 -c--a-w c:\program files\QuickTime Read Me.htm 2007-06-29 11:25 749,568 -c--a-w c:\program files\QTOControl.dll 2007-06-29 11:25 684,032 -c--a-w c:\program files\QTOLibrary.dll 2007-06-29 11:25 618,496 -c--a-w c:\program files\QTInfo.exe 2007-06-29 11:25 6,124,864 ----a-w c:\program files\QuickTimePlayer.exe 2007-06-29 11:25 574,784 -c--a-w c:\program files\QTPlugin.ocx 2007-06-29 11:25 303,104 -c--a-w c:\program files\QTUIPanelControl.dll 2007-06-29 11:24 55,622 -c--a-w c:\program files\Sample.mov 2007-06-29 11:24 483,328 -c--a-w c:\program files\PictureViewer.exe 2007-06-29 11:24 286,720 ----a-w c:\program files\QTTask.exe 2007-06-29 11:24 18,663 -c--a-w c:\program files\Sample.qtif 2006-10-21 21:54 152 --sh--r c:\windows\system32\11D43EA203.sys 2006-10-21 21:54 7,520 -csha-w c:\windows\system32\KGyGaAvL.sys . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . Note empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "EA Core"="c:\program files\Electronic Arts\EADM\Core.exe" [2008-07-21 2752512] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "QuickTime Task"="c:\program files\qttask.exe" [2007-06-29 286720] "TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2007-09-27 185632] "SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_06\bin\jusched.exe" [2008-03-25 144784] "AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2008-11-27 1261336] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "vidc.3IV2"= 3ivxVfWCodec_dec.dll [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Gamma Loader.lnk] path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk backup=c:\windows\pss\Adobe Gamma Loader.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Digital Line Detect.lnk] path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Digital Line Detect.lnk backup=c:\windows\pss\Digital Line Detect.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DLA] --a--c--- 2005-09-08 04:20 122940 c:\windows\system32\DLA\DLACTRLW.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DMXLauncher] --a--c--- 2005-10-05 02:12 94208 c:\program files\Dell\Media Experience\DMXLauncher.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ehTray] --a--c--- 2005-09-29 13:01 67584 c:\windows\ehome\ehtray.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Desktop Search] --a------ 2006-04-11 02:07 169472 c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IAAnotif] --a--c--- 2005-06-17 06:56 139264 c:\program files\Intel\Intel Matrix Storage Manager\IAAnotif.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup] --a--c--- 2005-06-10 09:44 249856 c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler] --a--c--- 2005-06-10 09:44 81920 c:\program files\Common Files\InstallShield\UpdateService\issch.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon] --a------ 2007-10-04 17:14 8491008 c:\windows\system32\nvcpl.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter] --a--c--- 2007-10-04 17:14 81920 c:\windows\system32\nvmctray.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] --a------ 2007-06-29 05:24 286720 c:\program files\QTTask.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe] --a------ 2007-09-27 17:02 185632 c:\program files\Common Files\Real\Update_OB\realsched.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz] --a--c--- 2007-10-04 17:14 1626112 c:\windows\system32\nwiz.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SigmatelSysTrayApp] --a--c--- 2005-03-22 22:20 339968 c:\windows\stsystra.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services] "usnjsvc"=3 (0x3) "tmproxy"=3 (0x3) "TmPfw"=3 (0x3) "TMBMServer"=2 (0x2) "SfCtlCom"=2 (0x2) "ose"=3 (0x3) "NVSvc"=2 (0x2) "NetSvc"=3 (0x3) "MDM"=2 (0x2) "KService"=2 (0x2) "IAANTMon"=2 (0x2) "ELService"=2 (0x2) [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\TrendAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\TrendFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "c:\\Program Files\\AVG\\AVG8\\avgemc.exe"= "c:\\Program Files\\AVG\\AVG8\\avgupd.exe"= R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\Drivers\avgldx86.sys [2008-11-20 97928] R2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [2008-11-20 875288] R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2008-11-20 231704] R2 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\Drivers\avgtdix.sys [2008-11-20 76040] R2 tmevtmgr;tmevtmgr;\??\c:\windows\system32\drivers\tmevtmgr.sys [2007-10-15 52368] R2 tmpreflt;tmpreflt;c:\windows\system32\DRIVERS\tmpreflt.sys [2007-09-17 36112] R3 tmcfw;Trend Micro Common Firewall Service;c:\windows\system32\DRIVERS\TM_CFW.sys [2007-09-17 333328] S3 SaiH8000;SaiH8000;c:\windows\system32\DRIVERS\SaiH8000.sys [2004-07-30 56576] S4 TmPfw;Trend Micro Personal Firewall;c:\progra~1\TRENDM~1\INTERN~2\TmPfw.exe [2007-10-15 480520] S4 tmproxy;Trend Micro Proxy Service;"c:\program files\Trend Micro\Internet Security\TmProxy.exe" [2007-10-15 648456] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{361ac05d-0e0d-11da-9aa9-806d6172696f}] \Shell\AutoRun\command - E:\setup.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e9d77a1a-b838-11dd-8c02-0013721253cd}] \Shell\AutoRun\command - e:\system\viewer\FlipVideoforPC.exe \Shell\Flip Video for PC\command - e:\system\viewer\FlipVideoforPC.exe . Contents of the 'Scheduled Tasks' folder 2008-03-20 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-06-03 12:42] . - - - - ORPHANS REMOVED - - - - MSConfigStartUp-kdx - c:\program files\Kontiki\KHost.exe MSConfigStartUp-SunJavaUpdateSched - c:\program files\Java\j2re1.4.2_03\bin\jusched.exe . ------- Supplementary Scan ------- . uStart Page = hxxp://minnesota.twins.mlb.com/index.jsp?c_id=min uInternet Connection Wizard,ShellNext = hxxp://www.google.com/ig/dell?hl=en&client=dell-inc&channel=us IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\OFFICE11\EXCEL.EXE/3000 FireFox -: Profile - c:\documents and settings\Shellie Waters\Application Data\Mozilla\Firefox\Profiles\kuae1v1r.default\ FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://forums.sims2community.com/index.php FF -: plugin - c:\program files\Adobe\Acrobat 6.0\Reader\browser\nppdf32.dll FF -: plugin - c:\program files\Plugins\npqtplugin.dll FF -: plugin - c:\program files\Plugins\npqtplugin2.dll FF -: plugin - c:\program files\Plugins\npqtplugin3.dll FF -: plugin - c:\program files\Plugins\npqtplugin4.dll FF -: plugin - c:\program files\Plugins\npqtplugin5.dll FF -: plugin - c:\program files\Plugins\npqtplugin6.dll FF -: plugin - c:\program files\Plugins\npqtplugin7.dll FF -: plugin - c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll . ************************************************************************ catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-12-04 16:07:17 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ********************************************************************** . ------------------------ Other Running Processes ------------------------ . c:\windows\ehome\ehrecvr.exe c:\windows\ehome\ehSched.exe c:\windows\ehome\mcrdsvc.exe c:\program files\AVG\AVG8\avgrsx.exe c:\windows\system32\dllhost.exe . ************************************************************************ . Completion time: 2008-12-04 16:11:28 - machine was rebooted ComboFix-quarantined-files.txt 2008-12-04 22:11:25 ComboFix2.txt 2008-05-15 04:31:37 Pre-Run: 82,254,192,640 bytes free Post-Run: 82,198,233,088 bytes free 200 --- E O F --- 2008-12-03 11:12:07

12-04-2008, 02:41 PM	#4 (permalink)
chemist Moderator, Analyst, Security Team; Rangemaster, TSF Academy Join Date: Oct 2007 Location: Georgia Posts: 8,661 OS: XP SP3	Re: Possible Infection Affecting Internet Hello, Wheezy. Can you connect to the internet now? ------------------------------------------------------ Please uninstall the following via Start->(or My Computer)->Control Panel->Add or Remove Programs if it still exists: Viewpoint Media Player<<This is considered foistware instead of malware since it is installed without users approval, but doesn't spy or do anything "bad". Please read here and here If you decide to uninstall it, also delete the following Folders if they still exist: C:\Program Files\Viewpoint C:\Documents and Settings\All Users\Application Data\Viewpoint ------------------------------------------------------ I see you have WildTangent Web Driver installed on your system. Although not technically spyware, it does have built-in components to update itself and collect information about your computer. We recommend uninstalling it. Please read here for information, removal instructions, and a link to an automatic removal tool. If you uninstall it, delete the following Folder if it still exists: C:\Program Files\WildTangent ------------------------------------------------------ Go Start > Run and copy/paste the following single-line command into the Run box and click OK: cmd /c Vfind -ltf "%systemdrive%\winlogon.exe" >log.txt&log.txt&del log.txt A Notepad file will open. Post the contents of log.txt in your next reply. ------------------------------------------------------ __________________ Our help is free but please donate Proud member of ASAP Proud member of UNITE

12-04-2008, 02:56 PM	#5 (permalink)
Wheezy TSF Supporter Join Date: Oct 2007 Location: Minnesota, USA Posts: 82 OS: Windows XP	Re: Possible Infection Affecting Internet Hi chemist! I am now able to connect to the internet, and I can also access this site, which I wasn't able to do before. I uninstalled the two programs you advised to uninstall. In fact, I didn't even know what the programs were and why/how they got onto my system! Here is the log that came up from the last step: --------------- Log --------------- -c--a-w 502,272 2004-08-10 10:00:00 C:\i386\winlogon.exe -c--a-w 507,904 2008-04-14 00:12:39 C:\WINDOWS\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\winlogon.exe ----a-w 502,272 2004-08-10 10:00:00 C:\WINDOWS\system32\winlogon.exe ----a-w 502,272 2004-08-10 10:00:00 C:\WINDOWS\system32\dllcache\winlogon.exe

12-04-2008, 03:11 PM	#6 (permalink)
chemist Moderator, Analyst, Security Team; Rangemaster, TSF Academy Join Date: Oct 2007 Location: Georgia Posts: 8,661 OS: XP SP3	Re: Possible Infection Affecting Internet Please go to: VirusTotal On the page you'll find a Browse button. Next to the Browse button you'll see a box to enter text. Please copy/paste the following bolded text into the box: C:\WINDOWS\system32\winlogon.exe Then click the Send File button just below. This will scan the file. Please be patient. If you get a message saying File has already been analysed: click Reanalyse file now Once scanned, copy and paste the results in your next reply. Please repeat for the following file: C:\WINDOWS\system32\dllcache\winlogon.exe ------------------------------------------------------ __________________ Our help is free but please donate Proud member of ASAP Proud member of UNITE

12-04-2008, 08:29 PM	#9 (permalink)
Wheezy TSF Supporter Join Date: Oct 2007 Location: Minnesota, USA Posts: 82 OS: Windows XP	Re: Possible Infection Affecting Internet I was able to complete all of the steps outlined. A short time after reading your post, chemist, my anti-virus produced a pop-up stating that a "backdoor trajan" was detected. I haven't had any noticeable interference (besides that one alert pop-up), but I haven't done much on my computer during the scan. I didn't want to compromise then scan or slow it down. Below are the logs from ComboFix and the online scan. --------------- ComboFix Log --------------- ComboFix 08-12-04.04 - Shellie Waters 2008-12-04 19:08:28.12 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.736 [GMT -6:00] Running from: c:\documents and settings\Shellie Waters\Desktop\Combo-Fix.exe Command switches used :: c:\documents and settings\Shellie Waters\Desktop\CFScript.txt * Created a new restore point . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . --------------- FCopy --------------- c:\windows\system32\dllcache\winlogon.exe --> c:\windows\system32\winlogon.exe . ((((((((((((((((((((((((( Files Created from 2008-11-05 to 2008-12-05 ))))))))))))))))))))))))))))))) . 2008-11-30 20:18 . 2008-12-04 18:42 <DIR> d--h----- C:\$AVG8.VAULT$ 2008-11-24 18:07 . 2008-11-24 18:07 <DIR> d-------- c:\program files\muvee Technologies 2008-11-24 18:07 . 2008-11-24 18:07 <DIR> d-------- c:\program files\Common Files\muvee Technologies 2008-11-24 18:07 . 2008-11-24 18:07 <DIR> d-------- c:\program files\3ivx 2008-11-24 18:06 . 2004-08-03 23:08 26,496 --a------ c:\windows\system32\dllcache\usbstor.sys 2008-11-20 16:12 . 2008-11-30 14:54 <DIR> d-------- c:\windows\system32\drivers\Avg 2008-11-20 16:12 . 2008-11-20 16:12 <DIR> d-------- c:\program files\AVG 2008-11-20 16:12 . 2008-11-30 20:18 <DIR> d-------- c:\documents and settings\All Users\Application Data\avg8 2008-11-20 16:12 . 2008-11-20 16:12 97,928 --a------ c:\windows\system32\drivers\avgldx86.sys 2008-11-20 16:12 . 2008-11-20 16:12 76,040 --a------ c:\windows\system32\drivers\avgtdix.sys 2008-11-20 16:12 . 2008-11-20 16:12 10,520 --a------ c:\windows\system32\avgrsstx.dll . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-12-02 20:29 --------- d---a-w c:\documents and settings\All Users\Application Data\TEMP 2008-12-01 02:08 295,424 ----a-w c:\windows\system32\termsrv.dll 2008-11-25 00:07 --------- d--h--w c:\program files\InstallShield Installation Information 2008-11-25 00:07 --------- d-----w c:\program files\QTComponents 2008-10-24 11:10 453,632 ----a-w c:\windows\system32\drivers\mrxsmb.sys 2008-10-24 11:10 453,632 ------w c:\windows\system32\dllcache\mrxsmb.sys 2008-10-17 05:08 --------- d-----w c:\documents and settings\Shellie Waters\Application Data\SPORE 2008-10-16 20:13 202,776 ----a-w c:\windows\system32\wuweb.dll 2008-10-16 20:13 202,776 ----a-w c:\windows\system32\dllcache\wuweb.dll 2008-10-16 20:13 1,809,944 ----a-w c:\windows\system32\wuaueng.dll 2008-10-16 20:13 1,809,944 ----a-w c:\windows\system32\dllcache\wuaueng.dll 2008-10-16 20:12 561,688 ----a-w c:\windows\system32\wuapi.dll 2008-10-16 20:12 561,688 ----a-w c:\windows\system32\dllcache\wuapi.dll 2008-10-16 20:12 323,608 ----a-w c:\windows\system32\wucltui.dll 2008-10-16 20:12 323,608 ----a-w c:\windows\system32\dllcache\wucltui.dll 2008-10-16 20:09 92,696 ----a-w c:\windows\system32\dllcache\cdm.dll 2008-10-16 20:09 92,696 ----a-w c:\windows\system32\cdm.dll 2008-10-16 20:09 51,224 ----a-w c:\windows\system32\wuauclt.exe 2008-10-16 20:09 51,224 ----a-w c:\windows\system32\dllcache\wuauclt.exe 2008-10-16 20:09 43,544 ----a-w c:\windows\system32\wups2.dll 2008-10-16 20:08 34,328 ----a-w c:\windows\system32\wups.dll 2008-10-16 20:08 34,328 ----a-w c:\windows\system32\dllcache\wups.dll 2008-10-16 20:06 268,648 ----a-w c:\windows\system32\mucltui.dll 2008-10-16 20:06 208,744 ----a-w c:\windows\system32\muweb.dll 2008-10-15 16:57 332,800 ------w c:\windows\system32\dllcache\netapi32.dll 2008-10-08 03:52 --------- d-----w c:\program files\TheSimsResource 2008-10-07 23:20 --------- d-----w c:\program files\SimPE 2008-09-15 11:57 1,846,016 ----a-w c:\windows\system32\win32k.sys 2008-09-15 11:57 1,846,016 ------w c:\windows\system32\dllcache\win32k.sys 2008-09-07 17:16 7,086 -c--a-w c:\windows\system32\ealregsnapshot1.reg 2008-01-15 07:49 1,498 ----a-w c:\program files\Calculator.lnk 2007-06-29 11:25 8,612 -c--a-w c:\program files\QuickTime Read Me.htm 2007-06-29 11:25 749,568 -c--a-w c:\program files\QTOControl.dll 2007-06-29 11:25 684,032 -c--a-w c:\program files\QTOLibrary.dll 2007-06-29 11:25 618,496 -c--a-w c:\program files\QTInfo.exe 2007-06-29 11:25 6,124,864 ----a-w c:\program files\QuickTimePlayer.exe 2007-06-29 11:25 574,784 -c--a-w c:\program files\QTPlugin.ocx 2007-06-29 11:25 303,104 -c--a-w c:\program files\QTUIPanelControl.dll 2007-06-29 11:24 55,622 -c--a-w c:\program files\Sample.mov 2007-06-29 11:24 483,328 -c--a-w c:\program files\PictureViewer.exe 2007-06-29 11:24 286,720 ----a-w c:\program files\QTTask.exe 2007-06-29 11:24 18,663 -c--a-w c:\program files\Sample.qtif 2006-10-21 21:54 152 --sh--r c:\windows\system32\11D43EA203.sys 2006-10-21 21:54 7,520 -csha-w c:\windows\system32\KGyGaAvL.sys . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . Note empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "EA Core"="c:\program files\Electronic Arts\EADM\Core.exe" [2008-07-21 2752512] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "QuickTime Task"="c:\program files\qttask.exe" [2007-06-29 286720] "TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2007-09-27 185632] "SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_06\bin\jusched.exe" [2008-03-25 144784] "AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2008-11-27 1261336] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "vidc.3IV2"= 3ivxVfWCodec_dec.dll [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Gamma Loader.lnk] path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk backup=c:\windows\pss\Adobe Gamma Loader.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Digital Line Detect.lnk] path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Digital Line Detect.lnk backup=c:\windows\pss\Digital Line Detect.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DLA] --a--c--- 2005-09-08 04:20 122940 c:\windows\system32\DLA\DLACTRLW.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DMXLauncher] --a--c--- 2005-10-05 02:12 94208 c:\program files\Dell\Media Experience\DMXLauncher.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ehTray] --a--c--- 2005-09-29 13:01 67584 c:\windows\ehome\ehtray.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Desktop Search] --a------ 2006-04-11 02:07 169472 c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IAAnotif] --a--c--- 2005-06-17 06:56 139264 c:\program files\Intel\Intel Matrix Storage Manager\IAAnotif.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup] --a--c--- 2005-06-10 09:44 249856 c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler] --a--c--- 2005-06-10 09:44 81920 c:\program files\Common Files\InstallShield\UpdateService\issch.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon] --a------ 2007-10-04 17:14 8491008 c:\windows\system32\nvcpl.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter] --a--c--- 2007-10-04 17:14 81920 c:\windows\system32\nvmctray.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] --a------ 2007-06-29 05:24 286720 c:\program files\QTTask.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe] --a------ 2007-09-27 17:02 185632 c:\program files\Common Files\Real\Update_OB\realsched.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz] --a--c--- 2007-10-04 17:14 1626112 c:\windows\system32\nwiz.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SigmatelSysTrayApp] --a--c--- 2005-03-22 22:20 339968 c:\windows\stsystra.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services] "usnjsvc"=3 (0x3) "tmproxy"=3 (0x3) "TmPfw"=3 (0x3) "TMBMServer"=2 (0x2) "SfCtlCom"=2 (0x2) "ose"=3 (0x3) "NVSvc"=2 (0x2) "NetSvc"=3 (0x3) "MDM"=2 (0x2) "KService"=2 (0x2) "IAANTMon"=2 (0x2) "ELService"=2 (0x2) [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\TrendAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\TrendFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "c:\\Program Files\\AVG\\AVG8\\avgemc.exe"= "c:\\Program Files\\AVG\\AVG8\\avgupd.exe"= R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\Drivers\avgldx86.sys [2008-11-20 97928] R2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [2008-11-20 875288] R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2008-11-20 231704] R2 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\Drivers\avgtdix.sys [2008-11-20 76040] R2 tmevtmgr;tmevtmgr;\??\c:\windows\system32\drivers\tmevtmgr.sys [2007-10-15 52368] R2 tmpreflt;tmpreflt;c:\windows\system32\DRIVERS\tmpreflt.sys [2007-09-17 36112] R3 tmcfw;Trend Micro Common Firewall Service;c:\windows\system32\DRIVERS\TM_CFW.sys [2007-09-17 333328] S3 SaiH8000;SaiH8000;c:\windows\system32\DRIVERS\SaiH8000.sys [2004-07-30 56576] S4 TmPfw;Trend Micro Personal Firewall;c:\progra~1\TRENDM~1\INTERN~2\TmPfw.exe [2007-10-15 480520] S4 tmproxy;Trend Micro Proxy Service;"c:\program files\Trend Micro\Internet Security\TmProxy.exe" [2007-10-15 648456] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{361ac05d-0e0d-11da-9aa9-806d6172696f}] \Shell\AutoRun\command - E:\setup.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e9d77a1a-b838-11dd-8c02-0013721253cd}] \Shell\AutoRun\command - e:\system\viewer\FlipVideoforPC.exe \Shell\Flip Video for PC\command - e:\system\viewer\FlipVideoforPC.exe . Contents of the 'Scheduled Tasks' folder 2008-03-20 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-06-03 12:42] . . ------- Supplementary Scan ------- . uStart Page = hxxp://minnesota.twins.mlb.com/index.jsp?c_id=min uInternet Connection Wizard,ShellNext = hxxp://www.google.com/ig/dell?hl=en&client=dell-inc&channel=us IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\OFFICE11\EXCEL.EXE/3000 FireFox -: Profile - c:\documents and settings\Shellie Waters\Application Data\Mozilla\Firefox\Profiles\kuae1v1r.default\ FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://forums.sims2community.com/index.php FF -: plugin - c:\program files\Adobe\Acrobat 6.0\Reader\browser\nppdf32.dll FF -: plugin - c:\program files\Plugins\npqtplugin.dll FF -: plugin - c:\program files\Plugins\npqtplugin2.dll FF -: plugin - c:\program files\Plugins\npqtplugin3.dll FF -: plugin - c:\program files\Plugins\npqtplugin4.dll FF -: plugin - c:\program files\Plugins\npqtplugin5.dll FF -: plugin - c:\program files\Plugins\npqtplugin6.dll FF -: plugin - c:\program files\Plugins\npqtplugin7.dll FF -: plugin - c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll . ************************************************************************ catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-12-04 19:09:55 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ********************************************************************** . Completion time: 2008-12-04 19:10:48 ComboFix-quarantined-files.txt 2008-12-05 01:10:43 ComboFix2.txt 2008-12-04 22:11:30 ComboFix3.txt 2008-05-15 04:31:37 Pre-Run: 82,296,320,000 bytes free Post-Run: 82,280,804,352 bytes free 196 --- E O F --- 2008-12-03 11:12:07 --------------- Kapersky Online Scan Log ---------------** -------------------------------------------------------------------------------- KASPERSKY ONLINE SCANNER 7 REPORT Thursday, December 4, 2008 Operating System: Microsoft Windows XP Professional Service Pack 2 (build 2600) Kaspersky Online Scanner 7 version: 7.0.25.0 Program database last update: Thursday, December 04, 2008 20:42:50 Records in database: 1436944 -------------------------------------------------------------------------------- Scan settings: Scan using the following database: extended Scan archives: yes Scan mail databases: yes Scan area - My Computer: C:\ D:\ Scan statistics: Files scanned: 102005 Threat name: 7 Infected objects: 7 Suspicious objects: 0 Duration of the scan: 02:46:12 File name / Threat name / Threats count C:\Program Files\Trend Micro\Internet Security\Quarantine\bydqykb.dll.vir Infected: not-a-virus:AdWare.Win32.Agent.ta 1 C:\Qoobox\Quarantine\C\WINDOWS\system32\drivers\svchost.exe.vir Infected: Trojan-Downloader.Win32.Agent.aswm 1 C:\Qoobox\Quarantine\C\WINDOWS\system32\drivers\TDSSmqlt.sys.vir Infected: Backdoor.Win32.TDSS.bkw 1 C:\Qoobox\Quarantine\C\WINDOWS\system32\TDSSbrsr.dll.vir Infected: Backdoor.Win32.TDSS.asz 1 C:\Qoobox\Quarantine\C\WINDOWS\system32\TDSScfum.dll.vir Infected: Trojan.Win32.Agent.arvz 1 C:\Qoobox\Quarantine\C\WINDOWS\system32\TDSSofxh.dll.vir Infected: Backdoor.Win32.TDSS.blh 1 C:\Qoobox\Quarantine\C\WINDOWS\system32\TDSSriqp.dll.vir Infected: Backdoor.Win32.TDSS.atb 1 The selected area was scanned.

12-04-2008, 09:19 PM	#10 (permalink)
Wheezy TSF Supporter Join Date: Oct 2007 Location: Minnesota, USA Posts: 82 OS: Windows XP	Re: Possible Infection Affecting Internet A little update: My web browsing seems to be back up in speed, however I did receive another pop-up alert from my AVG detecting a "trojan horse" agent. I clicked the option to "heal".

12-05-2008, 04:39 AM	#11 (permalink)
chemist Moderator, Analyst, Security Team; Rangemaster, TSF Academy Join Date: Oct 2007 Location: Georgia Posts: 8,661 OS: XP SP3	Re: Possible Infection Affecting Internet Hello again, Wheezy. It appears that you have two antivirus programs installed and running, TrendMicro and AVG. While this may seem like better protection, they can actually conflict with one another and cause system instability or even system hangs. Please choose one to keep and uninstall the other via Add or Remove Programs in your Control Panel. Please run DDS.scr again and post the DDS.txt it produces. I only need to see the log from the first scan. __________________ Our help is free but please donate Proud member of ASAP Proud member of UNITE

12-05-2008, 02:15 PM	#12 (permalink)
Wheezy TSF Supporter Join Date: Oct 2007 Location: Minnesota, USA Posts: 82 OS: Windows XP	Re: Possible Infection Affecting Internet Hi, chemist. I'd like to keep AVG and uninstall Trend Micro. However, it doesn't seem to let me uninstall. I tried via control panel and (start-all programs-Trend Micro-uninstall) but nothing seems to be working. Maybe I could uninstall it through the run box? I'm not sure how to proceed...

12-05-2008, 02:26 PM	#13 (permalink)
chemist Moderator, Analyst, Security Team; Rangemaster, TSF Academy Join Date: Oct 2007 Location: Georgia Posts: 8,661 OS: XP SP3	Re: Possible Infection Affecting Internet Hello again, Wheezy. Please visit this site for instructions on uninstalling TrendMicro Internet Security: http://esupport.trendmicro.com/suppo...&id=EN-1036064 You want the third option. Let me know if you have trouble. ------------------------------------------------------ __________________ Our help is free but please donate Proud member of ASAP Proud member of UNITE

12-05-2008, 02:53 PM	#14 (permalink)
Wheezy TSF Supporter Join Date: Oct 2007 Location: Minnesota, USA Posts: 82 OS: Windows XP	Re: Possible Infection Affecting Internet Thanks for the link, chemist! I followed the instructions and uninstalled Trend Micro. It uninstalled and rebooted, however now I am unable to connect to the internet at all (I'm using a laptop to write this). I also notice that the Trend Micro folder still shows up in the start menu and in my Program Files...

12-05-2008, 03:33 PM	#15 (permalink)
chemist Moderator, Analyst, Security Team; Rangemaster, TSF Academy Join Date: Oct 2007 Location: Georgia Posts: 8,661 OS: XP SP3	Re: Possible Infection Affecting Internet How do you connect to the internet? Please run DDS.scr and post the DDS.txt it produces. I only need to see the log from the first scan. You can transfer the log via USB drive. __________________ Our help is free but please donate Proud member of ASAP Proud member of UNITE

12-05-2008, 03:37 PM	#16 (permalink)
Wheezy TSF Supporter Join Date: Oct 2007 Location: Minnesota, USA Posts: 82 OS: Windows XP	Re: Possible Infection Affecting Internet Hi chemist. Just minutes after you posted this, I got my internet working. I clicked on the connection icon in the lower right-hand corner of the task bar (next to the clock) and unchecked the box with the option of Trend Micro firewall. My internet connection works now, but if I shouldn't have unchecked that option please advise. --------------- DDS Log --------------- DDS (Version 1.0) - NTFSx86 Run by Shellie Waters at 17:33:36.68 on Fri 12/05/2008 Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1022.673 [GMT -6:00] ============== Running Processes =============== C:\WINDOWS\system32\svchost -k DcomLaunch svchost.exe C:\WINDOWS\System32\svchost.exe -k netsvcs svchost.exe svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe C:\WINDOWS\eHome\ehRecvr.exe C:\WINDOWS\eHome\ehSched.exe C:\Program Files\Java\jre6\bin\jqs.exe svchost.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\PROGRA~1\AVG\AVG8\avgtray.exe C:\Program Files\Java\jre6\bin\jusched.exe C:\Program Files\Electronic Arts\EADM\Core.exe C:\PROGRA~1\AVG\AVG8\avgrsx.exe C:\PROGRA~1\AVG\AVG8\avgemc.exe C:\WINDOWS\system32\dllhost.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\System32\svchost.exe -k HTTPFilter C:\Documents and Settings\Shellie Waters\Desktop\dds.com ============== Pseudo HJT Report =============== uStart Page = hxxp://minnesota.twins.mlb.com/index.jsp?c_id=min uInternet Connection Wizard,ShellNext = hxxp://www.google.com/ig/dell?hl=en&client=dell-inc&channel=us BHO: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - c:\program files\adobe\acrobat 6.0\reader\activex\AcroIEHelper.dll BHO: {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - c:\program files\avg\avg8\avgssie.dll BHO: {53707962-6F74-2D53-2644-206D7942484F} - c:\downlo~1\spybot~1\SDHelper.dll BHO: {5CA3D70E-1895-11CF-8E15-001234567890} - c:\windows\system32\dla\DLASHX_W.DLL BHO: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\program files\java\jre6\bin\ssv.dll BHO: {9030D464-4C02-4ABF-8ECC-5164760863C6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll BHO: {CA6319C0-31B7-401E-A518-A07C3DB8F777} - c:\program files\bae\BAE.dll BHO: {DBC80044-A445-435b-BC74-9C25C1C588A9} - c:\program files\java\jre6\bin\jp2ssv.dll BHO: {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll uRun: [EA Core] c:\program files\electronic arts\eadm\Core.exe -silent mRun: [QuickTime Task] "c:\program files\qttask.exe" -atboottime mRun: [TkBellExe] "c:\program files\common files\real\update_ob\realsched.exe" -osboot mRun: [AVG8_TRAY] c:\progra~1\avg\avg8\avgtray.exe mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe" IE: E&xport to Microsoft Excel - c:\progra~1\micros~4\office11\EXCEL.EXE/3000 Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg8\avgpp.dll ============= SERVICES / DRIVERS =============== R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2008-11-20 97928] R1 AvgMfx86;AVG Free On-access Scanner Minifilter Driver x86;c:\windows\system32\drivers\avgmfx86.sys [2008-11-20 26824] R2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\avg\avg8\avgemc.exe [2008-11-20 875288] R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\avg\avg8\avgwdsvc.exe [2008-11-20 231704] R2 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2008-11-20 76040] R2 McrdSvc;Media Center Extender Service;c:\windows\ehome\mcrdsvc.exe [2005-8-5 99328] S3 SaiH8000;SaiH8000;c:\windows\system32\drivers\SaiH8000.sys [2004-7-30 56576] =============== Created Last 30 ================ 2008-12-04 19:20 73,728 a------- c:\windows\system32\javacpl.cpl 2008-12-04 19:20 410,984 a------- c:\windows\system32\deploytk.dll 2008-12-04 19:07 <DIR> --d----- C:\Combo-Fix 2008-12-04 15:59 161,792 a------- c:\windows\SWREG.exe 2008-12-04 15:59 98,816 a------- c:\windows\sed.exe 2008-11-30 20:18 <DIR> --d-h--- C:\$AVG8.VAULT$ 2008-11-24 18:07 <DIR> --d----- c:\program files\3ivx 2008-11-24 18:07 <DIR> --d----- c:\program files\muvee Technologies 2008-11-24 18:07 <DIR> --d----- c:\program files\common files\muvee Technologies 2008-11-24 18:06 26,496 a------- c:\windows\system32\dllcache\usbstor.sys 2008-11-20 16:12 76,040 a------- c:\windows\system32\drivers\avgtdix.sys 2008-11-20 16:12 10,520 a------- c:\windows\system32\avgrsstx.dll 2008-11-20 16:12 97,928 a------- c:\windows\system32\drivers\avgldx86.sys 2008-11-20 16:12 <DIR> --d----- c:\windows\system32\drivers\Avg 2008-11-20 16:12 <DIR> --d----- c:\program files\AVG 2008-11-20 16:12 <DIR> --d----- c:\docume~1\alluse~1\applic~1\avg8 ==================== Find3M ==================== 2008-12-05 16:39 <DIR> --d----- c:\program files\Trend Micro 2008-11-30 20:08 295,424 a------- c:\windows\system32\termsrv.dll 2008-11-24 18:07 <DIR> --d----- c:\program files\QTComponents 2008-10-24 05:10 453,632 -------- c:\windows\system32\dllcache\mrxsmb.sys 2008-10-16 23:08 <DIR> --d----- c:\docume~1\shelli~1\applic~1\SPORE 2008-10-16 14:13 1,809,944 a------- c:\windows\system32\dllcache\wuaueng.dll 2008-10-16 14:13 202,776 a------- c:\windows\system32\dllcache\wuweb.dll 2008-10-16 14:12 323,608 a------- c:\windows\system32\dllcache\wucltui.dll 2008-10-16 14:12 561,688 a------- c:\windows\system32\dllcache\wuapi.dll 2008-10-16 14:09 92,696 a------- c:\windows\system32\dllcache\cdm.dll 2008-10-16 14:09 51,224 a------- c:\windows\system32\dllcache\wuauclt.exe 2008-10-16 14:08 34,328 a------- c:\windows\system32\dllcache\wups.dll 2008-10-16 14:06 268,648 a------- c:\windows\system32\mucltui.dll 2008-10-16 14:06 208,744 a------- c:\windows\system32\muweb.dll 2008-10-15 10:57 332,800 -------- c:\windows\system32\dllcache\netapi32.dll 2008-10-07 21:52 <DIR> --d----- c:\program files\TheSimsResource 2008-10-07 17:20 <DIR> --d----- c:\program files\SimPE 2008-09-15 05:57 1,846,016 a------- c:\windows\system32\win32k.sys 2008-09-15 05:57 1,846,016 -------- c:\windows\system32\dllcache\win32k.sys 2008-09-07 11:16 7,086 ac------ c:\windows\system32\ealregsnapshot1.reg 2008-07-07 16:01 <DIR> --d----- c:\docume~1\shelli~1\applic~1\CoreFTP 2007-11-10 23:16 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Kontiki 2007-10-18 14:44 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Kaspersky Lab 2007-10-16 01:09 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Spybot - Search & Destroy 2006-10-18 11:54 <DIR> --d----- c:\docume~1\shelli~1\applic~1\.BitTornado 2006-09-16 21:23 <DIR> --d----- c:\docume~1\shelli~1\applic~1\X-Chat 2 2006-07-06 00:18 <DIR> --d----- c:\docume~1\shelli~1\applic~1\New Folder 2006-04-13 20:26 <DIR> --d----- c:\docume~1\shelli~1\applic~1\Corel Photo Album 2006-10-21 15:54 152 ---shr-- c:\windows\system32\11D43EA203.sys 2006-10-21 15:54 7,520 ac-sh--- c:\windows\system32\KGyGaAvL.sys ============= FINISH: 17:34:07.21 ===============

12-05-2008, 04:13 PM	#17 (permalink)
chemist Moderator, Analyst, Security Team; Rangemaster, TSF Academy Join Date: Oct 2007 Location: Georgia Posts: 8,661 OS: XP SP3	Re: Possible Infection Affecting Internet Hello again, wheezy. You did great! The Trend Micro folder is also where HijackThis resides. You can delete the folder if you don't want HijackThis anymore. How is your machine behaving? Let me know and I will give you some final instructions. __________________ Our help is free but please donate Proud member of ASAP Proud member of UNITE

12-05-2008, 04:26 PM	#18 (permalink)
Wheezy TSF Supporter Join Date: Oct 2007 Location: Minnesota, USA Posts: 82 OS: Windows XP	Re: Possible Infection Affecting Internet Hey chemist. I've been browsing for about an hour, and everything seems to be working just fine. I can access all the sites that I normally access, and Google no longer re-directs my search results to link directories. AVG seems to be working fine and says that all of its "security features are working correctly and up-to-date". I also haven't gotten any alert pop-ups from AVG since last night. Overall, everything seems to be working normally!

12-05-2008, 04:44 PM	#19 (permalink)
chemist Moderator, Analyst, Security Team; Rangemaster, TSF Academy Join Date: Oct 2007 Location: Georgia Posts: 8,661 OS: XP SP3	Re: Possible Infection Affecting Internet Congratulations. Well done! Your logs appear clean. You should be good to go. As far as those infected objects listed in the Kaspersky report, those are safely tucked away in ComboFix's quarantine folder or in old System Restore Points, which we will be taking care of now. Go to Start >> Run and Copy/Paste the following single-line command into the Run box and click OK: combofix /u This will uninstall ComboFix and delete ComboFix's quarantine folder. It will also implement some cleanup procedures, remove old System Restore points which contain previous infections, and create a fresh, clean System Restore point. Please re-enable your antivirus program and any other antispyware programs disabled earlier if you haven't already. You can safely delete any tools downloaded or any logs, files, and any shortcuts on your desktop that were created during this fix. ------------------------------------------------------ MICROSOFT UPDATES It is very important that you get all of the critical updates for your Operating System and Internet Explorer. Keeping your OS and browser up to date will help make you less susceptible to attacks by Trojans and viruses. Please go to Microsoft and download all the critical updates to help prevent possible re-infection. SPYWARE PREVENTION This is a good time to set up protection against further attacks. In light of your recent problem, I'm sure you'd like to avoid any future infections. Please read these well written articles: How Did I Get Infected In The First Place? by TonyKlein PC Safety and Security--What Do I Need? To help protect your computer in the future I recommend that you get the following free programs if you do not already have them: SpywareBlaster prevents the installation of ActiveX-based malware, blocks cookies, and restricts the actions of "bad" sites in Internet Explorer. See tutorial here IE-Spyad is another excellent program that places over 5000 dubious websites and domains in the IE Restricted list, which will help prevent attempts to infect your system. It basically prevents any downloads from the sites listed, although you will still be able to connect to the site. See tutorial here MVPS HOSTS FILE replaces your current HOSTS file with one that will restrict known ad sites from serving you unsolicited advertisements. It basically prevents your computer from connecting to those sites by redirecting them to 127.0.0.1, which is the IP of your local computer. See guide here and for Windows Vista here Spybot - Search & Destroy is an excellent spyware remover and also offers real-time protection against critical registry changes. Don't use the Immunize feature in Spybot if you use SpywareBlaster. See tutorial here Keep your antivirus program and antispyware programs updated and scan with them on a regular basis. Please respond to this thread one more time so we can mark this thread as resolved. __________________ Our help is free but please donate Proud member of ASAP Proud member of UNITE

12-05-2008, 05:12 PM	#20 (permalink)
Wheezy TSF Supporter Join Date: Oct 2007 Location: Minnesota, USA Posts: 82 OS: Windows XP	Re: Possible Infection Affecting Internet Although things seem like they are running normally, I did receive another "threat detected" pop-up message from AVG. I didn't think to snap a picture of it, but I'm just wondering if it's a legitimate threat or something from the virus vault. So if my logs are clean, is this just a false alert? Also, if I download and install one of the prevention programs (ie SpywareBlaster), should that be used along with my AVG or instead of it? Sorry for the confusion, I just don't want to have to crawl back here in 6 months with the same problem :p