|
|
|
|
|||||
|
|
|
|
|
|
|||
| Welcome
to Tech Support Forum home to more then 136,000 problems solved. Issues
have included: Spyware, Malware, Virus Issues, Windows, Microsoft,
Linux, Networking, Security, Hardware, and Gaming Getting your
problem solved is as easy as: 1. Registering for a free account 2. Asking your question 3. Receiving an answer Registered members: * See fewer ads. * And much more..
|
| Want to know how to post a question? click here | Having problems with spyware and pop-ups? First Steps |
|
|||||||
| Resolved HJT Threads Resolved spyware and popup issues. |
|
|
LinkBack | Thread Tools |
12-04-2008, 09:01 PM
|
#1 (permalink) |
|
Registered User
Join Date: Dec 2008
Posts: 9
OS: XP
|
Multiple trojans found by AV but they reappear after AV "cleans" them
Hi, I'm David. This is the first time I've gotten a virus on my computer. I stupidly clicked an executable that claimed to be a video codec required to watch HD videos. My friend pointed me to this website to get help. I read the "Read this before posting for malware removal help" but I'm not sure exactly what you guys will need to help me and I don't know much about computers, so I'll just be as detailed as I can.
Right after I clicked the file and okay'd installation, Firefox opened up a number of tabs (4 if I remember correctly) and, I think, downloaded malware. AVG popped up and detected a number of Trojans and attempted to "heal" them. Then my computer shut itself down, and I wasn't able to log back in to windows (It would freeze at the log on screen). I was able to then restart in safe mode and run AVG from the command line. The results of that are attached as AVG.txt. This allowed me to boot normally in to windows, where I ran a complete scan with AVG again. Those results are attached under AVG2.txt. I ran Superantispyware, and that found a rootkit (Rootkit.TDSServ), as well as some other trojans. Here are my Hijackthis and Gmer logs. I didn't run dds because of the sticky'd warning, but I can do so if needed. Thank you guys in advance. -------Hijackthis log------ Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 10:20:33 PM, on 12/4/2008 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16735) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe C:\WINDOWS\system32\spoolsv.exe C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\PnkBstrA.exe C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe c:\WINDOWS\system32\ZuneBusEnum.exe C:\PROGRA~1\AVG\AVG8\avgrsx.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe C:\Program Files\Java\jre6\bin\jusched.exe C:\PROGRA~1\AVG\AVG8\avgtray.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\Zune\ZuneLauncher.exe C:\WINDOWS\system32\rundll32.exe C:\Program Files\Razer Barracuda AC-1 Gaming Audio Card\Customapp\PROGRAM\RAZER BARRACUDA AC-1 GAMING AUDIO CARD.EXE C:\Program Files\AIM6\aim6.exe C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe C:\FRAPS\FRAPS.EXE C:\Program Files\Adobe\Acrobat 7.0\Acrobat\Acrobat_sl.exe C:\Program Files\Logitech\SetPoint\SetPoint.exe C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE C:\Program Files\AIM6\aolsoftware.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\taskmgr.exe C:\Program Files\AIM6\aolsoftware.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.2.6.26.dll O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" O4 - HKLM\..\Run: [Cmaudio8788] RunDll32 cmicnfgp.cpl,CMICtrlWnd O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [Zune Launcher] "c:\Program Files\Zune\ZuneLauncher.exe" O4 - HKLM\..\Run: [Wcujolet] rundll32.exe "C:\WINDOWS\Eloheja.dll",e O4 - HKLM\..\Run: [Mnadiqurejadan] rundll32.exe "C:\WINDOWS\emobabuyu.dll",e O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe O4 - HKCU\..\Run: [Fraps] C:\FRAPS\FRAPS.EXE O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ? O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet\tools\BitCometBHO_1.2.6.26.dll/206 (file missing) O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/su/ocx/15031/CTSUEng.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/wind...?1200726816937 O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/ge...sh/swflash.cab O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su/ocx/15034/CTPID.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{97A52C02-61E4-4789-8D03-99708175597F}: NameServer = 192.168.0.1 O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll O20 - AppInit_DLLs: avgrsstx.dll O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll O20 - Winlogon Notify: hseihuu - hseihuu.dll (file missing) O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe O23 - Service: FCI - Unknown owner - C:\WINDOWS\system32\svchost.exe:ext.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe ----End Hijackthis log----- ----Gmer log----- GMER 1.0.14.14536 - http://www.gmer.net Rootkit scan 2008-12-04 22:39:09 Windows 5.1.2600 Service Pack 3 ---- System - GMER 1.0.14 ---- SSDT sptd.sys ZwCreateKey [0xBA6BE0D0] SSDT sptd.sys ZwEnumerateKey [0xBA6C3FB2] SSDT sptd.sys ZwEnumerateValueKey [0xBA6C4340] SSDT sptd.sys ZwOpenKey [0xBA6BE0B0] SSDT sptd.sys ZwQueryKey [0xBA6C4418] SSDT sptd.sys ZwQueryValueKey [0xBA6C4298] SSDT sptd.sys ZwSetValueKey [0xBA6C44AA] SSDT \??\C:\Program Files\SUPERAntiSpyware\SASKUTIL.sys (SASKUTIL.SYS/SUPERAdBlocker.com and SUPERAntiSpyware.com) ZwTerminateProcess [0xADA23F20] ---- Kernel code sections - GMER 1.0.14 ---- .text ntkrnlpa.exe!ZwCallbackReturn + 2CE2 8050457E 2 Bytes [ 6C, BA ] ? C:\WINDOWS\system32\drivers\sptd.sys The process cannot access the file because it is being used by another process. .text USBPORT.SYS!DllUnload B8D6C8AC 5 Bytes JMP 8AA0C1C8 ? System32\Drivers\a1yt9qn2.SYS The system cannot find the file specified. ! ---- Kernel IAT/EAT - GMER 1.0.14 ---- IAT atapi.sys[HAL.dll!READ_PORT_UCHAR] [BA6BEAD4] sptd.sys IAT atapi.sys[HAL.dll!READ_PORT_BUFFER_USHORT] [BA6BEC1A] sptd.sys IAT atapi.sys[HAL.dll!READ_PORT_USHORT] [BA6BEB9C] sptd.sys IAT atapi.sys[HAL.dll!WRITE_PORT_BUFFER_USHORT] [BA6BF748] sptd.sys IAT atapi.sys[HAL.dll!WRITE_PORT_UCHAR] [BA6BF61E] sptd.sys ---- User IAT/EAT - GMER 1.0.14 ---- IAT C:\Program Files\AIM6\aim6.exe[3192] @ C:\WINDOWS\system32\ADVAPI32.dll [KERNEL32.dll!LoadLibraryExW] [6BFA9DE1] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC) IAT C:\Program Files\AIM6\aim6.exe[3192] @ C:\WINDOWS\system32\ADVAPI32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9E6E] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC) IAT C:\Program Files\AIM6\aim6.exe[3192] @ C:\WINDOWS\system32\ADVAPI32.dll [KERNEL32.dll!LoadLibraryW] [6BFA9CCD] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC) IAT C:\Program Files\AIM6\aim6.exe[3192] @ C:\WINDOWS\system32\ADVAPI32.dll [KERNEL32.dll!LoadLibraryA] [6BFA9C46] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC) IAT C:\Program Files\AIM6\aim6.exe[3192] @ C:\WINDOWS\system32\RPCRT4.dll [KERNEL32.dll!LoadLibraryA] [6BFA9C46] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC) IAT C:\Program Files\AIM6\aim6.exe[3192] @ C:\WINDOWS\system32\RPCRT4.dll [KERNEL32.dll!LoadLibraryW] [6BFA9CCD] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC) IAT C:\Program Files\AIM6\aim6.exe[3192] @ C:\WINDOWS\system32\RPCRT4.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9E6E] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC) IAT C:\Program Files\AIM6\aim6.exe[3192] @ C:\WINDOWS\system32\Secur32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9E6E] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC) IAT C:\Program Files\AIM6\aim6.exe[3192] @ C:\WINDOWS\system32\Secur32.dll [KERNEL32.dll!LoadLibraryA] [6BFA9C46] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC) IAT C:\Program Files\AIM6\aim6.exe[3192] @ C:\WINDOWS\system32\Secur32.dll [KERNEL32.dll!LoadLibraryW] [6BFA9CCD] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC) IAT C:\Program Files\AIM6\aim6.exe[3192] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [6BFA9DE1] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC) IAT C:\Program Files\AIM6\aim6.exe[3192] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryA] [6BFA9C46] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC) IAT C:\Program Files\AIM6\aim6.exe[3192] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9E6E] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC) IAT C:\Program Files\AIM6\aim6.exe[3192] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryW] [6BFA9CCD] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC) IAT C:\Program Files\AIM6\aim6.exe[3192] @ C:\WINDOWS\system32\GDI32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9E6E] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC) IAT C:\Program Files\AIM6\aim6.exe[3192] @ C:\WINDOWS\system32\GDI32.dll [KERNEL32.dll!LoadLibraryExW] [6BFA9DE1] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC) IAT C:\Program Files\AIM6\aim6.exe[3192] @ C:\WINDOWS\system32\GDI32.dll [KERNEL32.dll!LoadLibraryA] [6BFA9C46] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC) IAT C:\Program Files\AIM6\aim6.exe[3192] @ C:\WINDOWS\system32\GDI32.dll [KERNEL32.dll!LoadLibraryW] [6BFA9CCD] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC) IAT C:\Program Files\AIM6\aim6.exe[3192] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!LoadLibraryA] [6BFA9C46] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC) IAT C:\Program Files\AIM6\aim6.exe[3192] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!LoadLibraryW] [6BFA9CCD] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC) IAT C:\Program Files\AIM6\aim6.exe[3192] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!LoadLibraryExW] [6BFA9DE1] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC) IAT C:\Program Files\AIM6\aim6.exe[3192] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!LoadLibraryExA] [6BFA9D54] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC) IAT C:\Program Files\AIM6\aim6.exe[3192] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9E6E] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC) IAT C:\Program Files\AIM6\aim6.exe[3192] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9E6E] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC) IAT C:\Program Files\AIM6\aim6.exe[3192] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryExA] [6BFA9D54] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC) IAT C:\Program Files\AIM6\aim6.exe[3192] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryExW] [6BFA9DE1] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC) IAT C:\Program Files\AIM6\aim6.exe[3192] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryW] [6BFA9CCD] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC) IAT C:\Program Files\AIM6\aim6.exe[3192] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryA] [6BFA9C46] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC) IAT C:\Program Files\AIM6\aim6.exe[3192] @ C:\WINDOWS\system32\WININET.dll [ADVAPI32.dll!RegQueryValueExA] [012BE7FC] c:\program files\aim6\services\imApp\ver6_8_10_1\imAppService.dll (imAppService EE Application Service/AOL LLC) IAT C:\Program Files\AIM6\aim6.exe[3192] @ C:\WINDOWS\system32\WININET.dll [KERNEL32.dll!LoadLibraryW] [6BFA9CCD] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC) IAT C:\Program Files\AIM6\aim6.exe[3192] @ C:\WINDOWS\system32\WININET.dll [KERNEL32.dll!LoadLibraryExW] [6BFA9DE1] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC) IAT C:\Program Files\AIM6\aim6.exe[3192] @ C:\WINDOWS\system32\WININET.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9E6E] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC) IAT C:\Program Files\AIM6\aim6.exe[3192] @ C:\WINDOWS\system32\WININET.dll [KERNEL32.dll!LoadLibraryA] [6BFA9C46] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC) IAT C:\Program Files\AIM6\aim6.exe[3192] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9E6E] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC) IAT C:\Program Files\AIM6\aim6.exe[3192] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryA] [6BFA9C46] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC) IAT C:\Program Files\AIM6\aim6.exe[3192] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryW] [6BFA9CCD] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC) IAT C:\Program Files\AIM6\aim6.exe[3192] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryExW] [6BFA9DE1] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC) IAT C:\Program Files\AIM6\aim6.exe[3192] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryExA] [6BFA9D54] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC) IAT C:\Program Files\AIM6\aim6.exe[3192] @ C:\WINDOWS\system32\iphlpapi.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9E6E] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC) IAT C:\Program Files\AIM6\aim6.exe[3192] @ C:\WINDOWS\system32\iphlpapi.dll [KERNEL32.dll!LoadLibraryA] [6BFA9C46] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC) IAT C:\Program Files\AIM6\aim6.exe[3192] @ C:\WINDOWS\system32\NETAPI32.dll [KERNEL32.dll!LoadLibraryW] [6BFA9CCD] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC) IAT C:\Program Files\AIM6\aim6.exe[3192] @ C:\WINDOWS\system32\NETAPI32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9E6E] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC) IAT C:\Program Files\AIM6\aim6.exe[3192] @ C:\WINDOWS\system32\NETAPI32.dll [KERNEL32.dll!LoadLibraryA] [6BFA9C46] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC) IAT C:\Program Files\AIM6\aim6.exe[3192] @ C:\WINDOWS\system32\USERENV.dll [KERNEL32.dll!LoadLibraryW] [6BFA9CCD] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC) IAT C:\Program Files\AIM6\aim6.exe[3192] @ C:\WINDOWS\system32\USERENV.dll [KERNEL32.dll!LoadLibraryExA] [6BFA9D54] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC) IAT C:\Program Files\AIM6\aim6.exe[3192] @ C:\WINDOWS\system32\USERENV.dll [KERNEL32.dll!LoadLibraryA] [6BFA9C46] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC) IAT C:\Program Files\AIM6\aim6.exe[3192] @ C:\WINDOWS\system32\USERENV.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9E6E] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC) IAT C:\Program Files\AIM6\aolsoftware.exe[3648] @ C:\WINDOWS\system32\ADVAPI32.dll [KERNEL32.dll!LoadLibraryExW] [6BFA9DE1] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC) IAT C:\Program Files\AIM6\aolsoftware.exe[3648] @ C:\WINDOWS\system32\ADVAPI32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9E6E] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC) IAT C:\Program Files\AIM6\aolsoftware.exe[3648] @ C:\WINDOWS\system32\ADVAPI32.dll [KERNEL32.dll!LoadLibraryW] [6BFA9CCD] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC) IAT C:\Program Files\AIM6\aolsoftware.exe[3648] @ C:\WINDOWS\system32\ADVAPI32.dll [KERNEL32.dll!LoadLibraryA] [6BFA9C46] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC) IAT C:\Program Files\AIM6\aolsoftware.exe[3648] @ C:\WINDOWS\system32\RPCRT4.dll [KERNEL32.dll!LoadLibraryA] [6BFA9C46] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC) IAT C:\Program Files\AIM6\aolsoftware.exe[3648] @ C:\WINDOWS\system32\RPCRT4.dll [KERNEL32.dll!LoadLibraryW] [6BFA9CCD] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC) IAT C:\Program Files\AIM6\aolsoftware.exe[3648] @ C:\WINDOWS\system32\RPCRT4.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9E6E] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC) IAT C:\Program Files\AIM6\aolsoftware.exe[3648] @ C:\WINDOWS\system32\Secur32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9E6E] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC) IAT C:\Program Files\AIM6\aolsoftware.exe[3648] @ C:\WINDOWS\system32\Secur32.dll [KERNEL32.dll!LoadLibraryA] [6BFA9C46] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC) IAT C:\Program Files\AIM6\aolsoftware.exe[3648] @ C:\WINDOWS\system32\Secur32.dll [KERNEL32.dll!LoadLibraryW] [6BFA9CCD] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC) IAT C:\Program Files\AIM6\aolsoftware.exe[3648] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [6BFA9DE1] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC) IAT C:\Program Files\AIM6\aolsoftware.exe[3648] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryA] [6BFA9C46] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC) IAT C:\Program Files\AIM6\aolsoftware.exe[3648] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9E6E] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC) IAT C:\Program Files\AIM6\aolsoftware.exe[3648] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryW] [6BFA9CCD] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC) IAT C:\Program Files\AIM6\aolsoftware.exe[3648] @ C:\WINDOWS\system32\GDI32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9E6E] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC) IAT C:\Program Files\AIM6\aolsoftware.exe[3648] @ C:\WINDOWS\system32\GDI32.dll [KERNEL32.dll!LoadLibraryExW] [6BFA9DE1] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC) IAT C:\Program Files\AIM6\aolsoftware.exe[3648] @ C:\WINDOWS\system32\GDI32.dll [KERNEL32.dll!LoadLibraryA] [6BFA9C46] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC) IAT C:\Program Files\AIM6\aolsoftware.exe[3648] @ C:\WINDOWS\system32\GDI32.dll [KERNEL32.dll!LoadLibraryW] [6BFA9CCD] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC) IAT C:\Program Files\AIM6\aolsoftware.exe[3648] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!LoadLibraryA] [6BFA9C46] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC) IAT C:\Program Files\AIM6\aolsoftware.exe[3648] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!LoadLibraryW] [6BFA9CCD] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC) IAT C:\Program Files\AIM6\aolsoftware.exe[3648] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!LoadLibraryExW] [6BFA9DE1] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC) IAT C:\Program Files\AIM6\aolsoftware.exe[3648] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!LoadLibraryExA] [6BFA9D54] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC) IAT C:\Program Files\AIM6\aolsoftware.exe[3648] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9E6E] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC) IAT C:\Program Files\AIM6\aolsoftware.exe[3648] @ C:\WINDOWS\system32\SAMLIB.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9E6E] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC) IAT C:\Program Files\AIM6\aolsoftware.exe[3648] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9E6E] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC) IAT C:\Program Files\AIM6\aolsoftware.exe[3648] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryExA] [6BFA9D54] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC) IAT C:\Program Files\AIM6\aolsoftware.exe[3648] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryExW] [6BFA9DE1] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC) IAT C:\Program Files\AIM6\aolsoftware.exe[3648] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryW] [6BFA9CCD] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC) IAT C:\Program Files\AIM6\aolsoftware.exe[3648] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryA] [6BFA9C46] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC) IAT C:\Program Files\AIM6\aolsoftware.exe[3648] @ C:\WINDOWS\system32\NETAPI32.dll [KERNEL32.dll!LoadLibraryW] [6BFA9CCD] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC) IAT C:\Program Files\AIM6\aolsoftware.exe[3648] @ C:\WINDOWS\system32\NETAPI32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9E6E] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC) IAT C:\Program Files\AIM6\aolsoftware.exe[3648] @ C:\WINDOWS\system32\NETAPI32.dll [KERNEL32.dll!LoadLibraryA] [6BFA9C46] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC) IAT C:\Program Files\AIM6\aolsoftware.exe[3648] @ C:\WINDOWS\system32\WININET.dll [KERNEL32.dll!LoadLibraryW] [6BFA9CCD] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC) IAT C:\Program Files\AIM6\aolsoftware.exe[3648] @ C:\WINDOWS\system32\WININET.dll [KERNEL32.dll!LoadLibraryExW] [6BFA9DE1] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC) IAT C:\Program Files\AIM6\aolsoftware.exe[3648] @ C:\WINDOWS\system32\WININET.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9E6E] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC) IAT C:\Program Files\AIM6\aolsoftware.exe[3648] @ C:\WINDOWS\system32\WININET.dll [KERNEL32.dll!LoadLibraryA] [6BFA9C46] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC) IAT C:\Program Files\AIM6\aolsoftware.exe[3648] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9E6E] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC) IAT C:\Program Files\AIM6\aolsoftware.exe[3648] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryA] [6BFA9C46] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC) IAT C:\Program Files\AIM6\aolsoftware.exe[3648] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryW] [6BFA9CCD] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC) IAT C:\Program Files\AIM6\aolsoftware.exe[3648] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryExW] [6BFA9DE1] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC) IAT C:\Program Files\AIM6\aolsoftware.exe[3648] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryExA] [6BFA9D54] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC) IAT C:\Program Files\AIM6\aolsoftware.exe[3648] @ C:\WINDOWS\system32\USERENV.dll [KERNEL32.dll!LoadLibraryW] [6BFA9CCD] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC) IAT C:\Program Files\AIM6\aolsoftware.exe[3648] @ C:\WINDOWS\system32\USERENV.dll [KERNEL32.dll!LoadLibraryExA] [6BFA9D54] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC) IAT C:\Program Files\AIM6\aolsoftware.exe[3648] @ C:\WINDOWS\system32\USERENV.dll [KERNEL32.dll!LoadLibraryA] [6BFA9C46] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC) IAT C:\Program Files\AIM6\aolsoftware.exe[3648] @ C:\WINDOWS\system32\USERENV.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9E6E] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC) ---- Devices - GMER 1.0.14 ---- Device \FileSystem\Ntfs \Ntfs 8ACC31E8 Device \FileSystem\Udfs \UdfsCdRom 8A7F0790 Device \FileSystem\Udfs \UdfsDisk 8A7F0790 Device \Driver\usbohci \Device\USBPDO-0 8AA3C1E8 Device \Driver\PCI_NTPNP5262 \Device\00000051 sptd.sys Device \Driver\usbehci \Device\USBPDO-1 8AA0A1E8 Device \Driver\NetBT \Device\NetBT_Tcpip_{97A52C02-61E4-4789-8D03-99708175597F} 8A7DE518 Device \Driver\Ftdisk \Device\HarddiskVolume1 8ACC51E8 Device \Driver\Ftdisk \Device\HarddiskVolume2 8ACC51E8 Device \Driver\Cdrom \Device\CdRom0 8AA031E8 Device \Driver\nvata \Device\00000072 8ACC41E8 Device \Driver\Ftdisk \Device\HarddiskVolume3 8ACC51E8 Device \Driver\Cdrom \Device\CdRom1 8AA031E8 Device \Driver\nvata \Device\00000073 8ACC41E8 Device \Driver\Cdrom \Device\CdRom2 8AA031E8 Device \Driver\nvata \Device\00000076 8ACC41E8 Device \Driver\NetBT \Device\NetBt_Wins_Export 8A7DE518 Device \Driver\NetBT \Device\NetbiosSmb 8A7DE518 Device \Driver\usbohci \Device\USBFDO-0 8AA3C1E8 Device \Driver\usbehci \Device\USBFDO-1 8AA0A1E8 Device \Driver\nvata \Device\NvAta0 8ACC41E8 Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver 8A7FD5F8 Device \Driver\nvata \Device\NvAta1 8ACC41E8 Device \FileSystem\MRxSmb \Device\LanmanRedirector 8A7FD5F8 Device \Driver\Ftdisk \Device\FtControl 8ACC51E8 Device \Driver\a1yt9qn2 \Device\Scsi\a1yt9qn21 8A93E410 Device \Driver\a1yt9qn2 \Device\Scsi\a1yt9qn21Port4Path0Target0Lun0 8A93E410 Device \FileSystem\Cdfs \Cdfs 8A9F91E8 ---- Services - GMER 1.0.14 ---- Service \\?\globalroot\systemroot\system32\drivers\TDSSldgoafrk.sys (*** hidden *** ) [SYSTEM] TDSSserv.sys <-- ROOTKIT !!! ---- Registry - GMER 1.0.14 ---- Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s1 771343423 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s2 285507792 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@h0 1 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@p0 C:\Program Files\Alcohol Soft\Alcohol 120\ Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@h0 0 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@ujdew 0x18 0x78 0xD2 0x14 ... Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001@a0 0x20 0x01 0x00 0x00 ... Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001@ujdew 0x94 0x9F 0x3D 0x06 ... Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001\jdgg40 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001\jdgg40@ujdew 0xFC 0xA9 0x01 0xF1 ... Reg HKLM\SYSTEM\CurrentControlSet\Services\TDSSserv.sys@start 1 Reg HKLM\SYSTEM\CurrentControlSet\Services\TDSSserv.sys@type 1 Reg HKLM\SYSTEM\CurrentControlSet\Services\TDSSserv.sys@imagepath \\?\globalroot\systemroot\system32\drivers\TDSSldgoafrk.sys Reg HKLM\SYSTEM\CurrentControlSet\Services\TDSSserv.sys@group file system Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04 Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@p0 C:\Program Files\Alcohol Soft\Alcohol 120\ Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@h0 0 Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@ujdew 0x18 0x78 0xD2 0x14 ... Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001 Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001@a0 0x20 0x01 0x00 0x00 ... Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001@ujdew 0x94 0x9F 0x3D 0x06 ... Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001\jdgg40 Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001\jdgg40@ujdew 0xFC 0xA9 0x01 0xF1 ... Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04 Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@p0 C:\Program Files\Alcohol Soft\Alcohol 120\ Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@h0 0 Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@ujdew 0x18 0x78 0xD2 0x14 ... Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001 Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001@a0 0x20 0x01 0x00 0x00 ... Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001@ujdew 0x94 0x9F 0x3D 0x06 ... Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001\jdgg40 Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001\jdgg40@ujdew 0xFC 0xA9 0x01 0xF1 ... Reg HKLM\SYSTEM\ControlSet003\Services\TDSSserv.sys@start 1 Reg HKLM\SYSTEM\ControlSet003\Services\TDSSserv.sys@type 1 Reg HKLM\SYSTEM\ControlSet003\Services\TDSSserv.sys@imagepath \\?\globalroot\systemroot\system32\drivers\TDSSldgoafrk.sys Reg HKLM\SYSTEM\ControlSet003\Services\TDSSserv.sys@group file system Reg HKLM\SOFTWARE\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32 Reg HKLM\SOFTWARE\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32@ThreadingModel Apartment Reg HKLM\SOFTWARE\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL Reg HKLM\SOFTWARE\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32@cd042efbbd7f7af1647644e76e06692b 0xC8 0x28 0x51 0xAF ... Reg HKLM\SOFTWARE\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32 Reg HKLM\SOFTWARE\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32@ThreadingModel Apartment Reg HKLM\SOFTWARE\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL Reg HKLM\SOFTWARE\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32@bca643cdc5c2726b20d2ecedcc62c59b 0x6A 0x9C 0xD6 0x61 ... Reg HKLM\SOFTWARE\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32 Reg HKLM\SOFTWARE\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32@ThreadingModel Apartment Reg HKLM\SOFTWARE\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL Reg HKLM\SOFTWARE\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32@2c81e34222e8052573023a60d06dd016 0xFF 0x7C 0x85 0xE0 ... Reg HKLM\SOFTWARE\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32 Reg HKLM\SOFTWARE\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32@ThreadingModel Apartment Reg HKLM\SOFTWARE\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL Reg HKLM\SOFTWARE\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32@2582ae41fb52324423be06337561aa48 0x86 0x8C 0x21 0x01 ... Reg HKLM\SOFTWARE\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32 Reg HKLM\SOFTWARE\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32@ThreadingModel Apartment Reg HKLM\SOFTWARE\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL Reg HKLM\SOFTWARE\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32@caaeda5fd7a9ed7697d9686d4b818472 0xF5 0x1D 0x4D 0x73 ... Reg HKLM\SOFTWARE\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32 Reg HKLM\SOFTWARE\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32@ThreadingModel Apartment Reg HKLM\SOFTWARE\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL Reg HKLM\SOFTWARE\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32@a4a1bcf2cc2b8bc3716b74b2b4522f5d 0xB0 0x18 0xED 0xA7 ... Reg HKLM\SOFTWARE\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32 Reg HKLM\SOFTWARE\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32@ThreadingModel Apartment Reg HKLM\SOFTWARE\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL Reg HKLM\SOFTWARE\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32@4d370831d2c43cd13623e232fed27b7b 0x97 0x20 0x4E 0x9A ... Reg HKLM\SOFTWARE\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32 Reg HKLM\SOFTWARE\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32@ThreadingModel Apartment Reg HKLM\SOFTWARE\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL Reg HKLM\SOFTWARE\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32@1d68fe701cdea33e477eb204b76f993d 0x83 0x6C 0x56 0x8B ... Reg HKLM\SOFTWARE\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32 Reg HKLM\SOFTWARE\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32@ThreadingModel Apartment Reg HKLM\SOFTWARE\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL Reg HKLM\SOFTWARE\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32@1fac81b91d8e3c5aa4b0a51804d844a3 0x51 0xFA 0x6E 0x91 ... Reg HKLM\SOFTWARE\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32 Reg HKLM\SOFTWARE\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32@ThreadingModel Apartment Reg HKLM\SOFTWARE\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL Reg HKLM\SOFTWARE\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32@f5f62a6129303efb32fbe080bb27835b 0x3D 0xCE 0xEA 0x26 ... Reg HKLM\SOFTWARE\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32 Reg HKLM\SOFTWARE\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32@ThreadingModel Apartment Reg HKLM\SOFTWARE\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL Reg HKLM\SOFTWARE\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32@fd4e2e1a3940b94dceb5a6a021f2e3c6 0xE3 0x0E 0x66 0xD5 ... Reg HKLM\SOFTWARE\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32 Reg HKLM\SOFTWARE\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32@ThreadingModel Apartment Reg HKLM\SOFTWARE\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL Reg HKLM\SOFTWARE\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32@8a8aec57dd6508a385616fbc86791ec2 0x6C 0x43 0x2D 0x1E ... ---- Files - GMER 1.0.14 ---- ADS C:\WINDOWS\system32\svchost.exe:ext.exe 25088 bytes executable <-- ROOTKIT !!! ---- Services - GMER 1.0.14 ---- Service C:\WINDOWS\system32\svchost.exe:ext.exe [AUTO] FCI <-- ROOTKIT !!! ---- EOF - GMER 1.0.14 ---- |
|
     |
| Important Information |
|
Join the #1 Tech Support Forum Today - It's Totally Free!
TechSupportForum.com is a leading support website for your computer needs. We offer free, friendly and personalized computer support. Why pay to have your computer fixed when you can do it for free. Join TechSupportforum.com Today - Click Here |
|
12-05-2008, 12:43 AM
|
#2 (permalink) |
|
Registered User
Join Date: Dec 2008
Posts: 9
OS: XP
|
Re: Multiple trojans found by AV but they reappear after AV "cleans" them
Reread the stickys. Here are updated logs.
Thanks for your time. DDS (Version 1.0) - NTFSx86 Run by Sordavie at 2:36:04.48 on Fri 12/05/2008 Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.3070.2579 [GMT -5:00] ============== Running Processes =============== C:\WINDOWS\system32\svchost -k DcomLaunch svchost.exe C:\WINDOWS\System32\svchost.exe -k netsvcs C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup svchost.exe svchost.exe C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe C:\WINDOWS\system32\spoolsv.exe C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe svchost.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\PnkBstrA.exe C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe c:\WINDOWS\system32\ZuneBusEnum.exe C:\PROGRA~1\AVG\AVG8\avgrsx.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Java\jre6\bin\jusched.exe C:\PROGRA~1\AVG\AVG8\avgtray.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\Zune\ZuneLauncher.exe C:\WINDOWS\system32\rundll32.exe C:\Program Files\Razer Barracuda AC-1 Gaming Audio Card\Customapp\PROGRAM\RAZER BARRACUDA AC-1 GAMING AUDIO CARD.EXE C:\FRAPS\FRAPS.EXE C:\Program Files\Logitech\SetPoint\SetPoint.exe C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE C:\Documents and Settings\Sordavie\Desktop\dds.com ============== Pseudo HJT Report =============== uStart Page = about:blank BHO: {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - c:\program files\avg\avg8\avgssie.dll BHO: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\program files\java\jre6\bin\ssv.dll BHO: {DBC80044-A445-435b-BC74-9C25C1C588A9} - c:\program files\java\jre6\bin\jp2ssv.dll BHO: {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll uRun: [Aim6] "c:\program files\aim6\aim6.exe" /d locale=en-US ee://aol/imApp uRun: [SUPERAntiSpyware] c:\program files\superantispyware\SUPERAntiSpyware.exe uRun: [Fraps] c:\fraps\FRAPS.EXE mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup mRun: [nwiz] nwiz.exe /install mRun: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE mRun: [Cmaudio8788] RunDll32 cmicnfgp.cpl,CMICtrlWnd mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe" mRun: [AVG8_TRAY] c:\progra~1\avg\avg8\avgtray.exe mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit mRun: [Zune Launcher] "c:\program files\zune\ZuneLauncher.exe" mRun: [Wcujolet] rundll32.exe "c:\windows\Eloheja.dll",e mRun: [Mnadiqurejadan] rundll32.exe "c:\windows\emobabuyu.dll",e StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\logite~1.lnk - c:\program files\logitech\setpoint\SetPoint.exe IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000 IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe TCP: {97A52C02-61E4-4789-8D03-99708175597F} = 192.168.0.1 Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg8\avgpp.dll Notify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.dll Notify: hseihuu - hseihuu.dll Notify: LBTWlgn - c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll AppInit_DLLs: avgrsstx.dll SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll SEH: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - c:\program files\superantispyware\SASSEH.DLL ============= SERVICES / DRIVERS =============== R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2008-5-28 97928] R1 AvgMfx86;AVG On-access Scanner Minifilter Driver x86;c:\windows\system32\drivers\avgmfx86.sys [2008-1-19 26824] R1 SASDIFSV;SASDIFSV;\??\c:\program files\superantispyware\SASDIFSV.SYS [2008-11-17 8944] R1 SASKUTIL;SASKUTIL;\??\c:\program files\superantispyware\SASKUTIL.sys [2008-11-17 55024] R2 aawservice;Lavasoft Ad-Aware Service;"c:\program files\lavasoft\ad-aware\aawservice.exe" [2008-7-7 611664] R2 avg8wd;AVG8 WatchDog;c:\progra~1\avg\avg8\avgwdsvc.exe [2008-5-28 231704] R3 cmudaxp;Razer Barracuda AC-1 Gaming Interface;c:\windows\system32\drivers\cmudaxp.sys [2008-2-2 1423360] R3 OmniTV;Cx2388x AvStream Video Capture;c:\windows\system32\drivers\OmniTV.sys [2007-9-3 401280] R3 SASENUM;SASENUM;\??\c:\program files\superantispyware\SASENUM.SYS [2008-11-17 7408] S0 ati3unxx;ati3unxx;c:\windows\system32\drivers\ati3unxx.sys [] S2 FCI;FCI;c:\windows\system32\svchost.exe:ext.exe [] S3 ALSysIO;ALSysIO;\??\c:\docume~1\sordavie\locals~1\temp\ALSysIO.sys [] S3 ati6atxx;ati6atxx;\??\c:\windows\system32\drivers\ati6atxx.sys [] S3 OnAirGtSvc;OnAir GT USB HDTV Capture (ATSC/NTSC);c:\windows\system32\drivers\OnAirGt.sys [2008-2-10 98192] S3 restore;restore;\??\c:\windows\system32\drivers\restore.sys [] =============== Created Last 30 ================ 2008-12-05 01:59 3,144 ac------ c:\windows\system32\dllcache\srgb.icm 2008-12-04 22:27 250 a------- c:\windows\gmer.ini 2008-12-04 11:42 132,608 a------- c:\windows\emobabuyu.dll 2008-12-04 11:36 <DIR> --d----- c:\docume~1\alluse~1\applic~1\SUPERAntiSpyware.com 2008-12-04 11:35 <DIR> --d----- c:\program files\SUPERAntiSpyware 2008-12-04 11:35 <DIR> --d----- c:\docume~1\sordavie\applic~1\SUPERAntiSpyware.com 2008-12-04 03:41 102,664 a------- c:\windows\system32\drivers\tmcomm.sys 2008-12-04 03:26 6,182 a------- c:\windows\live.com-error.html 2008-12-04 03:26 2,258 a------- c:\windows\search.yahoo.com-error.html 2008-12-04 03:26 103,936 a------- C:\dtqlv.exe 2008-12-04 03:26 2,274 a------- c:\windows\system32\TDSSdbamnavx.dll 2008-12-04 03:26 2 a------- C:\414080910 2008-12-04 03:26 39,424 a------- c:\windows\Eloheja.dll 2008-12-04 03:26 39,424 a------- C:\bmwife.exe 2008-12-04 03:24 <DIR> --d----- c:\windows\Easy Decrypter 2008-12-04 03:24 <DIR> --d----- c:\program files\Easy Decrypter 2008-12-03 18:18 410,984 a------- c:\windows\system32\deploytk.dll 2008-12-01 15:51 221,184 a------- c:\windows\system32\wmpns.dll 2008-12-01 15:32 <DIR> --d----- c:\windows\system32\scripting 2008-12-01 15:32 <DIR> --d----- c:\windows\l2schemas 2008-12-01 15:32 <DIR> --d----- c:\windows\system32\en 2008-12-01 15:32 <DIR> --d----- c:\windows\system32\bits 2008-12-01 15:30 <DIR> --d----- c:\windows\ServicePackFiles 2008-12-01 15:27 <DIR> --d----- c:\windows\EHome 2008-11-12 18:52 455,296 -c------ c:\windows\system32\dllcache\mrxsmb.sys ==================== Find3M ==================== 2008-12-05 02:10 <DIR> --d----- c:\program files\DVDFab Platinum 3 2008-12-05 02:03 <DIR> --d----- c:\program files\BitComet 2008-12-05 02:00 <DIR> --d----- c:\program files\uTorrent 2008-12-05 02:00 <DIR> --d----- c:\docume~1\sordavie\applic~1\uTorrent 2008-12-04 11:35 <DIR> --d----- c:\program files\common files\Wise Installation Wizard 2008-12-04 03:26 14,336 a------- c:\windows\system32\svchost.exe 2008-12-01 15:34 <DIR> --d----- c:\program files\Messenger 2008-12-01 15:33 76,487 a------- c:\windows\pchealth\helpctr\offlinecache\index.dat 2008-12-01 15:30 <DIR> --d----- c:\program files\Windows NT 2008-11-08 18:08 <DIR> --d----- c:\program files\Xfire 2008-11-07 21:45 <DIR> --d----- c:\docume~1\sordavie\applic~1\Xfire 2008-11-07 21:07 183,128 a------- c:\windows\system32\PnkBstrB.exe 2008-10-29 20:24 42,320 a------- c:\windows\system32\xfcodec.dll 2008-10-29 02:00 <DIR> --d----- c:\program files\MSXML 6.0 2008-10-28 21:03 <DIR> --d----- c:\program files\Bethesda Softworks 2008-10-28 20:57 107,888 a------- c:\windows\system32\CmdLineExt.dll 2008-10-20 20:35 <DIR> --d----- c:\program files\Yahoo! 2008-10-16 14:06 268,648 a------- c:\windows\system32\mucltui.dll 2008-10-16 14:06 208,744 a------- c:\windows\system32\muweb.dll 2008-09-30 16:43 1,286,152 a------- c:\windows\system32\msxml4.dll 2008-09-15 07:12 1,846,400 a------- c:\windows\system32\win32k.sys 2008-09-09 20:14 1,307,648 a------- c:\windows\system32\msxml6.dll 2008-08-25 23:09 <DIR> --d----- c:\docume~1\sordavie\applic~1\Any Video Converter 2008-08-07 04:12 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Viewpoint 2008-07-28 00:08 <DIR> --d----- c:\docume~1\alluse~1\applic~1\acccore 2008-05-28 14:45 <DIR> --d----- c:\docume~1\alluse~1\applic~1\avg8 2008-02-10 14:19 <DIR> --d----- c:\docume~1\sordavie\applic~1\OnAirSolution 2008-01-25 06:55 <DIR> --d----- c:\docume~1\alluse~1\applic~1\NVIDIA Corporation ============= FINISH: 2:36:18.20 =============== Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 2:38:08 AM, on 12/5/2008 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16735) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe C:\WINDOWS\system32\spoolsv.exe C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\PnkBstrA.exe C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe c:\WINDOWS\system32\ZuneBusEnum.exe C:\PROGRA~1\AVG\AVG8\avgrsx.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Java\jre6\bin\jusched.exe C:\PROGRA~1\AVG\AVG8\avgtray.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\Zune\ZuneLauncher.exe C:\WINDOWS\system32\rundll32.exe C:\Program Files\Razer Barracuda AC-1 Gaming Audio Card\Customapp\PROGRAM\RAZER BARRACUDA AC-1 GAMING AUDIO CARD.EXE C:\FRAPS\FRAPS.EXE C:\Program Files\Logitech\SetPoint\SetPoint.exe C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE C:\WINDOWS\system32\notepad.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE O4 - HKLM\..\Run: [Cmaudio8788] RunDll32 cmicnfgp.cpl,CMICtrlWnd O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [Zune Launcher] "c:\Program Files\Zune\ZuneLauncher.exe" O4 - HKLM\..\Run: [Wcujolet] rundll32.exe "C:\WINDOWS\Eloheja.dll",e O4 - HKLM\..\Run: [Mnadiqurejadan] rundll32.exe "C:\WINDOWS\emobabuyu.dll",e O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe O4 - HKCU\..\Run: [Fraps] C:\FRAPS\FRAPS.EXE O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/su/ocx/15031/CTSUEng.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/wind...?1200726816937 O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/ge...sh/swflash.cab O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su/ocx/15034/CTPID.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{97A52C02-61E4-4789-8D03-99708175597F}: NameServer = 192.168.0.1 O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll O20 - AppInit_DLLs: avgrsstx.dll O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll O20 - Winlogon Notify: hseihuu - hseihuu.dll (file missing) O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe O23 - Service: FCI - Unknown owner - C:\WINDOWS\system32\svchost.exe:ext.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe -- End of file - 6126 bytes |
|
|
|
|
12-05-2008, 07:33 AM
|
#3 (permalink) |
|
Assistant Manager, TSF Academy; Moderator/Analyst Security Team
Join Date: Jan 2005
Location: Ohio
Posts: 26,606
OS: WinXP and Vista
|
Re: Multiple trojans found by AV but they reappear after AV "cleans" them
Hello sordavie and welcome,
Thank you for posting the required logs. It will require more than one round to properly clean your system. Please stay with me until given the 'all clear' even if symptoms seemingly abate. Read through this entire procedure and if you have any questions, please ask them before you begin. Then either print out, or copy this page to Notepad and save to your desktop for reference as you will not have any browsers open while you are carrying out portions of these instructions. *************************************************** Download ComboFix from one of these locations: Link 1 Link 2 Link 3 * IMPORTANT - Save ComboFix.exe to your Desktop
**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.  Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:  Click on Yes, to continue scanning for malware. When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply. |
|
|
|
|
12-05-2008, 12:19 PM
|
#4 (permalink) |
|
Registered User
Join Date: Dec 2008
Posts: 9
OS: XP
|
Re: Multiple trojans found by AV but they reappear after AV "cleans" them
Hi Ried,
Thank you for donating your time to help me out. I really appreciate it. I'll be sure to follow all your instructions to the letter. Here's the ComboFix log. ComboFix 08-12-05.01 - Sordavie 2008-12-05 14:10:08.1 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.2479 [GMT -5:00] Running from: c:\documents and settings\Sordavie\Desktop\ComboFix.exe * Created a new restore point . ADS - svchost.exe: deleted 25088 bytes in 1 streams. ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_FCI -------\Legacy_TDSSSERV.SYS -------\Service_FCI -------\Service_restore -------\Service_TDSSserv.sys ((((((((((((((((((((((((( Files Created from 2008-11-05 to 2008-12-05 ))))))))))))))))))))))))))))))) . 2008-12-05 01:59 . 2001-07-21 14:40 3,144 --a--c--- c:\windows\system32\dllcache\srgb.icm 2008-12-04 22:27 . 2008-12-05 02:26 250 --a------ c:\windows\gmer.ini 2008-12-04 11:42 . 2008-12-04 11:42 132,608 --a------ c:\windows\emobabuyu.dll 2008-12-04 11:36 . 2008-12-04 11:36 <DIR> d-------- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com 2008-12-04 11:35 . 2008-12-04 11:35 <DIR> d-------- c:\program files\SUPERAntiSpyware 2008-12-04 11:35 . 2008-12-04 11:35 <DIR> d-------- c:\documents and settings\Sordavie\Application Data\SUPERAntiSpyware.com 2008-12-04 03:41 . 2008-12-04 03:40 102,664 --a------ c:\windows\system32\drivers\tmcomm.sys 2008-12-04 03:40 . 2008-12-04 06:09 <DIR> d-------- c:\documents and settings\Administrator\.housecall6.6 2008-12-04 03:31 . 2008-12-04 03:40 <DIR> d-------- c:\documents and settings\Administrator 2008-12-04 03:26 . 2008-12-04 03:26 103,936 --a------ C:\dtqlv.exe 2008-12-04 03:26 . 2008-12-04 03:26 39,424 --a------ c:\windows\Eloheja.dll 2008-12-04 03:26 . 2008-12-04 03:26 39,424 --a------ C:\bmwife.exe 2008-12-04 03:26 . 2008-12-04 03:26 6,182 --a------ c:\windows\live.com-error.html 2008-12-04 03:26 . 2008-12-04 03:26 2,274 --a------ c:\windows\system32\TDSSdbamnavx.dll 2008-12-04 03:26 . 2008-12-04 03:26 2,258 --a------ c:\windows\search.yahoo.com-error.html 2008-12-04 03:26 . 2008-12-04 03:26 2 --a------ C:\414080910 2008-12-04 03:24 . 2008-12-04 03:24 <DIR> d-------- c:\windows\Easy Decrypter 2008-12-04 03:24 . 2008-12-04 03:24 <DIR> d-------- c:\program files\Easy Decrypter 2008-12-03 18:18 . 2008-12-03 18:18 410,984 --a------ c:\windows\system32\deploytk.dll 2008-12-01 15:51 . 2006-02-28 07:00 221,184 --a------ c:\windows\system32\wmpns.dll 2008-12-01 15:32 . 2008-12-01 15:32 <DIR> d-------- c:\windows\system32\scripting 2008-12-01 15:32 . 2008-12-01 15:32 <DIR> d-------- c:\windows\system32\en 2008-12-01 15:32 . 2008-12-01 15:32 <DIR> d-------- c:\windows\system32\bits 2008-12-01 15:32 . 2008-12-01 15:32 <DIR> d-------- c:\windows\l2schemas 2008-12-01 15:30 . 2008-12-01 15:30 <DIR> d-------- c:\windows\ServicePackFiles 2008-12-01 15:27 . 2008-12-01 15:27 <DIR> d-------- c:\windows\EHome 2008-11-12 18:52 . 2008-10-24 06:21 455,296 -----c--- c:\windows\system32\dllcache\mrxsmb.sys . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-12-05 19:13 --------- d---a-w c:\documents and settings\All Users\Application Data\TEMP 2008-12-05 07:13 --------- d-----w c:\program files\MSBuild 2008-12-05 07:13 --------- d-----w c:\documents and settings\All Users\Application Data\Microsoft Help 2008-12-05 07:10 87,608 ----a-w c:\documents and settings\Sordavie\Application Data\ezpinst.exe 2008-12-05 07:10 47,360 ----a-w c:\documents and settings\Sordavie\Application Data\pcouffin.sys 2008-12-05 07:10 --------- d-----w c:\program files\DVDFab Platinum 3 2008-12-05 07:10 --------- d-----w c:\documents and settings\Sordavie\Application Data\Vso 2008-12-05 07:08 --------- d-----w c:\program files\Common Files\Adobe 2008-12-05 07:03 --------- d-----w c:\program files\BitComet 2008-12-05 07:00 --------- d-----w c:\program files\uTorrent 2008-12-05 07:00 --------- d-----w c:\documents and settings\Sordavie\Application Data\uTorrent 2008-12-04 16:35 --------- d-----w c:\program files\Common Files\Wise Installation Wizard 2008-12-04 06:54 --------- d-----w c:\program files\Trillian 2008-12-03 23:18 --------- d-----w c:\program files\Java 2008-11-08 23:08 --------- d-----w c:\program files\Xfire 2008-11-08 02:45 --------- d-----w c:\documents and settings\Sordavie\Application Data\Xfire 2008-11-08 02:08 138,464 ----a-w c:\windows\system32\drivers\PnkBstrK.sys 2008-11-06 18:04 --------- d-----w c:\documents and settings\Sordavie\Application Data\OpenOffice.org2 2008-10-29 07:00 --------- d-----w c:\program files\MSXML 6.0 2008-10-29 02:03 --------- d--h--w c:\program files\InstallShield Installation Information 2008-10-29 02:03 --------- d-----w c:\program files\Bethesda Softworks 2008-10-29 02:03 --------- d-----w c:\documents and settings\All Users\Application Data\Fallout3 2008-10-29 02:00 --------- d-----w c:\program files\Reference Assemblies 2008-10-24 11:21 455,296 ----a-w c:\windows\system32\drivers\mrxsmb.sys 2008-10-21 01:37 --------- d-----w c:\documents and settings\All Users\Application Data\Yahoo! 2008-10-21 01:35 --------- d-----w c:\program files\Yahoo! 2008-10-05 23:53 --------- d-----w c:\program files\Defraggler 2008-01-20 20:46 22,328 ----a-w c:\documents and settings\Sordavie\Application Data\PnkBstrK.sys 2007-11-20 01:28 714,775,323 ----a-w c:\documents and settings\Sordavie\PoE2-v2.1.0.0.exe . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Aim6"="c:\program files\AIM6\aim6.exe" [2008-06-19 50528] "SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2008-11-17 1805552] "Fraps"="c:\fraps\FRAPS.EXE" [2008-01-14 913064] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-05-16 13529088] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-12-03 136600] "AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2008-11-27 1261336] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-05-16 86016] "Zune Launcher"="c:\program files\Zune\ZuneLauncher.exe" [2008-04-29 158624] "Wcujolet"="c:\windows\Eloheja.dll" [2008-12-04 39424] "Mnadiqurejadan"="c:\windows\emobabuyu.dll" [2008-12-04 132608] "nwiz"="nwiz.exe" [2008-05-16 c:\windows\system32\nwiz.exe] "Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2008-02-29 c:\windows\KHALMNPR.Exe] c:\documents and settings\All Users\Start Menu\Programs\Startup\ Logitech SetPoint.lnk - c:\program files\Logitech\SetPoint\SetPoint.exe [2008-01-19 805392] [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks] "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon] 2008-07-23 15:28 352256 c:\program files\SUPERAntiSpyware\SASWINLO.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn] 2008-05-02 01:42 72208 c:\program files\Common Files\Logishrd\Bluetooth\LBTWLgn.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=avgrsstx.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "VIDC.XFR1"= xfcodec.dll "msacm.l3fhg"= mp3fhg.acm "msacm.divxa32"= divxa32.acm "VIDC.X264"= x264vfw.dll "VIDC.HFYU"= huffyuv.dll "vidc.i263"= i263_32.drv [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ati3unxx.sys] @="Driver" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ati6atxx.sys] @="Driver" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys] @="Driver" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup] @="" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AlcoholAutomount] --a------ 2007-07-02 05:29 220544 c:\program files\Alcohol Soft\Alcohol 120\AxCmd.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter] --a------ 2008-05-16 13:01 86016 c:\windows\system32\nvmctray.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PMCRemote] --------- 2007-08-07 08:03 257096 c:\program files\Pinnacle\Shared Files\Programs\Remote\remoterm.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam] --a------ 2008-01-19 22:13 1266936 c:\program files\Steam\Steam.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Wcujolet] --a------ 2008-12-04 03:26 39424 c:\windows\Eloheja.dll [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\Xfire\\xfire.exe"= "c:\\Program Files\\uTorrent\\uTorrent.exe"= "c:\\Program Files\\WatchHDTV\\WatchHDTVInfo.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\EA GAMES\\Battlefield 2\\BF2.exe"= "c:\\Program Files\\THQ\\Dawn Of War\\W40k.exe"= "c:\\Program Files\\THQ\\Dawn Of War\\W40kWA.exe"= "c:\\Program Files\\THQ\\DarkCrusade\\DarkCrusade.exe"= "c:\\WINDOWS\\system32\\PnkBstrA.exe"= "c:\\WINDOWS\\system32\\PnkBstrB.exe"= "c:\\Program Files\\Trillian\\trillian.exe"= "c:\\Program Files\\AVG\\AVG8\\avgupd.exe"= "c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"= "c:\\Program Files\\AIM6\\aim6.exe"= "c:\\Program Files\\Messenger\\msmsgs.exe"= "c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "16186:TCP"= 16186:TCP:BitComet 16186 TCP "16186:UDP"= 16186:UDP:BitComet 16186 UDP "20925:TCP"= 20925:TCP:BITCOMMET PORT "20925:UDP"= 20925:UDP:BitComet 20925 UDP "6113:TCP"= 6113:TCP:BitComet 6113 TCP "6113:UDP"= 6113:UDP:BitComet 6113 UDP R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\Drivers\avgldx86.sys [2008-05-28 97928] R1 SASDIFSV;SASDIFSV;\??\c:\program files\SUPERAntiSpyware\SASDIFSV.SYS [2008-11-17 8944] R1 SASKUTIL;SASKUTIL;\??\c:\program files\SUPERAntiSpyware\SASKUTIL.sys [2008-11-17 55024] R2 avg8wd;AVG8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2008-05-28 231704] R3 cmudaxp;Razer Barracuda AC-1 Gaming Interface;c:\windows\system32\drivers\cmudaxp.sys [2008-02-02 1423360] R3 OmniTV;Cx2388x AvStream Video Capture;c:\windows\system32\DRIVERS\OmniTV.sys [2007-09-03 401280] R3 SASENUM;SASENUM;\??\c:\program files\SUPERAntiSpyware\SASENUM.SYS [2008-11-17 7408] S0 ati3unxx;ati3unxx;c:\windows\system32\Drivers\ati3unxx.sys [] S3 ALSysIO;ALSysIO;\??\c:\docume~1\Sordavie\LOCALS~1\Temp\ALSysIO.sys [] S3 ati6atxx;ati6atxx;\??\c:\windows\System32\drivers\ati6atxx.sys [] S3 OnAirGtSvc;OnAir GT USB HDTV Capture (ATSC/NTSC);c:\windows\system32\drivers\OnAirGt.sys [2008-02-10 98192] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{A744F16C-B2D5-4138-81A2-085CDFCDE83A}] rundll32 sxmg4.dll,InitModule . - - - - ORPHANS REMOVED - - - - HKLM-Run-Cmaudio8788 - cmicnfgp.cpl Notify-hseihuu - hseihuu.dll MSConfigStartUp-Acrobat Assistant 7 - c:\program files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe MSConfigStartUp-GrooveMonitor - c:\program files\Microsoft Office\Office12\GrooveMonitor.exe MSConfigStartUp-rs32net - c:\windows\System32\rs32net.exe MSConfigStartUp-CTHelper - CTHELPER.EXE MSConfigStartUp-CTxfiHlp - CTXFIHLP.EXE . ------- Supplementary Scan ------- . uStart Page = about:blank IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000 TCP: {97A52C02-61E4-4789-8D03-99708175597F} = 192.168.0.1 FireFox -: Profile - c:\documents and settings\Sordavie\Application Data\Mozilla\Firefox\Profiles\uev7b638.default\ FireFox -: prefs.js - STARTUP.HOMEPAGE - FF -: plugin - c:\documents and settings\Sordavie\Application Data\Mozilla\Firefox\Profiles\uev7b638.default\extensions\moveplayer@movenetworks.com\platform\WINNT_x86-msvc\plugins\npmnqmp07076007.dll FF -: plugin - c:\program files\Adobe\Acrobat 7.0\Acrobat\browser\nppdf32.dll FF -: plugin - c:\program files\Java\jre6\bin\new_plugin\npdeploytk.dll FF -: plugin - c:\program files\Java\jre6\bin\new_plugin\npjp2.dll FF -: plugin - c:\program files\Mozilla Firefox\plugins\npdeploytk.dll FF -: plugin - c:\program files\Yahoo!\Shared\npYState.dll . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-12-05 14:12:46 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . --------------------- DLLs Loaded Under Running Processes --------------------- - - - - - - - > 'winlogon.exe'(808) c:\program files\SUPERAntiSpyware\SASWINLO.dll c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll c:\program files\common files\logishrd\bluetooth\LBTServ.dll . ------------------------ Other Running Processes ------------------------ . c:\program files\Lavasoft\Ad-Aware\aawservice.exe c:\program files\Java\jre6\bin\jqs.exe c:\windows\system32\nvsvc32.exe c:\windows\system32\PnkBstrA.exe c:\program files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe c:\windows\system32\ZuneBusEnum.exe c:\program files\AVG\AVG8\avgrsx.exe c:\windows\system32\wscntfy.exe c:\program files\Razer Barracuda AC-1 Gaming Audio Card\CustomApp\Program\Razer Barracuda AC-1 Gaming Audio card.exe c:\windows\system32\rundll32.exe c:\windows\system32\rundll32.exe c:\program files\Common Files\Logishrd\KHAL2\KHALMNPR.exe c:\program files\AIM6\aolsoftware.exe . ************************************************************************** . Completion time: 2008-12-05 14:16:25 - machine was rebooted ComboFix-quarantined-files.txt 2008-12-05 19:16:23 Pre-Run: 126,813,655,040 bytes free Post-Run: 129,020,715,008 bytes free WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems] c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect 240 --- E O F --- 2008-12-03 08:00:32 |
|
|
|
|
12-05-2008, 04:38 PM
|
#5 (permalink) | |
|
Assistant Manager, TSF Academy; Moderator/Analyst Security Team
Join Date: Jan 2005
Location: Ohio
Posts: 26,606
OS: WinXP and Vista
|
Re: Multiple trojans found by AV but they reappear after AV "cleans" them
You're welcome. : )
Please copy this page to Notepad and save to your desktop for reference as you will not have any browsers open while you are carrying out portions of these instructions. It's IMPORTANT to carry out the instructions in the sequence listed below. *************************************************** Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix. --------------------------------------------------------------------- Open notepad and copy/paste the text in the code box below into it: Quote:
in the same location as ComboFix.exe  Refering to the picture above, drag CFScript into ComboFix.exe When finished, it shall produce a log for you. Post that log in your next reply. **Note** When CF finishes running, the ComboFix log will open along with a message box--do not be alarmed. With the above script, ComboFix will capture files to submit for analysis.
Please return with the C:\ComboFix.txt for further review. Last edited by Ried; 12-05-2008 at 05:23 PM. Reason: parsed url fixed |
|
|
|
|
|
12-06-2008, 12:20 AM
|
#6 (permalink) |
|
Registered User
Join Date: Dec 2008
Posts: 9
OS: XP
|
Re: Multiple trojans found by AV but they reappear after AV "cleans" them
Hi Ried, I dragged the notepad file, CFScript, with your script into ComboFix.exe and it ran and gave me a log. However, no additional message box opened up along with ComboFix log at the end. I am connected to the internet, but there was nothing about capturing files to submit for analysis. Instead two error windows popped up saying something like "emobabuyu.dll cannot be initialized or cannot be found" and also for Eloheja.dll.
Here's the ComboFix log: ComboFix 08-12-05.02 - Sordavie 2008-12-06 2:05:49.2 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.2608 [GMT -5:00] Running from: c:\documents and settings\Sordavie\Desktop\ComboFix.exe Command switches used :: c:\documents and settings\Sordavie\Desktop\CFScript.txt * Created a new restore point FILE :: c:\windows\live.com-error.html c:\windows\search.yahoo.com-error.html . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\414080910\ C:\bmwife.exe C:\dtqlv.exe c:\windows\Eloheja.dll c:\windows\emobabuyu.dll c:\windows\live.com-error.html c:\windows\search.yahoo.com-error.html c:\windows\system32\TDSSdbamnavx.dll . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_ATI6ATXX -------\Service_ati3unxx -------\Service_ati6atxx ((((((((((((((((((((((((( Files Created from 2008-11-06 to 2008-12-06 ))))))))))))))))))))))))))))))) . 2008-12-05 01:59 . 2001-07-21 14:40 3,144 --a--c--- c:\windows\system32\dllcache\srgb.icm 2008-12-04 22:27 . 2008-12-05 02:26 250 --a------ c:\windows\gmer.ini 2008-12-04 11:36 . 2008-12-04 11:36 <DIR> d-------- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com 2008-12-04 11:35 . 2008-12-04 11:35 <DIR> d-------- c:\program files\SUPERAntiSpyware 2008-12-04 11:35 . 2008-12-04 11:35 <DIR> d-------- c:\documents and settings\Sordavie\Application Data\SUPERAntiSpyware.com 2008-12-04 03:41 . 2008-12-04 03:40 102,664 --a------ c:\windows\system32\drivers\tmcomm.sys 2008-12-04 03:40 . 2008-12-04 06:09 <DIR> d-------- c:\documents and settings\Administrator\.housecall6.6 2008-12-04 03:31 . 2008-12-04 03:40 <DIR> d-------- c:\documents and settings\Administrator 2008-12-04 03:26 . 2008-12-04 03:26 2 --a------ C:\414080910 2008-12-04 03:24 . 2008-12-04 03:24 <DIR> d-------- c:\windows\Easy Decrypter 2008-12-04 03:24 . 2008-12-04 03:24 <DIR> d-------- c:\program files\Easy Decrypter 2008-12-03 18:18 . 2008-12-03 18:18 410,984 --a------ c:\windows\system32\deploytk.dll 2008-12-01 15:51 . 2006-02-28 07:00 221,184 --a------ c:\windows\system32\wmpns.dll 2008-12-01 15:32 . 2008-12-01 15:32 <DIR> d-------- c:\windows\system32\scripting 2008-12-01 15:32 . 2008-12-01 15:32 <DIR> d-------- c:\windows\system32\en 2008-12-01 15:32 . 2008-12-01 15:32 <DIR> d-------- c:\windows\system32\bits 2008-12-01 15:32 . 2008-12-01 15:32 <DIR> d-------- c:\windows\l2schemas 2008-12-01 15:30 . 2008-12-01 15:30 <DIR> d-------- c:\windows\ServicePackFiles 2008-12-01 15:27 . 2008-12-01 15:27 <DIR> d-------- c:\windows\EHome 2008-11-12 18:52 . 2008-10-24 06:21 455,296 -----c--- c:\windows\system32\dllcache\mrxsmb.sys . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-12-06 07:11 --------- d---a-w c:\documents and settings\All Users\Application Data\TEMP 2008-12-05 07:13 --------- d-----w c:\program files\MSBuild 2008-12-05 07:13 --------- d-----w c:\documents and settings\All Users\Application Data\Microsoft Help 2008-12-05 07:10 87,608 ----a-w c:\documents and settings\Sordavie\Application Data\ezpinst.exe 2008-12-05 07:10 47,360 ----a-w c:\documents and settings\Sordavie\Application Data\pcouffin.sys 2008-12-05 07:10 --------- d-----w c:\program files\DVDFab Platinum 3 2008-12-05 07:10 --------- d-----w c:\documents and settings\Sordavie\Application Data\Vso 2008-12-05 07:08 --------- d-----w c:\program files\Common Files\Adobe 2008-12-05 07:03 --------- d-----w c:\program files\BitComet 2008-12-05 07:00 --------- d-----w c:\program files\uTorrent 2008-12-05 07:00 --------- d-----w c:\documents and settings\Sordavie\Application Data\uTorrent 2008-12-04 16:35 --------- d-----w c:\program files\Common Files\Wise Installation Wizard 2008-12-04 06:54 --------- d-----w c:\program files\Trillian 2008-12-03 23:18 --------- d-----w c:\program files\Java 2008-11-08 23:08 --------- d-----w c:\program files\Xfire 2008-11-08 02:45 --------- d-----w c:\documents and settings\Sordavie\Application Data\Xfire 2008-11-08 02:08 138,464 ----a-w c:\windows\system32\drivers\PnkBstrK.sys 2008-11-06 18:04 --------- d-----w c:\documents and settings\Sordavie\Application Data\OpenOffice.org2 2008-10-29 07:00 --------- d-----w c:\program files\MSXML 6.0 2008-10-29 02:03 --------- d--h--w c:\program files\InstallShield Installation Information 2008-10-29 02:03 --------- d-----w c:\program files\Bethesda Softworks 2008-10-29 02:03 --------- d-----w c:\documents and settings\All Users\Application Data\Fallout3 2008-10-29 02:00 --------- d-----w c:\program files\Reference Assemblies 2008-10-24 11:21 455,296 ----a-w c:\windows\system32\drivers\mrxsmb.sys 2008-10-21 01:37 --------- d-----w c:\documents and settings\All Users\Application Data\Yahoo! 2008-10-21 01:35 --------- d-----w c:\program files\Yahoo! 2008-01-20 20:46 22,328 ----a-w c:\documents and settings\Sordavie\Application Data\PnkBstrK.sys 2007-11-20 01:28 714,775,323 ----a-w c:\documents and settings\Sordavie\PoE2-v2.1.0.0.exe . ((((((((((((((((((((((((((((( snapshot@2008-12-05_14.16.08.29 ))))))))))))))))))))))))))))))))))))))))) . + 2008-12-06 07:09:58 16,384 ----atw c:\windows\Temp\Perflib_Perfdata_138.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Aim6"="c:\program files\AIM6\aim6.exe" [2008-06-19 50528] "SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2008-11-17 1805552] "Fraps"="c:\fraps\FRAPS.EXE" [2008-01-14 913064] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-05-16 13529088] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-12-03 136600] "AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2008-11-27 1261336] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-05-16 86016] "Zune Launcher"="c:\program files\Zune\ZuneLauncher.exe" [2008-04-29 158624] "nwiz"="nwiz.exe" [2008-05-16 c:\windows\system32\nwiz.exe] "Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2008-02-29 c:\windows\KHALMNPR.Exe] c:\documents and settings\All Users\Start Menu\Programs\Startup\ Logitech SetPoint.lnk - c:\program files\Logitech\SetPoint\SetPoint.exe [2008-01-19 805392] [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks] "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon] 2008-07-23 15:28 352256 c:\program files\SUPERAntiSpyware\SASWINLO.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn] 2008-05-02 01:42 72208 c:\program files\Common Files\Logishrd\Bluetooth\LBTWLgn.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=avgrsstx.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "VIDC.XFR1"= xfcodec.dll "msacm.l3fhg"= mp3fhg.acm "msacm.divxa32"= divxa32.acm "VIDC.X264"= x264vfw.dll "VIDC.HFYU"= huffyuv.dll "vidc.i263"= i263_32.drv [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys] @="Driver" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup] @="" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter] --a------ 2008-05-16 13:01 86016 c:\windows\system32\nvmctray.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PMCRemote] --------- 2007-08-07 08:03 257096 c:\program files\Pinnacle\Shared Files\Programs\Remote\remoterm.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam] --a------ 2008-01-19 22:13 1266936 c:\program files\Steam\Steam.exe [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\Xfire\\xfire.exe"= "c:\\Program Files\\uTorrent\\uTorrent.exe"= "c:\\Program Files\\WatchHDTV\\WatchHDTVInfo.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\EA GAMES\\Battlefield 2\\BF2.exe"= "c:\\Program Files\\THQ\\Dawn Of War\\W40k.exe"= "c:\\Program Files\\THQ\\Dawn Of War\\W40kWA.exe"= "c:\\Program Files\\THQ\\DarkCrusade\\DarkCrusade.exe"= "c:\\WINDOWS\\system32\\PnkBstrA.exe"= "c:\\WINDOWS\\system32\\PnkBstrB.exe"= "c:\\Program Files\\Trillian\\trillian.exe"= "c:\\Program Files\\AVG\\AVG8\\avgupd.exe"= "c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"= "c:\\Program Files\\AIM6\\aim6.exe"= "c:\\Program Files\\Messenger\\msmsgs.exe"= "c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "16186:TCP"= 16186:TCP:BitComet 16186 TCP "16186:UDP"= 16186:UDP:BitComet 16186 UDP "20925:TCP"= 20925:TCP:BITCOMMET PORT "20925:UDP"= 20925:UDP:BitComet 20925 UDP "6113:TCP"= 6113:TCP:BitComet 6113 TCP "6113:UDP"= 6113:UDP:BitComet 6113 UDP R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\Drivers\avgldx86.sys [2008-05-28 97928] R1 SASDIFSV;SASDIFSV;\??\c:\program files\SUPERAntiSpyware\SASDIFSV.SYS [2008-11-17 8944] R1 SASKUTIL;SASKUTIL;\??\c:\program files\SUPERAntiSpyware\SASKUTIL.sys [2008-11-17 55024] R2 avg8wd;AVG8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2008-05-28 231704] R3 cmudaxp;Razer Barracuda AC-1 Gaming Interface;c:\windows\system32\drivers\cmudaxp.sys [2008-02-02 1423360] R3 OmniTV;Cx2388x AvStream Video Capture;c:\windows\system32\DRIVERS\OmniTV.sys [2007-09-03 401280] R3 SASENUM;SASENUM;\??\c:\program files\SUPERAntiSpyware\SASENUM.SYS [2008-11-17 7408] S3 ALSysIO;ALSysIO;\??\c:\docume~1\Sordavie\LOCALS~1\Temp\ALSysIO.sys [] S3 OnAirGtSvc;OnAir GT USB HDTV Capture (ATSC/NTSC);c:\windows\system32\drivers\OnAirGt.sys [2008-02-10 98192] . - - - - ORPHANS REMOVED - - - - HKLM-Run-Wcujolet - c:\windows\Eloheja.dll HKLM-Run-Mnadiqurejadan - c:\windows\emobabuyu.dll MSConfigStartUp-AlcoholAutomount - c:\program files\Alcohol Soft\Alcohol 120\axcmd.exe MSConfigStartUp-Wcujolet - c:\windows\Eloheja.dll . ------- Supplementary Scan ------- . uStart Page = about:blank IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000 TCP: {97A52C02-61E4-4789-8D03-99708175597F} = 192.168.0.1 FireFox -: Profile - c:\documents and settings\Sordavie\Application Data\Mozilla\Firefox\Profiles\uev7b638.default\ FireFox -: prefs.js - STARTUP.HOMEPAGE - FF -: plugin - c:\documents and settings\Sordavie\Application Data\Mozilla\Firefox\Profiles\uev7b638.default\extensions\moveplayer@movenetworks.com\platform\WINNT_x86-msvc\plugins\npmnqmp07076007.dll FF -: plugin - c:\program files\Adobe\Acrobat 7.0\Acrobat\browser\nppdf32.dll FF -: plugin - c:\program files\Java\jre6\bin\new_plugin\npdeploytk.dll FF -: plugin - c:\program files\Java\jre6\bin\new_plugin\npjp2.dll FF -: plugin - c:\program files\Mozilla Firefox\plugins\npdeploytk.dll FF -: plugin - c:\program files\Yahoo!\Shared\npYState.dll . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-12-06 02:10:27 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . --------------------- DLLs Loaded Under Running Processes --------------------- - - - - - - - > 'winlogon.exe'(804) c:\program files\SUPERAntiSpyware\SASWINLO.dll c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll c:\program files\common files\logishrd\bluetooth\LBTServ.dll . ------------------------ Other Running Processes ------------------------ . c:\program files\Lavasoft\Ad-Aware\aawservice.exe c:\program files\Java\jre6\bin\jqs.exe c:\windows\system32\nvsvc32.exe c:\windows\system32\PnkBstrA.exe c:\windows\system32\ZuneBusEnum.exe c:\program files\AVG\AVG8\avgrsx.exe c:\windows\system32\wscntfy.exe c:\windows\system32\rundll32.exe c:\program files\Common Files\Logishrd\KHAL2\KHALMNPR.exe c:\program files\AIM6\aolsoftware.exe . ************************************************************************** . Completion time: 2008-12-06 2:13:53 - machine was rebooted ComboFix-quarantined-files.txt 2008-12-06 07:13:50 ComboFix2.txt 2008-12-05 19:16:26 Pre-Run: 129,012,015,104 bytes free Post-Run: 129,005,744,128 bytes free 219 --- E O F --- 2008-12-03 08:00:32 |
|
|
|
|
12-06-2008, 04:35 PM
|
#7 (permalink) |
|
Assistant Manager, TSF Academy; Moderator/Analyst Security Team
Join Date: Jan 2005
Location: Ohio
Posts: 26,606
OS: WinXP and Vista
|
Re: Multiple trojans found by AV but they reappear after AV "cleans" them
Hello sordavie,
Please visit this sitecopy paste the following bolded text into the 'browse to file to submit' box: [4]-Submit_2008-12-06@2:05.zip Click 'Send File' -------------------------------------------- Using 'My Computer', navigate to and delete the following Files (Right click and select 'Delete'): C:\414080910 -------------------------------------------- It's important to run this online scan to search for any remnants. It can take some time, so please be patient and allow it to run it's full course: Using Internet Explorer or Firefox, visit http://www.kaspersky.com/kos/eng/par...avwebscan.html 1. Click Accept, when prompted to download and install the program files and database of malware definitions. 2. To optimize scanning time and produce a more sensible report for review:
3. Click Run at the Security prompt. The program will then begin downloading and installing and will also update the database. Please be patient as this can take several minutes.
How is the system behaving now? Last edited by Ried; 12-06-2008 at 04:41 PM. |
|
|
|
|
12-06-2008, 05:17 PM
|
#8 (permalink) |
|
Registered User
Join Date: Dec 2008
Posts: 9
OS: XP
|
Re: Multiple trojans found by AV but they reappear after AV "cleans" them
Hi Ried, when I type in [4]-Submit_2008-12-06@2:05.zip to 'Browse the file you want to submit' it gives me the error that [4]-Submit_2008-12-06@2:05.zip is an invalid file name.
|
|
|
|
|
12-06-2008, 05:32 PM
|
#9 (permalink) |
|
Assistant Manager, TSF Academy; Moderator/Analyst Security Team
Join Date: Jan 2005
Location: Ohio
Posts: 26,606
OS: WinXP and Vista
|
Re: Multiple trojans found by AV but they reappear after AV "cleans" them
My apologies, I cut off the path
 I'm going to have you browse to the file to be sure we have the file name correct as well. Go to that site again, and click the 'browse to file' Browse to C:\Qoobox\Quarantine\ and in that folder you will see a [4]-Submit_<date and time>.zip That's the file you want to 'Send' |
|
|
|
|
12-06-2008, 07:52 PM
|
#12 (permalink) |
|
Registered User
Join Date: Dec 2008
Posts: 9
OS: XP
|
Re: Multiple trojans found by AV but they reappear after AV "cleans" them
Here's the Kaspersky report
-------------------------------------------------------------------------------- KASPERSKY ONLINE SCANNER 7 REPORT Saturday, December 6, 2008 Operating System: Microsoft Windows XP Home Edition Service Pack 3 (build 2600) Kaspersky Online Scanner 7 version: 7.0.25.0 Program database last update: Saturday, December 06, 2008 19:53:45 Records in database: 1440831 -------------------------------------------------------------------------------- Scan settings: Scan using the following database: extended Scan archives: yes Scan mail databases: yes Scan area - My Computer: C:\ D:\ E:\ F:\ G:\ Scan statistics: Files scanned: 143474 Threat name: 4 Infected objects: 10 Suspicious objects: 0 Duration of the scan: 02:08:38 File name / Threat name / Threats count C:\Documents and Settings\Administrator\.housecall6.6\Quarantine\sxmg4.dll.bac_a00904 Infected: Trojan-Downloader.Win32.FraudLoad.vdxo 1 C:\Documents and Settings\Sordavie\My Documents\OLD FIREFOX DL\174106.exe Infected: not-a-virus:AdWare.Win32.NewDotNet 1 C:\Documents and Settings\Sordavie\My Documents\OLD FIREFOX DL\174106.exe Infected: not-a-virus:WebToolbar.Win32.WhenU.a 1 C:\Documents and Settings\Sordavie\My Documents\OLD FIREFOX DL\174106.exe Infected: not-a-virus:AdWare.Win32.Relevant.a 1 C:\Documents and Settings\Sordavie\My Documents\OLD FIREFOX DL\174259.exe Infected: not-a-virus:AdWare.Win32.NewDotNet 1 C:\Documents and Settings\Sordavie\My Documents\OLD FIREFOX DL\174259.exe Infected: not-a-virus:WebToolbar.Win32.WhenU.a 1 C:\Documents and Settings\Sordavie\My Documents\OLD FIREFOX DL\174259.exe Infected: not-a-virus:AdWare.Win32.Relevant.a 1 C:\Documents and Settings\Sordavie\My Documents\OLD FIREFOX DL\174544.exe Infected: not-a-virus:AdWare.Win32.NewDotNet 1 C:\Documents and Settings\Sordavie\My Documents\OLD FIREFOX DL\174544.exe Infected: not-a-virus:WebToolbar.Win32.WhenU.a 1 C:\Documents and Settings\Sordavie\My Documents\OLD FIREFOX DL\174544.exe Infected: not-a-virus:AdWare.Win32.Relevant.a 1 The selected area was scanned. Last edited by Ried; 12-06-2008 at 08:23 PM. |
|
|
|
|
12-06-2008, 08:26 PM
|
#13 (permalink) |
|
Assistant Manager, TSF Academy; Moderator/Analyst Security Team
Join Date: Jan 2005
Location: Ohio
Posts: 26,606
OS: WinXP and Vista
|
Re: Multiple trojans found by AV but they reappear after AV "cleans" them
Delete the following files:
C:\Documents and Settings\Sordavie\My Documents\OLD FIREFOX DL\174106.exe C:\Documents and Settings\Sordavie\My Documents\OLD FIREFOX DL\174259.exe C:\Documents and Settings\Sordavie\My Documents\OLD FIREFOX DL\174544.exe If those files are all that's in that folder, delete the OLD FIREFOX DL folder. Please run one last scan with dds and post the dds.txt |
|
|
|
|
12-06-2008, 08:49 PM
|
#14 (permalink) |
|
Registered User
Join Date: Dec 2008
Posts: 9
OS: XP
|
Re: Multiple trojans found by AV but they reappear after AV "cleans" them
Okay, here they are.
DDS (Version 1.0) - NTFSx86 Run by Sordavie at 22:46:17.71 on Sat 12/06/2008 Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.3070.2509 [GMT -5:00] ============== Running Processes =============== C:\WINDOWS\system32\svchost -k DcomLaunch svchost.exe C:\WINDOWS\System32\svchost.exe -k netsvcs C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup svchost.exe svchost.exe C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\PnkBstrA.exe c:\WINDOWS\system32\ZuneBusEnum.exe C:\Program Files\Java\jre6\bin\jusched.exe C:\PROGRA~1\AVG\AVG8\avgtray.exe C:\PROGRA~1\AVG\AVG8\avgrsx.exe C:\Program Files\AIM6\aim6.exe C:\FRAPS\FRAPS.EXE C:\Program Files\Logitech\SetPoint\SetPoint.exe C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE C:\Program Files\AIM6\aolsoftware.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\AVG\AVG8\avgui.exe C:\WINDOWS\system32\wscntfy.exe C:\Documents and Settings\Sordavie\Desktop\dds.com ============== Pseudo HJT Report =============== uStart Page = about:blank BHO: {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - c:\program files\avg\avg8\avgssie.dll BHO: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\program files\java\jre6\bin\ssv.dll BHO: {DBC80044-A445-435b-BC74-9C25C1C588A9} - c:\program files\java\jre6\bin\jp2ssv.dll BHO: {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll uRun: [Aim6] "c:\program files\aim6\aim6.exe" /d locale=en-US ee://aol/imApp uRun: [Fraps] c:\fraps\FRAPS.EXE mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup mRun: [nwiz] nwiz.exe /install mRun: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe" mRun: [AVG8_TRAY] c:\progra~1\avg\avg8\avgtray.exe mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit mRun: [Zune Launcher] "c:\program files\zune\ZuneLauncher.exe" StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\logite~1.lnk - c:\program files\logitech\setpoint\SetPoint.exe IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000 IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe TCP: {97A52C02-61E4-4789-8D03-99708175597F} = 192.168.0.1 Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg8\avgpp.dll Notify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.dll Notify: LBTWlgn - c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll AppInit_DLLs: avgrsstx.dll SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll SEH: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - c:\program files\superantispyware\SASSEH.DLL ============= SERVICES / DRIVERS =============== R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2008-5-28 97928] R1 AvgMfx86;AVG On-access Scanner Minifilter Driver x86;c:\windows\system32\drivers\avgmfx86.sys [2008-1-19 26824] R1 SASDIFSV;SASDIFSV;\??\c:\program files\superantispyware\SASDIFSV.SYS [2008-11-17 8944] R1 SASKUTIL;SASKUTIL;\??\c:\program files\superantispyware\SASKUTIL.sys [2008-11-17 55024] R2 aawservice;Lavasoft Ad-Aware Service;"c:\program files\lavasoft\ad-aware\aawservice.exe" [2008-7-7 611664] R2 avg8wd;AVG8 WatchDog;c:\progra~1\avg\avg8\avgwdsvc.exe [2008-5-28 231704] R3 cmudaxp;Razer Barracuda AC-1 Gaming Interface;c:\windows\system32\drivers\cmudaxp.sys [2008-2-2 1423360] R3 OmniTV;Cx2388x AvStream Video Capture;c:\windows\system32\drivers\OmniTV.sys [2007-9-3 401280] S3 ALSysIO;ALSysIO;\??\c:\docume~1\sordavie\locals~1\temp\ALSysIO.sys [] S3 OnAirGtSvc;OnAir GT USB HDTV Capture (ATSC/NTSC);c:\windows\system32\drivers\OnAirGt.sys [2008-2-10 98192] S3 SASENUM;SASENUM;\??\c:\program files\superantispyware\SASENUM.SYS [2008-11-17 7408] =============== Created Last 30 ================ 2008-12-06 02:05 <DIR> --d----- C:\ComboFix 2008-12-05 14:08 <DIR> a-dshr-- C:\cmdcons 2008-12-05 14:06 161,792 a------- c:\windows\SWREG.exe 2008-12-05 14:06 98,816 a------- c:\windows\sed.exe 2008-12-05 01:59 3,144 ac------ c:\windows\system32\dllcache\srgb.icm 2008-12-04 22:27 250 a------- c:\windows\gmer.ini 2008-12-04 11:36 <DIR> --d----- c:\docume~1\alluse~1\applic~1\SUPERAntiSpyware.com 2008-12-04 11:35 <DIR> --d----- c:\program files\SUPERAntiSpyware 2008-12-04 11:35 <DIR> --d----- c:\docume~1\sordavie\applic~1\SUPERAntiSpyware.com 2008-12-04 03:41 102,664 a------- c:\windows\system32\drivers\tmcomm.sys 2008-12-04 03:24 <DIR> --d----- c:\windows\Easy Decrypter 2008-12-04 03:24 <DIR> --d----- c:\program files\Easy Decrypter 2008-12-03 18:18 410,984 a------- c:\windows\system32\deploytk.dll 2008-12-01 15:51 221,184 a------- c:\windows\system32\wmpns.dll 2008-12-01 15:32 <DIR> --d----- c:\windows\system32\scripting 2008-12-01 15:32 <DIR> --d----- c:\windows\l2schemas 2008-12-01 15:32 <DIR> --d----- c:\windows\system32\en 2008-12-01 15:32 <DIR> --d----- c:\windows\system32\bits 2008-12-01 15:30 <DIR> --d----- c:\windows\ServicePackFiles 2008-12-01 15:27 <DIR> --d----- c:\windows\EHome 2008-11-12 18:52 455,296 -c------ c:\windows\system32\dllcache\mrxsmb.sys ==================== Find3M ==================== 2008-12-05 02:10 <DIR> --d----- c:\program files\DVDFab Platinum 3 2008-12-05 02:03 <DIR> --d----- c:\program files\BitComet 2008-12-05 02:00 <DIR> --d----- c:\program files\uTorrent 2008-12-05 02:00 <DIR> --d----- c:\docume~1\sordavie\applic~1\uTorrent 2008-12-04 11:35 <DIR> --d----- c:\program files\common files\Wise Installation Wizard 2008-12-04 03:26 14,336 a------- c:\windows\system32\svchost.exe 2008-12-01 15:34 <DIR> --d----- c:\program files\Messenger 2008-12-01 15:33 76,487 a------- c:\windows\pchealth\helpctr\offlinecache\index.dat 2008-12-01 15:30 <DIR> --d----- c:\program files\Windows NT 2008-11-08 18:08 <DIR> --d----- c:\program files\Xfire 2008-11-07 21:45 <DIR> --d----- c:\docume~1\sordavie\applic~1\Xfire 2008-11-07 21:07 183,128 a------- c:\windows\system32\PnkBstrB.exe 2008-10-29 20:24 42,320 a------- c:\windows\system32\xfcodec.dll 2008-10-29 02:00 <DIR> --d----- c:\program files\MSXML 6.0 2008-10-28 21:03 <DIR> --d----- c:\program files\Bethesda Softworks 2008-10-28 20:57 107,888 a------- c:\windows\system32\CmdLineExt.dll 2008-10-20 20:35 <DIR> --d----- c:\program files\Yahoo! 2008-10-16 14:06 268,648 a------- c:\windows\system32\mucltui.dll 2008-10-16 14:06 208,744 a------- c:\windows\system32\muweb.dll 2008-09-30 16:43 1,286,152 a------- c:\windows\system32\msxml4.dll 2008-09-15 07:12 1,846,400 a------- c:\windows\system32\win32k.sys 2008-09-09 20:14 1,307,648 a------- c:\windows\system32\msxml6.dll 2008-08-25 23:09 <DIR> --d----- c:\docume~1\sordavie\applic~1\Any Video Converter 2008-08-07 04:12 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Viewpoint 2008-07-28 00:08 <DIR> --d----- c:\docume~1\alluse~1\applic~1\acccore 2008-05-28 14:45 <DIR> --d----- c:\docume~1\alluse~1\applic~1\avg8 2008-02-10 14:19 <DIR> --d----- c:\docume~1\sordavie\applic~1\OnAirSolution 2008-01-25 06:55 <DIR> --d----- c:\docume~1\alluse~1\applic~1\NVIDIA Corporation ============= FINISH: 22:46:46.48 =============== Last edited by Ried; 12-06-2008 at 08:57 PM. |
|
|
|
|
12-06-2008, 08:58 PM
|
#15 (permalink) |
|
Assistant Manager, TSF Academy; Moderator/Analyst Security Team
Join Date: Jan 2005
Location: Ohio
Posts: 26,606
OS: WinXP and Vista
|
Re: Multiple trojans found by AV but they reappear after AV "cleans" them
Thank you. Your logs are clean. If there aren't any more problems, please continue with these final instructions and helpful links:
The following procedure will implement some cleanup procedures. It will also reset your System Restore by flushing out previous restore points (which contain the infections) and create a new restore point. Click Start > Run and copy/paste, or type the following bolded text into the Run box and click OK: ComboFix /u -------------------------------------------------------------------- To help protect your computer in the future I recommend that you get the following free programs if you do not already have them: McAfee Site Advisor--free version. The folks there check out websites and based on their findings, rate it as Safe, Unknown, Caution, or Bad. SpywareBlaster 4.0 to help prevent spyware from installing in the first place. Install & update SpywareBlaster with the latest definitions. After you have updated, click the button - enable protection for all unprotected items.
IESpyAD Zoned Out to block access to malicious websites so you cannot be redirected to them from an infected site or email. This severely impairs attempts to infect your system as it basically prevents any downloads (Cookies etc) from the sites listed, although you will still be able to connect to the sites. Update, and scan with your onboard Anti Malware and Anti Virus programs regularly. Without regular updates you will not be protected when new malicious programs are released. Scan here http://secunia.com/software_inspector/ for out of date & vulnerable common applications on your computer In light of your recent issue, I'm sure you'd like to avoid any future infections. Please take a look at these well written articles: PC Safety and Security--What Do I Need? Think Prevention **Be very wary with any security software that is advertised in popups or in other ways. They are not only usually of no use, but often have malware in them. ----------------------------------------------------- Follow the list above and the potential for infection will reduce dramatically. **Kindly respond one more time and let me know if we may consider this thread resolved. |
|
|
|
|
12-06-2008, 09:38 PM
|
#16 (permalink) |
|
Registered User
Join Date: Dec 2008
Posts: 9
OS: XP
|
Re: Multiple trojans found by AV but they reappear after AV "cleans" them
I'll definitely be much more vigilant about about my computer security from now on. Thank you very much for helping me Ried. Things appear to be functioning normaly.
Thanks again, Dave |
|
|
|
| Thread Tools | |
|
|
