|
|
|
|
|||||
|
|
|
|
|
|
|||
| Welcome
to Tech Support Forum home to more then 136,000 problems solved. Issues
have included: Spyware, Malware, Virus Issues, Windows, Microsoft,
Linux, Networking, Security, Hardware, and Gaming Getting your
problem solved is as easy as: 1. Registering for a free account 2. Asking your question 3. Receiving an answer Registered members: * See fewer ads. * And much more..
|
| Want to know how to post a question? click here | Having problems with spyware and pop-ups? First Steps |
|
|||||||
| Resolved HJT Threads Resolved spyware and popup issues. |
|
|
LinkBack | Thread Tools |
01-15-2009, 07:52 PM
|
#1 (permalink) |
|
Registered User
Join Date: Jan 2009
Posts: 5
OS: XP
|
Please Help-> banker.fstrojan.spyagent.da (malware infection)
I saw someone else was having the exact same problem, and Angelfire777 helped out. Here is that post:
Hi, Need Help with Malware Infection (Win32.Banker.FSTrojan) Like I said having the exact same problem, it is sending me false security notices such as: “Warning! Spyware files: Win32.Banker.FSTrojan.SpyAgent.DA and other detected on your computer! It’s highly recommended to scan the system immediately to remove all spyware and adware programs.” “Your computer is infected! It is recommended to start spyware cleaner tool.” “Windows Security Center has detected spyware/adware infection! It is strongly recommended to use special antispyware tools to prevent data loss.” “System files and register changing are detected. Your PC is under the threat of loss of the data! It is recommended to start the guard scanner.” I use AVG but it hasn't been able to fix this one, and I'm unable to use system restore or change my desktop background from a involuntary brightly colored display. Here are the log files: DDS (Ver_09-01-07.01) - NTFSx86 Run by Administrator at 20:29:23.98 on Thu 01/15/2009 Internet Explorer: 7.0.5730.13 BrowserJavaVersion: 1.6.0_03 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2046.1411 [GMT -6:00] AV: AVG Anti-Virus *On-access scanning enabled* (Updated) AV: *On-access scanning disabled* (Updated) FW: *disabled* ============== Running Processes =============== C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost -k DcomLaunch svchost.exe C:\WINDOWS\System32\svchost.exe -k netsvcs C:\Program Files\Intel\Wireless\Bin\EvtEng.exe C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe svchost.exe svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\Microsoft Shared\Ink\KeyboardSurrogate.exe C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe C:\WINDOWS\system32\lkcitdl.exe C:\WINDOWS\system32\lkads.exe C:\WINDOWS\system32\lktsrv.exe C:\Program Files\National Instruments\Shared\Security\nidmsrv.exe C:\WINDOWS\system32\nisvcloc.exe C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe C:\Program Files\Skyhook Wireless\Wi-Fi Service\WPSScannerSvc.exe C:\WINDOWS\SYSTEM32\WISPTIS.EXE C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\System32\tabbtnu.exe C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\Explorer.EXE C:\PROGRA~1\AVG\AVG8\avgemc.exe C:\PROGRA~1\AVG\AVG8\avgam.exe C:\PROGRA~1\AVG\AVG8\avgrsx.exe C:\Program Files\AVG\AVG8\avgcsrvx.exe C:\Program Files\Common Files\Microsoft Shared\Ink\TabTip.exe C:\Program Files\Common Files\Microsoft Shared\Ink\TCServer.exe C:\WINDOWS\stsystra.exe C:\Program Files\AVG\AVG8\avgcsrvx.exe C:\WINDOWS\CTHELPER.EXE C:\Program Files\iTunes\iTunesHelper.exe C:\PROGRA~1\AVG\AVG8\avgtray.exe C:\WINDOWS\svw.exe C:\WINDOWS\wdmon.exe C:\WINDOWS\svx.exe C:\WINDOWS\vlc.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\Program Files\BigFix\bigfix.exe C:\Program Files\Citrix\ICA Client\pnagent.exe C:\WINDOWS\System32\svchost.exe -k HTTPFilter C:\Program Files\Adobe\Acrobat 7.0\Reader\AcroRd32.exe C:\PROGRA~1\AVG\AVG8\avgnsx.exe C:\Program Files\AVG\AVG8\avgcsrvx.exe C:\WINDOWS\svhoster.exe C:\WINDOWS\runsql.exe C:\WINDOWS\svc.exe C:\WINDOWS\sv.exe C:\WINDOWS\odb.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\WINDOWS\svzip.exe C:\Documents and Settings\Administrator\Desktop\dds.com ============== Pseudo HJT Report =============== uSearch Bar = hxxp://www.google.com/ie uStart Page = hxxp://www.meddean.luc.edu/lumen/ uSearch Page = hxxp://www.google.com uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8 mStart Page = hxxp://www.gateway.com/g/startpage.html?Ch=Consumer&Br=GTW&Loc=ENG_US&Sys=PTB&M=CX210X uInternet Connection Wizard,ShellNext = iexplore uInternet Settings,ProxyServer = http= uSearchAssistant = hxxp://www.google.com/ie uSearchURL,(Default) = hxxp://www.google.com/search?q=%s mSearchAssistant = hxxp://www.google.com/ie BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 7.0\activex\AcroIEHelper.dll BHO: HelloWorldBHO Class: {359a2abb-6050-47f1-8642-eff82f23a4f4} - c:\windows\system32\icq6s.dll BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg8\avgssie.dll BHO: SSVHelper Class: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre1.6.0_03\bin\ssv.dll BHO: AVG Security Toolbar: {a057a204-bacc-4d26-9990-79a187e2698e} - c:\progra~1\avg\avg8\AVGTOO~1.DLL BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar.dll BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.0.926.3450\swg.dll BHO: Google Dictionary Compression sdch: {c84d72fe-e17d-4195-bb24-76c02e2e7c4e} - c:\program files\google\google toolbar\component\fastsearch_219B3E1547538286.dll BHO: CBrowserHelperObject Object: {ca6319c0-31b7-401e-a518-a07c3db8f777} - c:\windows\system32\BAE.dll TB: AOL Toolbar: {4982d40a-c53b-4615-b15b-b5b5e98d167c} - c:\program files\aol toolbar\toolbar.dll TB: AVG Security Toolbar: {a057a204-bacc-4d26-9990-79a187e2698e} - c:\progra~1\avg\avg8\AVGTOO~1.DLL TB: &Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar.dll TB: {C4069E3A-68F1-403E-B40E-20066696354B} - No File EB: Real.com: {fe54fa40-d68c-11d2-98fa-00c0f0318afe} - c:\windows\system32\Shdocvw.dll uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe uRun: [Aim6] uRun: [swg] c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe uRun: [AdwareAlert] c:\program files\adwarealert\AdwareAlert.exe -boot mRun: [TabletWizard] c:\windows\help\SplshWrp.exe mRun: [TabletTip] "c:\program files\common files\microsoft shared\ink\tabtip.exe" /resume mRun: [<NO NAME>] mRun: [Recguard] %WINDIR%\SMINST\RECGUARD.EXE mRun: [SigmatelSysTrayApp] stsystra.exe mRun: [CTHelper] CTHELPER.EXE mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe" mRun: [AVG8_TRAY] c:\progra~1\avg\avg8\avgtray.exe mRun: [odb] c:\windows\odb.exe mRun: [netc] c:\windows\svc.exe mRun: [netw] c:\windows\svw.exe mRun: [wdmon] c:\windows\wdmon.exe mRun: [netx] c:\windows\svx.exe mRun: [vlc] c:\windows\vlc.exe mRun: [net64] c:\windows\svhoster.exe mRun: [netsv32] c:\windows\sv.exe mRun: [netzip] c:\windows\svzip.exe mRun: [runsql] c:\windows\runsql.exe mRun: [SNM] c:\program files\spynomore\SNM.exe /startup dRun: [Power2GoExpress] NA dRunOnce: [RunNarrator] Narrator.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\adober~1.lnk - c:\program files\adobe\acrobat 7.0\reader\reader_sl.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\bigfix.lnk - c:\program files\bigfix\bigfix.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\progra~1.lnk - c:\windows\installer\{b2ae44cb-2aab-4c08-a54b-d264bd604da8}\Icon80951CEC.exe.20FBBF0A_A7E5_4BDE_9798_9811C3D135AC.exe uPolicies-explorer: NoSetActiveDesktop = 1 (0x1) uPolicies-explorer: NoActiveDesktopChanges = 1 (0x1) uPolicies-system: DisableTaskMgr = 1 (0x1) uPolicies-system: DisableRegistryTools = 1 (0x1) mPolicies-explorer: NoSetActiveDesktop = 1 (0x1) mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1) mPolicies-system: DisableTaskMgr = 1 (0x1) mPolicies-system: DisableRegistryTools = 1 (0x1) IE: &AOL Toolbar search - c:\program files\aol toolbar\toolbar.dll/SEARCH.HTML IE: &Test1 - c:\windows\system32\icq6s.dll/MENUSEARCH.HTM IE: E&xport to Microsoft Excel - c:\progra~1\micros~4\office11\EXCEL.EXE/3000 IE: {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - c:\program files\aim\aim.exe IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBC} - c:\program files\java\jre1.6.0_03\bin\ssv.dll IE: {4982D40A-C53B-4615-B15B-B5B5E98D167C} - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - c:\program files\aol toolbar\toolbar.dll IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~4\office11\REFIEBAR.DLL IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - {FE54FA40-D68C-11d2-98FA-00C0F0318AFE} - c:\windows\system32\Shdocvw.dll Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg8\avgpp.dll Notify: AtiExtEvent - Ati2evxx.dll Notify: avgrsstarter - avgrsstx.dll Notify: loginkey - c:\program files\common files\microsoft shared\ink\loginkey.dll Notify: TabBtnWL - TabBtnWL.dll Notify: tpgwlnotify - tpgwlnot.dll SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll STS: IPC Configuration Utility - No File STS: Windows Installer Class: {020487cc-fc04-4b1e-863f-d9801796230b} - c:\docume~1\admini~1\locals~1\temp\wndutl32.dll ================= FIREFOX =================== FF - ProfilePath - c:\docume~1\admini~1\applic~1\mozilla\firefox\profiles\ct00jvf6.default\ FF - prefs.js: browser.startup.homepage - hxxp://www.meddean.luc.edu/lumen/ FF - component: c:\program files\avg\avg8\firefox\components\avgssff.dll FF - component: c:\program files\avg\avg8\toolbarff\components\vmAVGConnector.dll FF - plugin: c:\program files\mozilla firefox\plugins\npunagi2.dll ============= SERVICES / DRIVERS =============== R0 AvgRkx86;avgrkx86.sys;c:\windows\system32\drivers\avgrkx86.sys [2008-10-13 12552] R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2008-10-13 325128] R1 AvgMfx86;AVG On-access Scanner Minifilter Driver x86;c:\windows\system32\drivers\avgmfx86.sys [2008-10-13 27656] R1 AvgTdiX;AVG8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2008-10-13 107272] R3 FinePnt;FinePoint Innovations HID Driver;c:\windows\system32\drivers\FpHidDrv.sys [2006-7-26 18816] R3 MSTabBtn;Tablet PC Buttons HID Driver;c:\windows\system32\drivers\MSTabBtn.sys [2006-7-26 9600] R3 urvpndrv;F5 Networks VPN Adapter;c:\windows\system32\drivers\urvpndrv.sys [2007-10-1 27000] R4 avg8emc;AVG8 E-mail Scanner;c:\progra~1\avg\avg8\avgemc.exe [2009-1-12 903960] R4 avg8wd;AVG8 WatchDog;c:\progra~1\avg\avg8\avgwdsvc.exe [2009-1-12 298264] S3 f5ipfw;F5 Networks StoneWall Filter;c:\windows\system32\drivers\urfltw2k.sys [2008-6-30 10744] =============== Created Last 30 ================ 2009-01-15 17:07 <DIR> --d----- c:\docume~1\admini~1\applic~1\AdwareAlert 2009-01-15 16:44 77,824 a------- c:\windows\system32\icq6s.dll 2009-01-15 15:26 1,152 a------- c:\windows\system32\windrv.sys 2009-01-15 13:54 283,136 a------- c:\windows\runsql.exe 2009-01-15 13:54 283,136 a------- c:\windows\svzip.exe 2009-01-15 13:54 282,624 a------- c:\windows\sv.exe 2009-01-15 13:54 281,088 a------- c:\windows\svhoster.exe 2009-01-15 13:54 235,008 a------- c:\windows\svx.exe 2009-01-15 13:54 234,496 a------- c:\windows\wdmon.exe 2009-01-15 13:54 233,984 a------- c:\windows\vlc.exe 2009-01-15 13:54 235,008 a------- c:\windows\svw.exe 2009-01-15 13:54 234,496 a------- c:\windows\svc.exe 2009-01-15 13:53 234,496 a------- c:\windows\odb.exe 2009-01-15 13:53 47,104 ---shr-- c:\windows\system32\alrsvcb.exe ==================== Find3M ==================== 2009-01-15 12:06 325,128 a------- c:\windows\system32\drivers\avgldx86.sys 2009-01-12 10:15 10,520 a------- c:\windows\system32\avgrsstx.dll 2009-01-12 10:14 12,552 a------- c:\windows\system32\drivers\avgrkx86.sys 2009-01-12 10:14 107,272 a------- c:\windows\system32\drivers\avgtdix.sys 2008-12-11 04:57 333,952 a------- c:\windows\system32\drivers\srv.sys 2008-10-23 06:36 286,720 a------- c:\windows\system32\gdi32.dll 1994-09-13 01:00 23,451 a------- c:\documents and settings\administrator\WM.EXE 1994-09-13 01:00 12,194 a------- c:\documents and settings\administrator\WMNU.COM 1994-09-13 01:00 7,787 a------- c:\documents and settings\administrator\WMNUCFG.EXE 1991-07-20 01:13 34,283 a------- c:\documents and settings\administrator\LHA.EXE 2008-09-18 15:39 32,768 a--sh--- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012008091820080919\index.dat ============= FINISH: 20:29:54.87 =============== THANKS FOR THE HELP!! |
|
     |
| Important Information |
|
Join the #1 Tech Support Forum Today - It's Totally Free!
TechSupportForum.com is a leading support website for your computer needs. We offer free, friendly and personalized computer support. Why pay to have your computer fixed when you can do it for free. Join TechSupportforum.com Today - Click Here |
|
01-17-2009, 02:09 PM
|
#2 (permalink) |
|
Moderator, Analyst, Security Team; Rangemaster, TSF Academy
Join Date: Oct 2007
Location: Georgia
Posts: 10,629
OS: XP SP3
|
Re: Please Help-> banker.fstrojan.spyagent.da (malware infection)
Hello and Welcome to TSF.
Please Subscribe to this Thread to get immediate notification of replies as soon as they are posted. To do this click Thread Tools, then click Subscribe to this Thread. Make sure it is set to Instant notification by email, then click Add Subscription. Please note that the forum is very busy and if I don't hear from you within three days this thread will be closed. ------------------------------------------------------ One or more of the identified infections is a backdoor trojan. This type of infection allows hackers to remotely control your computer, log keystrokes, steal critical system information, and download and execute files without your knowledge. If you do any banking or other financial transactions on the PC or if it should contain any other sensitive information, please get to a known clean computer and change all passwords where applicable, and it would be wise to contact those same financial institutions to apprise them of your situation. Please read this: How Do I Handle Possible Identify Theft, Internet Fraud, and CC Fraud? ------------------------------------------------------ Please visit this webpage for download links, and instructions for running ComboFix: http://www.bleepingcomputer.com/comb...o-use-combofix * Ensure you have disabled all antivirus and antimalware programs so they do not interfere with the running of ComboFix. Please post the C:\ComboFix.txt in your next reply for further review. ------------------------------------------------------ |
|
|
|
|
01-17-2009, 06:45 PM
|
#3 (permalink) |
|
Registered User
Join Date: Jan 2009
Posts: 5
OS: XP
|
Re: Please Help-> banker.fstrojan.spyagent.da (malware infection)
Over the weekend I downloaded a few other malware software, and ran it before. Now I just ran combo fix. It seems like everything is working well. It seems back to normal, I just don't know if the trojan is truly gone. Here is the log, THANKS FOR THE HELP!!!!
ComboFix 09-01-17.03 - Administrator 2009-01-17 19:38:24.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2046.1343 [GMT -6:00] Running from: c:\documents and settings\Administrator\Desktop\ComboFix.exe AV: *On-access scanning disabled* (Updated) AV: avast! antivirus 4.8.1296 [VPS 090117-0] *On-access scanning disabled* (Updated) AV: AVG Anti-Virus *On-access scanning disabled* (Updated) FW: *disabled* * Created a new restore point . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . D:\Autorun.inf . ((((((((((((((((((((((((( Files Created from 2008-12-18 to 2009-01-18 ))))))))))))))))))))))))))))))) . 2009-01-16 16:13 . 2009-01-16 16:13 552 --a------ c:\windows\system32\d3d8caps.dat 2009-01-16 14:12 . 2009-01-16 14:12 <DIR> d-------- c:\program files\Alwil Software 2009-01-16 14:09 . 2009-01-16 14:09 <DIR> d-------- c:\program files\SUPERAntiSpyware 2009-01-16 14:09 . 2009-01-16 14:09 <DIR> d-------- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com 2009-01-16 14:09 . 2009-01-16 14:09 <DIR> d-------- c:\documents and settings\Administrator\Application Data\SUPERAntiSpyware.com 2009-01-16 14:08 . 2009-01-16 14:08 <DIR> d-------- c:\program files\Common Files\Wise Installation Wizard 2009-01-16 14:08 . 2009-01-16 14:08 <DIR> d-------- c:\documents and settings\Administrator\Application Data\Malwarebytes 2009-01-16 14:08 . 2009-01-14 16:11 15,504 --a------ c:\windows\system32\drivers\mbam.sys 2009-01-16 14:07 . 2009-01-16 14:08 <DIR> d-------- c:\program files\Malwarebytes' Anti-Malware 2009-01-16 14:07 . 2009-01-16 14:07 <DIR> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes 2009-01-16 14:07 . 2009-01-14 16:11 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys 2009-01-16 07:37 . 2009-01-16 14:12 <DIR> d-------- c:\program files\Spyware Terminator 2009-01-16 07:37 . 2009-01-16 14:14 <DIR> d-------- c:\documents and settings\All Users\Application Data\Spyware Terminator 2009-01-16 07:37 . 2009-01-16 14:12 <DIR> d-------- c:\documents and settings\Administrator\Application Data\Spyware Terminator 2009-01-16 07:37 . 2009-01-16 07:37 142,592 --a------ c:\windows\system32\drivers\sp_rsdrv2.sys 2009-01-16 00:25 . 2009-01-16 00:25 165 --a------ c:\windows\wininit.ini 2009-01-16 00:08 . 2009-01-16 00:10 <DIR> d-------- c:\program files\Spybot - Search & Destroy 2009-01-16 00:08 . 2009-01-16 07:33 <DIR> d-------- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy 2009-01-15 20:31 . 2009-01-15 20:31 250 --a------ c:\windows\gmer.ini 2009-01-15 15:26 . 2009-01-15 15:26 1,152 --a------ c:\windows\system32\windrv.sys . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-01-16 02:19 --------- d-----w c:\program files\WinAce 2009-01-16 01:01 --------- d-----w c:\program files\Viewpoint 2009-01-16 01:01 --------- d-----w c:\documents and settings\All Users\Application Data\Viewpoint 2009-01-15 21:25 --------- d-----w c:\program files\Common Files\Download Manager 2009-01-15 21:01 --------- d-----w c:\program files\Skyhook Wireless 2009-01-15 18:06 325,128 ----a-w c:\windows\system32\drivers\avgldx86.sys 2009-01-12 16:15 10,520 ----a-w c:\windows\system32\avgrsstx.dll 2009-01-12 16:15 --------- d-----w c:\documents and settings\All Users\Application Data\avg8 2009-01-12 16:14 12,552 ----a-w c:\windows\system32\drivers\avgrkx86.sys 2009-01-12 16:14 107,272 ----a-w c:\windows\system32\drivers\avgtdix.sys 2009-01-03 01:46 --------- d-----w c:\program files\Google 2008-12-11 10:57 333,952 ----a-w c:\windows\system32\drivers\srv.sys 2008-10-23 12:36 286,720 ----a-w c:\windows\system32\gdi32.dll 1994-09-13 07:00 7,787 ----a-w c:\documents and settings\Administrator\WMNUCFG.EXE 1994-09-13 07:00 23,451 ----a-w c:\documents and settings\Administrator\WM.EXE 1994-09-13 07:00 12,194 ----a-w c:\documents and settings\Administrator\WMNU.COM 1991-07-20 07:13 34,283 ----a-w c:\documents and settings\Administrator\LHA.EXE 2006-06-07 20:40 132,848 ----a-w c:\program files\internet explorer\plugins\LV82ActiveXControl.dll 2008-09-18 21:39 32,768 --sha-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012008091820080919\index.dat . ((((((((((((((((((((((((((((((((((((((((((((( AWF )))))))))))))))))))))))))))))))))))))))))))))))))))))))))) . ----a-w 45,056 2006-01-03 00:41:22 c:\program files\ATI Technologies\ATI.ACE\bak\cli.exe ----a-w 271,872 2005-04-26 03:10:24 c:\program files\Common Files\Microsoft Shared\Ink\bak\tabtip.exe ----a-w 271,872 2008-04-14 00:12:37 c:\program files\Common Files\Microsoft Shared\Ink\tabtip.exe ----a-w 139,264 2005-10-12 19:30:42 c:\program files\Intel\Intel Matrix Storage Manager\bak\iaanotif.exe ----a-w 602,182 2005-12-28 18:56:16 c:\program files\Intel\Wireless\Bin\bak\ifrmewrk.exe ----a-w 667,718 2005-12-28 18:55:40 c:\program files\Intel\Wireless\Bin\bak\ZCfgSvc.exe ----a-w 132,496 2007-09-25 06:11:35 c:\program files\Java\jre1.6.0_03\bin\bak\jusched.exe ----a-w 573,440 2006-05-24 02:22:36 c:\program files\Motorola\SMSERIAL\bak\sm56hlpr.exe ----a-w 286,720 2007-11-15 05:43:10 c:\program files\QuickTime\bak\qttask.exe ----a-w 385,024 2008-02-01 04:13:08 c:\program files\QuickTime\QTTask.exe ----a-w 688,218 2004-11-05 14:47:00 c:\program files\Synaptics\SynTP\bak\SynTPEnh.exe ----a-w 98,394 2004-11-05 14:47:00 c:\program files\Synaptics\SynTP\bak\SynTPLpr.exe ----a-w 16,384 2004-08-04 19:00:00 c:\windows\Help\bak\SplshWrp.exe ----a-w 16,384 2008-04-14 00:12:36 c:\windows\Help\splshwrp.exe ----a-w 15,360 2004-08-04 19:00:00 c:\windows\system32\bak\ctfmon.exe ----a-w 15,360 2008-04-14 00:12:16 c:\windows\system32\ctfmon.exe . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360] "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-01-02 39408] "SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2008-09-16 1833296] "SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2008-12-22 1830128] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "TabletWizard"="c:\windows\help\SplshWrp.exe" [2008-04-13 16384] "TabletTip"="c:\program files\Common Files\microsoft shared\ink\tabtip.exe" [2008-04-13 271872] "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-01-31 385024] "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-02-19 267048] "AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-01-12 1601304] "SpywareTerminator"="c:\program files\Spyware Terminator\SpywareTerminatorShield.exe" [2009-01-16 2267136] "avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2008-11-26 81000] "SigmatelSysTrayApp"="stsystra.exe" [2005-12-27 c:\windows\stsystra.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "Power2GoExpress"="NA" [X] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce] "RunNarrator"="Narrator.exe" [2008-04-13 c:\windows\system32\narrator.exe] c:\documents and settings\All Users\Start Menu\Programs\Startup\ Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2008-04-23 29696] [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks] "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon] 2008-12-22 11:05 356352 c:\program files\SUPERAntiSpyware\SASWINLO.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\loginkey] 2008-04-13 18:11 47104 c:\program files\Common Files\Microsoft Shared\Ink\loginkey.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter] 2009-01-12 10:15 10520 c:\windows\system32\avgrsstx.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\TabBtnWL] 2002-08-29 11:41 11776 c:\windows\system32\tabbtnwl.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tpgwlnotify] 2008-04-13 18:12 32256 c:\windows\system32\tpgwlnot.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "msacm.clmp3enc"= c:\progra~1\CYBERL~1\Power2Go\CLMP3Enc.ACM [HKLM\~\startupfolder\C:^Documents and Settings^Administrator^Start Menu^Programs^Startup^Microsoft Office OneNote 2003 Quick Launch.lnk] path=c:\documents and settings\Administrator\Start Menu\Programs\Startup\Microsoft Office OneNote 2003 Quick Launch.lnk backup=c:\windows\pss\Microsoft Office OneNote 2003 Quick Launch.lnkStartup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^BigFix.lnk] path=c:\documents and settings\All Users\Start Menu\Programs\Startup\BigFix.lnk backup=c:\windows\pss\BigFix.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Program Neighborhood Agent.lnk] path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Program Neighborhood Agent.lnk backup=c:\windows\pss\Program Neighborhood Agent.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdwareAlert] c:\program files\AdwareAlert\AdwareAlert.exe [N/A] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AOL Spyware Protection] --a------ 2004-03-19 15:17 78960 c:\progra~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Gateway Extended Warranty] --a------ 2004-02-08 17:30 73728 c:\program files\Gateway\GWCares\gwcares.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper] --a------ 2008-02-19 12:10 267048 c:\program files\iTunes\iTunesHelper.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\net64] c:\windows\svhoster.exe [N/A] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\netc] c:\windows\svc.exe [N/A] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\netsv32] c:\windows\sv.exe [N/A] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\netw] c:\windows\svw.exe [N/A] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\netx] c:\windows\svx.exe [N/A] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\netzip] c:\windows\svzip.exe [N/A] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\odb] c:\windows\odb.exe [N/A] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] --a------ 2008-01-31 22:13 385024 c:\program files\QuickTime\QTTask.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Recguard] --a------ 2002-09-13 23:42 212992 c:\windows\SMINST\Recguard.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Reminder] --a------ 2005-02-25 18:24 966656 c:\windows\creator\Remind_XP.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl] --a------ 2005-01-12 04:01 32768 c:\program files\CyberLink\PowerDVD\PDVDServ.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\runsql] c:\windows\runsql.exe [N/A] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SNM] c:\program files\SpyNoMore\SNM.exe [N/A] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg] --a------ 2009-01-02 19:46 39408 c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\vlc] c:\windows\vlc.exe [N/A] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\wdmon] c:\windows\wdmon.exe [N/A] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTHelper] --a------ 2005-02-17 09:23 14848 c:\windows\CTHELPER.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SetDefaultMIDI] --a------ 2005-02-17 09:18 24576 c:\windows\MIDIDEF.EXE [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusDisableNotify"=dword:00000001 "UpdatesDisableNotify"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe"= "c:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe"= "c:\\Program Files\\America Online 9.0\\waol.exe"= "c:\\Program Files\\Windows Journal\\Journal.exe"= "c:\\Program Files\\AIM\\aim.exe"= "c:\\Program Files\\TVUPlayer\\TVUPlayer.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"= "c:\\Program Files\\AIM6\\aim6.exe"= "c:\\Program Files\\iTunes\\iTunes.exe"= "c:\\Novell\\GroupWise\\grpwise.exe"= "c:\\Novell\\GroupWise\\notify.exe"= "c:\\Program Files\\Microsoft Office\\OFFICE11\\OUTLOOK.EXE"= "c:\\Program Files\\AVG\\AVG8\\avgemc.exe"= "c:\\Program Files\\AVG\\AVG8\\avgupd.exe"= "c:\\Program Files\\AVG\\AVG8\\avgnsx.exe"= "c:\\Program Files\\Mozilla Firefox\\firefox.exe"= "c:\\Program Files\\Java\\jre1.6.0_03\\bin\\javaws.exe"= R0 AvgRkx86;avgrkx86.sys;c:\windows\system32\drivers\avgrkx86.sys [2008-10-13 12552] R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2009-01-16 111184] R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2008-10-13 325128] R1 AvgTdiX;AVG8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2008-10-13 107272] R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [2008-12-22 8944] R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [2008-12-22 55024] R1 sp_rsdrv2;Spyware Terminator Driver 2;c:\windows\system32\drivers\sp_rsdrv2.sys [2009-01-16 142592] R3 FinePnt;FinePoint Innovations HID Driver;c:\windows\system32\drivers\FpHidDrv.sys [2006-07-26 18816] R3 MSTabBtn;Tablet PC Buttons HID Driver;c:\windows\system32\drivers\MSTabBtn.sys [2006-07-26 9600] R3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [2008-12-22 7408] R3 urvpndrv;F5 Networks VPN Adapter;c:\windows\system32\drivers\urvpndrv.sys [2007-10-01 27000] R4 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2009-01-16 20560] R4 avg8emc;AVG8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [2009-01-12 903960] R4 avg8wd;AVG8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2009-01-12 298264] S3 f5ipfw;F5 Networks StoneWall Filter;c:\windows\system32\drivers\urfltw2k.sys [2008-06-30 10744] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\D] \Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Info.exe folder.htt 480 480 . . ------- Supplementary Scan ------- . uStart Page = hxxp://www.meddean.luc.edu/lumen/ uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8 mStart Page = hxxp://www.gateway.com/g/startpage.html?Ch=Consumer&Br=GTW&Loc=ENG_US&Sys=PTB&M=CX210X uInternet Connection Wizard,ShellNext = iexplore uInternet Settings,ProxyServer = http= uSearchURL,(Default) = hxxp://www.google.com/search?q=%s IE: &AOL Toolbar search - c:\program files\AOL Toolbar\toolbar.dll/SEARCH.HTML IE: &Test1 - c:\windows\system32\icq6s.dll/MENUSEARCH.HTM IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\OFFICE11\EXCEL.EXE/3000 FF - ProfilePath - c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\ct00jvf6.default\ FF - prefs.js: browser.startup.homepage - hxxp://www.meddean.luc.edu/lumen/ FF - component: c:\program files\AVG\AVG8\Firefox\components\avgssff.dll FF - component: c:\program files\AVG\AVG8\ToolbarFF\components\vmAVGConnector.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\npunagi2.dll . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-01-17 19:40:24 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . --------------------- LOCKED REGISTRY KEYS --------------------- [HKEY_USERS\Administrator\Software\Microsoft\SystemCertificates\AddressBook*] @Allowed: (Read) (RestrictedCode) @Allowed: (Read) (RestrictedCode) . --------------------- DLLs Loaded Under Running Processes --------------------- - - - - - - - > 'winlogon.exe'(904) c:\program files\SUPERAntiSpyware\SASWINLO.dll c:\windows\system32\Ati2evxx.dll . Completion time: 2009-01-17 19:41:45 ComboFix-quarantined-files.txt 2009-01-18 01:41:33 Pre-Run: 47,403,700,224 bytes free Post-Run: 48,751,181,824 bytes free WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems] c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect 271 --- E O F --- 2009-01-14 17:03:27 Last edited by stritch; 01-17-2009 at 07:12 PM. |
|
|
|
|
01-17-2009, 07:35 PM
|
#4 (permalink) | |
|
Moderator, Analyst, Security Team; Rangemaster, TSF Academy
Join Date: Oct 2007
Location: Georgia
Posts: 10,629
OS: XP SP3
|
Re: Please Help-> banker.fstrojan.spyagent.da (malware infection)
Hello stritch. Please tell us how your system is behaving.
Please copy this page to Notepad and Save it to your Desktop in order to assist you when carrying out the following instructions. Before beginning the fix, read this post completely. If there's anything that you do not understand, kindly ask your questions before proceeding. Ensure that there aren't any opened browsers when you are carrying out the procedures below. It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence. ------------------------------------------------------ It appears that you have two antivirus programs installed and running, avast! and AVG. While this may seem like better protection, they can actually conflict with one another and cause system instability or even system hangs. Please choose one to keep and uninstall the other via Add or Remove Programs in your Control Panel. ------------------------------------------------------ I see you have SpywareTerminator installed on your system. This application was previously listed as a rogue program because of concerns with adware. Please read here Although no longer listed as such, we recommend uninstalling it and downloading antispyware programs that have proven themselves tried and true. See here for a list of trustworthy antispyware products. ------------------------------------------------------ Please uninstall the following via Start->(or My Computer)->Control Panel->Add or Remove Programs if it still exists: Viewpoint Media Player<<This is considered foistware instead of malware since it is installed without users approval, but doesn't spy or do anything "bad". Please read here and here If you decide to uninstall it, also delete the following Folders if they still exist: C:\Program Files\Viewpoint C:\Documents and Settings\All Users\Application Data\Viewpoint ------------------------------------------------------ Close any open browsers. Disable your antivirus and antispyware applications, usually via a right-click on the System Tray icon. They may otherwise interfere with ComboFix. Open Notepad and copy/paste all the text in the quotebox below into Notepad: Quote:
 Referring to the picture above, drag CFScript onto ComboFix Your desktop may go blank. This is normal. It will return when ComboFix is done. ComboFix may reboot your machine. This is normal. When finished, it shall produce a log for you. Please post that log, ComboFix.txt in your next reply. Note: Do not mouseclick ComboFix's window whilst it's running. That may cause it to stall. ------------------------------------------------------ Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update.
Please download ATF-Cleaner by Atribune and Save it to your Desktop.
For Technical Support, double-click the e-mail address located at the bottom of each menu. ------------------------------------------------------ Please run this online scan to help look for remnants. Establish an internet connection & perform an online scan at Kaspersky Online Scanner Ensure your external and/or USB drives are inserted during the scan. Click Accept, when prompted to download and install the program files and database of malware definitions.
 **Note** To optimize scanning time and produce a more sensible report for review:
------------------------------------------------------ Please post the following in your next reply: ComboFix.txt Kaspersky report report on system behavior |
|
|
|
|
|
01-18-2009, 10:02 AM
|
#5 (permalink) |
|
Registered User
Join Date: Jan 2009
Posts: 5
OS: XP
|
Re: Please Help-> banker.fstrojan.spyagent.da (malware infection)
My computer seems to be running fine, I think everything is back to normal, thanks for all the help. I am truly grateful.
I did the Kaspersky scan twice, both times the scan report showed no viruses. The scan report was blank. Here are both reports: ComboFix 09-01-17.03 - Administrator 2009-01-17 22:03:17.2 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2046.1529 [GMT -6:00] Running from: c:\documents and settings\Administrator\Desktop\ComboFix.exe Command switches used :: c:\documents and settings\Administrator\Desktop\CFScript.txt AV: *On-access scanning disabled* (Updated) AV: AVG Anti-Virus *On-access scanning disabled* (Updated) FW: *disabled* * Created a new restore point FILE :: c:\windows\wininit.ini . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\program files\ATI Technologies\ATI.ACE\bak c:\program files\ATI Technologies\ATI.ACE\bak\cli.exe c:\program files\Common Files\Microsoft Shared\Ink\bak c:\program files\Common Files\Microsoft Shared\Ink\bak\tabtip.exe c:\program files\Intel\Intel Matrix Storage Manager\bak c:\program files\Intel\Intel Matrix Storage Manager\bak\iaanotif.exe c:\program files\Intel\Wireless\Bin\bak c:\program files\Intel\Wireless\Bin\bak\ifrmewrk.exe c:\program files\Intel\Wireless\Bin\bak\ZCfgSvc.exe c:\program files\Java\jre1.6.0_03\bin\bak c:\program files\Java\jre1.6.0_03\bin\bak\jusched.exe c:\program files\Motorola\SMSERIAL\bak c:\program files\Motorola\SMSERIAL\bak\sm56hlpr.exe c:\program files\QuickTime\bak c:\program files\QuickTime\bak\qttask.exe c:\program files\Synaptics\SynTP\bak c:\program files\Synaptics\SynTP\bak\SynTPEnh.exe c:\program files\Synaptics\SynTP\bak\SynTPLpr.exe c:\windows\Help\bak c:\windows\Help\bak\SplshWrp.exe c:\windows\system32\bak c:\windows\system32\bak\ctfmon.exe c:\windows\wininit.ini . ((((((((((((((((((((((((( Files Created from 2008-12-18 to 2009-01-18 ))))))))))))))))))))))))))))))) . 2009-01-16 16:13 . 2009-01-16 16:13 552 --a------ c:\windows\system32\d3d8caps.dat 2009-01-16 14:12 . 2009-01-16 14:12 <DIR> d-------- c:\program files\Alwil Software 2009-01-16 14:09 . 2009-01-16 14:09 <DIR> d-------- c:\program files\SUPERAntiSpyware 2009-01-16 14:09 . 2009-01-16 14:09 <DIR> d-------- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com 2009-01-16 14:09 . 2009-01-16 14:09 <DIR> d-------- c:\documents and settings\Administrator\Application Data\SUPERAntiSpyware.com 2009-01-16 14:08 . 2009-01-16 14:08 <DIR> d-------- c:\program files\Common Files\Wise Installation Wizard 2009-01-16 14:08 . 2009-01-16 14:08 <DIR> d-------- c:\documents and settings\Administrator\Application Data\Malwarebytes 2009-01-16 14:08 . 2009-01-14 16:11 15,504 --a------ c:\windows\system32\drivers\mbam.sys 2009-01-16 14:07 . 2009-01-16 14:08 <DIR> d-------- c:\program files\Malwarebytes' Anti-Malware 2009-01-16 14:07 . 2009-01-16 14:07 <DIR> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes 2009-01-16 14:07 . 2009-01-14 16:11 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys 2009-01-16 00:08 . 2009-01-16 00:10 <DIR> d-------- c:\program files\Spybot - Search & Destroy 2009-01-16 00:08 . 2009-01-16 07:33 <DIR> d-------- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy 2009-01-15 20:31 . 2009-01-15 20:31 250 --a------ c:\windows\gmer.ini 2009-01-15 15:26 . 2009-01-15 15:26 1,152 --a------ c:\windows\system32\windrv.sys . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-01-18 04:04 --------- d-----w c:\program files\QuickTime 2009-01-16 02:19 --------- d-----w c:\program files\WinAce 2009-01-16 01:01 --------- d-----w c:\documents and settings\All Users\Application Data\Viewpoint 2009-01-15 21:25 --------- d-----w c:\program files\Common Files\Download Manager 2009-01-15 21:01 --------- d-----w c:\program files\Skyhook Wireless 2009-01-15 18:06 325,128 ----a-w c:\windows\system32\drivers\avgldx86.sys 2009-01-12 16:15 10,520 ----a-w c:\windows\system32\avgrsstx.dll 2009-01-12 16:15 --------- d-----w c:\documents and settings\All Users\Application Data\avg8 2009-01-12 16:14 12,552 ----a-w c:\windows\system32\drivers\avgrkx86.sys 2009-01-12 16:14 107,272 ----a-w c:\windows\system32\drivers\avgtdix.sys 2009-01-03 01:46 --------- d-----w c:\program files\Google 2008-12-11 10:57 333,952 ----a-w c:\windows\system32\drivers\srv.sys 2008-10-23 12:36 286,720 ----a-w c:\windows\system32\gdi32.dll 1994-09-13 07:00 7,787 ----a-w c:\documents and settings\Administrator\WMNUCFG.EXE 1994-09-13 07:00 23,451 ----a-w c:\documents and settings\Administrator\WM.EXE 1994-09-13 07:00 12,194 ----a-w c:\documents and settings\Administrator\WMNU.COM 1991-07-20 07:13 34,283 ----a-w c:\documents and settings\Administrator\LHA.EXE 2006-06-07 20:40 132,848 ----a-w c:\program files\internet explorer\plugins\LV82ActiveXControl.dll 2008-09-18 21:39 32,768 --sha-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012008091820080919\index.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360] "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-01-02 39408] "SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2008-09-16 1833296] "SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2008-12-22 1830128] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "TabletWizard"="c:\windows\help\SplshWrp.exe" [2008-04-13 16384] "TabletTip"="c:\program files\Common Files\microsoft shared\ink\tabtip.exe" [2008-04-13 271872] "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-01-31 385024] "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-02-19 267048] "AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-01-12 1601304] "SigmatelSysTrayApp"="stsystra.exe" [2005-12-27 c:\windows\stsystra.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "Power2GoExpress"="NA" [X] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce] "RunNarrator"="Narrator.exe" [2008-04-13 c:\windows\system32\narrator.exe] c:\documents and settings\All Users\Start Menu\Programs\Startup\ Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2008-04-23 29696] [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks] "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon] 2008-12-22 11:05 356352 c:\program files\SUPERAntiSpyware\SASWINLO.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\loginkey] 2008-04-13 18:11 47104 c:\program files\Common Files\Microsoft Shared\Ink\loginkey.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter] 2009-01-12 10:15 10520 c:\windows\system32\avgrsstx.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\TabBtnWL] 2002-08-29 11:41 11776 c:\windows\system32\tabbtnwl.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tpgwlnotify] 2008-04-13 18:12 32256 c:\windows\system32\tpgwlnot.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "msacm.clmp3enc"= c:\progra~1\CYBERL~1\Power2Go\CLMP3Enc.ACM [HKLM\~\startupfolder\C:^Documents and Settings^Administrator^Start Menu^Programs^Startup^Microsoft Office OneNote 2003 Quick Launch.lnk] path=c:\documents and settings\Administrator\Start Menu\Programs\Startup\Microsoft Office OneNote 2003 Quick Launch.lnk backup=c:\windows\pss\Microsoft Office OneNote 2003 Quick Launch.lnkStartup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^BigFix.lnk] path=c:\documents and settings\All Users\Start Menu\Programs\Startup\BigFix.lnk backup=c:\windows\pss\BigFix.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Program Neighborhood Agent.lnk] path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Program Neighborhood Agent.lnk backup=c:\windows\pss\Program Neighborhood Agent.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AOL Spyware Protection] --a------ 2004-03-19 15:17 78960 c:\progra~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Gateway Extended Warranty] --a------ 2004-02-08 17:30 73728 c:\program files\Gateway\GWCares\gwcares.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper] --a------ 2008-02-19 12:10 267048 c:\program files\iTunes\iTunesHelper.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] --a------ 2008-01-31 22:13 385024 c:\program files\QuickTime\QTTask.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Recguard] --a------ 2002-09-13 23:42 212992 c:\windows\SMINST\Recguard.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Reminder] --a------ 2005-02-25 18:24 966656 c:\windows\creator\Remind_XP.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl] --a------ 2005-01-12 04:01 32768 c:\program files\CyberLink\PowerDVD\PDVDServ.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg] --a------ 2009-01-02 19:46 39408 c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTHelper] --a------ 2005-02-17 09:23 14848 c:\windows\CTHELPER.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SetDefaultMIDI] --a------ 2005-02-17 09:18 24576 c:\windows\MIDIDEF.EXE [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe"= "c:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe"= "c:\\Program Files\\America Online 9.0\\waol.exe"= "c:\\Program Files\\Windows Journal\\Journal.exe"= "c:\\Program Files\\AIM\\aim.exe"= "c:\\Program Files\\TVUPlayer\\TVUPlayer.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"= "c:\\Program Files\\AIM6\\aim6.exe"= "c:\\Program Files\\iTunes\\iTunes.exe"= "c:\\Novell\\GroupWise\\grpwise.exe"= "c:\\Novell\\GroupWise\\notify.exe"= "c:\\Program Files\\Microsoft Office\\OFFICE11\\OUTLOOK.EXE"= "c:\\Program Files\\AVG\\AVG8\\avgemc.exe"= "c:\\Program Files\\AVG\\AVG8\\avgupd.exe"= "c:\\Program Files\\AVG\\AVG8\\avgnsx.exe"= "c:\\Program Files\\Mozilla Firefox\\firefox.exe"= "c:\\Program Files\\Java\\jre1.6.0_03\\bin\\javaws.exe"= R0 AvgRkx86;avgrkx86.sys;c:\windows\system32\drivers\avgrkx86.sys [2008-10-13 12552] R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2008-10-13 325128] R1 AvgTdiX;AVG8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2008-10-13 107272] R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [2008-12-22 8944] R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [2008-12-22 55024] R3 FinePnt;FinePoint Innovations HID Driver;c:\windows\system32\drivers\FpHidDrv.sys [2006-07-26 18816] R3 MSTabBtn;Tablet PC Buttons HID Driver;c:\windows\system32\drivers\MSTabBtn.sys [2006-07-26 9600] R3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [2008-12-22 7408] R3 urvpndrv;F5 Networks VPN Adapter;c:\windows\system32\drivers\urvpndrv.sys [2007-10-01 27000] R4 avg8emc;AVG8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [2009-01-12 903960] R4 avg8wd;AVG8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2009-01-12 298264] S3 f5ipfw;F5 Networks StoneWall Filter;c:\windows\system32\drivers\urfltw2k.sys [2008-06-30 10744] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\D] \Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Info.exe folder.htt 480 480 . - - - - ORPHANS REMOVED - - - - MSConfigStartUp-runsql - c:\windows\runsql.exe . ------- Supplementary Scan ------- . uStart Page = hxxp://www.meddean.luc.edu/lumen/ uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8 mStart Page = hxxp://www.gateway.com/g/startpage.html?Ch=Consumer&Br=GTW&Loc=ENG_US&Sys=PTB&M=CX210X uInternet Connection Wizard,ShellNext = iexplore uInternet Settings,ProxyServer = http= uSearchURL,(Default) = hxxp://www.google.com/search?q=%s IE: &AOL Toolbar search - c:\program files\AOL Toolbar\toolbar.dll/SEARCH.HTML IE: &Test1 - c:\windows\system32\icq6s.dll/MENUSEARCH.HTM IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\OFFICE11\EXCEL.EXE/3000 FF - ProfilePath - c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\ct00jvf6.default\ FF - prefs.js: browser.startup.homepage - hxxp://www.meddean.luc.edu/lumen/ FF - component: c:\program files\AVG\AVG8\Firefox\components\avgssff.dll FF - component: c:\program files\AVG\AVG8\ToolbarFF\components\vmAVGConnector.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\npunagi2.dll . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-01-17 22:05:58 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . --------------------- LOCKED REGISTRY KEYS --------------------- [HKEY_USERS\Administrator\Software\Microsoft\SystemCertificates\AddressBook*] @Allowed: (Read) (RestrictedCode) @Allowed: (Read) (RestrictedCode) . --------------------- DLLs Loaded Under Running Processes --------------------- - - - - - - - > 'winlogon.exe'(900) c:\program files\SUPERAntiSpyware\SASWINLO.dll c:\windows\system32\Ati2evxx.dll . Completion time: 2009-01-17 22:07:11 ComboFix-quarantined-files.txt 2009-01-18 04  59ComboFix2.txt 2009-01-18 01:41:46 Pre-Run: 48,749,330,432 bytes free Post-Run: 48,809,979,904 bytes free 235 --- E O F --- 2009-01-14 17:03:27 *@*@*@*@*@*@*@*@*@*@*@*@*@*@*@*@*@*@*@*@*@*@*@*@*@*@*@ Kaspersky Report: -------------------------------------------------------------------------------- KASPERSKY ONLINE SCANNER 7 REPORT Sunday, January 18, 2009 Operating System: Microsoft Windows XP Professional Service Pack 3 (build 2600) Kaspersky Online Scanner 7 version: 7.0.25.0 Program database last update: Sunday, January 18, 2009 03:45:11 Records in database: 1639848 -------------------------------------------------------------------------------- Scan settings: Scan using the following database: extended Scan archives: yes Scan mail databases: yes Scan area - My Computer: C:\ D:\ E:\ F:\ G:\ Scan statistics: Files scanned: 68073 Threat name: 0 Infected objects: 0 Suspicious objects: 0 Duration of the scan: 01:11:12 No malware has been detected. The scan area is clean. The selected area was scanned. |
|
|
|
|
01-18-2009, 01:42 PM
|
#6 (permalink) |
|
Moderator, Analyst, Security Team; Rangemaster, TSF Academy
Join Date: Oct 2007
Location: Georgia
Posts: 10,629
OS: XP SP3
|
Re: Please Help-> banker.fstrojan.spyagent.da (malware infection)
Congratulations. Well done! Your logs appear clean. You should be good to go.
Go to Start >> Run and Copy/Paste the following single-line command into the Run box and click OK: combofix /u This will uninstall ComboFix and delete ComboFix's quarantine folder. It will also implement some cleanup procedures, remove old System Restore Points which contain previous infections, and create a fresh, clean System Restore Point. Please re-enable your antivirus program and any other antispyware programs disabled earlier if you haven't already. You can safely delete any tools downloaded or any logs, files, and any shortcuts on your desktop that were created during this fix. ------------------------------------------------------ MICROSOFT UPDATES It is very important that you get all of the critical updates for your Operating System and Internet Explorer. Keeping your OS and browser up to date will help make you less susceptible to attacks by Trojans and viruses. Please go to Microsoft and download all the critical updates to help prevent possible re-infection. SPYWARE PREVENTION This is a good time to set up protection against further attacks. In light of your recent problem, I'm sure you'd like to avoid any future infections. Please read these well written articles: To help protect your computer in the future I recommend that you get the following free programs if you do not already have them:
Please respond to this thread one more time so we can mark this thread as resolved. |
|
|
|
| Thread Tools | |
|
|
