|
|
|
|
|||||
|
|
|
|
|
|
|||
| Welcome
to Tech Support Forum home to more then 136,000 problems solved. Issues
have included: Spyware, Malware, Virus Issues, Windows, Microsoft,
Linux, Networking, Security, Hardware, and Gaming Getting your
problem solved is as easy as: 1. Registering for a free account 2. Asking your question 3. Receiving an answer Registered members: * See fewer ads. * And much more..
|
| Want to know how to post a question? click here | Having problems with spyware and pop-ups? First Steps |
|
|||||||
| Resolved HJT Threads Resolved spyware and popup issues. |
|
|
LinkBack | Thread Tools |
02-01-2009, 02:50 PM
|
#1 (permalink) |
|
Registered User
Join Date: Feb 2009
Posts: 10
OS: Windows XP SP3
|
Malware problem changing Proxy Settings
Hi
Before I begin I must tell you how glad I am to have come accross this forum as this problem is really starting to get to me. Here's the detail on where I am now. My problem machine is a Dell Inspiron 6000 with Windows XP Media edition (SP3). I began having problems when I noticed that the machine was running a good deal slower particularly when browsing the web. I began to notice that my "sent" data was exceeding my "received" data and when I clicked various links I was being directed to unrelated webpages (obscure search engines, porn sites etc.). I was informed that this may be a malware problem, a term I had never heard until a few days ago. I began by scanning my PC with TrendMicro online scan. It identified 5 or 6 malware/virsuses (did not record their names). I attempted to delete them but every time I tried the webpage froze (i.e., the feedback at the bottom right hand corner of the TrendMicro online scan said “idle” and didn’t move). I tried scanning my laptop with different online virus checks but I could not get access to the websites. They were blocked somehow. I also attempted to follow the advice on this webpage http://www.****online.com/forum/comp...st/t.10685641/ I did everything until it came to attempting to go online while in "Safe Mode with Networking". When attempting to go online in this mode it displayed the following message: The proxy server is refusing connections Firefox is configured to use a proxy server that is refusing connections. * Check the proxy settings to make sure that they are correct. * Contact your network administrator to make sure the proxy server is working I then went back into normal mode and scanned my laptop with both MalwareBytes' Anti Malware and SUPERAntiSpyware as direct by a user in a different forum. These programs did not detect any viruses. I then scanned my laptop with the AVG scan. AVG detected 6 viruses: Trojan Horse Downloader Agent AOJV Virus Identified Worm/Generic NIL Trojan Horse Downloader Small.EZY Trojan Horse SHeur.CQNT Trojan Horse. SHeur2.CLQ Trojan Horse Downloader Zlob AFWO These viruses were promptly deleted. However once this was done I was unable to go online. My laptop states that I am connected to my router but message displayed when I click Firefox states The proxy server is refusing connections Firefox is configured to use a proxy server that is refusing connections. * Check the proxy settings to make sure that they are correct. * Contact your network administrator to make sure the proxy server is working I now dont know what to do. Can anyone help? I am desperate at this point as its taking up a lot of time trying to solve the problem and I am under pressure to complete work. Any help much appreciated! Thanks Mike |
|
     |
| Important Information |
|
Join the #1 Tech Support Forum Today - It's Totally Free!
TechSupportForum.com is a leading support website for your computer needs. We offer free, friendly and personalized computer support. Why pay to have your computer fixed when you can do it for free. Join TechSupportforum.com Today - Click Here |
|
02-03-2009, 07:44 PM
|
#2 (permalink) |
|
Assistant Manager, TSF Academy; Moderator/Analyst Security Team
Join Date: Jan 2005
Location: Ohio
Posts: 26,914
OS: WinXP and Vista
|
Re: Malware problem changing Proxy Settings
Hello Mike,
Use another computer to download and transfer the tools outlined in our sticky topic New Instructions - Read This Before Posting for Malware Removal Help. Run them as instructed, then please post the requested logs in your next reply. |
|
|
|
|
02-11-2009, 05:32 AM
|
#3 (permalink) |
|
Registered User
Join Date: Feb 2009
Posts: 10
OS: Windows XP SP3
|
Re: Malware problem changing Proxy Settings
Hi Ried,
Thank you for your reply and apologies for the delay. I have been quite busy. I followed the instructions you gave and downloaded those two files. I encountered no problem with the DDS file and saved those 2 scripts to my desktop. However when following the instructions for the GMER scan it stated that I should untick the "show all" box. The problem is that the buttons "scan" "copy" and "save" are located higher up on the screen than they should be. The "save" button is directly over the "show all" box so I can't untick it. What should I do now? Cheers Mike |
|
|
|
|
02-11-2009, 05:53 AM
|
#4 (permalink) |
|
Assistant Manager, TSF Academy; Moderator/Analyst Security Team
Join Date: Jan 2005
Location: Ohio
Posts: 26,914
OS: WinXP and Vista
|
Re: Malware problem changing Proxy Settings
Hi Mike,
The show all button is typically ticked by default. If it is ticked, then please proceed with the scan anyway and I'll just have to wade through the extraneous info. : ) |
|
|
|
|
02-11-2009, 05:56 AM
|
#5 (permalink) |
|
Registered User
Join Date: Feb 2009
Posts: 10
OS: Windows XP SP3
|
Re: Malware problem changing Proxy Settings
Sorry I forgot, Here's the contents of the DDS file and I've attached the "attach" file from the DDS scan if that helps
DDS (Ver_09-02-01.01) - NTFSx86 Run by Michael Malone at 12:15:55.84 on 11/02/2009 Internet Explorer: 7.0.5730.13 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.503.238 [GMT 0:00] AV: AVG 7.5.519 *On-access scanning enabled* (Outdated) ============== Running Processes =============== C:\WINDOWS\system32\svchost -k DcomLaunch svchost.exe C:\Program Files\Windows Defender\MsMpEng.exe C:\WINDOWS\System32\svchost.exe -k netsvcs C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup C:\Program Files\Intel\Wireless\Bin\EvtEng.exe C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe svchost.exe svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe C:\PROGRA~1\Grisoft\AVG7\avgemc.exe C:\WINDOWS\eHome\ehRecvr.exe C:\WINDOWS\eHome\ehSched.exe C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe svchost.exe C:\WINDOWS\system32\svchost.exe -k imgsvc C:\WINDOWS\system32\dllhost.exe C:\Program Files\Intel\Wireless\Bin\ZcfgSvc.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\Explorer.EXE C:\PROGRA~1\Intel\Wireless\Bin\1XConfig.exe C:\windows\che08.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Documents and Settings\Michael Malone\Desktop\dds.scr ============== Pseudo HJT Report =============== uStart Page = hxxp://www.google.ie/ uInternet Settings,ProxyServer = http=127.0.0.1:8484 uInternet Settings,ProxyOverride = *.local;<local> BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 7.0\activex\AcroIEHelper.dll BHO: 813686 Class: {d577b1b9-76e7-42c6-82fe-15206296faed} - c:\windows\system32\813686\813686.dll TB: {724D43A0-0D85-11D4-9908-00400523E39A} - No File uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe uRun: [SUPERAntiSpyware] c:\program files\superantispyware\SUPERAntiSpyware.exe mRun: [sysberay2] c:\windows\che08.exe dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE dRun: [AVG7_Run] c:\progra~1\grisoft\avg7\avgw.exe /RUNONCE dRun: [Nokia.PCSync] c:\program files\nokia\nokia pc suite 6\PcSync2.exe /NoDialog dRun: [DWQueuedReporting] "c:\progra~1\common~1\micros~1\dw\dwtrig20.exe" -t IE: E&xport to Microsoft Excel - c:\progra~1\micros~3\office10\EXCEL.EXE/3000 IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe DPF: {54823A9D-6BAE-11D5-B519-0050BA2413EB} - hxxp://www.cyberlink.com/winxp/CheckDVD.cab DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1158853394536 DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/products/plugin/autodl/jinstall-142-windows-i586.cab DPF: {CAFEEFAC-0014-0002-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/products/plugin/autodl/jinstall-142-windows-i586.cab DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab Handler: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - c:\program files\common files\microsoft shared\web folders\PKMCDO.DLL Notify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.dll Notify: igfxcui - igfxdev.dll Notify: IntelWireless - c:\program files\intel\wireless\bin\LgNotify.dll SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll SEH: Microsoft AntiMalware ShellExecuteHook: {091eb208-39dd-417d-a5dd-7e2c2d8fb9cb} - c:\progra~1\wifd1f~1\MpShHook.dll SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLL LSA: Authentication Packages = msv1_0 nwprovau ================= FIREFOX =================== FF - ProfilePath - c:\docume~1\michae~1\applic~1\mozilla\firefox\profiles\x06ccga9.default\ FF - prefs.js: browser.startup.homepage - www.google.ie FF - prefs.js: network.proxy.http - 127.0.0.1 FF - prefs.js: network.proxy.http_port - 8484 FF - prefs.js: network.proxy.type - 4 FF - component: c:\program files\mozilla firefox\extensions\talkback@mozilla.org\components\qfaservices.dll ============= SERVICES / DRIVERS =============== R1 Avg7Core;AVG7 Kernel;c:\windows\system32\drivers\avg7core.sys [2007-6-2 821856] R1 Avg7RsW;AVG7 Wrap Driver;c:\windows\system32\drivers\avg7rsw.sys [2007-6-2 4224] R1 Avg7RsXP;AVG7 Resident Driver XP;c:\windows\system32\drivers\avg7rsxp.sys [2007-6-2 27776] R1 AvgClean;AVG7 Clean Driver;c:\windows\system32\drivers\avgclean.sys [2007-6-2 10760] R1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\sasdifsv.sys [2009-1-15 8944] R1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2009-1-15 55024] R2 Avg7Alrt;AVG7 Alert Manager Server;c:\progra~1\grisoft\avg7\avgamsvr.exe [2007-6-2 418816] R2 Avg7UpdSvc;AVG7 Update Service;c:\progra~1\grisoft\avg7\avgupsvc.exe [2007-6-2 49664] R2 AVGEMS;AVG E-mail Scanner;c:\progra~1\grisoft\avg7\avgemc.exe [2007-6-2 406528] R2 AvgTdi;AVG Network Redirector;c:\windows\system32\drivers\avgtdi.sys [2007-6-2 4960] R2 McrdSvc;Media Center Extender Service;c:\windows\ehome\mcrdsvc.exe [2005-8-5 99328] R2 WinDefend;Windows Defender;c:\program files\windows defender\MsMpEng.exe [2006-11-3 13592] R3 SASENUM;SASENUM;c:\program files\superantispyware\SASENUM.SYS [2009-1-15 7408] S2 AVG7 Alert Manager Server (Avg7Alrt) ;AVG7 Alert Manager Server (Avg7Alrt) ;c:\program files\roxio\bin\winsrv.exe --> c:\program files\roxio\bin\winsrv.exe [?] S3 IZNZJQO;IZNZJQO;c:\docume~1\michae~1\locals~1\temp\IZNZJQO.exe [2009-1-29 416640] S4 Airtfu;Airtfu;c:\windows\system32\drivers\hpn.sys [2005-8-16 25952] =============== Created Last 30 ================ 2009-01-31 16:37 <DIR> --d----- c:\docume~1\alluse~1\applic~1\SUPERAntiSpyware.com 2009-01-31 16:37 <DIR> --d----- c:\program files\SUPERAntiSpyware 2009-01-31 16:37 <DIR> --d----- c:\docume~1\michae~1\applic~1\SUPERAntiSpyware.com 2009-01-31 16:36 <DIR> --d----- c:\program files\common files\Wise Installation Wizard 2009-01-31 15:06 <DIR> --d----- c:\docume~1\michae~1\applic~1\Malwarebytes 2009-01-31 15:06 15,504 a------- c:\windows\system32\drivers\mbam.sys 2009-01-31 15:06 38,496 a------- c:\windows\system32\drivers\mbamswissarmy.sys 2009-01-31 15:05 <DIR> --d----- c:\program files\Malwarebytes' Anti-Malware 2009-01-31 15:05 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Malwarebytes 2009-01-29 17:39 <DIR> -cd----- c:\docume~1\alluse~1\applic~1\{83C91755-2546-441D-AC40-9A6B4B860800} 2009-01-29 17:37 <DIR> --d----- c:\program files\Trend Micro ==================== Find3M ==================== 2009-01-30 17:35 13,197,207 a------- c:\program files\PROCESSLIST.DB 2009-01-30 17:35 1,116,641 a------- c:\program files\PROCESSLISTRELATED.DB 2008-12-28 18:01 43,104 a------- c:\docume~1\michae~1\applic~1\GDIPFONTCACHEV1.DAT 2008-12-19 12:11 26,112 ----h--- c:\windows\che08.exe 2008-12-13 06:40 3,593,216 a------- c:\windows\system32\dllcache\mshtml.dll 2008-12-11 10:57 333,952 -------- c:\windows\system32\dllcache\srv.sys 2008-12-10 18:41 5,642 a--sh--- c:\windows\system32\KGyGaAvL.sys 2008-12-04 21:46 88,859 a------- c:\windows\pchealth\helpctr\offlinecache\index.dat ============= FINISH: 12:16:38.14 =============== Last edited by toiletduck1; 02-11-2009 at 06:21 AM. |
|
|
|
|
02-12-2009, 09:21 AM
|
#7 (permalink) |
|
Registered User
Join Date: Feb 2009
Posts: 10
OS: Windows XP SP3
|
Re: Malware problem changing Proxy Settings
Hi Reid
Ok finally got the GMER scan working. As it turned out, because the interface was altered and the relevant buttons were above the selection or tick boxes (rather than under them as in the screen shot), to get the "scan" and "save" buttons to work I had to click the very right hand side of the button for them to work. And you were right the "show all" box was automatically unticked (im sure you'll be glad to know :) I must also update you on the current situation. After i scanned my PC with AVG scan and deleted the malware it found I could not access the internet due to an error in the proxy settings. I assume that the malware that was deleted by AVG had altered my proxy settings in some way so when the malware were deleted, the proxy settings were changed and wouldnt work. So I went into internet options and clicked on "auto detect proxy settings for this network". That done the trick and I'm online again. However, I suspect that there are some problems remaining because my internet is still slower than it should be. Sure you will know yourself when you look at the files. Again many thanks for your time! Mike Last edited by toiletduck1; 02-12-2009 at 09:24 AM. |
|
|
|
|
02-12-2009, 02:57 PM
|
#8 (permalink) |
|
Moderator/Analyst, Security Team ; Rangemaster, TSF Academy
Join Date: Oct 2006
Posts: 4,581
OS: Vista
|
Re: Malware problem changing Proxy Settings
Hi toiletduck1, I will be helping you while Ried is away :)
Please visit this webpage for download links, and instructions for running combofix: http://www.bleepingcomputer.com/comb...o-use-combofix * Ensure you have disabled all anti virus and anti malware programs so they do not interfere with the running of ComboFix. Please include the C:\ComboFix.txt in your next reply for further review.
__________________
UNITE and ASAP since 2006  If we have helped you, please consider donating. The past won't be able to hurt you unless you keep on looking back at it. |
|
|
|
|
02-12-2009, 04:23 PM
|
#9 (permalink) |
|
Registered User
Join Date: Feb 2009
Posts: 10
OS: Windows XP SP3
|
Re: Malware problem changing Proxy Settings
Hello AngelFire
Thanks for your help. Here is the combofix txt file ComboFix 09-02-12.03 - Michael Malone 2009-02-12 23:04:28.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.503.186 [GMT 0:00] Running from: c:\documents and settings\Michael Malone\Desktop\ComboFix.exe Command switches used :: c:\documents and settings\Michael Malone\Desktop\ComboFix.exe AV: AVG 7.5.519 *On-access scanning disabled* (Outdated) * Created a new restore point . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\program files\Roxio\bin\winsrv.exe c:\windows\fmark2.dat . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_AVG7_ALERT_MANAGER_SERVER_(AVG7ALRT)_ -------\Service_AVG7 Alert Manager Server (Avg7Alrt) ((((((((((((((((((((((((( Files Created from 2009-01-12 to 2009-02-12 ))))))))))))))))))))))))))))))) . 2009-02-12 22:59 . 2009-02-12 23:00 <DIR> d-------- C:\32788R22FWJFW 2009-02-11 13:06 . 2009-02-11 13:06 <DIR> d-------- c:\documents and settings\All Users\Application Data\WinZip 2009-02-11 12:18 . 2009-02-12 15:55 250 --a------ c:\windows\gmer.ini 2009-01-31 16:37 . 2009-01-31 16:37 <DIR> d-------- c:\program files\SUPERAntiSpyware 2009-01-31 16:37 . 2009-01-31 16:37 <DIR> d-------- c:\documents and settings\Michael Malone\Application Data\SUPERAntiSpyware.com 2009-01-31 16:37 . 2009-01-31 16:37 <DIR> d-------- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com 2009-01-31 16:36 . 2009-01-31 16:36 <DIR> d-------- c:\program files\Common Files\Wise Installation Wizard 2009-01-31 15:06 . 2009-01-31 15:06 <DIR> d-------- c:\documents and settings\Michael Malone\Application Data\Malwarebytes 2009-01-31 15:05 . 2009-01-31 15:05 <DIR> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes 2009-01-29 17:39 . 2009-01-29 17:39 <DIR> d----c--- c:\documents and settings\All Users\Application Data\{83C91755-2546-441D-AC40-9A6B4B860800} 2009-01-29 17:37 . 2009-01-29 17:37 <DIR> d-------- c:\program files\Trend Micro . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-01-31 18:04 --------- d-----w c:\documents and settings\All Users\Application Data\avg7 2009-01-30 17:35 13,197,207 ----a-w c:\program files\PROCESSLIST.DB 2009-01-30 17:35 1,116,641 ----a-w c:\program files\PROCESSLISTRELATED.DB 2009-01-29 15:36 --------- d-----w c:\program files\Roxio 2008-12-30 23:34 --------- d-----w c:\program files\AC3Filter 2008-12-30 23:12 --------- d--h--w c:\program files\InstallShield Installation Information 2008-12-30 23:11 --------- d-----w c:\program files\DivX 2008-12-28 18:01 43,104 ----a-w c:\documents and settings\Michael Malone\Application Data\GDIPFONTCACHEV1.DAT 2008-12-19 12:11 26,112 ---h--w c:\windows\che08.exe 2008-12-15 12:15 --------- d-----w c:\documents and settings\All Users\Application Data\PC Drivers HeadQuarters 2008-12-20 13:32 67,688 ----a-w c:\program files\mozilla firefox\components\jar50.dll 2008-12-20 13:32 54,368 ----a-w c:\program files\mozilla firefox\components\jsd3250.dll 2008-12-20 13:32 34,944 ----a-w c:\program files\mozilla firefox\components\myspell.dll 2008-12-20 13:32 46,712 ----a-w c:\program files\mozilla firefox\components\spellchk.dll 2008-12-20 13:32 172,136 ----a-w c:\program files\mozilla firefox\components\xpinstal.dll . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360] "SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2009-01-15 1830128] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "sysberay2"="c:\windows\che08.exe" [2008-12-19 26112] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360] "AVG7_Run"="c:\progra~1\Grisoft\AVG7\avgw.exe" [2007-10-27 219136] "Nokia.PCSync"="c:\program files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-06-19 1241088] "DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-03-13 39264] [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks] "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon] 2008-12-22 11:05 356352 c:\program files\SUPERAntiSpyware\SASWINLO.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\IntelWireless] 2004-09-07 16:08 110592 c:\program files\Intel\Wireless\Bin\LgNotify.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "VIDC.JPEG"= JPEGCODE.DLL "VIDC.MJPG"= JPEGCODE.DLL "msacm.ac3filter"= ac3filter.acm [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager] BootExecute REG_MULTI_SZ \0 [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] Authentication Packages REG_MULTI_SZ msv1_0 nwprovau [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Gamma Loader.exe.lnk] path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Gamma Loader.exe.lnk backup=c:\windows\pss\Adobe Gamma Loader.exe.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Gamma Loader.lnk] path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk backup=c:\windows\pss\Adobe Gamma Loader.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk] path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Digital Line Detect.lnk] path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Digital Line Detect.lnk backup=c:\windows\pss\Digital Line Detect.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk] path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk backup=c:\windows\pss\Microsoft Office.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^Michael Malone^Start Menu^Programs^Startup^Morpheus.lnk] path=c:\documents and settings\Michael Malone\Start Menu\Programs\Startup\Morpheus.lnk backup=c:\windows\pss\Morpheus.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Photo Downloader] --a------ 2005-06-06 22:46 57344 c:\program files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Apoint] --a------ 2004-09-13 16:33 155648 c:\program files\Apoint\Apoint.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AVG7_CC] --a------ 2007-12-22 13:53 579072 c:\progra~1\Grisoft\AVG7\avgcc.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe] --a------ 2008-04-14 00:12 15360 c:\windows\system32\ctfmon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Dell QuickSet] --a------ 2005-09-01 17:24 684032 c:\program files\Dell\QuickSet\quickset.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DellSupport] --a------ 2007-03-15 10:09 460784 c:\program files\DellSupport\DSAgnt.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DMXLauncher] --a------ 2005-10-05 03:12 94208 c:\program files\Dell\Media Experience\DMXLauncher.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ehTray] --a------ 2005-09-29 14:01 67584 c:\windows\ehome\ehtray.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxhkcmd] --a------ 2005-10-14 20:46 77824 c:\windows\system32\hkcmd.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxpers] --a------ 2005-10-14 20:50 114688 c:\windows\system32\igfxpers.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxtray] --a------ 2005-10-14 20:49 94208 c:\windows\system32\igfxtray.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IntelWireless] --a------ 2004-10-30 14:59 385024 c:\program files\Intel\Wireless\Bin\iFrmewrk.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup] --a------ 2005-06-10 10:44 249856 c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler] --a------ 2005-06-10 10:44 81920 c:\program files\Common Files\InstallShield\UpdateService\issch.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper] --a------ 2005-12-20 19:54 278528 c:\program files\iTunes\iTunesHelper.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSKDetectorExe] --a------ 2005-07-12 19:05 1117184 c:\program files\McAfee\SpamKiller\MSKDetct.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] --a------ 2008-04-14 00:12 1695232 c:\program files\Messenger\msmsgs.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCSuiteTrayApplication] --a------ 2007-06-18 14:10 271360 c:\program files\Nokia\Nokia PC Suite 6\LaunchApplication.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] --a------ 2007-06-29 05:24 286720 c:\program files\QuickTime\QTTask.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] --a------ 2003-11-19 17:48 32881 c:\program files\Java\j2re1.4.2_03\bin\jusched.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe] --a------ 2006-11-08 22:50 185896 c:\program files\Common Files\Real\Update_OB\realsched.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\updateMgr] -ra------ 2006-03-30 15:45 313472 c:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Defender] --a------ 2006-11-03 18:20 866584 c:\program files\Windows Defender\MSASCui.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services] "MskService"=2 (0x2) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [2009-01-15 8944] R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [2009-01-15 55024] R2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [2006-11-03 13592] R3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [2009-01-15 7408] S3 IZNZJQO;IZNZJQO;c:\docume~1\MICHAE~1\LOCALS~1\Temp\IZNZJQO.exe --> c:\docume~1\MICHAE~1\LOCALS~1\Temp\IZNZJQO.exe [?] S4 Airtfu;Airtfu;c:\windows\system32\drivers\hpn.sys [2005-08-16 25952] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{149dc8fc-5405-11dd-a03e-001422ed22eb}] \Shell\AutoRun\command - E:\AutoRun.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{149dc8fd-5405-11dd-a03e-001422ed22eb}] \Shell\AutoRun\command - E:\AutoRun.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{361ac05d-0e0d-11da-9aa9-806d6172696f}] \Shell\AutoRun\command - E:\setup.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ee44c222-5270-11dd-a03a-001422ed22eb}] \Shell\AutoRun\command - E:\AutoRun.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ee44c226-5270-11dd-a03a-001422ed22eb}] \Shell\AutoRun\command - E:\AutoRun.exe . Contents of the 'Scheduled Tasks' folder 2009-02-12 c:\windows\Tasks\MP Scheduled Scan.job - c:\program files\Windows Defender\MpCmdRun.exe [2006-11-03 18:20] . - - - - ORPHANS REMOVED - - - - MSConfigStartUp-DLA - c:\windows\System32\DLA\DLACTRLW.EXE MSConfigStartUp-MCAgentExe - c:\progra~1\mcafee.com\agent\mcagent.exe MSConfigStartUp-McRegWiz - c:\progra~1\mcafee.com\agent\mcregwiz.exe MSConfigStartUp-MCUpdateExe - c:\progra~1\mcafee.com\agent\mcupdate.exe MSConfigStartUp-MPFExe - c:\progra~1\McAfee.com\PERSON~1\MpfTray.exe MSConfigStartUp-MSKAGENTEXE - c:\progra~1\McAfee\SPAMKI~1\MskAgent.exe MSConfigStartUp-RoboForm - c:\program files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe MSConfigStartUp-VirusScan Online - c:\progra~1\mcafee.com\vso\mcvsshld.exe . ------- Supplementary Scan ------- . uStart Page = hxxp://www.google.ie/ uInternet Settings,ProxyOverride = *.local;<local> IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office10\EXCEL.EXE/3000 FF - ProfilePath - c:\documents and settings\Michael Malone\Application Data\Mozilla\Firefox\Profiles\x06ccga9.default\ FF - prefs.js: browser.startup.homepage - www.google.ie FF - prefs.js: network.proxy.http - 127.0.0.1 FF - prefs.js: network.proxy.http_port - 8484 FF - prefs.js: network.proxy.type - 4 FF - component: c:\program files\Mozilla Firefox\components\xpinstal.dll FF - component: c:\program files\Mozilla Firefox\extensions\talkback@mozilla.org\components\qfaservices.dll . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-02-12 23:09:36 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . --------------------- DLLs Loaded Under Running Processes --------------------- - - - - - - - > 'winlogon.exe'(1008) c:\program files\SUPERAntiSpyware\SASWINLO.dll c:\program files\Intel\Wireless\Bin\LgNotify.dll . ------------------------ Other Running Processes ------------------------ . c:\program files\Intel\Wireless\Bin\EvtEng.exe c:\program files\Intel\Wireless\Bin\S24EvMon.exe c:\program files\Intel\Wireless\Bin\WLKEEPER.exe c:\program files\Intel\Wireless\Bin\ZCfgSvc.exe c:\progra~1\Intel\Wireless\Bin\1XConfig.exe c:\progra~1\Grisoft\AVG7\avgamsvr.exe c:\progra~1\Grisoft\AVG7\avgupsvc.exe c:\progra~1\Grisoft\AVG7\avgemc.exe c:\windows\ehome\ehrecvr.exe c:\windows\ehome\ehSched.exe c:\program files\Common Files\Microsoft Shared\VS7Debug\mdm.exe c:\program files\Internet Explorer\iexplore.exe c:\program files\Dell\NicConfigSvc\NicConfigSvc.exe c:\program files\Intel\Wireless\Bin\RegSrvc.exe c:\windows\ehome\mcrdsvc.exe c:\windows\system32\wscntfy.exe c:\windows\system32\dllhost.exe . ************************************************************************** . Completion time: 2009-02-12 23:14:55 - machine was rebooted ComboFix-quarantined-files.txt 2009-02-12 23:14:16 Pre-Run: 23,225,397,248 bytes free Post-Run: 23,819,276,288 bytes free WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS [operating systems] c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Windows XP Media Center Edition" /noexecute=optin /fastdetect 240 --- E O F --- 2009-02-10 09:00:42 Cheers! Mike |
|
|
|
|
02-13-2009, 10:34 AM
|
#10 (permalink) |
|
Moderator/Analyst, Security Team ; Rangemaster, TSF Academy
Join Date: Oct 2006
Posts: 4,581
OS: Vista
|
Re: Malware problem changing Proxy Settings
Hi,
*Open notepad. Copy and paste the text inside the code box below to notepad Code:
File::
c:\windows\che08.exe
c:\docume~1\MICHAE~1\LOCALS~1\Temp\IZNZJQO.exe
Driver::
IZNZJQO
Registry::
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"sysberay2"=-
DDS::
TB: {724D43A0-0D85-11D4-9908-00400523E39A} - No File
 Refering to the picture above, drag CFScript.txt into ComboFix.exe When finished, it shall produce a log for you. Post that log in your next reply. *Open notepad. Copy and paste the text inside the Code Box below into Notepad Choose File > Save As and under "Save as type", choose "All Files". Type query.bat in the File name and save it to your desktop. Code:
@echo off swreg query "HKLM\System\CurrentControlSet\Services\Airtfu" /s >check.txt notepad check.txt del check.txt del %0 *Your version of Java is outdated and needs to be updated to take advantage of fixes that have eliminated security vulnerabilities. Updating Java:
*Next, it's important to run this online scan to search for any remnants. It can take some time, so please be patient and allow it to run it's full course: Using Internet Explorer or Firefox, visit http://www.kaspersky.com/kos/eng/par...avwebscan.html 1. Click Accept, when prompted to download and install the program files and database of malware definitions. 2. To optimize scanning time and produce a more sensible report for review:
3. Click Run at the Security prompt. The program will then begin downloading and installing and will also update the database. Please be patient as this can take several minutes.
On your next reply, please include a
__________________
UNITE and ASAP since 2006 If we have helped you, please consider donating. The past won't be able to hurt you unless you keep on looking back at it. Last edited by Angelfire777; 02-13-2009 at 10:37 AM. |
|
|
|
|
02-16-2009, 03:45 PM
|
#11 (permalink) |
|
Registered User
Join Date: Feb 2009
Posts: 10
OS: Windows XP SP3
|
Re: Malware problem changing Proxy Settings
Hi AngelFire,
Here are the reports you asked for. Combofix ComboFix 09-02-12.03 - Michael Malone 2009-02-16 18:35:33.2 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.503.182 [GMT 0:00] Running from: c:\documents and settings\Michael Malone\Desktop\ComboFix.exe Command switches used :: c:\documents and settings\Michael Malone\Desktop\CFScript.txt AV: AVG 7.5.519 *On-access scanning disabled* (Updated) * Created a new restore point FILE :: c:\docume~1\MICHAE~1\LOCALS~1\Temp\IZNZJQO.exe c:\windows\che08.exe . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\windows\che08.exe . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_IZNZJQO -------\Service_IZNZJQO ((((((((((((((((((((((((( Files Created from 2009-01-16 to 2009-02-16 ))))))))))))))))))))))))))))))) . 2009-02-16 18:28 . 2009-02-16 18:34 <DIR> d-------- C:\32788R22FWJFW 2009-02-11 13:06 . 2009-02-11 13:06 <DIR> d-------- c:\documents and settings\All Users\Application Data\WinZip 2009-02-11 12:18 . 2009-02-12 15:55 250 --a------ c:\windows\gmer.ini 2009-01-31 16:37 . 2009-01-31 16:37 <DIR> d-------- c:\program files\SUPERAntiSpyware 2009-01-31 16:37 . 2009-01-31 16:37 <DIR> d-------- c:\documents and settings\Michael Malone\Application Data\SUPERAntiSpyware.com 2009-01-31 16:37 . 2009-01-31 16:37 <DIR> d-------- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com 2009-01-31 16:36 . 2009-01-31 16:36 <DIR> d-------- c:\program files\Common Files\Wise Installation Wizard 2009-01-31 15:06 . 2009-01-31 15:06 <DIR> d-------- c:\documents and settings\Michael Malone\Application Data\Malwarebytes 2009-01-31 15:05 . 2009-01-31 15:05 <DIR> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes 2009-01-29 17:39 . 2009-01-29 17:39 <DIR> d----c--- c:\documents and settings\All Users\Application Data\{83C91755-2546-441D-AC40-9A6B4B860800} 2009-01-29 17:37 . 2009-01-29 17:37 <DIR> d-------- c:\program files\Trend Micro . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-01-31 18:04 --------- d-----w c:\documents and settings\All Users\Application Data\avg7 2009-01-30 17:35 13,197,207 ----a-w c:\program files\PROCESSLIST.DB 2009-01-30 17:35 1,116,641 ----a-w c:\program files\PROCESSLISTRELATED.DB 2009-01-29 15:36 --------- d-----w c:\program files\Roxio 2008-12-30 23:34 --------- d-----w c:\program files\AC3Filter 2008-12-30 23:12 --------- d--h--w c:\program files\InstallShield Installation Information 2008-12-30 23:11 --------- d-----w c:\program files\DivX 2008-12-28 18:01 43,104 ----a-w c:\documents and settings\Michael Malone\Application Data\GDIPFONTCACHEV1.DAT 2008-12-20 13:32 67,688 ----a-w c:\program files\mozilla firefox\components\jar50.dll 2008-12-20 13:32 54,368 ----a-w c:\program files\mozilla firefox\components\jsd3250.dll 2008-12-20 13:32 34,944 ----a-w c:\program files\mozilla firefox\components\myspell.dll 2008-12-20 13:32 46,712 ----a-w c:\program files\mozilla firefox\components\spellchk.dll 2008-12-20 13:32 172,136 ----a-w c:\program files\mozilla firefox\components\xpinstal.dll . ((((((((((((((((((((((((((((( SnapShot@2009-02-12_23.13.13.87 ))))))))))))))))))))))))))))))))))))))))) . + 2008-10-16 20:38:34 124,928 -c----w c:\windows\ie7updates\KB961260-IE7\advpack.dll + 2008-10-16 20:38:34 347,136 -c----w c:\windows\ie7updates\KB961260-IE7\dxtmsft.dll + 2008-10-16 20:38:34 214,528 -c----w c:\windows\ie7updates\KB961260-IE7\dxtrans.dll + 2008-10-16 20:38:35 133,120 -c----w c:\windows\ie7updates\KB961260-IE7\extmgr.dll + 2008-10-16 20:38:35 63,488 -c----w c:\windows\ie7updates\KB961260-IE7\icardie.dll + 2008-10-16 13:11:09 70,656 -c----w c:\windows\ie7updates\KB961260-IE7\ie4uinit.exe + 2008-10-16 20:38:35 153,088 -c----w c:\windows\ie7updates\KB961260-IE7\ieakeng.dll + 2008-10-16 20:38:35 230,400 -c----w c:\windows\ie7updates\KB961260-IE7\ieaksie.dll + 2008-10-15 07:04:53 161,792 -c----w c:\windows\ie7updates\KB961260-IE7\ieakui.dll + 2008-10-16 20:38:35 383,488 -c----w c:\windows\ie7updates\KB961260-IE7\ieapfltr.dll + 2008-10-16 20:38:35 384,512 -c----w c:\windows\ie7updates\KB961260-IE7\iedkcs32.dll + 2008-10-16 20:38:37 6,066,176 -c----w c:\windows\ie7updates\KB961260-IE7\ieframe.dll + 2008-10-16 20:38:37 44,544 -c----w c:\windows\ie7updates\KB961260-IE7\iernonce.dll + 2008-10-16 20:38:37 267,776 -c----w c:\windows\ie7updates\KB961260-IE7\iertutil.dll + 2008-10-16 13:11:09 13,824 -c----w c:\windows\ie7updates\KB961260-IE7\ieudinit.exe + 2008-10-15 07  26 633,632 -c----w c:\windows\ie7updates\KB961260-IE7\iexplore.exe+ 2008-10-16 20:38:37 27,648 -c----w c:\windows\ie7updates\KB961260-IE7\jsproxy.dll + 2008-10-16 20:38:37 459,264 -c----w c:\windows\ie7updates\KB961260-IE7\msfeeds.dll + 2008-10-16 20:38:37 52,224 -c----w c:\windows\ie7updates\KB961260-IE7\msfeedsbs.dll + 2008-12-13 06:40:02 3,593,216 -c----w c:\windows\ie7updates\KB961260-IE7\mshtml.dll + 2008-10-16 20:38:38 477,696 -c----w c:\windows\ie7updates\KB961260-IE7\mshtmled.dll + 2008-10-16 20:38:38 193,024 -c----w c:\windows\ie7updates\KB961260-IE7\msrating.dll + 2008-10-16 20:38:39 671,232 -c----w c:\windows\ie7updates\KB961260-IE7\mstime.dll + 2008-10-16 20:38:39 102,912 -c----w c:\windows\ie7updates\KB961260-IE7\occache.dll + 2008-10-16 20:38:39 44,544 -c----w c:\windows\ie7updates\KB961260-IE7\pngfilt.dll + 2007-03-06 01:22:41 213,216 -c----w c:\windows\ie7updates\KB961260-IE7\spuninst\spuninst.exe + 2007-03-06 01:23:51 371,424 -c----w c:\windows\ie7updates\KB961260-IE7\spuninst\updspapi.dll + 2008-10-16 20:38:39 105,984 -c----w c:\windows\ie7updates\KB961260-IE7\url.dll + 2008-10-16 20:38:39 1,160,192 -c----w c:\windows\ie7updates\KB961260-IE7\urlmon.dll + 2008-10-16 20:38:39 233,472 -c----w c:\windows\ie7updates\KB961260-IE7\webcheck.dll + 2008-10-16 20:38:40 826,368 -c----w c:\windows\ie7updates\KB961260-IE7\wininet.dll - 2008-10-16 20:38:34 124,928 ----a-w c:\windows\system32\advpack.dll + 2008-12-20 23:15:11 124,928 ----a-w c:\windows\system32\advpack.dll - 2008-10-16 20:38:34 124,928 ------w c:\windows\system32\dllcache\advpack.dll + 2008-12-20 23:15:11 124,928 ------w c:\windows\system32\dllcache\advpack.dll - 2008-10-16 20:38:34 347,136 ------w c:\windows\system32\dllcache\dxtmsft.dll + 2008-12-20 23:15:12 347,136 ------w c:\windows\system32\dllcache\dxtmsft.dll - 2008-10-16 20:38:34 214,528 ------w c:\windows\system32\dllcache\dxtrans.dll + 2008-12-20 23:15:13 214,528 ------w c:\windows\system32\dllcache\dxtrans.dll - 2008-10-16 20:38:35 133,120 ------w c:\windows\system32\dllcache\extmgr.dll + 2008-12-20 23:15:13 133,120 ------w c:\windows\system32\dllcache\extmgr.dll - 2008-10-16 20:38:35 63,488 ------w c:\windows\system32\dllcache\icardie.dll + 2008-12-20 23:15:13 63,488 ------w c:\windows\system32\dllcache\icardie.dll - 2008-10-16 13:11:09 70,656 ------w c:\windows\system32\dllcache\ie4uinit.exe + 2008-12-19 09:10:15 70,656 ------w c:\windows\system32\dllcache\ie4uinit.exe - 2008-10-16 20:38:35 153,088 ------w c:\windows\system32\dllcache\ieakeng.dll + 2008-12-20 23:15:14 153,088 ------w c:\windows\system32\dllcache\ieakeng.dll - 2008-10-16 20:38:35 230,400 ------w c:\windows\system32\dllcache\ieaksie.dll + 2008-12-20 23:15:14 230,400 ------w c:\windows\system32\dllcache\ieaksie.dll - 2008-10-15 07:04:53 161,792 ------w c:\windows\system32\dllcache\ieakui.dll + 2008-12-19 05:23:56 161,792 ------w c:\windows\system32\dllcache\ieakui.dll - 2008-10-16 20:38:35 383,488 ------w c:\windows\system32\dllcache\ieapfltr.dll + 2008-12-20 23:15:15 383,488 ------w c:\windows\system32\dllcache\ieapfltr.dll - 2008-10-16 20:38:35 384,512 ------w c:\windows\system32\dllcache\iedkcs32.dll + 2008-12-20 23:15:16 384,512 ------w c:\windows\system32\dllcache\iedkcs32.dll - 2008-10-16 20:38:37 6,066,176 ------w c:\windows\system32\dllcache\ieframe.dll + 2008-12-20 23:15:21 6,066,688 ------w c:\windows\system32\dllcache\ieframe.dll - 2008-10-16 20:38:37 44,544 ------w c:\windows\system32\dllcache\iernonce.dll + 2008-12-20 23:15:21 44,544 ------w c:\windows\system32\dllcache\iernonce.dll - 2008-10-16 20:38:37 267,776 ------w c:\windows\system32\dllcache\iertutil.dll + 2008-12-20 23:15:22 267,776 ------w c:\windows\system32\dllcache\iertutil.dll - 2008-10-16 13:11:09 13,824 ------w c:\windows\system32\dllcache\ieudinit.exe + 2008-12-19 09:10:15 13,824 ------w c:\windows\system32\dllcache\ieudinit.exe - 2008-10-15 07 26 633,632 ------w c:\windows\system32\dllcache\iexplore.exe+ 2008-12-19 05:25:25 634,024 ------w c:\windows\system32\dllcache\iexplore.exe - 2008-10-16 20:38:37 27,648 ------w c:\windows\system32\dllcache\jsproxy.dll + 2008-12-20 23:15:23 27,648 ------w c:\windows\system32\dllcache\jsproxy.dll - 2008-10-16 20:38:37 459,264 ------w c:\windows\system32\dllcache\msfeeds.dll + 2008-12-20 23:15:23 459,264 ------w c:\windows\system32\dllcache\msfeeds.dll - 2008-10-16 20:38:37 52,224 ------w c:\windows\system32\dllcache\msfeedsbs.dll + 2008-12-20 23:15:24 52,224 ------w c:\windows\system32\dllcache\msfeedsbs.dll - 2008-12-13 06:40:02 3,593,216 ----a-w c:\windows\system32\dllcache\mshtml.dll + 2009-01-16 21:35:14 3,594,752 ----a-w c:\windows\system32\dllcache\mshtml.dll - 2008-10-16 20:38:38 477,696 ------w c:\windows\system32\dllcache\mshtmled.dll + 2008-12-20 23:15:30 477,696 ------w c:\windows\system32\dllcache\mshtmled.dll - 2008-10-16 20:38:38 193,024 ------w c:\windows\system32\dllcache\msrating.dll + 2008-12-20 23:15:31 193,024 ------w c:\windows\system32\dllcache\msrating.dll - 2008-10-16 20:38:39 671,232 ------w c:\windows\system32\dllcache\mstime.dll + 2008-12-20 23:15:32 671,232 ------w c:\windows\system32\dllcache\mstime.dll - 2008-10-16 20:38:39 102,912 ------w c:\windows\system32\dllcache\occache.dll + 2008-12-20 23:15:38 102,912 ------w c:\windows\system32\dllcache\occache.dll - 2008-10-16 20:38:39 44,544 ------w c:\windows\system32\dllcache\pngfilt.dll + 2008-12-20 23:15:38 44,544 ------w c:\windows\system32\dllcache\pngfilt.dll - 2008-10-16 20:38:39 105,984 ------w c:\windows\system32\dllcache\url.dll + 2008-12-20 23:15:39 105,984 ------w c:\windows\system32\dllcache\url.dll - 2008-10-16 20:38:39 1,160,192 ----a-w c:\windows\system32\dllcache\urlmon.dll + 2008-12-20 23:15:40 1,160,192 ----a-w c:\windows\system32\dllcache\urlmon.dll - 2008-10-16 20:38:39 233,472 ------w c:\windows\system32\dllcache\webcheck.dll + 2008-12-20 23:15:40 233,472 ------w c:\windows\system32\dllcache\webcheck.dll - 2008-10-16 20:38:40 826,368 ----a-w c:\windows\system32\dllcache\wininet.dll + 2008-12-20 23:15:41 826,368 ----a-w c:\windows\system32\dllcache\wininet.dll - 2008-10-16 20:38:34 347,136 ----a-w c:\windows\system32\dxtmsft.dll + 2008-12-20 23:15:12 347,136 ----a-w c:\windows\system32\dxtmsft.dll - 2008-10-16 20:38:34 214,528 ----a-w c:\windows\system32\dxtrans.dll + 2008-12-20 23:15:13 214,528 ----a-w c:\windows\system32\dxtrans.dll - 2008-10-16 20:38:35 133,120 ----a-w c:\windows\system32\extmgr.dll + 2008-12-20 23:15:13 133,120 ----a-w c:\windows\system32\extmgr.dll - 2008-10-16 20:38:35 63,488 ----a-w c:\windows\system32\icardie.dll + 2008-12-20 23:15:13 63,488 ----a-w c:\windows\system32\icardie.dll - 2008-10-16 13:11:09 70,656 ----a-w c:\windows\system32\ie4uinit.exe + 2008-12-19 09:10:15 70,656 ----a-w c:\windows\system32\ie4uinit.exe - 2008-10-16 20:38:35 153,088 ----a-w c:\windows\system32\ieakeng.dll + 2008-12-20 23:15:14 153,088 ----a-w c:\windows\system32\ieakeng.dll - 2008-10-16 20:38:35 230,400 ----a-w c:\windows\system32\ieaksie.dll + 2008-12-20 23:15:14 230,400 ----a-w c:\windows\system32\ieaksie.dll - 2008-10-15 07:04:53 161,792 ----a-w c:\windows\system32\ieakui.dll + 2008-12-19 05:23:56 161,792 ----a-w c:\windows\system32\ieakui.dll - 2008-10-16 20:38:35 383,488 ----a-w c:\windows\system32\ieapfltr.dll + 2008-12-20 23:15:15 383,488 ----a-w c:\windows\system32\ieapfltr.dll - 2008-10-16 20:38:35 384,512 ----a-w c:\windows\system32\iedkcs32.dll + 2008-12-20 23:15:16 384,512 ----a-w c:\windows\system32\iedkcs32.dll - 2008-10-16 20:38:37 6,066,176 ----a-w c:\windows\system32\ieframe.dll + 2008-12-20 23:15:21 6,066,688 ----a-w c:\windows\system32\ieframe.dll - 2008-10-16 20:38:37 44,544 ----a-w c:\windows\system32\iernonce.dll + 2008-12-20 23:15:21 44,544 ----a-w c:\windows\system32\iernonce.dll - 2008-10-16 20:38:37 267,776 ----a-w c:\windows\system32\iertutil.dll + 2008-12-20 23:15:22 267,776 ----a-w c:\windows\system32\iertutil.dll - 2008-10-16 13:11:09 13,824 ----a-w c:\windows\system32\ieudinit.exe + 2008-12-19 09:10:15 13,824 ----a-w c:\windows\system32\ieudinit.exe - 2008-10-16 20:38:37 27,648 ----a-w c:\windows\system32\jsproxy.dll + 2008-12-20 23:15:23 27,648 ----a-w c:\windows\system32\jsproxy.dll - 2009-01-10 01:35:28 20,853,704 ----a-w c:\windows\system32\MRT.exe + 2009-02-12 04:56:17 21,244,872 ----a-w c:\windows\system32\MRT.exe - 2008-10-16 20:38:37 459,264 ----a-w c:\windows\system32\msfeeds.dll + 2008-12-20 23:15:23 459,264 ----a-w c:\windows\system32\msfeeds.dll - 2008-10-16 20:38:37 52,224 ----a-w c:\windows\system32\msfeedsbs.dll + 2008-12-20 23:15:24 52,224 ----a-w c:\windows\system32\msfeedsbs.dll - 2008-12-13 06:40:02 3,593,216 ----a-w c:\windows\system32\mshtml.dll + 2009-01-16 21:35:14 3,594,752 ----a-w c:\windows\system32\mshtml.dll - 2008-10-16 20:38:38 477,696 ----a-w c:\windows\system32\mshtmled.dll + 2008-12-20 23:15:30 477,696 ----a-w c:\windows\system32\mshtmled.dll - 2008-10-16 20:38:38 193,024 ----a-w c:\windows\system32\msrating.dll + 2008-12-20 23:15:31 193,024 ----a-w c:\windows\system32\msrating.dll - 2008-10-16 20:38:39 671,232 ----a-w c:\windows\system32\mstime.dll + 2008-12-20 23:15:32 671,232 ----a-w c:\windows\system32\mstime.dll - 2008-10-16 20:38:39 102,912 ----a-w c:\windows\system32\occache.dll + 2008-12-20 23:15:38 102,912 ----a-w c:\windows\system32\occache.dll - 2008-10-16 20:38:39 44,544 ----a-w c:\windows\system32\pngfilt.dll + 2008-12-20 23:15:38 44,544 ----a-w c:\windows\system32\pngfilt.dll - 2007-11-30 12:39:22 17,272 ------w c:\windows\system32\spmsg.dll + 2008-07-09 07:38:24 17,272 ------w c:\windows\system32\spmsg.dll - 2008-10-16 20:38:39 105,984 ----a-w c:\windows\system32\url.dll + 2008-12-20 23:15:39 105,984 ----a-w c:\windows\system32\url.dll - 2008-10-16 20:38:39 1,160,192 ----a-w c:\windows\system32\urlmon.dll + 2008-12-20 23:15:40 1,160,192 ----a-w c:\windows\system32\urlmon.dll - 2008-10-16 20:38:39 233,472 ----a-w c:\windows\system32\webcheck.dll + 2008-12-20 23:15:40 233,472 ----a-w c:\windows\system32\webcheck.dll - 2008-10-16 20:38:40 826,368 ----a-w c:\windows\system32\wininet.dll + 2008-12-20 23:15:41 826,368 ----a-w c:\windows\system32\wininet.dll . -- Snapshot reset to current date -- . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360] "SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2009-01-15 1830128] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360] "AVG7_Run"="c:\progra~1\Grisoft\AVG7\avgw.exe" [2007-10-27 219136] "Nokia.PCSync"="c:\program files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-06-19 1241088] "DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-03-13 39264] [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks] "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon] 2008-12-22 11:05 356352 c:\program files\SUPERAntiSpyware\SASWINLO.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\IntelWireless] 2004-09-07 16:08 110592 c:\program files\Intel\Wireless\Bin\LgNotify.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "VIDC.JPEG"= JPEGCODE.DLL "VIDC.MJPG"= JPEGCODE.DLL "msacm.ac3filter"= ac3filter.acm [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager] BootExecute REG_MULTI_SZ \0 [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] Authentication Packages REG_MULTI_SZ msv1_0 nwprovau [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Gamma Loader.exe.lnk] path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Gamma Loader.exe.lnk backup=c:\windows\pss\Adobe Gamma Loader.exe.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Gamma Loader.lnk] path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk backup=c:\windows\pss\Adobe Gamma Loader.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk] path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Digital Line Detect.lnk] path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Digital Line Detect.lnk backup=c:\windows\pss\Digital Line Detect.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk] path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk backup=c:\windows\pss\Microsoft Office.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^Michael Malone^Start Menu^Programs^Startup^Morpheus.lnk] path=c:\documents and settings\Michael Malone\Start Menu\Programs\Startup\Morpheus.lnk backup=c:\windows\pss\Morpheus.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Photo Downloader] --a------ 2005-06-06 22:46 57344 c:\program files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Apoint] --a------ 2004-09-13 16:33 155648 c:\program files\Apoint\Apoint.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AVG7_CC] --a------ 2007-12-22 13:53 579072 c:\progra~1\Grisoft\AVG7\avgcc.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe] --a------ 2008-04-14 00:12 15360 c:\windows\system32\ctfmon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Dell QuickSet] --a------ 2005-09-01 17:24 684032 c:\program files\Dell\QuickSet\quickset.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DellSupport] --a------ 2007-03-15 10:09 460784 c:\program files\DellSupport\DSAgnt.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DMXLauncher] --a------ 2005-10-05 03:12 94208 c:\program files\Dell\Media Experience\DMXLauncher.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ehTray] --a------ 2005-09-29 14:01 67584 c:\windows\ehome\ehtray.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxhkcmd] --a------ 2005-10-14 20:46 77824 c:\windows\system32\hkcmd.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxpers] --a------ 2005-10-14 20:50 114688 c:\windows\system32\igfxpers.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxtray] --a------ 2005-10-14 20:49 94208 c:\windows\system32\igfxtray.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IntelWireless] --a------ 2004-10-30 14:59 385024 c:\program files\Intel\Wireless\Bin\iFrmewrk.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup] --a------ 2005-06-10 10:44 249856 c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler] --a------ 2005-06-10 10:44 81920 c:\program files\Common Files\InstallShield\UpdateService\issch.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper] --a------ 2005-12-20 19:54 278528 c:\program files\iTunes\iTunesHelper.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSKDetectorExe] --a------ 2005-07-12 19:05 1117184 c:\program files\McAfee\SpamKiller\MSKDetct.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] --a------ 2008-04-14 00:12 1695232 c:\program files\Messenger\msmsgs.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCSuiteTrayApplication] --a------ 2007-06-18 14:10 271360 c:\program files\Nokia\Nokia PC Suite 6\LaunchApplication.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] --a------ 2007-06-29 05:24 286720 c:\program files\QuickTime\QTTask.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] --a------ 2003-11-19 17:48 32881 c:\program files\Java\j2re1.4.2_03\bin\jusched.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe] --a------ 2006-11-08 22:50 185896 c:\program files\Common Files\Real\Update_OB\realsched.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\updateMgr] -ra------ 2006-03-30 15:45 313472 c:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Defender] --a------ 2006-11-03 18:20 866584 c:\program files\Windows Defender\MSASCui.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services] "MskService"=2 (0x2) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [2009-01-15 8944] R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [2009-01-15 55024] R2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [2006-11-03 13592] R3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [2009-01-15 7408] S4 Airtfu;Airtfu;c:\windows\system32\drivers\hpn.sys [2005-08-16 25952] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{149dc8fc-5405-11dd-a03e-001422ed22eb}] \Shell\AutoRun\command - E:\AutoRun.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{149dc8fd-5405-11dd-a03e-001422ed22eb}] \Shell\AutoRun\command - E:\AutoRun.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{361ac05d-0e0d-11da-9aa9-806d6172696f}] \Shell\AutoRun\command - E:\setup.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ee44c222-5270-11dd-a03a-001422ed22eb}] \Shell\AutoRun\command - E:\AutoRun.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ee44c226-5270-11dd-a03a-001422ed22eb}] \Shell\AutoRun\command - E:\AutoRun.exe . Contents of the 'Scheduled Tasks' folder 2009-02-16 c:\windows\Tasks\MP Scheduled Scan.job - c:\program files\Windows Defender\MpCmdRun.exe [2006-11-03 18:20] . . ------- Supplementary Scan ------- . uStart Page = hxxp://www.google.ie/ uInternet Settings,ProxyOverride = *.local;<local> IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office10\EXCEL.EXE/3000 FF - ProfilePath - c:\documents and settings\Michael Malone\Application Data\Mozilla\Firefox\Profiles\x06ccga9.default\ FF - prefs.js: browser.startup.homepage - www.google.ie FF - prefs.js: network.proxy.http - 127.0.0.1 FF - prefs.js: network.proxy.http_port - 8484 FF - prefs.js: network.proxy.type - 4 FF - component: c:\program files\Mozilla Firefox\components\xpinstal.dll FF - component: c:\program files\Mozilla Firefox\extensions\talkback@mozilla.org\components\qfaservices.dll . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-02-16 18:41:50 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... c:\windows\TEMP\TMP0000001E84FB74876BEF5AB0 524288 bytes executable scan completed successfully hidden files: 1 ************************************************************************** . --------------------- DLLs Loaded Under Running Processes --------------------- - - - - - - - > 'winlogon.exe'(1008) c:\program files\SUPERAntiSpyware\SASWINLO.dll c:\program files\Intel\Wireless\Bin\LgNotify.dll . ------------------------ Other Running Processes ------------------------ . c:\program files\Intel\Wireless\Bin\EvtEng.exe c:\program files\Intel\Wireless\Bin\S24EvMon.exe c:\program files\Intel\Wireless\Bin\WLKEEPER.exe c:\program files\Intel\Wireless\Bin\ZCfgSvc.exe c:\progra~1\Intel\Wireless\Bin\1XConfig.exe c:\progra~1\Grisoft\AVG7\avgamsvr.exe c:\progra~1\Grisoft\AVG7\avgupsvc.exe c:\progra~1\Grisoft\AVG7\avgemc.exe c:\windows\ehome\ehrecvr.exe c:\windows\ehome\ehSched.exe c:\program files\Common Files\Microsoft Shared\VS7Debug\mdm.exe c:\program files\Dell\NicConfigSvc\NicConfigSvc.exe c:\program files\Intel\Wireless\Bin\RegSrvc.exe c:\windows\ehome\mcrdsvc.exe c:\windows\system32\dllhost.exe c:\windows\system32\wscntfy.exe . ************************************************************************** . Completion time: 2009-02-16 18:47:06 - machine was rebooted ComboFix-quarantined-files.txt 2009-02-16 18:46:48 ComboFix2.txt 2009-02-12 23:14:56 Pre-Run: 23,531,089,920 bytes free Post-Run: 23,521,579,008 bytes free 376 --- E O F --- 2009-02-13 12:41:39 Query.bat scan report SteelWerX Registry Console Tool 2.0 Written by Bobbi Flekman 2006 (C) HKEY_LOCAL_MACHINE\system\currentcontrolset\services\airtfu ErrorControl REG_DWORD 0 (0x0) Type REG_DWORD 1 (0x1) Group REG_SZ Keyboard Class Tag REG_DWORD 1 (0x1) ImagePath REG_SZ C:\WINDOWS\system32\drivers\hpn.sys Start REG_DWORD 4 (0x4) HKEY_LOCAL_MACHINE\system\currentcontrolset\services\airtfu\Security Security REG_BINARY 01001480900000009c000000140000003000000002001c000100000002801400ff010f00010100000000000100000000020060000400000000001400fd01020001010000000000051200000000001800ff010f0001020000000000052000000020020000000014008d01020001010000000000050b00000000001800fd0102000102000000000005d800af00f600740000009a0000006200000a0a000000000055000200b6006a00 The Kaspersky Online Scan Report -------------------------------------------------------------------------------- KASPERSKY ONLINE SCANNER 7 REPORT Monday, February 16, 2009 Operating System: Microsoft Windows XP Professional Service Pack 3 (build 2600) Kaspersky Online Scanner 7 version: 7.0.25.0 Program database last update: Monday, February 16, 2009 14:36:31 Records in database: 1803468 -------------------------------------------------------------------------------- Scan settings: Scan using the following database: extended Scan archives: yes Scan mail databases: yes Scan area - My Computer: C:\ D:\ Scan statistics: Files scanned: 73373 Threat name: 1 Infected objects: 1 Suspicious objects: 0 Duration of the scan: 01:46:33 File name / Threat name / Threats count C:\Documents and Settings\Michael Malone\.housecall6.6\Quarantine\813686.dll.bac_a04540 Infected: not-a-virus:AdWare.Win32.E404.ix 1 The selected area was scanned. Is everything ok? Any advice in particular to further safeguard my laptop? And thanks for all the help. I'll be sure to donate something for the trouble. Mike |
|
|
|
|
02-17-2009, 05:15 PM
|
#12 (permalink) |
|
Moderator/Analyst, Security Team ; Rangemaster, TSF Academy
Join Date: Oct 2006
Posts: 4,581
OS: Vista
|
Re: Malware problem changing Proxy Settings
Hi,
You can delete this whole folder: C:\Documents and Settings\Michael Malone\.housecall6.6 empty your recycle bin. Logs look ok. How is it running? I'll give you some advice before I close the thread.
__________________
UNITE and ASAP since 2006 If we have helped you, please consider donating. The past won't be able to hurt you unless you keep on looking back at it. |
|
|
|
|
02-18-2009, 06:22 AM
|
#13 (permalink) |
|
Registered User
Join Date: Feb 2009
Posts: 10
OS: Windows XP SP3
|
Re: Malware problem changing Proxy Settings
Hi AngelFire,
I deleted that file and emptied my recycle bin. Overall, my laptop is running much better now. The startup doesnt seem to take as long and I am not being redirected to various sites when browsing the net. Also the download speeds (or transitions between webpages) is much faster now. So all and all happy days! Previously I was not very security conscious but I am now so could you recommend any programs or procedures that can help protect my pc? Also, do you know any good books or websites that explain the security issues related to the internet? Many thanks for your help! Mike |
|
|
|
|
02-18-2009, 10:26 AM
|
#14 (permalink) |
|
Moderator/Analyst, Security Team ; Rangemaster, TSF Academy
Join Date: Oct 2006
Posts: 4,581
OS: Vista
|
Re: Malware problem changing Proxy Settings
You're very welcome. Glad to hear everything's running fine!
Click start > run > copy and paste: combofix /u That will hide your system files, clear your system restore cache and uninstall combofix. Note: Make sure you update your Antivirus programs and other security products regularly to avoid new threats that could infect your system. Read TonyKlein's How Did I Get Infected In The First Place?. and please check out miekiemoes' "How to Prevent Malware" Happy safe surfing! Note: Please reply to this thread one last time so I could mark it as resolved.
__________________
UNITE and ASAP since 2006 If we have helped you, please consider donating. The past won't be able to hurt you unless you keep on looking back at it. |
|
|
|
| Thread Tools | |
|
|
