|
|
|
|
|||||
|
|
|
|
|
|
|||
| Welcome
to Tech Support Forum home to more then 136,000 problems solved. Issues
have included: Spyware, Malware, Virus Issues, Windows, Microsoft,
Linux, Networking, Security, Hardware, and Gaming Getting your
problem solved is as easy as: 1. Registering for a free account 2. Asking your question 3. Receiving an answer Registered members: * See fewer ads. * And much more..
|
|
| Want to know how to post a question? click here | Having problems with spyware and pop-ups? First Steps |
|
|||||||
| Resolved HJT Threads Resolved spyware and popup issues. |
|
|
LinkBack | Thread Tools |
03-23-2009, 06:58 PM
|
#1 (permalink) |
|
Registered User
Join Date: Mar 2009
Posts: 4
OS: XP
|
Ntoskrnl-hook
I recently noticed my computer running much slower. I ran McAfee and found NTOSKRNL-HOOK trojan. McAfee says that the trojan is deleted every time I run it, but inevitably it shows up again the next time I scan.
Around the time i noticed the virus, I also found that everytime I booted up the windows firewall would be turned off and I would have to go manually turn it back on. I have read the instructions for help cleansing this virus and so the after this sentence ends you will find the results from the DDS.txt DDS (Ver_09-03-16.01) - NTFSx86 Run by The Dope Master at 20:19:52.53 on Mon 03/23/2009 Internet Explorer: 7.0.5730.13 BrowserJavaVersion: 1.6.0_12 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2047.1309 [GMT -4:00] AV: McAfee VirusScan Enterprise *On-access scanning enabled* (Updated) ============== Running Processes =============== C:\WINDOWS\system32\svchost -k DcomLaunch svchost.exe C:\WINDOWS\System32\svchost.exe -k netsvcs svchost.exe svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Creative\SBAudigy2ZS\Surround Mixer\CTSysVol.exe C:\Program Files\Creative\SBAudigy2ZS\DVDAudio\CTDVDDet.EXE C:\WINDOWS\system32\CTHELPER.EXE C:\Program Files\McAfee\Common Framework\UdaterUI.exe C:\Program Files\HP\HP Software Update\HPWuSchd2.exe C:\Program Files\McAfee\Common Framework\McTray.exe C:\PROGRA~1\CYBERL~1\INSTAN~1\Win2K\IBurn.exe C:\Program Files\lg_fwupdate\fwupdate.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\D-Tools\daemon.exe C:\Program Files\Java\jre6\bin\jusched.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe C:\Documents and Settings\The Dope Master\Local Settings\Application Data\Google\Update\GoogleUpdate.exe C:\Program Files\Logitech\SetPoint\KEM.exe C:\Program Files\Logitech\SetPoint\KHALMNPR.EXE C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\WINDOWS\system32\CTSvcCDA.EXE C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe C:\WINDOWS\system32\svchost.exe -k hpdevmgmt C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\Program Files\McAfee\Common Framework\FrameworkService.exe C:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe C:\WINDOWS\System32\svchost.exe -k HPZ12 C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\System32\svchost.exe -k HPZ12 C:\WINDOWS\System32\svchost.exe -k imgsvc C:\WINDOWS\system32\MsPMSPSv.exe C:\Program Files\Linksys Wireless-G PCI Network Adapter with SpeedBooster\WLService.exe C:\Program Files\Linksys Wireless-G PCI Network Adapter with SpeedBooster\WMP54GSv1_1.exe C:\Documents and Settings\The Dope Master\Desktop\dds.scr ============== Pseudo HJT Report =============== uInternet Settings,ProxyOverride = localhost;*.local BHO: HP Print Enhancer: {0347c33e-8762-4905-bf09-768834316c61} - c:\program files\hp\smart web printing\hpswp_printenhancer.dll BHO: HP Print Clips: {053f9267-dc04-4294-a72c-58f732d338c0} - c:\program files\hp\smart web printing\hpswp_framework.dll BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll BHO: scriptproxy: {7db2d5a0-7241-4e79-b68d-6309f01c5231} - c:\program files\mcafee\virusscan enterprise\scriptcl.dll BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.0.926.3450\swg.dll BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe uRun: [LDM] c:\program files\logitech\desktop messenger\8876480\program\BackWeb-8876480.exe uRun: [Power2GoExpress] uRun: [Google Update] "c:\documents and settings\the dope master\local settings\application data\google\update\GoogleUpdate.exe" /c mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup mRun: [nwiz] nwiz.exe /install mRun: [CTSysVol] c:\program files\creative\sbaudigy2zs\surround mixer\CTSysVol.exe /r mRun: [CTDVDDET] c:\program files\creative\sbaudigy2zs\dvdaudio\CTDVDDet.EXE mRun: [CTHelper] CTHELPER.EXE mRun: [SBDrvDet] c:\program files\creative\sb drive det\SBDrvDet.exe /r mRun: [UpdReg] c:\windows\UpdReg.EXE mRun: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe" mRun: [ShStatEXE] "c:\program files\mcafee\virusscan enterprise\SHSTAT.EXE" /STANDALONE mRun: [McAfeeUpdaterUI] "c:\program files\mcafee\common framework\UdaterUI.exe" /StartedFromRunKey mRun: [HP Software Update] c:\program files\hp\hp software update\HPWuSchd2.exe mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe" mRun: [InstantBurn] c:\progra~1\cyberl~1\instan~1\win2k\IBurn.exe mRun: [LGODDFU] "c:\program files\lg_fwupdate\fwupdate.exe" blrun mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit mRun: [DAEMON Tools-1033] "c:\program files\d-tools\daemon.exe" -lang 1033 mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe" StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\logite~2.lnk - c:\program files\logitech\desktop messenger\8876480\program\LDMConf.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\logite~1.lnk - c:\program files\logitech\setpoint\KEM.exe IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000 IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~2\office12\ONBttnIE.dll IE: {58ECB495-38F0-49cb-A538-10282ABF65E7} - {E763472E-A716-4CD9-89BD-DBDA6122F741} - c:\program files\hp\smart web printing\hpswp_extensions.dll IE: {700259D7-1666-479a-93B1-3250410481E8} - {A93C41D8-01F8-4F8B-B14C-DE20B117E636} - c:\program files\hp\smart web printing\hpswp_extensions.dll IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL Trusted Zone: aol.com\free DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} - hxxp://www.nvidia.com/content/DriverDownload/srl/3.0.0.0/srl_bin/sysreqlab3.cab DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} - hxxp://gfx2.hotmail.com/mail/w3/resources/MSNPUpld.cab DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1228693487889 DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_12-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_12-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_12-windows-i586.cab TCP: NameServer = 85.255.112.66,85.255.112.131 TCP: {332D97BC-A23E-49AE-9886-3B81C35DE989} = 85.255.112.66,85.255.112.131 Handler: ebk - {1E411CE8-FE8B-4973-B8E0-6EA2CC3C6B06} - c:\windows\system32\ebkp.dll Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\program files\microsoft office\office12\GrooveSystemServices.dll SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll ================= FIREFOX =================== FF - ProfilePath - c:\docume~1\thedop~1\applic~1\mozilla\firefox\profiles\njzrfmjf.default\ FF - prefs.js: browser.startup.homepage - hxxps://my.usf.edu/webapps/portal/frameset.jsp FF - plugin: c:\documents and settings\the dope master\local settings\application data\google\update\1.2.141.5\npGoogleOneClick7.dll FF - plugin: c:\program files\google\google updater\2.4.1439.6872\npCIDetect13.dll ============= SERVICES / DRIVERS =============== R1 CLBStor;InstantBurn Storage Helper Driver;c:\windows\system32\drivers\CLBStor.sys [2008-12-20 16048] R1 mferkdk;VSCore mferkdk;c:\program files\mcafee\virusscan enterprise\mferkdk.sys [2006-11-30 31944] R2 {95808DC4-FA4A-4C74-92FE-5B863F82066B};{95808DC4-FA4A-4C74-92FE-5B863F82066B};c:\program files\cyberlink\powerdvd\000.fcl [2008-12-26 61424] R2 CLBUDF;CyberLink InstantBurn UDF Filesystem;c:\windows\system32\drivers\CLBUDF.sys [2008-12-20 162096] R2 McAfeeFramework;McAfee Framework Service;c:\program files\mcafee\common framework\FrameworkService.exe [2008-12-7 104000] R2 McShield;McAfee McShield;c:\program files\mcafee\virusscan enterprise\Mcshield.exe [2006-11-30 144960] R2 McTaskManager;McAfee Task Manager;c:\program files\mcafee\virusscan enterprise\VsTskMgr.exe [2006-11-30 54872] R2 Nero BackItUp Scheduler 4.0;Nero BackItUp Scheduler 4.0;c:\program files\common files\nero\nero backitup 4\NBService.exe [2008-9-24 935208] R2 PfDetNT;PfDetNT;c:\windows\system32\drivers\PfModNT.sys [2008-12-7 15840] R3 mfeavfk;McAfee Inc.;c:\windows\system32\drivers\mfeavfk.sys [2008-12-7 72264] R3 mfebopk;McAfee Inc.;c:\windows\system32\drivers\mfebopk.sys [2008-12-7 34152] R3 mfehidk;McAfee Inc.;c:\windows\system32\drivers\mfehidk.sys [2008-12-7 168776] =============== Created Last 30 ================ 2009-03-22 14:03 <DIR> --d----- c:\program files\uTorrent 2009-03-22 14:03 <DIR> --d----- c:\docume~1\thedop~1\applic~1\uTorrent 2009-03-20 19:33 45,056 a------- c:\windows\system32\IngDirectXDetect.dll 2009-03-20 19:33 1,413,120 a------- c:\windows\system32\ImpulseGlobals.dll 2009-03-20 19:33 208,896 a------- c:\windows\system32\ImpulseMessageHook.ocx 2009-03-20 19:33 73,728 a------- c:\windows\system32\ImpulseWindowFlash.ocx 2009-03-20 19:33 65,536 a------- c:\windows\system32\ImpulseASM.dll 2009-03-20 19:33 6,114 a------- c:\windows\system32\SHELLLNK.TLB 2009-03-20 19:33 <DIR> --d----- c:\program files\Ingenuware 2009-03-20 19:33 152,848 a------- c:\windows\system32\comdlg32.ocx 2009-03-20 19:33 83,672 a------- c:\windows\system32\CSRAS32.OCX 2009-03-20 19:33 42,192 a------- c:\windows\system32\hitime32.ocx 2009-03-20 19:33 1,536 a------- c:\windows\system32\ISWin32.tlb 2009-03-20 19:09 25,088 a------- c:\windows\system32\ebkp.dll 2009-03-20 19:09 <DIR> --d----- c:\docume~1\thedop~1\applic~1\EbkReader 2009-03-20 16:44 <DIR> --d----- c:\program files\Syncsoft 2009-03-19 02:04 <DIR> --d----- c:\program files\DivXCodec 2009-03-19 02:03 <DIR> --d----- c:\program files\XviD 2009-03-10 17:43 73,728 a------- c:\windows\system32\javacpl.cpl 2009-02-24 21:17 76 a------- c:\windows\system32\netjr32.dll 2009-02-24 21:17 585,728 -------- c:\windows\system32\AReadyLB.dll 2009-02-24 21:17 342,016 -------- c:\windows\system32\MC13.exe 2009-02-24 21:17 229,376 -------- c:\windows\system32\AudDevicePlugin.dll 2009-02-24 21:17 183,129 -------- c:\windows\system32\AM Install1.INF 2009-02-24 21:17 53,248 -------- c:\windows\system32\BBInstaller.exe 2009-02-24 21:17 3,851,784 a------- c:\windows\system32\D3DX9_39.dll 2009-02-24 21:17 <DIR> --d----- c:\program files\J River 2009-02-24 21:17 <DIR> --d----- c:\docume~1\thedop~1\applic~1\J River ==================== Find3M ==================== 2009-03-10 17:43 410,984 a------- c:\windows\system32\deploytk.dll 2009-02-09 07:13 1,846,784 a------- c:\windows\system32\win32k.sys 2008-12-09 23:33 1,570,816 a------- c:\docume~1\thedop~1\applic~1\tsdnwin.dll ============= FINISH: 20:20:12.28 =============== |
|
     |
| Important Information |
|
Join the #1 Tech Support Forum Today - It's Totally Free!
TechSupportForum.com is a leading support website for your computer needs. We offer free, friendly and personalized computer support. Why pay to have your computer fixed when you can do it for free. Join TechSupportforum.com Today - Click Here |
|
03-24-2009, 11:30 AM
|
#2 (permalink) |
|
Moderator, Analyst, Security Team; Rangemaster, TSF Academy
Join Date: Oct 2007
Location: Georgia
Posts: 12,821
OS: XP Home, Pro SP3; Win 7
|
Re: Ntoskrnl-hook
Hello and Welcome to TSF.
Please Subscribe to this Thread to get immediate notification of replies as soon as they are posted. To do this click Thread Tools, then click Subscribe to this Thread. Make sure it is set to Instant notification by email, then click Add Subscription. Please note that the forum is very busy and if I don't hear from you within three days this thread will be closed. ------------------------------------------------------ One or more of the identified infections is a backdoor trojan. This type of infection allows hackers to remotely control your computer, log keystrokes, steal critical system information, and download and execute files without your knowledge. If you do any banking or other financial transactions on the PC or if it should contain any other sensitive information, please get to a known clean computer and change all passwords where applicable, and it would be wise to contact those same financial institutions to apprise them of your situation. Please read this: How Do I Handle Possible Identify Theft, Internet Fraud, and CC Fraud? ------------------------------------------------------ Please note that these fixes are not instantaneous. Most infections require more than one round to properly eradicate. Please stay with me until given the 'all clear' even if symptoms seemingly abate. Kindly follow my instructions and please do no fixing on your own or running of scanners unless requested by a helper. ------------------------------------------------------ Please visit this webpage for download links, and instructions for running ComboFix: http://www.bleepingcomputer.com/comb...o-use-combofix * Ensure you have disabled all antivirus and antimalware programs so they do not interfere with the running of ComboFix. Get help here Please post the C:\ComboFix.txt in your next reply for further review. ------------------------------------------------------ |
|
|
|
|
03-24-2009, 03:40 PM
|
#3 (permalink) |
|
Registered User
Join Date: Mar 2009
Posts: 4
OS: XP
|
Re: Ntoskrnl-hook
Thank you so much Chemist, here is the log from combo fix.
ComboFix 09-03-22.01 - The Dope Master 2009-03-24 18:26:58.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2047.1673 [GMT -4:00] Running from: c:\documents and settings\The Dope Master\Desktop\ComboFix.exe AV: McAfee VirusScan Enterprise *On-access scanning disabled* (Updated) WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !! . ADS - WINDOWS: deleted 24 bytes in 1 streams. ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\recycler\S-1-6-23-100015287-100014501-100012244-3847.com c:\windows\system32\AutoRun.inf c:\windows\system32\drivers\gaopdxyejyxxuwrrnrvpktivmfyyuefvuuelti.sys c:\windows\system32\gaopdxcounter c:\windows\system32\gaopdxiopboodpyklardomanpxdbkyvpwmnmea.dll c:\windows\system32\netjr32.dll e:\recycler\S-1-6-23-100015287-100014501-100012244-3847.com f:\recycler\S-1-6-23-100015287-100014501-100012244-3847.com . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Service_gaopdxserv.sys ((((((((((((((((((((((((( Files Created from 2009-02-24 to 2009-03-24 ))))))))))))))))))))))))))))))) . 2009-03-23 17:55 . 2009-03-23 17:55 <DIR> d-------- c:\documents and settings\Administrator 2009-03-22 14:03 . 2009-03-22 14:03 <DIR> d-------- c:\program files\uTorrent 2009-03-22 14:03 . 2009-03-23 02:05 <DIR> d-------- c:\documents and settings\The Dope Master\Application Data\uTorrent 2009-03-20 19:33 . 2009-03-20 19:33 <DIR> d-------- c:\program files\Ingenuware 2009-03-20 19:33 . 2004-07-17 02:45 1,413,120 --a------ c:\windows\system32\ImpulseGlobals.dll 2009-03-20 19:33 . 2004-07-03 06:21 208,896 --a------ c:\windows\system32\ImpulseMessageHook.ocx 2009-03-20 19:33 . 2004-03-09 00:00 152,848 --a------ c:\windows\system32\comdlg32.ocx 2009-03-20 19:33 . 2002-05-27 21:10 83,672 --a------ c:\windows\system32\CSRAS32.OCX 2009-03-20 19:33 . 2004-07-03 06:23 73,728 --a------ c:\windows\system32\ImpulseWindowFlash.ocx 2009-03-20 19:33 . 2003-08-17 03:29 65,536 --a------ c:\windows\system32\ImpulseASM.dll 2009-03-20 19:33 . 2004-06-08 21:41 45,056 --a------ c:\windows\system32\IngDirectXDetect.dll 2009-03-20 19:33 . 2001-12-07 11:42 42,192 --a------ c:\windows\system32\hitime32.ocx 2009-03-20 19:33 . 1997-01-16 14:42 6,114 --a------ c:\windows\system32\SHELLLNK.TLB 2009-03-20 19:33 . 2000-05-01 22:22 1,536 --a------ c:\windows\system32\ISWin32.tlb 2009-03-20 19:09 . 2009-03-20 19:09 <DIR> d-------- c:\documents and settings\The Dope Master\Application Data\EbkReader 2009-03-20 19:09 . 2009-03-20 19:09 25,088 --a------ c:\windows\system32\ebkp.dll 2009-03-20 16:44 . 2009-03-20 16:44 <DIR> d-------- c:\program files\Syncsoft 2009-03-19 02:04 . 2009-03-19 02:04 <DIR> d-------- c:\program files\DivXCodec 2009-03-19 02:03 . 2009-03-19 02:03 <DIR> d-------- c:\program files\XviD 2009-03-10 17:43 . 2009-03-10 17:43 <DIR> d-------- c:\program files\Java 2009-03-10 17:43 . 2009-03-10 17:43 73,728 --a------ c:\windows\system32\javacpl.cpl 2009-02-24 21:17 . 2009-02-24 21:17 <DIR> d-------- c:\program files\J River 2009-02-24 21:17 . 2009-02-24 21:17 <DIR> d-------- c:\documents and settings\The Dope Master\Application Data\J River 2009-02-24 21:17 . 2008-07-12 09:18 3,851,784 --a------ c:\windows\system32\D3DX9_39.dll 2009-02-24 21:17 . 2009-01-19 13:01 585,728 --------- c:\windows\system32\AReadyLB.dll 2009-02-24 21:17 . 2009-02-06 19:13 342,016 --------- c:\windows\system32\MC13.exe 2009-02-24 21:17 . 2009-01-19 13:01 229,376 --------- c:\windows\system32\AudDevicePlugin.dll 2009-02-24 21:17 . 2009-01-19 13:01 183,129 --------- c:\windows\system32\AM Install1.INF 2009-02-24 21:17 . 2009-01-19 13:01 53,248 --------- c:\windows\system32\BBInstaller.exe . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-03-24 22:11 --------- d-----w c:\program files\Mozilla Thunderbird 2009-03-24 22:09 --------- d-----w c:\program files\lg_fwupdate 2009-03-24 00:19 --------- d-----w c:\documents and settings\The Dope Master\Application Data\U3 2009-03-23 21:43 --------- d-----w c:\documents and settings\All Users\Application Data\Google Updater 2009-03-23 04:54 --------- d-----w c:\documents and settings\All Users\Application Data\Microsoft Help 2009-03-20 23:33 --------- d--h--w c:\program files\InstallShield Installation Information 2009-03-10 21:43 410,984 ----a-w c:\windows\system32\deploytk.dll 2009-03-10 04:19 --------- d-----w c:\documents and settings\The Dope Master\Application Data\Azureus 2009-02-21 02:57 --------- d-----w c:\program files\eMule 2009-02-21 02:56 --------- d-----w c:\documents and settings\The Dope Master\Application Data\eMule 2009-02-11 16:01 --------- d-----w c:\program files\Vuze 2009-02-09 11:13 1,846,784 ----a-w c:\windows\system32\win32k.sys 2009-02-09 02:38 --------- d-----w c:\program files\FLV Player 2009-02-04 01:52 --------- d-----w c:\program files\FLAC 2009-02-04 01:41 --------- d-----w c:\documents and settings\The Dope Master\Application Data\Winamp 2009-02-03 06:03 --------- d-----w c:\program files\Winamp 2008-12-10 03:33 1,570,816 ----a-w c:\documents and settings\The Dope Master\Application Data\tsdnwin.dll . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360] "LDM"="c:\program files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe" [2008-12-07 20480] "Google Update"="c:\documents and settings\The Dope Master\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2008-12-07 133104] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-10-07 13574144] "CTSysVol"="c:\program files\Creative\SBAudigy2ZS\Surround Mixer\CTSysVol.exe" [2003-09-17 57344] "CTDVDDET"="c:\program files\Creative\SBAudigy2ZS\DVDAudio\CTDVDDet.EXE" [2003-06-18 45056] "SBDrvDet"="c:\program files\Creative\SB Drive Det\SBDrvDet.exe" [2002-12-03 45056] "UpdReg"="c:\windows\UpdReg.EXE" [2000-05-11 90112] "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-11-04 413696] "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-11-20 290088] "ShStatEXE"="c:\program files\McAfee\VirusScan Enterprise\SHSTAT.EXE" [2006-11-30 112216] "McAfeeUpdaterUI"="c:\program files\McAfee\Common Framework\UdaterUI.exe" [2006-11-17 136768] "HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-03-11 49152] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672] "InstantBurn"="c:\progra~1\CYBERL~1\INSTAN~1\Win2K\IBurn.exe" [2007-06-04 599600] "LGODDFU"="c:\program files\lg_fwupdate\fwupdate.exe" [2008-12-20 548864] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-10-07 86016] "DAEMON Tools-1033"="c:\program files\D-Tools\daemon.exe" [2004-08-22 81920] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-10 148888] "nwiz"="nwiz.exe" [2008-10-07 c:\windows\system32\nwiz.exe] "CTHelper"="CTHELPER.EXE" [2003-10-06 c:\windows\system32\CTHELPER.EXE] "Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" [2004-06-08 c:\windows\KHALMNPR.Exe] c:\documents and settings\All Users\Start Menu\Programs\Startup\ Logitech Desktop Messenger.lnk - c:\program files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe [2008-12-07 450560] Logitech SetPoint.lnk - c:\program files\Logitech\SetPoint\KEM.exe [2008-12-07 581632] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "msacm.clmp3enc"= c:\progra~1\CYBERL~1\Power2Go\CLMP3Enc.ACM [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk] path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BDRegion] --------- 2008-10-07 15:54 75048 c:\program files\CyberLink\Shared Files\brs.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update] --a----t- 2008-12-07 20:38 133104 c:\documents and settings\The Dope Master\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor] --a------ 2007-08-24 08:00 33648 c:\program files\Microsoft Office\Office12\GrooveMonitor.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LanguageShortcut] --a------ 2008-05-14 15:48 62760 c:\program files\CyberLink\PowerDVD\Language\Language.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteCenter] --a------ 2003-10-08 17:35 139264 c:\program files\Creative\MediaSource\RemoteControl\RcMan.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl] --------- 2008-07-21 18:32 87336 c:\program files\CyberLink\PowerDVD\PDVDServ.exe [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "enablefirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"= "c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"= "c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"= "c:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\backWeb-8876480.exe"= "c:\\Program Files\\Bonjour\\mDNSResponder.exe"= "c:\\Program Files\\iTunes\\iTunes.exe"= "c:\\Program Files\\McAfee\\Common Framework\\FrameworkService.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"= "c:\\Program Files\\Vuze\\Azureus.exe"= "c:\\Program Files\\Messenger\\msmsgs.exe"= "c:\\Program Files\\eMule\\emule.exe"= "c:\\Program Files\\uTorrent\\uTorrent.exe"= R1 CLBStor;InstantBurn Storage Helper Driver;c:\windows\system32\drivers\CLBStor.sys [2008-12-20 16048] R2 {95808DC4-FA4A-4C74-92FE-5B863F82066B};{95808DC4-FA4A-4C74-92FE-5B863F82066B};c:\program files\CyberLink\PowerDVD\000.fcl [2008-12-26 22:12:24 61424] R2 CLBUDF;CyberLink InstantBurn UDF Filesystem;c:\windows\system32\drivers\CLBUDF.sys [2008-12-20 162096] R2 PfDetNT;PfDetNT;c:\windows\system32\drivers\PfModNT.sys [2008-12-07 15840] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12 hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{667d46c2-c48a-11dd-be18-806d6172696f}] \Shell\AutoRun\command - D:\ASUSACPI.exe [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}] "c:\program files\Common Files\LightScribe\LSRunOnce.exe" . Contents of the 'Scheduled Tasks' folder 2009-03-24 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-606747145-706699826-725345543-1003.job - c:\documents and settings\The Dope Master\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2008-12-07 20:38] . - - - - ORPHANS REMOVED - - - - HKCU-Run-Power2GoExpress - (no file) MSConfigStartUp-RGSC - c:\program files\Rockstar Games\Rockstar Games Social Club\RGSCLauncher.exe . ------- Supplementary Scan ------- . uInternet Settings,ProxyOverride = localhost;*.local IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000 Trusted Zone: aol.com\free Handler: ebk - {1E411CE8-FE8B-4973-B8E0-6EA2CC3C6B06} - c:\windows\system32\ebkp.dll FF - ProfilePath - c:\documents and settings\The Dope Master\Application Data\Mozilla\Firefox\Profiles\njzrfmjf.default\ FF - prefs.js: browser.search.selectedEngine - eBay FF - prefs.js: browser.startup.homepage - hxxps://my.usf.edu/webapps/portal/frameset.jsp FF - plugin: c:\documents and settings\The Dope Master\Local Settings\Application Data\Google\Update\1.2.141.5\npGoogleOneClick7.dll FF - plugin: c:\program files\Google\Google Updater\2.4.1439.6872\npCIDetect13.dll . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-03-24 18:32:20 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\{95808DC4-FA4A-4C74-92FE-5B863F82066B}] "ImagePath"="\??\c:\program files\CyberLink\PowerDVD\000.fcl" . Completion time: 2009-03-24 18:36:28 ComboFix-quarantined-files.txt 2009-03-24 22:36:26 Pre-Run: 42,922,913,792 bytes free Post-Run: 43,165,519,872 bytes free 197 --- E O F --- 2009-03-17 04:51:32 |
|
|
|
|
03-24-2009, 04:08 PM
|
#4 (permalink) |
|
Moderator, Analyst, Security Team; Rangemaster, TSF Academy
Join Date: Oct 2007
Location: Georgia
Posts: 12,821
OS: XP Home, Pro SP3; Win 7
|
Re: Ntoskrnl-hook
Hello jjonas. Please tell us how your system is behaving.
Please copy this page to Notepad and Save it to your Desktop in order to assist you when carrying out the following instructions. Before beginning the fix, read this post completely. If there's anything that you do not understand, kindly ask your questions before proceeding. Ensure that there aren't any opened browsers when you are carrying out the procedures below. It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence. ------------------------------------------------------ I see you have P2P software ( uTorrent, eMule, and Vuze ) installed on your machine. We are not here to pass judgment on file-sharing as a concept. However, we will warn you that engaging in this activity and having this kind of software installed on your machine will always make you more susceptible to re-infections. It may be contributing to your current situation. This page will give you further information. Please note: Even if you are using a "safe" P2P program, it is only the program that is safe. You will be sharing files from uncertified sources, and these are often infected. The bad guys use P2P filesharing as a major conduit to spread their wares. References for the risk of these programs are here, here, and here. I would strongly recommend that you uninstall them, however that choice is up to you. If you choose to remove these programs, you can do so via Control Panel >> Add or Remove Programs. ------------------------------------------------------ Please download ATF-Cleaner by Atribune and Save it to your Desktop.
For Technical Support, double-click the e-mail address located at the bottom of each menu. ------------------------------------------------------ Please run this online scan to help look for remnants. Establish an internet connection & perform an online scan at Kaspersky Online Scanner Ensure your external and/or USB drives are inserted during the scan. Click Accept, when prompted to download and install the program files and database of malware definitions.
 **Note** To optimize scanning time and produce a more sensible report for review:
------------------------------------------------------ Please post the following in your next reply: Kaspersky report report on system behavior |
|
|
|
|
03-25-2009, 03:36 PM
|
#5 (permalink) |
|
Registered User
Join Date: Mar 2009
Posts: 4
OS: XP
|
Re: Ntoskrnl-hook
After I ran combofix, my computer seemed to be behaving more normal. The firewall is no longer being turned off after I boot my computer. I havn't been rerouted to any other sites when clicking on links as before. Is this information sufficient? Below you shall find the results of the Kaspersky report....
-------------------------------------------------------------------------------- KASPERSKY ONLINE SCANNER 7 REPORT Wednesday, March 25, 2009 Operating System: Microsoft Windows XP Professional Service Pack 3 (build 2600) Kaspersky Online Scanner 7 version: 7.0.25.0 Program database last update: Wednesday, March 25, 2009 15:19:24 Records in database: 1968481 -------------------------------------------------------------------------------- Scan settings: Scan using the following database: extended Scan archives: yes Scan mail databases: yes Scan area - My Computer: A:\ C:\ D:\ E:\ F:\ G:\ H:\ I:\ L:\ Scan statistics: Files scanned: 132575 Threat name: 2 Infected objects: 4 Suspicious objects: 0 Duration of the scan: 03:59:27 File name / Threat name / Threats count C:\Qoobox\Quarantine\C\RECYCLER\S-1-6-23-100015287-100014501-100012244-3847.com.vir Infected: Trojan.Win32.TDSS.ury 1 C:\Qoobox\Quarantine\E\RECYCLER\S-1-6-23-100015287-100014501-100012244-3847.com.vir Infected: Trojan.Win32.TDSS.ury 1 C:\Qoobox\Quarantine\F\RECYCLER\S-1-6-23-100015287-100014501-100012244-3847.com.vir Infected: Trojan.Win32.TDSS.ury 1 F:\Music\Artists\Beck\(2008) - Modern Guilt\06 - Walls.mp3 Infected: Trojan-Downloader.WMA.GetCodec.i 1 The selected area was scanned. |
|
|
|
|
03-25-2009, 04:00 PM
|
#6 (permalink) |
|
Moderator, Analyst, Security Team; Rangemaster, TSF Academy
Join Date: Oct 2007
Location: Georgia
Posts: 12,821
OS: XP Home, Pro SP3; Win 7
|
Re: Ntoskrnl-hook
Hello again, jjonas.
You have one infected mp3 file. The other finds have been quarantined by ComboFix. Ensure your F: drive is inserted/connected. Go to Start > Run and copy/paste the following into the Run box and click OK: cmd /c del /a/f/q "F:\Music\Artists\Beck\(2008) - Modern Guilt\06 - Walls.mp3" A DOS window will open and close again, this is normal. ------------------------------------------------------ Congratulations. Well done! Your logs appear clean. You should be good to go. As far as those infected objects listed in the Kaspersky report, those are safely tucked away in ComboFix's quarantine folder or in old System Restore Points, which we will be taking care of now. Please disable McAfee before uninstalling ComboFix and then re-enable it after doing so. Go to Start >> Run and Copy/Paste the following single-line command into the Run box and click OK: combofix /u This will uninstall ComboFix and delete ComboFix's quarantine folder. It will also implement some cleanup procedures, remove old System Restore Points which contain previous infections, and create a fresh, clean System Restore Point. Please re-enable your antivirus program and any other antispyware programs disabled earlier if you haven't already. You can safely delete any tools downloaded or any logs, files, and any shortcuts on your desktop that were created during this fix. ------------------------------------------------------ MICROSOFT UPDATES It is very important that you get all of the critical updates for your Operating System and Internet Explorer. Keeping your OS and browser up to date will help make you less susceptible to attacks by Trojans and viruses. Please go to Microsoft and download all the critical updates to help prevent possible re-infection. SPYWARE PREVENTION This is a good time to set up protection against further attacks. In light of your recent problem, I'm sure you'd like to avoid any future infections. Please read these well written articles: To help protect your computer in the future I recommend that you get the following free programs if you do not already have them:
Please respond to this thread one more time so we can mark this thread as resolved. |
|
|
|
| Thread Tools | |
|
|
