Trojan/Malware?????

[nsh]

Can someone please help me to identify the issue with this computer. I'm receiving 'On-Access Scan Message' stating 'VirusScan Alert! - C:\WINDOWS\system32\SYS32DLL.exe'. I have McAfee and scanned for viruses. It found several and deleted. When I restart the machine, the On-Access Scan Messages box pops up, if I close it, I receive 'blue screen'. I am now unable to access the internet (Support forum) from problematic computer so I'm sending files from another computer.

I have followed the instructions on 'what to do first'. I will attach the files you requested.

Any comments or suggestions would be greatly appreciated. Thanks!

<begin note>
Mod's note:

Please note that this section of the forum is very busy, and re-familiarize yourself with the Bumping Rules found in NEW INSTRUCTIONS - Read This Before Posting For Malware Removal Help, which you should have read before posting.


We ask that no one bump a thread before 72 hrs have passed, and then, only once. Premature bump posts will be deleted.

Thanks for understanding.


Additionally, you've not provided the main log from DDS, dds.txt which will be needed before anyone can help.

<end note>

[nsh]

This is the DDS information. Please let me know if additional information is needed. Thanks again!


DDS (Ver_09-05-14.01) - NTFSx86
Run by Administrator at 9:26:05.38 on Mon 05/18/2009
Internet Explorer: 7.0.5730.11
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1023.609 [GMT -5:00]

AV: McAfee VirusScan Enterprise *On-access scanning enabled* (Updated) {918A2B0B-2C60-4016-A4AB-E868DEABF7F0}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\McAfee\Common Framework\FrameworkService.exe
C:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe
C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\MiaSvc.exe
C:\Program Files\Carl Zeiss\MTB 2004\MTB Server Console\MTBService.exe
svchost.exe "C:\WINDOWS\system32\adsldpcp.exe"
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\Mixer.exe
C:\WINDOWS\system32\hpnra.exe
C:\WINDOWS\system32\3dlTB.exe
C:\Program Files\McAfee\Common Framework\UdaterUI.exe
C:\windows\ld08.exe
C:\windows\pp07.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\McAfee\Common Framework\McTray.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\All Users\Desktop\dds.scr

============== Pseudo HJT Report ===============

uInternet Settings,ProxyServer = http=localhost:7171
uInternet Settings,ProxyOverride = *.local;<local>
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: 218538 Class: {5e5efa8f-9f53-418e-b78e-44866667a404} - c:\windows\system32\218538\218538.dll
BHO: scriptproxy: {7db2d5a0-7241-4e79-b68d-6309f01c5231} - c:\program files\mcafee\virusscan enterprise\Scriptcl.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.1.1309.3572\swg.dll
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
mRun: [C-Media Mixer] Mixer.exe /startup
mRun: [HP Network Registry Agent] c:\windows\system32\hpnra.exe
mRun: [NeroFilterCheck] c:\windows\system32\NeroCheck.exe
mRun: [3Dlabs Taskbar Display Manager] c:\windows\system32\3dlTB.exe
mRun: [ShStatEXE] "c:\program files\mcafee\virusscan enterprise\SHSTAT.EXE" /STANDALONE
mRun: [McAfeeUpdaterUI] "c:\program files\mcafee\common framework\UdaterUI.exe" /StartedFromRunKey
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 8.0\reader\Reader_sl.exe"
mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
mRun: [sysldtray] c:\windows\ld08.exe
mRun: [pp] c:\windows\pp07.exe
IE: E&xport to Microsoft Excel - c:\progra~1\micros~3\office11\EXCEL.EXE/3000
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~3\office11\REFIEBAR.DLL
DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} - hxxp://download.microsoft.com/download/e/4/9/e494c802-dd90-4c6b-a074-469358f075a6/OGAControl.cab
DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1175625591765
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload.macromedia.com/get/shockwave/cabs/flash/swflash.cab
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SecurityProviders: msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll, digiwet.dll

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\admini~1\applic~1\mozilla\firefox\profiles\q1pra848.default\
FF - prefs.js: network.proxy.http - localhost
FF - prefs.js: network.proxy.http_port - 7171
FF - prefs.js: network.proxy.type - 1
FF - plugin: c:\program files\google\google updater\2.4.1536.6592\npCIDetect13.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npCouponPrinter.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npmozax.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npvirtools.dll

============= SERVICES / DRIVERS ===============

R1 mferkdk;VSCore mferkdk;c:\program files\mcafee\virusscan enterprise\mferkdk.sys [2006-11-30 31944]
R2 McAfeeFramework;McAfee Framework Service;c:\program files\mcafee\common framework\FrameworkService.exe [2007-4-16 104000]
R2 McShield;McAfee McShield;c:\program files\mcafee\virusscan enterprise\Mcshield.exe [2006-11-30 144960]
R2 McTaskManager;McAfee Task Manager;c:\program files\mcafee\virusscan enterprise\VsTskMgr.exe [2006-11-30 54872]
R2 miasvc;3Dlabs LMM;c:\windows\system32\MiaSvc.exe [2007-4-3 40960]
R2 MTBService;MTB2004 Server;c:\program files\carl zeiss\mtb 2004\mtb server console\MTBService.exe [2006-11-15 20480]
R2 ZiPciDump;ZiPciDump;c:\program files\common files\carl zeiss vision\system\zipl\ZiPciDmp.sys [2004-3-24 5632]
R3 mfeavfk;McAfee Inc.;c:\windows\system32\drivers\mfeavfk.sys [2007-4-16 72264]
R3 mfebopk;McAfee Inc.;c:\windows\system32\drivers\mfebopk.sys [2007-4-16 34152]
R3 mfehidk;McAfee Inc.;c:\windows\system32\drivers\mfehidk.sys [2007-4-16 168776]
R3 miranda;miranda;c:\windows\system32\drivers\3dlMP.sys [2007-4-3 187264]
S2 RemoteRegistryRasAuto;Remote Registry RemoteRegistryRasAuto;c:\windows\system32\adsldpcp.exe srv --> c:\windows\system32\adsldpcp.exe srv [?]

=============== Created Last 30 ================

2009-05-18 09:20 2 -c--h--- c:\windows\t55ft3190f44.dat
2009-05-18 09:20 0 ac------ c:\windows\st_1242674912.exe
2009-05-18 09:20 0 ac------ c:\windows\st_1242656485.exe
2009-05-15 16:09 11,776 -c--h--- c:\windows\pp07.exe
2009-05-15 16:09 2 -c--h--- c:\windows\t55ft3189f44.dat
2009-05-14 15:25 13,824 ac------ c:\windows\st_1242351177.exe
2009-05-14 14:27 0 ac------ c:\windows\st_1242347717.exe
2009-05-14 14:27 0 ac------ c:\windows\st_1242329290.exe
2009-05-14 14:19 1 ac------ c:\windows\9g2234wesdf3dfgjf23
2009-05-14 14:18 <DIR> -cd----- C:\QUARANTINE
2009-05-14 14:18 2 -c--h--- c:\windows\t55ft2692f44.dat
2009-05-14 14:18 <DIR> -cd----- c:\windows\system32\218538
2009-05-14 14:18 32 ac-s---- c:\windows\system32\1410159257.dat
2009-05-14 14:18 48,640 -c-shr-- c:\windows\system32\adsldpcp.exe
2009-05-14 14:18 27,648 -c--h--- c:\windows\ld08.exe
2009-05-14 14:17 27,136 ac------ c:\windows\system32\digiwet.dll

==================== Find3M ====================

2007-04-04 08:37 16,384 ac-sh--- c:\windows\temp\cookies\index.dat
2007-04-04 08:37 16,384 ac-sh--- c:\windows\temp\history\history.ie5\index.dat
2007-04-04 08:37 16,384 ac-sh--- c:\windows\temp\temporary internet files\content.ie5\index.dat

============= FINISH: 9:26:44.67 ===============

[tetonbob]

Before beginning the fix, read this post completely. If there's anything that you do not understand, kindly ask your questions before proceeding. Ensure that there aren't any opened browsers when you are carrying out the procedures below. Save the following instructions in Notepad as this webpage would not be available when you're carrying out the fix.

It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence.

---------------------------------------------------------------------------------------------

Please note that these fixes are not instantaneous. Most infections require more than one round to properly eradicate.

Stay with me until given the 'all clear' even if symptoms diminish. Lack of symptoms does not always mean the job is complete.

Kindly follow my instructions and please do no fixing on your own or running of scanners unless requested by me or another helper at this forum.

---------------------------------------------------------------------------------------------


Download ComboFix from one of these locations, but do not run it yet.

Link 1
Link 2
Link 3

Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with ComboFix.

McAfee:

Double-click the taskbar icon to open the Security Center
Click Advanced Menu (lower left)
Click Configure (left)
Click Computer & Files (upper left)
VirusScan can be disabled on the right. Choose a setting similar to "Until I say so" so that it does not restore upon reboot.

Not sure if McAfee Enterprise uses the same settings, but here's an example

http://img.photobucket.com/albums/v6...ee_disable.gif

Open notepad and copy/paste the text in the quotebox below into it:

DDS::
uInternet Settings,ProxyServer = http=localhost:7171
uInternet Settings,ProxyOverride = *.local;<local>

Firefox::
FF - ProfilePath - c:\docume~1\admini~1\applic~1\mozilla\firefox\profiles\q1pra848.default\
FF - prefs.js: network.proxy.http - localhost
FF - prefs.js: network.proxy.http_port - 7171
FF - prefs.js: network.proxy.type - 1

Save this as CFScript.txt




Refering to the picture above, drag CFScript.txt into ComboFix.exe


As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed.

Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.





The Windows recovery console will allow you to boot up into a special recovery mode that allows us to help you in the case that your computer has a problem after an attempted removal of malware.

With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal.

Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement.

ComboFix will now automatically install the Microsoft Windows Recovery Console onto your computer, which will show up as a new option when booting up your computer. Do not select the Microsoft Windows Recovery Console option when you start your computer unless requested to by a helper.

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see a message that says:

The Recovery Console was successfully installed.



Click on Yes, to continue scanning for malware.

Your desktop may go blank. This is normal. It will return when ComboFix is done. ComboFix may reboot your machine. This is normal.



When finished, it shall produce a log for you, C:\ComboFix.txt. Post that log in your next reply.

Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall

Reenable your protection applications.

---------------------------------------------------------------------------------------------

Should there be issues with internet afterward:

*In IE: Tools Menu -> Internet Options -> Connections Tab ->Lan Settings > uncheck "use a proxy server" or reconfigure the Proxy server again in case you have set it previously.


In Firefox in Tools Menu -> Options... -> Advanced Tab -> Network Tab -> "Settings" under Connection and uncheck the proxyserver, set it to No Proxy.

[nsh]

Tetonbob, I do believe you are my hero! I have read and followed the post completely (I hope). I think this computer may be fixed. I'm waiting your final 'all clear' before I celebrate though. I am having a little difficulty getting my Virus Scan Enterprise back up, but will research that issue further. Here is the log:

ComboFix 09-05-19.08 - Administrator 05/20/2009 9:43.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1023.753 [GMT -5:00]
Running from: c:\documents and settings\Administrator\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Administrator\Desktop\CFScript.txt
AV: McAfee VirusScan Enterprise *On-access scanning disabled* (Updated) {918A2B0B-2C60-4016-A4AB-E868DEABF7F0}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\ld08.exe
c:\windows\pp07.exe
c:\windows\pp08.exe
c:\windows\pp09.exe
c:\windows\st_1242329290.exe
c:\windows\st_1242347717.exe
c:\windows\st_1242351177.exe
c:\windows\st_1242656485.exe
c:\windows\st_1242674912.exe
c:\windows\st_1242676318.exe
c:\windows\st_1242694760.exe
c:\windows\st_1242827269.exe
c:\windows\st_1242845752.exe
c:\windows\system32\218538
c:\windows\system32\218538\218538.dll
c:\windows\system32\790151
c:\windows\system32\790151\790151.dll
c:\windows\system32\adsldpcp.exe
c:\windows\system32\digiwet.dll
c:\windows\system32\drivers\ati64si.sys
c:\windows\system32\drivers\i386si.sys
c:\windows\t55ft2692f44.dat
c:\windows\t55ft2730f44.dat
c:\windows\t55ft3189f44.dat
c:\windows\t55ft3190f44.dat
c:\windows\t55ft3250f44.dat

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_NEW_DRV
-------\Legacy_REMOTEREGISTRYRASAUTO
-------\Service_RemoteRegistryRasAuto


((((((((((((((((((((((((( Files Created from 2009-04-20 to 2009-05-20 )))))))))))))))))))))))))))))))
.

2009-05-20 14:01 . 2009-05-20 14:01 13312 -c-h--w c:\windows\pp10.exe
2009-05-18 15:25 . 2009-05-18 15:26 -------- dc----w c:\documents and settings\Administrator\Local Settings\Application Data\jZip
2009-05-18 15:25 . 2009-05-20 13:50 -------- dc----w c:\documents and settings\Administrator\Application Data\Smart-Shopper
2009-05-18 15:25 . 2009-05-18 15:25 -------- dc----w c:\program files\Smart-Shopper
2009-05-18 15:25 . 2009-05-18 15:25 -------- dc----w c:\program files\jZip
2009-05-14 19:18 . 2009-05-19 16:10 -------- dc----w C:\QUARANTINE
2009-05-14 19:18 . 2009-05-14 19:18 32 -cs-a-w c:\windows\system32\1410159257.dat
2009-05-14 19:18 . 2009-05-14 19:18 20520 -c-h--w c:\documents and settings\wetlab\wetlab.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
.

------- Sigcheck -------

[7] 2006-04-20 12:18 360576 B2220C618B42A2212A59D91EBD6FC4B4 c:\windows\$hf_mig$\KB917953\SP2QFE\tcpip.sys
[7] 2007-10-30 16:53 360832 64798ECFA43D78C7178375FCDD16D8C8 c:\windows\$hf_mig$\KB941644\SP2QFE\tcpip.sys
[7] 2004-08-04 04:14 359040 9F4B36614A0FC234525BA224957DE55C c:\windows\$NtUninstallKB917953$\tcpip.sys
[7] 2006-04-20 11:51 359808 1DBF125862891817F374F407626967F4 c:\windows\$NtUninstallKB941644$\tcpip.sys
[-] 2007-10-30 17:20 360064 ECF02439FD31BBD0DBC2EC05600CF08A c:\windows\system32\dllcache\tcpip.sys
[-] 2007-10-30 17:20 360064 ECF02439FD31BBD0DBC2EC05600CF08A c:\windows\system32\drivers\tcpip.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HP Network Registry Agent"="c:\windows\system32\hpnra.exe" [2000-10-26 49152]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"3Dlabs Taskbar Display Manager"="c:\windows\system32\3dlTB.exe" [2006-02-16 235008]
"ShStatEXE"="c:\program files\McAfee\VirusScan Enterprise\SHSTAT.EXE" [2006-11-30 112216]
"McAfeeUpdaterUI"="c:\program files\McAfee\Common Framework\UdaterUI.exe" [2006-11-17 136768]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-11 39792]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-02-01 385024]
"C-Media Mixer"="Mixer.exe" - c:\windows\mixer.exe [2002-10-15 1818624]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

R2 miasvc;3Dlabs LMM;c:\windows\system32\MiaSvc.exe [4/3/2007 3:46 PM 40960]
R2 MTBService;MTB2004 Server;c:\program files\Carl Zeiss\MTB 2004\MTB Server Console\MTBService.exe [11/15/2006 8:33 AM 20480]
R2 ZiPciDump;ZiPciDump;c:\program files\Common Files\Carl Zeiss Vision\System\ZiPL\ZiPciDmp.sys [3/24/2004 11:01 AM 5632]
R3 miranda;miranda;c:\windows\system32\drivers\3dlMP.sys [4/3/2007 3:46 PM 187264]
.
Contents of the 'Scheduled Tasks' folder

2009-05-20 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-10-14 14:31]

2009-05-19 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1004336348-823518204-682003330-1006.job
- c:\documents and settings\wetlab\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-02-05 20:14]
.
- - - - ORPHANS REMOVED - - - -

BHO-{22186AA4-E2A6-45E8-BF4F-5C103C0458B0} - c:\windows\system32\790151\790151.dll
BHO-{5E5EFA8F-9F53-418E-B78E-44866667A404} - c:\windows\system32\218538\218538.dll


.
------- Supplementary Scan -------
.
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\q1pra848.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com
FF - plugin: c:\program files\Google\Google Updater\2.4.1536.6592\npCIDetect13.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npCouponPrinter.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npmozax.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npvirtools.dll

---- FIREFOX POLICIES ----
FF - user.js: yahoo.homepage.dontask - true.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-05-20 09:48
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\App Paths\OCTAGAPLAYER.EXE*er.x3d*D*]
@="c:\\Program Files\\Octaga\\Octaga Player\\OctagaPlayer.exe"
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(3212)
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\McAfee\Common Framework\FrameworkService.exe
c:\program files\McAfee\VirusScan Enterprise\VsTskMgr.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\program files\McAfee\Common Framework\naPrdMgr.exe
c:\program files\McAfee\Common Framework\Mctray.exe
.
**************************************************************************
.
Completion time: 2009-05-20 9:51 - machine was rebooted
ComboFix-quarantined-files.txt 2009-05-20 14:51

Pre-Run: 1,067,458,560 bytes free
Post-Run: 1,176,363,008 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

149 --- E O F --- 2008-06-21 08:02

[tetonbob]

Still a bit of work to do, but that cleared out a lot of the junk.

Please go to: VirusTotal

• On the page you'll find a "Browse" button.
  
• Next to the browse button you'll see a box to enter text.
• Please copy/paste the following:
  
  c:\windows\pp10.exe
  
  
• Then click the "Send File " button just below.
• This will scan the file. Please be patient.
• If you get a message saying File has already been analyzed: click Reanalyze file now
• Once scanned, copy and paste the results in your next reply, or simply provide the link to the results page.
  
• Please repeat for the following files:
  
  • 
    c:\documents and settings\wetlab\wetlab.exe
    

[nsh]

Not sure what all this means..... but it doesn't look good to me.

I have attached both files. Thanks again for all your help!

[tetonbob]

No, it doesn't. Let's remove them. I'd like to collect samples for further analysis. We'll use ComboFix to do that.

Before beginning the fix, read this post completely. If there's anything that you do not understand, kindly ask your questions before proceeding. Ensure that there aren't any opened browsers when you are carrying out the procedures below. Save the following instructions in Notepad as this webpage would not be available when you're carrying out the fix.

It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence.

---------------------------------------------------------------------------------------------

1. Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with ComboFix.
   
2. Open notepad and copy/paste the text in the quotebox below into it:
   
   

   http://www.techsupportforum.com/security-center/virus-trojan-spyware-help/377167-trojan-malware.html#post2146169
   File::
   c:\windows\system32\1410159257.dat
   DirLook::
   c:\documents and settings\wetlab 
   Collect::
   c:\windows\pp10.exe 
   c:\documents and settings\wetlab\wetlab.exe

   Save this as CFScript.txt
   
   
   
   
   Referring to the picture above, drag CFScript.txt into ComboFix.exe
   
   
   
3. Your desktop may go blank. This is normal. It will return when ComboFix is done. ComboFix may reboot your machine. This is normal.
   
4. When finished, it shall produce a log for you. Post that log in your next reply
   
   Note:
   Do not mouseclick combofix's window whilst it's running. That may cause it to stall.
   
   **Note**
   
   When CF finishes running, the ComboFix log will open along with a message box--do not be alarmed. With the above script, ComboFix will capture files to submit for analysis.
   • Ensure you are connected to the internet and click OK on the message box.
   If you do not get a message box, please do the following:
   
   There should be a file named [4]-Submit_date@time.zip with today's date, located here:
   
   C:\QooBox\Quarantine\[4]-Submit_date@time.zip
   
   Using the 'Browse' button, please submit it to this site ==> http://www.bleepingcomputer.com/subm....php?channel=4
   
   Please let me know if you successfully submitted the file. Thanks.
   
   ------------------------------------------------------
   
5. Ensure your AntiVirus and AntiSpyware applications are re-enabled.
   
   ---------------------------------------------------------------------------------------------
   

[nsh]

I'm sorry, but I'm doing something wrong. I will attach the ComboFix log but when I go to: http://www.bleepingcomputer.com/subm....php?channel=4, I received a 404 error and do not see an area to submit C:\Q00Box\Quarantine\[4]-Submit_date&time.zip. Any suggestions?

[tetonbob]

Hi. The link works just fine in my post, but in yours, it's been copied and broken.

Try again please, click it.

http://www.bleepingcomputer.com/subm....php?channel=4

I've removed the attachment from here, as my test machine is not up right now, and we can't have live malware samples attached to forum posts.

A question for you..

Is "wetlab" another user account on this machine?

[nsh]

Yes, wetlab is another user account on this machine.

The file has been submitted to link mentioned above. Thank you for the patience of a saint!

[tetonbob]

That worked, thanks!

It would be wise for us to get a set of DDS logs from "wetlab" account. Some locations are account specific. Can you log on to that account, and run DDS?

[nsh]

Here is the DDS from wetlab login.

[tetonbob]

Hello -

That's one of the two logs needed. I also would like dds.txt from wetlabs account. No need to attach it, just post it in reply.

[nsh]

DDS (Ver_09-05-14.01) - NTFSx86
Run by wetlab at 14:55:49.17 on Wed 05/20/2009
Internet Explorer: 7.0.5730.11
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1023.702 [GMT -5:00]

AV: McAfee VirusScan Enterprise *On-access scanning disabled* (Updated) {918A2B0B-2C60-4016-A4AB-E868DEABF7F0}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\McAfee\Common Framework\FrameworkService.exe
C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\MiaSvc.exe
C:\Program Files\Carl Zeiss\MTB 2004\MTB Server Console\MTBService.exe
C:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\Mixer.exe
C:\WINDOWS\system32\hpnra.exe
C:\WINDOWS\system32\3dlTB.exe
C:\Program Files\McAfee\Common Framework\UdaterUI.exe
C:\Program Files\McAfee\Common Framework\McTray.exe
C:\Documents and Settings\wetlab\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
C:\Program Files\Adobe\Reader 8.0\Reader\AcroRd32.exe
C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe
C:\Documents and Settings\Administrator\Desktop\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.omrf.org/
uInternet Connection Wizard,ShellNext = "c:\program files\outlook express\msimn.exe"
uInternet Settings,ProxyServer = http=localhost:7171
uInternet Settings,ProxyOverride = *.local;<local>
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: scriptproxy: {7db2d5a0-7241-4e79-b68d-6309f01c5231} - c:\program files\mcafee\virusscan enterprise\scriptcl.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.1.1309.3572\swg.dll
uRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
uRun: [Google Update] "c:\documents and settings\wetlab\local settings\application data\google\update\GoogleUpdate.exe" /c
uRun: [wetlab] c:\documents and settings\wetlab\wetlab.exe /i
uRun: [ttool] c:\windows\9129837.exe
mRun: [C-Media Mixer] Mixer.exe /startup
mRun: [HP Network Registry Agent] c:\windows\system32\hpnra.exe
mRun: [NeroFilterCheck] c:\windows\system32\NeroCheck.exe
mRun: [3Dlabs Taskbar Display Manager] c:\windows\system32\3dlTB.exe
mRun: [ShStatEXE] "c:\program files\mcafee\virusscan enterprise\SHSTAT.EXE" /STANDALONE
mRun: [McAfeeUpdaterUI] "c:\program files\mcafee\common framework\UdaterUI.exe" /StartedFromRunKey
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 8.0\reader\Reader_sl.exe"
mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
IE: E&xport to Microsoft Excel - d:\progra~1\office11\EXCEL.EXE/3000
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~3\office11\REFIEBAR.DLL
DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} - hxxp://download.microsoft.com/download/e/4/9/e494c802-dd90-4c6b-a074-469358f075a6/OGAControl.cab
DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1175625591765
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload.macromedia.com/get/shockwave/cabs/flash/swflash.cab
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\wetlab\applic~1\mozilla\firefox\profiles\8jx4wa61.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/ig?hl=en
FF - prefs.js: network.proxy.http - localhost
FF - prefs.js: network.proxy.http_port - 7171
FF - prefs.js: network.proxy.type - 1
FF - plugin: c:\documents and settings\wetlab\local settings\application data\google\update\1.2.145.5\npGoogleOneClick8.dll
FF - plugin: c:\program files\google\google updater\2.4.1536.6592\npCIDetect13.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npCouponPrinter.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npmozax.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npvirtools.dll

============= SERVICES / DRIVERS ===============

P2 McShield;McAfee McShield;c:\program files\mcafee\virusscan enterprise\Mcshield.exe [2006-11-30 144960]
R1 mferkdk;VSCore mferkdk;c:\program files\mcafee\virusscan enterprise\mferkdk.sys [2006-11-30 31944]
R2 McAfeeFramework;McAfee Framework Service;c:\program files\mcafee\common framework\FrameworkService.exe [2007-4-16 104000]
R2 McTaskManager;McAfee Task Manager;c:\program files\mcafee\virusscan enterprise\VsTskMgr.exe [2006-11-30 54872]
R2 miasvc;3Dlabs LMM;c:\windows\system32\MiaSvc.exe [2007-4-3 40960]
R2 MTBService;MTB2004 Server;c:\program files\carl zeiss\mtb 2004\mtb server console\MTBService.exe [2006-11-15 20480]
R2 ZiPciDump;ZiPciDump;c:\program files\common files\carl zeiss vision\system\zipl\ZiPciDmp.sys [2004-3-24 5632]
R3 mfeavfk;McAfee Inc.;c:\windows\system32\drivers\mfeavfk.sys [2007-4-16 72264]
R3 mfebopk;McAfee Inc.;c:\windows\system32\drivers\mfebopk.sys [2007-4-16 34152]
R3 mfehidk;McAfee Inc.;c:\windows\system32\drivers\mfehidk.sys [2007-4-16 168776]
R3 miranda;miranda;c:\windows\system32\drivers\3dlMP.sys [2007-4-3 187264]

=============== Created Last 30 ================

2009-05-20 09:42 <DIR> acdshr-- C:\cmdcons
2009-05-20 09:37 161,792 ac------ c:\windows\SWREG.exe
2009-05-20 09:37 98,816 ac------ c:\windows\sed.exe
2009-05-18 10:25 <DIR> -cd----- c:\program files\Smart-Shopper
2009-05-18 10:25 <DIR> -cd----- c:\program files\jZip
2009-05-14 14:19 1 ac------ c:\windows\9g2234wesdf3dfgjf23
2009-05-14 14:18 <DIR> -cd----- C:\QUARANTINE

==================== Find3M ====================


============= FINISH: 14:56:03.13 ===============

[nsh]

Will not be in forum the rest of the day. I will check again first thing tomorrow morning. Have a great evening!

[tetonbob]

We should run ComboFix on this account also.

As ComboFix is updated frequently, download a fresh copy to the destop of this account from one of these links

Download ComboFix from one of these locations:

Link 1
Link 2
Link 3


Download & save ComboFix to your Desktop but don't run it yet

Open notepad and copy/paste the text in the quotebox below into it:

DDS::
uInternet Settings,ProxyServer = http=localhost:7171
uInternet Settings,ProxyOverride = *.local;<local>

Firefox::
FF - ProfilePath - c:\docume~1\wetlab\applic~1\mozilla\firefox\profiles\8jx4wa61.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/ig?hl=en
FF - prefs.js: network.proxy.http - localhost
FF - prefs.js: network.proxy.http_port - 7171
FF - prefs.js: network.proxy.type - 1
File::
c:\windows\9g2234wesdf3dfgjf23

Save this as "CFScript"





Referring to the picture above, drag CFScript.txt into ComboFix.exe

When finished, it shall produce a log for you, C:\ComboFix.txt.


------------

If there are internet issues

*In IE: Tools Menu -> Internet Options -> Connections Tab ->Lan Settings > uncheck "use a proxy server" or reconfigure the Proxy server again in case you have set it previously.

In Firefox in Tools Menu -> Options... -> Advanced Tab -> Network Tab -> "Settings" under Connection and uncheck the proxyserver, set it to No Proxy.

[nsh]

Done. Here is the log. Please let me know if additional information is needed. Thank you.

[tetonbob]

Looking good now. Next is to run an online scan, to help look for remnants.

This scan requires SunJava

• Download the latest version of Java Runtime Environment (JRE) 6 and save it to your desktop.
• Scroll down to where it says "Java SE Runtime Environment (JRE) 6 Update 13. The Java SE Runtime Environment (JRE) allows end-users to run Java applications."
• Click the "Download" button to the right.
• Select the Windows platform from the dropdown menu.
• Read the License Agreement and then check the box that says: " I agree to the Java SE Runtime Environment 6 with JavaFX License Agreement". Click on Continue.The page will refresh.
• Click on the link to download Windows Offline Installation and save the file to your desktop.
• Close any programs you may have running - especially your web browser.
• Then from your desktop double-click on jre-6u13-windows-i586-p.exe to install the newest version.

Other option:

From this page:

http://www.java.com/en/download/manual.jsp

Choose this link

http://javadl.sun.com/webapps/downlo...BundleId=29219

Offline Installation under Windows category.

---------------------------------------------------------------------------------------------

Please perform this online scan to help look for remnants. This scan can take upwards of an hour, so please plan accordingly.

Establish an internet connection & perform an online scan with Firefox or Internet Explorer at Kaspersky Online Scanner

**Note**

To optimize scanning time and produce a more sensible report for review:

• Close any open programs
• Turn off the real time scanner of any existing antivirus program while performing the online scan.

Click Accept, when prompted to download and install the program files and database of malware definitions.

• Click Run at the Security prompt.
• The program will then begin downloading and installing and will also update the database.
• Please be patient as this can take several minutes.
• Once the update is complete, click on Settings. Uncheck Mail databases.
• Next, click on My Computer under the green Scan bar to the left to start the scan.
• Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
• Do NOT be alarmed by what you see in the report. Many of the finds have likely been quarantined.
• Click View scan report at the bottom.
• Click the Save Report As... button.
• Click the Save as Text button to save the file to your desktop so that you may post it in your next reply.

---------------------------------------------------------------------------------------------

How is the machine behaving?

[nsh]

Thought I would log onto another machine while running Kaspersky online scanner on problematic computer. After running ComboFix logged onto the wetlab account, I received 1 'On-Access Scan Message - VirusScan Alert!' Name: C:\System Volume Information\_Restore{23ECCDB8-CC49-485B-940C-9C6FOE80B5D}\RP698. Detected as: Generic Rootkit.w. Detection Type: Trojan. Status: Deleted......

Closed this box and then received your post to run online scanner. My goodness. This mess make me never want to use a computer again! Smile!

[tetonbob]

System Volume Information is where Windows stores System Restore points. We shall address those later by flushing out old restore points and setting a new clean one, but unless you were to restore the machine to that point, those finds are not a major concern.