|
|
|
|
|||||
|
|
|
|
|
|
|||
| Welcome
to Tech Support Forum home to more then 136,000 problems solved. Issues
have included: Spyware, Malware, Virus Issues, Windows, Microsoft,
Linux, Networking, Security, Hardware, and Gaming Getting your
problem solved is as easy as: 1. Registering for a free account 2. Asking your question 3. Receiving an answer Registered members: * See fewer ads. * And much more..
|
| Want to know how to post a question? click here | Having problems with spyware and pop-ups? First Steps |
|
|||||||
| Resolved HJT Threads Resolved spyware and popup issues. |
|
|
LinkBack | Thread Tools |
06-04-2009, 07:35 AM
|
#1 (permalink) |
|
Registered User
Join Date: Jun 2009
Posts: 6
OS: Windows XP
|
Help please!
The other day I got a message that said it was from Windows and that I had a bunch of trojans and other things infecting my machine, it asked if I wanted it fixed and I said yes. I think this was a mistake because now my computer is acting funny, it turns off my Norton Internet Security, when I try to activate it all the settings turn off again.
I believe I followed the instructions for giving you this information, please help if you can. DDS (Ver_09-05-14.01) - NTFSx86 Run by Owner at 13:49:00.51 on Mon 06/01/2009 Internet Explorer: 8.0.6001.18702 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.895.332 [GMT -4:00] AV: Norton Internet Security *On-access scanning enabled* (Updated) {E10A9785-9598-4754-B552-92431C1C35F8} FW: Norton Internet Security *enabled* {7C21A4C9-F61F-4AC4-B722-A6E19C16F220} ============== Running Processes =============== C:\WINDOWS\system32\svchost -k DcomLaunch svchost.exe C:\WINDOWS\System32\svchost.exe -k netsvcs svchost.exe svchost.exe C:\WINDOWS\system32\spoolsv.exe svchost.exe C:\Program Files\APC\APC PowerChute Personal Edition\mainserv.exe C:\WINDOWS\arservice.exe C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe C:\WINDOWS\eHome\ehRecvr.exe C:\WINDOWS\eHome\ehSched.exe C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe C:\Program Files\Norton Internet Security\Engine\16.5.0.135\ccSvcHst.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\HPZipm12.exe C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS C:\Program Files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe svchost.exe C:\WINDOWS\system32\svchost.exe -k imgsvc C:\Program Files\Viewpoint\Common\ViewpointService.exe C:\WINDOWS\system32\dllhost.exe C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe C:\Program Files\Norton Internet Security\Engine\16.5.0.135\ccSvcHst.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe C:\Program Files\HP\HP Software Update\HPWuSchd2.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Documents and Settings\Owner.LUPO\Desktop\dds.scr ============== Pseudo HJT Report =============== uSearch Bar = hxxp://www.comcast.net/toolbar2.0/search/ uStart Page = hxxp://www.comcast.net/comcast.html uInternet Settings,ProxyOverride = *.local mSearchAssistant = hxxp://www.comcast.net/toolbar2.0/search/ BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 7.0\activex\AcroIEHelper.dll BHO: Comcast Toolbar: {4e7bd74f-2b8d-469e-93be-be2df4d9ae29} - c:\progra~1\comcas~1\COMCAS~1.DLL BHO: Symantec NCO BHO: {602adb0e-4aff-4217-8aa1-95dac4dfa408} - c:\program files\norton internet security\engine\16.5.0.135\coIEPlg.dll BHO: Symantec Intrusion Prevention: {6d53ec84-6aae-4787-aeee-f4628f01010c} - c:\program files\norton internet security\engine\16.5.0.135\IPSBHO.DLL BHO: CBrowserHelperObject Object: {ca6319c0-31b7-401e-a518-a07c3db8f777} - c:\windows\system32\BAE.dll TB: {DE9C389F-3316-41A7-809B-AA305ED9D922} - No File TB: Comcast Toolbar: {4e7bd74f-2b8d-469e-93be-be2df4d9ae29} - c:\progra~1\comcas~1\COMCAS~1.DLL TB: Norton Toolbar: {7febefe3-6b19-4349-98d2-ffb09d4b49ca} - c:\program files\norton internet security\engine\16.5.0.135\coIEPlg.dll TB: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File EB: Real.com: {fe54fa40-d68c-11d2-98fa-00c0f0318afe} - c:\windows\system32\Shdocvw.dll uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe uRun: [MSMSGS] "c:\program files\messenger\msmsgs.exe" /background mRun: [Symantec PIF AlertEng] "c:\program files\common files\symantec shared\pif\{b8e1dd85-8582-4c61-b58f-2f227fca9a08}\pifsvc.exe" /a /m "c:\program files\common files\symantec shared\pif\{b8e1dd85-8582-4c61-b58f-2f227fca9a08}\AlertEng.dll" mRun: [HP Software Update] c:\program files\hp\hp software update\HPWuSchd2.exe dRun: [MySpaceIM] c:\program files\myspace\im\MySpaceIM.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\hpdigi~1.lnk - c:\program files\hp\digital imaging\bin\hpqtra08.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\hpimag~1.lnk - c:\program files\hp\digital imaging\bin\hpqthb08.exe IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000 IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - {FE54FA40-D68C-11d2-98FA-00C0F0318AFE} - c:\windows\system32\Shdocvw.dll DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} - hxxp://download.microsoft.com/download/e/4/9/e494c802-dd90-4c6b-a074-469358f075a6/OGAControl.cab DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} - hxxp://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase5483.cab DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1160002098000 DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} - hxxps://webdl.symantec.com/activex/symdlmgr.cab DPF: {9A57B18E-2F5D-11D5-8997-00104BD12D94} - hxxp://support.gateway.com/support/serialharvest/gwCID.CAB DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/swflash.cab Handler: intu-help-qb1 - {9B0F96C7-2E4B-433e-ABF3-043BA1B54AE3} - c:\program files\intuit\quickbooks 2006\HelpAsyncPluggableProtocol.dll Handler: qbwc - {FC598A64-626C-4447-85B8-53150405FD57} - c:\windows\system32\mscoree.dll Handler: symres - {AA1061FE-6C41-421f-9344-69640C9732AB} - c:\program files\norton internet security\engine\16.5.0.135\CoIEPlg.dll SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll ================= FIREFOX =================== FF - ProfilePath - c:\docume~1\owner~1.lup\applic~1\mozilla\firefox\profiles\8eib39ex.default\ FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q= FF - prefs.js: browser.startup.homepage - hxxp://www.comcast.net/home.html FF - component: c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\norton\coffplgn\components\coFFPlgn.dll FF - component: c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\norton\ipsffplgn\components\IPSFFPl.dll FF - component: c:\documents and settings\owner.lupo\application data\mozilla\firefox\profiles\8eib39ex.default\extensions\kodak-companion@mozilla.com\platform\winnt_x86-msvc\components\mozFotofox.dll FF - plugin: c:\documents and settings\owner.lupo\application data\mozilla\firefox\profiles\8eib39ex.default\extensions\moveplayer@movenetworks.com\platform\winnt_x86-msvc\plugins\npmnqmp07076007.dll FF - plugin: c:\program files\java\jre1.5.0_02\bin\NPJava11.dll FF - plugin: c:\program files\java\jre1.5.0_02\bin\NPJava12.dll FF - plugin: c:\program files\java\jre1.5.0_02\bin\NPJava13.dll FF - plugin: c:\program files\java\jre1.5.0_02\bin\NPJava14.dll FF - plugin: c:\program files\java\jre1.5.0_02\bin\NPJava32.dll FF - plugin: c:\program files\java\jre1.5.0_02\bin\NPJPI150_02.dll FF - plugin: c:\program files\java\jre1.5.0_02\bin\NPOJI610.dll FF - plugin: c:\program files\mozilla firefox\plugins\npunagi2.dll FF - plugin: c:\program files\viewpoint\viewpoint experience technology\npViewpoint.dll FF - plugin: c:\program files\virtual earth 3d\npVE3D.dll ============= SERVICES / DRIVERS =============== R0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\nis\1005000.087\SymEFA.sys [2009-3-18 310320] R1 BHDrvx86;Symantec Heuristics Driver;c:\windows\system32\drivers\nis\1005000.087\BHDrvx86.sys [2009-3-18 258608] R1 ccHP;Symantec Hash Provider;c:\windows\system32\drivers\nis\1005000.087\cchpx86.sys [2009-3-18 482352] R1 IDSxpx86;IDSxpx86;c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\norton\definitions\ipsdefs\20090528.001\IDSXpx86.sys [2009-5-29 276344] R2 McrdSvc;Media Center Extender Service;c:\windows\ehome\mcrdsvc.exe [2005-8-5 99328] R2 Norton Internet Security;Norton Internet Security;c:\program files\norton internet security\engine\16.5.0.135\ccSvcHst.exe [2009-3-18 115560] R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\viewpoint\common\ViewpointService.exe [2007-2-15 24652] R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\common files\symantec shared\eengine\EraserUtilRebootDrv.sys [2009-2-25 101936] R3 NAVENG;NAVENG;c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\norton\definitions\virusdefs\20090601.003\naveng.sys [2009-6-1 89104] R3 NAVEX15;NAVEX15;c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\norton\definitions\virusdefs\20090601.003\navex15.sys [2009-6-1 876144] =============== Created Last 30 ================ 2009-06-01 08:31 <DIR> --d----- c:\program files\Norton Support ==================== Find3M ==================== 2009-03-18 09:54 60,808 a------- c:\windows\system32\S32EVNT1.DLL 2009-03-08 04:34 914,944 a------- c:\windows\system32\wininet.dll 2009-03-08 04:34 43,008 a------- c:\windows\system32\licmgr10.dll 2009-03-08 04:33 18,944 a------- c:\windows\system32\corpol.dll 2009-03-08 04:33 420,352 a------- c:\windows\system32\vbscript.dll 2009-03-08 04:32 72,704 a------- c:\windows\system32\admparse.dll 2009-03-08 04:32 71,680 a------- c:\windows\system32\iesetup.dll 2009-03-08 04:31 34,816 a------- c:\windows\system32\imgutil.dll 2009-03-08 04:31 48,128 a------- c:\windows\system32\mshtmler.dll 2009-03-08 04:31 45,568 a------- c:\windows\system32\mshta.exe 2009-03-08 04:22 156,160 a------- c:\windows\system32\msls31.dll 2009-03-06 10:22 284,160 a------- c:\windows\system32\pdh.dll 2009-02-02 09:14 32,768 a--sh--- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012009020220090203\index.dat ============= FINISH: 13:50:42.93 =============== |
|
     |
| Important Information |
|
Join the #1 Tech Support Forum Today - It's Totally Free!
TechSupportForum.com is a leading support website for your computer needs. We offer free, friendly and personalized computer support. Why pay to have your computer fixed when you can do it for free. Join TechSupportforum.com Today - Click Here |
|
06-05-2009, 03:48 PM
|
#2 (permalink) |
|
Moderator, Analyst, Security Team; Rangemaster, TSF Academy
Join Date: Oct 2007
Location: Georgia
Posts: 10,688
OS: XP SP3
|
Re: Help please!
Hello and Welcome to TSF.
Please Subscribe to this Thread to get immediate notification of replies as soon as they are posted. To do this click Thread Tools, then click Subscribe to this Thread. Make sure it is set to Instant notification by email, then click Add Subscription. Please note that the forum is very busy and if I don't hear from you within three days this thread will be closed. ------------------------------------------------------ It appears the logs in the zipped file you attached cannot be extracted. I need to see those logs. Please re-attach them to your next reply without zipping them up. If you didn't save the logs you will have to run dds and gmer again. I only need to see the second log from dds(Attach.txt) and the gmer log. ------------------------------------------------------ |
|
|
|
|
06-06-2009, 06:20 AM
|
#3 (permalink) |
|
Registered User
Join Date: Jun 2009
Posts: 6
OS: Windows XP
|
Re: Help please!
OK here is the information again. Also, now the machine won't let me copy files on to a CD.
DDS (Ver_09-05-14.01) - NTFSx86 Run by Owner at 13:49:00.51 on Mon 06/01/2009 Internet Explorer: 8.0.6001.18702 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.895.332 [GMT -4:00] AV: Norton Internet Security *On-access scanning enabled* (Updated) {E10A9785-9598-4754-B552-92431C1C35F8} FW: Norton Internet Security *enabled* {7C21A4C9-F61F-4AC4-B722-A6E19C16F220} ============== Running Processes =============== C:\WINDOWS\system32\svchost -k DcomLaunch svchost.exe C:\WINDOWS\System32\svchost.exe -k netsvcs svchost.exe svchost.exe C:\WINDOWS\system32\spoolsv.exe svchost.exe C:\Program Files\APC\APC PowerChute Personal Edition\mainserv.exe C:\WINDOWS\arservice.exe C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe C:\WINDOWS\eHome\ehRecvr.exe C:\WINDOWS\eHome\ehSched.exe C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe C:\Program Files\Norton Internet Security\Engine\16.5.0.135\ccSvcHst.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\HPZipm12.exe C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS C:\Program Files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe svchost.exe C:\WINDOWS\system32\svchost.exe -k imgsvc C:\Program Files\Viewpoint\Common\ViewpointService.exe C:\WINDOWS\system32\dllhost.exe C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe C:\Program Files\Norton Internet Security\Engine\16.5.0.135\ccSvcHst.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe C:\Program Files\HP\HP Software Update\HPWuSchd2.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Documents and Settings\Owner.LUPO\Desktop\dds.scr ============== Pseudo HJT Report =============== uSearch Bar = hxxp://www.comcast.net/toolbar2.0/search/ uStart Page = hxxp://www.comcast.net/comcast.html uInternet Settings,ProxyOverride = *.local mSearchAssistant = hxxp://www.comcast.net/toolbar2.0/search/ BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 7.0\activex\AcroIEHelper.dll BHO: Comcast Toolbar: {4e7bd74f-2b8d-469e-93be-be2df4d9ae29} - c:\progra~1\comcas~1\COMCAS~1.DLL BHO: Symantec NCO BHO: {602adb0e-4aff-4217-8aa1-95dac4dfa408} - c:\program files\norton internet security\engine\16.5.0.135\coIEPlg.dll BHO: Symantec Intrusion Prevention: {6d53ec84-6aae-4787-aeee-f4628f01010c} - c:\program files\norton internet security\engine\16.5.0.135\IPSBHO.DLL BHO: CBrowserHelperObject Object: {ca6319c0-31b7-401e-a518-a07c3db8f777} - c:\windows\system32\BAE.dll TB: {DE9C389F-3316-41A7-809B-AA305ED9D922} - No File TB: Comcast Toolbar: {4e7bd74f-2b8d-469e-93be-be2df4d9ae29} - c:\progra~1\comcas~1\COMCAS~1.DLL TB: Norton Toolbar: {7febefe3-6b19-4349-98d2-ffb09d4b49ca} - c:\program files\norton internet security\engine\16.5.0.135\coIEPlg.dll TB: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File EB: Real.com: {fe54fa40-d68c-11d2-98fa-00c0f0318afe} - c:\windows\system32\Shdocvw.dll uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe uRun: [MSMSGS] "c:\program files\messenger\msmsgs.exe" /background mRun: [Symantec PIF AlertEng] "c:\program files\common files\symantec shared\pif\{b8e1dd85-8582-4c61-b58f-2f227fca9a08}\pifsvc.exe" /a /m "c:\program files\common files\symantec shared\pif\{b8e1dd85-8582-4c61-b58f-2f227fca9a08}\AlertEng.dll" mRun: [HP Software Update] c:\program files\hp\hp software update\HPWuSchd2.exe dRun: [MySpaceIM] c:\program files\myspace\im\MySpaceIM.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\hpdigi~1.lnk - c:\program files\hp\digital imaging\bin\hpqtra08.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\hpimag~1.lnk - c:\program files\hp\digital imaging\bin\hpqthb08.exe IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000 IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - {FE54FA40-D68C-11d2-98FA-00C0F0318AFE} - c:\windows\system32\Shdocvw.dll DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} - hxxp://download.microsoft.com/download/e/4/9/e494c802-dd90-4c6b-a074-469358f075a6/OGAControl.cab DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} - hxxp://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase5483.cab DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1160002098000 DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} - hxxps://webdl.symantec.com/activex/symdlmgr.cab DPF: {9A57B18E-2F5D-11D5-8997-00104BD12D94} - hxxp://support.gateway.com/support/serialharvest/gwCID.CAB DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/swflash.cab Handler: intu-help-qb1 - {9B0F96C7-2E4B-433e-ABF3-043BA1B54AE3} - c:\program files\intuit\quickbooks 2006\HelpAsyncPluggableProtocol.dll Handler: qbwc - {FC598A64-626C-4447-85B8-53150405FD57} - c:\windows\system32\mscoree.dll Handler: symres - {AA1061FE-6C41-421f-9344-69640C9732AB} - c:\program files\norton internet security\engine\16.5.0.135\CoIEPlg.dll SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll ================= FIREFOX =================== FF - ProfilePath - c:\docume~1\owner~1.lup\applic~1\mozilla\firefox\profiles\8eib39ex.default\ FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q= FF - prefs.js: browser.startup.homepage - hxxp://www.comcast.net/home.html FF - component: c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\norton\coffplgn\components\coFFPlgn.dll FF - component: c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\norton\ipsffplgn\components\IPSFFPl.dll FF - component: c:\documents and settings\owner.lupo\application data\mozilla\firefox\profiles\8eib39ex.default\extensions\kodak-companion@mozilla.com\platform\winnt_x86-msvc\components\mozFotofox.dll FF - plugin: c:\documents and settings\owner.lupo\application data\mozilla\firefox\profiles\8eib39ex.default\extensions\moveplayer@movenetworks.com\platform\winnt_x86-msvc\plugins\npmnqmp07076007.dll FF - plugin: c:\program files\java\jre1.5.0_02\bin\NPJava11.dll FF - plugin: c:\program files\java\jre1.5.0_02\bin\NPJava12.dll FF - plugin: c:\program files\java\jre1.5.0_02\bin\NPJava13.dll FF - plugin: c:\program files\java\jre1.5.0_02\bin\NPJava14.dll FF - plugin: c:\program files\java\jre1.5.0_02\bin\NPJava32.dll FF - plugin: c:\program files\java\jre1.5.0_02\bin\NPJPI150_02.dll FF - plugin: c:\program files\java\jre1.5.0_02\bin\NPOJI610.dll FF - plugin: c:\program files\mozilla firefox\plugins\npunagi2.dll FF - plugin: c:\program files\viewpoint\viewpoint experience technology\npViewpoint.dll FF - plugin: c:\program files\virtual earth 3d\npVE3D.dll ============= SERVICES / DRIVERS =============== R0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\nis\1005000.087\SymEFA.sys [2009-3-18 310320] R1 BHDrvx86;Symantec Heuristics Driver;c:\windows\system32\drivers\nis\1005000.087\BHDrvx86.sys [2009-3-18 258608] R1 ccHP;Symantec Hash Provider;c:\windows\system32\drivers\nis\1005000.087\cchpx86.sys [2009-3-18 482352] R1 IDSxpx86;IDSxpx86;c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\norton\definitions\ipsdefs\20090528.001\IDSXpx86.sys [2009-5-29 276344] R2 McrdSvc;Media Center Extender Service;c:\windows\ehome\mcrdsvc.exe [2005-8-5 99328] R2 Norton Internet Security;Norton Internet Security;c:\program files\norton internet security\engine\16.5.0.135\ccSvcHst.exe [2009-3-18 115560] R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\viewpoint\common\ViewpointService.exe [2007-2-15 24652] R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\common files\symantec shared\eengine\EraserUtilRebootDrv.sys [2009-2-25 101936] R3 NAVENG;NAVENG;c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\norton\definitions\virusdefs\20090601.003\naveng.sys [2009-6-1 89104] R3 NAVEX15;NAVEX15;c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\norton\definitions\virusdefs\20090601.003\navex15.sys [2009-6-1 876144] =============== Created Last 30 ================ 2009-06-01 08:31 <DIR> --d----- c:\program files\Norton Support ==================== Find3M ==================== 2009-03-18 09:54 60,808 a------- c:\windows\system32\S32EVNT1.DLL 2009-03-08 04:34 914,944 a------- c:\windows\system32\wininet.dll 2009-03-08 04:34 43,008 a------- c:\windows\system32\licmgr10.dll 2009-03-08 04:33 18,944 a------- c:\windows\system32\corpol.dll 2009-03-08 04:33 420,352 a------- c:\windows\system32\vbscript.dll 2009-03-08 04:32 72,704 a------- c:\windows\system32\admparse.dll 2009-03-08 04:32 71,680 a------- c:\windows\system32\iesetup.dll 2009-03-08 04:31 34,816 a------- c:\windows\system32\imgutil.dll 2009-03-08 04:31 48,128 a------- c:\windows\system32\mshtmler.dll 2009-03-08 04:31 45,568 a------- c:\windows\system32\mshta.exe 2009-03-08 04:22 156,160 a------- c:\windows\system32\msls31.dll 2009-03-06 10:22 284,160 a------- c:\windows\system32\pdh.dll 2009-02-02 09:14 32,768 a--sh--- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012009020220090203\index.dat ============= FINISH: 13:50:42.93 =============== GMER 1.0.15.14972 - http://www.gmer.net Rootkit scan 2009-06-01 16:54:46 Windows 5.1.2600 Service Pack 3 ---- System - GMER 1.0.15 ---- Code 853F7E10 ZwEnumerateKey Code 85444010 ZwFlushInstructionCache Code 853C76C6 IofCallDriver Code 8546200E IofCompleteRequest ---- Devices - GMER 1.0.15 ---- Device \FileSystem\Ntfs \Ntfs 857411D8 Device \FileSystem\Fastfat \FatCdrom 85321788 Device \Driver\NetBT \Device\NetBT_Tcpip_{7C369BD8-ED3D-473E-B36A-C6358913A583} 851BD368 AttachedDevice \Driver\Tcpip \Device\Ip SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation) AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 arkbcfltr.sys (Microsoft AR PS/2 Keyboard Filter Driver (Beta 2 Release 2)/Microsoft Corporation) AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 arkbcfltr.sys (Microsoft AR PS/2 Keyboard Filter Driver (Beta 2 Release 2)/Microsoft Corporation) Device \Driver\usbohci \Device\USBPDO-0 854FB1D8 Device \Driver\dmio \Device\DmControl\DmIoDaemon 8575A1D8 Device \Driver\dmio \Device\DmControl\DmConfig 8575A1D8 Device \Driver\dmio \Device\DmControl\DmPnP 8575A1D8 Device \Driver\dmio \Device\DmControl\DmInfo 8575A1D8 Device \Driver\usbehci \Device\USBPDO-1 85537980 AttachedDevice \Driver\Tcpip \Device\Tcp SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation) Device \Driver\Ftdisk \Device\HarddiskVolume1 857CF1D8 Device \Driver\Ftdisk \Device\HarddiskVolume2 857CF1D8 Device \Driver\NetBT \Device\NetBt_Wins_Export 851BD368 Device \Driver\usbstor \Device\000000c3 845811D8 Device \Driver\NetBT \Device\NetbiosSmb 851BD368 Device \Driver\usbstor \Device\000000d0 845811D8 Device \Driver\usbstor \Device\000000c4 845811D8 Device \Driver\usbstor \Device\000000c5 845811D8 Device \Driver\usbstor \Device\000000c6 845811D8 AttachedDevice \Driver\Tcpip \Device\Udp SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation) AttachedDevice \Driver\Tcpip \Device\RawIp SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation) Device \Driver\usbohci \Device\USBFDO-0 854FB1D8 Device \Driver\usbehci \Device\USBFDO-1 85537980 Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver 852785E8 Device \FileSystem\MRxSmb \Device\LanmanRedirector 852785E8 Device \Driver\Ftdisk \Device\FtControl 857CF1D8 Device \Driver\usbstor \Device\000000be 845811D8 Device \Driver\usbstor \Device\000000cc 845811D8 Device \FileSystem\Fastfat \Fat 85321788 AttachedDevice \FileSystem\Fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation) Device \FileSystem\Cdfs \Cdfs 85171980 ---- Services - GMER 1.0.15 ---- Service C:\WINDOWS\system32\drivers\kungsfemfagvpt.sys (*** hidden *** ) [SYSTEM] kungsfrxuwnswr <-- ROOTKIT !!! ---- Registry - GMER 1.0.15 ---- Reg HKLM\SYSTEM\CurrentControlSet\Services\kungsfrxuwnswr Reg HKLM\SYSTEM\CurrentControlSet\Services\kungsfrxuwnswr@start 1 Reg HKLM\SYSTEM\CurrentControlSet\Services\kungsfrxuwnswr@type 1 Reg HKLM\SYSTEM\CurrentControlSet\Services\kungsfrxuwnswr@group file system Reg HKLM\SYSTEM\CurrentControlSet\Services\kungsfrxuwnswr@imagepath \systemroot\system32\drivers\kungsfemfagvpt.sys Reg HKLM\SYSTEM\CurrentControlSet\Services\kungsfrxuwnswr\main Reg HKLM\SYSTEM\CurrentControlSet\Services\kungsfrxuwnswr\main@aid 10081 Reg HKLM\SYSTEM\CurrentControlSet\Services\kungsfrxuwnswr\main@sid 0 Reg HKLM\SYSTEM\CurrentControlSet\Services\kungsfrxuwnswr\main@cmddelay 7200 Reg HKLM\SYSTEM\CurrentControlSet\Services\kungsfrxuwnswr\main\connections Reg HKLM\SYSTEM\CurrentControlSet\Services\kungsfrxuwnswr\main\delete Reg HKLM\SYSTEM\CurrentControlSet\Services\kungsfrxuwnswr\main\injector Reg HKLM\SYSTEM\CurrentControlSet\Services\kungsfrxuwnswr\main\injector@* kungsfwsp.dll Reg HKLM\SYSTEM\CurrentControlSet\Services\kungsfrxuwnswr\main\tasks Reg HKLM\SYSTEM\CurrentControlSet\Services\kungsfrxuwnswr\modules Reg HKLM\SYSTEM\CurrentControlSet\Services\kungsfrxuwnswr\modules@kungsfrk.sys \systemroot\system32\drivers\kungsfemfagvpt.sys Reg HKLM\SYSTEM\CurrentControlSet\Services\kungsfrxuwnswr\modules@kungsfcmd.dll \systemroot\system32\kungsfnqlrlxbe.dll Reg HKLM\SYSTEM\CurrentControlSet\Services\kungsfrxuwnswr\modules@kungsflog.dat \systemroot\system32\kungsfpxuxriro.dat Reg HKLM\SYSTEM\CurrentControlSet\Services\kungsfrxuwnswr\modules@kungsf.dat \systemroot\system32\kungsfewbhcxoy.dat Reg HKLM\SYSTEM\CurrentControlSet\Services\kungsfrxuwnswr\modules@kungsfwsp.dll \systemroot\system32\kungsfmylvmyqb.dll Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0xA6 0x58 0x81 0x33 ... Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0 Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0xA6 0x58 0x81 0x33 ... Reg HKLM\SYSTEM\ControlSet003\Services\kungsfrxuwnswr Reg HKLM\SYSTEM\ControlSet003\Services\kungsfrxuwnswr@start 1 Reg HKLM\SYSTEM\ControlSet003\Services\kungsfrxuwnswr@type 1 Reg HKLM\SYSTEM\ControlSet003\Services\kungsfrxuwnswr@group file system Reg HKLM\SYSTEM\ControlSet003\Services\kungsfrxuwnswr@imagepath \systemroot\system32\drivers\kungsfemfagvpt.sys Reg HKLM\SYSTEM\ControlSet003\Services\kungsfrxuwnswr\main Reg HKLM\SYSTEM\ControlSet003\Services\kungsfrxuwnswr\main@aid 10081 Reg HKLM\SYSTEM\ControlSet003\Services\kungsfrxuwnswr\main@sid 0 Reg HKLM\SYSTEM\ControlSet003\Services\kungsfrxuwnswr\main@cmddelay 3600 Reg HKLM\SYSTEM\ControlSet003\Services\kungsfrxuwnswr\main\connections Reg HKLM\SYSTEM\ControlSet003\Services\kungsfrxuwnswr\main\delete Reg HKLM\SYSTEM\ControlSet003\Services\kungsfrxuwnswr\main\injector Reg HKLM\SYSTEM\ControlSet003\Services\kungsfrxuwnswr\main\injector@* kungsfwsp.dll Reg HKLM\SYSTEM\ControlSet003\Services\kungsfrxuwnswr\main\tasks Reg HKLM\SYSTEM\ControlSet003\Services\kungsfrxuwnswr\modules Reg HKLM\SYSTEM\ControlSet003\Services\kungsfrxuwnswr\modules@kungsfrk.sys \systemroot\system32\drivers\kungsfemfagvpt.sys Reg HKLM\SYSTEM\ControlSet003\Services\kungsfrxuwnswr\modules@kungsfcmd.dll \systemroot\system32\kungsfnqlrlxbe.dll Reg HKLM\SYSTEM\ControlSet003\Services\kungsfrxuwnswr\modules@kungsflog.dat \systemroot\system32\kungsfpxuxriro.dat Reg HKLM\SYSTEM\ControlSet003\Services\kungsfrxuwnswr\modules@kungsf.dat \systemroot\system32\kungsfewbhcxoy.dat Reg HKLM\SYSTEM\ControlSet003\Services\kungsfrxuwnswr\modules@kungsfwsp.dll \systemroot\system32\kungsfmylvmyqb.dll Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0 Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0xA6 0x58 0x81 0x33 ... ---- Files - GMER 1.0.15 ---- File C:\WINDOWS\system32\drivers\kungsfemfagvpt.sys 20480 bytes executable <-- ROOTKIT !!! File C:\WINDOWS\system32\kungsfmylvmyqb.dll 19456 bytes executable File C:\WINDOWS\system32\kungsfnqlrlxbe.dll 20992 bytes executable File C:\WINDOWS\system32\kungsfpxuxriro.dat 15542 bytes File C:\WINDOWS\Temp\kungsfptuicxgqfw.tmp 19456 bytes executable File C:\WINDOWS\Temp\kungsfqrneqhwufj.tmp 19456 bytes executable File C:\WINDOWS\Temp\kungsfrumcdsitqk.tmp 19456 bytes executable ---- EOF - GMER 1.0.15 ---- UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG. IF REQUESTED, ZIP IT UP & ATTACH IT DDS (Ver_09-05-14.01) Microsoft Windows XP Professional Boot Device: \Device\HarddiskVolume1 Install Date: 10/4/2006 6:15:39 PM System Uptime: 6/1/2009 10:18:06 AM (3 hours ago) Motherboard: C51PVGM-GB | | C51PVGM-GB Processor: AMD Athlon(tm) 64 X2 Dual Core Processor 3800+ | Socket M2 | 2009/201mhz ==== Disk Partitions ========================= C: is FIXED (NTFS) - 228 GiB total, 150.843 GiB free. D: is FIXED (FAT32) - 5 GiB total, 3.399 GiB free. E: is CDROM () F: is Removable G: is Removable H: is Removable I: is Removable J: is Removable ==== Disabled Device Manager Items ============= ==== System Restore Points =================== RP789: 3/4/2009 11:44:49 AM - System Checkpoint RP790: 3/5/2009 7:50:35 PM - System Checkpoint RP791: 3/7/2009 6:49:55 AM - System Checkpoint RP792: 3/8/2009 8:52:06 AM - System Checkpoint RP793: 3/9/2009 10:02:02 AM - System Checkpoint RP794: 3/10/2009 10:56:16 AM - System Checkpoint RP795: 3/11/2009 2:20:32 PM - Software Distribution Service 3.0 RP796: 3/12/2009 2:31:53 PM - System Checkpoint RP797: 3/12/2009 9  16 PM - Software Distribution Service 3.0RP798: 3/14/2009 11:05:22 AM - System Checkpoint RP799: 3/15/2009 1:14:04 PM - System Checkpoint RP800: 3/16/2009 7:53:00 PM - System Checkpoint RP801: 3/17/2009 8:17:39 PM - System Checkpoint RP802: 3/18/2009 8:38:49 PM - System Checkpoint RP803: 3/19/2009 8:46:33 PM - System Checkpoint RP804: 3/20/2009 8:50:43 PM - System Checkpoint RP805: 3/22/2009 12:02:17 PM - System Checkpoint RP806: 3/23/2009 5:47:35 PM - System Checkpoint RP807: 3/25/2009 8:10:26 AM - System Checkpoint RP808: 3/26/2009 11:27:40 AM - System Checkpoint RP809: 3/28/2009 8:59:45 AM - System Checkpoint RP810: 3/29/2009 9:54:32 AM - System Checkpoint RP811: 3/30/2009 2:29:53 PM - System Checkpoint RP812: 3/31/2009 4:58:42 PM - System Checkpoint RP813: 4/1/2009 5:05:57 PM - System Checkpoint RP814: 4/2/2009 8:26:41 AM - Installed Windows Internet Explorer 8. RP815: 4/2/2009 8:27:59 AM - Software Distribution Service 3.0 RP816: 4/2/2009 8:50:40 AM - Software Distribution Service 3.0 RP817: 4/3/2009 9:49:05 AM - System Checkpoint RP818: 4/4/2009 12:20:58 PM - System Checkpoint RP819: 4/5/2009 1:20:02 PM - System Checkpoint RP820: 4/6/2009 1:25:08 PM - System Checkpoint RP821: 4/7/2009 2:51:20 PM - System Checkpoint RP822: 4/8/2009 4:59:53 PM - System Checkpoint RP823: 4/9/2009 5:08:01 PM - System Checkpoint RP824: 4/11/2009 9:03:23 AM - System Checkpoint RP825: 4/12/2009 9:05:04 AM - System Checkpoint RP826: 4/13/2009 10:01:54 AM - System Checkpoint RP827: 4/14/2009 5:08:36 PM - System Checkpoint RP828: 4/15/2009 5:05:20 PM - Software Distribution Service 3.0 RP829: 4/16/2009 5:25:01 PM - System Checkpoint RP830: 4/17/2009 6:23:08 PM - System Checkpoint RP831: 4/19/2009 10:23:00 AM - System Checkpoint RP832: 4/20/2009 12:00:01 PM - System Checkpoint RP833: 4/21/2009 3:39:30 PM - System Checkpoint RP834: 4/22/2009 8:43:09 PM - System Checkpoint RP835: 4/23/2009 9 56 PM - System CheckpointRP836: 4/24/2009 9:55:14 PM - System Checkpoint RP837: 4/26/2009 8:25:30 AM - System Checkpoint RP838: 4/27/2009 9:16:06 AM - System Checkpoint RP839: 4/28/2009 2:10:18 PM - System Checkpoint RP840: 4/29/2009 3:01:29 PM - System Checkpoint RP841: 4/30/2009 7:33:58 PM - System Checkpoint RP842: 5/1/2009 7:45:27 PM - System Checkpoint RP843: 5/3/2009 9:23:09 AM - System Checkpoint RP844: 5/4/2009 9:55:07 AM - System Checkpoint RP845: 5/5/2009 11:15:22 AM - System Checkpoint RP846: 5/6/2009 1:01:22 PM - System Checkpoint RP847: 5/7/2009 2:41:17 PM - System Checkpoint RP848: 5/8/2009 4:31:09 PM - System Checkpoint RP849: 5/9/2009 4:33:49 PM - System Checkpoint RP850: 5/10/2009 5:41:30 PM - System Checkpoint RP851: 5/11/2009 5:50:57 PM - System Checkpoint RP852: 5/12/2009 6:46:53 PM - System Checkpoint RP853: 5/12/2009 10:15:46 PM - Software Distribution Service 3.0 RP854: 5/14/2009 9:08:07 AM - System Checkpoint RP855: 5/15/2009 9:22:28 AM - System Checkpoint RP856: 5/16/2009 8:52:25 PM - System Checkpoint RP857: 5/18/2009 7:49:17 AM - System Checkpoint RP858: 5/19/2009 12:17:17 PM - System Checkpoint RP859: 5/20/2009 12:44:53 PM - System Checkpoint RP860: 5/21/2009 1:43:49 PM - System Checkpoint RP861: 5/22/2009 2:29:52 PM - System Checkpoint RP862: 5/23/2009 4:52:16 PM - System Checkpoint RP863: 5/24/2009 5:26:35 PM - System Checkpoint RP864: 5/26/2009 9:38:44 PM - System Checkpoint RP865: 5/29/2009 10:44:26 AM - System Checkpoint RP866: 5/30/2009 10:48:42 AM - System Checkpoint RP867: 5/31/2009 1:46:42 PM - System Checkpoint ==== Installed Programs ====================== µTorrent 3100_3200_3300_Help 3100_3200_3300trb 3200 Adobe Flash Player 10 ActiveX Adobe Flash Player 10 Plugin Adobe Reader 7.0.7 Adobe Shockwave Player AIM 6 AIM Facebook Plugin 0.0.8 AiO_Scan_CDA AiOSoftwareNPI APC PowerChute Personal Edition Apple Software Update Ares 2.0.8 AV Music Morpher Browser Address Error Redirector BuddyList Ops 1.0.0.1 BufferChm Camera Window Canon Camera Window for ZoomBrowser EX Canon PhotoRecord Canon Utilities File Viewer Utility 1.2 Canon Utilities PhotoStitch 3.1 Canon Utilities RemoteCapture 2.7 Canon Utilities ZoomBrowser EX CleanUp! Colorizer 1.0.0.1 Comcast High-Speed Internet Install Wizard Comcast Toolbar CP_AtenaShokunin1Config CP_CalendarTemplates1 CP_Package_Basic1 CP_Package_Variety1 CP_Package_Variety2 CP_Package_Variety3 CP_Panorama1Config Critical Update for Windows Media Player 11 (KB959772) CueTour CustomerResearchQFolder CuteFTP 8 Home Destinations DeviceFunctionQFolder DeviceManagementQFolder Digital Media Reader DocProc DocumentViewer DocumentViewerQFolder DVD Solution Easy Rafters 3.2 eSupportQFolder ExtractNow Fax_CDA File Viewer Utility 1.2 FullDPAppQFolder Gateway Drivers and Applications Recovery Gateway Multi-function Keyboard gtw_logo High Definition Audio Driver Package - KB888111 HijackThis 1.99.1 Hotfix for Windows Internet Explorer 7 (KB947864) Hotfix for Windows Media Format 11 SDK (KB929399) Hotfix for Windows Media Player 10 (KB903157) Hotfix for Windows Media Player 11 (KB939683) Hotfix for Windows XP (KB952287) HP Document Viewer 5.3 HP Extended Capabilities 5.3 HP Image Zone 5.3 HP Imaging Device Functions 5.3 HP Photosmart, Officejet and Deskjet 7.0.A HP Product Assistant HP PSC & OfficeJet 5.3.A HP Solution Center & Imaging Support Tools 5.3 HP Update HPProductAssistant InstantShareDevices iPod Updater 2004-08-06 iTunes J2SE Runtime Environment 5.0 Update 2 LabelCreator Pro LiveUpdate 3.1 (Symantec Corporation) LiveUpdate Notice (Symantec Corporation) MarketResearch Microsoft .NET Framework 1.1 Microsoft .NET Framework 1.1 Hotfix (KB928366) Microsoft .NET Framework 2.0 Service Pack 1 Microsoft .NET Framework 3.0 Microsoft Away Mode Microsoft Compression Client Pack 1.0 for Windows XP Microsoft Internationalized Domain Names Mitigation APIs Microsoft National Language Support Downlevel APIs Microsoft Office Standard Edition 2003 Microsoft Silverlight Microsoft User-Mode Driver Framework Feature Pack 1.0 Mozilla Firefox (3.0.10) MSXML 4.0 SP2 (KB927978) MSXML 4.0 SP2 (KB936181) MSXML 4.0 SP2 (KB954430) MSXML 4.0 SP2 Parser and SDK MSXML 6 Service Pack 2 (KB954459) Multimedia Keyboard Driver MySpaceIM Napster Burn Engine neroxml NewCopy_CDA Norton Internet Security NVIDIA Drivers Palm Desktop PanoStandAlone PeerGuardian 2.0 PhotoGallery PhotoStitch Power2Go 4.0 PowerDVD Print Artist Photo Projects ProductContextNPI QFolder QuickBooks Pro 2008 QuickTime RandMap Readme RealPlayer REALTEK GbE & FE Ethernet PCI NIC Driver Realtek High Definition Audio Driver Recovery Software Suite Gateway RemoteCapture 2.7.0 Scan ScannerCopy Security Update for Step By Step Interactive Training (KB898458) Security Update for Windows Internet Explorer 7 (KB928090) Security Update for Windows Internet Explorer 7 (KB929969) Security Update for Windows Internet Explorer 7 (KB931768) Security Update for Windows Internet Explorer 7 (KB933566) Security Update for Windows Internet Explorer 7 (KB937143) Security Update for Windows Internet Explorer 7 (KB938127) Security Update for Windows Internet Explorer 7 (KB939653) Security Update for Windows Internet Explorer 7 (KB942615) Security Update for Windows Internet Explorer 7 (KB944533) Security Update for Windows Internet Explorer 7 (KB950759) Security Update for Windows Internet Explorer 7 (KB953838) Security Update for Windows Internet Explorer 7 (KB956390) Security Update for Windows Internet Explorer 7 (KB958215) Security Update for Windows Internet Explorer 7 (KB960714) Security Update for Windows Internet Explorer 7 (KB961260) Security Update for Windows Media Player (KB911564) Security Update for Windows Media Player (KB952069) Security Update for Windows Media Player 10 (KB911565) Security Update for Windows Media Player 10 (KB917734) Security Update for Windows Media Player 11 (KB936782) Security Update for Windows Media Player 11 (KB954154) Security Update for Windows Media Player 6.4 (KB925398) Security Update for Windows XP (KB913433) Security Update for Windows XP (KB923561) Security Update for Windows XP (KB923689) Security Update for Windows XP (KB938464-v2) Security Update for Windows XP (KB938464) Security Update for Windows XP (KB941569) Security Update for Windows XP (KB946648) Security Update for Windows XP (KB950760) Security Update for Windows XP (KB950762) Security Update for Windows XP (KB950974) Security Update for Windows XP (KB951066) Security Update for Windows XP (KB951376-v2) Security Update for Windows XP (KB951376) Security Update for Windows XP (KB951698) Security Update for Windows XP (KB951748) Security Update for Windows XP (KB952004) Security Update for Windows XP (KB952954) Security Update for Windows XP (KB953839) Security Update for Windows XP (KB954211) Security Update for Windows XP (KB954459) Security Update for Windows XP (KB954600) Security Update for Windows XP (KB955069) Security Update for Windows XP (KB956391) Security Update for Windows XP (KB956572) Security Update for Windows XP (KB956802) Security Update for Windows XP (KB956803) Security Update for Windows XP (KB956841) Security Update for Windows XP (KB957095) Security Update for Windows XP (KB957097) Security Update for Windows XP (KB958644) Security Update for Windows XP (KB958687) Security Update for Windows XP (KB958690) Security Update for Windows XP (KB959426) Security Update for Windows XP (KB960225) Security Update for Windows XP (KB960715) Security Update for Windows XP (KB960803) Security Update for Windows XP (KB961373) SkinsHP1 Soft Data Fax Modem with SmartCP SolutionCenter Sonic Encoders Sonic_PrimoSDK Status SupportSoft Assisted Service TeamViewer 4 TrayApp Unload Update for Windows Internet Explorer 8 (KB968220) Update for Windows Media Player 10 (KB910393) Update for Windows Media Player 10 (KB913800) Update for Windows Media Player 10 (KB926251) Update for Windows XP (KB951072-v2) Update for Windows XP (KB951978) Update for Windows XP (KB953356) Update for Windows XP (KB955839) Update for Windows XP (KB967715) Update Rollup 2 for Windows XP Media Center Edition 2005 URGE Viewpoint Manager (Remove Only) Viewpoint Media Player Virtual Earth 3D (Beta) WebFldrs XP WebReg Winamp (remove only) Windows Communication Foundation Windows Driver Package - Advanced Micro Devices (AmdK8) Processor (05/27/2006 1.3.2.0) Windows Genuine Advantage Notifications (KB905474) Windows Genuine Advantage Validation Tool (KB892130) Windows Imaging Component Windows Internet Explorer 7 Windows Internet Explorer 8 Windows Live OneCare safety scanner Windows Media Format 11 runtime Windows Media Player 11 Windows Media Player Firefox Plugin Windows Presentation Foundation Windows Workflow Foundation Windows XP Media Center Edition 2005 KB925766 Windows XP Service Pack 3 WinRAR archiver WinZip 12.0 XML Paper Specification Shared Components Pack 1.0 ==== Event Viewer Messages From Past Week ======== 6/1/2009 2:24:14 AM, error: SideBySide [59] - Resolve Partial Assembly failed for Microsoft.VC80.MFCLOC. Reference error message: The referenced assembly is not installed on your system. . 6/1/2009 2:24:14 AM, error: SideBySide [59] - Generate Activation Context failed for C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\MFC80.DLL. Reference error message: The operation completed successfully. . 6/1/2009 2:24:14 AM, error: SideBySide [32] - Dependent Assembly Microsoft.VC80.MFCLOC could not be found and Last Error was The referenced assembly is not installed on your system. 6/1/2009 12:54:01 PM, error: System Error [1003] - Error code 100000d1, parameter1 e54ef000, parameter2 00000002, parameter3 00000000, parameter4 f341ce85. 5/30/2009 9:01:01 AM, error: SideBySide [61] - Syntax error in manifest or policy file "C:\Program Files\Apple Software Update\Plugins\MSIInstallPlugin.dll.Manifest" on line 2. The required attribute version is missing from element assemblyIdentity. 5/30/2009 9:01:01 AM, error: SideBySide [61] - Syntax error in manifest or policy file "C:\Program Files\Apple Software Update\Plugins\EXEInstallPlugin.dll.Manifest" on line 2. The required attribute version is missing from element assemblyIdentity. 5/30/2009 9:01:01 AM, error: SideBySide [59] - Generate Activation Context failed for C:\Program Files\Apple Software Update\Plugins\MSIInstallPlugin.dll.Manifest. Reference error message: The operation completed successfully. . 5/30/2009 9:01:01 AM, error: SideBySide [59] - Generate Activation Context failed for C:\Program Files\Apple Software Update\Plugins\EXEInstallPlugin.dll.Manifest. Reference error message: The operation completed successfully. . 5/30/2009 9:01:01 AM, error: SideBySide [58] - Syntax error in manifest or policy file "C:\Program Files\Apple Software Update\Plugins\MSIInstallPlugin.dll.Manifest" on line 2. 5/30/2009 9:01:01 AM, error: SideBySide [58] - Syntax error in manifest or policy file "C:\Program Files\Apple Software Update\Plugins\EXEInstallPlugin.dll.Manifest" on line 2. ==== End Of File =========================== |
|
|
|
|
06-06-2009, 06:44 AM
|
#4 (permalink) |
|
Moderator, Analyst, Security Team; Rangemaster, TSF Academy
Join Date: Oct 2007
Location: Georgia
Posts: 10,688
OS: XP SP3
|
Re: Help please!
Hello runaroundsue.
One or more of the identified infections is a backdoor trojan. This type of infection allows hackers to remotely control your computer, log keystrokes, steal critical system information, and download and execute files without your knowledge. If you do any banking or other financial transactions on the PC or if it should contain any other sensitive information, please get to a known clean computer and change all passwords where applicable, and it would be wise to contact those same financial institutions to apprise them of your situation. Please read this: How Do I Handle Possible Identify Theft, Internet Fraud, and CC Fraud? ------------------------------------------------------ Please note that these fixes are not instantaneous. Most infections require more than one round to properly eradicate. Please stay with me until given the 'all clear' even if symptoms seemingly abate. Kindly follow my instructions and please do no fixing on your own or running of scanners unless requested by a helper. ------------------------------------------------------ Download ComboFix from any of the links below. You must rename it to Combo-Fix before saving it. Save it to your Desktop. If you are using Firefox, go to Tools > Options > Main and select 'Always ask me where to save files' and click OK. Link 1 Link 2 Link 3   * IMPORTANT !!! Save Combo-Fix.exe to your Desktop ------------------------------------------------------
 Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:  Click on Yes to continue scanning for malware. Your desktop may go blank. This is normal. It will return when ComboFix is done. ComboFix may reboot your machine. This is normal. When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply. ------------------------------------------------------ Last edited by chemist; 06-06-2009 at 06:51 AM. |
|
|
|
|
06-06-2009, 07:34 AM
|
#5 (permalink) |
|
Registered User
Join Date: Jun 2009
Posts: 6
OS: Windows XP
|
Re: Help please!
I ran Combofix and things seem back to normal. Here is the log.
ComboFix 09-06-05.07 - Owner 06/06/2009 9:19.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.895.583 [GMT -4:00] Running from: c:\documents and settings\Owner.LUPO\Desktop\ComboFix.exe AV: Norton Internet Security *On-access scanning disabled* (Updated) {E10A9785-9598-4754-B552-92431C1C35F8} FW: Norton Internet Security *disabled* {7C21A4C9-F61F-4AC4-B722-A6E19C16F220} . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\windows\system32\bszip.dll c:\windows\system32\drivers\kungsfemfagvpt.sys c:\windows\system32\kungsfewbhcxoy.dat c:\windows\system32\kungsfmylvmyqb.dll c:\windows\system32\kungsfnqlrlxbe.dll c:\windows\system32\kungsfpxuxriro.dat D:\Autorun.inf D:\Desktop.ini . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Service_kungsfrxuwnswr ((((((((((((((((((((((((( Files Created from 2009-05-06 to 2009-06-06 ))))))))))))))))))))))))))))))) . 2009-06-06 13:19 . 2009-03-12 09:03 165240 ----a-r- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\IPSFFPlgn\components\IPSFFPl.dll 2009-06-06 12:11 . 2009-06-01 06:32 89104 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20090605.040\NAVENG.SYS 2009-06-06 12:11 . 2009-06-01 06:32 876144 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20090605.040\NAVEX15.SYS 2009-06-06 12:11 . 2009-06-01 06:32 177520 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20090605.040\NAVENG32.DLL 2009-06-06 12:11 . 2009-06-01 06:32 1181040 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20090605.040\NAVEX32A.DLL 2009-06-06 12:11 . 2009-06-01 06:32 371248 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20090605.040\EECTRL.SYS 2009-06-06 12:11 . 2009-06-01 06:32 259368 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20090605.040\ECMSVR32.DLL 2009-06-06 12:11 . 2009-06-01 06:32 2414128 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20090605.040\CCERASER.DLL 2009-06-06 12:11 . 2009-06-01 06:32 101936 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20090605.040\ERASER.SYS 2009-06-01 12:31 . 2009-06-01 12:32 -------- d-----w- c:\program files\Norton Support 2009-06-01 12:31 . 2009-06-01 12:31 -------- d-----w- c:\documents and settings\Owner.LUPO\Local Settings\Application Data\Symantec 2009-05-29 18:18 . 2009-03-16 20:03 533880 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20090528.001\Scxpx86.dll 2009-05-29 18:18 . 2009-01-29 21:50 276344 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20090528.001\IDSXpx86.sys 2009-05-29 18:18 . 2009-01-29 21:50 292912 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20090528.001\IDSvix86.sys 2009-05-29 18:18 . 2009-01-29 21:50 447864 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20090528.001\IDSxpx86.dll 2009-05-29 18:18 . 2009-01-29 21:50 396848 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20090528.001\IDSviA64.sys 2009-05-19 22:31 . 2009-03-16 20:03 533880 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20090513.001\Scxpx86.dll 2009-05-19 22:31 . 2009-01-29 21:50 276344 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20090513.001\IDSXpx86.sys 2009-05-19 22:31 . 2009-01-29 21:50 447864 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20090513.001\IDSxpx86.dll 2009-05-19 22:31 . 2009-01-29 21:50 292912 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20090513.001\IDSvix86.sys 2009-05-19 22:31 . 2009-01-29 21:50 396848 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20090513.001\IDSviA64.sys . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-06-01 21:12 . 2008-12-10 16:50 -------- d-----w- c:\documents and settings\All Users\Application Data\WinZip 2009-06-01 05:47 . 2007-02-16 05:29 -------- d-----w- c:\documents and settings\Owner.LUPO\Application Data\uTorrent 2009-05-07 20:39 . 2007-08-01 20:55 -------- d-----w- c:\documents and settings\Owner.LUPO\Application Data\ComcastToolbar 2009-04-08 16:29 . 2008-06-10 14:39 3126 ----a-w- c:\documents and settings\All Users\Application Data\Intuit\QuickBooks 2008\qbbackup.sys 2009-04-05 01:31 . 2008-12-17 02:38 2592 ----a-w- c:\documents and settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat 2009-03-26 02:11 . 2009-04-23 20:58 65536 ----a-w- c:\documents and settings\Owner.LUPO\Application Data\Mozilla\Firefox\Profiles\8eib39ex.default\extensions\kodak-companion@mozilla.com\platform\WINNT_x86-msvc\components\mozFotofox.dll 2009-03-18 13:54 . 2009-01-29 03:10 60808 ----a-w- c:\windows\system32\S32EVNT1.DLL 2009-03-18 13:54 . 2009-01-29 03:10 124464 ----a-w- c:\windows\system32\drivers\SYMEVENT.SYS 2009-03-16 20:03 . 2009-03-16 20:03 533880 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\BinHub\Scxpx86.dll 2009-03-12 09:03 . 2009-01-29 03:10 36400 ----a-r- c:\windows\system32\drivers\SymIM.sys 2009-03-12 09:03 . 2009-01-29 03:10 554352 ----a-r- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\coFFPlgn\components\coFFPlgn.dll . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360] "MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Symantec PIF AlertEng"="c:\program files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2007-11-29 583048] "HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "MySpaceIM"="c:\program files\MySpace\IM\MySpaceIM.exe" [2007-03-07 5181440] c:\documents and settings\All Users\Start Menu\Programs\Startup\ HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2005-5-12 282624] HP Image Zone Fast Start.lnk - c:\program files\HP\Digital Imaging\bin\hpqthb08.exe [2005-5-12 73728] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "aux2"=wdmaud.sys [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SymEFA.sys] @="FSFilter Activity Monitor" [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk] path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^APC UPS Status.lnk] path=c:\documents and settings\All Users\Start Menu\Programs\Startup\APC UPS Status.lnk backup=c:\windows\pss\APC UPS Status.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^QuickBooks Update Agent.lnk] path=c:\documents and settings\All Users\Start Menu\Programs\Startup\QuickBooks Update Agent.lnk backup=c:\windows\pss\QuickBooks Update Agent.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusDisableNotify"=dword:00000001 "UpdatesDisableNotify"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"= "c:\\Program Files\\Messenger\\msmsgs.exe"= "c:\\Program Files\\Intuit\\QuickBooks 2006\\QBDBMgrN.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Documents and Settings\\Owner.LUPO\\Desktop\\entourage\\utorrent.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"= "c:\\Program Files\\iTunes\\iTunes.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"= "c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"= "c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"= R0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\NIS\1005000.087\SymEFA.sys [3/18/2009 9:54 AM 310320] R1 BHDrvx86;Symantec Heuristics Driver;c:\windows\system32\drivers\NIS\1005000.087\BHDrvx86.sys [3/18/2009 9:54 AM 258608] R1 ccHP;Symantec Hash Provider;c:\windows\system32\drivers\NIS\1005000.087\cchpx86.sys [3/18/2009 9:53 AM 482352] R1 IDSxpx86;IDSxpx86;c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20090528.001\IDSXpx86.sys [5/29/2009 2:18 PM 276344] R2 Norton Internet Security;Norton Internet Security;c:\program files\Norton Internet Security\Engine\16.5.0.135\ccSvcHst.exe [3/18/2009 9:53 AM 115560] R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [2/15/2007 2:41 PM 24652] R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2/25/2009 9:40 PM 101936] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}] "c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP . Contents of the 'Scheduled Tasks' folder 2009-06-06 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2006-10-10 22:13] 2006-10-04 c:\windows\Tasks\ISP signup reminder 3.job - c:\windows\system32\OOBE\oobebaln.exe [2006-06-17 00:12] . - - - - ORPHANS REMOVED - - - - SafeBoot-procexp90.Sys . ------- Supplementary Scan ------- . uStart Page = hxxp://www.comcast.net/comcast.html uInternet Settings,ProxyOverride = *.local IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 FF - ProfilePath - c:\documents and settings\Owner.LUPO\Application Data\Mozilla\Firefox\Profiles\8eib39ex.default\ FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q= FF - prefs.js: browser.startup.homepage - hxxp://www.comcast.net/home.html FF - component: c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\coFFPlgn\components\coFFPlgn.dll FF - component: c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\IPSFFPlgn\components\IPSFFPl.dll FF - component: c:\documents and settings\Owner.LUPO\Application Data\Mozilla\Firefox\Profiles\8eib39ex.default\extensions\kodak-companion@mozilla.com\platform\WINNT_x86-msvc\components\mozFotofox.dll FF - plugin: c:\documents and settings\Owner.LUPO\Application Data\Mozilla\Firefox\Profiles\8eib39ex.default\extensions\moveplayer@movenetworks.com\platform\WINNT_x86-msvc\plugins\npmnqmp07076007.dll FF - plugin: c:\program files\Java\jre1.5.0_02\bin\NPJava11.dll FF - plugin: c:\program files\Java\jre1.5.0_02\bin\NPJava12.dll FF - plugin: c:\program files\Java\jre1.5.0_02\bin\NPJava13.dll FF - plugin: c:\program files\Java\jre1.5.0_02\bin\NPJava14.dll FF - plugin: c:\program files\Java\jre1.5.0_02\bin\NPJava32.dll FF - plugin: c:\program files\Java\jre1.5.0_02\bin\NPJPI150_02.dll FF - plugin: c:\program files\Java\jre1.5.0_02\bin\NPOJI610.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\npunagi2.dll FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll FF - plugin: c:\program files\Virtual Earth 3D\npVE3D.dll . ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-06-06 09:23 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Norton Internet Security] "ImagePath"="\"c:\program files\Norton Internet Security\Engine\16.5.0.135\ccSvcHst.exe\" /s \"Norton Internet Security\" /m \"c:\program files\Norton Internet Security\Engine\16.5.0.135\diMaster.dll\" /prefetch:1" . Completion time: 2009-06-06 9:26 ComboFix-quarantined-files.txt 2009-06-06 13:26 Pre-Run: 161,890,213,888 bytes free Post-Run: 161,872,793,600 bytes free WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems] c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Windows XP Media Center Edition" /noexecute=optin /fastdetect /usepmtimer 187 --- E O F --- 2009-05-13 02:17 |
|
|
|
|
06-06-2009, 07:47 AM
|
#6 (permalink) |
|
Moderator, Analyst, Security Team; Rangemaster, TSF Academy
Join Date: Oct 2007
Location: Georgia
Posts: 10,688
OS: XP SP3
|
Re: Help please!
Hello, runaroundsue.
Please copy this page to Notepad and Save it to your Desktop in order to assist you when carrying out the following instructions. Before beginning the fix, read this post completely. If there's anything that you do not understand, kindly ask your questions before proceeding. Ensure that there aren't any opened browsers when you are carrying out the procedures below. It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence. ------------------------------------------------------ You are using an outdated version of HijackThis. Please uninstall HijackThis 1.99.1 in the Add or Remove Programs section of your Control Panel and delete your current version. ------------------------------------------------------ Please uninstall the following via Start->(or My Computer)->Control Panel->Add or Remove Programs if they still exist: Viewpoint Manager Viewpoint Media Player The above are considered foistware instead of malware since they are installed without users approval, but don't spy or do anything "bad". Please read here and here ------------------------------------------------------ I see you have P2P software ( uTorrent and Ares ) installed on your machine. We are not here to pass judgment on file-sharing as a concept. However, we will warn you that engaging in this activity and having this kind of software installed on your machine will always make you more susceptible to re-infections. It may be contributing to your current situation. This page will give you further information. Please note: Even if you are using a "safe" P2P program, it is only the program that is safe. You will be sharing files from uncertified sources, and these are often infected. The bad guys use P2P filesharing as a major conduit to spread their wares. References for the risk of these programs are here and here. I would strongly recommend that you uninstall them, however that choice is up to you. If you choose to remove these programs, you can do so via Control Panel >> Add or Remove Programs. ------------------------------------------------------ Open Notepad and copy/paste the entire contents of the codebox below into Notepad (don't forget to copy and paste REGEDIT4): Code:
REGEDIT4 [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusDisableNotify"=dword:00000000 "UpdatesDisableNotify"=dword:00000000 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring] "DisableMonitoring"=dword:00000000 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000000 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000000 It should look like this:  Double-click on fix.reg and choose Yes to merge/add it to the registry. Please delete the file afterwards. ------------------------------------------------------ Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update.
Please download ATF-Cleaner by Atribune and Save it to your Desktop.
For Technical Support, double-click the e-mail address located at the bottom of each menu. ------------------------------------------------------ Please run this online scan to help look for remnants. Establish an internet connection & perform an online scan at Kaspersky Online Scanner Ensure your external and/or USB drives are inserted during the scan. Click Accept, when prompted to download and install the program files and database of malware definitions.
 **Note** To optimize scanning time and produce a more sensible report for review:
------------------------------------------------------ |
|
|
|
|
06-07-2009, 03:20 PM
|
#7 (permalink) |
|
Registered User
Join Date: Jun 2009
Posts: 6
OS: Windows XP
|
Re: Help please!
Thanks for the help so far, here is the scan from Kasperskey, looks like there are still some issues to deal with.
KASPERSKY ONLINE SCANNER 7.0 REPORT Sunday, June 7, 2009 Operating System: Microsoft Windows XP Professional Service Pack 3 (build 2600) Kaspersky Online Scanner version: 7.0.26.13 Program database last update: Sunday, June 07, 2009 19:42:32 Records in database: 2322728 -------------------------------------------------------------------------------- Scan settings: Scan using the following database: extended Scan archives: yes Scan mail databases: yes Scan area - My Computer: C:\ D:\ E:\ F:\ G:\ H:\ I:\ J:\ K:\ Scan statistics: Files scanned: 97008 Threat name: 3 Infected objects: 3 Suspicious objects: 0 Duration of the scan: 01:59:54 File name / Threat name / Threats count C:\Qoobox\Quarantine\C\WINDOWS\system32\kungsfmylvmyqb.dll.vir Infected: Trojan.Win32.Small.bzc 1 C:\Qoobox\Quarantine\C\WINDOWS\system32\kungsfnqlrlxbe.dll.vir Infected: Trojan-Downloader.Win32.Agent.ceyj 1 D:\i386\Apps\App00577\comps\toolbar\toolbr.exe Infected: not-a-virus:AdWare.Win32.SearchIt.t 1 The selected area was scanned. |
|
|
|
|
06-07-2009, 04:20 PM
|
#8 (permalink) |
|
Moderator, Analyst, Security Team; Rangemaster, TSF Academy
Join Date: Oct 2007
Location: Georgia
Posts: 10,688
OS: XP SP3
|
Re: Help please!
Hello again, runaroundsue. QooBox is ComboFix's quarantine folder. Those two files are harmless now.
The toolbr.exe find by Kaspersky came factory installed on your recovery partition, so we will leave it be. ------------------------------------------------------ Congratulations. Well done! Your logs appear clean. You should be good to go. As far as those infected objects listed in the Kaspersky report, those are safely tucked away in ComboFix's quarantine folder or in old System Restore Points, which we will be taking care of now. Please disable Norton before uninstalling ComboFix and then re-enable it after doing so. Go to Start >> Run and Copy/Paste the following single-line command into the Run box and click OK: combofix /u This will uninstall ComboFix and delete ComboFix's quarantine folder. It will also implement some cleanup procedures, remove old System Restore Points which contain previous infections, and create a fresh, clean System Restore Point. Please re-enable your antivirus program and any other antispyware programs disabled earlier if you haven't already. You can safely delete any tools downloaded or any logs, files, and any shortcuts on your desktop that were created during this fix. ------------------------------------------------------ MICROSOFT UPDATES It is very important that you get all of the critical updates for your Operating System and Internet Explorer. Keeping your OS and browser up to date will help make you less susceptible to attacks by Trojans and viruses. Please go to Microsoft and download all the critical updates to help prevent possible re-infection. SPYWARE PREVENTION This is a good time to set up protection against further attacks. In light of your recent problem, I'm sure you'd like to avoid any future infections. Please read these well written articles:
Please respond to this thread one more time so we can mark this thread as resolved. |
|
|
|
| Thread Tools | |
|
|
