|
|
|
|
|||||
|
|
|
|
|
|
|||
| Welcome
to Tech Support Forum home to more then 136,000 problems solved. Issues
have included: Spyware, Malware, Virus Issues, Windows, Microsoft,
Linux, Networking, Security, Hardware, and Gaming Getting your
problem solved is as easy as: 1. Registering for a free account 2. Asking your question 3. Receiving an answer Registered members: * See fewer ads. * And much more..
|
| Want to know how to post a question? click here | Having problems with spyware and pop-ups? First Steps |
|
|||||||
| Resolved HJT Threads Resolved spyware and popup issues. |
|
|
LinkBack | Thread Tools |
06-23-2009, 10:57 PM
|
#1 (permalink) |
|
Registered User
Join Date: Jun 2009
Posts: 4
OS: xp media edition 2005
|
suspected trojan sucking all my comp's memory.
Whenever I reboot I get a messege that says windows cannot find c:windows/config/lsass.exe. I've run antivirus programs but no luck. I'm dont really understand how this works, but here goes.
DDS (Ver_09-05-14.01) - NTFSx86 Run by Me at 13:43:52.65 on Sat 06/20/2009 Internet Explorer: 7.0.5730.11 Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.2046.1486 [GMT -7:00] ============== Running Processes =============== C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost -k DcomLaunch svchost.exe C:\WINDOWS\System32\svchost.exe -k netsvcs C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup svchost.exe svchost.exe C:\WINDOWS\System32\WLTRYSVC.EXE C:\WINDOWS\System32\bcmwltry.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.exe C:\WINDOWS\ehome\ehtray.exe C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\WINDOWS\stsystra.exe C:\Program Files\Dell\QuickSet\quickset.exe C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe C:\Program Files\Dell AIO 810\dlcgmon.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\WINDOWS\system32\WLTRAY.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Windows Live\Messenger\msnmsgr.exe C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe svchost.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\WINDOWS\eHome\ehRecvr.exe C:\WINDOWS\eHome\ehSched.exe C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe C:\WINDOWS\ehome\RMSvc.exe svchost.exe C:\WINDOWS\system32\svchost.exe -k imgsvc C:\WINDOWS\system32\dlcgcoms.exe C:\WINDOWS\system32\dllhost.exe C:\WINDOWS\eHome\ehmsas.exe C:\Documents and Settings\Me\Desktop\dds.scr ============== Pseudo HJT Report =============== uStart Page = hxxp://login.live.com/login.srf?wa=wsignin1.0&rpsnv=10&ct=1203105751&rver=4.5.2130.0&wp=MBI&wreply=http:%2F%2Fmail.live.com%2Fdefault.aspx&id=64855 uSearch Page = uSearch Bar = uDefault_Page_URL = http://www.google.ca/ig/dell?hl=en&c...row&channel=ca uInternet Connection Wizard,ShellNext = iexplore mSearchAssistant = mWinlogon: Shell=Explorer.exe c:\windows\config\lsass.exe BHO: AcroIEHlprObj Class: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 6.0\reader\activex\AcroIEHelper.dll BHO: SSVHelper Class: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre1.6.0_07\bin\ssv.dll BHO: {7E853D72-626A-48EC-A868-BA8D5E23E045} - No File BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar.dll BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.1.1309.3572\swg.dll BHO: Google Dictionary Compression sdch: {c84d72fe-e17d-4195-bb24-76c02e2e7c4e} - c:\program files\google\google toolbar\component\fastsearch_A8904FB862BD9564.dll BHO: &Research: {d263fa6d-84cc-48a8-9af6-c664362b7a5b} - c:\windows\system32\winconfig.dll TB: {0BF43445-2F28-4351-9252-17FE6E806AA0} - No File TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar.dll EB: Real.com: {fe54fa40-d68c-11d2-98fa-00c0f0318afe} - c:\windows\system32\Shdocvw.dll uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe uRun: [msnmsgr] "c:\program files\windows live\messenger\msnmsgr.exe" /background uRun: [SpybotSD TeaTimer] c:\program files\spybot - search & destroy\TeaTimer.exe mRun: [ehTray] c:\windows\ehome\ehtray.exe mRun: [SunJavaUpdateSched] "c:\program files\java\jre1.6.0_07\bin\jusched.exe" mRun: [SynTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe mRun: [SigmatelSysTrayApp] stsystra.exe mRun: [Dell QuickSet] c:\program files\dell\quickset\quickset.exe mRun: [DVDLauncher] "c:\program files\cyberlink\powerdvd\DVDLauncher.exe" mRun: [ISUSPM Startup] "c:\program files\common files\installshield\updateservice\isuspm.exe" -startup mRun: [ISUSScheduler] "c:\program files\common files\installshield\updateservice\issch.exe" -start mRun: [DLCGCATS] rundll32 c:\windows\system32\spool\drivers\w32x86\3\DLCGtime.dll,_RunDLLEntry@16 mRun: [dlcgmon.exe] "c:\program files\dell aio 810\dlcgmon.exe" mRun: [TkBellExe] "c:\program files\common files\real\update_ob\realsched.exe" -osboot mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime mRun: [Broadcom Wireless Manager UI] c:\windows\system32\WLTRAY.exe IE: &Search - ?p=ZUzeb004YYCA_ZZzer000 IE: {B4B52284-A248-4c51-9F7C-F0A0C67FCC9D} - c:\program files\partygaming\partycasino\RunApp.exe IE: {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - c:\program files\partygaming\partypoker\RunApp.exe IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBC} - c:\program files\java\jre1.6.0_07\bin\ssv.dll IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - {FE54FA40-D68C-11d2-98FA-00C0F0318AFE} - c:\windows\system32\Shdocvw.dll Trusted Zone: internet Trusted Zone: mcafee.com DPF: {0713E8D2-850A-101B-AFC0-4210102A8DA7} - hxxp://download.mcafee.com/molbin/Shared/ComCtl32/6,0,80,22/ComCtl32.cab DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} - hxxp://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} - hxxp://by127fd.bay127.hotmail.msn.com/resources/MsnPUpld.cab DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} - hxxp://upload.facebook.com/controls/FacebookPhotoUploader.cab DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab DPF: {CAFEEFAC-0015-0000-0008-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_08-windows-i586.cab DPF: {CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_10-windows-i586.cab DPF: {CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_11-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - c:\program files\google\google toolbar\component\fastsearch_A8904FB862BD9564.dll Handler: siteadvisor - {3A5DC592-7723-4EAA-9EE6-AF4222BCF879} - Notify: AtiExtEvent - Ati2evxx.dll SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll ============= SERVICES / DRIVERS =============== R2 McrdSvc;Media Center Extender Service;c:\windows\ehome\McrdSvc.exe [2005-10-20 96256] =============== Created Last 30 ================ 2009-06-20 00:50 <DIR> --d----- c:\program files\Spybot - Search & Destroy 2009-06-20 00:50 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Spybot - Search & Destroy 2009-06-18 18:54 <DIR> -cd-h--- c:\docume~1\alluse~1\applic~1\{92E7A367-8E12-4830-AA70-29C32E331A81} 2009-06-18 18:50 119,296 a------- c:\windows\system32\dllcache\camext30.dll 2009-06-18 18:49 37,568 a------- c:\windows\system32\dllcache\avmwan.sys 2009-06-18 18:48 56,623 a------- c:\windows\system32\dllcache\ati1btxx.sys 2009-06-18 18:47 7,168 a------- c:\windows\system32\dllcache\wamregps.dll 2009-06-16 16:44 667,648 a------- c:\windows\system32\BCMLogon.dll 2009-06-16 16:44 1,200,128 a------- c:\windows\system32\BCMWLTRY.EXE 2009-06-16 16:44 253,952 a------- c:\windows\system32\bcmwlu00.exe 2009-06-16 16:44 69,632 a------- c:\windows\system32\bcmwlpkt.dll 2009-06-16 16:44 33,664 a------- c:\windows\system32\drivers\BCMWLNPF.SYS 2009-06-16 16:43 3,096,576 a------- c:\windows\system32\BCMWLCPL.CPL 2009-06-16 16:43 2,129,920 a------- c:\windows\system32\WLBCGCBPRO731.DLL 2009-06-16 16:43 1,347,584 a------- c:\windows\system32\WLTRAY.EXE 2009-06-16 16:43 757,760 a------- c:\windows\system32\bcm1xsup.dll 2009-06-16 16:43 86,016 a------- c:\windows\system32\preflib.dll 2009-06-16 16:43 44,032 a------- c:\windows\system32\wltrynt.dll 2009-06-16 16:43 18,944 a------- c:\windows\system32\WLTRYSVC.EXE 2009-06-14 20:37 54,156 a---h--- c:\windows\QTFont.qfn 2009-06-14 20:37 1,409 a------- c:\windows\QTFont.for ==================== Find3M ==================== 2009-05-07 08:44 344,064 a------- c:\windows\system32\localspl.dll 2009-05-07 08:44 344,064 -------- c:\windows\system32\dllcache\localspl.dll 2009-04-28 21:56 827,392 a------- c:\windows\system32\wininet.dll 2009-04-28 21:56 827,392 a------- c:\windows\system32\dllcache\wininet.dll 2009-04-28 21:56 233,472 -------- c:\windows\system32\dllcache\webcheck.dll 2009-04-28 21:56 1,159,680 a------- c:\windows\system32\dllcache\urlmon.dll 2009-04-28 21:56 671,232 a------- c:\windows\system32\dllcache\mstime.dll 2009-04-28 21:56 105,984 a------- c:\windows\system32\dllcache\url.dll 2009-04-28 21:56 44,544 a------- c:\windows\system32\dllcache\pngfilt.dll 2009-04-28 21:56 102,912 -------- c:\windows\system32\dllcache\occache.dll 2009-04-28 21:56 3,596,288 a------- c:\windows\system32\dllcache\mshtml.dll 2009-04-28 21:56 477,696 a------- c:\windows\system32\dllcache\mshtmled.dll 2009-04-28 21:56 193,024 a------- c:\windows\system32\dllcache\msrating.dll 2009-04-28 02:05 70,656 -------- c:\windows\system32\dllcache\ie4uinit.exe 2009-04-28 02:05 13,824 -------- c:\windows\system32\dllcache\ieudinit.exe 2009-04-24 22:27 636,088 -------- c:\windows\system32\dllcache\iexplore.exe 2009-04-24 22:26 161,792 -------- c:\windows\system32\dllcache\ieakui.dll 2009-04-19 23:23 5,486 a--sh--- c:\windows\system32\KGyGaAvL.sys 2009-04-17 02:58 1,846,656 a------- c:\windows\system32\win32k.sys 2009-04-17 02:58 1,846,656 -------- c:\windows\system32\dllcache\win32k.sys 2009-04-15 08:26 583,168 a------- c:\windows\system32\rpcrt4.dll 2009-04-15 08:26 583,168 -------- c:\windows\system32\dllcache\rpcrt4.dll 2007-09-23 00:13 774,144 a------- c:\program files\RngInterstitial.dll 2006-12-05 21:33 251 a------- c:\program files\wt3d.ini 2006-12-17 12:50 88 ---shr-- c:\windows\system32\7327E16C99.sys ============= FINISH: 13:44:16.67 =============== |
|
     |
| Important Information |
|
Join the #1 Tech Support Forum Today - It's Totally Free!
TechSupportForum.com is a leading support website for your computer needs. We offer free, friendly and personalized computer support. Why pay to have your computer fixed when you can do it for free. Join TechSupportforum.com Today - Click Here |
|
06-25-2009, 06:21 AM
|
#2 (permalink) |
|
Moderator, Analyst, Security Team
Join Date: Oct 2006
Location: Důn Čideann,Scotland.
Posts: 5,093
OS: XP
|
Re: suspected trojan sucking all my comp's memory.
Hello and welcome to TSF
Please subscribe to this thread to get immediate notification of replies as soon as they are posted. To do this click Thread Tools, then click Subscribe to this Thread. Make sure it is set to Instant Notification, then click Subscribe. ======== Please follow all instructions and in which order they come, if you have any questions, please ask before proceeding. Its important that you follow this through until i give you the all clear. Please DO NOT Attach logs to your posts unless you are advised to do so. ========= S& D Spybot's Tea Timer While TeaTimer is an excellent tool for the prevention of spyware, it can sometimes prevents our tools from fixing certain things. Please disable TeaTimer for now until you are clean. TeaTimer can be re-activated once your logs are clean.
========== Download ComboFix from one of these locations: Link 1 Link 2 Link 3 * IMPORTANT !!! Place combofix.exe on your Desktop Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with ComboFix. Double click on combofix.exe & follow the prompts. As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.  The Windows recovery console will allow you to boot up into a special recovery mode that allows us to help you in the case that your computer has a problem after an attempted removal of malware. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement. ComboFix will now automatically install the Microsoft Windows Recovery Console onto your computer, which will show up as a new option when booting up your computer. Do not select the Microsoft Windows Recovery Console option when you start your computer unless requested to by a helper. Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see a message that says: The Recovery Console was successfully installed.  Click on Yes, to continue scanning for malware. Your desktop may go blank. This is normal. It will return when ComboFix is done. ComboFix may reboot your machine. This is normal. When finished, it shall produce a log for you. Post that log in your next reply Note: Do not mouseclick combofix's window whilst it's running. That may cause it to stall. Please note that the forum is very busy and if I don't hear from you within three days this thread will be closed. Last edited by TheBruce1; 06-25-2009 at 06:41 AM. |
|
|
|
|
06-25-2009, 06:35 PM
|
#3 (permalink) |
|
Registered User
Join Date: Jun 2009
Posts: 4
OS: xp media edition 2005
|
Re: suspected trojan sucking all my comp's memory.
ComboFix 09-06-25.01 - Me 06/25/2009 17:17.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.2046.1582 [GMT -7:00] Running from: c:\documents and settings\Me\Desktop\ComboFix.exe . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\documents and settings\Me\Start Menu\A360 c:\documents and settings\Me\Start Menu\A360\A360.lnk c:\documents and settings\Me\Start Menu\A360\Help.lnk c:\documents and settings\Me\Start Menu\A360\Registration.lnk c:\program files\Common Files\System\Uninstall c:\program files\Common Files\System\Uninstall\Uninstall A360.lnk c:\program files\IEToolbar c:\program files\IEToolbar\Ant.com Toolbar\ant.dll c:\program files\IEToolbar\Ant.com Toolbar\AntPlugin.dll c:\windows\kb913800.exe . ((((((((((((((((((((((((( Files Created from 2009-05-26 to 2009-06-26 ))))))))))))))))))))))))))))))) . 2009-06-20 07:50 . 2009-06-20 08:49 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy 2009-06-20 07:50 . 2009-06-20 08:19 -------- d-----w- c:\program files\Spybot - Search & Destroy 2009-06-19 01:54 . 2009-06-19 01:54 -------- dc-h--w- c:\documents and settings\All Users\Application Data\{92E7A367-8E12-4830-AA70-29C32E331A81} 2009-06-19 01:50 . 2001-08-18 05:36 119296 ----a-w- c:\windows\system32\dllcache\camext30.dll 2009-06-19 01:49 . 2001-08-17 19:13 37568 ----a-w- c:\windows\system32\dllcache\avmwan.sys 2009-06-19 01:48 . 2004-08-04 05:29 56623 ----a-w- c:\windows\system32\dllcache\ati1btxx.sys 2009-06-19 01:47 . 2004-08-10 10:00 7168 ----a-w- c:\windows\system32\dllcache\wamregps.dll 2009-06-16 23:44 . 2005-12-19 16:08 667648 ----a-w- c:\windows\system32\BCMLogon.dll 2009-06-16 23:44 . 2005-12-19 16:08 69632 ----a-w- c:\windows\system32\bcmwlpkt.dll 2009-06-16 23:44 . 2005-12-19 16:08 33664 ----a-w- c:\windows\system32\drivers\BCMWLNPF.SYS 2009-06-16 23:44 . 2005-12-19 16:08 253952 ----a-w- c:\windows\system32\bcmwlu00.exe 2009-06-16 23:44 . 2005-12-19 16:08 1200128 ----a-w- c:\windows\system32\BCMWLTRY.EXE 2009-06-16 23:43 . 2005-12-19 16:08 86016 ----a-w- c:\windows\system32\preflib.dll 2009-06-16 23:43 . 2005-12-19 16:08 44032 ----a-w- c:\windows\system32\wltrynt.dll 2009-06-16 23:43 . 2005-12-19 16:08 2129920 ----a-w- c:\windows\system32\WLBCGCBPRO731.DLL 2009-06-16 23:43 . 2005-12-19 16:08 18944 ----a-w- c:\windows\system32\WLTRYSVC.EXE 2009-06-16 23:43 . 2005-12-19 16:08 1347584 ----a-w- c:\windows\system32\WLTRAY.EXE 2009-06-16 23:43 . 2005-12-19 16:08 757760 ----a-w- c:\windows\system32\bcm1xsup.dll . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-06-25 06:25 . 2009-01-14 08:44 -------- d-----w- c:\documents and settings\All Users\Application Data\Google Updater 2009-06-24 05:56 . 2007-04-13 20:35 -------- d-----w- c:\documents and settings\Me\Application Data\dvdcss 2009-06-20 19:35 . 2006-08-23 20:03 -------- d-----w- c:\documents and settings\Me\Application Data\ATI 2009-06-20 19:35 . 2006-08-17 22:08 -------- d-----w- c:\documents and settings\Administrator\Application Data\ATI 2009-06-20 19:34 . 2008-09-26 07:39 -------- d-----w- c:\program files\Common Files\ATI Technologies 2009-06-20 19:32 . 2006-08-17 21:51 -------- d--h--w- c:\program files\InstallShield Installation Information 2009-06-20 19:29 . 2006-11-15 23:12 -------- d-----w- c:\program files\BitComet 2009-06-20 19:06 . 2007-09-29 16:56 664 ----a-w- c:\windows\system32\d3d9caps.dat 2009-06-16 23:44 . 2006-08-17 21:55 -------- d-----w- c:\program files\Dell 2009-06-02 05:15 . 2008-09-26 07:42 -------- d-----w- c:\documents and settings\All Users\Application Data\Cyberlink 2009-05-29 04:32 . 2006-08-23 20:06 -------- d-----w- c:\program files\Dl_cats 2009-05-07 15:44 . 2005-08-16 09:18 344064 ----a-w- c:\windows\system32\localspl.dll 2009-04-29 04:56 . 2005-08-16 09:18 827392 ----a-w- c:\windows\system32\wininet.dll 2009-04-29 04:55 . 2005-08-16 09:18 78336 ----a-w- c:\windows\system32\ieencode.dll 2009-04-20 06:23 . 2006-09-21 00:23 56 --sh--r- c:\windows\system32\996CE12773.sys 2009-04-20 06:23 . 2006-08-24 04:51 5486 --sha-w- c:\windows\system32\KGyGaAvL.sys 2009-04-17 09:58 . 2005-08-16 09:18 1846656 ----a-w- c:\windows\system32\win32k.sys 2009-04-15 15:26 . 2005-08-16 09:18 583168 ----a-w- c:\windows\system32\rpcrt4.dll 2007-09-23 07:13 . 2007-09-23 07:15 774144 ----a-w- c:\program files\RngInterstitial.dll 2006-12-06 04:33 . 2006-12-06 04:33 251 ----a-w- c:\program files\wt3d.ini 2006-12-17 19:50 . 2006-08-24 04:51 88 --sh--r- c:\windows\system32\7327E16C99.sys . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-10 15360] "msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 5724184] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ehTray"="c:\windows\ehome\ehtray.exe" [2005-09-29 67584] "SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784] "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-03-08 761947] "Dell QuickSet"="c:\program files\Dell\QuickSet\quickset.exe" [2006-04-06 1032192] "DVDLauncher"="c:\program files\CyberLink\PowerDVD\DVDLauncher.exe" [2005-12-10 49152] "ISUSPM Startup"="c:\program files\Common Files\InstallShield\UpdateService\isuspm.exe" [2005-06-10 249856] "ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2005-06-10 81920] "DLCGCATS"="c:\windows\System32\spool\DRIVERS\W32X86\3\DLCGtime.dll" [2005-09-08 73728] "dlcgmon.exe"="c:\program files\Dell AIO 810\dlcgmon.exe" [2005-10-21 425984] "TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-08-07 185896] "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-03-29 413696] "Broadcom Wireless Manager UI"="c:\windows\system32\WLTRAY.exe" [2005-12-19 1347584] "SigmatelSysTrayApp"="stsystra.exe" - c:\windows\stsystra.exe [2006-03-24 282624] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS] @="" [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^AOL 9.0 Tray Icon.lnk] path=c:\documents and settings\All Users\Start Menu\Programs\Startup\AOL 9.0 Tray Icon.lnk backup=c:\windows\pss\AOL 9.0 Tray Icon.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Extender Resource Monitor.lnk] path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Extender Resource Monitor.lnk backup=c:\windows\pss\Extender Resource Monitor.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusDisableNotify"=dword:00000001 "UpdatesDisableNotify"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\Messenger\\msmsgs.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\iTunes\\iTunes.exe"= "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"= "c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "22516:TCP"= 22516:TCP:BitComet 22516 TCP "22516:UDP"= 22516:UDP:BitComet 22516 UDP "3776:UDP"= 3776:UDP:Media Center Extender Service "3390:TCP"= 3390:TCP:Remote Media Center Experience [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] QWAVE REG_MULTI_SZ QWAVE [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{4D494B45-4D49-4D49-4D49-4D494B454D49}] "c:\windows\Cursors\lsass.exe" /s . Contents of the 'Scheduled Tasks' folder 2009-06-18 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 21:57] 2009-06-25 c:\windows\Tasks\Google Software Updater.job - c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2007-04-19 02:55] . . ------- Supplementary Scan ------- . uStart Page = hxxp://login.live.com/login.srf?wa=wsignin1.0&rpsnv=10&ct=1203105751&rver=4.5.2130.0&wp=MBI&wreply=http:%2F%2Fmail.live.com%2Fdefault.aspx&id=64855 uInternet Connection Wizard,ShellNext = iexplore IE: &Search - ?p=ZUzeb004YYCA_ZZzer000 IE: {{B4B52284-A248-4c51-9F7C-F0A0C67FCC9D} - c:\program files\PartyGaming\PartyCasino\RunApp.exe Trusted Zone: internet Trusted Zone: mcafee.com . ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-06-25 17:21 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... HKLM\Software\Microsoft\Windows\CurrentVersion\Run DLCGCATS = rundll32 c:\windows\System32\spool\DRIVERS\W32X86\3\DLCGtime.dll,_RunDLLEntry@16??????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????? scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . --------------------- LOCKED REGISTRY KEYS --------------------- [HKEY_USERS\S-1-5-21-1598283739-452893982-683752979-1005\Software\Microsoft\SystemCertificates\AddressBook*] @Allowed: (Read) (RestrictedCode) @Allowed: (Read) (RestrictedCode) . --------------------- DLLs Loaded Under Running Processes --------------------- - - - - - - - > 'winlogon.exe'(888) c:\windows\system32\Ati2evxx.dll c:\windows\System32\BCMLogon.dll . Completion time: 2009-06-26 17:23 ComboFix-quarantined-files.txt 2009-06-26 00:23 Pre-Run: 39,105,552,384 bytes free Post-Run: 39,870,218,240 bytes free 155 --- E O F --- 2009-06-19 01:54 |
|
|
|
|
06-26-2009, 05:16 AM
|
#4 (permalink) |
|
Moderator, Analyst, Security Team
Join Date: Oct 2006
Location: Důn Čideann,Scotland.
Posts: 5,093
OS: XP
|
Re: suspected trojan sucking all my comp's memory.
Hello again
Please follow all instructions and in which order they come, if you have any questions, please ask before proceeding. Its important that you follow this through until i give you the all clear. Can you tell me why you have no antivirus protection installed? Do not install one just yet, we will during the course of this fix. Keep the computer off the internet as much as possible, you really should not be on the internet without protection installed. ======= Click > Start > Control Panel > Add or Remove Programs and uninstall the following programs: Viewpoint Media Player<---Viewpoint is considered as foistware instead of malware since it is installed without users approval but doesn't spy or do anything "bad". This will change from what we know in 2006 read this article: http://www.clickz.com/news/article.php/3561546 Additional Information Here ========= Open notepad and copy/paste the text in the quotebox below into it: Code:
Folder::
c:\documents and settings\All Users\Application Data\{92E7A367-8E12-4830-AA70-29C32E331A81}
c:\program files\BitComet
File::
c:\windows\system32\996CE12773.sys
c:\windows\system32\7327E16C99.sys
Registry::
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000000
"UpdatesDisableNotify"=dword:00000000
[-HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{4D494B45-4D49-4D49-4D49-4D494B454D49}]
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"22516:TCP"=-
"22516:UDP"=-
DDS::
uInternet Connection Wizard,ShellNext = iexplore
IE: &Search - ?p=ZUzeb004YYCA_ZZzer000
Trusted Zone: internet
Trusted Zone: mcafee.com
 Refering to the picture above, drag CFscript into ComboFix.exe Follow the prompts, and post the resulting log, C:\ComboFix.txt Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system. Warning: Do not mouseclick combofix's window whilst it's running. That may cause it to stall ========== I see no evidence of an AntiVirus program on your system. This must be resolved. Go Here and follow instruction to download, install and run a scan, post the log from that scan in your reply. You can choose an antivirus of your own if you wish. =========== JAVA OUTDATED Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update.
========= Download ATF-Cleaner by Atribune to your desktop. Double-click ATF Cleaner.exe to open it Under Main choose: Windows Temp Current User Temp All Users Temp Cookies Temporary Internet Files Prefetch Java Cache *The other boxes are optional* Then click the Empty Selected button. If you have Firefox installed: Click Firefox at the top and choose: Select All Click the Empty Selected button. NOTE: If you would like to keep your saved passwords, please click NO at the prompt. If you have Opera installed: Click Opera at the top and choose: Select All Click the Empty Selected button. NOTE: If you would like to keep your saved passwords, please click NO at the prompt. Click Exit on the Main menu to close the program. ========= Logs Required C:\Combofix.txt Avira Scan Report An update on how your system is running. |
|
|
|
|
06-27-2009, 06:51 PM
|
#5 (permalink) |
|
Registered User
Join Date: Jun 2009
Posts: 4
OS: xp media edition 2005
|
Re: suspected trojan sucking all my comp's memory.
ComboFix 09-06-26.02 - Me 06/26/2009 23:16.3 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.2046.1469 [GMT -7:00] Running from: c:\documents and settings\Me\Desktop\ComboFix.exe Command switches used :: c:\documents and settings\Me\Desktop\CFScript.txt FILE :: "c:\windows\system32\7327E16C99.sys" "c:\windows\system32\996CE12773.sys" . ((((((((((((((((((((((((( Files Created from 2009-05-27 to 2009-06-27 ))))))))))))))))))))))))))))))) . 2009-06-20 07:50 . 2009-06-20 08:49 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy 2009-06-20 07:50 . 2009-06-20 08:19 -------- d-----w- c:\program files\Spybot - Search & Destroy 2009-06-19 01:50 . 2001-08-18 05:36 119296 ----a-w- c:\windows\system32\dllcache\camext30.dll 2009-06-19 01:49 . 2001-08-17 19:13 37568 ----a-w- c:\windows\system32\dllcache\avmwan.sys 2009-06-19 01:48 . 2004-08-04 05:29 56623 ----a-w- c:\windows\system32\dllcache\ati1btxx.sys 2009-06-19 01:47 . 2004-08-10 10:00 7168 ----a-w- c:\windows\system32\dllcache\wamregps.dll 2009-06-16 23:44 . 2005-12-19 16:08 667648 ----a-w- c:\windows\system32\BCMLogon.dll 2009-06-16 23:44 . 2005-12-19 16:08 69632 ----a-w- c:\windows\system32\bcmwlpkt.dll 2009-06-16 23:44 . 2005-12-19 16:08 33664 ----a-w- c:\windows\system32\drivers\BCMWLNPF.SYS 2009-06-16 23:44 . 2005-12-19 16:08 253952 ----a-w- c:\windows\system32\bcmwlu00.exe 2009-06-16 23:44 . 2005-12-19 16:08 1200128 ----a-w- c:\windows\system32\BCMWLTRY.EXE 2009-06-16 23:43 . 2005-12-19 16:08 86016 ----a-w- c:\windows\system32\preflib.dll 2009-06-16 23:43 . 2005-12-19 16:08 44032 ----a-w- c:\windows\system32\wltrynt.dll 2009-06-16 23:43 . 2005-12-19 16:08 2129920 ----a-w- c:\windows\system32\WLBCGCBPRO731.DLL 2009-06-16 23:43 . 2005-12-19 16:08 18944 ----a-w- c:\windows\system32\WLTRYSVC.EXE 2009-06-16 23:43 . 2005-12-19 16:08 1347584 ----a-w- c:\windows\system32\WLTRAY.EXE 2009-06-16 23:43 . 2005-12-19 16:08 757760 ----a-w- c:\windows\system32\bcm1xsup.dll . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-06-26 12:46 . 2009-01-14 08:44 -------- d-----w- c:\documents and settings\All Users\Application Data\Google Updater 2009-06-24 05:56 . 2007-04-13 20:35 -------- d-----w- c:\documents and settings\Me\Application Data\dvdcss 2009-06-20 19:35 . 2006-08-23 20:03 -------- d-----w- c:\documents and settings\Me\Application Data\ATI 2009-06-20 19:35 . 2006-08-17 22:08 -------- d-----w- c:\documents and settings\Administrator\Application Data\ATI 2009-06-20 19:34 . 2008-09-26 07:39 -------- d-----w- c:\program files\Common Files\ATI Technologies 2009-06-20 19:32 . 2006-08-17 21:51 -------- d--h--w- c:\program files\InstallShield Installation Information 2009-06-20 19:06 . 2007-09-29 16:56 664 ----a-w- c:\windows\system32\d3d9caps.dat 2009-06-16 23:44 . 2006-08-17 21:55 -------- d-----w- c:\program files\Dell 2009-06-02 05:15 . 2008-09-26 07:42 -------- d-----w- c:\documents and settings\All Users\Application Data\Cyberlink 2009-05-29 04:32 . 2006-08-23 20:06 -------- d-----w- c:\program files\Dl_cats 2009-05-07 15:44 . 2005-08-16 09:18 344064 ----a-w- c:\windows\system32\localspl.dll 2009-04-29 04:56 . 2005-08-16 09:18 827392 ----a-w- c:\windows\system32\wininet.dll 2009-04-29 04:55 . 2005-08-16 09:18 78336 ----a-w- c:\windows\system32\ieencode.dll 2009-04-20 06:23 . 2006-08-24 04:51 5486 --sha-w- c:\windows\system32\KGyGaAvL.sys 2009-04-17 09:58 . 2005-08-16 09:18 1846656 ----a-w- c:\windows\system32\win32k.sys 2009-04-15 15:26 . 2005-08-16 09:18 583168 ----a-w- c:\windows\system32\rpcrt4.dll 2007-09-23 07:13 . 2007-09-23 07:15 774144 ----a-w- c:\program files\RngInterstitial.dll 2006-12-06 04:33 . 2006-12-06 04:33 251 ----a-w- c:\program files\wt3d.ini . ((((((((((((((((((((((((((((( SnapShot@2009-06-26_00.21.49 ))))))))))))))))))))))))))))))))))))))))) . + 2009-06-26 00:22 . 2008-10-16 21:09 51224 c:\windows\system32\dllcache\cache\wuauclt.exe + 2009-06-26 00:22 . 2004-08-10 10:00 82944 c:\windows\system32\dllcache\cache\ws2_32.dll + 2009-06-26 00:22 . 2004-08-10 10:00 24576 c:\windows\system32\dllcache\cache\userinit.exe + 2009-06-26 00:22 . 2004-08-10 10:00 14336 c:\windows\system32\dllcache\cache\svchost.exe + 2009-06-26 00:22 . 2005-06-10 23:53 57856 c:\windows\system32\dllcache\cache\spoolsv.exe + 2009-06-26 00:22 . 2004-08-10 10:00 17408 c:\windows\system32\dllcache\cache\powrprof.dll + 2009-06-26 00:22 . 2004-08-10 10:00 13312 c:\windows\system32\dllcache\cache\lsass.exe + 2009-06-26 00:22 . 2004-08-04 03:58 24576 c:\windows\system32\dllcache\cache\kbdclass.sys + 2009-06-26 00:22 . 2004-08-10 10:00 29056 c:\windows\system32\dllcache\cache\ip6fw.sys + 2009-06-26 00:22 . 2004-08-10 10:00 15360 c:\windows\system32\dllcache\cache\ctfmon.exe + 2009-06-26 00:22 . 2004-08-10 10:00 502272 c:\windows\system32\dllcache\cache\winlogon.exe + 2009-06-26 00:22 . 2009-04-29 04:56 827392 c:\windows\system32\dllcache\cache\wininet.dll + 2009-06-26 00:22 . 2007-03-08 15:36 577536 c:\windows\system32\dllcache\cache\user32.dll + 2009-06-26 00:22 . 2005-03-10 00:49 295424 c:\windows\system32\dllcache\cache\termsrv.dll + 2009-06-26 00:22 . 2008-06-20 10:45 360320 c:\windows\system32\dllcache\cache\tcpip.sys + 2009-06-26 00:22 . 2009-02-06 10:22 110592 c:\windows\system32\dllcache\cache\services.exe + 2009-06-26 00:22 . 2004-08-10 10:00 182912 c:\windows\system32\dllcache\cache\ndis.sys + 2009-06-26 00:22 . 2009-03-21 14:18 986112 c:\windows\system32\dllcache\cache\kernel32.dll + 2009-06-26 00:22 . 2004-08-10 10:00 110080 c:\windows\system32\dllcache\cache\imm32.dll + 2009-06-26 00:22 . 2004-08-10 10:00 167936 c:\windows\system32\dllcache\cache\appmgmts.dll + 2009-06-26 00:22 . 2004-08-10 10:00 1580544 c:\windows\system32\dllcache\cache\sfcfiles.dll + 2009-06-26 00:22 . 2009-02-06 10:29 2142720 c:\windows\system32\dllcache\cache\ntoskrnl.exe + 2009-06-26 00:22 . 2009-02-06 09:49 2020864 c:\windows\system32\dllcache\cache\ntkrnlpa.exe + 2009-06-26 00:22 . 2007-06-13 10:23 1033216 c:\windows\system32\dllcache\cache\explorer.exe . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-10 15360] "msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 5724184] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ehTray"="c:\windows\ehome\ehtray.exe" [2005-09-29 67584] "SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784] "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-03-08 761947] "Dell QuickSet"="c:\program files\Dell\QuickSet\quickset.exe" [2006-04-06 1032192] "DVDLauncher"="c:\program files\CyberLink\PowerDVD\DVDLauncher.exe" [2005-12-10 49152] "ISUSPM Startup"="c:\program files\Common Files\InstallShield\UpdateService\isuspm.exe" [2005-06-10 249856] "ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2005-06-10 81920] "DLCGCATS"="c:\windows\System32\spool\DRIVERS\W32X86\3\DLCGtime.dll" [2005-09-08 73728] "dlcgmon.exe"="c:\program files\Dell AIO 810\dlcgmon.exe" [2005-10-21 425984] "TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-08-07 185896] "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-03-29 413696] "Broadcom Wireless Manager UI"="c:\windows\system32\WLTRAY.exe" [2005-12-19 1347584] "SigmatelSysTrayApp"="stsystra.exe" - c:\windows\stsystra.exe [2006-03-24 282624] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS] @="" [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^AOL 9.0 Tray Icon.lnk] path=c:\documents and settings\All Users\Start Menu\Programs\Startup\AOL 9.0 Tray Icon.lnk backup=c:\windows\pss\AOL 9.0 Tray Icon.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Extender Resource Monitor.lnk] path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Extender Resource Monitor.lnk backup=c:\windows\pss\Extender Resource Monitor.lnkCommon Startup [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\Messenger\\msmsgs.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\iTunes\\iTunes.exe"= "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"= "c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "3776:UDP"= 3776:UDP:Media Center Extender Service "3390:TCP"= 3390:TCP:Remote Media Center Experience [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] QWAVE REG_MULTI_SZ QWAVE . Contents of the 'Scheduled Tasks' folder 2009-06-18 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 21:57] 2009-06-27 c:\windows\Tasks\Google Software Updater.job - c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2007-04-19 02:55] . . ------- Supplementary Scan ------- . uStart Page = hxxp://login.live.com/login.srf?wa=wsignin1.0&rpsnv=10&ct=1203105751&rver=4.5.2130.0&wp=MBI&wreply=http:%2F%2Fmail.live.com%2Fdefault.aspx&id=64855 IE: {{B4B52284-A248-4c51-9F7C-F0A0C67FCC9D} - c:\program files\PartyGaming\PartyCasino\RunApp.exe . ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-06-26 23:18 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... HKLM\Software\Microsoft\Windows\CurrentVersion\Run DLCGCATS = rundll32 c:\windows\System32\spool\DRIVERS\W32X86\3\DLCGtime.dll,_RunDLLEntry@16??????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????? scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . --------------------- LOCKED REGISTRY KEYS --------------------- [HKEY_USERS\S-1-5-21-1598283739-452893982-683752979-1005\Software\Microsoft\SystemCertificates\AddressBook*] @Allowed: (Read) (RestrictedCode) @Allowed: (Read) (RestrictedCode) . --------------------- DLLs Loaded Under Running Processes --------------------- - - - - - - - > 'winlogon.exe'(888) c:\windows\system32\Ati2evxx.dll c:\windows\System32\BCMLogon.dll - - - - - - - > 'explorer.exe'(3204) c:\windows\system32\WPDShServiceObj.dll c:\windows\system32\PortableDeviceTypes.dll c:\windows\system32\PortableDeviceApi.dll . Completion time: 2009-06-27 23:20 ComboFix-quarantined-files.txt 2009-06-27 06:20 ComboFix2.txt 2009-06-27 05:51 ComboFix3.txt 2009-06-26 00:23 Pre-Run: 39,214,751,744 bytes free Post-Run: 39,198,576,640 bytes free 164 --- E O F --- 2009-06-19 01:54 |
|
|
|
|
06-27-2009, 06:53 PM
|
#6 (permalink) |
|
Registered User
Join Date: Jun 2009
Posts: 4
OS: xp media edition 2005
|
Re: suspected trojan sucking all my comp's memory.
Avira AntiVir Personal
Report file date: Saturday, June 27, 2009 14:18 Scanning for 1429418 virus strains and unwanted programs. Licensee : Avira AntiVir Personal - FREE Antivirus Serial number : 0000149996-ADJIE-0000001 Platform : Windows XP Windows version : (Service Pack 2) [5.1.2600] Boot mode : Normally booted Username : SYSTEM Computer name : MIKE Version information: BUILD.DAT : 9.0.0.403 17961 Bytes 6/3/2009 17:05:00 AVSCAN.EXE : 9.0.3.6 466689 Bytes 5/11/2009 17:14:47 AVSCAN.DLL : 9.0.3.0 40705 Bytes 2/27/2009 18:58:24 LUKE.DLL : 9.0.3.2 209665 Bytes 2/20/2009 19:35:49 LUKERES.DLL : 9.0.2.0 12033 Bytes 2/27/2009 18:58:52 ANTIVIR0.VDF : 7.1.0.0 15603712 Bytes 10/27/2008 20:30:36 ANTIVIR1.VDF : 7.1.4.132 5707264 Bytes 6/24/2009 21:14:45 ANTIVIR2.VDF : 7.1.4.133 2048 Bytes 6/24/2009 21:14:45 ANTIVIR3.VDF : 7.1.4.144 82944 Bytes 6/26/2009 21:14:45 Engineversion : 8.2.0.199 AEVDF.DLL : 8.1.1.1 106868 Bytes 4/30/2009 19:52:04 AESCRIPT.DLL : 8.1.2.10 418171 Bytes 6/27/2009 21:14:50 AESCN.DLL : 8.1.2.3 127347 Bytes 5/14/2009 19:02:01 AERDL.DLL : 8.1.1.3 438645 Bytes 10/30/2008 02:24:41 AEPACK.DLL : 8.1.3.18 401783 Bytes 5/28/2009 00:07:20 AEOFFICE.DLL : 8.1.0.38 196987 Bytes 6/27/2009 21:14:50 AEHEUR.DLL : 8.1.0.137 1823095 Bytes 6/27/2009 21:14:49 AEHELP.DLL : 8.1.3.6 205174 Bytes 6/27/2009 21:14:47 AEGEN.DLL : 8.1.1.46 348533 Bytes 6/27/2009 21:14:46 AEEMU.DLL : 8.1.0.9 393588 Bytes 10/9/2008 22:32:40 AECORE.DLL : 8.1.6.12 180599 Bytes 5/28/2009 00:07:20 AEBB.DLL : 8.1.0.3 53618 Bytes 10/9/2008 22:32:40 AVWINLL.DLL : 9.0.0.3 18177 Bytes 12/12/2008 16:47:59 AVPREF.DLL : 9.0.0.1 43777 Bytes 12/5/2008 18:32:15 AVREP.DLL : 8.0.0.3 155905 Bytes 1/20/2009 22:34:28 AVREG.DLL : 9.0.0.0 36609 Bytes 12/5/2008 18:32:09 AVARKT.DLL : 9.0.0.3 292609 Bytes 3/24/2009 23:05:41 AVEVTLOG.DLL : 9.0.0.7 167169 Bytes 1/30/2009 18:37:08 SQLITE3.DLL : 3.6.1.0 326401 Bytes 1/28/2009 23:03:49 SMTPLIB.DLL : 9.2.0.25 28417 Bytes 2/2/2009 16:21:33 NETNT.DLL : 9.0.0.0 11521 Bytes 12/5/2008 18:32:10 RCIMAGE.DLL : 9.0.0.25 2438913 Bytes 5/15/2009 23:39:58 RCTEXT.DLL : 9.0.37.0 86785 Bytes 4/17/2009 18:19:48 Configuration settings for the scan: Jobname.............................: Complete system scan Configuration file..................: c:\program files\avira\antivir desktop\sysscan.avp Logging.............................: low Primary action......................: interactive Secondary action....................: ignore Scan master boot sector.............: on Scan boot sector....................: on Boot sectors........................: C:, Process scan........................: on Scan registry.......................: on Search for rootkits.................: on Integrity checking of system files..: off Scan all files......................: All files Scan archives.......................: on Recursion depth.....................: 20 Smart extensions....................: on Macro heuristic.....................: on File heuristic......................: medium Start of the scan: Saturday, June 27, 2009 14:18 Starting search for hidden objects. '58206' objects were checked, '0' hidden objects were found. The scan of running processes will be started Scan process 'avscan.exe' - '1' Module(s) have been scanned Scan process 'avcenter.exe' - '1' Module(s) have been scanned Scan process 'avgnt.exe' - '1' Module(s) have been scanned Scan process 'sched.exe' - '1' Module(s) have been scanned Scan process 'avguard.exe' - '1' Module(s) have been scanned Scan process 'iexplore.exe' - '1' Module(s) have been scanned Scan process 'wmiapsrv.exe' - '1' Module(s) have been scanned Scan process 'jqs.exe' - '1' Module(s) have been scanned Scan process 'wuauclt.exe' - '1' Module(s) have been scanned Scan process 'alg.exe' - '1' Module(s) have been scanned Scan process 'ehmsas.exe' - '1' Module(s) have been scanned Scan process 'dllhost.exe' - '1' Module(s) have been scanned Scan process 'dlcgcoms.exe' - '1' Module(s) have been scanned Scan process 'wmiprvse.exe' - '1' Module(s) have been scanned Scan process 'McrdSvc.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'RMSvc.exe' - '1' Module(s) have been scanned Scan process 'NicConfigSvc.exe' - '1' Module(s) have been scanned Scan process 'ehSched.exe' - '1' Module(s) have been scanned Scan process 'ehrecvr.exe' - '1' Module(s) have been scanned Scan process 'AppleMobileDeviceService.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'msnmsgr.exe' - '1' Module(s) have been scanned Scan process 'ctfmon.exe' - '1' Module(s) have been scanned Scan process 'WLTRAY.EXE' - '1' Module(s) have been scanned Scan process 'realsched.exe' - '1' Module(s) have been scanned Scan process 'DLCGmon.exe' - '1' Module(s) have been scanned Scan process 'issch.exe' - '1' Module(s) have been scanned Scan process 'DVDLauncher.exe' - '1' Module(s) have been scanned Scan process 'quickset.exe' - '1' Module(s) have been scanned Scan process 'stsystra.exe' - '1' Module(s) have been scanned Scan process 'SynTPEnh.exe' - '1' Module(s) have been scanned Scan process 'ehtray.exe' - '1' Module(s) have been scanned Scan process 'spoolsv.exe' - '1' Module(s) have been scanned Scan process 'BCMWLTRY.EXE' - '1' Module(s) have been scanned Scan process 'WLTRYSVC.EXE' - '1' Module(s) have been scanned Scan process 'explorer.exe' - '1' Module(s) have been scanned Scan process 'ati2evxx.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'ati2evxx.exe' - '1' Module(s) have been scanned Scan process 'lsass.exe' - '1' Module(s) have been scanned Scan process 'services.exe' - '1' Module(s) have been scanned Scan process 'winlogon.exe' - '1' Module(s) have been scanned Scan process 'csrss.exe' - '1' Module(s) have been scanned Scan process 'smss.exe' - '1' Module(s) have been scanned 51 processes with 51 modules were scanned Starting master boot sector scan: Master boot sector HD0 [INFO] No virus was found! Start scanning boot sectors: Boot sector 'C:\' [INFO] No virus was found! Starting to scan executable files (registry). The registry was scanned ( '62' files ). Starting the file scan: Begin scan in 'C:\' C:\hiberfil.sys [WARNING] The file could not be opened! [NOTE] This file is a Windows system file. [NOTE] This file cannot be opened for scanning. C:\pagefile.sys [WARNING] The file could not be opened! [NOTE] This file is a Windows system file. [NOTE] This file cannot be opened for scanning. C:\WINDOWS\Downloaded Program Files\MyFunCardsFWBInitialSetup1.0.0.15-3.exe [0] Archive type: RSRC --> Object [DETECTION] Contains recognition pattern of the ADSPY/FunWeb.E.16 adware or spyware Beginning disinfection: C:\WINDOWS\Downloaded Program Files\MyFunCardsFWBInitialSetup1.0.0.15-3.exe [NOTE] The file was moved to '4a8cb942.qua'! End of the scan: Saturday, June 27, 2009 17:26 Used time: 48:05 Minute(s) The scan has been done completely. 8189 Scanned directories 181528 Files were scanned 1 Viruses and/or unwanted programs were found 0 Files were classified as suspicious 0 files were deleted 0 Viruses and unwanted programs were repaired 1 Files were moved to quarantine 0 Files were renamed 2 Files cannot be scanned 181525 Files not concerned 3300 Archives were scanned 2 Warnings 3 Notes 58206 Objects were scanned with rootkit scan 0 Hidden objects were found |
|
|
|
|
06-28-2009, 06:18 AM
|
#7 (permalink) |
|
Moderator, Analyst, Security Team
Join Date: Oct 2006
Location: Důn Čideann,Scotland.
Posts: 5,093
OS: XP
|
Re: suspected trojan sucking all my comp's memory.
Hello again
You don't seem to have a firewall program installed. Using a firewall will allow you to give/deny access for applications that want to go online. Select one of these, or another of your choice: ======== If there are no further issues, continue below. ======== Delete DDS from your desktop, you may keep ATF-Cleaner if you wish... otherwise delete from desktop. ======== Well done, your logs are clean. Click start>run>type(or copy/paste command into run box): ComboFix /u Click ok. ========= Clear IE7 cookies *On the Internet Explorer 7 Tools menu, click Internet Options. The Internet Options box should open to the General tab. *On the General tab, in the Browsing History, click the Delete button. This will delete all the files that are currently stored in your cache [that includes cookies too]. *Click OK, and then click OK again. Clear Firefox cookies/cache • Select "Tools" • Select "Options". • Select "Privacy". • In "Settings" window put the check mark for Cookies,Cache,Browsing history and any others you want. • Click OK. • In Private area click "Clear Now". ------------------------------------------------------------------------------------------- MICROSOFT UPDATES 1.Click Start,Run, type sysdm.cpl, and then press OK. 2.Click the Automatic Updates tab, and then click to select one of the following options. We recommend that you select the Automatic (recommended). Microsoft updates are released every second Tuesday of each month,what is called "Patch Tuesday". ------------------------------------------------------------------------------------------ Useful Information and Programs to keep you safe. WOT Free helps you avoid disingenuous Internet content by allowing you to learn from others' experiences. WOT shows you website reputations on your browser, telling you how much other users trust a website. This helps you make better decisions while browsing and avoid phishing, malware, and other types of fraud. Reputations can also be added to web search results, Gmail, Wikipedia, and other selected sites. WOT reputations are computed mainly from user testimonies. Sharing your knowledge with others is just a click away, without ever having to leave the site. We also collect data from hundreds of other sources (including PhishTank) to quickly warn you of emerging threats. Currently, WOT knows over 12 million websites. For Internet Explorer users: WOT for IE -------------------------------------------------------------------------------------- Alternate Browsers Try the following free alternate browsers rather than Internet Explorer Avant Firefox Opera K-Meleon ------------------------------------------------------------------------------------------ Free Antispyware Products SuperAntiSpyware Malwarebytes ' Anti-Malware SpywareBlaster to help prevent spyware from installing in the first place.
------------------------------------------------------------------ The MVPS Hosts file replaces your current HOSTS file with one that will restrict known ad sites from serving you unsolicited advertisements. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is the IP of your local computer. Note that if you use a company provided HOSTS file you should not use the MVPS HOSTS file. If your having trouble downloading & extracting,see link below for guidance: http://www.mvps.org/winhelp2002/hosts2.htm Once you have extracted the host file,double click on it and a new window will open. Double-click on mvps.batand follow the prompts --------------------------------------------------------------- Winpatrol - Download and install the free version of Winpatrol. A tutorial for this product is located here: Using Winpatrol to protect your computer. ---------------------------------------- SnoopFree is a programme that informs you when another programme is wanting to log your keystrokes or read your screen.Only for XP users. Update all these programs regularly. Without regular updates you will not be protected when new malicious programs are released. ============================================== Secunia PSI is a programme that will alert you to vulnerabilities and outdated programs you have installed, such as Java, Flash Player and many more. It can also alert you if you have not installed the latest patches from Microsoft. ============================================== Also, please take a look at this well written article: PC Safety and Security--What Do I Need? **Be very wary with any security software that is advertised in popups or in other ways. They are not only usually of no use, but often have malware in them. Please reply to this thread once more, as we may mark this as resolved, thanks. |
|
|
|
| Thread Tools | |
|
|
