Annoying pop up with Firefox

[michele.milani]

Hi everybody,

I got some virus/trojan, the antivirus found Agent.cikx and put it in quarantine, but Firefox still pops up adv windows.

This is the RootRepeal log:

ROOTREPEAL (c) AD, 2007-2009
==================================================
Scan Start Time: 2009/08/15 14:59
Program Version: Version 1.3.5.0
Windows Version: Windows XP SP3
==================================================

Drivers
-------------------
Name: dump_atapi.sys
Image Path: C:\WINDOWS\System32\Drivers\dump_atapi.sys
Address: 0xF651B000 Size: 98304 File Visible: No Signed: -
Status: -

Name: dump_WMILIB.SYS
Image Path: C:\WINDOWS\System32\Drivers\dump_WMILIB.SYS
Address: 0xF8C5C000 Size: 8192 File Visible: No Signed: -
Status: -

Name: rootrepeal.sys
Image Path: C:\WINDOWS\system32\drivers\rootrepeal.sys
Address: 0xF102F000 Size: 49152 File Visible: No Signed: -
Status: -

Hidden/Locked Files
-------------------
Path: C:\Documents and Settings\Matteo Milani\Dati applicazioni\Mozilla\Firefox\Profiles\vjd1bplq.default\sessionstore.js
Status: Could not get file information (Error 0xc0000008)

Path: c:\documents and settings\matteo milani\impostazioni locali\dati applicazioni\mozilla\firefox\profiles\vjd1bplq.default\cache\_cache_001_
Status: Size mismatch (API: 1156893, Raw: 1138825)

Path: c:\documents and settings\matteo milani\impostazioni locali\dati applicazioni\mozilla\firefox\profiles\vjd1bplq.default\cache\_cache_002_
Status: Size mismatch (API: 1517413, Raw: 1507454)

Path: c:\documents and settings\matteo milani\impostazioni locali\dati applicazioni\mozilla\firefox\profiles\vjd1bplq.default\cache\_cache_003_
Status: Size mismatch (API: 2505311, Raw: 2449046)

SSDT
-------------------
#: 041 Function Name: NtCreateKey
Status: Hooked by "<unknown>" at address 0xf8dd21de

#: 053 Function Name: NtCreateThread
Status: Hooked by "<unknown>" at address 0xf8dd21d4

#: 063 Function Name: NtDeleteKey
Status: Hooked by "<unknown>" at address 0xf8dd21e3

#: 065 Function Name: NtDeleteValueKey
Status: Hooked by "<unknown>" at address 0xf8dd21ed

#: 098 Function Name: NtLoadKey
Status: Hooked by "<unknown>" at address 0xf8dd21f2

#: 122 Function Name: NtOpenProcess
Status: Hooked by "<unknown>" at address 0xf8dd21c0

#: 128 Function Name: NtOpenThread
Status: Hooked by "<unknown>" at address 0xf8dd21c5

#: 193 Function Name: NtReplaceKey
Status: Hooked by "<unknown>" at address 0xf8dd21fc

#: 204 Function Name: NtRestoreKey
Status: Hooked by "<unknown>" at address 0xf8dd21f7

#: 247 Function Name: NtSetValueKey
Status: Hooked by "<unknown>" at address 0xf8dd21e8

#: 257 Function Name: NtTerminateProcess
Status: Hooked by "<unknown>" at address 0xf8dd21cf

==EOF==

And this is the GMER log:

GMER 1.0.15.15020 [9lfuzq2o.exe] - http://www.gmer.net
Rootkit scan 2009-08-15 19:34:26
Windows 5.1.2600 Service Pack 3


---- System - GMER 1.0.15 ----

SSDT F8DD21DE ZwCreateKey
SSDT F8DD21D4 ZwCreateThread
SSDT F8DD21E3 ZwDeleteKey
SSDT F8DD21ED ZwDeleteValueKey
SSDT F8DD21F2 ZwLoadKey
SSDT F8DD21C0 ZwOpenProcess
SSDT F8DD21C5 ZwOpenThread
SSDT F8DD21FC ZwReplaceKey
SSDT F8DD21F7 ZwRestoreKey
SSDT F8DD21E8 ZwSetValueKey
SSDT F8DD21CF ZwTerminateProcess

---- Kernel code sections - GMER 1.0.15 ----

.text ntoskrnl.exe!_abnormal_termination + 428 804E2A84 4 Bytes CALL 6C4707AA

---- Devices - GMER 1.0.15 ----

AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.)
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 mouclass.sys (Driver Mouse Class/Microsoft Corporation)

---- EOF - GMER 1.0.15 ----

Let me know if you see something suspicious.

Thanks!
Michele

[tetonbob]

Hello and Welcome.

We want all our members to perform the steps outlined in the link I'll give you below, before posting for assistance. There's a sticky at the top of this forum, and a

Having problems with spyware and pop-ups? First Steps

link at the top of each page.

---------------------------------------------------------------------------------------------

Please follow our pre-posting process outlined here:

NEW INSTRUCTIONS - Read This Before Posting For Malware Removal Help

After running through all the steps, you shall have a proper set of logs. Please post them in a new topic, as this one shall be closed. I currently have as many open topics as I can effectively handle; this will have you back in queue with the proper logs so an available helper would be able to assist.

If you have trouble with one of the steps, simply move on to the next one, and make note of it in your reply.

Please note that the Virus/Trojan/Spyware Help forum is extremely busy, and it may take a while to receive a reply.