|
|
|
|
|||||
|
|
|
|
|
|
|||
| Welcome
to Tech Support Forum home to more then 136,000 problems solved. Issues
have included: Spyware, Malware, Virus Issues, Windows, Microsoft,
Linux, Networking, Security, Hardware, and Gaming Getting your
problem solved is as easy as: 1. Registering for a free account 2. Asking your question 3. Receiving an answer Registered members: * See fewer ads. * And much more..
|
| Want to know how to post a question? click here | Having problems with spyware and pop-ups? First Steps |
|
|||||||
| Resolved HJT Threads Resolved spyware and popup issues. |
|
|
LinkBack | Thread Tools |
09-04-2009, 09:21 AM
|
#1 (permalink) |
|
Registered User
Join Date: Sep 2009
Location: Southeast Louisiana: Bayou Country
Posts: 37
OS: Windows Vista Home Premium
|
Monopod/a.exe/b.exe/etc...Can't run DDS, etc!
HELP! Monopod; a.exe; b.exe; etc.!! Can't run DDS or ANYTHING really....
I'm sorry. I missed the part about only having one post to prevent the post from being overlooked for assistance. Original thread Trying to take the first steps...darn Monopod! I was so caught up in the stress of what this is doing. So, I've compiled the posts into one, as seen below: I have two computers: a desktop and a laptop. I use the laptop for college. I'm a 4.0 student of Criminal Justice, working hard to obtain a degree to get my family out of the economic repurcussions and to pay forward the kindness shown to my family following the brutal stabbing of my husband. Well, I made the BIG mistake of letting my ten year old use my laptop to search about music, as she has just joined the band. I know that I have acquired Monopod. Aurora is distraught over what this is doing to my school computer, as am I!! While I was occupied, she followed a link provided by Google about making music. I think she meant "composing" music. That ended up downloading a program she says she thinks is called Sound Force or something like that. A few minutes later, I returned to my post at my laptop. To my suprise, I noticed BAD things happening. Internet Explorer has a changed icon, I cannot access IE8 or most other programs. It says that I don't have permission or that the file or path is wrong. I had one of the IT guys at school look at for me shortly after (the same day). He said he did some kind of command prompt with things like dir a.exe, attrib a.exe, attrib a.exe -a, dir b.exe, attrib b.exe, attrib b.exe -b, and del b.exe. That didn't work. I have downloaded DDS and GMER to start this process so that I may post to the site for assistance. I CAN'T run DDS, though. It keeps saying that I need to disable script blocking tools. However, I had to take a screen shot to see that message, as it popped up and went away so quickly! This thing is making F-Secure "malfunction," ErrorSmart won't start, I can only access the Internet using Firefox, but I am on a wireless network at home. Thus, I am scared to enable the wireless connection for fear it may find its way to my desktop pc. Internet Explorer doesn't even have an icon anymore. It's the basic "application" window icon. However, I can access the internet tools without opening Explorer. I checked under Control Panel>Folder Options. I noticed that .exe and .com are nowhere to be found in the list. I closed it and then thought...wait a second....maybe I'm crazy and I just didn't see it. However, when I tried to open Folder Options again, I couldn't. This thing is controlling everything. I have taken the good measure of downloading the most commonly prescribed programs by this forum to burn to disc IF I am asked to download and run them in this process in the hopes of saving time. My unit ends this Saturday night, and my family has been plagued with tragedy after hardship after tragedy in the past week--everything from the death of my Momma 'Nise to the sizeable scalp laceration that resulted in a pretty bad concussion in my six year old daughter to kidney stones present in my ten year old to the diagnosis of a valve blockage in my father in law's heart. I truly need to resolve this issue as swiftly as possible. Were these hardships not enough, I am aware of the potential for financial institution repurcussions of this malware. As my family does not have much to speak of, the hacks would be quite disappointed in the balance of our bank account, but I would like to keep the little money that we have. I have notified the bank of the situation and will be monitoring my husband's credit report for extra measure. Any help in relaying how to complete the first steps needed to help me address this Monopod would be GREATLY appreciated. I will be checking in regularly throughout the day/weekend/whatever it takes!! Oh! I almost forgot! The laptop is running XP Professional. I have no P2P software installed. I have no form of iTunes, Rhapsody, or anything like it. I have F-Secure Antivirus provided by Charter Communications, and my home wireless network is from Network Magic. Unfortunately, I also have Error Smart. I've been hearing that this program is....an issue. I was able to run GMER. I could not save the file after the scan. What I was able to do was to save the file as the scan progressed. Each time new entries popped up on the list, I would save the file again. I tried renaming MalwareBytes, but I noticed that GMER picked those renamed files up during the scan. When I run DDS, the most I can get out of it is for the black screen to come up. It's the one regarding disabling script blocking errors.....this will take a few minutes.....etc. Nothing further will happen. The screen will just stay that way. Here is the Win32Diag.exe log: Log file is located at: C:\Documents and Settings\student\Desktop\Win32kDiag.txt Removing all found mount points. Attempting to reset file permissions. WARNING: Could not get backup privileges! Searching 'C:\WINDOWS'... Found mount point : C:\WINDOWS\$hf_mig$\KB942615\KB942615 Mount point destination : \Device\__max++>\^ Removing mount point : C:\WINDOWS\$hf_mig$\KB942615\KB942615 Found mount point : C:\WINDOWS\addins\addins Mount point destination : \Device\__max++>\^ Removing mount point : C:\WINDOWS\addins\addins Found mount point : C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP1.tmp\ZAP1.tmp Mount point destination : \Device\__max++>\^ Removing mount point : C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP1.tmp\ZAP1.tmp Found mount point : C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP1D0.tmp\ZAP1D0.tmp Mount point destination : \Device\__max++>\^ Removing mount point : C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP1D0.tmp\ZAP1D0.tmp Found mount point : C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP2CC.tmp\ZAP2CC.tmp Mount point destination : \Device\__max++>\^ Removing mount point : C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP2CC.tmp\ZAP2CC.tmp Found mount point : C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP39E.tmp\ZAP39E.tmp Mount point destination : \Device\__max++>\^ Removing mount point : C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP39E.tmp\ZAP39E.tmp Found mount point : C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP488.tmp\ZAP488.tmp Mount point destination : \Device\__max++>\^ Removing mount point : C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP488.tmp\ZAP488.tmp Found mount point : C:\WINDOWS\assembly\temp\temp Mount point destination : \Device\__max++>\^ Removing mount point : C:\WINDOWS\assembly\temp\temp Found mount point : C:\WINDOWS\assembly\tmp\tmp Mount point destination : \Device\__max++>\^ Removing mount point : C:\WINDOWS\assembly\tmp\tmp Found mount point : C:\WINDOWS\Config\Config Mount point destination : \Device\__max++>\^ Removing mount point : C:\WINDOWS\Config\Config Found mount point : C:\WINDOWS\Connection Wizard\Connection Wizard Mount point destination : \Device\__max++>\^ Removing mount point : C:\WINDOWS\Connection Wizard\Connection Wizard Found mount point : C:\WINDOWS\CSC\d1\d1 Mount point destination : \Device\__max++>\^ Removing mount point : C:\WINDOWS\CSC\d1\d1 Found mount point : C:\WINDOWS\CSC\d2\d2 Mount point destination : \Device\__max++>\^ Removing mount point : C:\WINDOWS\CSC\d2\d2 Found mount point : C:\WINDOWS\CSC\d3\d3 Mount point destination : \Device\__max++>\^ Removing mount point : C:\WINDOWS\CSC\d3\d3 Found mount point : C:\WINDOWS\CSC\d4\d4 Mount point destination : \Device\__max++>\^ Removing mount point : C:\WINDOWS\CSC\d4\d4 Found mount point : C:\WINDOWS\CSC\d5\d5 Mount point destination : \Device\__max++>\^ Removing mount point : C:\WINDOWS\CSC\d5\d5 Found mount point : C:\WINDOWS\CSC\d6\d6 Mount point destination : \Device\__max++>\^ Removing mount point : C:\WINDOWS\CSC\d6\d6 Found mount point : C:\WINDOWS\CSC\d7\d7 Mount point destination : \Device\__max++>\^ Removing mount point : C:\WINDOWS\CSC\d7\d7 Found mount point : C:\WINDOWS\CSC\d8\d8 Mount point destination : \Device\__max++>\^ Removing mount point : C:\WINDOWS\CSC\d8\d8 Found mount point : C:\WINDOWS\Driver Cache\AMD64\AMD64 Mount point destination : \Device\__max++>\^ Removing mount point : C:\WINDOWS\Driver Cache\AMD64\AMD64 Found mount point : C:\WINDOWS\ime\chsime\applets\applets Mount point destination : \Device\__max++>\^ Removing mount point : C:\WINDOWS\ime\chsime\applets\applets Found mount point : C:\WINDOWS\ime\CHTIME\Applets\Applets Mount point destination : \Device\__max++>\^ Removing mount point : C:\WINDOWS\ime\CHTIME\Applets\Applets Found mount point : C:\WINDOWS\ime\imejp\applets\applets Mount point destination : \Device\__max++>\^ Removing mount point : C:\WINDOWS\ime\imejp\applets\applets Found mount point : C:\WINDOWS\ime\imejp98\imejp98 Mount point destination : \Device\__max++>\^ Removing mount point : C:\WINDOWS\ime\imejp98\imejp98 Found mount point : C:\WINDOWS\ime\imjp8_1\applets\applets Mount point destination : \Device\__max++>\^ Removing mount point : C:\WINDOWS\ime\imjp8_1\applets\applets Found mount point : C:\WINDOWS\ime\imkr6_1\applets\applets Mount point destination : \Device\__max++>\^ Removing mount point : C:\WINDOWS\ime\imkr6_1\applets\applets Found mount point : C:\WINDOWS\ime\imkr6_1\dicts\dicts Mount point destination : \Device\__max++>\^ Removing mount point : C:\WINDOWS\ime\imkr6_1\dicts\dicts Found mount point : C:\WINDOWS\ime\shared\res\res Mount point destination : \Device\__max++>\^ Removing mount point : C:\WINDOWS\ime\shared\res\res Found mount point : C:\WINDOWS\Installer\$PatchCache$\Managed\00002109411090400000000000F01FEC\12.0.4518\12.0.4518 Mount point destination : \Device\__max++>\^ Removing mount point : C:\WINDOWS\Installer\$PatchCache$\Managed\00002109411090400000000000F01FEC\12.0.4518\12.0.4518 Found mount point : C:\WINDOWS\Installer\$PatchCache$\Managed\00002109440090400000000000F01FEC\12.0.4518\12.0.4518 Mount point destination : \Device\__max++>\^ Removing mount point : C:\WINDOWS\Installer\$PatchCache$\Managed\00002109440090400000000000F01FEC\12.0.4518\12.0.4518 Found mount point : C:\WINDOWS\Installer\$PatchCache$\Managed\00002109511090400000000000F01FEC\12.0.4518\12.0.4518 Mount point destination : \Device\__max++>\^ Removing mount point : C:\WINDOWS\Installer\$PatchCache$\Managed\00002109511090400000000000F01FEC\12.0.4518\12.0.4518 Found mount point : C:\WINDOWS\Installer\$PatchCache$\Managed\00002109711090400000000000F01FEC\12.0.4518\12.0.4518 Mount point destination : \Device\__max++>\^ Removing mount point : C:\WINDOWS\Installer\$PatchCache$\Managed\00002109711090400000000000F01FEC\12.0.4518\12.0.4518 Found mount point : C:\WINDOWS\Installer\$PatchCache$\Managed\00002109910090400000000000F01FEC\12.0.4518\12.0.4518 Mount point destination : \Device\__max++>\^ Removing mount point : C:\WINDOWS\Installer\$PatchCache$\Managed\00002109910090400000000000F01FEC\12.0.4518\12.0.4518 Found mount point : C:\WINDOWS\Installer\$PatchCache$\Managed\00002109B10090400000000000F01FEC\12.0.4518\12.0.4518 Mount point destination : \Device\__max++>\^ Removing mount point : C:\WINDOWS\Installer\$PatchCache$\Managed\00002109B10090400000000000F01FEC\12.0.4518\12.0.4518 Found mount point : C:\WINDOWS\Installer\$PatchCache$\Managed\00002109F100A0C00000000000F01FEC\12.0.4518\12.0.4518 Mount point destination : \Device\__max++>\^ Removing mount point : C:\WINDOWS\Installer\$PatchCache$\Managed\00002109F100A0C00000000000F01FEC\12.0.4518\12.0.4518 Found mount point : C:\WINDOWS\Installer\$PatchCache$\Managed\00002109F100C0400000000000F01FEC\12.0.4518\12.0.4518 Mount point destination : \Device\__max++>\^ Removing mount point : C:\WINDOWS\Installer\$PatchCache$\Managed\00002109F100C0400000000000F01FEC\12.0.4518\12.0.4518 Found mount point : C:\WINDOWS\Installer\$PatchCache$\Managed\0DC1503A46F231838AD88BCDDC8E8F7C\3.2.30729\3.2.30729 Mount point destination : \Device\__max++>\^ Removing mount point : C:\WINDOWS\Installer\$PatchCache$\Managed\0DC1503A46F231838AD88BCDDC8E8F7C\3.2.30729\3.2.30729 Found mount point : C:\WINDOWS\Installer\$PatchCache$\Managed\62287FAB00234BD4EB33D429A2978904\3.0.6920\3.0.6920 Mount point destination : \Device\__max++>\^ Removing mount point : C:\WINDOWS\Installer\$PatchCache$\Managed\62287FAB00234BD4EB33D429A2978904\3.0.6920\3.0.6920 Found mount point : C:\WINDOWS\Installer\$PatchCache$\Managed\D7314F9862C648A4DB8BE2A5B47BE100\1.0.0\1.0.0 Mount point destination : \Device\__max++>\^ Removing mount point : C:\WINDOWS\Installer\$PatchCache$\Managed\D7314F9862C648A4DB8BE2A5B47BE100\1.0.0\1.0.0 Found mount point : C:\WINDOWS\Installer\$PatchCache$\Managed\DC3BF90CC0D3D2F398A9A6D1762F70F3\2.2.30729\2.2.30729 Mount point destination : \Device\__max++>\^ Removing mount point : C:\WINDOWS\Installer\$PatchCache$\Managed\DC3BF90CC0D3D2F398A9A6D1762F70F3\2.2.30729\2.2.30729 Found mount point : C:\WINDOWS\java\classes\classes Mount point destination : \Device\__max++>\^ Removing mount point : C:\WINDOWS\java\classes\classes Found mount point : C:\WINDOWS\java\trustlib\trustlib Mount point destination : \Device\__max++>\^ Removing mount point : C:\WINDOWS\java\trustlib\trustlib Found mount point : C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Temporary ASP.NET Files\Bind Logs\Bind Logs Mount point destination : \Device\__max++>\^ Removing mount point : C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Temporary ASP.NET Files\Bind Logs\Bind Logs Found mount point : C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Temporary ASP.NET Files\Temporary ASP.NET Files Mount point destination : \Device\__max++>\^ Removing mount point : C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Temporary ASP.NET Files\Temporary ASP.NET Files Found mount point : C:\WINDOWS\Minidump\Minidump Mount point destination : \Device\__max++>\^ Removing mount point : C:\WINDOWS\Minidump\Minidump Found mount point : C:\WINDOWS\msapps\msinfo\msinfo Mount point destination : \Device\__max++>\^ Removing mount point : C:\WINDOWS\msapps\msinfo\msinfo Found mount point : C:\WINDOWS\pchealth\ERRORREP\QHEADLES\QHEADLES Mount point destination : \Device\__max++>\^ Removing mount point : C:\WINDOWS\pchealth\ERRORREP\QHEADLES\QHEADLES Found mount point : C:\WINDOWS\pchealth\ERRORREP\QSIGNOFF\QSIGNOFF Mount point destination : \Device\__max++>\^ Removing mount point : C:\WINDOWS\pchealth\ERRORREP\QSIGNOFF\QSIGNOFF Found mount point : C:\WINDOWS\pchealth\ERRORREP\UserDumps\UserDumps Mount point destination : \Device\__max++>\^ Removing mount point : C:\WINDOWS\pchealth\ERRORREP\UserDumps\UserDumps Found mount point : C:\WINDOWS\pchealth\helpctr\BATCH\BATCH Mount point destination : \Device\__max++>\^ Removing mount point : C:\WINDOWS\pchealth\helpctr\BATCH\BATCH Found mount point : C:\WINDOWS\pchealth\helpctr\Config\CheckPoint\CheckPoint Mount point destination : \Device\__max++>\^ Removing mount point : C:\WINDOWS\pchealth\helpctr\Config\CheckPoint\CheckPoint Found mount point : C:\WINDOWS\pchealth\helpctr\Config\News\News Mount point destination : \Device\__max++>\^ Removing mount point : C:\WINDOWS\pchealth\helpctr\Config\News\News Found mount point : C:\WINDOWS\pchealth\helpctr\HelpFiles\HelpFiles Mount point destination : \Device\__max++>\^ Removing mount point : C:\WINDOWS\pchealth\helpctr\HelpFiles\HelpFiles Found mount point : C:\WINDOWS\pchealth\helpctr\InstalledSKUs\InstalledSKUs Mount point destination : \Device\__max++>\^ Removing mount point : C:\WINDOWS\pchealth\helpctr\InstalledSKUs\InstalledSKUs Found mount point : C:\WINDOWS\pchealth\helpctr\System_OEM\System_OEM Mount point destination : \Device\__max++>\^ Removing mount point : C:\WINDOWS\pchealth\helpctr\System_OEM\System_OEM Found mount point : C:\WINDOWS\pchealth\helpctr\Temp\Temp Mount point destination : \Device\__max++>\^ Removing mount point : C:\WINDOWS\pchealth\helpctr\Temp\Temp Found mount point : C:\WINDOWS\PIF\PIF Mount point destination : \Device\__max++>\^ Removing mount point : C:\WINDOWS\PIF\PIF Found mount point : C:\WINDOWS\Registration\CRMLog\CRMLog Mount point destination : \Device\__max++>\^ Removing mount point : C:\WINDOWS\Registration\CRMLog\CRMLog Found mount point : C:\WINDOWS\security\logs\logs Mount point destination : \Device\__max++>\^ Removing mount point : C:\WINDOWS\security\logs\logs Found mount point : C:\WINDOWS\SoftwareDistribution\AuthCabs\Downloaded\Downloaded Mount point destination : \Device\__max++>\^ Removing mount point : C:\WINDOWS\SoftwareDistribution\AuthCabs\Downloaded\Downloaded Found mount point : C:\WINDOWS\SoftwareDistribution\Download\355f788b6de8a3ec79e9aa172e6317f1\backup\backup Mount point destination : \Device\__max++>\^ Removing mount point : C:\WINDOWS\SoftwareDistribution\Download\355f788b6de8a3ec79e9aa172e6317f1\backup\backup Found mount point : C:\WINDOWS\SoftwareDistribution\Download\fa58243222bcfe35e5467668df396003\backup\backup Mount point destination : \Device\__max++>\^ Removing mount point : C:\WINDOWS\SoftwareDistribution\Download\fa58243222bcfe35e5467668df396003\backup\backup Found mount point : C:\WINDOWS\Sun\Java\Deployment\Deployment Mount point destination : \Device\__max++>\^ Removing mount point : C:\WINDOWS\Sun\Java\Deployment\Deployment Found mount point : C:\WINDOWS\SxsCaPendDel\SxsCaPendDel Mount point destination : \Device\__max++>\^ Removing mount point : C:\WINDOWS\SxsCaPendDel\SxsCaPendDel Found mount point : C:\WINDOWS\system32\1025\1025 Mount point destination : \Device\__max++>\^ Removing mount point : C:\WINDOWS\system32\1025\1025 Found mount point : C:\WINDOWS\system32\1028\1028 Mount point destination : \Device\__max++>\^ Removing mount point : C:\WINDOWS\system32\1028\1028 Found mount point : C:\WINDOWS\system32\1031\1031 Mount point destination : \Device\__max++>\^ Removing mount point : C:\WINDOWS\system32\1031\1031 Found mount point : C:\WINDOWS\system32\1037\1037 Mount point destination : \Device\__max++>\^ Removing mount point : C:\WINDOWS\system32\1037\1037 Found mount point : C:\WINDOWS\system32\1041\1041 Mount point destination : \Device\__max++>\^ Removing mount point : C:\WINDOWS\system32\1041\1041 Found mount point : C:\WINDOWS\system32\1042\1042 Mount point destination : \Device\__max++>\^ Removing mount point : C:\WINDOWS\system32\1042\1042 Found mount point : C:\WINDOWS\system32\1054\1054 Mount point destination : \Device\__max++>\^ Removing mount point : C:\WINDOWS\system32\1054\1054 Found mount point : C:\WINDOWS\system32\2052\2052 Mount point destination : \Device\__max++>\^ Removing mount point : C:\WINDOWS\system32\2052\2052 Found mount point : C:\WINDOWS\system32\3076\3076 Mount point destination : \Device\__max++>\^ Removing mount point : C:\WINDOWS\system32\3076\3076 Found mount point : C:\WINDOWS\system32\3com_dmi\3com_dmi Mount point destination : \Device\__max++>\^ Removing mount point : C:\WINDOWS\system32\3com_dmi\3com_dmi Found mount point : C:\WINDOWS\system32\appmgmt\MACHINE\MACHINE Mount point destination : \Device\__max++>\^ Removing mount point : C:\WINDOWS\system32\appmgmt\MACHINE\MACHINE Found mount point : C:\WINDOWS\system32\appmgmt\S-1-5-21-3248069879-188315912-2387915954-1003\S-1-5-21-3248069879-188315912-2387915954-1003 Mount point destination : \Device\__max++>\^ Removing mount point : C:\WINDOWS\system32\appmgmt\S-1-5-21-3248069879-188315912-2387915954-1003\S-1-5-21-3248069879-188315912-2387915954-1003 Found mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Microsoft\Media Player\Media Player Mount point destination : \Device\__max++>\^ Removing mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Microsoft\Media Player\Media Player Found mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Microsoft\SystemCertificates\My\Certificates\Certificates Mount point destination : \Device\__max++>\^ Removing mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Microsoft\SystemCertificates\My\Certificates\Certificates Found mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Microsoft\SystemCertificates\My\CRLs\CRLs Mount point destination : \Device\__max++>\^ Removing mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Microsoft\SystemCertificates\My\CRLs\CRLs Found mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Microsoft\SystemCertificates\My\CTLs\CTLs Mount point destination : \Device\__max++>\^ Removing mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Microsoft\SystemCertificates\My\CTLs\CTLs Found mount point : C:\WINDOWS\system32\config\systemprofile\Desktop\Desktop Mount point destination : \Device\__max++>\^ Removing mount point : C:\WINDOWS\system32\config\systemprofile\Desktop\Desktop Found mount point : C:\WINDOWS\system32\config\systemprofile\Favorites\Favorites Mount point destination : \Device\__max++>\^ Removing mount point : C:\WINDOWS\system32\config\systemprofile\Favorites\Favorites Found mount point : C:\WINDOWS\system32\config\systemprofile\Local Settings\Temp\F-Secure\Anti-Virus\Anti-Virus Mount point destination : \Device\__max++>\^ Removing mount point : C:\WINDOWS\system32\config\systemprofile\Local Settings\Temp\F-Secure\Anti-Virus\Anti-Virus Found mount point : C:\WINDOWS\system32\config\systemprofile\My Documents\My Documents Mount point destination : \Device\__max++>\^ Removing mount point : C:\WINDOWS\system32\config\systemprofile\My Documents\My Documents Found mount point : C:\WINDOWS\system32\config\systemprofile\NetHood\NetHood Mount point destination : \Device\__max++>\^ Removing mount point : C:\WINDOWS\system32\config\systemprofile\NetHood\NetHood Found mount point : C:\WINDOWS\system32\config\systemprofile\PrintHood\PrintHood Mount point destination : \Device\__max++>\^ Removing mount point : C:\WINDOWS\system32\config\systemprofile\PrintHood\PrintHood Found mount point : C:\WINDOWS\system32\config\systemprofile\Recent\Recent Mount point destination : \Device\__max++>\^ Removing mount point : C:\WINDOWS\system32\config\systemprofile\Recent\Recent Found mount point : C:\WINDOWS\system32\dhcp\dhcp Mount point destination : \Device\__max++>\^ Removing mount point : C:\WINDOWS\system32\dhcp\dhcp Found mount point : C:\WINDOWS\system32\drivers\disdn\disdn Mount point destination : \Device\__max++>\^ Removing mount point : C:\WINDOWS\system32\drivers\disdn\disdn Cannot access: C:\WINDOWS\system32\eventlog.dll Attempting to restore permissions of : C:\WINDOWS\system32\eventlog.dll [1] 2004-08-04 00:56:44 55808 C:\WINDOWS\$NtServicePackUninstall$\eventlog.dll (Microsoft Corporation) |
|
     |
| Important Information |
|
Join the #1 Tech Support Forum Today - It's Totally Free!
TechSupportForum.com is a leading support website for your computer needs. We offer free, friendly and personalized computer support. Why pay to have your computer fixed when you can do it for free. Join TechSupportforum.com Today - Click Here |
|
09-04-2009, 09:37 AM
|
#2 (permalink) |
|
Manager, Security Center, TSF Academy; Analyst, Security Team
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,651
OS: 2000 Pro; XP Pro; XP Home
|
Re: Monopod/a.exe/b.exe/etc...Can't run DDS, etc!
Hello, and Welcome to TSF.
Please subscribe to this thread to get immediate notification of replies as soon as they are posted. To do this click Thread Tools, then click Subscribe to this Thread. Make sure it is set to Instant Notification, then click Subscribe. Before beginning the fix, read this post completely. If there's anything that you do not understand, kindly ask your questions before proceeding. Ensure that there aren't any opened browsers when you are carrying out the procedures below. Save the following instructions in Notepad as this webpage would not be available when you're carrying out the fix. It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence. --------------------------------------------------------------------------------------------- Please note that these fixes are not instantaneous. Most infections require more than one round to properly eradicate. Stay with me until given the 'all clear' even if symptoms diminish. Lack of symptoms does not always mean the job is complete. Kindly follow my instructions and please do no fixing on your own or running of scanners unless requested by me or another helper at this forum. ---------------------------------------------------------------------------------------------
__________________
Practice Safe Surfing Because what you don't know, CAN hurt you.  Microsoft MVP - Consumer Security 2009
|
|
|
|
|
09-04-2009, 12:08 PM
|
#3 (permalink) |
|
Registered User
Join Date: Sep 2009
Location: Southeast Louisiana: Bayou Country
Posts: 37
OS: Windows Vista Home Premium
|
Re: Monopod/a.exe/b.exe/etc...Can't run DDS, etc!
I will do this shortly. I do have a question, though. Is it inadvisable to enable the wireless network connection on my laptop as long as this infection is present? I've been using my desktop pc to access the internet and download the files you've asked me to acquire. I'm scared to enable the internet connection.
How do I find out if I'm safe to access my accounts on my desktop as a "safe" computer? |
|
|
|
|
09-04-2009, 12:10 PM
|
#4 (permalink) |
|
Registered User
Join Date: Sep 2009
Location: Southeast Louisiana: Bayou Country
Posts: 37
OS: Windows Vista Home Premium
|
Re: Monopod/a.exe/b.exe/etc...Can't run DDS, etc!
One more question. I see it says to disable and renable Anti-virus programs prior to and following ComboFix. What if my F-Secure states "malfunction" and is not "working?"
|
|
|
|
|
09-04-2009, 12:34 PM
|
#5 (permalink) |
|
Manager, Security Center, TSF Academy; Analyst, Security Team
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,651
OS: 2000 Pro; XP Pro; XP Home
|
Re: Monopod/a.exe/b.exe/etc...Can't run DDS, etc!
If you don't want to have an active internet connection on this machine, use the manual method for installing Recovery Console as outlined here
http://www.bleepingcomputer.com/comb...anual_recovery Please do this: Go to Microsoft's website => http://support.microsoft.com/kb/310994 Select the download that's appropriate for your Operating System  Download the file & save it as it's originally named, next to ComboFix.exe.  Now close all open windows and programs, then drag the setup package onto ComboFix.exe and drop it. Follow the prompts to start ComboFix and when prompted, agree to the End-User License Agreement to install the Microsoft Recovery Console. ComboFix will now automatically install the Windows Recovery Console onto your computer, which will show up as a new option when booting up your computer. Do not select the Windows Recovery Console option when you start your computer unless requested to by a helper. As part of installing the Recovery Console, ComboFix will begin to run. Follow the prompts to install the Recovery Console. Your desktop may disappear. This is normal. It will return. Once the Recovery Console is installed using ComboFix, you should see a message that says: The Recovery Console was successfully installed.  Click on Yes. ========================== Can you, or can you not, disable F-Secure?
__________________
Practice Safe Surfing Because what you don't know, CAN hurt you. Microsoft MVP - Consumer Security 2009
|
|
|
|
|
09-04-2009, 01:09 PM
|
#6 (permalink) |
|
Registered User
Join Date: Sep 2009
Location: Southeast Louisiana: Bayou Country
Posts: 37
OS: Windows Vista Home Premium
|
Re: Monopod/a.exe/b.exe/etc...Can't run DDS, etc!
I can "Unload" and "Unload and allow all internet traffic" but the F-secure suite says "malfunction."
|
|
|
|
|
09-04-2009, 01:11 PM
|
#7 (permalink) |
|
Manager, Security Center, TSF Academy; Analyst, Security Team
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,651
OS: 2000 Pro; XP Pro; XP Home
|
Re: Monopod/a.exe/b.exe/etc...Can't run DDS, etc!
It should be fine to run ComboFix if you can unload it.
__________________
Practice Safe Surfing Because what you don't know, CAN hurt you. Microsoft MVP - Consumer Security 2009
|
|
|
|
|
09-04-2009, 01:14 PM
|
#8 (permalink) |
|
Manager, Security Center, TSF Academy; Analyst, Security Team
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,651
OS: 2000 Pro; XP Pro; XP Home
|
Re: Monopod/a.exe/b.exe/etc...Can't run DDS, etc!
As this infection alters many file permissions, it may be easier, and possibly required if it's been affected, to uninstall F-Secure and reinstall it later
__________________
Practice Safe Surfing Because what you don't know, CAN hurt you. Microsoft MVP - Consumer Security 2009
|
|
|
|
|
09-04-2009, 01:37 PM
|
#9 (permalink) |
|
Registered User
Join Date: Sep 2009
Location: Southeast Louisiana: Bayou Country
Posts: 37
OS: Windows Vista Home Premium
|
Re: Monopod/a.exe/b.exe/etc...Can't run DDS, etc!
Okay. I am going to unload F-Secure now and run the ComboFix. As far as uninstalling F-secure, you just let me know when I should do that. Reading your last post, I am wondering if the other affected programs I have will need to be reinstalled...
|
|
|
|
|
09-04-2009, 01:51 PM
|
#10 (permalink) |
|
Registered User
Join Date: Sep 2009
Location: Southeast Louisiana: Bayou Country
Posts: 37
OS: Windows Vista Home Premium
|
Re: Monopod/a.exe/b.exe/etc...Can't run DDS, etc!
Well, F-Secure would not actually disable the real-time scanning. I unchecked the box, but it won't disable. I have taken it off and am about to run the ComboFix on the restart.
|
|
|
|
|
09-04-2009, 01:58 PM
|
#11 (permalink) | ||
|
Manager, Security Center, TSF Academy; Analyst, Security Team
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,651
OS: 2000 Pro; XP Pro; XP Home
|
Re: Monopod/a.exe/b.exe/etc...Can't run DDS, etc!
Quote:
Quote:
That's fine. As the machine is isolated from internet and network, not having any protection is not an issue for now. Will be looking for the ComboFix log.
__________________
Practice Safe Surfing Because what you don't know, CAN hurt you. Microsoft MVP - Consumer Security 2009
|
||
|
|
|
|
09-04-2009, 02:14 PM
|
#12 (permalink) |
|
Registered User
Join Date: Sep 2009
Location: Southeast Louisiana: Bayou Country
Posts: 37
OS: Windows Vista Home Premium
|
Re: Monopod/a.exe/b.exe/etc...Can't run DDS, etc!
ComboFix 09-09-03.02 - student 09/04/2009 13:01.1.2 - NTFSx86
Running from: c:\documents and settings\student\Desktop\ComboFix.exe * Created a new restore point . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\program files\iWin Games\iWinGamesHookIE.dll c:\windows\Installer\20fca.msi c:\windows\msa.exe Infected copy of c:\windows\system32\eventlog.dll was found and disinfected Restored copy from - c:\windows\system32\logevent.dll . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_NWCWORKSTATION -------\Legacy_{79007602-0CDB-4405-9DBF-1257BB3226ED} -------\Service_NWCWorkstation ((((((((((((((((((((((((( Files Created from 2009-08-04 to 2009-09-04 ))))))))))))))))))))))))))))))) . 2009-09-03 20:00 . 2009-09-03 20:01 -------- d-----w- c:\program files\PieBwasta 2009-09-03 19:48 . 2009-09-03 19:55 -------- d--ha-w- C:\New Folder 2009-09-03 19:17 . 2009-09-03 19:17 -------- d-----w- c:\documents and settings\student\Application Data\Malwarebytes 2009-09-03 19:17 . 2009-08-03 20:36 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2009-09-03 19:17 . 2009-09-03 19:44 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware 2009-09-03 19:17 . 2009-09-03 19:17 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes 2009-09-03 19:17 . 2009-08-03 20:36 19096 ----a-w- c:\windows\system32\drivers\mbam.sys 2009-09-03 15:58 . 2009-09-03 15:58 -------- d-----w- c:\program files\trend micro 2009-09-03 15:58 . 2009-09-03 15:58 -------- d-----w- C:\rsit 2009-09-03 05:50 . 2009-09-03 05:50 -------- d--h--w- c:\windows\system32\GroupPolicy 2009-09-02 22:25 . 2009-09-04 20:01 -------- d--h--w- c:\windows\PIF 2009-09-02 18:21 . 2009-09-02 18:24 -------- d-----w- c:\program files\Windows Live Safety Center 2009-09-02 18:00 . 2009-09-02 18:00 -------- d-----w- c:\windows\LastGood(2) 2009-09-02 17:07 . 2009-09-02 18:20 -------- d-----w- c:\documents and settings\All Users\Application Data\Yahoo! Companion 2009-09-01 15:39 . 2009-09-01 15:39 -------- d-----w- c:\program files\WebEx 2009-09-01 15:37 . 2009-07-07 21:48 25392 ----a-w- c:\windows\system32\drivers\pnarp.sys 2009-09-01 15:37 . 2009-07-07 21:48 26672 ----a-w- c:\windows\system32\drivers\purendis.sys 2009-09-01 15:36 . 2009-09-01 15:36 -------- d-----w- c:\program files\Common Files\Pure Networks Shared 2009-08-28 15:57 . 2009-08-28 15:58 -------- d-----w- c:\documents and settings\student\Local Settings\Application Data\Xmarks 2009-08-28 15:57 . 2009-08-28 15:57 -------- d-----w- c:\program files\Xmarks 2009-08-20 18:46 . 2009-08-20 18:46 -------- d-----w- c:\documents and settings\student\Application Data\McAfee 2009-08-20 18:45 . 2009-09-01 15:41 -------- d-----w- c:\program files\McAfee 2009-08-20 18:45 . 2009-08-20 18:45 -------- d-----w- c:\documents and settings\All Users\Application Data\McAfee 2009-08-16 01:01 . 2009-08-16 01:01 -------- d-----w- C:\154d2e9e2c9f19a9321f4eb6c4a3 2009-08-16 01:00 . 2009-09-04 20:01 -------- d-----w- c:\windows\SxsCaPendDel 2009-08-14 14:00 . 2009-08-14 14:16 -------- d-----w- c:\documents and settings\student\Application Data\ErrorSmart 2009-08-14 14:00 . 2009-09-02 22:25 -------- d-----w- c:\program files\ErrorSmart 2009-08-12 22:57 . 2009-07-10 13:27 1315328 -c----w- c:\windows\system32\dllcache\msoe.dll . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-09-04 20:04 . 2009-07-24 19:42 -------- d-----w- c:\program files\iWin Games 2009-09-04 19:51 . 2009-03-17 14:25 -------- d-----w- c:\program files\Charter Security Suite 2009-09-04 19:49 . 2009-03-17 14:23 -------- d-----w- c:\documents and settings\All Users\Application Data\f-secure 2009-09-02 17:07 . 2008-10-28 14:20 -------- d-----w- c:\program files\Yahoo! 2009-09-01 15:39 . 2009-05-27 04:37 8892928 ----a-w- c:\documents and settings\All Users\Application Data\atscie.msi 2009-08-28 21:50 . 2009-08-04 15:56 -------- d-----w- c:\program files\lx_Cats 2009-08-25 13:54 . 2008-01-17 00:55 -------- d-----w- c:\program files\Java 2009-08-16 01:13 . 2008-01-15 22:11 69680 ----a-w- c:\documents and settings\student\Local Settings\Application Data\GDIPFONTCACHEV1.DAT 2009-08-16 01:12 . 2009-07-24 19:44 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP 2009-08-13 02:03 . 2008-01-15 23:50 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help 2009-08-05 09:01 . 2004-08-04 07:56 204800 ----a-w- c:\windows\system32\mswebdvd.dll 2009-08-04 16:43 . 2009-08-04 16:42 -------- d-----w- c:\program files\Lexmark 2500 Series 2009-08-03 03:14 . 2008-04-09 15:16 -------- d-----w- c:\program files\Microsoft Silverlight 2009-07-26 21:42 . 2009-07-26 21:42 -------- d-----w- c:\documents and settings\student\Application Data\Flood Light Games 2009-07-26 21:42 . 2009-07-26 21:42 -------- d-----w- c:\documents and settings\All Users\Application Data\Flood Light Games 2009-07-26 21:24 . 2009-07-24 19:44 -------- d-----w- c:\program files\iWin.com 2009-07-26 21:16 . 2009-07-26 21:16 -------- d-----w- c:\documents and settings\student\Application Data\Winv1001 2009-07-25 12:23 . 2009-01-23 15:09 411368 ----a-w- c:\windows\system32\deploytk.dll 2009-07-24 19:43 . 2009-07-24 19:43 -------- d-----w- c:\documents and settings\All Users\Application Data\iWin Games 2009-07-17 19:01 . 2004-08-04 07:56 58880 ----a-w- c:\windows\system32\atl.dll 2009-07-15 20:16 . 2008-01-15 23:21 -------- d--h--w- c:\program files\InstallShield Installation Information 2009-07-14 06:43 . 2004-08-04 07:56 286208 ----a-w- c:\windows\system32\wmpdxm.dll 2009-07-03 17:09 . 2004-08-04 07:56 915456 ----a-w- c:\windows\system32\wininet.dll 2009-06-25 08:25 . 2004-08-04 07:56 54272 ----a-w- c:\windows\system32\wdigest.dll 2009-06-25 08:25 . 2004-08-04 07:56 56832 ----a-w- c:\windows\system32\secur32.dll 2009-06-25 08:25 . 2004-08-04 07:56 147456 ----a-w- c:\windows\system32\schannel.dll 2009-06-25 08:25 . 2004-08-04 07:56 730112 ----a-w- c:\windows\system32\lsasrv.dll 2009-06-25 08:25 . 2004-08-04 07:56 301568 ----a-w- c:\windows\system32\kerberos.dll 2009-06-25 08:25 . 2004-08-04 07:56 136192 ----a-w- c:\windows\system32\msv1_0.dll 2009-06-24 11:18 . 2004-08-03 22:59 92928 ----a-w- c:\windows\system32\drivers\ksecdd.sys 2009-06-16 14:36 . 2004-08-04 07:56 119808 ----a-w- c:\windows\system32\t2embed.dll 2009-06-16 14:36 . 2001-08-22 22:00 81920 ----a-w- c:\windows\system32\fontsub.dll 2009-06-12 12:31 . 2004-08-04 07:56 80896 ----a-w- c:\windows\system32\tlntsess.exe 2009-06-12 12:31 . 2004-08-04 07:56 76288 ----a-w- c:\windows\system32\telnet.exe 2009-06-10 16:19 . 2008-01-15 21:01 2066432 ----a-w- c:\windows\system32\mstscax.dll 2009-06-10 14:13 . 2004-08-04 07:56 84992 ----a-w- c:\windows\system32\avifil32.dll 2009-06-10 06:14 . 2004-08-04 07:56 132096 ----a-w- c:\windows\system32\wkssvc.dll . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Xmarks"="c:\program files\Xmarks\IE Extension\xmarkssync.exe" [2009-05-08 1003520] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Broadcom Wireless Manager UI"="c:\windows\system32\WLTRAY.exe" [2007-10-10 2183168] "SigmatelSysTrayApp"="c:\program files\SigmaTel\C-Major Audio\WDM\stsystra.exe" [2007-05-10 405504] "GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2007-08-24 33648] "ATICCC"="c:\program files\ATI Technologies\ATI.ACE\CLIStart.exe" [2006-09-25 90112] "Apoint"="c:\program files\DellTPad\Apoint.exe" [2007-07-02 159744] "PAC7302_Monitor"="c:\windows\PixArt\PAC7302\Monitor.exe" [2006-11-03 319488] "TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-05-13 198160] "nmapp"="c:\program files\Pure Networks\Network Magic\nmapp.exe" [2008-12-14 467240] "Synchronization Manager"="c:\windows\system32\mobsync.exe" [2008-04-14 143360] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-07-25 149280] "nmctxth"="c:\program files\Common Files\Pure Networks Shared\Platform\nmctxth.exe" [2009-07-07 647216] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "MySpaceIM"="c:\program files\MySpace\IM\MySpaceIM.exe" [2008-04-17 9117696] [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] Authentication Packages REG_MULTI_SZ msv1_0 nwprovau [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Bluetooth Manager.lnk] path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Bluetooth Manager.lnk backup=c:\windows\pss\Bluetooth Manager.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Exif Launcher S.lnk] path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Exif Launcher S.lnk backup=c:\windows\pss\Exif Launcher S.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusOverride"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"= "c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"= "c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"= "c:\\WINDOWS\\system32\\dpvsetup.exe"= "c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"= "c:\\Program Files\\MySpace\\IM\\MySpaceIM.exe"= "c:\\Program Files\\ooVoo\\ooVoo.exe"= "c:\\Program Files\\iWin Games\\iWinGames.exe"= "c:\\Program Files\\iWin Games\\WebUpdater.exe"= "c:\\WINDOWS\\system32\\lxddcoms.exe"= "c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\lxddpswx.exe"= "c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\lxddjswx.exe"= "c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\lxddtime.exe"= "c:\program files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe"= c:\program files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe:LocalSubNet,0.0.0.0/255.255.255.255:Enabled:Pure Networks Platform Service [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009 "443:TCP"= 443:TCP:*:Disabled:ooVoo TCP port 443 "443:UDP"= 443:UDP:*:Disabled:ooVoo UDP port 443 "37674:TCP"= 37674:TCP:*:Disabled:ooVoo TCP port 37674 "37674:UDP"= 37674:UDP:*:Disabled:ooVoo UDP port 37674 "37675:UDP"= 37675:UDP:*:Disabled:ooVoo UDP port 37675 "37676:TCP"= 37676:TCP:ooVoo TCP port 37676 "37676:UDP"= 37676:UDP:*:Disabled:ooVoo UDP port 37676 "37677:UDP"= 37677:UDP:*:Disabled:ooVoo UDP port 37677 "67:UDP"= 67:UDP:DHCP Discovery Service R2 gupdate1c9d42113d3f6fc;Google Update Service (gupdate1c9d42113d3f6fc);c:\program files\Google\Update\GoogleUpdate.exe [2009-05-13 133104] R3 PAC7302;PAC7302 VGA USB Camera;c:\windows\system32\DRIVERS\PAC7302.SYS [2007-06-14 457856] S2 iWinTrusted;iWinTrusted;c:\program files\iWin Games\iWinTrusted.exe [2009-07-09 78104] S2 lxdd_device;lxdd_device;c:\windows\system32\lxddcoms.exe [2007-05-25 537520] S2 NwSapAgent;SAP Agent;c:\windows\system32\svchost.exe [2008-04-14 14336] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}] "c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP . Contents of the 'Scheduled Tasks' folder 2009-09-01 c:\windows\Tasks\ErrorSmart Scheduled Scan.job - c:\program files\ErrorSmart\ErrorSmart.exe [2009-08-05 22:39] 2009-09-04 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files\Google\Update\GoogleUpdate.exe [2009-05-13 23:17] 2009-09-03 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files\Google\Update\GoogleUpdate.exe [2009-05-13 23:17] 2009-09-04 c:\windows\Tasks\User_Feed_Synchronization-{3B19CECA-4528-4116-942B-0819906140BD}.job - c:\windows\system32\msfeedssync.exe [2007-08-14 11:31] . - - - - ORPHANS REMOVED - - - - Toolbar-Locked - (no file) WebBrowser-{A057A204-BACC-4D26-8087-36EE87E26986} - (no file) SafeBoot-Wdf01000.sys . ------- Supplementary Scan ------- . uStart Page = hxxp://onlinecci.com/ uInternet Settings,ProxyOverride = <local> Trusted Zone: internet Trusted Zone: mcafee.com FF - ProfilePath - c:\documents and settings\student\Application Data\Mozilla\Firefox\Profiles\g9lijox8.default\ FF - prefs.js: browser.search.defaulturl - hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2706&invocationType=&query= FF - prefs.js: browser.search.selectedEngine - AIM Search FF - prefs.js: browser.startup.homepage - hxxp://www.onlinecci.com/ FF - prefs.js: keyword.URL - hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2706&invocationType=&query= FF - prefs.js: network.proxy.type - 4 FF - plugin: c:\program files\Google\Update\1.2.183.7\npGoogleOneClick8.dll FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ . ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-09-04 13:07 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . --------------------- LOCKED REGISTRY KEYS --------------------- [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10c.exe,-101" [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\Elevation] "Enabled"=dword:00000001 [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\LocalServer32] @="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10c.exe" [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" [HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}] @Denied: (A 2) (Everyone) @="IFlashBroker3" [HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" [HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . --------------------- DLLs Loaded Under Running Processes --------------------- - - - - - - - > 'winlogon.exe'(1436) c:\windows\system32\Ati2evxx.dll - - - - - - - > 'explorer.exe'(3860) c:\windows\system32\WININET.dll c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.3053_x-ww_b80fa8ca\MSVCR80.dll c:\windows\system32\webcheck.dll c:\windows\system32\IEFRAME.dll c:\windows\system32\mshtml.dll c:\windows\system32\msls31.dll c:\windows\system32\hnetcfg.dll c:\windows\system32\WPDShServiceObj.dll c:\windows\system32\PortableDeviceTypes.dll c:\windows\system32\PortableDeviceApi.dll . ------------------------ Other Running Processes ------------------------ . c:\windows\system32\ati2evxx.exe c:\windows\system32\WLTRYSVC.EXE c:\windows\system32\ati2evxx.exe c:\windows\system32\BCMWLTRY.EXE c:\program files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe c:\program files\Java\jre6\bin\jqs.exe c:\program files\Dell\QuickSet\NicConfigSvc.exe c:\program files\SigmaTel\C-Major Audio\DellXPM_5515v131\WDM\stacsv.exe c:\program files\DellTPad\ApMsgFwd.exe c:\program files\DellTPad\ApntEx.exe c:\program files\DellTPad\hidfind.exe c:\program files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe c:\windows\system32\wscntfy.exe . ************************************************************************** . Completion time: 2009-09-04 13:10 - machine was rebooted ComboFix-quarantined-files.txt 2009-09-04 20:10 Pre-Run: 64,699,830,272 bytes free Post-Run: 64,931,127,296 bytes free WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe [boot loader] default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems] c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect 262 --- E O F --- 2009-09-02 16:50 |
|
|
|
|
09-04-2009, 02:23 PM
|
#13 (permalink) |
|
Manager, Security Center, TSF Academy; Analyst, Security Team
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,651
OS: 2000 Pro; XP Pro; XP Home
|
Re: Monopod/a.exe/b.exe/etc...Can't run DDS, etc!
Good job.
Next, I need to see a couple more logs. You already have Win32kDiag. Run it again, without the switches. Double-click on it to run a scan. When it's finished, there will be a log called Win32kDiag.txt on your desktop. Please open it with notepad and post the contents here. Next.... Download the attached junction.zip and extract it to it's own folder on your desktop. Double click the peek.bat and allow it to run. It will take some time to complete, so please be patient and wait until it finishes. A log will be produced at C:\log.txt. Please attach that log in your next reply.
__________________
Practice Safe Surfing Because what you don't know, CAN hurt you. Microsoft MVP - Consumer Security 2009
|
|
|
|
|
09-04-2009, 02:24 PM
|
#14 (permalink) |
|
Manager, Security Center, TSF Academy; Analyst, Security Team
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,651
OS: 2000 Pro; XP Pro; XP Home
|
Re: Monopod/a.exe/b.exe/etc...Can't run DDS, etc!
Also, please do this:
Please go to Start > Run and copy/paste the following, then press Enter: C:\QooBox\Add-Remove Programs.txt A text file should open. Please post the contents of that file in your next reply.
__________________
Practice Safe Surfing Because what you don't know, CAN hurt you. Microsoft MVP - Consumer Security 2009
|
|
|
|
|
09-04-2009, 02:51 PM
|
#15 (permalink) |
|
Registered User
Join Date: Sep 2009
Location: Southeast Louisiana: Bayou Country
Posts: 37
OS: Windows Vista Home Premium
|
Re: Monopod/a.exe/b.exe/etc...Can't run DDS, etc!
Win32kdiag.exe says:
WARNING: Could not get backup privileges! Searching 'C:\Windows'... Cannot access: C:\WINDOWS\system32\MRT.exe |
|
|
|
|
09-04-2009, 02:53 PM
|
#16 (permalink) |
|
Registered User
Join Date: Sep 2009
Location: Southeast Louisiana: Bayou Country
Posts: 37
OS: Windows Vista Home Premium
|
Re: Monopod/a.exe/b.exe/etc...Can't run DDS, etc!
Disregard that last post...duh Amanda...that's part of the scan I guess because it's adding stuff onto that...pardon my brain fart...
|
|
|
|
|
09-04-2009, 02:54 PM
|
#17 (permalink) |
|
Registered User
Join Date: Sep 2009
Location: Southeast Louisiana: Bayou Country
Posts: 37
OS: Windows Vista Home Premium
|
Re: Monopod/a.exe/b.exe/etc...Can't run DDS, etc!
I promise to wait in the future, but I felt it absolutely necessary to say THANK YOU for taking the time to help me. I cannot express how important this is to me or how much your help means to me.
|
|
|
|
|
09-04-2009, 03:14 PM
|
#18 (permalink) |
|
Registered User
Join Date: Sep 2009
Location: Southeast Louisiana: Bayou Country
Posts: 37
OS: Windows Vista Home Premium
|
Re: Monopod/a.exe/b.exe/etc...Can't run DDS, etc!
Log file is located at: C:\Documents and Settings\student\Desktop\Win32kDiag.txt
WARNING: Could not get backup privileges! Searching 'C:\WINDOWS'... Cannot access: C:\WINDOWS\system32\MRT.exe [1] 2009-07-29 17:49:16 24281536 C:\WINDOWS\system32\MRT.exe () Cannot access: C:\WINDOWS\system32\wbem\wmiprvse.exe [1] 2009-02-06 03:15:13 227840 C:\WINDOWS\$hf_mig$\KB956572\SP3QFE\wmiprvse.exe (Microsoft Corporation) [1] 2004-08-04 00:56:58 218112 C:\WINDOWS\$NtServicePackUninstall$\wmiprvse.exe (Microsoft Corporation) [1] 2008-04-13 17:12:40 218112 C:\WINDOWS\$NtUninstallKB956572$\wmiprvse.exe (Microsoft Corporation) [1] 2008-04-13 17:12:40 218112 C:\WINDOWS\ServicePackFiles\i386\wmiprvse.exe (Microsoft Corporation) [1] 2009-02-06 09:39:29 227840 C:\WINDOWS\SoftwareDistribution\Download\51401b498f4675531d9efb941ee01ef3\SP2GDR\wmiprvse.exe (Microsoft Corporation) [1] 2009-02-06 02:41:05 227840 C:\WINDOWS\SoftwareDistribution\Download\51401b498f4675531d9efb941ee01ef3\SP2QFE\wmiprvse.exe (Microsoft Corporation) [1] 2009-02-06 03:10:02 227840 C:\WINDOWS\SoftwareDistribution\Download\51401b498f4675531d9efb941ee01ef3\SP3GDR\wmiprvse.exe (Microsoft Corporation) [1] 2009-02-06 03:15:13 227840 C:\WINDOWS\SoftwareDistribution\Download\51401b498f4675531d9efb941ee01ef3\SP3QFE\wmiprvse.exe (Microsoft Corporation) [1] 2009-02-06 03:10:02 227840 C:\WINDOWS\system32\dllcache\wmiprvse.exe (Microsoft Corporation) [1] 2009-02-06 03:10:02 227840 C:\WINDOWS\system32\wbem\wmiprvse.exe () Finished! |
|
|
|
|
09-04-2009, 03:37 PM
|
#19 (permalink) |
|
Registered User
Join Date: Sep 2009
Location: Southeast Louisiana: Bayou Country
Posts: 37
OS: Windows Vista Home Premium
|
Re: Monopod/a.exe/b.exe/etc...Can't run DDS, etc!
Here is the junction log:
Junction v1.05 - Windows junction creator and reparse point viewer Copyright (C) 2000-2007 Mark Russinovich Systems Internals - http://www.sysinternals.com Failed to open \\?\c:\\pagefile.sys: The process cannot access the file because it is being used by another process. ... ... . Failed to open \\?\c:\\Documents and Settings\student\Desktop\gmer.exe: Access is denied. Failed to open \\?\c:\\Documents and Settings\student\Desktop\mrt.exe: Access is denied. Failed to open \\?\c:\\Documents and Settings\student\Desktop\OTL.exe: Access is denied. Failed to open \\?\c:\\Documents and Settings\student\Desktop\RSIT (DDS).exe: Access is denied. . Failed to open \\?\c:\\Documents and Settings\student\Local Settings\Application Data\Microsoft\CardSpace\CardSpace.db: Access is denied. Failed to open \\?\c:\\Documents and Settings\student\Local Settings\Application Data\Microsoft\CardSpace\CardSpace.db.shadow: Access is denied. . . Failed to open \\?\c:\\Documents and Settings\student\My Documents\My ooVoo\mrt.exe: Access is denied. Failed to open \\?\c:\\Documents and Settings\student\My Documents\My Received Files\mrt.exe: Access is denied. Failed to open \\?\c:\\Documents and Settings\student\My Documents\MySpaceIM Pics\mrt.exe: Access is denied. .. ... ... ... ... ... ... ... .. Failed to open \\?\c:\\Program Files\ErrorSmart\ErrorSmart.exe: Access is denied. . . Failed to open \\?\c:\\Program Files\Internet Explorer\iexplore.exe: Access is denied. .. ... ... Failed to open \\?\c:\\Program Files\Malwarebytes' Anti-Malware\mbam.exe: Access is denied. ... ... ... ... . Failed to open \\?\c:\\Program Files\trend micro\student.exe: Access is denied. .. .. Failed to open \\?\c:\\System Volume Information\MountPointManagerRemoteDatabase: Access is denied. . ... ... ... ... ... ... ... ... ... ... ... Failed to open \\?\c:\\WINDOWS\system32\MRT.exe: Access is denied. ... ... .. Failed to open \\?\c:\\WINDOWS\system32\wbem\wmiprvse.exe: Access is denied. .No reparse points found. |
|
|
|
|
09-04-2009, 03:40 PM
|
#20 (permalink) |
|
Registered User
Join Date: Sep 2009
Location: Southeast Louisiana: Bayou Country
Posts: 37
OS: Windows Vista Home Premium
|
Re: Monopod/a.exe/b.exe/etc...Can't run DDS, etc!
This is the Qoobox log:
2007 Microsoft Office Suite Service Pack 1 (SP1) Adobe Flash Player 10 ActiveX Adobe Flash Player 10 Plugin Adobe Reader 8.1.6 Adobe Shockwave Player 11.5 Apple Mobile Device Support Apple Software Update ArcSoft WebCam Companion 2 Are You Smarter Than A 5th Grader (remove only) ATI - Software Uninstall Utility ATI Catalyst Control Center ATI Display Driver Bluetooth Stack for Windows by Toshiba Broadcom Gigabit Integrated Controller CCleaner (remove only) Cisco Network Magic Conexant HDA D330 MDC V.92 Modem Critical Update for Windows Media Player 11 (KB959772) Dell Resource CD Dell Touchpad Dell Wireless WLAN Card Download Updater (AOL LLC) ErrorSmart Family Feud (remove only) Fishdom (remove only) FUJIFILM FinePixViewer S Ver.2.1 Google Chrome Google Update Helper High Definition Audio Driver Package - KB835221 HijackThis 2.0.2 Hotfix for Microsoft .NET Framework 3.0 (KB932471) Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595) Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484) Hotfix for Windows Internet Explorer 7 (KB947864) Hotfix for Windows Media Format 11 SDK (KB929399) Hotfix for Windows Media Player 11 (KB939683) Hotfix for Windows XP (KB952287) Hotfix for Windows XP (KB961118) Hotfix for Windows XP (KB970653-v3) iWin Games (remove only) Java(TM) 6 Update 15 Java(TM) 6 Update 3 Java(TM) 6 Update 7 Lexmark 2500 Series Logitech Legacy USB Camera Driver Package Logitech QuickCam Driver Package Logitech Updater Lost in Reefs (remove only) Malwarebytes' Anti-Malware Microsoft .NET Framework 1.1 Microsoft .NET Framework 1.1 Hotfix (KB928366) Microsoft .NET Framework 2.0 Service Pack 2 Microsoft .NET Framework 3.0 Service Pack 2 Microsoft .NET Framework 3.5 SP1 Microsoft Base Smart Card Cryptographic Service Provider Package Microsoft Compression Client Pack 1.0 for Windows XP Microsoft Internationalized Domain Names Mitigation APIs Microsoft Kernel-Mode Driver Framework Feature Pack 1.5 Microsoft National Language Support Downlevel APIs Microsoft Office Access MUI (English) 2007 Microsoft Office Access Setup Metadata MUI (English) 2007 Microsoft Office Enterprise 2007 Microsoft Office Excel MUI (English) 2007 Microsoft Office Groove MUI (English) 2007 Microsoft Office Groove Setup Metadata MUI (English) 2007 Microsoft Office InfoPath MUI (English) 2007 Microsoft Office OneNote MUI (English) 2007 Microsoft Office Outlook MUI (English) 2007 Microsoft Office PowerPoint MUI (English) 2007 Microsoft Office Proof (English) 2007 Microsoft Office Proof (French) 2007 Microsoft Office Proof (Spanish) 2007 Microsoft Office Proofing (English) 2007 Microsoft Office Publisher MUI (English) 2007 Microsoft Office Shared MUI (English) 2007 Microsoft Office Shared Setup Metadata MUI (English) 2007 Microsoft Office Word MUI (English) 2007 Microsoft Silverlight Microsoft Software Update for Web Folders (English) 12 Microsoft User-Mode Driver Framework Feature Pack 1.0 Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 Microsoft Visual C++ 2005 Redistributable MigoSync Mozilla Firefox (3.5.2) MSN MSXML 4.0 SP2 (KB936181) MSXML 4.0 SP2 (KB954430) MSXML 6.0 Parser (KB933579) MySpaceIM Mystery PI: Lost in Los Angeles (remove only) NetWaiting Network Magic ooVoo Pageant Princess (remove only) Pure Networks Platform QuickSet QuickTime RealPlayer Rhapsody Player Engine Security Update for 2007 Microsoft Office System (KB951550) Security Update for 2007 Microsoft Office System (KB951944) Security Update for 2007 Microsoft Office System (KB969559) Security Update for 2007 Microsoft Office System (KB969679) Security Update for CAPICOM (KB931906) Security Update for Microsoft Office Excel 2007 (KB969682) Security Update for Microsoft Office OneNote 2007 (KB950130) Security Update for Microsoft Office PowerPoint 2007 (KB957789) Security Update for Microsoft Office Publisher 2007 (KB969693) Security Update for Microsoft Office system 2007 (KB954326) Security Update for Microsoft Office system 2007 (KB969613) Security Update for Microsoft Office Word 2007 (KB969604) Security Update for Visio 2007 (KB947590) Security Update for Windows Internet Explorer 7 (KB938127) Security Update for Windows Internet Explorer 7 (KB942615) Security Update for Windows Internet Explorer 7 (KB950759) Security Update for Windows Internet Explorer 7 (KB956390) Security Update for Windows Internet Explorer 7 (KB958215) Security Update for Windows Internet Explorer 7 (KB960714) Security Update for Windows Internet Explorer 7 (KB961260) Security Update for Windows Internet Explorer 7 (KB963027) Security Update for Windows Internet Explorer 7 (KB969897) Security Update for Windows Internet Explorer 8 (KB969897) Security Update for Windows Internet Explorer 8 (KB972260) Security Update for Windows Media Player (KB952069) Security Update for Windows Media Player (KB973540) Security Update for Windows Media Player 11 (KB936782) Security Update for Windows Media Player 11 (KB954154) Security Update for Windows XP (KB923561) Security Update for Windows XP (KB923789) Security Update for Windows XP (KB938464-v2) Security Update for Windows XP (KB938464) Security Update for Windows XP (KB941569) Security Update for Windows XP (KB946648) Security Update for Windows XP (KB950760) Security Update for Windows XP (KB950762) Security Update for Windows XP (KB950974) Security Update for Windows XP (KB951066) Security Update for Windows XP (KB951376-v2) Security Update for Windows XP (KB951376) Security Update for Windows XP (KB951698) Security Update for Windows XP (KB951748) Security Update for Windows XP (KB952004) Security Update for Windows XP (KB952954) Security Update for Windows XP (KB954211) Security Update for Windows XP (KB954459) Security Update for Windows XP (KB954600) Security Update for Windows XP (KB955069) Security Update for Windows XP (KB956391) Security Update for Windows XP (KB956572) Security Update for Windows XP (KB956744) Security Update for Windows XP (KB956802) Security Update for Windows XP (KB956803) Security Update for Windows XP (KB956841) Security Update for Windows XP (KB957095) Security Update for Windows XP (KB957097) Security Update for Windows XP (KB958644) Security Update for Windows XP (KB958687) Security Update for Windows XP (KB958690) Security Update for Windows XP (KB959426) Security Update for Windows XP (KB960225) Security Update for Windows XP (KB960715) Security Update for Windows XP (KB960803) Security Update for Windows XP (KB960859) Security Update for Windows XP (KB961371) Security Update for Windows XP (KB961373) Security Update for Windows XP (KB961501) Security Update for Windows XP (KB968537) Security Update for Windows XP (KB969898) Security Update for Windows XP (KB970238) Security Update for Windows XP (KB971557) Security Update for Windows XP (KB971633) Security Update for Windows XP (KB971657) Security Update for Windows XP (KB973346) Security Update for Windows XP (KB973354) Security Update for Windows XP (KB973507) Security Update for Windows XP (KB973869) SigmaTel Audio SpywareBlaster 4.2 The Hidden Object Show 2 (remove only) Update for 2007 Microsoft Office System (KB967642) Update for Microsoft .NET Framework 3.5 SP1 (KB963707) Update for Microsoft Office Outlook 2007 (KB969907) Update for Outlook 2007 Junk Email Filter (kb972691) Update for Windows XP (KB951072-v2) Update for Windows XP (KB951978) Update for Windows XP (KB955839) Update for Windows XP (KB967715) Update for Windows XP (KB968389) Update for Windows XP (KB973815) Webcam 2200 WebEx Support Manager for Internet Explorer WebFldrs XP Windows Imaging Component Windows Internet Explorer 8 Windows Live OneCare safety scanner Windows Media Format 11 runtime Windows Media Format SDK Hotfix - KB891122 Windows Media Player 11 Windows Presentation Foundation Windows Rights Management Client Backwards Compatibility SP2 Windows Rights Management Client with Service Pack 2 Windows XP Service Pack 3 WinZip Womens Murder Club Death In Scarlet (remove only) Xmarks for IE Yahoo! Messenger Yahoo! Toolbar |
|
|
|
| Thread Tools | |
|
|
