Go Back   Tech Support Forum > Security Center > Virus/Trojan/Spyware Help > Resolved HJT Threads

User Tag List

ise32 pop up on startup / malware

This is a discussion on ise32 pop up on startup / malware within the Resolved HJT Threads forums, part of the Tech Support Forum category. Over the past two month I have been getting an ise32 pop up window on the start up of my


 
 
Thread Tools Search this Thread
Old 01-31-2009, 05:53 PM   #1
Guest
 
Join Date: Jan 2009
Posts: 11
OS:



Over the past two month I have been getting an ise32 pop up window on the start up of my windows vista operating system. I believe it happened when I was downloading 'fun' applications/tools to enhance my Firefox and Explorer websurfing. (Things like Fast Dial etc.) Not sure, but that is when I noticed the pop up message. I have recently found out this is malware and could be getting into my computer through a back door or something. I need help on how to remove this from my computer.
Attached are the required documents per yoru instructions and pasted below is the dds.txt. Thanks.


DDS (Ver_09-01-19.01) - NTFSx86
Run by Wencke at 18:07:59.44 on Sat 01/31/2009
Internet Explorer: 7.0.6001.18000 BrowserJavaVersion: 1.6.0_11
Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.1.1033.18.1982.930 [GMT -7:00]

AV: Norton Internet Security *On-access scanning enabled* (Outdated)
FW: Norton Internet Security *enabled*

============== Running Processes ===============

C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k rpcss
C:\Windows\System32\svchost.exe -k secsvcs
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\WacomTouchService.exe
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\system32\WLANExt.exe
C:\Windows\System32\spoolsv.exe
c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\DigitalPersona\Bin\DpHostW.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\taskeng.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Program Files\HP\QuickPlay\Kernel\TV\QPCapSvc.exe
C:\Windows\SYSTEM32\WISPTIS.EXE
C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\Program Files\Sling Media\SlingAgent\SlingAgentService.exe
c:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe
c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\system32\Pen_Tablet.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\Program Files\DigitalPersona\Bin\DpAgent.exe
C:\Windows\system32\taskeng.exe
C:\Windows\SYSTEM32\WISPTIS.EXE
C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe
C:\Windows\system32\Dwm.exe
C:\Windows\system32\WTablet\Pen_TabletUser.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\Pen_Tablet.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\HP\QuickPlay\QPService.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\HP\Digital Imaging\bin\HpqSRmon.exe
c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe
C:\Windows\ehome\ehtray.exe
C:\Windows\system32\wbem\wmiprvse.exe
c:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\ehome\ehmsas.exe
C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe
C:\Windows\ehome\ehsched.exe
C:\ProgramData\Macrovision\FLEXnet Connect\6\ISUSPM.exe
C:\Program Files\Hewlett-Packard\HP wireless Assistant\WiFiMsg.EXE
C:\Windows\ehome\ehRecvr.exe
c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe
C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\eFax Messenger 4.2\J2GTray.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\System32\svchost.exe -k swprv
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe
C:\Users\Wencke\Downloads\dds(2).com

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.google.com/webhp
uDefault_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=81&bd=Pavilion&pf=laptop
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=81&bd=Pavilion&pf=laptop
mDefault_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=81&bd=Pavilion&pf=laptop
BHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\progra~1\yahoo!\companion\installs\cpn0\yt.dll
BHO: NoExplorer - No File
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: Yahoo! IE Services Button: {5bab4b5b-68bc-4b02-94d6-2fc0de4a7897} - c:\program files\yahoo!\common\yiesrvc.dll
BHO: NCO 2.0 IE BHO: {602adb0e-4aff-4217-8aa1-95dac4dfa408} - c:\program files\common files\symantec shared\coshared\browser\2.0\coIEPlg.dll
BHO: Symantec Intrusion Prevention: {6d53ec84-6aae-4787-aeee-f4628f01010c} - c:\progra~1\common~1\symant~1\ids\IPSBHO.dll
BHO: Java(tm) Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre6\bin\ssv.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: HP Print Clips: {ffffffff-ff12-44c5-91ec-068e3aa1b2d7} - c:\program files\hp\smart web printing\hpswp_framework.dll
TB: Show Norton Toolbar: {7febefe3-6b19-4349-98d2-ffb09d4b49ca} - c:\program files\common files\symantec shared\coshared\browser\2.0\CoIEPlg.dll
TB: Yahoo! ¤u¨ă¦C: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\progra~1\yahoo!\companion\installs\cpn0\yt.dll
uRun: [Sidebar] c:\program files\windows sidebar\sidebar.exe /autoRun
uRun: [LightScribe Control Panel] c:\program files\common files\lightscribe\LightScribeControlPanel.exe -hidden
uRun: [ehTray.exe] c:\windows\ehome\ehTray.exe
uRun: [Yahoo! Pager] "c:\progra~1\yahoo!\messen~1\YAHOOM~1.EXE" -quiet
uRun: [Speech Recognition] "c:\windows\speech\common\sapisvr.exe" -SpeechUX -Startup
uRun: [ISUSPM] "c:\programdata\macrovision\flexnet connect\6\ISUSPM.exe" -scheduler
uRun: [Internet Security Service] c:\restore\s-1-5-21-1482476501-1644491937-682003330-1013\ise32.exe
uRun: [LaunchList] c:\program files\pinnacle\studio 11\LaunchList2.exe
uRun: [WMPNSCFG] c:\program files\windows media player\WMPNSCFG.exe
mRun: [NvSvc] RUNDLL32.EXE c:\windows\system32\nvsvc.dll,nvsvcStart
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRun: [SynTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe
mRun: [SMSERIAL] c:\program files\motorola\smserial\sm56hlpr.exe
mRun: [RtHDVCpl] RtHDVCpl.exe
mRun: [QPService] "c:\program files\hp\quickplay\QPService.exe"
mRun: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
mRun: [UCam_Menu] "c:\program files\cyberlink\youcam\muitransfer\muistartmenu.exe" "c:\program files\cyberlink\youcam" update "software\cyberlink\youcam\1.0"
mRun: [DpAgent] c:\program files\digitalpersona\bin\dpagent.exe
mRun: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
mRun: [ccApp] "c:\program files\common files\symantec shared\ccApp.exe"
mRun: [hpqSRMon] c:\program files\hp\digital imaging\bin\hpqSRMon.exe
mRun: [HP Health Check Scheduler] c:\program files\hewlett-packard\hp health check\HPHC_Scheduler.exe
mRun: [hpWirelessAssistant] c:\program files\hewlett-packard\hp wireless assistant\HPWAMain.exe
mRun: [masqform.exe] c:\program files\pureedge\viewer 6.5\masqform.exe -RunOnce
mRun: [eFax 4.2] "c:\program files\efax messenger 4.2\J2GDllCmd.exe" /R
mRun: [HP Software Update] c:\program files\hp\hp software update\HPWuSchd2.exe
mRun: [AppleSyncNotifier] c:\program files\common files\apple\mobile device support\bin\AppleSyncNotifier.exe
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 8.0\reader\Reader_sl.exe"
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\adobeg~1.lnk - c:\program files\common files\adobe\calibration\Adobe Gamma Loader.exe
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\efax42~1.lnk - c:\program files\efax messenger 4.2\J2GTray.exe
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\eventr~1.lnk - c:\program files\broderbund\printmaster\pmremind.exe
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: {58ECB495-38F0-49cb-A538-10282ABF65E7} - {A93C41D8-01F8-4F8B-B14C-DE20B117E636} - c:\program files\hp\smart web printing\hpswp_extensions.dll
IE: {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - c:\program files\yahoo!\common\yiesrvc.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab
Handler: junomsg - {C4D10830-379D-11d4-9B2D-00C04F1579A5} - c:\program files\juno\bin\jmsgpph.dll
LSA: Notification Packages = scecli DPPWDFLT

================= FIREFOX ===================

FF - ProfilePath - c:\users\wencke\appdata\roaming\mozilla\firefox\profiles\doclf1ug.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.ut.ngb.army.mil/hro/Job%20Announcements%20Page/Job.htm
FF - component: c:\program files\mozilla firefox\components\coFFPlgn.dll
FF - plugin: c:\program files\viewpoint\viewpoint experience technology\npViewpoint.dll
FF - plugin: c:\users\wencke\appdata\roaming\mozilla\firefox\profiles\doclf1ug.default\extensions\[email protected]\platform\winnt_x86-msvc\plugins\npmnqmp07076007.dll

============= SERVICES / DRIVERS ===============

R1 IDSvix86;Symantec Intrusion Prevention Driver;c:\progra~2\symantec\defini~1\symcdata\ipsdefs\20080529.006\IDSvix86.sys [2008-5-29 261680]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\common files\symantec shared\eengine\EraserUtilRebootDrv.sys [2008-4-8 109616]
R3 SYMNDISV;SYMNDISV;c:\windows\system32\drivers\symndisv.sys [2008-6-13 41008]
R3 Wacomhidfilter;Wacom HID Filter;c:\windows\system32\drivers\wacomhidfilter.sys [2007-11-5 10536]
R3 WacomVTHid;Virtual Touch Driver;c:\windows\system32\drivers\WacomVTHid.sys [2007-2-22 11312]
R4 BcmSqlStartupSvc;Business Contact Manager SQL Server Startup Service;c:\program files\microsoft small business\business contact manager\BcmSqlStartupSvc.exe [2008-1-11 30312]
R4 LiveUpdate Notice;LiveUpdate Notice;c:\program files\common files\symantec shared\CCSVCHST.EXE [2007-8-24 149352]
R4 SlingAgentService;SlingAgent Service;c:\program files\sling media\slingagent\SlingAgentService.exe [2008-12-10 88576]
R4 TabletServicePen;TabletServicePen;c:\windows\system32\Pen_Tablet.exe [2008-2-28 1369384]
R4 WacomTouchService;Wacom Touch Service;c:\windows\system32\WacomTouchService.exe [2008-2-28 95528]
S3 COH_Mon;COH_Mon;c:\windows\system32\drivers\COH_Mon.sys [2007-5-29 23888]
S3 MSSQL$MSSMLBIZ;SQL Server (MSSMLBIZ);c:\program files\microsoft sql server\mssql.1\mssql\binn\sqlservr.exe [2008-2-26 29183504]

=============== Created Last 30 ================

2009-01-31 15:46 <DIR> --d----- c:\program files\Sun
2009-01-14 03:08 288,768 a------- c:\windows\system32\drivers\srv.sys
2009-01-05 16:18 90,112 a------- c:\windows\system32\QuickTimeVR.qtx
2009-01-05 16:18 57,344 a------- c:\windows\system32\QuickTime.qts

==================== Find3M ====================

2009-01-31 16:01 410,984 a------- c:\windows\system32\deploytk.dll
2009-01-20 10:30 27,934 a------- c:\users\wencke\appdata\roaming\nvModes.dat
2009-01-09 11:37 124,464 a------- c:\windows\system32\drivers\SYMEVENT.SYS
2009-01-09 11:37 10,635 a------- c:\windows\system32\drivers\SYMEVENT.CAT
2009-01-09 11:37 806 a------- c:\windows\system32\drivers\SYMEVENT.INF
2008-11-22 15:37 143,360 a------- c:\windows\inf\infstrng.dat
2008-11-22 15:37 51,200 a------- c:\windows\inf\infpub.dat
2008-11-22 15:37 86,016 a------- c:\windows\inf\infstor.dat
2008-06-16 07:01 665,600 a------- c:\windows\inf\drvindex.dat
2008-01-20 19:43 174 a--sh--- c:\program files\desktop.ini
2006-11-02 05:42 287,440 a------- c:\windows\inf\perflib\0409\perfi.dat
2006-11-02 05:42 287,440 a------- c:\windows\inf\perflib\0409\perfh.dat
2006-11-02 05:42 30,674 a------- c:\windows\inf\perflib\0409\perfd.dat
2006-11-02 05:42 30,674 a------- c:\windows\inf\perflib\0409\perfc.dat
2006-11-02 02:20 287,440 a------- c:\windows\inf\perflib\0000\perfi.dat
2006-11-02 02:20 287,440 a------- c:\windows\inf\perflib\0000\perfh.dat
2006-11-02 02:20 30,674 a------- c:\windows\inf\perflib\0000\perfd.dat
2006-11-02 02:20 30,674 a------- c:\windows\inf\perflib\0000\perfc.dat
2008-06-06 08:45 16,384 a--sh--- c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\windows\history\history.ie5\index.dat
2008-06-06 08:45 32,768 a--sh--- c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\windows\temporary internet files\content.ie5\index.dat
2008-06-06 08:45 16,384 a--sh--- c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\windows\cookies\index.dat

============= FINISH: 18:08:24.89 ===============
Attached Files
File Type: zip Attach.zip (5.4 KB, 13 views)
notonjuno is offline  
Sponsored Links
Advertisement
 
Old 02-04-2009, 09:19 AM   #2
Guest
 
Join Date: Jan 2009
Posts: 11
OS:



Hello... ? Anyone out there that can help me with this? It's been 3 days. I was just checking back.
notonjuno is offline  
Old 02-04-2009, 12:12 PM   #3
TSF Security Manager
Emeritus
 
tetonbob's Avatar
 
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 52,197
OS: XP Pro; XP Home; Win7 x86 & x64



Hello and Welcome. Please subscribe to this thread to get immediate notification of replies as soon as they are posted. To do this click Thread Tools, then click Subscribe to this Thread. Make sure it is set to Instant Notification, then click Subscribe.

Before beginning the fix, read this post completely. If there's anything that you do not understand, kindly ask your questions before proceeding. It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence.

---------------------------------------------------------------------------------------------

You have a variant of a bot infection showing in your log.

W32.IRCBot is a back door Trojan horse that connects to an IRC server and awaits commands from a remote attacker, including spreading through network shares, spam email messages, IRC channels and to other computers.

Even though the Virus has been identified and can be killed, because of it's backdoor functionality, there is no way to be sure what information has been stolen from your system. If you do any banking or have recently paid for goods or services online you will need to change all passwords from a clean computer, and it would be wise to contact your bank or credit card company to inform them of your situation. This also applies to passwords for any confidential sites you use such as Paypal, Ebay, Email etc... The infection you have has the ability to download and execute files, log keystrokes, Redirect connections, Sniff sent packets for information & Steal personal information so it is a very serious threat.

---------------------------------------------------------------------------------------------

Please note that these fixes are not instantaneous. Most infections require more than one round to properly eradicate.

Stay with me until given the 'all clear' even if symptoms diminish. Lack of symptoms does not always mean the job is complete.

Kindly follow my instructions and please do no fixing on your own or running of scanners unless requested by me or another helper at this forum.

---------------------------------------------------------------------------------------------

Please visit this webpage for download links, and instructions for running combofix:

https://www.bleepingcomputer.com/comb...o-use-combofix

* Ensure you have disabled all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Please include the C:\ComboFix.txt in your next reply for further review.
__________________
Practice Safe Surfing
Because what you don't know, CAN hurt you.
Proud Member of UNITE since 2006

Microsoft MVP Consumer Security 2009 - 2015
tetonbob is offline  
Sponsored Links
Advertisement
 
Old 02-05-2009, 10:05 AM   #4
Guest
 
Join Date: Jan 2009
Posts: 11
OS:



ComboFix 09-02-04.01 - Wencke 2009-02-05 10:44:42.1 - NTFSx86
Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.1.1033.18.1982.865 [GMT -7:00]
Running from: c:\users\Wencke\Desktop\ComboFix.exe
AV: Norton Internet Security *On-access scanning enabled* (Outdated)
FW: Norton Internet Security *disabled*
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\restore\S-1-5-21-1482476501-1644491937-682003330-1013
c:\restore\S-1-5-21-1482476501-1644491937-682003330-1013\Desktop.ini
c:\restore\S-1-5-21-1482476501-1644491937-682003330-1013\ise32.exe
c:\windows\system32\KBL.LOG

.
((((((((((((((((((((((((( Files Created from 2009-01-05 to 2009-02-05 )))))))))))))))))))))))))))))))
.

2009-02-04 23:39 . 2009-02-04 23:39 <DIR> d-------- c:\program files\Western Digital Technologies
2009-02-04 02:10 . 2009-02-04 02:11 314,566,630 --a------ c:\windows\MEMORY.DMP
2009-01-31 18:16 . 2009-01-31 18:16 250 --a------ c:\windows\gmer.ini
2009-01-31 15:46 . 2009-01-31 15:46 <DIR> d-------- c:\program files\Sun
2009-01-31 15:33 . 2009-01-31 15:34 <DIR> d-------- c:\program files\QuickTime
2009-01-14 03:08 . 2008-12-15 19:42 288,768 --a------ c:\windows\System32\drivers\srv.sys
2009-01-05 16:18 . 2009-01-05 16:18 90,112 --a------ c:\windows\System32\QuickTimeVR.qtx
2009-01-05 16:18 . 2009-01-05 16:18 57,344 --a------ c:\windows\System32\QuickTime.qts

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-02-05 17:49 --------- d-----w c:\users\Wencke\AppData\Roaming\WTablet
2009-02-05 06:35 --------- d-----w c:\program files\Juno
2009-01-31 23:01 410,984 ----a-w c:\windows\System32\deploytk.dll
2009-01-31 22:12 --------- d-----w c:\program files\Common Files\Adobe
2009-01-30 16:06 --------- d-----w c:\programdata\Symantec
2009-01-20 17:30 27,934 ----a-w c:\users\Wencke\AppData\Roaming\nvModes.dat
2009-01-14 15:07 --------- d-----w c:\programdata\Microsoft Help
2009-01-14 15:07 --------- d-----w c:\program files\Windows Mail
2009-01-12 23:21 --------- d-----w c:\programdata\Hewlett-Packard
2009-01-12 22:43 --------- d-----w c:\program files\Hewlett-Packard
2009-01-09 18:37 806 ----a-w c:\windows\system32\drivers\SYMEVENT.INF
2009-01-09 18:37 124,464 ----a-w c:\windows\system32\drivers\SYMEVENT.SYS
2009-01-09 18:37 10,635 ----a-w c:\windows\system32\drivers\SYMEVENT.CAT
2009-01-09 18:37 --------- d-----w c:\program files\Symantec
2008-12-30 18:53 --------- d-----w c:\program files\Java
2008-12-24 08:56 --------- d-----w c:\users\Wencke\AppData\Roaming\dvdcss
2008-01-21 02:43 174 --sha-w c:\program files\desktop.ini
2007-08-25 02:52 300,400 ----a-w c:\program files\mozilla firefox\components\coFFPlgn.dll
2008-06-06 15:45 16,384 --sha-w c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
2008-06-06 15:45 32,768 --sha-w c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
2008-06-06 15:45 16,384 --sha-w c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-01-20 1233920]
"LightScribe Control Panel"="c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe" [2007-08-23 455968]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-20 125952]
"Yahoo! Pager"="c:\progra~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" [2007-08-30 4670704]
"Speech Recognition"="c:\windows\Speech\Common\sapisvr.exe" [2008-01-20 49664]
"ISUSPM"="c:\programdata\Macrovision\FLEXnet Connect\6\ISUSPM.exe" [2007-03-29 222128]
"LaunchList"="c:\program files\Pinnacle\Studio 11\LaunchList2.exe" [2007-03-21 145496]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-20 202240]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvSvc"="c:\windows\system32\nvsvc.dll" [2007-11-07 86016]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-11-07 8501792]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-11-07 81920]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-01-18 1033512]
"SMSERIAL"="c:\program files\Motorola\SMSERIAL\sm56hlpr.exe" [2007-11-01 671744]
"QPService"="c:\program files\HP\QuickPlay\QPService.exe" [2007-12-19 468264]
"QlbCtrl"="c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2007-09-27 202032]
"UCam_Menu"="c:\program files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" [2007-09-13 222504]
"DpAgent"="c:\program files\DigitalPersona\Bin\dpagent.exe" [2007-09-20 671744]
"ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2008-10-17 51048]
"hpqSRMon"="c:\program files\HP\Digital Imaging\bin\hpqSRMon.exe" [2008-06-02 80896]
"HP Health Check Scheduler"="c:\program files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe" [2008-06-16 75008]
"hpWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2007-10-03 480560]
"masqform.exe"="c:\program files\PureEdge\Viewer 6.5\masqform.exe" [2005-07-04 643072]
"eFax 4.2"="c:\program files\eFax Messenger 4.2\J2GDllCmd.exe" [2006-07-14 107008]
"HP Software Update"="c:\program files\Hp\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-11-07 111936]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-11-20 290088]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-01-05 413696]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-01-31 136600]
"RtHDVCpl"="RtHDVCpl.exe" [2007-10-10 c:\windows\RtHDVCpl.exe]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2008-05-11 113664]
eFax 4.2.lnk - c:\program files\eFax Messenger 4.2\J2GTray.exe [2008-04-15 612352]
Event Reminder.lnk - c:\program files\Broderbund\PrintMaster\pmremind.exe [2008-12-04 331776]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.i420"= vdrcodec.dll
"msacm.l3codecp"= l3codecp.acm
"VIDC.MJPG"= Pvmjpg30.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Notification Packages REG_MULTI_SZ scecli DPPWDFLT

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UacDisableNotify"=dword:00000001
"InternetSettingsDisableNotify"=dword:00000001
"AutoUpdateDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{7D148BC7-A6F2-47B8-A85C-CFABB48F9E50}"= UDP:c:\program files\Common Files\AOL\Loader\aolload.exe:AOL Loader
"{6D2A8AE7-291A-4214-AA53-3E5AD10D7ED9}"= TCP:c:\program files\Common Files\AOL\Loader\aolload.exe:AOL Loader
"{4F2A2A37-5EE1-422F-9EEC-327BF80E1458}"= TCP:6004|c:\program files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook
"{1B5672BB-6574-4E3C-AEBF-82C18766A6BA}"= c:\program files\Cyberlink\PowerDirector\PDR.EXE:CyberLink PowerDirector
"{19EB87CA-1E68-4220-9B55-6AF0742BBB9F}"= UDP:c:\program files\earthlink totalaccess\TaskPanl.exe:taskpanl
"{A19188FD-D44D-416F-8B2A-1F5913BE19B6}"= TCP:c:\program files\earthlink totalaccess\TaskPanl.exe:taskpanl
"{D0CB2D1C-D06F-4790-B809-611F1806ECF5}"= UDP:c:\program files\earthlink totalaccess\TaskPanl.exe:taskpanl
"{2477D870-439F-4124-81CC-4A804F8491EB}"= TCP:c:\program files\earthlink totalaccess\TaskPanl.exe:taskpanl
"{1B5C953F-DAC7-440B-B9DD-CBE986C481E5}"= UDP:c:\program files\earthlink totalaccess\TaskPanl.exe:taskpanl
"{6FBC9E6E-7FBF-4715-B005-5D69FAE76293}"= TCP:c:\program files\earthlink totalaccess\TaskPanl.exe:taskpanl
"{D7B0980B-6BA9-412B-9821-C5E8580CE5B3}"= c:\program files\HP\QuickPlay\QP.exe:Quick Play
"{C462F09D-5D73-46DC-A263-A39431AB3226}"= c:\program files\HP\QuickPlay\QPService.exe:Quick Play Resident Program
"{0606D2BC-F6D4-48D5-A61C-338D6EA4533A}"= UDP:c:\program files\Yahoo!\Messenger\YahooMessenger.exe:Yahoo! Messenger
"{9342934F-F7A9-4118-A01D-81220A060616}"= TCP:c:\program files\Yahoo!\Messenger\YahooMessenger.exe:Yahoo! Messenger
"{A8375D77-CC85-4838-92A7-F15F9F88E7F0}"= UDP:c:\program files\Yahoo!\Messenger\YServer.exe:Yahoo! FT Server
"{5D5E3A9E-7158-4732-9BEE-DBF5B65938F3}"= TCP:c:\program files\Yahoo!\Messenger\YServer.exe:Yahoo! FT Server
"{42B27562-6C88-4615-AD66-8F538216E298}"= UDP:c:\program files\123Movies2IPOD 2008\123Movies2IPOD.exe:123Movies2iPOD 2008
"{73C29E37-1D21-402E-8511-DA0CFA5B9056}"= UDP:c:\program files\123Movies2IPOD 2008\123Movies2IPOD.exe:123Movies2iPOD 2008
"{869BC6D0-D380-4A2D-82F1-B8C2EE9A7B68}"= TCP:c:\program files\123Movies2IPOD 2008\123Movies2IPOD.exe:123Movies2iPOD 2008
"{B1344F0B-977F-4EBB-82B3-64D9DFDBB3E2}"= TCP:c:\program files\123Movies2IPOD 2008\123Movies2IPOD.exe:123Movies2iPOD 2008
"{1CFB1724-46DE-4DE7-A371-8656588B18B4}"= UDP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{81ED752D-4392-43B1-B5C6-65165449A810}"= TCP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{003FCFEE-8A77-431F-BC0E-DC6E68BAF1FB}"= UDP:c:\program files\123Movies2IPOD 2009\123Movies2IPOD.exe:123Movies2iPOD 2009
"{183297E5-D39C-49D0-A24B-34771264189C}"= UDP:c:\program files\123Movies2IPOD 2009\123Movies2IPOD.exe:123Movies2iPOD 2009
"{8192690F-D046-4EBB-9F43-EE1797709ECB}"= TCP:c:\program files\123Movies2IPOD 2009\123Movies2IPOD.exe:123Movies2iPOD 2009
"{882CF40C-887C-47F0-8481-CB58137F8C1A}"= TCP:c:\program files\123Movies2IPOD 2009\123Movies2IPOD.exe:123Movies2iPOD 2009
"{72E4B7F3-7BC4-4CBF-8EED-375AA4F595AA}"= UDP:c:\program files\Pinnacle\Studio 11\programs\RM.exe:Render Manager
"{990CFEBC-B99A-40C8-91EB-BC4D516D4571}"= TCP:c:\program files\Pinnacle\Studio 11\programs\RM.exe:Render Manager
"{2ECADBCE-C0C1-4144-A515-9996AC31FA4B}"= UDP:c:\program files\Pinnacle\Studio 11\programs\Studio.exe:Studio
"{785327E6-666C-447E-998E-F5F88028C00E}"= TCP:c:\program files\Pinnacle\Studio 11\programs\Studio.exe:Studio
"{50BD0E40-7D08-426E-A7EE-4D71CA59CBD0}"= UDP:c:\program files\Pinnacle\Studio 11\programs\PMSRegisterFile.exe:PMSRegisterFile
"{BF659AF2-254E-470A-BD21-F9F07FCEFDDA}"= TCP:c:\program files\Pinnacle\Studio 11\programs\PMSRegisterFile.exe:PMSRegisterFile
"{8B1D9D9A-7698-4016-B9FB-165601E18C5C}"= UDP:c:\program files\Pinnacle\Studio 11\programs\umi.exe:umi
"{B4FB3D92-E3B9-4D98-8BA7-8AA5571CE90F}"= TCP:c:\program files\Pinnacle\Studio 11\programs\umi.exe:umi
"{9CF1F067-2EDF-4BEE-9910-1EA25BE06202}"= UDP:c:\program files\iTunes\iTunes.exe:iTunes
"{7F16935E-08E9-46C3-8DFC-A11B1986CE00}"= TCP:c:\program files\iTunes\iTunes.exe:iTunes
"{5AB692D9-E056-465E-B036-BD55F137FDE9}"= UDP:c:\program files\iTunes\iTunes.exe:iTunes
"{01862EE4-24F9-49C7-91B5-E5EB8E5EB3B6}"= TCP:c:\program files\iTunes\iTunes.exe:iTunes

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile\AuthorizedApplications\List]
"c:\\Program Files\\EarthLink TotalAccess\\TaskPanl.exe"= c:\program files\EarthLink TotalAccess\TaskPanl.exe:*:Enabled:Earthlink

R1 IDSvix86;Symantec Intrusion Prevention Driver;c:\progra~2\Symantec\DEFINI~1\SymcData\ipsdefs\20080529.006\IDSvix86.sys [2008-05-29 261680]
R2 BcmSqlStartupSvc;Business Contact Manager SQL Server Startup Service;c:\program files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe [2008-01-11 30312]
R2 LiveUpdate Notice;LiveUpdate Notice;c:\program files\Common Files\Symantec Shared\CCSVCHST.EXE [2007-08-24 149352]
R2 SlingAgentService;SlingAgent Service;c:\program files\Sling Media\SlingAgent\SlingAgentService.exe [2008-12-10 88576]
R2 TabletServicePen;TabletServicePen;c:\windows\System32\Pen_Tablet.exe [2008-02-28 1369384]
R2 WacomTouchService;Wacom Touch Service;c:\windows\System32\WacomTouchService.exe [2008-02-28 95528]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2008-04-08 109616]
R3 SYMNDISV;SYMNDISV;c:\windows\System32\drivers\symndisv.sys [2008-06-13 41008]
R3 Wacomhidfilter;Wacom HID Filter;c:\windows\System32\drivers\wacomhidfilter.sys [2007-11-05 10536]
R3 WacomVTHid;Virtual Touch Driver;c:\windows\System32\drivers\WacomVTHid.sys [2007-02-22 11312]
S3 COH_Mon;COH_Mon;c:\windows\System32\drivers\COH_Mon.sys [2007-05-29 23888]
S3 MSSQL$MSSMLBIZ;SQL Server (MSSMLBIZ);c:\program files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2008-02-26 29183504]

--- Other Services/Drivers In Memory ---

*NewlyCreated* - COMHOST

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{4cb8462a-125a-11dd-835b-001e683be5ef}]
\shell\AutoRun\command - h:\restore\S-1-5-21-1482476501-1644491937-682003330-1013\ise32.exe
\shell\open\command - h:\restore\S-1-5-21-1482476501-1644491937-682003330-1013\ise32.exe

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
"c:\program files\Common Files\LightScribe\LSRunOnce.exe"
.
Contents of the 'Scheduled Tasks' folder

2009-02-03 c:\windows\Tasks\Norton Internet Security - Run Full System Scan - Wencke.job
- c:\program files\Norton Internet Security\Norton AntiVirus\Navw32.exe [2007-08-26 17:19]

2009-02-05 c:\windows\Tasks\User_Feed_Synchronization-{2CCE5A98-749A-4501-973D-8B79417B73B6}.job
- c:\windows\system32\msfeedssync.exe [2008-01-20 19:24]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/webhp
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=81&bd=Pavilion&pf=laptop
FF - ProfilePath - c:\users\Wencke\AppData\Roaming\Mozilla\Firefox\Profiles\doclf1ug.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.ut.ngb.army.mil/hro/Job%20Announcements%20Page/Job.htm
FF - component: c:\program files\Mozilla Firefox\components\coFFPlgn.dll
FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll
FF - plugin: c:\users\Wencke\AppData\Roaming\Mozilla\Firefox\Profiles\doclf1ug.default\extensions\[email protected]\platform\WINNT_x86-msvc\plugins\npmnqmp07076007.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, https://www.gmer.net
Rootkit scan 2009-02-05 10:51:21
Windows 6.0.6001 Service Pack 1 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'lsass.exe'(692)
c:\windows\system32\DPPWDFLT.dll

- - - - - - - > 'Explorer.exe'(5944)
c:\program files\DigitalPersona\Bin\DpoFeedb.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\System32\audiodg.exe
c:\windows\System32\wlanext.exe
c:\program files\DigitalPersona\Bin\DpHostW.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\program files\HP\QuickPlay\Kernel\TV\QPCapSvc.exe
c:\program files\CyberLink\Shared Files\RichVideo.exe
c:\program files\Microsoft SQL Server\90\Shared\sqlbrowser.exe
c:\program files\Microsoft SQL Server\90\Shared\sqlwriter.exe
c:\program files\Hewlett-Packard\Shared\hpqWmiEx.exe
c:\program files\HP\QuickPlay\Kernel\TV\QPSched.exe
c:\windows\System32\wisptis.exe
c:\program files\Common Files\microsoft shared\ink\TabTip.exe
c:\windows\System32\wisptis.exe
c:\program files\Common Files\microsoft shared\ink\TabTip.exe
c:\windows\System32\WTablet\Pen_TabletUser.exe
c:\windows\System32\rundll32.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\windows\ehome\ehmsas.exe
c:\windows\ehome\ehsched.exe
c:\program files\Symantec\LiveUpdate\AluSchedulerSvc.exe
c:\program files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
c:\windows\ehome\ehrecvr.exe
c:\program files\iPod\bin\iPodService.exe
c:\program files\Hewlett-Packard\HP Health Check\HPHC_Service.exe
c:\windows\System32\rundll32.exe
c:\program files\Common Files\microsoft shared\ink\InputPersonalization.exe
c:\program files\Synaptics\SynTP\SynTPHelper.exe
c:\program files\Yahoo!\Messenger\Ymsgr_tray.exe
.
**************************************************************************
.
Completion time: 2009-02-05 10:58:43 - machine was rebooted [Wencke]
ComboFix-quarantined-files.txt 2009-02-05 17:58:31

Pre-Run: 77,073,113,088 bytes free
Post-Run: 77,136,490,496 bytes free

245 --- E O F --- 2009-02-05 17:38:47
notonjuno is offline  
Old 02-05-2009, 10:08 AM   #5
Guest
 
Join Date: Jan 2009
Posts: 11
OS:



I just pasted the info. I can't recall and find the button to zip it and attach it. Do you need it that way?

And let me thank you in advance. (And I'll stay with each step and thank you at the end too.)

Thanks
notonjuno is offline  
Old 02-05-2009, 10:37 AM   #6
TSF Security Manager
Emeritus
 
tetonbob's Avatar
 
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 52,197
OS: XP Pro; XP Home; Win7 x86 & x64



Pasting the info is just fine, thanks.

Before we continue, I have a question.

What is your H Drive? Is it a removable media of some sort, or a network drive?
__________________
Practice Safe Surfing
Because what you don't know, CAN hurt you.
Proud Member of UNITE since 2006

Microsoft MVP Consumer Security 2009 - 2015
tetonbob is offline  
Old 02-05-2009, 04:30 PM   #7
Guest
 
Join Date: Jan 2009
Posts: 11
OS:



To tell you the truth... I do not know what the H: drive is.
I usually have an external drive plugged in, but I believe when I ran the big fix, I unplugged it. So just now, I plugged it in the three USB ports I have.. 2 in the back read it as G if I plug it in. the one on the side reads it as E. When I plug in my multi card reader in the back (with the extgernal hard drive still plugged in, drives: F, I, J, K appear. Leaving all that plugged in and plugging in a thumb drive on the side, now reads an H drive. hmm. I thought when I ran the big fix this evening, nothing was plugged in (I could be wrong, yesterday I plugged it in to back up my stuff). Maybe when I ran the original reports I had stuff plugged in. Does this all make sense? Should I run the reports again?
notonjuno is offline  
Old 02-05-2009, 04:35 PM   #8
Guest
 
Join Date: Jan 2009
Posts: 11
OS:



P.S. I believe my USB drives are giving me a hard time. What I mean is, I can plug my external hard drive in and it says it cannot be read. Then when I move it to the side port, it reads fine. But now my external hard drive won't function at all on this Laptop. I don't know if this is involved with the malware or not. The other EXACT SAME brand new hard drive will read. So then I thought it was the drive, but I have the same problem with some thumb drives, yet it all seems to work on other PC's. Weird.
notonjuno is offline  
Old 02-05-2009, 05:22 PM   #9
TSF Security Manager
Emeritus
 
tetonbob's Avatar
 
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 52,197
OS: XP Pro; XP Home; Win7 x86 & x64



Might be an issue with that USB port.

If you would...please insert or make active the USB drives, as one of them is also infected.

Before beginning the fix, read this post completely. If there's anything that you do not understand, kindly ask your questions before proceeding. Ensure that there aren't any opened browsers when you are carrying out the procedures below. Save the following instructions in Notepad as this webpage would not be available when you're carrying out the fix.

It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence.

---------------------------------------------------------------------------------------------
  1. Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with ComboFix.
  2. Open notepad and copy/paste the text in the quotebox below into it:

    Quote:
    File::
    h:\restore\S-1-5-21-1482476501-1644491937-682003330-1013\ise32.exe

    Registry::
    [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{4cb8462a-125a-11dd-835b-001e683be5ef}]
    Save this as CFScript.txt




    Referring to the picture above, drag CFScript.txt into ComboFix.exe


  3. Your desktop may go blank. This is normal. It will return when ComboFix is done. ComboFix may reboot your machine. This is normal.
  4. When finished, it shall produce a log for you. Post that log in your next reply

    Note:
    Do not mouseclick combofix's window whilst it's running. That may cause it to stall.


    ---------------------------------------------------------------------------------------------
  5. Ensure your AntiVirus and AntiSpyware applications are re-enabled. A reboot should have done this.


    ---------------------------------------------------------------------------------------------
__________________
Practice Safe Surfing
Because what you don't know, CAN hurt you.
Proud Member of UNITE since 2006

Microsoft MVP Consumer Security 2009 - 2015
tetonbob is offline  
Old 02-05-2009, 11:10 PM   #10
Guest
 
Join Date: Jan 2009
Posts: 11
OS:



ComboFix 09-02-04.01 - Wencke 2009-02-05 23:57:31.2 - NTFSx86
Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.1.1033.18.1982.1204 [GMT -7:00]
Running from: c:\users\Wencke\Desktop\ComboFix.exe
Command switches used :: c:\users\Wencke\Desktop\CFScript.txt
AV: Norton Internet Security *On-access scanning disabled* (Outdated)
FW: Norton Internet Security *disabled*
* Created a new restore point

FILE ::
h:\restore\S-1-5-21-1482476501-1644491937-682003330-1013\ise32.exe
.

((((((((((((((((((((((((( Files Created from 2009-01-06 to 2009-02-06 )))))))))))))))))))))))))))))))
.

2009-02-04 23:39 . 2009-02-04 23:39 <DIR> d-------- c:\program files\Western Digital Technologies
2009-02-04 02:10 . 2009-02-04 02:11 314,566,630 --a------ c:\windows\MEMORY.DMP
2009-01-31 18:16 . 2009-01-31 18:16 250 --a------ c:\windows\gmer.ini
2009-01-31 15:46 . 2009-01-31 15:46 <DIR> d-------- c:\program files\Sun
2009-01-31 15:33 . 2009-01-31 15:34 <DIR> d-------- c:\program files\QuickTime
2009-01-14 03:08 . 2008-12-15 19:42 288,768 --a------ c:\windows\System32\drivers\srv.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-02-06 07:02 --------- d-----w c:\users\Wencke\AppData\Roaming\WTablet
2009-02-05 23:57 --------- d-----w c:\program files\Juno
2009-01-31 23:01 410,984 ----a-w c:\windows\System32\deploytk.dll
2009-01-31 22:12 --------- d-----w c:\program files\Common Files\Adobe
2009-01-30 16:06 --------- d-----w c:\programdata\Symantec
2009-01-20 17:30 27,934 ----a-w c:\users\Wencke\AppData\Roaming\nvModes.dat
2009-01-14 15:07 --------- d-----w c:\programdata\Microsoft Help
2009-01-14 15:07 --------- d-----w c:\program files\Windows Mail
2009-01-12 23:21 --------- d-----w c:\programdata\Hewlett-Packard
2009-01-12 22:43 --------- d-----w c:\program files\Hewlett-Packard
2009-01-09 18:37 806 ----a-w c:\windows\system32\drivers\SYMEVENT.INF
2009-01-09 18:37 124,464 ----a-w c:\windows\system32\drivers\SYMEVENT.SYS
2009-01-09 18:37 10,635 ----a-w c:\windows\system32\drivers\SYMEVENT.CAT
2009-01-09 18:37 --------- d-----w c:\program files\Symantec
2008-12-30 18:53 --------- d-----w c:\program files\Java
2008-12-24 08:56 --------- d-----w c:\users\Wencke\AppData\Roaming\dvdcss
2008-01-21 02:43 174 --sha-w c:\program files\desktop.ini
2007-08-25 02:52 300,400 ----a-w c:\program files\mozilla firefox\components\coFFPlgn.dll
2008-06-06 15:45 16,384 --sha-w c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
2008-06-06 15:45 32,768 --sha-w c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
2008-06-06 15:45 16,384 --sha-w c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
.

((((((((((((((((((((((((((((( [email protected]_10.56.47.73 )))))))))))))))))))))))))))))))))))))))))
.
- 2009-02-05 17:50:09 262,144 --sha-w c:\windows\ServiceProfiles\LocalService\NTUSER.DAT
+ 2009-02-06 07:02:57 262,144 --sha-w c:\windows\ServiceProfiles\LocalService\NTUSER.DAT
- 2009-02-05 17:50:59 262,144 --sha-w c:\windows\ServiceProfiles\NetworkService\NTUSER.DAT
+ 2009-02-06 07:03:37 262,144 --sha-w c:\windows\ServiceProfiles\NetworkService\NTUSER.DAT
- 2009-02-05 07:44:47 16,384 --sha-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2009-02-06 06:43:53 16,384 --sha-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2009-02-05 07:44:47 49,152 --sha-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2009-02-06 06:43:53 49,152 --sha-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2009-02-05 07:44:47 16,384 --sha-w c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2009-02-06 06:43:53 16,384 --sha-w c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2009-02-05 06:43:34 118,872 ----a-w c:\windows\System32\perfc009.dat
+ 2009-02-06 06:51:38 118,872 ----a-w c:\windows\System32\perfc009.dat
- 2009-02-05 06:43:34 642,392 ----a-w c:\windows\System32\perfh009.dat
+ 2009-02-06 06:51:38 642,392 ----a-w c:\windows\System32\perfh009.dat
- 2009-02-05 17:51:51 11,000 ----a-w c:\windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-108685758-2383704155-994952919-1003_UserData.bin
+ 2009-02-06 06:45:54 11,032 ----a-w c:\windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-108685758-2383704155-994952919-1003_UserData.bin
- 2009-02-05 17:51:50 90,758 ----a-w c:\windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin
+ 2009-02-06 06:45:54 90,758 ----a-w c:\windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin
- 2009-02-04 15:15:04 55,930 ----a-w c:\windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin
+ 2009-02-06 06:45:52 55,962 ----a-w c:\windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin
- 2009-02-05 17:33:31 371,842 ----a-w c:\windows\System32\WDI\SuspendPerformanceDiagnostics_SystemData_S3.bin
+ 2009-02-06 06:33:12 375,966 ----a-w c:\windows\System32\WDI\SuspendPerformanceDiagnostics_SystemData_S3.bin
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-01-20 1233920]
"LightScribe Control Panel"="c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe" [2007-08-23 455968]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-20 125952]
"Yahoo! Pager"="c:\progra~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" [2007-08-30 4670704]
"Speech Recognition"="c:\windows\Speech\Common\sapisvr.exe" [2008-01-20 49664]
"ISUSPM"="c:\programdata\Macrovision\FLEXnet Connect\6\ISUSPM.exe" [2007-03-29 222128]
"LaunchList"="c:\program files\Pinnacle\Studio 11\LaunchList2.exe" [2007-03-21 145496]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-20 202240]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvSvc"="c:\windows\system32\nvsvc.dll" [2007-11-07 86016]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-11-07 8501792]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-11-07 81920]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-01-18 1033512]
"SMSERIAL"="c:\program files\Motorola\SMSERIAL\sm56hlpr.exe" [2007-11-01 671744]
"QPService"="c:\program files\HP\QuickPlay\QPService.exe" [2007-12-19 468264]
"QlbCtrl"="c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2007-09-27 202032]
"UCam_Menu"="c:\program files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" [2007-09-13 222504]
"DpAgent"="c:\program files\DigitalPersona\Bin\dpagent.exe" [2007-09-20 671744]
"ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2008-10-17 51048]
"hpqSRMon"="c:\program files\HP\Digital Imaging\bin\hpqSRMon.exe" [2008-06-02 80896]
"HP Health Check Scheduler"="c:\program files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe" [2008-06-16 75008]
"hpWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2007-10-03 480560]
"masqform.exe"="c:\program files\PureEdge\Viewer 6.5\masqform.exe" [2005-07-04 643072]
"eFax 4.2"="c:\program files\eFax Messenger 4.2\J2GDllCmd.exe" [2006-07-14 107008]
"HP Software Update"="c:\program files\Hp\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-11-07 111936]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-11-20 290088]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-01-05 413696]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-01-31 136600]
"RtHDVCpl"="RtHDVCpl.exe" [2007-10-10 c:\windows\RtHDVCpl.exe]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2008-05-11 113664]
eFax 4.2.lnk - c:\program files\eFax Messenger 4.2\J2GTray.exe [2008-04-15 612352]
Event Reminder.lnk - c:\program files\Broderbund\PrintMaster\pmremind.exe [2008-12-04 331776]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.i420"= vdrcodec.dll
"msacm.l3codecp"= l3codecp.acm
"VIDC.MJPG"= Pvmjpg30.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Notification Packages REG_MULTI_SZ scecli DPPWDFLT

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UacDisableNotify"=dword:00000001
"InternetSettingsDisableNotify"=dword:00000001
"AutoUpdateDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{7D148BC7-A6F2-47B8-A85C-CFABB48F9E50}"= UDP:c:\program files\Common Files\AOL\Loader\aolload.exe:AOL Loader
"{6D2A8AE7-291A-4214-AA53-3E5AD10D7ED9}"= TCP:c:\program files\Common Files\AOL\Loader\aolload.exe:AOL Loader
"{4F2A2A37-5EE1-422F-9EEC-327BF80E1458}"= TCP:6004|c:\program files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook
"{1B5672BB-6574-4E3C-AEBF-82C18766A6BA}"= c:\program files\Cyberlink\PowerDirector\PDR.EXE:CyberLink PowerDirector
"{19EB87CA-1E68-4220-9B55-6AF0742BBB9F}"= UDP:c:\program files\earthlink totalaccess\TaskPanl.exe:taskpanl
"{A19188FD-D44D-416F-8B2A-1F5913BE19B6}"= TCP:c:\program files\earthlink totalaccess\TaskPanl.exe:taskpanl
"{D0CB2D1C-D06F-4790-B809-611F1806ECF5}"= UDP:c:\program files\earthlink totalaccess\TaskPanl.exe:taskpanl
"{2477D870-439F-4124-81CC-4A804F8491EB}"= TCP:c:\program files\earthlink totalaccess\TaskPanl.exe:taskpanl
"{1B5C953F-DAC7-440B-B9DD-CBE986C481E5}"= UDP:c:\program files\earthlink totalaccess\TaskPanl.exe:taskpanl
"{6FBC9E6E-7FBF-4715-B005-5D69FAE76293}"= TCP:c:\program files\earthlink totalaccess\TaskPanl.exe:taskpanl
"{D7B0980B-6BA9-412B-9821-C5E8580CE5B3}"= c:\program files\HP\QuickPlay\QP.exe:Quick Play
"{C462F09D-5D73-46DC-A263-A39431AB3226}"= c:\program files\HP\QuickPlay\QPService.exe:Quick Play Resident Program
"{0606D2BC-F6D4-48D5-A61C-338D6EA4533A}"= UDP:c:\program files\Yahoo!\Messenger\YahooMessenger.exe:Yahoo! Messenger
"{9342934F-F7A9-4118-A01D-81220A060616}"= TCP:c:\program files\Yahoo!\Messenger\YahooMessenger.exe:Yahoo! Messenger
"{A8375D77-CC85-4838-92A7-F15F9F88E7F0}"= UDP:c:\program files\Yahoo!\Messenger\YServer.exe:Yahoo! FT Server
"{5D5E3A9E-7158-4732-9BEE-DBF5B65938F3}"= TCP:c:\program files\Yahoo!\Messenger\YServer.exe:Yahoo! FT Server
"{42B27562-6C88-4615-AD66-8F538216E298}"= UDP:c:\program files\123Movies2IPOD 2008\123Movies2IPOD.exe:123Movies2iPOD 2008
"{73C29E37-1D21-402E-8511-DA0CFA5B9056}"= UDP:c:\program files\123Movies2IPOD 2008\123Movies2IPOD.exe:123Movies2iPOD 2008
"{869BC6D0-D380-4A2D-82F1-B8C2EE9A7B68}"= TCP:c:\program files\123Movies2IPOD 2008\123Movies2IPOD.exe:123Movies2iPOD 2008
"{B1344F0B-977F-4EBB-82B3-64D9DFDBB3E2}"= TCP:c:\program files\123Movies2IPOD 2008\123Movies2IPOD.exe:123Movies2iPOD 2008
"{1CFB1724-46DE-4DE7-A371-8656588B18B4}"= UDP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{81ED752D-4392-43B1-B5C6-65165449A810}"= TCP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{003FCFEE-8A77-431F-BC0E-DC6E68BAF1FB}"= UDP:c:\program files\123Movies2IPOD 2009\123Movies2IPOD.exe:123Movies2iPOD 2009
"{183297E5-D39C-49D0-A24B-34771264189C}"= UDP:c:\program files\123Movies2IPOD 2009\123Movies2IPOD.exe:123Movies2iPOD 2009
"{8192690F-D046-4EBB-9F43-EE1797709ECB}"= TCP:c:\program files\123Movies2IPOD 2009\123Movies2IPOD.exe:123Movies2iPOD 2009
"{882CF40C-887C-47F0-8481-CB58137F8C1A}"= TCP:c:\program files\123Movies2IPOD 2009\123Movies2IPOD.exe:123Movies2iPOD 2009
"{72E4B7F3-7BC4-4CBF-8EED-375AA4F595AA}"= UDP:c:\program files\Pinnacle\Studio 11\programs\RM.exe:Render Manager
"{990CFEBC-B99A-40C8-91EB-BC4D516D4571}"= TCP:c:\program files\Pinnacle\Studio 11\programs\RM.exe:Render Manager
"{2ECADBCE-C0C1-4144-A515-9996AC31FA4B}"= UDP:c:\program files\Pinnacle\Studio 11\programs\Studio.exe:Studio
"{785327E6-666C-447E-998E-F5F88028C00E}"= TCP:c:\program files\Pinnacle\Studio 11\programs\Studio.exe:Studio
"{50BD0E40-7D08-426E-A7EE-4D71CA59CBD0}"= UDP:c:\program files\Pinnacle\Studio 11\programs\PMSRegisterFile.exe:PMSRegisterFile
"{BF659AF2-254E-470A-BD21-F9F07FCEFDDA}"= TCP:c:\program files\Pinnacle\Studio 11\programs\PMSRegisterFile.exe:PMSRegisterFile
"{8B1D9D9A-7698-4016-B9FB-165601E18C5C}"= UDP:c:\program files\Pinnacle\Studio 11\programs\umi.exe:umi
"{B4FB3D92-E3B9-4D98-8BA7-8AA5571CE90F}"= TCP:c:\program files\Pinnacle\Studio 11\programs\umi.exe:umi
"{9CF1F067-2EDF-4BEE-9910-1EA25BE06202}"= UDP:c:\program files\iTunes\iTunes.exe:iTunes
"{7F16935E-08E9-46C3-8DFC-A11B1986CE00}"= TCP:c:\program files\iTunes\iTunes.exe:iTunes
"{5AB692D9-E056-465E-B036-BD55F137FDE9}"= UDP:c:\program files\iTunes\iTunes.exe:iTunes
"{01862EE4-24F9-49C7-91B5-E5EB8E5EB3B6}"= TCP:c:\program files\iTunes\iTunes.exe:iTunes

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile\AuthorizedApplications\List]
"c:\\Program Files\\EarthLink TotalAccess\\TaskPanl.exe"= c:\program files\EarthLink TotalAccess\TaskPanl.exe:*:Enabled:Earthlink

R1 IDSvix86;Symantec Intrusion Prevention Driver;c:\progra~2\Symantec\DEFINI~1\SymcData\ipsdefs\20080529.006\IDSvix86.sys [2008-05-29 261680]
R2 BcmSqlStartupSvc;Business Contact Manager SQL Server Startup Service;c:\program files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe [2008-01-11 30312]
R2 LiveUpdate Notice;LiveUpdate Notice;c:\program files\Common Files\Symantec Shared\CCSVCHST.EXE [2007-08-24 149352]
R2 SlingAgentService;SlingAgent Service;c:\program files\Sling Media\SlingAgent\SlingAgentService.exe [2008-12-10 88576]
R2 TabletServicePen;TabletServicePen;c:\windows\System32\Pen_Tablet.exe [2008-02-28 1369384]
R2 WacomTouchService;Wacom Touch Service;c:\windows\System32\WacomTouchService.exe [2008-02-28 95528]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2008-04-08 109616]
R3 SYMNDISV;SYMNDISV;c:\windows\System32\drivers\symndisv.sys [2008-06-13 41008]
R3 Wacomhidfilter;Wacom HID Filter;c:\windows\System32\drivers\wacomhidfilter.sys [2007-11-05 10536]
R3 WacomVTHid;Virtual Touch Driver;c:\windows\System32\drivers\WacomVTHid.sys [2007-02-22 11312]
S3 COH_Mon;COH_Mon;c:\windows\System32\drivers\COH_Mon.sys [2007-05-29 23888]
S3 MSSQL$MSSMLBIZ;SQL Server (MSSMLBIZ);c:\program files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2008-02-26 29183504]

--- Other Services/Drivers In Memory ---

*NewlyCreated* - COMHOST

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3a16c02e-f3ad-11dd-bfcb-001e683be5ef}]
\shell\AutoRun\command - L:\LaunchU3.exe -a

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
"c:\program files\Common Files\LightScribe\LSRunOnce.exe"
.
Contents of the 'Scheduled Tasks' folder

2009-02-03 c:\windows\Tasks\Norton Internet Security - Run Full System Scan - Wencke.job
- c:\program files\Norton Internet Security\Norton AntiVirus\Navw32.exe [2007-08-26 17:19]

2009-02-06 c:\windows\Tasks\User_Feed_Synchronization-{2CCE5A98-749A-4501-973D-8B79417B73B6}.job
- c:\windows\system32\msfeedssync.exe [2008-01-20 19:24]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/webhp
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=81&bd=Pavilion&pf=laptop
FF - ProfilePath - c:\users\Wencke\AppData\Roaming\Mozilla\Firefox\Profiles\doclf1ug.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.ut.ngb.army.mil/hro/Job%20Announcements%20Page/Job.htm
FF - component: c:\program files\Mozilla Firefox\components\coFFPlgn.dll
FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll
FF - plugin: c:\users\Wencke\AppData\Roaming\Mozilla\Firefox\Profiles\doclf1ug.default\extensions\[email protected]\platform\WINNT_x86-msvc\plugins\npmnqmp07076007.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, https://www.gmer.net
Rootkit scan 2009-02-06 00:03:00
Windows 6.0.6001 Service Pack 1 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'lsass.exe'(692)
c:\windows\system32\DPPWDFLT.dll

- - - - - - - > 'Explorer.exe'(5172)
c:\program files\DigitalPersona\Bin\DpoFeedb.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\System32\audiodg.exe
c:\windows\System32\wlanext.exe
c:\program files\DigitalPersona\Bin\DpHostW.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\program files\HP\QuickPlay\Kernel\TV\QPCapSvc.exe
c:\program files\CyberLink\Shared Files\RichVideo.exe
c:\program files\Microsoft SQL Server\90\Shared\sqlbrowser.exe
c:\program files\Microsoft SQL Server\90\Shared\sqlwriter.exe
c:\program files\Hewlett-Packard\Shared\hpqWmiEx.exe
c:\program files\HP\QuickPlay\Kernel\TV\QPSched.exe
c:\windows\System32\wisptis.exe
c:\program files\Common Files\microsoft shared\ink\TabTip.exe
c:\windows\System32\WTablet\Pen_TabletUser.exe
c:\windows\System32\wisptis.exe
c:\program files\Common Files\microsoft shared\ink\TabTip.exe
c:\windows\System32\rundll32.exe
c:\windows\System32\rundll32.exe
c:\windows\ehome\ehmsas.exe
c:\program files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
c:\windows\ehome\ehsched.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\program files\Hewlett-Packard\Shared\HpqToaster.exe
c:\program files\iPod\bin\iPodService.exe
c:\program files\Yahoo!\Messenger\Ymsgr_tray.exe
c:\program files\Symantec\LiveUpdate\AluSchedulerSvc.exe
c:\program files\Synaptics\SynTP\SynTPHelper.exe
c:\windows\ehome\ehrecvr.exe
c:\program files\Common Files\microsoft shared\ink\InputPersonalization.exe
c:\program files\Hewlett-Packard\HP Health Check\HPHC_Service.exe
c:\windows\System32\wbem\WMIADAP.exe
c:\windows\System32\dllhost.exe
.
**************************************************************************
.
Completion time: 2009-02-06 0:08:22 - machine was rebooted
ComboFix-quarantined-files.txt 2009-02-06 07:08:19
ComboFix2.txt 2009-02-05 17:58:44

Pre-Run: 77,715,476,480 bytes free
Post-Run: 77,791,813,632 bytes free

271 --- E O F --- 2009-02-05 17:38:47
notonjuno is offline  
Old 02-06-2009, 07:59 AM   #11
TSF Security Manager
Emeritus
 
tetonbob's Avatar
 
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 52,197
OS: XP Pro; XP Home; Win7 x86 & x64



Uninstall the following via the Uninstall Programs Panel (Start > Control Panel > Uninstall a Program):

Java(TM) 6 Update 2
Java(TM) 6 Update 7


These are all outdated, and security risks by having them installed still. Unfortunately, Java does not uninstall these older versions when you update, nor tell you that you should. Going forward, Java will overwrite existing installs, so removing older versions should not be required after this.

Leave Java(TM) 6 Update 11 alone, as it is the most recent.

---------------------------------------------------------------------------------------------

Go here to run an online scannner from ESET.
  • Note: You will need to use Internet explorer for this scan. Vista users must right click on the IE shortcut, and run as administrator.
  • Turn off the real time scanner of any existing antivirus program while performing the online scan
  • Tick the box next to YES, I accept the Terms of Use.
  • Click Start
  • When asked, allow the activex control to install
  • Click Start
  • Make sure that the option Remove found threats is unticked, and the option Scan unwanted applications is checked
  • Click Scan
  • Wait for the scan to finish
  • Use notepad to open the logfile located at C:\Program Files\EsetOnlineScanner\log.txt
  • Copy and paste that log as a reply to this topic and also let me know how things are now.
__________________
Practice Safe Surfing
Because what you don't know, CAN hurt you.
Proud Member of UNITE since 2006

Microsoft MVP Consumer Security 2009 - 2015
tetonbob is offline  
Old 02-06-2009, 12:41 PM   #12
Guest
 
Join Date: Jan 2009
Posts: 11
OS:



So far so goo. The ISE32 window doesn't show up on start up anymore.
Not sure if the norton scanner stayed off when I was doing this last scan (pasted below). I didn't think the scan woudl last longer than an horu and I think the last 7 -10 minutes it got turned back on.

# version=4
# OnlineScanner.ocx=1.0.0.635
# OnlineScannerDLLA.dll=1, 0, 0, 79
# OnlineScannerDLLW.dll=1, 0, 0, 78
# OnlineScannerUninstaller.exe=1, 0, 0, 49
# vers_standard_module=3834 (20090206)
# vers_arch_module=1.064 (20080214)
# vers_adv_heur_module=1.066 (20070917)
# EOSSerial=73ef16683f01294588829ebc9a5b6a26
# end=finished
# remove_checked=false
# unwanted_checked=true
# utc_time=2009-02-06 08:30:34
# local_time=2009-02-06 01:30:34 (-0700, Mountain Standard Time)
# country="United States"
# osver=6.0.6001 NT Service Pack 1
# scanned=769440
# found=1
# scan_time=4512
C:\Qoobox\Quarantine\C\RESTORE\S-1-5-21-1482476501-1644491937-682003330-1013\ise32.exe.vir Win32/AutoRun.ABJ worm ED45A0711ED2F2A8C91EEF2D297DB9FD
notonjuno is offline  
Old 02-06-2009, 01:09 PM   #13
TSF Security Manager
Emeritus
 
tetonbob's Avatar
 
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 52,197
OS: XP Pro; XP Home; Win7 x86 & x64



The item Esetfound is in ComboFix quarantine, and will be addressed by uninstalling ComboFix as instructed below

Other than that....

Your logs appear clean.You should be good to go. We still have a few items to address.

Press the Windows key + R, and in the Run box which opens, copy/paste in the following single line command & click OK

combofix /u



This will uninstall ComboFix. It will also implement some cleanup procedures and reset System Restore points.

Now that your system is clean, to help protect your computer in the future I recommend that you follow these steps and look into the following free programs:
  • Microsoft Windows Update - https://www.windowsupdate.com
    Visit regularly. This will ensure your computer always has the latest security updates. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.

  • SpywareBlaster to help prevent spyware from installing in the first place.
    • Install & update SpywareBlaster with the latest definitions.
      After you have updated, click the button - enable protection for all unprotected items
  • McAfee Site Advisor--free version. The folks there check out websites and based on their findings, rate it as Safe, Unknown, Caution, or Bad.
  • Winpatrol

    Winpatrol is heuristic protection program, meaning it looks for patterns in codes that work like malware. It also takes a snapshot of your system's critical resources and alerts you to any changes that may occur without you knowing. You can read more about Winpatrol's features here.

    You can get a free copy of Winpatrol or use the Plus version for more features.

    You can read Winpatrol's FAQ if you run into problems.

  • MVPS HOST FILE
    The MVPS Hosts file replaces your current HOSTS file with one that will restrict known ad sites form serving you unsolicited advertisements. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is the IP of your local computer.
    • Download Host.zip to your desktop.
    • From your Desktop right-click (hosts.zip) and select:
      Extract All from the menu.
    • Click Next, click Next, select the option:
      "Show Extracted files", click Finish
    • This will open the newly created hosts folder on your Desktop.
    • Double-click on the included mvps.bat file, this will rename the existing HOSTS file to HOSTS.MVP, then it will copy the included updated HOSTS file to the correct location on your machine.
    • Once updated you should see another prompt that the task was completed.
  • ANTIVIRUS SOFTWARE
    It is very important that you have anti-virus software running on your machine. This alone can save you a lot of trouble with malware in the future. It is imperative that you update your antivirus software at least once a week (even more if you wish). If you do not update your antivirus software then it will not be able to catch new malware that may have come out.

    Do not install more than one AntiVirus program because they will conflict with each other.

  • Scan here https://secunia.com/software_inspector/ for out of date & vulnerable common applications on your computer

  • https://www.trillian.cc ? Trillian or https://www.miranda-im.com ? Miranda-IM - These are Malware free Instant Messenger programs which allow you to connect to multiple IM services in one program! (AOL, Yahoo, ICQ, IRC, MSN)

  • https://www.aumha.org/downloads/erunt-setup.exe - ERUNT - A useful freeware utility for users of Windows 2000/XP//Vista. It's made up of two parts - ERUNT & NTREGOPT.

    ERUNT will create daily complete backups of your computer's Registry. Whilst System Restore does the same thing, a corrupt registry file may prevent Windows from booting & this effectively renders disables System Restore. With ERUNT, you're able to restore the damaged Registry.

    NTREGOPT works by recreating each registry hive "from scratch", thus removing any slack space that may be left from previously modified or deleted keys. In other words, it compacts the Registry to a small size which allows Windows to load & perform faster.


In light of your recent troubles, I'm sure you'll like to avoid any future infections. Please take a look at these well written articles
If you want to fight back the Malware Writers that have made your life a misery, please take a look here and read what you can do against it.

Please respond to this thread one more time so we can mark this thread as resolved.
__________________
Practice Safe Surfing
Because what you don't know, CAN hurt you.
Proud Member of UNITE since 2006

Microsoft MVP Consumer Security 2009 - 2015
tetonbob is offline  
Old 02-07-2009, 01:28 AM   #14
Guest
 
Join Date: Jan 2009
Posts: 11
OS:



Thank you so much. I appreciate all the help and will read the articles you suggested. What a great website this is. Thanks again.
notonjuno is offline  
Old 02-07-2009, 07:09 AM   #15
TSF Security Manager
Emeritus
 
tetonbob's Avatar
 
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 52,197
OS: XP Pro; XP Home; Win7 x86 & x64



You're welcome, glad to have helped.

Surf Safely, and Think Prevention!

Since this issue is resolved, this topic will be archived.
__________________
Practice Safe Surfing
Because what you don't know, CAN hurt you.
Proud Member of UNITE since 2006

Microsoft MVP Consumer Security 2009 - 2015
tetonbob is offline  
 

Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is on
Smilies are on
[IMG] code is on
HTML code is Off
Trackbacks are Off
Pingbacks are Off
Refbacks are Off


Post a Question


» Site Navigation
 > FAQ
  > 10.0.0.2
Powered by vBadvanced CMPS v3.2.3


All times are GMT -7. The time now is 01:06 AM.


Powered by vBulletin® Version 3.8.8
Copyright ©2000 - 2020, vBulletin Solutions, Inc.
vBulletin Security provided by vBSecurity v2.2.2 (Pro) - vBulletin Mods & Addons Copyright © 2020 DragonByte Technologies Ltd.
User Alert System provided by Advanced User Tagging v3.1.0 (Pro) - vBulletin Mods & Addons Copyright © 2020 DragonByte Technologies Ltd.
Copyright 2001 - 2018, Tech Support Forum

Windows 10 - Windows 7 - Windows XP - Windows Vista - Trojan Removal - Spyware Removal - Virus Removal - Networking - Security - Top Web Hosts