Jump to content

_willow_

Members
 View Profile  See their activity

  • Posts

    9

  • Joined

  • Last visited

 Content Type 

Posts posted by _willow_

    Thanks for helping. ping.exe

    in Resolved Malware Removal Logs

    Posted

    Mr. C, the RogueKiller found 2 objects. However, I'm ignoring that and only posting the RK log, as instructed:

    RogueKiller V8.1.1 [10/01/2012] by Tigzy

    mail: tigzyRK<at>gmail<dot>com

    Feedback: http://www.geekstogo.com/forum/files/file/413-roguekiller/

    Website: http://tigzy.geekstogo.com/roguekiller.php

    Blog: http://tigzyrk.blogspot.com

    Operating System: Windows XP (5.1.2600 Service Pack 3) 32 bits version

    Started in : Normal mode

    User : User [Admin rights]

    Mode : Scan -- Date : 10/18/2012 20:37:41

    ¤¤¤ Bad processes : 0 ¤¤¤

    ¤¤¤ Registry Entries : 2 ¤¤¤

    [HJPOL] HKLM\[...]\System : DisableRegistryTools (0) -> FOUND

    [HJ DESK] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND

    ¤¤¤ Particular Files / Folders: ¤¤¤

    ¤¤¤ Driver : [LOADED] ¤¤¤

    ¤¤¤ HOSTS File: ¤¤¤

    --> C:\WINDOWS\system32\drivers\etc\hosts

    127.0.0.1 localhost

    ¤¤¤ MBR Check: ¤¤¤

    +++++ PhysicalDrive0: HDS728080PLAT20 +++++

    --- User ---

    [MBR] 25b6f7f00ee924d129722e33c877ea12

    [bSP] 6ab81512ed7b103b5f7d01d89b81ec91 : Windows XP MBR Code

    Partition table:

    0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 63 | Size: 76308 Mo

    User = LL1 ... OK!

    User = LL2 ... OK!

    Finished : << RKreport[2].txt >>

    RKreport[1].txt ; RKreport[2].txt

    Thanks for helping. ping.exe

    in Resolved Malware Removal Logs

    Posted

    Malwarebytes Anti-Malware 1.65.1.1000

    www.malwarebytes.org

    Database version: v2012.10.19.01

    Windows XP Service Pack 3 x86 NTFS

    Internet Explorer 8.0.6001.18702

    User :: SR1602HM [administrator]

    10/18/2012 7:39:15 PM

    mbam-log-2012-10-18 (19-39-15).txt

    Scan type: Quick scan

    Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM

    Scan options disabled: P2P

    Objects scanned: 197548

    Time elapsed: 5 minute(s), 25 second(s)

    Memory Processes Detected: 0

    (No malicious items detected)

    Memory Modules Detected: 0

    (No malicious items detected)

    Registry Keys Detected: 0

    (No malicious items detected)

    Registry Values Detected: 0

    (No malicious items detected)

    Registry Data Items Detected: 0

    (No malicious items detected)

    Folders Detected: 0

    (No malicious items detected)

    Files Detected: 0

    (No malicious items detected)

    (end)

    Thanks for helping. ping.exe

    in Resolved Malware Removal Logs

    Posted

    Chin Up & Carry On with cleanup, is my decision. I'm rolling with you, Mr. C.

    I will reformat and reinstall OS once scrubbed.

    The amount of cash a hacker could get from my hippy credit card should disabuse them of any lofty notions.

    Combofix txt:

    ComboFix 12-10-18.03 - User 10/18/2012 9:55.1.1 - x86

    Running from: c:\documents and settings\User\Desktop\ComboFix.exe

    .

    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

    .

    .

    c:\documents and settings\All Users\Application Data\857806u6a536h330w210q4bgt1u2

    c:\documents and settings\All Users\Application Data\TEMP

    c:\documents and settings\All Users\Application Data\TEMP\DFC5A2B2.TMP

    c:\windows\system\system32

    c:\windows\system\system32\Drivers\kbcam.inf

    c:\windows\system\system32\Drivers\kbcam.sys

    c:\windows\system32\dds_trash_log.cmd

    c:\windows\system32\Packet.dll

    c:\windows\system32\pthreadVC.dll

    c:\windows\system32\WanPacket.dll

    c:\windows\system32\wpcap.dll

    .

    .

    ((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

    .

    .

    -------\Legacy_6TO4

    .

    .

    ((((((((((((((((((((((((( Files Created from 2012-09-18 to 2012-10-18 )))))))))))))))))))))))))))))))

    .

    .

    2012-10-18 03:55 . 2012-10-18 14:33 -------- d-----w- C:\TDSSKiller_Quarantine

    2012-10-11 14:29 . 2012-10-11 14:29 -------- d-----w- C:\9cade25de7a102557e66b6a177

    2012-10-11 13:57 . 2012-09-07 23:04 22856 ----a-w- c:\windows\system32\drivers\mbam.sys

    2012-10-11 13:52 . 2012-07-04 14:05 139784 -c----w- c:\windows\system32\dllcache\rdpwd.sys

    2012-10-11 13:36 . 2012-10-11 13:36 -------- d-----w- c:\windows\system32\wbem\Repository

    2012-10-10 22:56 . 2012-10-11 13:57 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

    2012-10-09 02:19 . 2012-08-28 15:14 521728 -c----w- c:\windows\system32\dllcache\jsdbgui.dll

    2012-10-09 02:08 . 2011-04-21 13:37 105472 -c----w- c:\windows\system32\dllcache\mup.sys

    2012-10-03 23:28 . 2012-10-03 23:28 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Application Data\PCHealth

    2012-10-03 23:23 . 2011-07-08 14:02 10496 -c----w- c:\windows\system32\dllcache\ndistapi.sys

    2012-10-03 23:23 . 2012-01-11 19:06 3072 -c----w- c:\windows\system32\dllcache\iacenc.dll

    2012-10-03 23:23 . 2012-01-11 19:06 3072 ------w- c:\windows\system32\iacenc.dll

    2012-10-03 23:20 . 2003-04-21 21:18 77824 ----a-r- c:\windows\system32\nvuenet.exe

    2012-10-03 23:20 . 2003-04-21 21:18 54784 ----a-r- c:\windows\system32\drivers\NVENET.sys

    2012-10-03 23:14 . 2012-10-03 23:14 -------- d-----w- c:\program files\HP

    2012-10-03 23:14 . 2012-10-03 23:14 -------- d-----w- c:\program files\Hewlett-Packard

    2012-10-03 22:15 . 2012-10-03 22:15 -------- d-----w- c:\documents and settings\All Users\Application Data\Geek Squad

    2012-10-03 20:19 . 2011-03-30 06:22 1034240 ----a-r- c:\windows\system32\drivers\AE2500xp.sys

    2012-10-03 20:18 . 2007-11-06 19:22 34064 ----a-r- c:\windows\system32\drivers\npf.sys

    2012-10-03 19:52 . 2004-08-04 04:31 32384 -c--a-w- c:\windows\system32\dllcache\usb101et.sys

    2012-10-03 19:52 . 2004-08-04 04:31 32384 ----a-w- c:\windows\system32\drivers\usb101et.sys

    2012-10-03 19:14 . 2012-10-11 13:36 -------- d-----w- c:\documents and settings\Administrator

    .

    .

    .

    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

    .

    2012-10-18 03:56 . 2004-08-04 12:00 162816 ----a-w- c:\windows\system32\drivers\netbt.sys

    2012-10-11 14:14 . 2012-03-31 13:31 696760 ----a-w- c:\windows\system32\FlashPlayerApp.exe

    2012-10-11 14:14 . 2011-07-15 21:50 73656 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl

    2012-08-28 15:14 . 2004-08-04 12:00 916992 ----a-w- c:\windows\system32\wininet.dll

    2012-08-28 15:14 . 2004-08-04 12:00 43520 ----a-w- c:\windows\system32\licmgr10.dll

    2012-08-28 15:14 . 2004-08-04 12:00 1469440 ------w- c:\windows\system32\inetcpl.cpl

    2012-08-28 12:07 . 2004-08-04 12:00 385024 ----a-w- c:\windows\system32\html.iec

    2012-08-24 13:53 . 2004-08-04 12:00 177664 ----a-w- c:\windows\system32\wintrust.dll

    .

    .

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

    .

    .

    *Note* empty entries & legit default entries are not shown

    REGEDIT4

    .

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

    "DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-02-26 437160]

    .

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]

    c:\windows\system32\dumprep 0 -k [X]

    .

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AlcxMonitor]

    2004-09-07 20:47 57344 ----a-w- c:\windows\ALCXMNTR.EXE

    .

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]

    2008-04-14 00:12 15360 ----a-w- c:\windows\system32\ctfmon.exe

    .

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]

    2012-01-18 20:02 254696 ----a-w- c:\program files\Common Files\Java\Java Update\jusched.exe

    .

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]

    2010-01-16 08:12 198160 ----a-w- c:\program files\Common Files\Real\Update_OB\realsched.exe

    .

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]

    "WMPNetworkSvc"=3 (0x3)

    "MatSvc"=3 (0x3)

    "JavaQuickStarterService"=2 (0x2)

    "idsvc"=3 (0x3)

    "gusvc"=3 (0x3)

    .

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

    "%windir%\\system32\\sessmgr.exe"=

    .

    R2 MBAMScheduler;MBAMScheduler;c:\program files\Malwarebytes' Anti-Malware\mbamscheduler.exe [10/11/2012 7:57 AM 399432]

    R2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [10/11/2012 7:57 AM 676936]

    R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [10/11/2012 7:57 AM 22856]

    S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [3/31/2012 7:31 AM 250808]

    S3 KBCAM;JamC@m USB service;c:\windows\system32\drivers\KBCAM.sys [12/11/2008 5:15 AM 16384]

    S3 KLSIENET;Driver for USB Ethernet Adapter;c:\windows\system32\drivers\usb101et.sys [10/3/2012 1:52 PM 32384]

    S3 Linksys_adapter_H;Linksys Adapter Network Driver;c:\windows\system32\drivers\AE2500xp.sys [10/3/2012 2:19 PM 1034240]

    .

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs

    scramby

    arrayssl_vpn_service3,0,1,9

    nmwcdc

    icm10blk

    acedrv07

    IFP700

    pimsgss

    ilicensesvc

    knobserv

    tapvpn

    pmem

    obvious

    A4S2600

    SiSRaid2

    WINFLASH

    mbackmonitor

    FireTDI

    rtm

    ofcservice

    MSMQ

    tmcomm

    tmmbd

    pdengine

    eliservice

    trufos

    papyjoy

    avc

    ultra66

    RTLE8023xp

    mssql$microsoftsmlbiz

    siswlsvc

    Cardex

    .

    Contents of the 'Scheduled Tasks' folder

    .

    2012-10-18 c:\windows\Tasks\Adobe Flash Player Updater.job

    - c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-03-31 14:14]

    .

    2012-10-18 c:\windows\Tasks\User_Feed_Synchronization-{F016FBAB-93A5-4668-BF1E-65AB09A30CE6}.job

    - c:\windows\system32\msfeedssync.exe [2009-03-08 10:31]

    .

    .

    ------- Supplementary Scan -------

    .

    uStart Page = about:blank

    uInternet Settings,ProxyOverride = <local>

    uSearchAssistant = hxxp://www.google.com/ie

    uSearchURL,(Default) = hxxp://www.google.com/search?q=%s

    Trusted Zone: thejamcam.com\www

    TCP: DhcpNameServer = 192.168.0.1 205.171.3.25

    .

    - - - - ORPHANS REMOVED - - - -

    .

    Toolbar-Locked - (no file)

    Notify-AtiExtEvent - (no file)

    Notify-NavLogon - (no file)

    SafeBoot-30164547.sys

    SafeBoot-54314066.sys

    SafeBoot-61403485.sys

    SafeBoot-82675482.sys

    .

    .

    .

    **************************************************************************

    .

    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

    Rootkit scan 2012-10-18 10:06

    Windows 5.1.2600 Service Pack 3 NTFS

    .

    scanning hidden processes ...

    .

    scanning hidden autostart entries ...

    .

    scanning hidden files ...

    .

    scan completed successfully

    hidden files: 0

    .

    **************************************************************************

    .

    --------------------- LOCKED REGISTRY KEYS ---------------------

    .

    [HKEY_USERS\S-1-5-21-1078081533-1482476501-725345543-1004\Software\Microsoft\SystemCertificates\AddressBook*]

    @Allowed: (Read) (RestrictedCode)

    @Allowed: (Read) (RestrictedCode)

    .

    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]

    @Denied: (A 2) (Everyone)

    @="FlashBroker"

    "LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_11_4_402_287_ActiveX.exe,-101"

    .

    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]

    "Enabled"=dword:00000001

    .

    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]

    @="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_11_4_402_287_ActiveX.exe"

    .

    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]

    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

    .

    [HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]

    @Denied: (A 2) (Everyone)

    @="IFlashBroker5"

    .

    [HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]

    @="{00020424-0000-0000-C000-000000000046}"

    .

    [HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]

    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

    "Version"="1.0"

    .

    --------------------- DLLs Loaded Under Running Processes ---------------------

    .

    - - - - - - - > 'explorer.exe'(3772)

    c:\windows\system32\WININET.dll

    c:\windows\system32\ieframe.dll

    c:\windows\system32\webcheck.dll

    c:\windows\system32\WPDShServiceObj.dll

    c:\windows\system32\PortableDeviceTypes.dll

    c:\windows\system32\PortableDeviceApi.dll

    .

    ------------------------ Other Running Processes ------------------------

    .

    c:\windows\system32\rundll32.exe

    c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe

    c:\windows\system32\imapi.exe

    .

    **************************************************************************

    .

    Completion time: 2012-10-18 10:09:23 - machine was rebooted

    ComboFix-quarantined-files.txt 2012-10-18 16:08

    .

    Pre-Run: 70,938,075,136 bytes free

    Post-Run: 71,050,035,200 bytes free

    .

    WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe

    [boot loader]

    timeout=2

    default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS

    [operating systems]

    c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

    UnsupportedDebug="do not select this" /debug

    multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect

    .

    - - End Of File - - 39DFD4AB0469DD787C14EFADD64F3AB9

    Thanks for helping. ping.exe

    in Resolved Malware Removal Logs

    Posted

    TDSSKiller.2.8.13.0_17.10.2012_21.51.39_log.txt

    Above, is large Log #2, as an attachment.

    Below, Log #3:

    21:57:32.0359 0580 TDSS rootkit removing tool 2.8.13.0 Oct 12 2012 17:26:47

    21:57:32.0953 0580 ============================================================

    21:57:32.0953 0580 Current date / time: 2012/10/17 21:57:32.0953

    21:57:32.0953 0580 SystemInfo:

    21:57:32.0953 0580

    21:57:32.0953 0580 OS Version: 5.1.2600 ServicePack: 3.0

    21:57:32.0953 0580 Product type: Workstation

    21:57:32.0953 0580 ComputerName: SR1602HM

    21:57:32.0953 0580 UserName: User

    21:57:32.0953 0580 Windows directory: C:\WINDOWS

    21:57:32.0953 0580 System windows directory: C:\WINDOWS

    21:57:32.0953 0580 Processor architecture: Intel x86

    21:57:32.0953 0580 Number of processors: 1

    21:57:32.0953 0580 Page size: 0x1000

    21:57:32.0953 0580 Boot type: Normal boot

    21:57:32.0953 0580 ============================================================

    21:57:36.0875 0580 BG loaded

    21:57:37.0312 0580 Drive \Device\Harddisk0\DR0 - Size: 0x12A1F16000 (74.53 Gb), SectorSize: 0x200, Cylinders: 0x2601, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000054

    21:57:37.0359 0580 ============================================================

    21:57:37.0359 0580 \Device\Harddisk0\DR0:

    21:57:37.0359 0580 MBR partitions:

    21:57:37.0359 0580 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0x950A5C1

    21:57:37.0359 0580 ============================================================

    21:57:37.0406 0580 C: <-> \Device\Harddisk0\DR0\Partition1

    21:57:37.0515 0580 ============================================================

    21:57:37.0515 0580 Initialize success

    21:57:37.0515 0580 ============================================================

    Thanks for helping. ping.exe

    in Resolved Malware Removal Logs

    Posted

    21:41:13.0359 0740 TDSS rootkit removing tool 2.8.13.0 Oct 12 2012 17:26:47

    21:41:13.0828 0740 ============================================================

    21:41:13.0828 0740 Current date / time: 2012/10/17 21:41:13.0828

    21:41:13.0828 0740 SystemInfo:

    21:41:13.0828 0740

    21:41:13.0828 0740 OS Version: 5.1.2600 ServicePack: 3.0

    21:41:13.0828 0740 Product type: Workstation

    21:41:13.0828 0740 ComputerName: SR1602HM

    21:41:13.0828 0740 UserName: User

    21:41:13.0828 0740 Windows directory: C:\WINDOWS

    21:41:13.0828 0740 System windows directory: C:\WINDOWS

    21:41:13.0828 0740 Processor architecture: Intel x86

    21:41:13.0828 0740 Number of processors: 1

    21:41:13.0828 0740 Page size: 0x1000

    21:41:13.0828 0740 Boot type: Normal boot

    21:41:13.0828 0740 ============================================================

    21:41:16.0406 0740 Drive \Device\Harddisk0\DR0 - Size: 0x12A1F16000 (74.53 Gb), SectorSize: 0x200, Cylinders: 0x2601, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000054

    21:41:16.0421 0740 ============================================================

    21:41:16.0421 0740 \Device\Harddisk0\DR0:

    21:41:16.0421 0740 MBR partitions:

    21:41:16.0421 0740 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0x950A5C1

    21:41:16.0421 0740 ============================================================

    21:41:16.0468 0740 C: <-> \Device\Harddisk0\DR0\Partition1

    21:41:16.0515 0740 ============================================================

    21:41:16.0515 0740 Initialize success

    21:41:16.0515 0740 ============================================================

    21:42:28.0406 0908 Deinitialize success

    Thanks for helping. ping.exe

    in Resolved Malware Removal Logs

    Posted

    Mr. Charlie, I am humbled by the fumble with the messaging font. Thank you for your patience.

    On a positive note: Thanks to your instruction, I'm looking pretty good over here.

    First, the Listparts log:

    ListParts by Farbar Version: 16-10-2012

    Ran by User (administrator) on 17-10-2012 at 21:24:08

    Windows XP (X86)

    Running From: C:\Documents and Settings\User\Local Settings\Temporary Internet Files\Content.IE5\5800MX3B

    Language: 0409

    ************************************************************

    ========================= Memory info ======================

    Percentage of memory in use: 94%

    Total physical RAM: 447.36 MB

    Available physical RAM: 24.14 MB

    Total Pagefile: 722.53 MB

    Available Pagefile: 365.43 MB

    Total Virtual: 2047.88 MB

    Available Virtual: 2000.08 MB

    ======================= Partitions =========================

    1 Drive c: () (Fixed) (Total:74.52 GB) (Free:66.17 GB) NTFS ==>[Drive with boot components (Windows XP)]

    Disk ### Status Size Free Dyn Gpt

    -------- ---------- ------- ------- --- ---

    Disk 0 Online 75 GB 0 B

    Partitions of Disk 0:

    ===============

    The disk management services could not complete the operation.

    ======================================================================================================

    ****** End Of Log ******

    Thanks for helping. ping.exe

    in Resolved Malware Removal Logs

    Posted

    Zipfile success!

    RogueKiller V8.1.1 [10/01/2012] by Tigzy

    mail: tigzyRK<at>gmail<dot>com

    Feedback: http://www.geekstogo.com/forum/files/file/413-roguekiller/

    Website: http://tigzy.geekstogo.com/roguekiller.php

    Blog: http://tigzyrk.blogspot.com

    Operating System: Windows XP (5.1.2600 Service Pack 3) 32 bits version

    Started in : Normal mode

    User : User [Admin rights]

    Mode : Scan -- Date : 10/17/2012 10:44:49

    ¤¤¤ Bad processes : 0 ¤¤¤

    ¤¤¤ Registry Entries : 2 ¤¤¤

    [HJPOL] HKLM\[...]\System : DisableTaskMgr (0) -> FOUND

    [HJ DESK] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND

    ¤¤¤ Particular Files / Folders: ¤¤¤

    ¤¤¤ Driver : [LOADED] ¤¤¤

    ¤¤¤ HOSTS File: ¤¤¤

    --> C:\WINDOWS\system32\drivers\etc\hosts

    ¤¤¤ MBR Check: ¤¤¤

    +++++ PhysicalDrive0: HDS728080PLAT20 +++++

    --- User ---

    [MBR] 25b6f7f00ee924d129722e33c877ea12

    [bSP] 6ab81512ed7b103b5f7d01d89b81ec91 : Windows XP MBR Code

    Partition table:

    0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 63 | Size: 76308 Mo

    User = LL1 ... OK!

    User = LL2 ... OK!

    Finished : << RKreport[1].txt >>

    RKreport[1].txt

    Thanks for helping. ping.exe

    in Resolved Malware Removal Logs

    Posted

    Hi Mr. Charlie. What a comfort it is to co-pilot with a deity.

    I'm unable to download the roguekiller.

    A popup states that it is not a valid Win32 application.

    I have exited my malwarebytes program & have no known programs running when I attempt to download, however I do have a USB optical mouse, no other USBs or externals connected.

    Thanks for helping. ping.exe

    in Resolved Malware Removal Logs

    Posted

    I have a ping.exe popup about every 100 seconds.

    MalwareBytes detects 2 rootkits in \System Volume Information\

    but only when I ran the scan in safe mode.

    Disinfect did not last. I do not have audio.

    It prevents me from installing Microsoft Security Essentials, and does not allow me to look at my firewall. However, I can see I have a firewall by moving about in safe mode.

    Attached is my DDS text. Thank you for helping me! ~willow~

    DDS (Ver_2012-10-14.05) - NTFS_x86

    Internet Explorer: 8.0.6001.18702

    Run by User at 23:40:05 on 2012-10-16

    Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.447.38 [GMT -6:00]

    .

    .

    ============== Running Processes ================

    .

    C:\WINDOWS\Explorer.EXE

    C:\WINDOWS\system32\spoolsv.exe

    C:\WINDOWS\system32\rundll32.exe

    C:\WINDOWS\system32\ctfmon.exe

    C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe

    C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe

    C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe

    C:\Program Files\Internet Explorer\iexplore.exe

    C:\Program Files\Internet Explorer\iexplore.exe

    C:\WINDOWS\system32\wbem\wmiprvse.exe

    C:\WINDOWS\system32\svchost.exe -k NetworkService

    C:\WINDOWS\System32\svchost.exe -k eapsvcs

    C:\WINDOWS\system32\svchost.exe -k LocalService

    C:\WINDOWS\System32\svchost.exe -k dot3svc

    C:\WINDOWS\system32\svchost.exe -k LocalService

    C:\WINDOWS\system32\svchost.exe -k imgsvc

    C:\WINDOWS\System32\svchost.exe -k netsvcs

    .

    ============== Pseudo HJT Report ===============

    .

    uStart Page = about:blank

    uProxyOverride = <local>

    uSearchAssistant = hxxp://www.google.com/ie

    uSearchURL,(Default) = hxxp://www.google.com/search?q=%s

    BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049C3E9-B461-4BC5-8870-4C09146192CA} - c:\program files\real\realplayer\rpbrowserrecordplugin.dll

    BHO: Java Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\program files\java\jre6\bin\ssv.dll

    BHO: Java Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - c:\program files\java\jre6\bin\jp2ssv.dll

    BHO: JQSIEStartDetectorImpl Class: {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

    uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe

    dRun: [DWQueuedReporting] "c:\progra~1\common~1\micros~1\dw\dwtrig20.exe" -t

    uPolicies-Explorer: NoDriveTypeAutoRun = dword:145

    mPolicies-Windows\System: Allow-LogonScript-NetbiosDisabled = dword:1

    mPolicies-Explorer: NoDriveTypeAutoRun = dword:145

    IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe

    IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe

    LSP: mswsock.dll

    DPF: {73ECB3AA-4717-450C-A2AB-D00DAD9EE203} - hxxp://h20614.www2.hp.com/ediags/gmd/Install/Cab/hpdetect119b.cab

    TCP: NameServer = 192.168.0.1 205.171.3.25

    TCP: Interfaces\{18858CE0-7C46-4096-94BA-2794DAD47486} : DHCPNameServer = 192.168.15.1

    TCP: Interfaces\{A6C89752-2FA4-4916-B0BE-03494BD3880D} : DHCPNameServer = 192.168.0.1 205.171.3.25

    TCP: Interfaces\{B4139F04-C7AE-4233-B996-227482E15FB1} : DHCPNameServer = 192.168.0.1 205.171.3.25

    Notify: AtiExtEvent - <no file>

    Notify: NavLogon - <no file>

    SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

    .

    ============= SERVICES / DRIVERS ===============

    .

    R2 MBAMScheduler;MBAMScheduler;c:\program files\malwarebytes' anti-malware\mbamscheduler.exe [2012-10-11 399432]

    R2 MBAMService;MBAMService;c:\program files\malwarebytes' anti-malware\mbamservice.exe [2012-10-11 676936]

    R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2012-10-11 22856]

    S2 ofcservice;Ccpwdsvc;c:\windows\system32\svchost.exe -k netsvcs [2004-8-4 14336]

    S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\macromed\flash\FlashPlayerUpdateService.exe [2012-3-31 250808]

    S3 KBCAM;JamC@m USB service;c:\windows\system32\drivers\KBCAM.sys [2008-12-11 16384]

    S3 KLSIENET;Driver for USB Ethernet Adapter;c:\windows\system32\drivers\usb101et.sys [2012-10-3 32384]

    S3 Linksys_adapter_H;Linksys Adapter Network Driver;c:\windows\system32\drivers\AE2500xp.sys [2012-10-3 1034240]

    .

    =============== Created Last 30 ================

    .

    2012-10-11 14:29:36 -------- d-----w- C:\9cade25de7a102557e66b6a177

    2012-10-11 13:57:07 22856 ----a-w- c:\windows\system32\drivers\mbam.sys

    2012-10-11 13:52:25 139784 -c----w- c:\windows\system32\dllcache\rdpwd.sys

    2012-10-11 13:36:09 -------- d-----w- c:\windows\system32\wbem\repository\FS

    2012-10-11 13:36:09 -------- d-----w- c:\windows\system32\wbem\Repository

    2012-10-10 22:56:34 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

    2012-10-09 02:19:38 521728 -c----w- c:\windows\system32\dllcache\jsdbgui.dll

    2012-10-09 02:08:49 105472 -c----w- c:\windows\system32\dllcache\mup.sys

    2012-10-03 23:23:19 10496 -c----w- c:\windows\system32\dllcache\ndistapi.sys

    2012-10-03 23:23:17 3072 -c----w- c:\windows\system32\dllcache\iacenc.dll

    2012-10-03 23:23:17 3072 ------w- c:\windows\system32\iacenc.dll

    2012-10-03 23:20:21 77824 ----a-r- c:\windows\system32\nvuenet.exe

    2012-10-03 23:20:21 54784 ----a-r- c:\windows\system32\drivers\NVENET.sys

    2012-10-03 23:14:59 -------- d-----w- c:\program files\HP

    2012-10-03 22:15:56 -------- d-----w- c:\documents and settings\all users\application data\Geek Squad

    2012-10-03 20:19:04 1034240 ----a-r- c:\windows\system32\drivers\AE2500xp.sys

    2012-10-03 20:18:23 88696 ----a-r- c:\windows\system32\packet.dll

    2012-10-03 20:18:23 68224 ----a-r- c:\windows\system32\WanPacket.dll

    2012-10-03 20:18:23 53299 ----a-r- c:\windows\system32\pthreadVC.dll

    2012-10-03 20:18:23 34064 ----a-r- c:\windows\system32\drivers\npf.sys

    2012-10-03 20:18:23 240248 ----a-r- c:\windows\system32\wpcap.dll

    2012-10-03 19:52:51 32384 -c--a-w- c:\windows\system32\dllcache\usb101et.sys

    2012-10-03 19:52:51 32384 ----a-w- c:\windows\system32\drivers\usb101et.sys

    .

    ==================== Find3M ====================

    .

    2012-10-17 00:04:29 0 --sha-w- c:\windows\system32\dds_trash_log.cmd

    2012-10-11 14:14:08 73656 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl

    2012-10-11 14:14:08 696760 ----a-w- c:\windows\system32\FlashPlayerApp.exe

    2012-08-28 15:14:53 916992 ----a-w- c:\windows\system32\wininet.dll

    2012-08-28 15:14:53 43520 ----a-w- c:\windows\system32\licmgr10.dll

    2012-08-28 15:14:52 1469440 ------w- c:\windows\system32\inetcpl.cpl

    2012-08-28 12:07:15 385024 ----a-w- c:\windows\system32\html.iec

    2012-08-24 13:53:22 177664 ----a-w- c:\windows\system32\wintrust.dll

    .

    ============= FINISH: 23:41:22.95 ===============

Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.