Occasional browser hijack and Win32 error

ghg565 · December 7, 2011

Hello,

I have a Windows XP sp3 computer that seems to be infected with some malware. I have tried to remove it by myself and the issues keep comming back. I am having occasional browser redirecting from google results using chrome, my task manager keeps getting disabled, and I am getting a generic host process for win32 services error each time I reboot(which may be unrelated but I figure it is best to fix any malware issue before taking on any other problems). According to my event viewer the generic win32 error is from the DNS Client service terminating unexpectedly. I have tried running DDS but my computer freezes after it runs for about 2 mins. I haven't been able to find either of the log files that it creates so I am not sure what I need to post for you? Please let me know and I will post any needed info asap. I tried running a full scan with Malwarebytes in safe mode w/networking and some issues were found and fixed, but the symptoms came back on the next reboot. Next I treid renaming the mbam.exe and using unhide.exe before running but no issues were found and my problems persist. Any help is much appreciated!

Hello Again,

I have done some more work on this computer and have gotten it to finish a DDS scan for which I have attached the created log files. I also have gotten rid of any symptoms that I was experiencing before and had mentioned in my previous post. This was accomplished using TDSS Killer and the Malwarebytes scan. I am all to aware that this doesn't mean that the malware is completely gone and I would appreciate an experts opinion on whether further action is necessary. I also have a Gmer log file which I have attached even though it may not be of any help (sorry if this is not helpful but I am trying to expedite the process as best I can.)

Thanks again for any help!

GmerLog.txt

attach.txt

dds.txt

.

DDS (Ver_2011-08-26.01) - NTFSx86

Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.5.0_14

Run by Owner at 15:10:37 on 2011-12-08

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1013.572 [GMT -7:00]

.

============== Running Processes ===============

.

C:\WINDOWS\system32\svchost.exe -k DcomLaunch

svchost.exe

C:\WINDOWS\System32\svchost.exe -k netsvcs

svchost.exe

C:\WINDOWS\system32\spoolsv.exe

svchost.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\System32\svchost.exe -k HTTPFilter

C:\Program Files\SigmaTel\C-Major Audio\WDM\STacSV.exe

C:\WINDOWS\system32\igfxtray.exe

C:\WINDOWS\system32\hkcmd.exe

C:\WINDOWS\system32\igfxpers.exe

C:\WINDOWS\system32\ctfmon.exe

C:\WINDOWS\system32\igfxsrvc.exe

C:\WINDOWS\system32\svchost.exe -k imgsvc

C:\Program Files\SUPERAntiSpyware\SASCORE.EXE

.

============== Pseudo HJT Report ===============

.

uInternet Settings,ProxyOverride = *.local

uURLSearchHooks: H - No File

BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll

BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - c:\documents and settings\all users\application data\real\realplayer\browserrecordplugin\ie\rpbrowserrecordplugin.dll

BHO: SSVHelper Class: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre1.5.0_14\bin\ssv.dll

{fbf2401b-7447-4727-be5d-c19b2075ca84}

TB: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File

TB: {10134636-E7AF-4AC5-A1DC-C7C44BB97D81} - No File

TB: {D7E97865-918F-41E4-9CD0-25AB1C574CE8} - No File

uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe

uRun: [sUPERAntiSpyware] c:\program files\superantispyware\SUPERAntiSpyware.exe

uRun: [Google Update] "c:\documents and settings\owner\local settings\application data\google\update\GoogleUpdate.exe" /c

mRun: [igfxTray] c:\windows\system32\igfxtray.exe

mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe

mRun: [Persistence] c:\windows\system32\igfxpers.exe

mRun: [MDS_Menu] "c:\program files\olympus\ib\muitransfer\muistartmenu.exe" "c:\program files\olympus\ib" updatewithcreateonce "software\olympus\ib\1.0"

dRun: [DWQueuedReporting] "c:\progra~1\common~1\micros~1\dw\dwtrig20.exe" -t

IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000

IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe

IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe

IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0015-0000-0014-ABCDEFFEDCBC} - c:\program files\java\jre1.5.0_14\bin\ssv.dll

IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL

Trusted Zone: aol.com\free

DPF: Garmin Communicator Plug-In - hxxps://static.garmincdn.com/gcp/ie/2.9.2.0/GarminAxControl.CAB

DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} - hxxp://download.microsoft.com/download/e/7/3/e7345c16-80aa-4488-ae10-9ac6be844f99/OGAControl.cab

DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} - c:\program files\yahoo!\common\Yinsthelper.dll

DPF: {48DD0448-9209-4F81-9F6D-D83562940134} - hxxp://lads.myspace.com/upload/MySpaceUploader1006.cab

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_14-windows-i586.cab

DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab

DPF: {CAFEEFAC-0015-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_07-windows-i586.cab

DPF: {CAFEEFAC-0015-0000-0014-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_14-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_14-windows-i586.cab

Notify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.DLL

Notify: igfxcui - igfxdev.dll

SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLL

.

============= SERVICES / DRIVERS ===============

.

R1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\SASDIFSV.SYS [2010-2-17 12880]

R1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2010-5-10 67664]

R2 !SASCORE;SAS Core Service;c:\program files\superantispyware\SASCORE.EXE [2010-6-29 116608]

S3 OlyCamComm;OLYMPUS USB Communication Device;c:\windows\system32\drivers\OlyCamComm.sys [2010-8-29 21648]

S4 CIDLinkAdvisorService;CIDLinkAdvisorService;"c:\program files\callingid\callingidlinkadvisor2.0\linkadvisor\cidlinkadvisorservice.exe" --> c:\program files\callingid\callingidlinkadvisor2.0\linkadvisor\CIDLinkAdvisorService.exe [?]

S4 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2010-1-31 135664]

S4 gupdatem;Google Update Service (gupdatem);c:\program files\google\update\GoogleUpdate.exe [2010-1-31 135664]

.

=============== Created Last 30 ================

.

2011-12-07 22:00:24 -------- d-----w- c:\documents and settings\owner\application data\SUPERAntiSpyware.com

2011-12-07 22:00:24 -------- d-----w- c:\documents and settings\all users\application data\SUPERAntiSpyware.com

2011-12-07 22:00:15 -------- d-----w- c:\program files\SUPERAntiSpyware

2011-12-07 14:40:53 100864 ----a-w- C:\fgwyyfod.sys

2011-12-07 05:01:49 -------- d-----w- c:\documents and settings\owner\application data\Malwarebytes

2011-12-07 04:58:24 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2011-12-07 04:58:23 20952 ----a-w- c:\windows\system32\drivers\mbam.sys

2011-12-07 04:58:23 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2011-12-07 04:58:23 -------- d-----w- c:\documents and settings\all users\application data\Malwarebytes

2011-12-07 04:41:50 -------- d-----w- c:\program files\Trend Micro

2011-12-07 04:33:56 -------- d-----w- c:\documents and settings\owner\local settings\application data\Western Digital

2011-11-09 14:30:21 -------- d-----w- c:\windows\pss

.

==================== Find3M ====================

.

2011-12-08 19:52:08 187776 ----a-w- c:\windows\system32\drivers\acpi.sys

2011-12-07 04:33:43 414368 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl

2011-12-07 04:28:13 222080 ------w- c:\windows\system32\MpSigStub.exe

2011-10-10 14:22:41 692736 ----a-w- c:\windows\system32\inetcomm.dll

2011-09-28 07:06:50 599040 ----a-w- c:\windows\system32\crypt32.dll

2011-09-26 18:41:20 611328 ----a-w- c:\windows\system32\uiautomationcore.dll

2011-09-26 18:41:20 220160 ----a-w- c:\windows\system32\oleacc.dll

2011-09-26 18:41:14 20480 ----a-w- c:\windows\system32\oleaccrc.dll

2007-10-10 02:06:18 51422520 ----a-w- c:\program files\iTunes743Setup.exe

2007-10-09 05:46:14 13411824 ----a-w- c:\program files\Google_Earth_BZXD.exe

.

============= FINISH: 15:11:04.45 ===============

LDTate · December 8, 2011

:welcome:

Please go to http://www.virustotal.com/, click on Browse, and upload the following file for analysis:

C:\fgwyyfod.sys

Then click Submit. Allow the file to be scanned, and then please copy and paste the results here for me to see.

If virustotal is too busy you can try these.

http://virusscan.jotti.org

http://www.kaspersky.com/scanforvirus.html

ghg565 · December 8, 2011

This is what I got when I submitted the file:

1 VT Community user(s) with a total of 1 reputation credit(s) say(s) this sample is goodware. 0 VT Community user(s) with a total of 0 reputation credit(s) say(s) this sample is malware.

File name: fgwyyfod.sys

Submission date: 2011-12-08 22:59:08 (UTC)

Current status: finished

Result: 0/ 43 (0.0%)

AhnLab-V3 2011.12.08.02 2011.12.08 -

AntiVir 7.11.19.30 2011.12.08 -

Antiy-AVL 2.0.3.7 2011.12.08 -

Avast 6.0.1289.0 2011.12.08 -

AVG 10.0.0.1190 2011.12.08 -

BitDefender 7.2 2011.12.09 -

ByteHero 1.0.0.1 2011.12.07 -

CAT-QuickHeal 12.00 2011.12.08 -

ClamAV 0.97.3.0 2011.12.09 -

Commtouch 5.3.2.6 2011.12.08 -

Comodo 10887 2011.12.08 -

DrWeb 5.0.2.03300 2011.12.08 -

Emsisoft 5.1.0.11 2011.12.08 -

eSafe 7.0.17.0 2011.12.08 -

eTrust-Vet 37.0.9614 2011.12.08 -

F-Prot 4.6.5.141 2011.11.29 -

F-Secure 9.0.16440.0 2011.12.08 -

Fortinet 4.3.388.0 2011.12.08 -

GData 22 2011.12.08 -

Ikarus T3.1.1.109.0 2011.12.08 -

Jiangmin 13.0.900 2011.12.08 -

K7AntiVirus 9.119.5619 2011.12.07 -

Kaspersky 9.0.0.837 2011.12.08 -

McAfee 5.400.0.1158 2011.12.08 -

McAfee-GW-Edition 2010.1E 2011.12.08 -

Microsoft 1.7903 2011.12.08 -

NOD32 6691 2011.12.07 -

Norman 6.07.13 2011.12.07 -

nProtect 2011-12-08.02 2011.12.08 -

Panda 10.0.3.5 2011.12.08 -

PCTools 8.0.0.5 2011.12.08 -

Prevx 3.0 2011.12.09 -

Rising 23.87.03.02 2011.12.08 -

Sophos 4.71.0 2011.12.08 -

SUPERAntiSpyware 4.40.0.1006 2011.12.08 -

Symantec 20111.2.0.82 2011.12.08 -

TheHacker 6.7.0.1.353 2011.12.07 -

TrendMicro 9.500.0.1008 2011.12.08 -

TrendMicro-HouseCall 9.500.0.1008 2011.12.08 -

VBA32 3.12.16.4 2011.12.08 -

VIPRE 11221 2011.12.08 -

ViRobot 2011.12.8.4815 2011.12.08 -

VirusBuster 14.1.106.0 2011.12.08 -

Additional informationShow all

MD5 : 577c37fbeb973390e61b654d0ac1bebd

SHA1 : d63afbc87838239d816942e81db56cbe237ad1d1

SHA256: 49c9df7fb2200e3e20aedb8f8a69aa28bf858adfbc3ae286957d2479832abb8b

ssdeep: 1536:PhQy2GDoTNx3l7mhrKB3rJ1ucBZsKV5phBuj2pCNsiDjyRHnMcs+Zg5rcS5yZBT:5ABl1u

sVf6Nui2nMcsYgJcS5yT

File size : 100864 bytes

First seen: 2011-07-17 05:09:05

Last seen : 2011-12-08 22:59:08

TrID:

Win32 Executable Generic (58.4%)

Clipper DOS Executable (13.8%)

Generic Win/DOS Executable (13.7%)

DOS Executable Generic (13.7%)

VXD Driver (0.2%)

sigcheck:

publisher....: GMER

product......: GMER

description..: GMER Driver http://www.gmer.net

original name: gmer.sys

internal name: gmer.sys

file version.: 1, 0, 15, 4918 built by: WinDDK

comments.....: n/a

signers......: -

signing date.: -

verified.....: Unsigned

PEInfo: PE structure information

[[ basic data ]]

entrypointaddress: 0x16005

timedatestamp....: 0x4E21F298 (Sat Jul 16 20:20:40 2011)

machinetype......: 0x14c (I386)

[[ 7 section(s) ]]

name, viradd, virsiz, rawdsiz, ntropy, md5

.text, 0x480, 0xEA2C, 0xEA80, 6.45, a0ffd8d7e67fda16d045b3b9c0142509

.rwtext, 0xEF00, 0x51, 0x80, 1.71, c00d6d7ba9be2d7a526fdd7311b1247f

.rdata, 0xEF80, 0x2FBC, 0x3000, 5.14, d5bbf44c1f811f2d9f8454ba69b8c008

.data, 0x11F80, 0x4044, 0x4080, 0.34, 74ff1bbfb8e0ed1825669d220a13bc03

INIT, 0x16000, 0xAA8, 0xB00, 5.43, 619c6618a9e220cb810a7c9a63a55a26

.rsrc, 0x16B00, 0x370, 0x380, 3.35, c0c6d76b43cfd61d2ad6fb7fc4b40a16

.reloc, 0x16E80, 0x1B1A, 0x1B80, 6.44, 278d1556f5baf102668f4df3707ad15b

[[ 2 import(s) ]]

ntoskrnl.exe: ExFreePoolWithTag, ExAllocatePool, ZwReadFile, ZwQueryInformationFile, ZwOpenFile, memcpy, KeQuerySystemTime, PsLookupProcessByProcessId, ObfDereferenceObject, ObReferenceObjectByHandle, KeDetachProcess, KeAttachProcess, MmIsAddressValid, memset, ZwSetInformationFile, RtlInitUnicodeString, ObOpenObjectByPointer, IofCompleteRequest, IoDeleteDevice, IoDeleteSymbolicLink, RtlUnicodeStringToAnsiString, PsTerminateSystemThread, PsCreateSystemThread, KeInitializeEvent, wcsstr, IoCreateSymbolicLink, IoCreateDevice, PsGetVersion, strrchr, KeGetCurrentThread, KeBugCheckEx, IoFreeIrp, _wcsnicmp, IoAllocateIrp, IoGetBaseFileSystemDeviceObject, ZwWriteFile, ZwCreateFile, strncmp, IoGetCurrentProcess, strncpy, _vsnprintf, PsGetCurrentProcessId, _snprintf, RtlTimeToTimeFields, ExSystemTimeToLocalTime, _stricmp, ZwQuerySystemInformation, _strnicmp, RtlCopyUnicodeString, ZwQueryValueKey, ZwOpenKey, ZwSetValueKey, _snwprintf, ZwClose, MmUnlockPages, MmProbeAndLockPages, IoAllocateMdl, ZwEnumerateKey, PsLookupThreadByThreadId, RtlAnsiStringToUnicodeString, RtlInitAnsiString, _strupr, _strlwr, KeDelayExecutionThread, RtlVolumeDeviceToDosName, ObfReferenceObject, IoGetDeviceObjectPointer, wcschr, wcsncmp, KeInsertQueueDpc, KeSetTargetProcessorDpc, KeInitializeDpc, KeNumberProcessors, MmMapLockedPagesSpecifyCache, KeServiceDescriptorTable, _wcsicmp, wcsrchr, strchr, strstr, wcsncpy, IoCreateNotificationEvent, ZwQuerySection, RtlInitString, ZwRequestWaitReplyPort, ZwConnectPort, MmMapLockedPages, MmGetSystemRoutineAddress, ObReferenceObjectByName, IoDriverObjectType, ZwDeleteFile, KeTickCount, NtClose, IofCallDriver, RtlCompareUnicodeString, IoBuildSynchronousFsdRequest, _alldiv, RtlEqualUnicodeString, ZwQueryDirectoryObject, ZwOpenDirectoryObject, ZwQuerySymbolicLinkObject, ZwOpenSymbolicLinkObject, IoGetDeviceInterfaces, KeBugCheck, KeSetEvent, KeWaitForSingleObject, IoFreeMdl, KeClearEvent, RtlUnwind

HAL.dll: KfLowerIrql, KeGetCurrentIrql, KfRaiseIrql

ExifTool:

file metadata

CharacterSet: Unicode

CodeSize: 62976

CompanyName: GMER

EntryPoint: 0x16005

FileDescription: GMER Driver http://www.gmer.net

FileFlagsMask: 0x003f

FileOS: Windows NT 32-bit

FileSize: 98 kB

FileSubtype: 7

FileType: Win32 EXE

FileVersion: 1, 0, 15, 4918 built by: WinDDK

FileVersionNumber: 1.0.15.4918

ImageVersion: 6.0

InitializedDataSize: 36736

InternalName: gmer.sys

LanguageCode: English (U.S.)

LinkerVersion: 8.0

MIMEType: application/octet-stream

MachineType: Intel 386 or later, and compatibles

OSVersion: 6.0

ObjectFileType: Driver

OriginalFilename: gmer.sys

PEType: PE32

ProductName: GMER

ProductVersion: 1, 0, 15, 4918

ProductVersionNumber: 1.0.15.4918

Subsystem: Native

SubsystemVersion: 5.1

TimeStamp: 2011:07:16 22:20:40+02:00

UninitializedDataSize: 0

Hope this helps you out.

Thank you for your help.

LDTate · December 8, 2011

Please do not attach the scan results from Combofx. Use copy/paste.

Vista and Windows 7 users:

1. These tools MUST be run from the executable. (.exe) every time you run them

2. With Admin Rights (Right click, choose "Run as Administrator")

Download ComboFix from one of these locations:

Link 1

Link 2 If using this link, Right Click and select Save As.

* IMPORTANT !!! Save ComboFix.exe to your Desktop

Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. Note: If you are having difficulty properly disabling your protective programs, or are unsure as to what programs need to be disabled, please refer to the information available through this link : Protective Programs
Double click on ComboFix.exe & follow the prompts.
Notes: Combofix will run without the Recovery Console installed. Skip the Recovery Console part if you're running Vista or Windows 7.
Note: If you have XP SP3, use the XP SP2 package.
If Vista or Windows 7, skip the Recovery Console part
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt using Copy / Paste in your next reply.

Notes:

1.Do not mouse-click Combofix's window while it is running. That may cause it to stall.

2. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.

3. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you -- please tell your helper.

4. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

Give it atleast 20-30 minutes to finish if needed.

Please do not attach the scan results from Combofx. Use copy/paste.

Also please describe how your computer behaves at the moment.

ghg565 · December 8, 2011

Here is the ComboFix log:

ComboFix 11-12-08.01 - Owner 12/08/2011 16:40:11.1.2 - x86

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1013.446 [GMT -7:00]

Running from: c:\documents and settings\Owner\Desktop\ComboFix.exe

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\docume~1\Owner\LOCALS~1\Temp\SASA.tmp

c:\docume~1\Owner\LOCALS~1\Temp\SASB.tmp

c:\documents and settings\All Users\Application Data\TEMP

c:\documents and settings\All Users\Application Data\TEMP\{89A43E80-AC6C-4DA8-9800-F4B30ED577C0}\PostBuild.exe

c:\documents and settings\Owner\Local Settings\Temp\SASA.tmp

c:\documents and settings\Owner\Local Settings\Temp\SASB.tmp

c:\documents and settings\Owner\WINDOWS

c:\windows\CSC\d6

c:\windows\EventSystem.log

J:\albkpq3.exe

.

((((((((((((((((((((((((( Files Created from 2011-11-08 to 2011-12-08 )))))))))))))))))))))))))))))))

.

2011-12-07 15:19 . 2011-12-07 15:19 -------- d-----w- c:\documents and settings\Administrator\Application Data\Malwarebytes

2011-12-07 14:40 . 2011-12-07 14:40 100864 ----a-w- C:\fgwyyfod.sys

2011-12-07 05:01 . 2011-12-07 05:01 -------- d-----w- c:\documents and settings\Owner\Application Data\Malwarebytes

2011-12-07 04:58 . 2010-04-29 22:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2011-12-07 04:58 . 2011-12-07 19:17 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2011-12-07 04:58 . 2011-12-07 04:58 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes

2011-12-07 04:58 . 2010-04-29 22:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys

2011-12-07 04:41 . 2011-12-07 04:41 -------- d-----w- c:\program files\Trend Micro

2011-12-07 04:33 . 2011-12-07 04:33 -------- d-----w- c:\documents and settings\Owner\Local Settings\Application Data\Western Digital

2011-12-07 01:03 . 2011-12-07 01:03 -------- d-sh--w- c:\documents and settings\Administrator\IECompatCache

2011-12-07 00:59 . 2011-12-07 00:59 -------- d-sh--w- c:\documents and settings\Administrator\PrivacIE

2011-12-07 00:47 . 2011-12-07 22:26 -------- d-----w- c:\documents and settings\Administrator\Application Data\CallingID

2011-12-07 00:46 . 2011-12-07 00:46 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\Google

2011-11-21 01:59 . 2011-11-21 01:59 -------- d-sh--w- c:\windows\system32\config\systemprofile\IETldCache

2011-11-09 15:10 . 2011-11-09 15:10 -------- d-sh--w- c:\documents and settings\Administrator\IETldCache

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2011-12-08 19:52 . 2004-08-03 23:07 187776 ----a-w- c:\windows\system32\drivers\acpi.sys

2011-12-07 04:33 . 2011-08-13 15:29 414368 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl

2011-12-07 04:28 . 2009-10-03 00:05 222080 ------w- c:\windows\system32\MpSigStub.exe

2011-10-10 14:22 . 2007-09-25 20:46 692736 ----a-w- c:\windows\system32\inetcomm.dll

2011-09-28 07:06 . 2007-09-25 22:34 599040 ----a-w- c:\windows\system32\crypt32.dll

2011-09-26 18:41 . 2008-07-30 02:59 611328 ----a-w- c:\windows\system32\uiautomationcore.dll

2011-09-26 18:41 . 2007-09-25 22:35 220160 ----a-w- c:\windows\system32\oleacc.dll

2011-09-26 18:41 . 2007-09-25 22:35 20480 ----a-w- c:\windows\system32\oleaccrc.dll

2007-10-10 02:06 . 2007-10-10 02:06 51422520 ----a-w- c:\program files\iTunes743Setup.exe

2007-10-09 05:46 . 2007-10-09 05:46 13411824 ----a-w- c:\program files\Google_Earth_BZXD.exe

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-07-01 150040]

"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-07-01 170520]

"Persistence"="c:\windows\system32\igfxpers.exe" [2008-07-01 141848]

"MDS_Menu"="c:\program files\Olympus\ib\MUITransfer\MUIStartMenu.exe" [2009-05-20 222504]

.

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-03-13 39264]

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE]

@=""

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]

2011-03-30 04:59 937920 ----a-r- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]

2011-09-07 22:58 37296 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\APSDaemon]

2011-09-27 14:22 59240 ----a-w- c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]

2007-03-12 19:49 153136 ----a-w- c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DVDtoiPodConverter_upgrade]

2007-10-12 10:15 817664 ----a-w- c:\program files\E-Zsoft\DVDtoiPodConverter\DVDtoiPodConverter.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]

2011-10-10 01:06 421736 ----a-w- c:\program files\iTunes\iTunesHelper.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]

2008-04-14 00:12 1695232 ----a-w- c:\program files\Messenger\msmsgs.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]

2007-03-10 00:53 153136 ----a-w- c:\program files\Common Files\Ahead\Lib\NeroCheck.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Olympus ib]

2010-02-05 05:47 93376 ------w- c:\program files\Olympus\ib\olycamdetect.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OnlineBackupScheduler]

2010-10-16 18:06 594760 ----a-w- c:\program files\Online Backup\OnlineBackup.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]

2011-07-06 01:36 421888 ----a-w- c:\program files\QuickTime\QTTask.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SigmatelSysTrayApp]

2006-05-26 14:58 282624 ----a-w- c:\windows\sttray.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]

2010-09-22 03:17 202256 ----a-w- c:\program files\Common Files\Real\Update_OB\realsched.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WMPNSCFG]

2006-10-19 03:05 204288 ------w- c:\program files\Windows Media Player\wmpnscfg.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]

"YahooAUService"=2 (0x2)

"gusvc"=3 (0x3)

"gupdatem"=3 (0x3)

"gupdate"=2 (0x2)

"CIDLinkAdvisorService"=2 (0x2)

"CaCCProvSP"=3 (0x3)

.

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"AntiVirusOverride"=dword:00000001

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\Program Files\\Java\\jdk1.5.0_14\\jre\\bin\\java.exe"=

"c:\\Program Files\\Google\\Google Earth\\client\\googleearth.exe"=

"c:\\Program Files\\Common Files\\Apple\\Apple Application Support\\WebKit2WebProcess.exe"=

"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=

"c:\\Program Files\\iTunes\\iTunes.exe"=

.

R1 SASKUTIL;SASKUTIL;\??\c:\program files\SUPERAntiSpyware\SASKUTIL.SYS --> c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [?]

R2 !SASCORE;SAS Core Service;"c:\program files\SUPERAntiSpyware\SASCORE.EXE" --> c:\program files\SUPERAntiSpyware\SASCORE.EXE [?]

S3 OlyCamComm;OLYMPUS USB Communication Device;c:\windows\system32\drivers\OlyCamComm.sys [8/29/2010 10:30 AM 21648]

S4 CIDLinkAdvisorService;CIDLinkAdvisorService;"c:\program files\CallingID\CallingIDLinkAdvisor2.0\LinkAdvisor\CIDLinkAdvisorService.exe" --> c:\program files\CallingID\CallingIDLinkAdvisor2.0\LinkAdvisor\CIDLinkAdvisorService.exe [?]

S4 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [1/31/2010 3:09 PM 135664]

S4 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [1/31/2010 3:09 PM 135664]

.

--- Other Services/Drivers In Memory ---

.

*Deregistered* - SASDIFSV

.

Contents of the 'Scheduled Tasks' folder

.

2011-11-29 c:\windows\Tasks\AppleSoftwareUpdate.job

- c:\program files\Apple Software Update\SoftwareUpdate.exe [2011-06-02 00:57]

.

2011-12-08 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2495073255-414440772-572454927-1005Core.job

- c:\documents and settings\Owner\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2011-12-08 05:54]

.

2011-12-08 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2495073255-414440772-572454927-1005UA.job

- c:\documents and settings\Owner\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2011-12-08 05:54]

.

2011-12-08 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-2495073255-414440772-572454927-1005.job

- c:\program files\Real\RealUpgrade\realupgrade.exe [2010-06-03 10:02]

.

2011-12-08 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-2495073255-414440772-572454927-1005.job

- c:\program files\Real\RealUpgrade\realupgrade.exe [2010-06-03 10:02]

.

------- Supplementary Scan -------

.

uInternet Settings,ProxyOverride = *.local

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

Trusted Zone: aol.com\free

TCP: DhcpNameServer = 208.180.42.100 66.76.175.100 208.180.42.68

DPF: Garmin Communicator Plug-In - hxxps://static.garmincdn.com/gcp/ie/2.9.2.0/GarminAxControl.CAB

.

- - - - ORPHANS REMOVED - - - -

.

Toolbar-Locked - (no file)

SafeBoot-26179755.sys

MSConfigStartUp-AdobeUpdater - c:\program files\Common Files\Adobe\Updater5\AdobeUpdater.exe

MSConfigStartUp-cctray - c:\program files\CA\CA Internet Security Suite\cctray\cctray.exe

MSConfigStartUp-swg - c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

MSConfigStartUp-YKNNWfXiCRNj - c:\documents and settings\All Users\Application Data\YKNNWfXiCRNj.exe

AddRemove-{CDB98E2F-7B2A-42C2-B718-F1F6B31586DF} - c:\program files\CallingID\CallingIDLinkAdvisor2.0\CIDLinkAdvisor.exe

.

**************************************************************************

.

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2011-12-08 16:47

Windows 5.1.2600 Service Pack 3 NTFS

.

scanning hidden processes ...

.

scanning hidden autostart entries ...

.

scanning hidden files ...

.

scan completed successfully

hidden files: 0

.

**************************************************************************

.

--------------------- LOCKED REGISTRY KEYS ---------------------

.

[HKEY_LOCAL_MACHINE\software\Microsoft\Internet Explorer\User Preferences]

@Denied: (2) (Administrator)

"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,

d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,f2,c5,74,66,f1,d2,b7,4e,89,1d,21,\

"6256FFB019F8FDFBD36745B06F4540E9AEAF222A25"=hex:01,00,00,00,d0,8c,9d,df,01,15,

d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,f2,c5,74,66,f1,d2,b7,4e,89,1d,21,\

.

--------------------- DLLs Loaded Under Running Processes ---------------------

.

- - - - - - - > 'winlogon.exe'(664)

c:\program files\SUPERAntiSpyware\SASWINLO.DLL

c:\windows\system32\WININET.dll

.

Completion time: 2011-12-08 16:50:04

ComboFix-quarantined-files.txt 2011-12-08 23:50

.

Pre-Run: 123,338,936,320 bytes free

Post-Run: 126,038,106,112 bytes free

.

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe

[boot loader]

timeout=2

default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS

[operating systems]

c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

UnsupportedDebug="do not select this" /debug

multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect

.

- - End Of File - - 374E51FBA79F45010616D0AFEE34D147

Thank you again for helping.

LDTate · December 8, 2011

How's it running now?

ghg565 · December 8, 2011

Hello,

Sorry I forgot to add the computers current behavior. Haven't had any issues since my DSS scan. All seems well at the moment. No issues with browser redirecting, task manager is back, I am able to run any scans, av programs without issue.

Thx again, and let me know what else needs to be done.

LDTate · December 8, 2011

Good job

The following will implement some cleanup procedures as well as reset System Restore points:

For XP:

Click START run
Now type ComboFix /Uninstall in the runbox and click OK. Note the space between the X and the /, it needs to be there.

For Vista / Windows 7

Click START Search
Now type ComboFix /Uninstall in the runbox and click OK. Note the space between the X and the /, it needs to be there.

If you used DeFogger

To re-enable your Emulation drivers, double click DeFogger to run the tool.

The application window will appear
Click the Re-enable button to re-enable your CD Emulation drivers
Click Yes to continue
A 'Finished!' message will appear
Click OK
DeFogger will now ask to reboot the machine - click OK

IMPORTANT! If you receive an error message while running DeFogger, please post the log defogger_enable which will appear on your desktop.

Your Emulation drivers are now re-enabled.

Here's my usual all clean post

To be on the safe side, I would also change all my passwords.

This infection appears to have been cleaned, but as the malware could be configured to run any program a remote attacker requires, it's impossible to be 100% sure that any machine is clean.

Log looks good

Update your AntiVirus Software - It is imperative that you update your Antivirus software at least once a week
(Even more if you wish). If you do not update your antivirus software then it will not be able to catch any of the new variants that may come out.
Use a Firewall - I can not stress how important it is that you use a Firewall on your computer.
Without a firewall your computer is succeptible to being hacked and taken over.
I am very serious about this and see it happen almost every day with my clients.
Simply using a Firewall in its default configuration can lower your risk greatly.
Using a secure browser plugin M86 SecureBrowsing makes it safe to search, surf and socialize online. This free browser plug-in displays security icons next to links on search engines and social networking sites like Facebook, Twitter and LinkedIn, so you'll know which pages are safe and which ones to avoid.
•Free browser plug-in for Internet Explorer and Firefox
•Real-time safety ratings
•Ideal for Facebook, Twitter and LinkedIn
JAVA Click this link and click on the Free JAVA Download
Visit Microsoft's Windows Update Site Frequently - It is important that you visit http://www.windowsupdate.com regularly.
This will ensure your computer has always the latest security updates available installed on your computer.
If there are new updates to install, install them immediately, reboot your computer, and revisit the site
until there are no more critical updates.

Only run one Anti-Virus and Firewall program.

I would suggest you read:

PC Safety and Security--What Do I Need?.

How to Prevent Malware:

The full version of Malwarebytes' Anti-Malware could have helped protect your computer against this threat.

We use different ways of protecting your computer(s):

Dynamically Blocks Malware Sites & Servers
Malware Execution Prevention

Save yourself the hassle and get protected.

ghg565 · December 9, 2011

Thanks again for all the help! Glad to have a clean bill of health.

LDTate · December 9, 2011

You're more than welcome.

Glad we were able to help

Peace be with you

LDTate · December 9, 2011

Since this issue is resolved I will close the thread to prevent others from posting here. If you need assistance please start your own topic and someone will be happy to assist you.

Occasional browser hijack and Win32 error

Recommended Posts

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Recently Browsing 0 members

Important Information