FUpingexe Posted December 21, 2011 ID:507497 Share Posted December 21, 2011 ok.. i got a ping.exe proces.. its using 70-99 cpu..here is that dds.txt im suposed to add.DDS (Ver_2011-08-26.01) - NTFSx86 Internet Explorer: 6.0.2900.2180Run by Stefan Glintzer at 17:20:30 on 2011-12-21Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.2038.856 [GMT 2:00].AV: ESET NOD32 antivirus system 2.70 *Disabled/Outdated* {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}AV: Symantec AntiVirus Corporate Edition *Enabled/Updated* {FB06448E-52B8-493A-90F3-E43226D3305C}.============== Running Processes ===============.C:\WINDOWS\system32\svchost -k DcomLaunchsvchost.exeC:\WINDOWS\System32\svchost.exe -k netsvcsC:\WINDOWS\system32\svchost.exe -k WudfServiceGroupsvchost.exesvchost.exeC:\Program Files\Common Files\Symantec Shared\ccSetMgr.exeC:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exeC:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exeC:\WINDOWS\system32\spoolsv.exesvchost.exeC:\Program Files\Wave Systems Corp\Common\DataServer.exeC:\WINDOWS\Explorer.EXEC:\Program Files\Symantec AntiVirus\DefWatch.exeC:\WINDOWS\system32\FsUsbExService.ExeC:\Program Files\Java\jre6\bin\jqs.exeC:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exeC:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exeC:\Program Files\Dell\QuickSet\NICCONFIGSVC.exeC:\Program Files\Eset\nod32krn.exeC:\WINDOWS\system32\PnkBstrA.exeC:\WINDOWS\system32\PnkBstrB.exeC:\Program Files\Symantec AntiVirus\SavRoam.exeC:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exeC:\WINDOWS\system32\svchost.exe -k imgsvcC:\Program Files\Symantec AntiVirus\Rtvscan.exeC:\Program Files\NTRU Cryptosystems\NTRU Hybrid TSS v2.0.25\bin\tcsd_win32.exeC:\Program Files\Vodafone\Vodafone Mobile Broadband\Bin\VmbService.exeC:\WINDOWS\system32\wscntfy.exeC:\WINDOWS\stsystra.exeC:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exeC:\WINDOWS\system32\taskmgr.exeC:\WINDOWS\system32\rundll32.exeC:\Program Files\Apoint\Apoint.exeC:\Program Files\Common Files\Symantec Shared\ccApp.exeC:\PROGRA~1\SYMANT~1\VPTray.exeC:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exeC:\Program Files\D-Link\D-Link Wireless G DWA-110\AirGCFG.exeC:\Program Files\Logitech\SetPointP\SetPoint.exeC:\WINDOWS\system32\hkcmd.exeC:\WINDOWS\system32\igfxpers.exeC:\Program Files\Logitech\Gaming Software\LWEMon.exeC:\Program Files\Vodafone\Vodafone Mobile Broadband\Bin\MobileBroadband.exeC:\PROGRA~1\A4Tech\Keyboard\Ikeymain.exeC:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exeC:\Documents and Settings\All Users\Application Data\Macrovision\FLEXnet Connect\6\ISUSPM.exeC:\Program Files\Messenger\msmsgs.exeC:\WINDOWS\system32\ctfmon.exeC:\Program Files\Samsung\Samsung New PC Studio\NPSAgent.exeC:\Program Files\Nokia\PC Internet Access\NPCIA.exeC:\Program Files\Digital Line Detect\DLG.exeC:\Program Files\Wave Systems Corp\Services Manager\Secure Update\AutoUpdate.exeC:\Program Files\Gaia Dream Creation\Gaia Wallpaper Desktop\GaiaWallpaperDesktop.exeC:\Program Files\Apoint\HidFind.exeC:\Program Files\Apoint\Apntex.exeC:\WINDOWS\system32\igfxsrvc.exeC:\Program Files\PC Connectivity Solution\ServiceLayer.exeC:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exeC:\Program Files\Common Files\LogiShrd\KHAL3\KHALMNPR.EXEC:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exeC:\Program Files\PC Connectivity Solution\Transports\NclMSBTSrv.exeC:\Documents and Settings\Stefan Glintzer\Local Settings\Application Data\Google\Chrome\Application\chrome.exeC:\Documents and Settings\Stefan Glintzer\Local Settings\Application Data\Google\Chrome\Application\chrome.exeC:\Documents and Settings\Stefan Glintzer\Local Settings\Application Data\Google\Chrome\Application\chrome.exeC:\Documents and Settings\Stefan Glintzer\Local Settings\Application Data\Google\Chrome\Application\chrome.exeC:\Documents and Settings\Stefan Glintzer\Local Settings\Application Data\Google\Chrome\Application\chrome.exeC:\Documents and Settings\Stefan Glintzer\My Documents\Downloads\multiboxing\hotkeynet.exeC:\Documents and Settings\Stefan Glintzer\Local Settings\Application Data\Google\Chrome\Application\chrome.exe.============== Pseudo HJT Report ===============.uStart Page = hxxp://securityresponse.symantec.com/avcenter/fix_homepage/mDefault_Page_URL = hxxp://securityresponse.symantec.com/avcenter/fix_homepage/mDefault_Search_URL = hxxp://securityresponse.symantec.com/avcenter/fix_homepage/mSearch Page = hxxp://securityresponse.symantec.com/avcenter/fix_homepage/mStart Page = hxxp://securityresponse.symantec.com/avcenter/fix_homepage/mWinlogon: UIHost=vistaui.exeBHO: AcroIEHlprObj Class: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 6.0\reader\activex\AcroIEHelper.dllBHO: FDMIECookiesBHO Class: {cc59e0f9-7e43-44fa-9faa-8377850bf205} - c:\program files\free download manager\iefdm2.dllBHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dllBHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dllTB: StylerToolBar: {d2f8f919-690b-4ea2-9fa7-a203d1e04f75} - c:\program files\styler\tb\StylerTB.dllTB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn\yt.dlluRun: [iSUSPM] "c:\documents and settings\all users\application data\macrovision\flexnet connect\6\ISUSPM.exe" -scheduleruRun: [bgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "c:\program files\common files\ahead\lib\NMBgMonitor.exe"uRun: [MSMSGS] "c:\program files\messenger\msmsgs.exe" /backgrounduRun: [ctfmon.exe] c:\windows\system32\ctfmon.exeuRun: [Google Update] "c:\documents and settings\stefan glintzer\local settings\application data\google\update\GoogleUpdate.exe" /cuRun: [AutoStartNPSAgent] c:\program files\samsung\samsung new pc studio\NPSAgent.exeuRun: [NokiaPCInternetAccess] "c:\program files\nokia\pc internet access\NPCIA.exe" /bmRun: [sigmatelSysTrayApp] stsystra.exemRun: [Document Manager] c:\program files\wave systems corp\services manager\docmgr\bin\docmgr.exemRun: [bluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgentmRun: [Apoint] c:\program files\apoint\Apoint.exemRun: [ccApp] "c:\program files\common files\symantec shared\ccApp.exe"mRun: [vptray] c:\progra~1\symant~1\VPTray.exemRun: [ANIWZCS2Service] c:\program files\ani\aniwzcs2 service\WZCSLDR2.exemRun: [D-Link D-Link Wireless G DWA-110] c:\program files\d-link\d-link wireless g dwa-110\AirGCFG.exemRun: [Yahoo Messenger] mRun: [EvtMgr6] c:\program files\logitech\setpointp\SetPoint.exe /launchGamingmRun: [sunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"mRun: [NPSStartup] mRun: [igfxTray] c:\windows\system32\igfxtray.exemRun: [HotKeysCmds] c:\windows\system32\hkcmd.exemRun: [Persistence] c:\windows\system32\igfxpers.exemRun: [start WingMan Profiler] c:\program files\logitech\gaming software\LWEMon.exe /nouimRun: [RaidCall] c:\raidcall\\raidcall.exemRun: [MobileBroadband] c:\program files\vodafone\vodafone mobile broadband\bin\MobileBroadband.exe /silentmRun: [iKeyWorks] c:\progra~1\a4tech\keyboard\Ikeymain.exemRun: [Malwarebytes' Anti-Malware] "c:\program files\malwarebytes' anti-malware\mbamgui.exe" /starttraydRun: [Nokia.PCSync] c:\program files\nokia\nokia pc suite 6\PcSync2.exe /NoDialogStartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\digita~1.lnk - c:\program files\digital line detect\DLG.exeStartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\embass~1.lnk - c:\program files\wave systems corp\services manager\secure update\AutoUpdate.exeStartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\gaiawa~1.lnk - c:\program files\gaia dream creation\gaia wallpaper desktop\GaiaWallpaperDesktop.exeStartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\micros~1.lnk - c:\program files\microsoft office\office10\OSA.EXEIE: Download all with Free Download Manager - file://c:\program files\free download manager\dlall.htmIE: Download selected with Free Download Manager - file://c:\program files\free download manager\dlselected.htmIE: Download video with Free Download Manager - file://c:\program files\free download manager\dlfvideo.htmIE: Download with Free Download Manager - file://c:\program files\free download manager\dllink.htmIE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office10\EXCEL.EXE/3000IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exeLSP: c:\windows\system32\imon.dllDPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cabDPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cabDPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cabTCP: DhcpNameServer = 196.207.36.251 196.207.36.254TCP: Interfaces\{82A2685A-1BA5-432E-A691-B1225C81DD74} : DhcpNameServer = 196.207.36.251 196.207.36.254Handler: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - c:\program files\common files\microsoft shared\web folders\PKMCDO.DLLHandler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLLNotify: igfxcui - igfxdev.dllNotify: LBTWlgn - c:\program files\common files\logishrd\bluetooth\LBTWlgn.dllNotify: NavLogon - c:\windows\system32\NavLogon.dllAppInit_DLLs: wxvault.dll, NVDESK32.DLLSSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dllLSA: Authentication Packages = msv1_0 wvauth.============= SERVICES / DRIVERS ===============.R0 Vax347b;Vax347b;c:\windows\system32\drivers\Vax347b.sys [2010-3-19 159616]R0 Vax347s;Vax347s;c:\windows\system32\drivers\Vax347s.sys [2010-3-19 5248]R1 nod32drv;nod32drv;c:\windows\system32\drivers\nod32drv.sys [2010-1-27 15424]R1 SAVRT;SAVRT;c:\program files\symantec antivirus\savrt.sys [2006-9-7 337592]R1 SAVRTPEL;SAVRTPEL;c:\program files\symantec antivirus\Savrtpel.sys [2006-9-7 54968]R2 ccEvtMgr;Symantec Event Manager;c:\program files\common files\symantec shared\ccEvtMgr.exe [2006-7-20 192160]R2 ccSetMgr;Symantec Settings Manager;c:\program files\common files\symantec shared\ccSetMgr.exe [2006-7-20 169632]R2 FsUsbExService;FsUsbExService;c:\windows\system32\FsUsbExService.Exe [2011-7-22 233472]R2 LBeepKE;Logitech Beep Suppression Driver;c:\windows\system32\drivers\LBeepKE.sys [2010-12-25 10448]R2 MBAMService;MBAMService;c:\program files\malwarebytes' anti-malware\mbamservice.exe [2011-12-21 366152]R2 NOD32krn;NOD32 Kernel Service;c:\program files\eset\nod32krn.exe [2010-1-27 552064]R2 SavRoam;SAVRoam;c:\program files\symantec antivirus\SavRoam.exe [2006-9-28 116464]R2 StarWindService;StarWind iSCSI Service;c:\program files\alcohol soft\alcohol 120\starwind\StarWindService.exe [2005-4-2 217600]R2 Symantec AntiVirus;Symantec AntiVirus;c:\program files\symantec antivirus\Rtvscan.exe [2006-9-28 1813232]R2 VmbService;Vodafone Mobile Broadband Service;c:\program files\vodafone\vodafone mobile broadband\bin\VmbService.exe [2011-7-14 9216]R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\common files\symantec shared\eengine\EraserUtilRebootDrv.sys [2011-11-11 106104]R3 ewusbnet;HUAWEI USB-NDIS miniport;c:\windows\system32\drivers\ewusbnet.sys [2010-12-3 237440]R3 FsUsbExDisk;FsUsbExDisk;c:\windows\system32\FsUsbExDisk.Sys [2011-7-22 36608]R3 huawei_enumerator;huawei_enumerator;c:\windows\system32\drivers\ew_jubusenum.sys [2011-11-21 73344]R3 Ma730Pt;MA730 Bluetooth VCOM Driver;c:\windows\system32\drivers\ma730Pt.sys [2010-1-29 103040]R3 Ma730Vad;MA730 Bluetooth Audio;c:\windows\system32\drivers\Ma730Vad.sys [2010-1-29 23376]R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2011-12-21 22216]R3 NAVENG;NAVENG;c:\progra~1\common~1\symant~1\virusd~1\20111220.002\naveng.sys [2011-12-21 86136]R3 NAVEX15;NAVEX15;c:\progra~1\common~1\symant~1\virusd~1\20111220.002\navex15.sys [2011-12-21 1576312]S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2010-12-13 136176]S3 ew_hwusbdev;Huawei MobileBroadband USB PNP Device;c:\windows\system32\drivers\ew_hwusbdev.sys [2011-11-21 102784]S3 gupdatem;Google Update Service (gupdatem);c:\program files\google\update\GoogleUpdate.exe [2010-12-13 136176]S3 hwusbfake;Huawei DataCard USB Fake;c:\windows\system32\drivers\ewusbfake.sys [2011-2-8 100736]S3 massfilter;ZTE Mass Storage Filter Driver;c:\windows\system32\drivers\massfilter.sys [2010-4-9 7680]S3 nmwcdnsu;Nokia USB Flashing Phone Parent;c:\windows\system32\drivers\nmwcdnsu.sys [2011-10-14 137344]S3 PROCEXP151;PROCEXP151;\??\c:\windows\system32\drivers\procexp151.sys --> c:\windows\system32\drivers\PROCEXP151.SYS [?]S3 s1029bus;Sony Ericsson Device 1029 driver (WDM);c:\windows\system32\drivers\s1029bus.sys [2010-5-8 90280]S3 s1029mdfl;Sony Ericsson Device 1029 USB WMC Modem Filter;c:\windows\system32\drivers\s1029mdfl.sys [2010-5-8 15016]S3 s1029mdm;Sony Ericsson Device 1029 USB WMC Modem Driver;c:\windows\system32\drivers\s1029mdm.sys [2010-5-8 122280]S3 s1029mgmt;Sony Ericsson Device 1029 USB WMC Device Management Drivers (WDM);c:\windows\system32\drivers\s1029mgmt.sys [2010-5-8 115880]S3 s1029nd5;Sony Ericsson Device 1029 USB Ethernet Emulation (NDIS);c:\windows\system32\drivers\s1029nd5.sys [2010-5-8 26024]S3 s1029obex;Sony Ericsson Device 1029 USB WMC OBEX Interface;c:\windows\system32\drivers\s1029obex.sys [2010-5-8 111912]S3 s1029unic;Sony Ericsson Device 1029 USB Ethernet Emulation (WDM);c:\windows\system32\drivers\s1029unic.sys [2010-5-8 116904]S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504]S3 ZTEusbnet;ZTE USB-NDIS miniport;c:\windows\system32\drivers\ZTEusbnet.sys [2010-4-9 110080]S3 ZTEusbvoice;ZTE VoUSB Port;c:\windows\system32\drivers\zteusbvoice.sys [2010-4-9 104960].=============== Created Last 30 ================.2011-12-21 10:49:41 -------- d-----w- c:\documents and settings\stefan glintzer\application data\Malwarebytes2011-12-21 10:48:36 -------- d-----w- c:\documents and settings\all users\application data\Malwarebytes2011-12-21 10:48:19 22216 ----a-w- c:\windows\system32\drivers\mbam.sys2011-12-21 10:48:18 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware2011-12-20 23:41:43 -------- d--h--w- c:\documents and settings\all users\application data\Common Files2011-12-20 23:19:20 -------- d-----w- c:\windows\system32\NtmsData2011-12-20 22:40:45 -------- d-----w- c:\documents and settings\all users\application data\MFAData2011-12-18 17:46:22 -------- d-----w- C:\Fraps2011-12-17 18:38:37 -------- d-----w- c:\program files\RetroEpic2011-12-01 11:16:08 -------- d-----w- c:\program files\A4Tech2011-12-01 11:06:44 -------- d-----w- c:\documents and settings\stefan glintzer\application data\DriverFinder2011-11-30 15:27:40 -------- d-----w- c:\documents and settings\stefan glintzer\application data\.minecraft2011-11-29 13:00:32 -------- d-----w- c:\program files\IObit2011-11-29 13:00:32 -------- d-----w- c:\documents and settings\all users\application data\IObit.==================== Find3M ====================.2011-12-07 16:44:19 21840 ----atw- c:\windows\system32\SIntfNT.dll2011-12-07 16:44:19 17212 ----atw- c:\windows\system32\SIntf32.dll2011-12-07 16:44:19 12067 ----atw- c:\windows\system32\SIntf16.dll2011-10-22 11:21:38 65536 ----a-w- c:\windows\system32\frapsvid.dll.=================== ROOTKIT ====================.Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.netWindows 5.1.2600 Disk: Hitachi_HTS721080G9SA00 rev.MC4OC10H -> Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3 .device: opened successfullyuser: MBR read successfully.Disk trace:called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys >>UNKNOWN [0x8A6E44D0]<< _asm { PUSH EBP; MOV EBP, ESP; PUSH ECX; MOV EAX, [EBP+0x8]; CMP EAX, [0x8a6ea7d0]; MOV EAX, [0x8a6ea84c]; PUSH EBX; PUSH ESI; MOV ESI, [EBP+0xc]; MOV EBX, [ESI+0x60]; PUSH EDI; JNZ 0x20; MOV [EBP+0x8], EAX; }1 ntkrnlpa!IofCallDriver[0x804EEF9C] -> \Device\Harddisk0\DR0[0x8A7B5030]3 CLASSPNP[0xBA10905B] -> ntkrnlpa!IofCallDriver[0x804EEF9C] -> [0x8A6A1B08]\Driver\atapi[0x8A7F91B0] -> IRP_MJ_CREATE -> 0x8A6E44D0error: Read A device attached to the system is not functioning.kernel: MBR read successfully_asm { XOR AX, AX; MOV SS, AX; MOV SP, 0x7c00; STI ; PUSH AX; POP ES; PUSH AX; POP DS; CLD ; MOV SI, 0x7c1b; MOV DI, 0x61b; PUSH AX; PUSH DI; MOV CX, 0x1e5; REP MOVSB ; RETF ; MOV BP, 0x7be; MOV CL, 0x4; CMP [bP+0x0], CH; JL 0x2e; JNZ 0x3a; }detected disk devices:detected hooks:\Driver\atapi DriverStartIo -> 0x8A6E431Buser & kernel MBR OK Warning: possible TDL3 rootkit infection !.============= FINISH: 17:21:40.01 =============== Link to post Share on other sites More sharing options...
Maurice Naggar Posted February 2, 2012 ID:522950 Share Posted February 2, 2012 Hello,Would you advise if you have resolved your issues or if you have sought help elsewhere?If not resolved and you are not already seeking help elsewhere, I'd like for you to rerun a new (fresh) DDS and Copy & Paste the DDS.txt into a new reply.Anyone other than original-poster who has similar issues, do not reply here. Start your own topic. Link to post Share on other sites More sharing options...
Maurice Naggar Posted February 6, 2012 ID:524074 Share Posted February 6, 2012 Due to the lack of feedback this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread. Thanks! Link to post Share on other sites More sharing options...
Recommended Posts