Referrred here, (combofix log included)

jay2009 · February 15, 2009

referred here as shown in this post

http://www.malwarebytes.org/forums/index.p...amp;#entry56664

(please note someone is spamming my name on this and other forums, disregard or remove their posts,)

thanks for all the help!

i was able to run combofix earleir, but after trying to generate a log it seems that i cannot launch either combofix or mbam

i click on them and they say run but they do not launch?

awaiting help

AdvancedSetup · February 15, 2009

Well if neither program will run in either Normal or Safe Mode and trying a few different names then please run the following.

Avira AntiVir Rescue System

Requires access to a working computer with a CD/DVD burner to create a bootable CD.

Download the
Avira AntiVir Rescue System
from
here
Place a blank CD in your burner and double-click on the downloaded file.
The program will automatically burn the CD for you.
Place the burned CD into the affected computer and start the computer from this CD.
On the bottom left side of the screen there are 2 flags. Using your mouse click on the British flag to use English.
Click on the
Configuration
button.
- Select
  Scan all files
- Select
  Try to repair infected files
  and
  Rename files, if they cannot be removed
- Select
  Scan for dialers
- Select
  Scan for joke programs (Jokes)
- Select
  Scan for games
- Select
  Scan for spyware (SPR)
[*]
Click on
Virus scanner
[*]
Click on
Start scanner
at the bottom of the screen
[*]
Currently the program does not support saving a log. Write down the amount of items for Records, Suspect files, and Warnings

The Avira AntiVir Rescue System is a Linux-based application that allows accessing computers that cannot be booted anymore and is updated several times a day so that the most recent security updates are always available.

Screen resolution problems

Please see the post

here

if you're unable to view the entire screen of Avira.

jay2009 · February 15, 2009

will try that disc today, as long as it doesnt interfere with the files in this system (FYI thanks for closing that other post, if possible you can just delete it, having it show up in search results just fuels the flames for people in the future.

I dont know who that person was but they came from annoyances.org NUFF SAID!

thanks for the tip will try it today!

Well if neither program will run in either Normal or Safe Mode and trying a few different names then please run the following.
Avira AntiVir Rescue System
Requires access to a working computer with a CD/DVD burner to create a bootable CD.
Download the
Avira AntiVir Rescue System
from
here
Place a blank CD in your burner and double-click on the downloaded file.

The program will automatically burn the CD for you.

Place the burned CD into the affected computer and start the computer from this CD.

On the bottom left side of the screen there are 2 flags. Using your mouse click on the British flag to use English.

Click on the
Configuration
button.

Select
Scan all files
Select
Try to repair infected files
and
Rename files, if they cannot be removed

Select
Scan for dialers

Select
Scan for joke programs (Jokes)

Select
Scan for games

Select
Scan for spyware (SPR)

[*]
Click on
Virus scanner
[*]
Click on
Start scanner
at the bottom of the screen
[*]
Currently the program does not support saving a log. Write down the amount of items for Records, Suspect files, and Warnings
The Avira AntiVir Rescue System is a Linux-based application that allows accessing computers that cannot be booted anymore and is updated several times a day so that the most recent security updates are always available.
Screen resolution problems
Please see the post
here
http://forum.avira.com/wbb/index.php?page=Thread&threadID=82578' rel="external nofollow">
if you're unable to view the entire screen of Avira.

jay2009 · February 15, 2009

Just a follow up, i installed and burned the anti

when i launched the CD in linux (via boot) i was unable to get it to scan, i tried to point the mnt/ to sda5 (which is the disk with the infected system on it) but every time i clicked scan it said finished, nothing happened

in linux i am familiar with the normal operations, yet it seemed like it was not even responding

awaiting advice!

jay2009 · February 15, 2009

anyone?

Just a follow up, i installed and burned the anti
when i launched the CD in linux (via boot) i was unable to get it to scan, i tried to point the mnt/ to sda5 (which is the disk with the infected system on it) but every time i clicked scan it said finished, nothing happened
in linux i am familiar with the normal operations, yet it seemed like it was not even responding
awaiting advice!

AdvancedSetup · February 15, 2009

Please be patient - there are many users requesting help as well. When replying please click on the ADDREPLY button - not on the REPLY button.

Please run the following scanner on the system then.

Download to the desktop: Dr.Web CureIt

Doubleclick the drweb-cureit.exe file and Allow to run the express scan
This will scan the files currently running in memory and when something is found, click the yes button when it asks you if you want to cure it. This is only a short scan.
Once the short scan has finished, Click Options > Change settings
Choose the "Scan"-tab, remove the mark at "Heuristic analysis".
Back at the main window, mark the drives that you want to scan.
Select all drives. A red dot shows which drives have been chosen.
Click the green arrow at the right, and the scan will start.
Click 'Yes to all' if it asks if you want to cure/move the file.
When the scan has finished, look if you can click next icon next to the files found:

If so, click it and then click the next icon right below and select Move incurable as you'll see in next image:

This will move it to the %userprofile%\DoctorWeb\quarantaine-folder if it can't be cured. (this in case if we need samples)
After selecting, in the Dr.Web CureIt menu on top, click file and choose save report list
Save the report to your desktop. The report will be called DrWeb.csv
Close Dr.Web Cureit.
Reboot your computer!! Because it could be possible that files in use will be moved/deleted during reboot.
After reboot, post the contents of the log from Dr.Web you saved previously in your next reply with a new hijackthis log.

Also try to run a Disk Check on the volume. From DOS - CHKDSK C: /F

jay2009 · February 16, 2009

ok just so you know thanks for the help

ran a scan with the dr program, then an advanced scan which locked up the pc after 3 hours, so if i do another it will be after i turn in for the night

this pc is still functional for now

the pc seems to be crashing every second after that scan went down though, i will try a reboot as nothing seems to work without freezing on me

(another weird thing is now happening, may not be related to the bugs though) the firefox thumbnails are no longer showing up on some webpages, or even regular images for that matter

thats the update

AdvancedSetup · February 16, 2009

Well maybe do a disk check on the drive

CHKDSK C: /F

or what drive it is. Then reboot.

If these don't work then take the drive out and slave it to a working PC with Dr Web installed or Kaspersky.

If you can't get it to stop crashing as is and can't run an Avira boot CD then your options are getting limited.

jay2009 · February 16, 2009

ok im running a basic chkdsk on the volume right now

as for the /F it tries to lock the volume, and when it reoboots it DOES NOT do its scan

kaspersky (havent tried that in a long time

im still trying to work at this, any help is greatly appreciated

AdvancedSetup · February 16, 2009

It might not do a CHDKSK due to AV drivers, Video drivers, or even Malware.

If you have an ULTIMATE BOOT CD 4 Windows you could do those fixes.

If you're a Tech as said then you should have or build one of these disks just for stuff like this.

jay2009 · February 16, 2009

hope this helps

this is obviously something thoroughly in the system now!

AdvancedSetup · February 16, 2009

Go here Ultimate Boot CD for Windows and read a little and download and build one of these disks. Then boot up with it and you can use all kinds of repair tools on that drive.

List of Tools on the CD

http://www.ubcd4win.com/contents.htm

jay2009 · February 16, 2009

just so were all on the same page, i was able to complete a scan with drweb last night during the overnight (while the pc was idel) it found some very intersting things in my system32 directory, i am reverting back to the instructions given for that step in this post for now, before moving further

will update after a reboot!

jay2009 · February 16, 2009

drweb report

vremover.exe;C:\data storage\software;Program.AnalogProxy;Incurable.Moved.;

CurrProcess.exe;C:\data storage\software\bart boot cd\PROGRAMS\Applications;Tool.CurrProcess.110;Incurable.Moved.;

ipscan.exe;C:\data storage\software\bart boot cd\PROGRAMS\IPScan;Tool.AngryIpscan;Incurable.Moved.;

vncconfig.exe;C:\data storage\software\bart boot cd\PROGRAMS\vncserver;Program.RemoteAdmin;Incurable.Moved.;

winvnc4.exe;C:\data storage\software\bart boot cd\PROGRAMS\vncserver;Program.RemoteAdmin;Incurable.Moved.;

WM_HOOKS.DLL;C:\data storage\software\bart boot cd\SYSTEM32;Program.RemoteAdmin;Incurable.Moved.;

Process.exe;C:\Documents and Settings\administrator.ZTEKCORP\My Documents\SmitfraudFix\SmitfraudFix;Tool.Prockill;Incurable.Moved.;

restart.exe;C:\Documents and Settings\administrator.ZTEKCORP\My Documents\SmitfraudFix\SmitfraudFix;Tool.ShutDown.14;Incurable.Moved.;

rc10ancd.EXE;C:\Program Files\Psygnosis\Rollcage Stage II;Tool.GameCrack;Incurable.Moved.;

rc10ancd.EXE;C:\Program Files\Psygnosis\Rollcage Stage II\rc10ancd;Tool.GameCrack;Incurable.Moved.;

Sample.dll;C:\Program Files\Rightload\plugins;Trojan.DownLoader.origin;Incurable.Moved.;

WinVNC.exe;C:\Program Files\TightVNC;Program.WinVnc;Incurable.Moved.;

senekamnvaqgrr.sys.vir;C:\Qoobox\Quarantine\C\WINDOWS\system32\drivers;BackDoor.Tdss.57;Deleted.;

Process.exe;C:\SmitfraudFix;Tool.Prockill;Incurable.Moved.;

restart.exe;C:\SmitfraudFix;Tool.ShutDown.14;Incurable.Moved.;

Process.exe;C:\WINDOWS\system32;Tool.Prockill;Incurable.Moved.;

xihahcck.dll;C:\WINDOWS\system32;Trojan.DownLoad.28016;Deleted.;

hijackthis log

Logfile of HijackThis v1.99.1

Scan saved at 10:23:36, on 02/16/2009

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\savedump.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\System32\WLTRYSVC.EXE

C:\WINDOWS\System32\bcmwltry.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe

C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\OEM02Mon.exe

C:\Program Files\VMware\VMware Workstation\vmware-tray.exe

C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe

C:\WINDOWS\system32\wuauclt.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\data storage\software\AV-removal\hijackthis\HijackThis.exe

O4 - HKLM\..\Run: [vmware-tray] C:\Program Files\VMware\VMware Workstation\vmware-tray.exe

O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto

O4 - HKCU\..\Run: [Messenger (Yahoo!)] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll

O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe

O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = ZTEK.corp

O17 - HKLM\Software\..\Telephony: DomainName = ZTEK.corp

O17 - HKLM\System\CCS\Services\Tcpip\..\{1414EC86-24E2-4125-A830-017786A7F9EF}: NameServer = 192.168.1.2,4.2.2.2

O17 - HKLM\System\CCS\Services\Tcpip\..\{29BBAE27-D70B-4D9A-B104-2D8D9C8D4D82}: NameServer = 4.2.2.2,192.168.1.2

O17 - HKLM\System\CCS\Services\Tcpip\..\{5DBB5200-8BB1-44A5-B336-66359E0A8B71}: NameServer = 4.2.2.2

O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = ZTEK.corp

O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = ZTEK.corp

O17 - HKLM\System\CS3\Services\Tcpip\Parameters: Domain = ZTEK.corp

O17 - HKLM\System\CS4\Services\Tcpip\Parameters: Domain = ZTEK.corp

O17 - HKLM\System\CS5\Services\Tcpip\Parameters: Domain = ZTEK.corp

O17 - HKLM\System\CS6\Services\Tcpip\Parameters: Domain = ZTEK.corp

O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll

O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe

O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe

O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe

O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE

standing by...

jay2009 · February 16, 2009

ok heres the full update

took the pc out of network and ran the ubcd on it

the following was performed

ran a squared FULL SCAN removed several low priority threats

ran full scan using antivir no problems found

checked several things using ezpcfix (no problems found)

after reboot malwarebytes software STILL WILL NOT LOAD

hijackthis will work if using an older file, however the newer install will not launch, i suspect i just might have some corrupt installs though (wishful thinking?)

not sure where we go from here, a test of TEN consecutive clicks off of google results brings me to the pages requested, so i am not sure if that demon is still lurking

maybe whatever this was is gone, i will await further instructions (FYI, i am a tech as stated, but i never saw something riddle so fast through a system, i know that we get security updates everyday and tehy are getting smarter at virus and spyware malware placements, but this thing was viscuios.)

I do appreciate all the help from this forum!

HIJACKTHIS LOG (most current)

Logfile of HijackThis v1.99.1

Scan saved at 4:09:22, on 02/16/2009

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\System32\WLTRYSVC.EXE

C:\WINDOWS\System32\bcmwltry.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe

C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\VMware\VMware Workstation\vmware-tray.exe

C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Program Files\Windows NT\Accessories\WORDPAD.EXE