Jump to content

Trojan.Agent & Rootkit.Agent, not deleted by MBAM


Recommended Posts

Hi there,

I do extended virus checking with Antivir, Mbam, Skybot and some online scanners on a monthly basis.

Now I stumbled upon this to nasty things: Trojan.Agent & Rootkit.Agent. Mbam says it will delete them on

reboot, but after each reboot they're still found by Mbam.

I dont know if it is important, but in September of the last year, I had an infection with Vundo and I think I got rid of it.

Here are my logs:

-----------------------------------------------

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 12:12:59, on 3/29/2009

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v8.00 (8.00.6001.18702)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Avira\AntiVir Desktop\sched.exe

C:\Program Files\Avira\AntiVir Desktop\avguard.exe

C:\Program Files\Intel\AMT\atchksrv.exe

C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe

C:\Program Files\Intel\AMT\LMS.exe

C:\Program Files\Autodesk\3ds Max 2008\mentalray\satellite\raysat_3dsMax2008_32server.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Intel\AMT\UNS.exe

C:\WINDOWS\system32\SearchIndexer.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\TortoiseSVN\bin\TSVNCache.exe

C:\Program Files\Analog Devices\Core\smax4pnp.exe

C:\Program Files\FreePDF_XP\fpassist.exe

C:\Program Files\Intel\AMT\atchk.exe

C:\Program Files\Avira\AntiVir Desktop\avgnt.exe

C:\WINDOWS\system32\ctfmon.exe

C:\WINDOWS\system32\SearchProtocolHost.exe

C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe

C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Program Files\Java\jre6\bin\java.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll

O2 - BHO: (no name) - {275BB5EB-1FF1-4299-A418-5756A9535B98} - C:\WINDOWS\system32\atmf.dll (file missing)

O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

O4 - HKLM\..\Run: [Cpqset] C:\Program Files\Hewlett-Packard\Default Settings\cpqset.exe

O4 - HKLM\..\Run: [soundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe

O4 - HKLM\..\Run: [startCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [FreePDF Assistant] C:\Program Files\FreePDF_XP\fpassist.exe

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [atchk] "C:\Program Files\Intel\AMT\atchk.exe"

O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"

O4 - HKLM\..\RunOnce: [WIAWizardMenu] RUNDLL32.EXE C:\WINDOWS\system32\sti_ci.dll,WiaCreateWizardMenu

O4 - HKLM\..\RunOnce: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000

O8 - Extra context menu item: Send to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm

O8 - Extra context menu item: Send To Bluetooth - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm

O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL

O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm

O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm

O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O16 - DPF: {BDBDE413-7B1C-4C68-A8FF-C5B2B4090876} (F-Secure Online Scanner 3.3) - http://support.f-secure.com/ols/fscax.cab

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL

O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe

O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe

O23 - Service: Intel® Active Management Technology System Status Service (atchksrv) - Intel Corporation - C:\Program Files\Intel\AMT\atchksrv.exe

O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe

O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe

O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe

O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe

O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe

O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

O23 - Service: getPlus® Helper - NOS Microsystems Ltd. - C:\Program Files\NOS\bin\getPlus_HelperSvc.exe

O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe

O23 - Service: Intel® Active Management Technology Local Management Service (LMS) - Intel Corporation - C:\Program Files\Intel\AMT\LMS.exe

O23 - Service: mental ray 3.6 Satellite for Autodesk 3ds Max 2008 32-bit 32-bit (mi-raysat_3dsMax2008_32) - Unknown owner - C:\Program Files\Autodesk\3ds Max 2008\mentalray\satellite\raysat_3dsMax2008_32server.exe

O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe

O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe

O23 - Service: Intel® Active Management Technology User Notification Service (UNS) - Intel Corporation - C:\Program Files\Intel\AMT\UNS.exe

--

End of file - 8894 bytes

--------------------------------------------

---------------------------------------------

Malwarebytes' Anti-Malware 1.35

Database version: 1910

Windows 5.1.2600 Service Pack 3

3/29/2009 12:12:22 PM

mbam-log-2009-03-29 (12-12-16).txt

Scan type: Quick Scan

Objects scanned: 70191

Time elapsed: 4 minute(s), 27 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 4

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 1

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Settings\bf (Trojan.Agent) -> No action taken.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Settings\bk (Trojan.Agent) -> No action taken.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Settings\iu (Trojan.Agent) -> No action taken.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Settings\mu (Trojan.Agent) -> No action taken.

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

C:\Documents and Settings\md\Local Settings\temp\aqccykqd.dat (Rootkit.Agent) -> No action taken.

--------------------------------------------

I really apriciate your service.

Link to post
Share on other sites

  • Staff

Hi,

What's up with the spaces in your log? Please delete the extra spaces, because it stretches the page.

* Please visit this webpage for instructions for downloading and running ComboFix:

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

Post the log from ComboFix in your next reply.

Please make sure you disable ALL of your Antivirus/Antispyware/Firewall before running ComboFix..This because Security Software may see some components ComboFix uses (prep.com for example) as suspicious and blocks the tool, or even deletes it. Please visit HERE if you don't know how.

Link to post
Share on other sites

Ok, heres the scan-log:

ComboFix 09-03-31.01 - md 2009-03-31 14:54:33.1 - NTFSx86

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2047.1497 [GMT -7:00]

Running from: c:\documents and settings\md\Desktop\ComboFix.exe

AV: AntiVir Desktop *On-access scanning disabled* (Updated)

* Created a new restore point

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\windows\system32\tmp.reg

.

((((((((((((((((((((((((( Files Created from 2009-02-28 to 2009-03-31 )))))))))))))))))))))))))))))))

.

2009-03-30 22:48 . 2009-03-30 22:48 <DIR> d--hs---- c:\documents and settings\NetworkService\IETldCache

2009-03-30 00:26 . 2009-03-30 15:16 <DIR> d-------- C:\ergodata

2009-03-29 11:49 . 2009-01-09 12:19 1,089,593 -----c--- c:\windows\system32\dllcache\ntprint.cat

2009-03-29 11:45 . 2009-03-29 11:44 73,728 --a------ c:\windows\system32\javacpl.cpl

2009-03-29 11:27 . 2009-03-29 11:27 <DIR> d-------- c:\windows\system32\XPSViewer

2009-03-29 11:26 . 2009-03-29 11:26 <DIR> d-------- C:\4e427f16206304bff318a63d27e43e

2009-03-29 11:26 . 2008-07-06 05:06 1,676,288 --------- c:\windows\system32\xpssvcs.dll

2009-03-29 11:26 . 2008-07-06 05:06 1,676,288 -----c--- c:\windows\system32\dllcache\xpssvcs.dll

2009-03-29 11:26 . 2008-07-06 03:50 597,504 -----c--- c:\windows\system32\dllcache\printfilterpipelinesvc.exe

2009-03-29 11:26 . 2008-07-06 05:06 575,488 --------- c:\windows\system32\xpsshhdr.dll

2009-03-29 11:26 . 2008-07-06 05:06 575,488 -----c--- c:\windows\system32\dllcache\xpsshhdr.dll

2009-03-29 11:26 . 2008-07-06 05:06 117,760 --------- c:\windows\system32\prntvpt.dll

2009-03-29 11:26 . 2008-07-06 05:06 89,088 -----c--- c:\windows\system32\dllcache\filterpipelineprintproc.dll

2009-03-29 11:25 . 2009-03-29 11:25 <DIR> d--hs---- c:\documents and settings\md\PrivacIE

2009-03-29 11:24 . 2009-03-29 11:24 <DIR> d--hs---- c:\documents and settings\LocalService\IETldCache

2009-03-29 11:23 . 2009-03-29 11:23 <DIR> d--hs---- c:\documents and settings\md\IETldCache

2009-03-29 11:14 . 2009-03-29 11:14 584 --a------ c:\windows\imsins.BAK

2009-03-29 11:11 . 2009-03-29 11:14 <DIR> d--h-c--- c:\windows\ie8

2009-03-29 11:09 . 2009-03-29 11:20 <DIR> d-------- c:\windows\SxsCaPendDel

2009-03-27 02:28 . 2009-03-27 02:28 <DIR> d-------- c:\program files\PTGui

2009-03-27 02:28 . 2009-03-30 21:57 <DIR> d-------- c:\documents and settings\md\Application Data\PTGui

2009-03-26 06:14 . 2008-11-20 12:19 9,200 --------- c:\windows\system32\drivers\cdralw2k.sys

2009-03-26 06:14 . 2008-11-20 12:19 9,072 --------- c:\windows\system32\drivers\cdr4_xp.sys

2009-03-26 06:11 . 2009-03-26 06:11 <DIR> d-------- c:\windows\system32\IOSUBSYS

2009-03-25 04:46 . 2009-03-25 04:46 <DIR> d-------- c:\documents and settings\md\Application Data\Canon

2009-03-25 04:45 . 2009-03-27 00:54 <DIR> d-------- c:\documents and settings\All Users\Application Data\PhotoStitch

2009-03-25 04:30 . 2009-03-25 04:30 <DIR> d-------- c:\program files\Avira

2009-03-25 04:30 . 2009-03-25 04:30 <DIR> d-------- c:\documents and settings\All Users\Application Data\Avira

2009-03-25 04:30 . 2009-02-13 11:31 55,640 --a------ c:\windows\system32\drivers\avgntflt.sys

2009-03-24 17:26 . 2009-03-24 17:26 <DIR> d-------- c:\program files\Common Files\postureAgent

2009-03-24 17:26 . 2007-11-09 16:18 920,088 --a------ c:\windows\system32\mesoludlg.exe

2009-03-24 17:26 . 2006-11-10 09:25 319,456 --a------ c:\windows\system32\difxapi.dll

2009-03-24 08:15 . 2009-03-24 08:15 <DIR> d-------- c:\program files\Canon

2009-03-24 08:14 . 2009-03-24 08:14 <DIR> d-------- c:\program files\Common Files\Canon

2009-03-20 11:50 . 2009-03-20 11:50 3,358,720 --a------ c:\windows\system32\GPhotos.scr

2009-03-14 07:02 . 2009-03-14 07:02 <DIR> d-------- c:\documents and settings\md\Application Data\.Kanton ZH

2009-03-14 04:59 . 2009-03-14 04:59 <DIR> d--h----- c:\program files\Zero G Registry

2009-03-14 04:59 . 2009-03-14 05:08 <DIR> d-------- c:\program files\Private Tax 2008

2009-03-14 04:58 . 2009-03-14 04:58 <DIR> d--h----- c:\documents and settings\md\InstallAnywhere

2009-03-12 17:22 . 2008-04-13 17:12 221,184 --a------ c:\windows\system32\wmpns.dll

2009-03-12 07:40 . 2009-03-12 07:40 <DIR> d-------- c:\program files\FreePDF_XP

2009-03-12 07:40 . 2009-03-12 07:41 <DIR> d-------- c:\documents and settings\All Users\FreePDF

2009-03-12 07:40 . 2008-02-25 14:23 119,152 --a------ c:\windows\system32\redmon.hlp

2009-03-12 07:40 . 2008-02-25 14:23 116,224 --a------ c:\windows\system32\redmonnt.dll

2009-03-12 07:40 . 2008-02-25 14:23 45,056 --a------ c:\windows\system32\unredmon.exe

2009-03-08 14:22 . 2009-03-08 14:22 49,152 --------- c:\windows\system32\msrating.dll.mui

2009-03-08 14:22 . 2009-03-08 14:22 2,560 --------- c:\windows\system32\mshta.exe.mui

2009-03-08 14:21 . 2009-03-08 14:21 4,096 --------- c:\windows\system32\ie4uinit.exe.mui

2009-03-08 14:20 . 2009-03-08 14:20 81,920 --------- c:\windows\system32\iedkcs32.dll.mui

2009-02-23 16:09 . 2009-02-23 16:09 <DIR> d-------- c:\program files\CCleaner

2009-02-23 12:01 . 2009-02-23 12:01 <DIR> d-------- C:\fsaua.data

2009-02-12 22:20 . 2009-02-12 22:20 5,630 --------- c:\windows\system32\IE8Eula.rtf

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-03-31 07:17 --------- d-----w c:\documents and settings\md\Application Data\Skype

2009-03-31 04:58 --------- d-----w c:\documents and settings\md\Application Data\MAXON

2009-03-30 23:36 --------- d-----w c:\documents and settings\md\Application Data\skypePM

2009-03-29 18:44 410,984 ----a-w c:\windows\system32\deploytk.dll

2009-03-28 09:18 --------- d-----w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy

2009-03-28 08:56 --------- d-----w c:\program files\Malwarebytes' Anti-Malware

2009-03-28 08:36 --------- d-----w c:\program files\Spybot - Search & Destroy

2009-03-27 09:19 --------- d-----w c:\documents and settings\md\Application Data\Azureus

2009-03-26 23:49 38,496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys

2009-03-26 23:49 15,504 ----a-w c:\windows\system32\drivers\mbam.sys

2009-03-26 13:11 --------- d-----w c:\program files\Google

2009-03-25 00:26 --------- d-----w c:\program files\Intel

2009-03-16 10:09 --------- d-----w c:\program files\Common Files\Adobe

2009-03-13 00:22 --------- d-----w c:\documents and settings\All Users\Application Data\Microsoft Help

2009-03-12 16:10 --------- d-----w c:\documents and settings\All Users\Application Data\Apple Computer

2009-03-08 14:59 --------- d-----w c:\program files\Vuze

2009-03-08 11:34 914,944 ----a-w c:\windows\system32\wininet.dll

2009-03-08 11:34 43,008 ----a-w c:\windows\system32\licmgr10.dll

2009-03-08 11:33 420,352 ----a-w c:\windows\system32\vbscript.dll

2009-03-08 11:33 18,944 ----a-w c:\windows\system32\corpol.dll

2009-03-08 11:32 72,704 ----a-w c:\windows\system32\admparse.dll

2009-03-08 11:32 71,680 ----a-w c:\windows\system32\iesetup.dll

2009-03-08 11:31 48,128 ----a-w c:\windows\system32\mshtmler.dll

2009-03-08 11:31 45,568 ----a-w c:\windows\system32\mshta.exe

2009-03-08 11:31 34,816 ----a-w c:\windows\system32\imgutil.dll

2009-03-08 11:22 156,160 ----a-w c:\windows\system32\msls31.dll

2009-03-02 10:58 --------- d-----w c:\documents and settings\md\Application Data\gtk-2.0

2009-02-09 11:13 1,846,784 ----a-w c:\windows\system32\win32k.sys

2009-01-08 01:21 26,144 ----a-w c:\windows\system32\spupdsvc.exe

2009-01-08 01:20 265,720 ----a-w c:\windows\system32\msdbg2.dll

2009-01-08 01:20 26,112 ----a-w c:\windows\system32\idndl.dll

2009-01-08 01:20 24,576 ----a-w c:\windows\system32\nlsdl.dll

2009-01-08 01:20 23,552 ----a-w c:\windows\system32\normaliz.dll

2008-12-05 06:54 144,896 ----a-w c:\windows\system32\schannel.dll

2008-03-15 00:46 32 ----a-w c:\documents and settings\All Users\Application Data\ezsid.dat

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\1TortoiseSVN]

@="{30351346-7B7D-4FCC-81B4-1E394CA267EB}"

[HKEY_CLASSES_ROOT\CLSID\{30351346-7B7D-4FCC-81B4-1E394CA267EB}]

2008-01-05 06:03 536576 --a------ c:\program files\TortoiseSVN\bin\tortoisesvn.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\2TortoiseSVN]

@="{30351347-7B7D-4FCC-81B4-1E394CA267EB}"

[HKEY_CLASSES_ROOT\CLSID\{30351347-7B7D-4FCC-81B4-1E394CA267EB}]

2008-01-05 06:03 536576 --a------ c:\program files\TortoiseSVN\bin\tortoisesvn.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\3TortoiseSVN]

@="{30351348-7B7D-4FCC-81B4-1E394CA267EB}"

[HKEY_CLASSES_ROOT\CLSID\{30351348-7B7D-4FCC-81B4-1E394CA267EB}]

2008-01-05 06:03 536576 --a------ c:\program files\TortoiseSVN\bin\tortoisesvn.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\4TortoiseSVN]

@="{3035134B-7B7D-4FCC-81B4-1E394CA267EB}"

[HKEY_CLASSES_ROOT\CLSID\{3035134B-7B7D-4FCC-81B4-1E394CA267EB}]

2008-01-05 06:03 536576 --a------ c:\program files\TortoiseSVN\bin\tortoisesvn.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\5TortoiseSVN]

@="{3035134C-7B7D-4FCC-81B4-1E394CA267EB}"

[HKEY_CLASSES_ROOT\CLSID\{3035134C-7B7D-4FCC-81B4-1E394CA267EB}]

2008-01-05 06:03 536576 --a------ c:\program files\TortoiseSVN\bin\tortoisesvn.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\6TortoiseSVN]

@="{3035134D-7B7D-4FCC-81B4-1E394CA267EB}"

[HKEY_CLASSES_ROOT\CLSID\{3035134D-7B7D-4FCC-81B4-1E394CA267EB}]

2008-01-05 06:03 536576 --a------ c:\program files\TortoiseSVN\bin\tortoisesvn.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\7TortoiseSVN]

@="{3035134E-7B7D-4FCC-81B4-1E394CA267EB}"

[HKEY_CLASSES_ROOT\CLSID\{3035134E-7B7D-4FCC-81B4-1E394CA267EB}]

2008-01-05 06:03 536576 --a------ c:\program files\TortoiseSVN\bin\tortoisesvn.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Cpqset"="c:\program files\Hewlett-Packard\Default Settings\cpqset.exe" [2007-05-03 57344]

"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2007-01-05 872448]

"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-01-21 61440]

"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-01-05 413696]

"FreePDF Assistant"="c:\program files\FreePDF_XP\fpassist.exe" [2008-07-22 357376]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]

"atchk"="c:\program files\Intel\AMT\atchk.exe" [2007-11-09 408088]

"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]

"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-29 148888]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]

"GrpConv"="grpconv -o" [X]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-13 15360]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]

"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2008-05-26 304128]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]

2008-07-23 07:28 352256 c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]

"msacm.l3fhg"= mp3fhg.acm

"msacm.divxa32"= divxa32.acm

"VIDC.X264"= x264vfw.dll

"VIDC.HFYU"= huffyuv.dll

"vidc.i263"= i263_32.drv

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Windows Search.lnk]

path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Windows Search.lnk

backup=c:\windows\pss\Windows Search.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AccelerometerSysTrayApplet]

--a------ 2007-01-24 06:28 124928 c:\windows\system32\accelerometerST.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]

--a------ 2009-02-27 09:10 35696 c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]

--a----t- 2009-01-02 02:49 133104 c:\documents and settings\md\Local Settings\Application Data\Google\Update\GoogleUpdate.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]

--a------ 2007-05-08 07:24 54840 c:\program files\Hp\HP Software Update\hpwuSchd2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]

--a------ 2009-01-05 08:18 413696 c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SPC1300]

--a------ 2007-05-31 07:54 675840 c:\windows\vspc1300.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]

--a------ 2009-03-29 11:44 148888 c:\program files\Java\jre6\bin\jusched.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\Autodesk\\3ds Max 2008\\3dsmax.exe"=

"c:\\Program Files\\Messenger\\msmsgs.exe"=

"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=

"c:\\Program Files\\Vuze\\Azureus.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\Program Files\\MATLAB\\R2008a\\bin\\win32\\MATLAB.exe"=

"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=

"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=

"c:\\Program Files\\Orb Networks\\Orb\\bin\\Orb.exe"=

"c:\\Program Files\\Orb Networks\\Orb\\bin\\OrbTray.exe"=

"c:\\Program Files\\Orb Networks\\Orb\\bin\\OrbStreamerClient.exe"=

"c:\\Program Files\\Orb Networks\\Orb\\bin\\OrbChannelScan.exe"=

"c:\\Program Files\\Next Limit\\Maxwell\\mxcl.exe"=

"c:\\WINDOWS\\system32\\ftp.exe"=

"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

R0 ysaokvss;ysaokvss;c:\windows\system32\drivers\ysaokvss.sys [2004-08-04 23424]

R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [2008-11-17 8944]

R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [2008-11-17 55024]

R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [2009-03-25 108289]

R2 UNS;Intel® Active Management Technology User Notification Service;c:\program files\Intel\AMT\UNS.exe [2009-03-24 1464856]

R3 AtiHdmiService;ATI Function Driver for HDMI Service;c:\windows\system32\drivers\AtiHdmi.sys [2007-07-20 89600]

S3 getPlus® Helper;getPlus® Helper;c:\program files\NOS\bin\getPlus_HelperSvc.exe [2009-01-26 33752]

S3 phaudlwr;Philips Audio Filter;c:\windows\system32\drivers\phaudlwr.sys [2008-11-07 88704]

S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [2008-11-17 7408]

S3 sdAuxService;PC Tools Auxiliary Service;c:\program files\Spyware Doctor\pctsAuxs.exe [2008-12-04 356920]

S3 SPC1300;USB2.0 PC Camera (SPC1300);c:\windows\system32\drivers\spc1300.sys [2008-11-07 3033728]

S4 msvsmon80;Visual Studio 2005 Remote Debugger;c:\program files\Microsoft Visual Studio 8\Common7\IDE\Remote Debugger\x86\msvsmon.exe [2006-12-01 2805000]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1fadd2b8-1cf1-11de-b451-0013e8e1a867}]

\Shell\AutoRun\command - F:\setup.exe

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]

"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP

.

Contents of the 'Scheduled Tasks' folder

2009-03-31 c:\windows\Tasks\AppleSoftwareUpdate.job

- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 03:34]

2009-03-31 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-507921405-764733703-839522115-1003.job

- c:\documents and settings\md\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-01-02 02:49]

.

- - - - ORPHANS REMOVED - - - -

BHO-{275BB5EB-1FF1-4299-A418-5756A9535B98} - c:\windows\system32\atmf.dll

WebBrowser-{60C27EB2-E665-4D12-8F8C-7358E62FD82B} - (no file)

HKLM-RunOnce-<NO NAME> - (no file)

MSConfigStartUp-Acrobat Assistant 8 - c:\program files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe

MSConfigStartUp-Adobe_ID0EYTHM - c:\progra~1\COMMON~1\Adobe\ADOBEV~1\Server\bin\VERSIO~2.EXE

.

------- Supplementary Scan -------

.

uInternet Settings,ProxyOverride = *.local

uSearchURL,(Default) = hxxp://www.google.com/search?q=%s

IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000

IE: Send to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm

IE: Send To Bluetooth - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm

FF - ProfilePath - c:\documents and settings\md\Application Data\Mozilla\Firefox\Profiles\ryrpastz.default\

FF - prefs.js: browser.startup.homepage - hxxp://mail.google.com/mail/#inbox|http://en-gb.facebook.com/

FF - plugin: c:\documents and settings\md\Local Settings\Application Data\Google\Update\1.2.141.5\npGoogleOneClick7.dll

FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll

FF - plugin: c:\program files\Mozilla Firefox\plugins\np32asw.dll

FF - plugin: c:\program files\Mozilla Firefox\plugins\npcosmop211.dll

FF - plugin: c:\program files\Photosynth\npPhotosynthMozilla.dll

.

**************************************************************************

catchme 0.3.1375 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-03-31 14:55:54

Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run

Cpqset = c:\program files\Hewlett-Packard\Default Settings\cpqset.exe????????T??????????????|?M?|?????M?|&?@

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

.

--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(1332)

c:\program files\SUPERAntiSpyware\SASWINLO.dll

c:\windows\system32\WININET.dll

c:\windows\system32\Ati2evxx.dll

.

Completion time: 2009-03-31 14:57:50

ComboFix-quarantined-files.txt 2009-03-31 21:57:47

ComboFix2.txt 2008-12-05 12:29:36

Pre-Run: 13,214,699,520 bytes free

Post-Run: 13,391,384,576 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe

[boot loader]

timeout=2

default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS

[operating systems]

c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

274 --- E O F --- 2009-03-29 18:31:37

Link to post
Share on other sites

  • Staff

Hi,

* Open notepad - don't use any other texteditor than notepad or the script will fail.

Copy/paste the text in the quotebox below into notepad:

File::

c:\windows\system32\drivers\ysaokvss.sys

Driver::

ysaokvss

Save this as txtfile CFScript

Then drag the CFScript into ComboFix.exe as you see in the screenshot below.

CFScript.gif

This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply.

Link to post
Share on other sites

Antivir openend automatically after reboot, Combofix asked my to close it. Thats what I did and it finished.

Please let me know if thats a problem. I think I could deselect autostart somewhere.

Anyway, heres the log:

ComboFix 09-03-31.01 - md 2009-03-31 16:29:23.2 - NTFSx86

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2047.1489 [GMT -7:00]

Running from: c:\documents and settings\md\Desktop\ComboFix.exe

Command switches used :: c:\documents and settings\md\Desktop\CFScript.txt

AV: AntiVir Desktop *On-access scanning disabled* (Updated)

* Created a new restore point

FILE ::

c:\windows\system32\drivers\ysaokvss.sys

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\windows\system32\drivers\ysaokvss.sys

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Legacy_YSAOKVSS

-------\Service_ysaokvss

((((((((((((((((((((((((( Files Created from 2009-02-28 to 2009-03-31 )))))))))))))))))))))))))))))))

.

2009-03-30 22:48 . 2009-03-30 22:48 <DIR> d--hs---- c:\documents and settings\NetworkService\IETldCache

2009-03-30 00:26 . 2009-03-30 15:16 <DIR> d-------- C:\ergodata

2009-03-29 11:49 . 2009-01-09 12:19 1,089,593 -----c--- c:\windows\system32\dllcache\ntprint.cat

2009-03-29 11:45 . 2009-03-29 11:44 73,728 --a------ c:\windows\system32\javacpl.cpl

2009-03-29 11:27 . 2009-03-29 11:27 <DIR> d-------- c:\windows\system32\XPSViewer

2009-03-29 11:26 . 2009-03-29 11:26 <DIR> d-------- C:\4e427f16206304bff318a63d27e43e

2009-03-29 11:26 . 2008-07-06 05:06 1,676,288 --------- c:\windows\system32\xpssvcs.dll

2009-03-29 11:26 . 2008-07-06 05:06 1,676,288 -----c--- c:\windows\system32\dllcache\xpssvcs.dll

2009-03-29 11:26 . 2008-07-06 03:50 597,504 -----c--- c:\windows\system32\dllcache\printfilterpipelinesvc.exe

2009-03-29 11:26 . 2008-07-06 05:06 575,488 --------- c:\windows\system32\xpsshhdr.dll

2009-03-29 11:26 . 2008-07-06 05:06 575,488 -----c--- c:\windows\system32\dllcache\xpsshhdr.dll

2009-03-29 11:26 . 2008-07-06 05:06 117,760 --------- c:\windows\system32\prntvpt.dll

2009-03-29 11:26 . 2008-07-06 05:06 89,088 -----c--- c:\windows\system32\dllcache\filterpipelineprintproc.dll

2009-03-29 11:25 . 2009-03-29 11:25 <DIR> d--hs---- c:\documents and settings\md\PrivacIE

2009-03-29 11:24 . 2009-03-29 11:24 <DIR> d--hs---- c:\documents and settings\LocalService\IETldCache

2009-03-29 11:23 . 2009-03-29 11:23 <DIR> d--hs---- c:\documents and settings\md\IETldCache

2009-03-29 11:14 . 2009-03-29 11:14 584 --a------ c:\windows\imsins.BAK

2009-03-29 11:11 . 2009-03-29 11:14 <DIR> d--h-c--- c:\windows\ie8

2009-03-29 11:09 . 2009-03-29 11:20 <DIR> d-------- c:\windows\SxsCaPendDel

2009-03-27 02:28 . 2009-03-27 02:28 <DIR> d-------- c:\program files\PTGui

2009-03-27 02:28 . 2009-03-30 21:57 <DIR> d-------- c:\documents and settings\md\Application Data\PTGui

2009-03-26 06:14 . 2008-11-20 12:19 9,200 --------- c:\windows\system32\drivers\cdralw2k.sys

2009-03-26 06:14 . 2008-11-20 12:19 9,072 --------- c:\windows\system32\drivers\cdr4_xp.sys

2009-03-26 06:11 . 2009-03-26 06:11 <DIR> d-------- c:\windows\system32\IOSUBSYS

2009-03-25 04:46 . 2009-03-25 04:46 <DIR> d-------- c:\documents and settings\md\Application Data\Canon

2009-03-25 04:45 . 2009-03-27 00:54 <DIR> d-------- c:\documents and settings\All Users\Application Data\PhotoStitch

2009-03-25 04:30 . 2009-03-25 04:30 <DIR> d-------- c:\program files\Avira

2009-03-25 04:30 . 2009-03-25 04:30 <DIR> d-------- c:\documents and settings\All Users\Application Data\Avira

2009-03-25 04:30 . 2009-02-13 11:31 55,640 --a------ c:\windows\system32\drivers\avgntflt.sys

2009-03-24 17:26 . 2009-03-24 17:26 <DIR> d-------- c:\program files\Common Files\postureAgent

2009-03-24 17:26 . 2007-11-09 16:18 920,088 --a------ c:\windows\system32\mesoludlg.exe

2009-03-24 17:26 . 2006-11-10 09:25 319,456 --a------ c:\windows\system32\difxapi.dll

2009-03-24 08:15 . 2009-03-24 08:15 <DIR> d-------- c:\program files\Canon

2009-03-24 08:14 . 2009-03-24 08:14 <DIR> d-------- c:\program files\Common Files\Canon

2009-03-20 11:50 . 2009-03-20 11:50 3,358,720 --a------ c:\windows\system32\GPhotos.scr

2009-03-14 07:02 . 2009-03-14 07:02 <DIR> d-------- c:\documents and settings\md\Application Data\.Kanton ZH

2009-03-14 04:59 . 2009-03-14 04:59 <DIR> d--h----- c:\program files\Zero G Registry

2009-03-14 04:59 . 2009-03-14 05:08 <DIR> d-------- c:\program files\Private Tax 2008

2009-03-14 04:58 . 2009-03-14 04:58 <DIR> d--h----- c:\documents and settings\md\InstallAnywhere

2009-03-12 17:22 . 2008-04-13 17:12 221,184 --a------ c:\windows\system32\wmpns.dll

2009-03-12 07:40 . 2009-03-12 07:40 <DIR> d-------- c:\program files\FreePDF_XP

2009-03-12 07:40 . 2009-03-12 07:41 <DIR> d-------- c:\documents and settings\All Users\FreePDF

2009-03-12 07:40 . 2008-02-25 14:23 119,152 --a------ c:\windows\system32\redmon.hlp

2009-03-12 07:40 . 2008-02-25 14:23 116,224 --a------ c:\windows\system32\redmonnt.dll

2009-03-12 07:40 . 2008-02-25 14:23 45,056 --a------ c:\windows\system32\unredmon.exe

2009-03-08 14:22 . 2009-03-08 14:22 49,152 --------- c:\windows\system32\msrating.dll.mui

2009-03-08 14:22 . 2009-03-08 14:22 2,560 --------- c:\windows\system32\mshta.exe.mui

2009-03-08 14:21 . 2009-03-08 14:21 4,096 --------- c:\windows\system32\ie4uinit.exe.mui

2009-03-08 14:20 . 2009-03-08 14:20 81,920 --------- c:\windows\system32\iedkcs32.dll.mui

2009-02-23 16:09 . 2009-02-23 16:09 <DIR> d-------- c:\program files\CCleaner

2009-02-23 12:01 . 2009-02-23 12:01 <DIR> d-------- C:\fsaua.data

2009-02-12 22:20 . 2009-02-12 22:20 5,630 --------- c:\windows\system32\IE8Eula.rtf

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-03-31 07:17 --------- d-----w c:\documents and settings\md\Application Data\Skype

2009-03-31 04:58 --------- d-----w c:\documents and settings\md\Application Data\MAXON

2009-03-30 23:36 --------- d-----w c:\documents and settings\md\Application Data\skypePM

2009-03-28 09:18 --------- d-----w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy

2009-03-28 08:56 --------- d-----w c:\program files\Malwarebytes' Anti-Malware

2009-03-28 08:36 --------- d-----w c:\program files\Spybot - Search & Destroy

2009-03-27 09:19 --------- d-----w c:\documents and settings\md\Application Data\Azureus

2009-03-26 23:49 38,496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys

2009-03-26 23:49 15,504 ----a-w c:\windows\system32\drivers\mbam.sys

2009-03-26 13:11 --------- d-----w c:\program files\Google

2009-03-25 00:26 --------- d-----w c:\program files\Intel

2009-03-16 10:09 --------- d-----w c:\program files\Common Files\Adobe

2009-03-13 00:22 --------- d-----w c:\documents and settings\All Users\Application Data\Microsoft Help

2009-03-12 16:10 --------- d-----w c:\documents and settings\All Users\Application Data\Apple Computer

2009-03-08 14:59 --------- d-----w c:\program files\Vuze

2009-03-02 10:58 --------- d-----w c:\documents and settings\md\Application Data\gtk-2.0

2008-03-15 00:46 32 ----a-w c:\documents and settings\All Users\Application Data\ezsid.dat

.

((((((((((((((((((((((((((((( SnapShot@2009-03-31_14.56.48.98 )))))))))))))))))))))))))))))))))))))))))

.

+ 2005-10-21 03:02:28 163,328 ----a-w c:\windows\ERDNT\subs\ERDNT.EXE

- 2009-03-31 16:44:01 78,458 ----a-w c:\windows\system32\perfc009.dat

+ 2009-03-31 23:25:58 78,458 ----a-w c:\windows\system32\perfc009.dat

- 2009-03-31 16:44:01 462,296 ----a-w c:\windows\system32\perfh009.dat

+ 2009-03-31 23:25:58 462,296 ----a-w c:\windows\system32\perfh009.dat

+ 2009-03-31 23:37:34 16,384 ----atw c:\windows\temp\Perflib_Perfdata_11c.dat

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{275BB5EB-1FF1-4299-A418-5756A9535B98}]

c:\windows\system32\atmf.dll [bU]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\1TortoiseSVN]

@="{30351346-7B7D-4FCC-81B4-1E394CA267EB}"

[HKEY_CLASSES_ROOT\CLSID\{30351346-7B7D-4FCC-81B4-1E394CA267EB}]

2008-01-05 06:03 536576 --a------ c:\program files\TortoiseSVN\bin\tortoisesvn.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\2TortoiseSVN]

@="{30351347-7B7D-4FCC-81B4-1E394CA267EB}"

[HKEY_CLASSES_ROOT\CLSID\{30351347-7B7D-4FCC-81B4-1E394CA267EB}]

2008-01-05 06:03 536576 --a------ c:\program files\TortoiseSVN\bin\tortoisesvn.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\3TortoiseSVN]

@="{30351348-7B7D-4FCC-81B4-1E394CA267EB}"

[HKEY_CLASSES_ROOT\CLSID\{30351348-7B7D-4FCC-81B4-1E394CA267EB}]

2008-01-05 06:03 536576 --a------ c:\program files\TortoiseSVN\bin\tortoisesvn.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\4TortoiseSVN]

@="{3035134B-7B7D-4FCC-81B4-1E394CA267EB}"

[HKEY_CLASSES_ROOT\CLSID\{3035134B-7B7D-4FCC-81B4-1E394CA267EB}]

2008-01-05 06:03 536576 --a------ c:\program files\TortoiseSVN\bin\tortoisesvn.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\5TortoiseSVN]

@="{3035134C-7B7D-4FCC-81B4-1E394CA267EB}"

[HKEY_CLASSES_ROOT\CLSID\{3035134C-7B7D-4FCC-81B4-1E394CA267EB}]

2008-01-05 06:03 536576 --a------ c:\program files\TortoiseSVN\bin\tortoisesvn.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\6TortoiseSVN]

@="{3035134D-7B7D-4FCC-81B4-1E394CA267EB}"

[HKEY_CLASSES_ROOT\CLSID\{3035134D-7B7D-4FCC-81B4-1E394CA267EB}]

2008-01-05 06:03 536576 --a------ c:\program files\TortoiseSVN\bin\tortoisesvn.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\7TortoiseSVN]

@="{3035134E-7B7D-4FCC-81B4-1E394CA267EB}"

[HKEY_CLASSES_ROOT\CLSID\{3035134E-7B7D-4FCC-81B4-1E394CA267EB}]

2008-01-05 06:03 536576 --a------ c:\program files\TortoiseSVN\bin\tortoisesvn.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Cpqset"="c:\program files\Hewlett-Packard\Default Settings\cpqset.exe" [2007-05-03 57344]

"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2007-01-05 872448]

"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-01-21 61440]

"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-01-05 413696]

"FreePDF Assistant"="c:\program files\FreePDF_XP\fpassist.exe" [2008-07-22 357376]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]

"atchk"="c:\program files\Intel\AMT\atchk.exe" [2007-11-09 408088]

"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]

"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-29 148888]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-13 15360]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]

"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2008-05-26 304128]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]

2008-07-23 07:28 352256 c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]

"msacm.l3fhg"= mp3fhg.acm

"msacm.divxa32"= divxa32.acm

"VIDC.X264"= x264vfw.dll

"VIDC.HFYU"= huffyuv.dll

"vidc.i263"= i263_32.drv

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Windows Search.lnk]

path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Windows Search.lnk

backup=c:\windows\pss\Windows Search.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AccelerometerSysTrayApplet]

--a------ 2007-01-24 06:28 124928 c:\windows\system32\accelerometerST.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]

--a------ 2009-02-27 09:10 35696 c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]

--a----t- 2009-01-02 02:49 133104 c:\documents and settings\md\Local Settings\Application Data\Google\Update\GoogleUpdate.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]

--a------ 2007-05-08 07:24 54840 c:\program files\Hp\HP Software Update\hpwuSchd2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]

--a------ 2009-01-05 08:18 413696 c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SPC1300]

--a------ 2007-05-31 07:54 675840 c:\windows\vspc1300.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]

--a------ 2009-03-29 11:44 148888 c:\program files\Java\jre6\bin\jusched.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\Autodesk\\3ds Max 2008\\3dsmax.exe"=

"c:\\Program Files\\Messenger\\msmsgs.exe"=

"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=

"c:\\Program Files\\Vuze\\Azureus.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\Program Files\\MATLAB\\R2008a\\bin\\win32\\MATLAB.exe"=

"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=

"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=

"c:\\Program Files\\Orb Networks\\Orb\\bin\\Orb.exe"=

"c:\\Program Files\\Orb Networks\\Orb\\bin\\OrbTray.exe"=

"c:\\Program Files\\Orb Networks\\Orb\\bin\\OrbStreamerClient.exe"=

"c:\\Program Files\\Orb Networks\\Orb\\bin\\OrbChannelScan.exe"=

"c:\\Program Files\\Next Limit\\Maxwell\\mxcl.exe"=

"c:\\WINDOWS\\system32\\ftp.exe"=

"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [2008-11-17 8944]

R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [2008-11-17 55024]

R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [2009-03-25 108289]

R2 UNS;Intel

Link to post
Share on other sites

  • Staff

Hi,

Antivir openend automatically after reboot, Combofix asked my to close it. Thats what I did and it finished.

Please let me know if thats a problem. I think I could deselect autostart somewhere.

That's OK.. Combofix did its job anyway.

Start HijackThis and check next entry in it:

O2 - BHO: (no name) - {275BB5EB-1FF1-4299-A418-5756A9535B98} - C:\WINDOWS\system32\atmf.dll (file missing)

Then click the Fix checked button below.

Then, * Go to start > run and copy and paste next command in the field:

ComboFix /u

Make sure there's a space between Combofix and /

Then hit enter.

This will uninstall Combofix, delete its related folders and files, reset your clock settings, hide file extensions, hide the system/hidden files and resets System Restore again.

Let me know in your next reply how things are now.

Link to post
Share on other sites

Ok, thanks a lot so far. But problems seem to go on.

My mbam scan was clean, but my avira (antivir personal) scan found a bad guy

called TR/Trash.Gen (see scan below). I tried to delete it but it didnt succeed. I rebooted, scanned again,

and I was still there. I puted it into the quarantine. I also get this redirections on google search result links

into topic related business sites.

Avira AntiVir Personal

Report file date: Tuesday, March 31, 2009 22:23

Scanning for 1334358 virus strains and unwanted programs.

Licensee : Avira AntiVir Personal - FREE Antivirus

Serial number : 0000149996-ADJIE-0000001

Platform : Windows XP

Windows version : (Service Pack 3) [5.1.2600]

Boot mode : Normally booted

Username : SYSTEM

Computer name : MDMOBILE

Version information:

BUILD.DAT : 9.0.0.387 17962 Bytes 3/24/2009 11:04:00

AVSCAN.EXE : 9.0.3.3 464641 Bytes 2/24/2009 19:13:26

AVSCAN.DLL : 9.0.3.0 40705 Bytes 2/27/2009 17:58:24

LUKE.DLL : 9.0.3.2 209665 Bytes 2/20/2009 18:35:49

LUKERES.DLL : 9.0.2.0 12033 Bytes 2/27/2009 17:58:52

ANTIVIR0.VDF : 7.1.0.0 15603712 Bytes 10/27/2008 19:30:36

ANTIVIR1.VDF : 7.1.2.12 3336192 Bytes 2/11/2009 03:33:26

ANTIVIR2.VDF : 7.1.2.199 1008640 Bytes 3/22/2009 17:52:40

ANTIVIR3.VDF : 7.1.2.241 330752 Bytes 3/31/2009 16:45:25

Engineversion : 8.2.0.129

AEVDF.DLL : 8.1.1.0 106868 Bytes 1/28/2009 00:36:42

AESCRIPT.DLL : 8.1.1.70 369019 Bytes 3/27/2009 17:52:56

AESCN.DLL : 8.1.1.8 127346 Bytes 3/27/2009 17:52:54

AERDL.DLL : 8.1.1.3 438645 Bytes 10/30/2008 01:24:41

AEPACK.DLL : 8.1.3.11 397687 Bytes 3/27/2009 17:52:53

AEOFFICE.DLL : 8.1.0.36 196987 Bytes 2/27/2009 03:01:56

AEHEUR.DLL : 8.1.0.111 1679736 Bytes 3/27/2009 17:52:52

AEHELP.DLL : 8.1.2.2 119158 Bytes 2/27/2009 03:01:56

AEGEN.DLL : 8.1.1.31 340341 Bytes 3/27/2009 17:52:46

AEEMU.DLL : 8.1.0.9 393588 Bytes 10/9/2008 21:32:40

AECORE.DLL : 8.1.6.6 176501 Bytes 2/17/2009 21:22:44

AEBB.DLL : 8.1.0.3 53618 Bytes 10/9/2008 21:32:40

AVWINLL.DLL : 9.0.0.3 18177 Bytes 12/12/2008 15:47:59

AVPREF.DLL : 9.0.0.1 43777 Bytes 12/5/2008 17:32:15

AVREP.DLL : 8.0.0.3 155905 Bytes 1/20/2009 21:34:28

AVREG.DLL : 9.0.0.0 36609 Bytes 12/5/2008 17:32:09

AVARKT.DLL : 9.0.0.1 292609 Bytes 2/9/2009 14:52:24

AVEVTLOG.DLL : 9.0.0.7 167169 Bytes 1/30/2009 17:37:08

SQLITE3.DLL : 3.6.1.0 326401 Bytes 1/28/2009 22:03:49

SMTPLIB.DLL : 9.2.0.25 28417 Bytes 2/2/2009 15:21:33

NETNT.DLL : 9.0.0.0 11521 Bytes 12/5/2008 17:32:10

RCIMAGE.DLL : 9.0.0.21 2438401 Bytes 2/9/2009 18:45:45

RCTEXT.DLL : 9.0.35.0 87297 Bytes 3/11/2009 22:55:12

Configuration settings for the scan:

Jobname.............................: Complete system scan

Configuration file..................: c:\program files\avira\antivir desktop\sysscan.avp

Logging.............................: low

Primary action......................: interactive

Secondary action....................: ignore

Scan master boot sector.............: on

Scan boot sector....................: on

Boot sectors........................: C:,

Process scan........................: on

Scan registry.......................: on

Search for rootkits.................: on

Integrity checking of system files..: on

Optimised scan......................: on

Scan all files......................: All files

Scan archives.......................: on

Recursion depth.....................: 20

Smart extensions....................: on

Macro heuristic.....................: on

File heuristic......................: medium

Deviating risk categories...........: +APPL,+JOKE,

Start of the scan: Tuesday, March 31, 2009 22:23

Initiating scan of system files:

Signed -> 'C:\WINDOWS\system32\svchost.exe'

Signed -> 'C:\WINDOWS\system32\winlogon.exe'

Signed -> 'C:\WINDOWS\explorer.exe'

Signed -> 'C:\WINDOWS\system32\smss.exe'

Signed -> 'C:\WINDOWS\system32\wininet.DLL'

Signed -> 'C:\WINDOWS\system32\wsock32.DLL'

Signed -> 'C:\WINDOWS\system32\ws2_32.DLL'

Signed -> 'C:\WINDOWS\system32\services.exe'

Signed -> 'C:\WINDOWS\system32\lsass.exe'

Signed -> 'C:\WINDOWS\system32\csrss.exe'

Signed -> 'C:\WINDOWS\system32\drivers\kbdclass.sys'

Signed -> 'C:\WINDOWS\system32\spoolsv.exe'

Signed -> 'C:\WINDOWS\system32\alg.exe'

Signed -> 'C:\WINDOWS\system32\wuauclt.exe'

Signed -> 'C:\WINDOWS\system32\advapi32.DLL'

Signed -> 'C:\WINDOWS\system32\user32.DLL'

Signed -> 'C:\WINDOWS\system32\gdi32.DLL'

Signed -> 'C:\WINDOWS\system32\kernel32.DLL'

Signed -> 'C:\WINDOWS\system32\ntdll.DLL'

Signed -> 'C:\WINDOWS\system32\ntoskrnl.exe'

Signed -> 'C:\WINDOWS\system32\ctfmon.exe'

The system files were scanned ('21' files)

Starting search for hidden objects.

'90953' objects were checked, '0' hidden objects were found.

The scan of running processes will be started

Scan process 'avscan.exe' - '1' Module(s) have been scanned

Scan process 'avcenter.exe' - '1' Module(s) have been scanned

Scan process 'CCC.exe' - '1' Module(s) have been scanned

Scan process 'MOM.exe' - '1' Module(s) have been scanned

Scan process 'ctfmon.exe' - '1' Module(s) have been scanned

Scan process 'jusched.exe' - '1' Module(s) have been scanned

Scan process 'avgnt.exe' - '1' Module(s) have been scanned

Scan process 'atchk.exe' - '1' Module(s) have been scanned

Scan process 'fpassist.exe' - '1' Module(s) have been scanned

Scan process 'smax4pnp.exe' - '1' Module(s) have been scanned

Scan process 'alg.exe' - '1' Module(s) have been scanned

Scan process 'TSVNCache.exe' - '1' Module(s) have been scanned

Scan process 'explorer.exe' - '1' Module(s) have been scanned

Scan process 'searchindexer.exe' - '1' Module(s) have been scanned

Scan process 'UNS.exe' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'raysat_3dsMax2008_32server.exe' - '1' Module(s) have been scanned

Scan process 'LMS.exe' - '1' Module(s) have been scanned

Scan process 'jqs.exe' - '1' Module(s) have been scanned

Scan process 'cvpnd.exe' - '1' Module(s) have been scanned

Scan process 'mDNSResponder.exe' - '1' Module(s) have been scanned

Scan process 'AdskScSrv.exe' - '1' Module(s) have been scanned

Scan process 'atchksrv.exe' - '1' Module(s) have been scanned

Scan process 'avguard.exe' - '1' Module(s) have been scanned

Scan process 'ati2evxx.exe' - '1' Module(s) have been scanned

Scan process 'sched.exe' - '1' Module(s) have been scanned

Scan process 'spoolsv.exe' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'btwdins.exe' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'ati2evxx.exe' - '1' Module(s) have been scanned

Scan process 'lsass.exe' - '1' Module(s) have been scanned

Scan process 'services.exe' - '1' Module(s) have been scanned

Scan process 'winlogon.exe' - '1' Module(s) have been scanned

Scan process 'csrss.exe' - '1' Module(s) have been scanned

Scan process 'smss.exe' - '1' Module(s) have been scanned

39 processes with 39 modules were scanned

Starting master boot sector scan:

Start scanning boot sectors:

Starting to scan executable files (registry).

The registry was scanned ( '66' files ).

Starting the file scan:

Begin scan in 'C:\'

C:\hiberfil.sys

[WARNING] The file could not be opened!

[NOTE] This file is a Windows system file.

[NOTE] This file cannot be opened for scanning.

C:\pagefile.sys

[WARNING] The file could not be opened!

[NOTE] This file is a Windows system file.

[NOTE] This file cannot be opened for scanning.

C:\WINDOWS\system32\drivers\bovugyuk.sys

[DETECTION] Is the TR/Trash.Gen Trojan

C:\WINDOWS\system32\drivers\sptd.sys

[WARNING] The file could not be opened!

Beginning disinfection:

C:\WINDOWS\system32\drivers\bovugyuk.sys

[DETECTION] Is the TR/Trash.Gen Trojan

[WARNING] The file was ignored!

End of the scan: Wednesday, April 01, 2009 00:14

Used time: 1:42:59 Hour(s)

The scan has been done completely.

37947 Scanned directories

880024 Files were scanned

1 Viruses and/or unwanted programs were found

0 Files were classified as suspicious

0 files were deleted

0 Viruses and unwanted programs were repaired

0 Files were moved to quarantine

0 Files were renamed

3 Files cannot be scanned

880020 Files not concerned

9231 Archives were scanned

4 Warnings

2 Notes

90953 Objects were scanned with rootkit scan

0 Hidden objects were found

Link to post
Share on other sites

  • Staff

Hi,

It indeed looks like you got reinfected again.

Do you use Firefox or IE as your main browser? If you use Firefox, please install the NoScript add-on, because I know this infection is getting installed via legitimate sites as well.

Then, redownload and run Combofix again and post the log in your next reply.

Link to post
Share on other sites

I use firefox. And I installed the plugin right now.

Heres the combofix log:

ComboFix 09-03-31.04 - md 2009-04-01 9:45:57.3 - NTFSx86

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2047.1492 [GMT -7:00]

Running from: c:\documents and settings\md\Desktop\ComboFix.exe

AV: AntiVir Desktop *On-access scanning disabled* (Updated)

* Created a new restore point

.

((((((((((((((((((((((((( Files Created from 2009-03-01 to 2009-04-01 )))))))))))))))))))))))))))))))

.

2009-04-01 01:17 . 2009-04-01 01:17 <DIR> d--h----- c:\windows\PIF

2009-03-30 22:48 . 2009-03-30 22:48 <DIR> d--hs---- c:\documents and settings\NetworkService\IETldCache

2009-03-30 00:26 . 2009-03-30 15:16 <DIR> d-------- C:\ergodata

2009-03-29 11:49 . 2009-01-09 12:19 1,089,593 -----c--- c:\windows\system32\dllcache\ntprint.cat

2009-03-29 11:45 . 2009-03-29 11:44 73,728 --a------ c:\windows\system32\javacpl.cpl

2009-03-29 11:27 . 2009-03-29 11:27 <DIR> d-------- c:\windows\system32\XPSViewer

2009-03-29 11:26 . 2009-03-29 11:26 <DIR> d-------- C:\4e427f16206304bff318a63d27e43e

2009-03-29 11:26 . 2008-07-06 05:06 1,676,288 --------- c:\windows\system32\xpssvcs.dll

2009-03-29 11:26 . 2008-07-06 05:06 1,676,288 -----c--- c:\windows\system32\dllcache\xpssvcs.dll

2009-03-29 11:26 . 2008-07-06 03:50 597,504 -----c--- c:\windows\system32\dllcache\printfilterpipelinesvc.exe

2009-03-29 11:26 . 2008-07-06 05:06 575,488 --------- c:\windows\system32\xpsshhdr.dll

2009-03-29 11:26 . 2008-07-06 05:06 575,488 -----c--- c:\windows\system32\dllcache\xpsshhdr.dll

2009-03-29 11:26 . 2008-07-06 05:06 117,760 --------- c:\windows\system32\prntvpt.dll

2009-03-29 11:26 . 2008-07-06 05:06 89,088 -----c--- c:\windows\system32\dllcache\filterpipelineprintproc.dll

2009-03-29 11:25 . 2009-03-29 11:25 <DIR> d--hs---- c:\documents and settings\md\PrivacIE

2009-03-29 11:24 . 2009-03-29 11:24 <DIR> d--hs---- c:\documents and settings\LocalService\IETldCache

2009-03-29 11:23 . 2009-03-29 11:23 <DIR> d--hs---- c:\documents and settings\md\IETldCache

2009-03-29 11:14 . 2009-03-29 11:14 584 --a------ c:\windows\imsins.BAK

2009-03-29 11:11 . 2009-03-29 11:14 <DIR> d--h-c--- c:\windows\ie8

2009-03-29 11:09 . 2009-03-29 11:20 <DIR> d-------- c:\windows\SxsCaPendDel

2009-03-27 02:28 . 2009-03-27 02:28 <DIR> d-------- c:\program files\PTGui

2009-03-27 02:28 . 2009-03-30 21:57 <DIR> d-------- c:\documents and settings\md\Application Data\PTGui

2009-03-26 06:14 . 2008-11-20 12:19 9,200 --------- c:\windows\system32\drivers\cdralw2k.sys

2009-03-26 06:14 . 2008-11-20 12:19 9,072 --------- c:\windows\system32\drivers\cdr4_xp.sys

2009-03-26 06:11 . 2009-03-26 06:11 <DIR> d-------- c:\windows\system32\IOSUBSYS

2009-03-25 04:46 . 2009-03-25 04:46 <DIR> d-------- c:\documents and settings\md\Application Data\Canon

2009-03-25 04:45 . 2009-03-27 00:54 <DIR> d-------- c:\documents and settings\All Users\Application Data\PhotoStitch

2009-03-25 04:30 . 2009-03-25 04:30 <DIR> d-------- c:\program files\Avira

2009-03-25 04:30 . 2009-03-25 04:30 <DIR> d-------- c:\documents and settings\All Users\Application Data\Avira

2009-03-25 04:30 . 2009-02-13 11:31 55,640 --a------ c:\windows\system32\drivers\avgntflt.sys

2009-03-24 17:26 . 2009-03-24 17:26 <DIR> d-------- c:\program files\Common Files\postureAgent

2009-03-24 17:26 . 2007-11-09 16:18 920,088 --a------ c:\windows\system32\mesoludlg.exe

2009-03-24 17:26 . 2006-11-10 09:25 319,456 --a------ c:\windows\system32\difxapi.dll

2009-03-24 08:15 . 2009-03-24 08:15 <DIR> d-------- c:\program files\Canon

2009-03-24 08:14 . 2009-03-24 08:14 <DIR> d-------- c:\program files\Common Files\Canon

2009-03-20 11:50 . 2009-03-20 11:50 3,358,720 --a------ c:\windows\system32\GPhotos.scr

2009-03-14 07:02 . 2009-03-14 07:02 <DIR> d-------- c:\documents and settings\md\Application Data\.Kanton ZH

2009-03-14 04:59 . 2009-03-14 04:59 <DIR> d--h----- c:\program files\Zero G Registry

2009-03-14 04:59 . 2009-03-14 05:08 <DIR> d-------- c:\program files\Private Tax 2008

2009-03-14 04:58 . 2009-03-14 04:58 <DIR> d--h----- c:\documents and settings\md\InstallAnywhere

2009-03-12 17:22 . 2008-04-13 17:12 221,184 --a------ c:\windows\system32\wmpns.dll

2009-03-12 07:40 . 2009-03-12 07:40 <DIR> d-------- c:\program files\FreePDF_XP

2009-03-12 07:40 . 2009-03-12 07:41 <DIR> d-------- c:\documents and settings\All Users\FreePDF

2009-03-12 07:40 . 2008-02-25 14:23 119,152 --a------ c:\windows\system32\redmon.hlp

2009-03-12 07:40 . 2008-02-25 14:23 116,224 --a------ c:\windows\system32\redmonnt.dll

2009-03-12 07:40 . 2008-02-25 14:23 45,056 --a------ c:\windows\system32\unredmon.exe

2009-03-08 14:22 . 2009-03-08 14:22 49,152 --------- c:\windows\system32\msrating.dll.mui

2009-03-08 14:22 . 2009-03-08 14:22 2,560 --------- c:\windows\system32\mshta.exe.mui

2009-03-08 14:21 . 2009-03-08 14:21 4,096 --------- c:\windows\system32\ie4uinit.exe.mui

2009-03-08 14:20 . 2009-03-08 14:20 81,920 --------- c:\windows\system32\iedkcs32.dll.mui

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-04-01 07:28 --------- d-----w c:\documents and settings\md\Application Data\Skype

2009-04-01 07:15 --------- d-----w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy

2009-04-01 07:02 --------- d-----w c:\documents and settings\md\Application Data\skypePM

2009-03-31 04:58 --------- d-----w c:\documents and settings\md\Application Data\MAXON

2009-03-29 18:44 410,984 ----a-w c:\windows\system32\deploytk.dll

2009-03-28 08:56 --------- d-----w c:\program files\Malwarebytes' Anti-Malware

2009-03-28 08:36 --------- d-----w c:\program files\Spybot - Search & Destroy

2009-03-27 09:19 --------- d-----w c:\documents and settings\md\Application Data\Azureus

2009-03-26 23:49 38,496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys

2009-03-26 23:49 15,504 ----a-w c:\windows\system32\drivers\mbam.sys

2009-03-26 13:11 --------- d-----w c:\program files\Google

2009-03-25 00:26 --------- d-----w c:\program files\Intel

2009-03-16 10:09 --------- d-----w c:\program files\Common Files\Adobe

2009-03-13 00:22 --------- d-----w c:\documents and settings\All Users\Application Data\Microsoft Help

2009-03-12 16:10 --------- d-----w c:\documents and settings\All Users\Application Data\Apple Computer

2009-03-08 14:59 --------- d-----w c:\program files\Vuze

2009-03-08 11:34 914,944 ----a-w c:\windows\system32\wininet.dll

2009-03-08 11:34 43,008 ----a-w c:\windows\system32\licmgr10.dll

2009-03-08 11:33 420,352 ----a-w c:\windows\system32\vbscript.dll

2009-03-08 11:33 18,944 ----a-w c:\windows\system32\corpol.dll

2009-03-08 11:32 72,704 ----a-w c:\windows\system32\admparse.dll

2009-03-08 11:32 71,680 ----a-w c:\windows\system32\iesetup.dll

2009-03-08 11:31 48,128 ----a-w c:\windows\system32\mshtmler.dll

2009-03-08 11:31 45,568 ----a-w c:\windows\system32\mshta.exe

2009-03-08 11:31 34,816 ----a-w c:\windows\system32\imgutil.dll

2009-03-08 11:22 156,160 ----a-w c:\windows\system32\msls31.dll

2009-03-02 10:58 --------- d-----w c:\documents and settings\md\Application Data\gtk-2.0

2009-02-23 23:09 --------- d-----w c:\program files\CCleaner

2009-02-09 11:13 1,846,784 ----a-w c:\windows\system32\win32k.sys

2009-01-08 01:21 26,144 ----a-w c:\windows\system32\spupdsvc.exe

2009-01-08 01:20 265,720 ----a-w c:\windows\system32\msdbg2.dll

2009-01-08 01:20 26,112 ----a-w c:\windows\system32\idndl.dll

2009-01-08 01:20 24,576 ----a-w c:\windows\system32\nlsdl.dll

2009-01-08 01:20 23,552 ----a-w c:\windows\system32\normaliz.dll

2008-03-15 00:46 32 ----a-w c:\documents and settings\All Users\Application Data\ezsid.dat

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\1TortoiseSVN]

@="{30351346-7B7D-4FCC-81B4-1E394CA267EB}"

[HKEY_CLASSES_ROOT\CLSID\{30351346-7B7D-4FCC-81B4-1E394CA267EB}]

2008-01-05 06:03 536576 --a------ c:\program files\TortoiseSVN\bin\tortoisesvn.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\2TortoiseSVN]

@="{30351347-7B7D-4FCC-81B4-1E394CA267EB}"

[HKEY_CLASSES_ROOT\CLSID\{30351347-7B7D-4FCC-81B4-1E394CA267EB}]

2008-01-05 06:03 536576 --a------ c:\program files\TortoiseSVN\bin\tortoisesvn.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\3TortoiseSVN]

@="{30351348-7B7D-4FCC-81B4-1E394CA267EB}"

[HKEY_CLASSES_ROOT\CLSID\{30351348-7B7D-4FCC-81B4-1E394CA267EB}]

2008-01-05 06:03 536576 --a------ c:\program files\TortoiseSVN\bin\tortoisesvn.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\4TortoiseSVN]

@="{3035134B-7B7D-4FCC-81B4-1E394CA267EB}"

[HKEY_CLASSES_ROOT\CLSID\{3035134B-7B7D-4FCC-81B4-1E394CA267EB}]

2008-01-05 06:03 536576 --a------ c:\program files\TortoiseSVN\bin\tortoisesvn.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\5TortoiseSVN]

@="{3035134C-7B7D-4FCC-81B4-1E394CA267EB}"

[HKEY_CLASSES_ROOT\CLSID\{3035134C-7B7D-4FCC-81B4-1E394CA267EB}]

2008-01-05 06:03 536576 --a------ c:\program files\TortoiseSVN\bin\tortoisesvn.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\6TortoiseSVN]

@="{3035134D-7B7D-4FCC-81B4-1E394CA267EB}"

[HKEY_CLASSES_ROOT\CLSID\{3035134D-7B7D-4FCC-81B4-1E394CA267EB}]

2008-01-05 06:03 536576 --a------ c:\program files\TortoiseSVN\bin\tortoisesvn.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\7TortoiseSVN]

@="{3035134E-7B7D-4FCC-81B4-1E394CA267EB}"

[HKEY_CLASSES_ROOT\CLSID\{3035134E-7B7D-4FCC-81B4-1E394CA267EB}]

2008-01-05 06:03 536576 --a------ c:\program files\TortoiseSVN\bin\tortoisesvn.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Cpqset"="c:\program files\Hewlett-Packard\Default Settings\cpqset.exe" [2007-05-03 57344]

"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2007-01-05 872448]

"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-01-21 61440]

"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-01-05 413696]

"FreePDF Assistant"="c:\program files\FreePDF_XP\fpassist.exe" [2008-07-22 357376]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]

"atchk"="c:\program files\Intel\AMT\atchk.exe" [2007-11-09 408088]

"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]

"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-29 148888]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-13 15360]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]

"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2008-05-26 304128]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]

2008-07-23 07:28 352256 c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]

"msacm.l3fhg"= mp3fhg.acm

"msacm.divxa32"= divxa32.acm

"VIDC.X264"= x264vfw.dll

"VIDC.HFYU"= huffyuv.dll

"vidc.i263"= i263_32.drv

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Windows Search.lnk]

path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Windows Search.lnk

backup=c:\windows\pss\Windows Search.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AccelerometerSysTrayApplet]

--a------ 2007-01-24 06:28 124928 c:\windows\system32\accelerometerST.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]

--a------ 2009-02-27 09:10 35696 c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]

--a----t- 2009-01-02 02:49 133104 c:\documents and settings\md\Local Settings\Application Data\Google\Update\GoogleUpdate.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]

--a------ 2007-05-08 07:24 54840 c:\program files\Hp\HP Software Update\hpwuSchd2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]

--a------ 2009-01-05 08:18 413696 c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SPC1300]

--a------ 2007-05-31 07:54 675840 c:\windows\vspc1300.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]

--a------ 2009-03-29 11:44 148888 c:\program files\Java\jre6\bin\jusched.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\Autodesk\\3ds Max 2008\\3dsmax.exe"=

"c:\\Program Files\\Messenger\\msmsgs.exe"=

"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=

"c:\\Program Files\\Vuze\\Azureus.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\Program Files\\MATLAB\\R2008a\\bin\\win32\\MATLAB.exe"=

"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=

"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=

"c:\\Program Files\\Orb Networks\\Orb\\bin\\Orb.exe"=

"c:\\Program Files\\Orb Networks\\Orb\\bin\\OrbTray.exe"=

"c:\\Program Files\\Orb Networks\\Orb\\bin\\OrbStreamerClient.exe"=

"c:\\Program Files\\Orb Networks\\Orb\\bin\\OrbChannelScan.exe"=

"c:\\Program Files\\Next Limit\\Maxwell\\mxcl.exe"=

"c:\\WINDOWS\\system32\\ftp.exe"=

"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [2008-11-17 8944]

R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [2008-11-17 55024]

R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [2009-03-25 108289]

R2 UNS;Intel® Active Management Technology User Notification Service;c:\program files\Intel\AMT\UNS.exe [2009-03-24 1464856]

R3 AtiHdmiService;ATI Function Driver for HDMI Service;c:\windows\system32\drivers\AtiHdmi.sys [2007-07-20 89600]

S3 getPlus® Helper;getPlus® Helper;c:\program files\NOS\bin\getPlus_HelperSvc.exe [2009-01-26 33752]

S3 phaudlwr;Philips Audio Filter;c:\windows\system32\drivers\phaudlwr.sys [2008-11-07 88704]

S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [2008-11-17 7408]

S3 sdAuxService;PC Tools Auxiliary Service;c:\program files\Spyware Doctor\pctsAuxs.exe [2008-12-04 356920]

S3 SPC1300;USB2.0 PC Camera (SPC1300);c:\windows\system32\drivers\spc1300.sys [2008-11-07 3033728]

S4 msvsmon80;Visual Studio 2005 Remote Debugger;c:\program files\Microsoft Visual Studio 8\Common7\IDE\Remote Debugger\x86\msvsmon.exe [2006-12-01 2805000]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1fadd2b8-1cf1-11de-b451-0013e8e1a867}]

\Shell\AutoRun\command - F:\setup.exe

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]

"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP

.

Contents of the 'Scheduled Tasks' folder

2009-03-31 c:\windows\Tasks\AppleSoftwareUpdate.job

- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 03:34]

2009-04-01 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-507921405-764733703-839522115-1003.job

- c:\documents and settings\md\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-01-02 02:49]

.

.

------- Supplementary Scan -------

.

uInternet Settings,ProxyOverride = *.local

uSearchURL,(Default) = hxxp://www.google.com/search?q=%s

IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000

IE: Send to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm

IE: Send To Bluetooth - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm

FF - ProfilePath - c:\documents and settings\md\Application Data\Mozilla\Firefox\Profiles\ryrpastz.default\

FF - prefs.js: browser.startup.homepage - hxxp://mail.google.com/mail/#inbox|http://en-gb.facebook.com/

FF - plugin: c:\documents and settings\md\Local Settings\Application Data\Google\Update\1.2.141.5\npGoogleOneClick7.dll

FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll

FF - plugin: c:\program files\Mozilla Firefox\plugins\np32asw.dll

FF - plugin: c:\program files\Mozilla Firefox\plugins\npcosmop211.dll

FF - plugin: c:\program files\Photosynth\npPhotosynthMozilla.dll

.

**************************************************************************

catchme 0.3.1375 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-04-01 09:52:04

Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run

Cpqset = c:\program files\Hewlett-Packard\Default Settings\cpqset.exe????????T??????????????|?M?|?????M?|&?@

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

.

--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(1488)

c:\program files\SUPERAntiSpyware\SASWINLO.dll

c:\windows\system32\Ati2evxx.dll

.

Completion time: 2009-04-01 10:03:03

ComboFix-quarantined-files.txt 2009-04-01 17:03:00

ComboFix2.txt 2009-03-31 23:48:53

Pre-Run: 12,619,943,936 bytes free

Post-Run: 12,764,839,936 bytes free

251 --- E O F --- 2009-03-29 18:31:37

Link to post
Share on other sites

  • Staff

Hi,

Above log looks clean again btw..

Is your Avira still detecting the same? If so, then let Avira delete it instead of ignoring it (as you did previously):

Beginning disinfection:

C:\WINDOWS\system32\drivers\bovugyuk.sys

[DETECTION] Is the TR/Trash.Gen Trojan

[WARNING] The file was ignored!

Link to post
Share on other sites

No, antivir doesnt detect it anymore. Theres only one warning:

Begin scan in 'C:\WINDOWS\system32'

C:\WINDOWS\system32\drivers\sptd.sys

[WARNING] The file could not be opened!

Hope thats ok. I think I'm going to do some other scans,

and hope to find nothing anymore. Thanks again.

Link to post
Share on other sites

  • Staff

Hi,

The warning is nothing to worry about, I have it as well. It's just because that legitimate file is locked.

You should be ok again. That file that was found previously was just a "trash" file, so it wouldn't do much. The main infection was already removed with the cfscript.

Please read my Prevention page with lots of info and tips how to prevent this in the future.

And if you want to improve speed/system performance after malware removal, take a look here.

Extra note: Make sure your programs are up to date - because older versions may contain Security Leaks. To find out what programs need to be updated, please run the Secunia Software Inspector Scan.

Happy Surfing again!

Link to post
Share on other sites

  • Staff

Since this issue appears resolved ... this Topic is closed.

If you need this topic reopened for continuations of existing problems, please request this by sending me a PM with the address of the thread. This applies only to the original topic starter.

Everyone else please begin a New Topic.

Link to post
Share on other sites

Guest
This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.