Please reveiw - just ran Malwareytes

vmi1816 · May 26, 2009

Hey all,

I've been working with Kaspersky support in an effor to remove a rootkit virus. After following their instructions, they suggested I run your progam and upload my log file.

Can someone check it out and point me in the right direction. I still have several trojans on my PC.

Thanks in advance,

vmi1816

mbam_log_2009_05_25__19_57_08_.txt

negster22 · May 26, 2009

Hello and Welcome,

Please copy/paste your logs into into your topic reply.

Only attach logs, if asked to do so.

Follow the directions in this topic:

http://www.malwarebytes.org/forums/index.php?showtopic=9573

Download DDS and save it to your desktop from here or here

Disable any script blocking programs you may have installed (such as Norton script blocking), and then double-click dss.scr to run the tool.

When done, DDS will open two (2) logs:
- DDS.txt
- Attach.txt
[*]Save both reports to your desktop
[*]Please copy and paste both logs into your next reply,

Post the DDS logs, your MBAM logs, and a HJT log in your next reply please.

vmi1816 · May 26, 2009

Here you go and thanks for the fast reply!

attach.txt

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.

IF REQUESTED, ZIP IT UP & ATTACH IT

DDS (Ver_09-05-14.01)

Microsoft Windows XP Home Edition

Boot Device: \Device\HarddiskVolume1

Install Date: 11/22/2005 8:32:24 PM

System Uptime: 5/26/2009 1:40:44 AM (5 hours ago)

Motherboard: Gateway | |

Processor: Intel® Celeron® M processor 1.40GHz | uFCPGA2 | 1389/400mhz

==== Disk Partitions =========================

C: is FIXED (NTFS) - 49 GiB total, 35.884 GiB free.

D: is FIXED (FAT32) - 7 GiB total, 4.752 GiB free.

E: is CDROM ()

==== Disabled Device Manager Items =============

==== System Restore Points ===================

RP376: 2/27/2009 9:07:03 PM - System Checkpoint

RP377: 3/3/2009 7:30:24 PM - System Checkpoint

RP378: 3/5/2009 9:13:04 PM - System Checkpoint

RP379: 3/12/2009 9:04:18 PM - Software Distribution Service 3.0

RP380: 3/13/2009 8:59:24 PM - Software Distribution Service 3.0

RP381: 3/15/2009 1:00:30 PM - Software Distribution Service 3.0

RP382: 3/18/2009 8:57:20 PM - System Checkpoint

RP383: 3/20/2009 5:55:22 PM - Software Distribution Service 3.0

RP384: 3/23/2009 4:13:59 PM - System Checkpoint

RP385: 3/29/2009 9:19:33 PM - System Checkpoint

RP386: 3/31/2009 8:37:12 PM - System Checkpoint

RP387: 4/3/2009 9:33:21 PM - System Checkpoint

RP388: 4/4/2009 10:29:14 PM - System Checkpoint

RP389: 4/8/2009 6:11:42 PM - System Checkpoint

RP390: 4/9/2009 8:30:46 PM - System Checkpoint

RP391: 4/10/2009 10:40:00 PM - System Checkpoint

RP392: 4/13/2009 6:05:19 PM - System Checkpoint

RP393: 4/14/2009 10:08:04 PM - System Checkpoint

RP394: 4/16/2009 8:12:42 PM - Software Distribution Service 3.0

RP395: 4/17/2009 12:54:53 PM - Software Distribution Service 3.0

RP396: 4/18/2009 4:58:16 PM - System Checkpoint

RP397: 4/20/2009 5:52:07 PM - System Checkpoint

RP398: 4/23/2009 9:56:33 PM - System Checkpoint

RP399: 4/25/2009 9:31:46 PM - System Checkpoint

RP400: 4/27/2009 2:19:44 PM - System Checkpoint

RP401: 4/29/2009 7:24:43 PM - System Checkpoint

RP402: 5/25/2009 8:49:41 PM - System Checkpoint

==== Installed Programs ======================

ABBYY FineReader 6.0 Sprint

Adobe Acrobat and Reader 8.1.2 Security Update 1 (KB403742)

Adobe Flash Player 10 ActiveX

Adobe Flash Player 9 ActiveX

Adobe Flash Player Plugin

Adobe Reader 8.1.2

Adobe Reader 8.1.2 Security Update 1 (KB403742)

Adobe

negster22 · May 26, 2009

You have a new infection that's going around.

Please download ATF Cleaner by Atribune

Close Internet Explorer and any other open browsers
Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.

If you use Firefox browser

Click Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click
No at the prompt.

If you use Opera browser

Click Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.

Click Exit on the Main menu to close the program.

Reboot

Next, download this Antirootkit Program to a folder that you create such as C:\ARK, by choosing the "Download EXE" button on the webpage.

Disable the active protection component of your antivirus by following the directions that apply here:

http://www.bleepingcomputer.com/forums/topic114351.html

Next, please perform a rootkit scan:

Double-click the randomly name EXE located in the C:\ARK folder that you just downloaded to run the program.
When the program opens, it will automatically initiate a very fast scan of common rootkit hiding places.
When that "quick scan" is done, save the scan log to the Windows clipboard
Open Notepad or a similar text editor
Paste the clipboard contents into a text file by clicking Edit | Paste or Ctl V
Exit the Program
Save the Scan log as ARK.txt and post it in your next reply.
Only- if the log is very long attach it please.

Please download Combofix from one of these locations:

HERE or HERE

I want you to rename Combofix.exe as you download it to a name of your choice such as bonkers.exe

Notes:

It is very important that save the newly renamed EXE file to your desktop.
You must rename Combofixe.exe as you download it and not after it is on your computer.
You may have to modify your browser settings if you use Firefox, so you can rename Combofix.exe as you download it. To do that:
For Firefox
- Open Firefox and click Tools -> Options -> Main
- Under the downloads section check the button that says "Always ask me where to save files".
- Click OK
[*]For Internet Explorer:
- When downloading, choose to save, not open the file
- When prompted - save the file to your desktop, and rename it anything with an .exe extension on the end.

Here is a tutorial that describes how to download, install and run Combofix more thoroughly. Please review it and follow the prompts to install Recovery Console if you have not done that already:

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

Very Important! Temporarily disable your antivirus and antimalware real-time protection and any script blocking components of them or your firewall before performing a scan. They can interfere with ComboFix and even remove onboard components so it is rendered ineffective:

http://www.bleepingcomputer.com/forums/topic114351.html

Also, disable your firewall!

You can enable the Window firewall in the interim, until the scan is complete.

Note: The above tutorial does not tell you to rename Combofix as I have instructed you to do in the above instructions, so make sure you complete the renaming step before launching Combofix.

Running Combofix

In the event you already have Combofix, please delete it as this is a new version.

Close any open browsers.
Close/disable all anti-virus and anti-malware programs so they do not interfere with the running of ComboFix.

1. Double click on the renamed combofix.exe (bonkers.exe) & follow the prompts.

2. When finished, it will produce a log file located at C:\ComboFix.txt

3. Post the contents of that log in your next reply with a new hijackthis log.

Note: Do not mouseclick combofix's window while it is running. That may cause your system to stall/hang.

Please post back ARK.txt and C:\Combofix.txt

vmi1816 · May 27, 2009

Hello,

Here are my files.

ark.txt

GMER 1.0.15.14972 - http://www.gmer.net

Rootkit scan 2009-05-26 20:47:29

Windows 5.1.2600 Service Pack 3

---- System - GMER 1.0.15 ----

SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab) ZwEnumerateKey [0xEEC25940]

SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab) ZwEnumerateValueKey [0xEEC259A8]

Code \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab) FsRtlCheckLockForReadAccess

Code \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab) IoIsOperationSynchronous

---- Devices - GMER 1.0.15 ----

AttachedDevice \FileSystem\Fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)

AttachedDevice \Driver\Tcpip \Device\Ip kl1.sys (Kaspersky Unified Driver/Kaspersky Lab)

AttachedDevice \Driver\Tcpip \Device\Tcp kl1.sys (Kaspersky Unified Driver/Kaspersky Lab)

AttachedDevice \Driver\Tcpip \Device\Udp kl1.sys (Kaspersky Unified Driver/Kaspersky Lab)

AttachedDevice \Driver\Tcpip \Device\RawIp kl1.sys (Kaspersky Unified Driver/Kaspersky Lab)

AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.)

AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.)

---- EOF - GMER 1.0.15 ----

combofix.txt

ComboFix 09-05-26.02 - Owner 05/26/2009 20:55.2 - NTFSx86

Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.502.163 [GMT -4:00]

Running from: c:\documents and settings\Owner\Desktop\bonkers.exe

AV: Kaspersky Internet Security *On-access scanning disabled* (Updated) {2C4D4BC6-0793-4956-A9F9-E252435469C0}

FW: Kaspersky Internet Security *disabled* {2C4D4BC6-0793-4956-A9F9-E252435469C0}

.

((((((((((((((((((((((((( Files Created from 2009-04-27 to 2009-05-27 )))))))))))))))))))))))))))))))

.

2009-05-26 23:54 . 2009-05-27 00:46 -------- d-----w C:\ark

2009-05-25 23:10 . 2009-05-25 23:10 -------- d-----w c:\documents and settings\Owner\Application Data\Malwarebytes

2009-05-25 23:09 . 2009-04-06 19:32 15504 ----a-w c:\windows\system32\drivers\mbam.sys

2009-05-25 23:09 . 2009-04-06 19:32 38496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys

2009-05-25 23:09 . 2009-05-26 10:26 -------- d-----w c:\program files\Malwarebytes' Anti-Malware

2009-05-25 23:09 . 2009-05-25 23:09 -------- d-----w c:\documents and settings\All Users\Application Data\Malwarebytes

2009-05-25 23:07 . 2009-05-25 23:07 -------- d-----w c:\documents and settings\Owner\Application Data\gtk-2.0

2009-05-25 22:56 . 2009-05-25 22:57 -------- d-----w c:\program files\ScreenPrint32 v3

2009-05-25 22:56 . 2009-05-25 22:56 249856 ------w c:\windows\Setup1.exe

2009-05-25 22:56 . 2009-05-25 22:56 73216 ----a-w c:\windows\ST6UNST.EXE

2009-05-25 18:03 . 2004-08-04 19:00 50176 -c--a-w c:\windows\system32\dllcache\proquota.exe

2009-05-25 15:03 . 2009-05-25 14:41 19046 ----a-w C:\sysinfo.zip

2009-05-25 14:59 . 2009-05-25 14:59 2 ---h--w c:\windows\sonce122730.dat

2009-05-25 14:59 . 2009-05-25 19:13 -------- d-----w c:\windows\system32\sysloc

2009-05-18 00:25 . 2009-05-18 00:25 23 --sha-w c:\windows\system32\edacded0_x.dat

2009-05-18 00:24 . 2009-05-18 00:25 -------- d-----w c:\program files\jv16 PowerTools 2009

2009-05-16 00:20 . 2009-05-16 00:20 -------- d-----w C:\nitromarketingBonus

2009-05-15 20:54 . 2009-05-16 02:14 -------- d-----w c:\windows\system32\796525

2009-05-10 23:42 . 2009-05-10 23:42 -------- d-----w c:\documents and settings\Owner\.thumbnails

2009-05-01 20:59 . 2004-08-04 19:00 4224 ----a-w c:\windows\system32\drivers\beep.sys

2009-05-01 20:58 . 2009-05-01 20:58 6407 ----a-w c:\windows\system32\krncode.dat

2009-05-01 20:58 . 2009-05-01 20:58 1575 ----a-w c:\windows\system32\pwrcode.dat

2009-05-01 20:58 . 2009-05-01 20:58 19434 ----a-w c:\windows\system32\wincode.dat

2009-05-01 20:58 . 2008-04-14 00:12 17408 ----a-w c:\windows\system32\osysp.dat

2009-05-01 20:58 . 2009-03-21 14:06 989696 ----a-w c:\windows\system32\osysk.dat

2009-05-01 20:58 . 2009-02-20 08:10 666112 ----a-w c:\windows\system32\osysw.dat

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-05-26 23:58 . 2009-01-12 02:56 -------- d-----w c:\documents and settings\All Users\Application Data\Kaspersky Lab

2009-05-26 18:08 . 2007-03-09 02:39 -------- d-----w c:\program files\BrainBullet

2009-05-26 18:05 . 2009-01-12 02:56 2872 --sha-w c:\windows\system32\drivers\fidbox2.idx

2009-05-26 18:05 . 2009-01-12 02:56 524320 --sha-w c:\windows\system32\drivers\fidbox2.dat

2009-05-26 18:05 . 2009-01-12 02:56 2354720 --sha-w c:\windows\system32\drivers\fidbox.dat

2009-05-26 18:05 . 2009-01-12 02:56 19476 --sha-w c:\windows\system32\drivers\fidbox.idx

2009-05-20 23:45 . 2009-01-12 02:58 105395 ----a-w c:\windows\system32\drivers\klin.dat

2009-05-20 23:45 . 2009-01-12 02:58 94643 ----a-w c:\windows\system32\drivers\klick.dat

2009-05-11 20:50 . 2005-11-26 23:24 -------- d-----w c:\program files\Lx_cats

2009-04-18 22:12 . 2008-11-15 17:42 -------- d-----w c:\program files\Finding Notes Easy

2009-03-06 14:22 . 2004-08-26 16:12 284160 ----a-w c:\windows\system32\pdh.dll

2009-05-02 15:59 . 2007-04-22 20:56 67688 ----a-w c:\program files\mozilla firefox\components\jar50.dll

2009-05-02 15:59 . 2007-04-22 20:56 54368 ----a-w c:\program files\mozilla firefox\components\jsd3250.dll

2009-05-02 15:59 . 2007-04-22 20:56 34944 ----a-w c:\program files\mozilla firefox\components\myspell.dll

2009-05-02 15:59 . 2007-04-22 20:56 46712 ----a-w c:\program files\mozilla firefox\components\spellchk.dll

2009-05-02 15:59 . 2007-04-22 20:56 172136 ----a-w c:\program files\mozilla firefox\components\xpinstal.dll

.

((((((((((((((((((((((((((((( SnapShot@2009-05-25_18.06.58 )))))))))))))))))))))))))))))))))))))))))

.

+ 2000-07-15 04:00 . 2000-07-15 04:00 101888 c:\windows\system32\VB6STKIT.DLL

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]

"RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2004-11-03 32768]

"SynTPLpr"="c:\program files\Synaptics\SynTP\SynTPLpr.exe" [2004-11-04 98394]

"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2004-11-04 688218]

"Reminder"="c:\windows\Creator\Remind_XP.exe" [2005-02-25 966656]

"IgfxTray"="c:\windows\system32\igfxtray.exe" [2004-12-24 155648]

"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2004-12-24 118784]

"LXCGCATS"="c:\windows\System32\spool\DRIVERS\W32X86\3\LXCGtime.dll" [2005-04-27 69632]

"lxcgmon.exe"="c:\program files\Lexmark 2300 Series\lxcgmon.exe" [2005-05-04 200704]

"FaxCenterServer"="c:\program files\Lexmark Fax Solutions\fm3032.exe" [2008-03-20 320168]

"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2005-10-08 98304]

"Adobe Photo Downloader"="c:\program files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" [2005-06-07 57344]

"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2007-04-15 185896]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-12 39792]

"lxdxmon.exe"="c:\program files\Lexmark 3600-4600 Series\lxdxmon.exe" [2008-03-20 668328]

"lxdxamon"="c:\program files\Lexmark 3600-4600 Series\lxdxamon.exe" [2008-03-20 16040]

"AVP"="c:\program files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe" [2009-02-06 206088]

"ScreenPrint32"="c:\program files\ScreenPrint32 v3\ScreenPrint32.exe" [2003-05-16 446464]

c:\documents and settings\All Users\Start Menu\Programs\Startup\

BBStartup.lnk.lnk - c:\program files\BrainBullet\BBStartup.exe [2007-3-8 403968]

BigFix.lnk - c:\program files\BigFix\BigFix.exe [2005-10-8 1742384]

Install Pending Files.LNK - c:\program files\SIFXINST\SIFXINST.EXE [2005-10-8 729088]

MiniEYE-MiniREAD Launch.lnk - c:\program files\Infinite Mind LC\eyeQ\ARLaunch.exe [2007-9-2 323584]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]

"AOL ACS"=2 (0x2)

"AOL TopSpeedMonitor"=2 (0x2)

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]

"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=

"c:\\WINDOWS\\system32\\lxcgcoms.exe"=

"c:\\WINDOWS\\system32\\lxdxcoms.exe"=

"c:\\Program Files\\Lexmark 3600-4600 Series\\lxdxamon.exe"=

"c:\\Program Files\\Lexmark 3600-4600 Series\\frun.exe"=

"c:\\Program Files\\Abbyy FineReader 6.0 Sprint\\Scan\\ScanMan6.exe"=

"c:\\Program Files\\Lexmark Fax Solutions\\FaxCtr.exe"=

"c:\\Program Files\\Lexmark 3600-4600 Series\\lxdxmon.exe"=

"c:\\WINDOWS\\system32\\lxdxcfg.exe"=

"c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\lxdxpswx.exe"=

"c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\lxdxjswx.exe"=

"c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\lxdxtime.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [1/29/2008 7:29 PM 33808]

R2 litsgt;litsgt;c:\windows\system32\drivers\litsgt.sys [9/2/2007 11:42 AM 137344]

R2 lxdx_device;lxdx_device;c:\windows\system32\lxdxcoms.exe -service --> c:\windows\system32\lxdxcoms.exe -service [?]

R2 tansgt;tansgt;c:\windows\system32\drivers\tansgt.sys [9/2/2007 11:42 AM 12032]

R3 KLFLTDEV;Kaspersky Lab KLFltDev;c:\windows\system32\drivers\klfltdev.sys [3/13/2008 8:02 PM 26640]

R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\drivers\klim5.sys [4/30/2008 7:06 PM 24592]

--- Other Services/Drivers In Memory ---

*NewlyCreated* - AUJASNKJ

*Deregistered* - aujasnkj

.

Contents of the 'Scheduled Tasks' folder

2005-11-23 c:\windows\Tasks\ISP signup reminder 1.job

- c:\windows\system32\OOBE\oobebaln.exe [2004-08-26 00:12]

2005-11-23 c:\windows\Tasks\ISP signup reminder 2.job

- c:\windows\system32\OOBE\oobebaln.exe [2004-08-26 00:12]

.

- - - - ORPHANS REMOVED - - - -

BHO-{437A43D5-E5C3-4959-BBD0-F2BFB1EDC6FD} - (no file)

.

------- Supplementary Scan -------

.

uStart Page = hxxp://www.kaspersky.com/

mStart Page = hxxp://www.gatewaybiz.com

uInternet Settings,ProxyServer = http=localhost:7171

uInternet Settings,ProxyOverride = *.local;<local>

uSearchURL,(Default) = hxxp://www.google.com/search?q=%s

IE: Add to Banner Ad Blocker - c:\program files\Kaspersky Lab\Kaspersky Internet Security 2009\ie_banner_deny.htm

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

FF - ProfilePath - c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\7m7oly42.default\

FF - prefs.js: browser.search.selectedEngine - Crawler Search

FF - prefs.js: browser.startup.homepage - hxxp://en-us.start.mozilla.com/firefox?client=firefox-a&rls=org.mozilla:en-US:official

FF - component: c:\program files\Mozilla Firefox\components\xpinstal.dll

.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-05-26 20:57

Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run

LXCGCATS = rundll32 c:\windows\System32\spool\DRIVERS\W32X86\3\LXCGtime.dll,_RunDLLEntry@16???????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

.

--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(1320)

c:\windows\system32\igfxsrvc.dll

c:\windows\system32\hccutils.DLL

- - - - - - - > 'explorer.exe'(3080)

c:\windows\system32\WPDShServiceObj.dll

c:\windows\system32\PortableDeviceTypes.dll

c:\windows\system32\PortableDeviceApi.dll

.

Completion time: 2009-05-27 20:59

ComboFix-quarantined-files.txt 2009-05-27 00:59

ComboFix2.txt 2009-05-25 18:12

Pre-Run: 38,504,546,304 bytes free

Post-Run: 38,492,053,504 bytes free

171 --- E O F --- 2009-05-14 00:16

You have a new infection that's going around.
Please download ATF Cleaner by Atribune
Close Internet Explorer and any other open browsers
Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.
If you use Firefox browser
Click Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click
No at the prompt.
If you use Opera browser
Click Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
Click Exit on the Main menu to close the program.
Reboot
Next, download this Antirootkit Program to a folder that you create such as C:\ARK, by choosing the "Download EXE" button on the webpage.
Disable the active protection component of your antivirus by following the directions that apply here:
http://www.bleepingcomputer.com/forums/topic114351.html
Next, please perform a rootkit scan:
Double-click the randomly name EXE located in the C:\ARK folder that you just downloaded to run the program.
When the program opens, it will automatically initiate a very fast scan of common rootkit hiding places.
When that "quick scan" is done, save the scan log to the Windows clipboard
Open Notepad or a similar text editor
Paste the clipboard contents into a text file by clicking Edit | Paste or Ctl V
Exit the Program
Save the Scan log as ARK.txt and post it in your next reply.
Only- if the log is very long attach it please.
Please download Combofix from one of these locations:
HERE or HERE
I want you to rename Combofix.exe as you download it to a name of your choice such as bonkers.exe
Notes:
It is very important that save the newly renamed EXE file to your desktop.
You must rename Combofixe.exe as you download it and not after it is on your computer.
You may have to modify your browser settings if you use Firefox, so you can rename Combofix.exe as you download it. To do that:
For Firefox
Open Firefox and click Tools -> Options -> Main
Under the downloads section check the button that says "Always ask me where to save files".
Click OK
[*]For Internet Explorer:
When downloading, choose to save, not open the file
When prompted - save the file to your desktop, and rename it anything with an .exe extension on the end.
Here is a tutorial that describes how to download, install and run Combofix more thoroughly. Please review it and follow the prompts to install Recovery Console if you have not done that already:
http://www.bleepingcomputer.com/combofix/how-to-use-combofix
Very Important! Temporarily disable your antivirus and antimalware real-time protection and any script blocking components of them or your firewall before performing a scan. They can interfere with ComboFix and even remove onboard components so it is rendered ineffective:
http://www.bleepingcomputer.com/forums/topic114351.html
Also, disable your firewall!
You can enable the Window firewall in the interim, until the scan is complete.
Note: The above tutorial does not tell you to rename Combofix as I have instructed you to do in the above instructions, so make sure you complete the renaming step before launching Combofix.
Running Combofix
In the event you already have Combofix, please delete it as this is a new version.
Close any open browsers.
Close/disable all anti-virus and anti-malware programs so they do not interfere with the running of ComboFix.
1. Double click on the renamed combofix.exe (bonkers.exe) & follow the prompts.
2. When finished, it will produce a log file located at C:\ComboFix.txt
3. Post the contents of that log in your next reply with a new hijackthis log.
Note: Do not mouseclick combofix's window while it is running. That may cause your system to stall/hang.
Please post back ARK.txt and C:\Combofix.txt

negster22 · May 27, 2009

Can I see your first Combofix report please:

ComboFix2.txt 2009-05-25 18:12

vmi1816 · May 27, 2009

Hi,

I included the combofix in my last post but I renamed the file from combofix2 to combofix.

Thanks!

Can I see your first Combofix report please:
ComboFix2.txt 2009-05-25 18:12

vmi1816 · May 27, 2009

I am sorry,

Here's an earlier version. I may have deleted the combofix2 file. Can u use this file?

ComboFix 09-05-25.01 - Owner 05/25/2009 13:58.1 - NTFSx86

Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.502.204 [GMT -4:00]

Running from: C:\123.exe

AV: Kaspersky Internet Security *On-access scanning disabled* (Updated) {2C4D4BC6-0793-4956-A9F9-E252435469C0}

FW: Kaspersky Internet Security *disabled* {2C4D4BC6-0793-4956-A9F9-E252435469C0}

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

C:\123.exe

c:\documents and settings\Owner\Application Data\wiaserva.log

c:\documents and settings\Owner\Desktop\Error Cleaner.url

c:\documents and settings\Owner\Desktop\Privacy Protector.url

c:\documents and settings\Owner\Favorites\Privacy Protector.url

c:\documents and settings\Owner\Favorites\Spyware&Malware Protection.url

C:\SYS32DLL.bat

c:\windows\ld08.exe

c:\windows\new_drv.sys

c:\windows\pp10.exe

c:\windows\rs.txt

c:\windows\search_res.txt

c:\windows\st_1242343511.exe

c:\windows\st_1242351379.exe

c:\windows\st_1242434008.exe

c:\windows\system32\218538

c:\windows\system32\drivers\UACxylkspypdvbqegb.sys

c:\windows\system32\lowsec

c:\windows\system32\lowsec\local.ds

c:\windows\system32\lowsec\user.ds

c:\windows\system32\SYSDLL.exe

c:\windows\system32\UACdjwhxvrbdisteti.dll

c:\windows\system32\uacinit.dll

c:\windows\system32\UACnqfewthniwbeuom.log

c:\windows\system32\UACpbnmpxthexjecfq.dll

c:\windows\system32\UACppjwswqblovbrsb.dat

c:\windows\system32\UACqplvtakcrjqvjei.dll

c:\windows\system32\UACrfgivrqopxmewlf.log

c:\windows\system32\UACsnvsilivowfutmn.dll

c:\windows\system32\UACubdtkbmuepwojes.log

c:\windows\system32\UACxcymrmdtmafrgxr.dll

c:\windows\system32\wbem\grpconv.exe

c:\windows\system32\wbem\proquota.exe

c:\windows\t55ft2692f44.dat

c:\windows\t55ft3189f44.dat

D:\Autorun.inf

D:\Desktop.ini

%~1 was missing

Restored copy from - %~2

%~1 was missing

Restored copy from - %~2

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Service_UACd.sys

-------\Legacy_NEW_DRV

((((((((((((((((((((((((( Files Created from 2009-04-25 to 2009-05-25 )))))))))))))))))))))))))))))))

.

2009-05-25 18:03 . 2004-08-04 19:00 50176 -c--a-w c:\windows\system32\dllcache\proquota.exe

2009-05-25 15:03 . 2009-05-25 14:41 19046 ----a-w C:\sysinfo.zip

2009-05-25 14:59 . 2009-05-25 14:59 2 ---h--w c:\windows\sonce122730.dat

2009-05-25 14:59 . 2009-05-25 14:59 -------- d-----w c:\windows\system32\sysloc