Win32TrojanTDSS

[doac00]

I posted in the general section and was instructed to use rootrepeal to rid myself of the rookit system file, which I did, and thus then managed to run MBAM to do it's stuff. I then removed 7 objects that where found. I thus need to find out if the PC is now clean and hence can someone look at the HJack report and MBAM report shown below;

Thanks in advance!

Malwarebytes' Anti-Malware 1.37

Database version: 2255

Windows 5.1.2600 Service Pack 3

09/06/2009 19:21:26

mbam-log-2009-06-09 (19-21-26).txt

Scan type: Quick Scan

Objects scanned: 75970

Time elapsed: 4 minute(s), 28 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 1

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 6

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

HKEY_LOCAL_MACHINE\SOFTWARE\UAC (Rootkit.Trace) -> Quarantined and deleted successfully.

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

c:\WINDOWS\system32\UAClybpyqyrsrqsdrr.dll (Trojan.TDSS) -> Quarantined and deleted successfully.

c:\WINDOWS\system32\UACtowylvrdopclteh.dll (Trojan.TDSS) -> Quarantined and deleted successfully.

c:\WINDOWS\Temp\UAC7c3f.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.

c:\WINDOWS\Temp\UAC89bc.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\uacinit.dll (Trojan.Agent) -> Quarantined and deleted successfully.

c:\WINDOWS\system32\drivers\UACipfulksentsaypu.sys (Trojan.Agent) -> Quarantined and deleted successfully.

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 19:32:40, on 09/06/2009

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16827)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

F:\PROGRA~1\AVG\AVG8\avgwdsvc.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\WINDOWS\system32\svchost.exe

F:\PROGRA~1\AVG\AVG8\avgrsx.exe

F:\PROGRA~1\AVG\AVG8\avgemc.exe

F:\PROGRA~1\AVG\AVG8\avgnsx.exe

F:\Program Files\AVG\AVG8\avgcsrvx.exe

C:\WINDOWS\Explorer.EXE

F:\PROGRA~1\AVG\AVG8\avgtray.exe

C:\WINDOWS\ALCXMNTR.EXE

C:\Program Files\iTunes\iTunesHelper.exe

C:\Program Files\Java\jre6\bin\jusched.exe

C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Windows Media Player\WMPNSCFG.exe

F:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe

C:\Program Files\Belkin\Switch2\Switch2.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - F:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - F:\Program Files\AVG\AVG8\avgssie.dll

O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

O4 - HKLM\..\Run: [AVG8_TRAY] F:\PROGRA~1\AVG\AVG8\avgtray.exe

O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"

O4 - HKLM\..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [\\POWER-PC\EPSON Stylus Photo RX560 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIBPE.EXE /FU "C:\DOCUME~1\THEDOA~1\LOCALS~1\Temp\E_S3.tmp" /EF "HKCU"

O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O4 - Startup: Switch2.lnk = ?

O4 - Global Startup: Adobe Reader Speed Launch.lnk = F:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe

O4 - Global Startup: ColorVisionStartup.lnk = C:\Program Files\ColorVision\Utility\ColorVisionStartup.exe

O4 - Global Startup: Microsoft Office.lnk = F:\Program Files\Mircosoft Office\Office\OSA9.EXE

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w3/resources/MSNPUpld.cab

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab

O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - F:\Program Files\AVG\AVG8\avgpp.dll

O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll

O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - F:\PROGRA~1\AVG\AVG8\avgemc.exe

O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - F:\PROGRA~1\AVG\AVG8\avgwdsvc.exe

O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe

O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe

O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe

[doac00]

Can anybody please help and do a quick check of the logs - do I need any more steps like combofix etc..??

Thanks kindly

[miekiemoes]

Hi,

Yes, it may be a good idea to run Combofix as well. Post this log in your next reply so I can have a look.

Extra note... I see you are running AdWatch.

I suggest you disable it because it can interfere with the fixes.

To disable AdWatch:

* Right click on the Ad-Watch icon in the system tray.

* At the bottom of the screen there will be two checkable items called Active and Automatic.

o Active: This will turn Ad-Watch On\Off without closing it.

o Automatic: Suspicious activity will be blocked automatically.

* Uncheck both of those boxes.

* (When done, you can re-enable it using the same steps but this time check both boxes.)

[doac00]

ok will do - right I know combofix needs to be run from the desktop - is there an option just to scan and log or is that the defualt behaviour prior to cut and pasting a notepad file onto it??

I'd do this, this evening when I can fire up the home PC again to run it - have Combofix on my pen-drive ready to rock and roll.

[miekiemoes]

s there an option just to scan and log or is that the defualt behaviour prior to cut and pasting a notepad file onto it??

You don't have to cut and paste anything.

Just download Combofix to your desktop and doubleclick to run.

[doac00]

Combofix log.

ComboFix 09-06-08.05 - The Doaney's 10/06/2009 18:42.1 - NTFSx86

Microsoft Windows XP Home Edition 5.1.2600.3.1252.44.1033.18.1023.628 [GMT 1:00]

Running from: c:\documents and settings\The Doaney's\Desktop\ComboFix.exe

AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\windows\system32\UACqpabwwasmmkndrs.dat

G:\Autorun.inf

G:\Desktop.ini

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Service_UACd.sys

((((((((((((((((((((((((( Files Created from 2009-05-10 to 2009-06-10 )))))))))))))))))))))))))))))))

.

2009-06-09 17:28 . 2009-06-09 17:28 -------- d-----w- c:\documents and settings\The Doaney's\Application Data\Malwarebytes

2009-06-08 17:49 . 2009-05-26 12:20 40160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2009-06-08 17:49 . 2009-06-08 17:57 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2009-06-08 17:49 . 2009-06-08 17:49 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes

2009-06-08 17:49 . 2009-05-26 12:19 19096 ----a-w- c:\windows\system32\drivers\mbam.sys

2009-06-08 17:20 . 2009-06-08 17:20 -------- d-----w- c:\program files\Trend Micro

2009-06-08 17:15 . 2009-06-08 17:15 -------- d-----w- c:\documents and settings\All Users\Application Data\TEMP

2009-06-08 17:15 . 2009-06-08 17:15 -------- d-----w- c:\program files\SpywareBlaster

2009-06-07 12:15 . 2009-06-07 12:03 15688 ----a-w- c:\windows\system32\lsdelete.exe

2009-06-07 12:01 . 2009-06-07 12:01 -------- dc-h--w- c:\documents and settings\All Users\Application Data\{7972B2E5-3E09-4E5E-81B7-FE5819D6772F}

2009-06-07 12:01 . 2009-03-12 08:17 2902048 -c--a-w- c:\documents and settings\All Users\Application Data\{7972B2E5-3E09-4E5E-81B7-FE5819D6772F}\Ad-AwareAE.exe

2009-06-07 12:01 . 2009-06-07 12:01 -------- d-----w- c:\program files\Lavasoft

2009-06-07 12:01 . 2009-06-07 12:01 -------- d-----w- c:\documents and settings\All Users\Application Data\Lavasoft

2009-06-07 08:21 . 2009-06-07 08:47 -------- d-----w- c:\documents and settings\The Doaney's\Application Data\Lavasoft

2009-05-25 08:26 . 2009-05-25 08:26 152576 ----a-w- c:\documents and settings\The Doaney's\Application Data\Sun\Java\jre1.6.0_13\lzma.dll

2009-05-12 17:32 . 2009-05-12 17:32 -------- d-----w- c:\program files\iPod

2009-05-12 17:32 . 2009-05-12 17:32 -------- d-----w- c:\program files\iTunes

2009-05-12 17:32 . 2009-05-12 17:32 -------- d-----w- c:\documents and settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}

2009-05-12 17:30 . 2009-05-12 17:30 -------- d-----w- c:\program files\Bonjour

2009-05-12 17:28 . 2009-05-12 17:29 -------- d-----w- c:\program files\QuickTime

2009-05-12 17:24 . 2009-05-12 17:24 75048 ----a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 8.1.1.10\SetupAdmin.exe

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-05-25 08:28 . 2008-09-07 18:42 -------- d-----w- c:\program files\Java

2009-05-23 19:46 . 2008-09-07 18:44 -------- d-----w- c:\documents and settings\The Doaney's\Application Data\Azureus

2009-05-12 17:32 . 2008-12-25 12:05 -------- d-----w- c:\program files\Common Files\Apple

2009-05-11 09:24 . 2008-08-17 19:41 11952 ----a-w- c:\windows\system32\avgrsstx.dll

2009-05-11 09:24 . 2008-08-17 19:41 325896 ----a-w- c:\windows\system32\drivers\avgldx86.sys

2009-05-11 09:24 . 2008-08-17 19:41 27784 ----a-w- c:\windows\system32\drivers\avgmfx86.sys

2009-05-11 09:24 . 2008-08-17 19:41 108552 ----a-w- c:\windows\system32\drivers\avgtdix.sys

2009-05-02 07:36 . 2008-09-13 18:23 7114736 ----a-w- c:\documents and settings\The Doaney's\Application Data\Azureus\plugins\azemp\azmplay.exe

2009-03-19 15:32 . 2009-03-19 15:32 23400 ----a-w- c:\documents and settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}\x86\x86\GEARAspiWDM.sys

2009-03-19 15:32 . 2008-12-25 12:08 23400 ----a-w- c:\windows\system32\drivers\GEARAspiWDM.sys

2009-03-18 18:59 . 2009-03-18 18:59 152576 ----a-w- c:\documents and settings\The Doaney's\Application Data\Sun\Java\jre1.6.0_10\lzma.dll

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

"\\POWER-PC\EPSON Stylus Photo RX560 Series"="c:\windows\System32\spool\DRIVERS\W32X86\3\E_FATIBPE.EXE" [2006-05-23 139264]

"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2006-10-19 204288]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"AVG8_TRAY"="f:\progra~1\AVG\AVG8\avgtray.exe" [2009-05-11 1947928]

"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-01-05 413696]

"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-04-02 342312]

"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-09 148888]

"Ad-Watch"="c:\program files\Lavasoft\Ad-Aware\AAWTray.exe" [2009-06-07 518488]

"AlcxMonitor"="ALCXMNTR.EXE" - c:\windows\Alcxmntr.exe [2004-09-07 57344]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\The Doaney's\Start Menu\Programs\Startup\

Switch2.lnk - c:\documents and settings\The Doaney's\Application Data\Microsoft\Installer\{067B5E9A-A4BA-4BF2-AFF2-6D5414B2E88A}\NewShortcut1_067B5E9AA4BA4BF2AFF26D5414B2E88A.exe [2008-8-18 135168]

c:\documents and settings\All Users\Start Menu\Programs\Startup\

Adobe Reader Speed Launch.lnk - f:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-9-23 29696]

ColorVisionStartup.lnk - c:\program files\ColorVision\Utility\ColorVisionStartup.exe [2006-1-31 385024]

Microsoft Office.lnk - f:\program files\Mircosoft Office\Office\OSA9.EXE [1999-2-17 65588]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]

2009-05-11 09:24 11952 ----a-w- c:\windows\system32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]

@="Service"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"f:\\Program Files\\AVG\\AVG8\\avgemc.exe"=

"f:\\Program Files\\AVG\\AVG8\\avgupd.exe"=

"c:\\Program Files\\Messenger\\msmsgs.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=

"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=

"f:\\Program Files\\Azureus\\Azureus.exe"=

"c:\\Program Files\\Logitech\\Logitech Harmony Remote Software 7\\HarmonyRemote.exe"=

"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=

"c:\\Program Files\\iTunes\\iTunes.exe"=

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [07/06/2009 13:03 64160]

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [17/08/2008 20:41 325896]

R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [17/08/2008 20:41 108552]

R2 avg8emc;AVG Free8 E-mail Scanner;f:\progra~1\AVG\AVG8\avgemc.exe [13/08/2008 22:42 908568]

R2 avg8wd;AVG Free8 WatchDog;f:\progra~1\AVG\AVG8\avgwdsvc.exe [13/08/2008 22:42 298776]

S2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [09/03/2009 20:06 1005904]

S3 TNET1130;D-Link AirPlus XtremeG+ Wireless Adapter;c:\windows\system32\drivers\GPLUS.sys [08/02/2009 15:19 202496]

.

Contents of the 'Scheduled Tasks' folder

2009-06-07 c:\windows\Tasks\Ad-Aware Update (Weekly).job

- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-03-09 12:03]

2009-05-11 c:\windows\Tasks\AppleSoftwareUpdate.job

- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 12:34]

.

- - - - ORPHANS REMOVED - - - -

SafeBoot-procexp90.Sys

.

------- Supplementary Scan -------

.

uStart Page = hxxp://www.google.com/

uInternet Settings,ProxyOverride = *.local

.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-06-10 18:47

Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

.

--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(2768)

c:\windows\system32\WPDShServiceObj.dll

c:\windows\system32\PortableDeviceTypes.dll

c:\windows\system32\PortableDeviceApi.dll

.

------------------------ Other Running Processes ------------------------

.

c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

c:\program files\Bonjour\mDNSResponder.exe

c:\program files\Java\jre6\bin\jqs.exe

c:\program files\Windows Media Player\wmpnetwk.exe

f:\program files\AVG\AVG8\avgrsx.exe

f:\progra~1\AVG\AVG8\avgnsx.exe

f:\program files\AVG\AVG8\avgcsrvx.exe

c:\windows\system32\wscntfy.exe

c:\program files\Belkin\Switch2\Switch2.exe

c:\program files\iPod\bin\iPodService.exe

.

**************************************************************************

.

Completion time: 2009-06-10 18:49 - machine was rebooted

ComboFix-quarantined-files.txt 2009-06-10 17:49

Pre-Run: 7,819,816,960 bytes free

Post-Run: 7,801,417,728 bytes free

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe

[boot loader]

timeout=2

default=signature(ea1aa9c7)disk(0)rdisk(0)partition(1)\WINDOWS

[operating systems]

c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

signature(ea1aa9c7)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect

157 --- E O F --- 2009-05-14 06:34

[doac00]

Mieke,

Any chance you could quickly check the combofix log and let me know the PC is "clean" again - it seems to be functioning fine now but that doesn't mean it's still not got something sinister still lurking.

Thanks

[miekiemoes]

Any chance you could quickly check the combofix log and let me know the PC is "clean" again

Sure, otherwise I wouldn't ask for the logs

I see Combofix deleted the leftovers, so the rest looks clean again.

* Go to start > run and copy and paste next command in the field:

ComboFix /u

Make sure there's a space between Combofix and /

Then hit enter.

This will uninstall Combofix, delete its related folders and files, reset your clock settings, hide file extensions, hide the system/hidden files and resets System Restore again.

Also,

Please read my Prevention page with lots of info and tips how to prevent this in the future.

And if you want to improve speed/system performance after malware removal, take a look here.

Extra note: Make sure your programs are up to date - because older versions may contain Security Leaks. To find out what programs need to be updated, please run the Secunia Software Inspector Scan.

Happy Surfing again!

[doac00]

Mieke,

Thank you very much - your time on this is much appreciated. I have one small issue - I deleted Combofix off my PC already by hitting the delete key. I may have even cleaned the recycle bin and run CCleaner so here is the question. If I install combofix off my pen drive again onto the desktop can I still run the command prompt to uninstall it or would it need to have been the original one?

I may not have cleaned the recycle bin so I'll check first and pop that back onto desktop and run the uninstall.

Sorry about that - ahead of myself.

Wife will be happy to surf again and I'll read your prevention page. I now have AVG, Ad Aware and an active-X watcher activated so will probably need to read your speed up page as well ;-)

Regard and thanks again.

[miekiemoes]

Hi,

Don't worry if you have deleted it manually already. Just delete the C:\qoobox folder as well.

And you're most welcome

[doac00]

Ahh okay good news - just remove that directory - shall do.

Thanks again.

A moderator can readily close this now.

[miekiemoes]

Since this issue appears resolved ... this Topic is closed.

If you need this topic reopened for continuations of existing problems, please request this by sending me a PM with the address of the thread. This applies only to the original topic starter.

Everyone else please begin a New Topic.